Chapter 10. Formal Specification. Objectives. To explain why formal specification helps discover problems in system requirements . To describe the use of: Algebraic specification techniques, and Model-based specification techniques (including simple pre- and post-conditions).
(axiomatic, function theoretic)
a “back-end” element of requirements elicitation/analysis/specification/validation
TION NAME > (Gener
< name >
TION NAMES >
iption of the sor
t and its oper
ation signatures setting out the names and the types of
the parameters to the operations defined over the sort
Axioms defining the oper
er the sor
(LISP fans: Tail = CDR, Head = CAR)
( Elem )
A FIFO linear list
Defines a list where elements are added at the end and removed from the front. The operations are Create, which brings an empty list into existence; Cons, which creates a new list with an added member; Length, which evaluates the list size; Head, which evaluates the front element of the list; and Tail, which creates a list by removing the head from its input list. Undefined represents an undefined value of type Elem.
Create → List
Operator names + type info for argument(s) & result
Cons (List, Elem) → List
Head (Create) = Undefined
Head (Cons (L, v)) =
Defines Tail in terms of Create and Cons
Length (Create) = 0
Length (Cons (L, v)) = Length (L) + 1
ail (Create ) = Create
ail (Cons (L, v)) =
ail (L), v)
Tail (Cons ( [5, 7], 9)) = ?
= Cons (Tail ( [5, 7] ), 9) (axiom 6)
= Cons (Tail (Cons (, 7) ) , 9)
= Cons (Cons (Tail (), 7) , 9) (axiom 6)
= Cons (Cons (Tail (Cons ([ ], 5) ), 7) , 9)
= Cons (Cons (Create, 7) , 9) (axiom 6)
= Cons ( , 9)
= [7, 9]
What does Head (Tail (L)) do?
L Head (Tail (L))
[a, b, c]
Are axioms 1-6 sufficient to prove ANY true assertion of the form
Head (Tail (L) ) = v ?
Consider ONE EXAMPLE:
Head (Tail ([a, b]) = b
Head (Tail ([a, b])) = Head (Tail (Cons ([a], b)))
= Head (Cons (Tail ([a]), b)) (axiom 6)
= Head (Cons (Tail (Cons ([ ], a)), b))
= Head (Cons ([ ], b)) (axiom 6)
= b (axiom 2)
So, we can prove Head (Tail ([a, b]) = b using the given axioms, but how could one show that the axioms are sufficient to prove ANY true assertion of the form
Head (Tail (L) ) = v ?
Moral: Showing correctness and completeness of algebraic specifications can be very tricky!
Natural numbers (0, 1, 2, …)
(defines scheme state)
(invariants, pre- & post-conditions)
contents ≤ capacity
Each Z schema has an predicate part which defines conditions that are always true(schema invariants)
For the insulin pump schema, for example, it is always true that:
The dose must be less than or equal to the capacity (= level) of the insulin reservoir.
No single dose may be more than 4 units of insulin and the total dose delivered in a time period must not exceed 25 units of insulin. This is a safety constraint.
display2! shows the amount of insulin to be delivered.
operations change state
imports state & predicates
x′ - value of x after operation
Sort a non-empty array LIST[1..N] into increasing order.
Pre-cond: N ≥ 1
Post-cond: For_Every i, 1 ≤ i ≤ N-1, LIST[i] ≤ LIST[i+1]
Search a non-empty, ordered array LIST[1..N] for the value stored in KEY. If present, set FOUND to true and J to an index of LIST which corresponds to KEY. Otherwise, set FOUND to false.
Pre-cond:N ≥ 1 & [(“LIST is in increasing order”) V (“LIST is in decreasing order”)]
(Exercise: express the “ordered” predicates above FORMALLY.)
Post-cond: [(FOUND & There_Exists i, 1 ≤ i ≤ N | J=i & LIST[J]=Key) V (NOT FOUND & For_Every i, 1 ≤ i ≤ N, LIST[i]≠KEY)] & UNCH(LIST,KEY)