Table Of ContentFormal Specification
Springer
London
Berlin
Heidelberg
New York
Barcelona
Hong Kong
Milan
Paris
Santa Clara
Singapore
Tokyo
Nimal Nissanke
Formal Specification
Techniques and Applications
Springer
Nimal Nissanke, MSc, PhD
Department of Computing Science, University of Reading,
PO Box 225, Whiteknights, Reading RG6 6AY, UK
ISBN-13:978-1-85233-002-6
British Library Cataloguing in Publication Data
Nissanke, Nimal
Formal specification : techniques and applications
l.Software engineering 2.Computer software - Specifications
l.Title
005.1'2 - - 0 73
ISBN -13: 978-1-85233-002-6 e-ISBN -13: 978-1-4471-0791-0
DOl: 10.1007/978-1-4471-0791-0
Library of Congress Cataloging-in-Publication Data
A catalog record for this book is available from the Library of Congress
Apart from any fair dealing for the purposes of research or private study, or criticism or review, as
permitted under the Copyright, Designs and Patents Act 1988, this publication may only be reproduced,
stored or transmitted, in any form or by any means, with the prior permission in writing of the
publishers, or in the case of reprographic reproduction in accordance with the terms of licences issued
by the Copyright Licensing Agency. Enquiries concerning reproduction outside those terms should be
sent to the publishers.
© Springer-V eriagL ondon Limited 1999
The use of registered names, trademarks etc. in this publication does not imply, even in the absence of a
specific statement, that such names are exempt from the relevant laws and regulations and therefore free
for general use.
The publisher makes no representation, express or implied, with regard to the accuracy of the
information contained in this book and cannot accept any legal responsibility or liability for any errors
or omissions that may be made.
Typesetting: Camera ready by author
34/3830-543210 Printed on acid-free paper SPIN 10658790
For Machiko
Preface
Formal specification is the application of mathematics to software specifi
cation, that is, for documenting customer requirements on software. The
objective is to overcome the lack of precision and ambiguity inherent in in
formal specifications, arising primarily from the use of natural language as
the medium of specification. Ill-specified customer requirements have long
been identified as a root cause of many of the problems associated with soft
ware, including software not meeting requirements, delays in software deliv
ery, high and unpredictable development costs and problems in maintenance.
These are major concerns from the points of view of both the customer and
the developer alike. The lack of formality has also been a major concern in
the design and implementation phases of software development. As a result,
mathematical (formal) methods of software development have been an ac
tive area of research, not only in developing approaches and making a case
for such methods but also demonstrating, in the process, their viability in
practical software engineering.
The above achievements, as well as their benefits to the industry, have
been widely recognised by higher educational institutions. As a result, formal
methods now form an important part of both undergraduate and postgrad
uate curricula. Despite the best endeavours of the higher educational insti
tutions, however, the lack of professionals competent in formal methods, at
least in sufficient numbers, continues to be a dominant factor in inhibiting the
industrial use of formal methods. This situation is not helped by academic
backgrounds of students entering higher education, making the successful de
livery of formal methods courses a difficult task. As a result, many students
are unable to profit from courses in the right manner, limiting their achieve
ments in some cases to an awareness rather than a working knowledge. This
book aims to alleviate these difficulties, by placing emphasis on the develop
ment of necessary mathematical skills in one particular area, namely formal
specification, and at the same time giving the student a wider appreciation
of the area. In this way, it is hoped, the book will facilitate greater industrial
use of formal methods.
Being one of the first areas in software engineering to have been subjected
to a mathematical, treatment, formal specification is the most mature area of
formal methods. This explains why this book concentrates on formal speci-
VIII Preface
fication. Despite this, hopefully, the book will make a convincing case for a
wider use of mathematics in software development.
A major part of this book is the result of a course given at the University
of Reading, U.K. However, the book includes a significant amount of ad
vanced material in order to cater for those wishing to acquire a deeper, and
a more comprehensive, understanding. Therefore, the book is also suitable
for the postgraduate student and the professional wishing to acquire a broad
understanding of formal specification techniques.
Most specification languages consist of two easily identifiable ingredients:
a branch of discrete mathematics with a standardised notation as the founda
tion of the language and an extended mathematical notation devised specially
for structuring specifications. In the case of languages such as Z and VDM,
the foundation mathematics consist of predicate logic and set theory.
The study of formal specification can be based on the above distinction
between the branch of mathematics lying at the foundation of the specifica
tion language and the extended notation. This makes the study of standard
mathematics and the study of formal specification two fairly distinct separate
tasks, allowing a smooth progression from the former to the latter. In this
context, most of the standard notation applicable to foundation mathematics
can be found in many texts, including [4, 27, 28, 43, 45, 66]. The text [43] is a
gentle introduction to the subject and motivates the study according to the
needs of formal specification. Separating the two aspects of the specification
language does not, however, imply their independence. Confidence in both
is essential for developing the skills required in formal specification, both
with respect to reading and writing specifications, as well as in mathematical
reasoning about specifications, that is, in proof.
This text also deliberately exposes the reader to more than one popu
lar specification formalism, primarily to make the point that, generally, the
specifier will often have a choice at his disposal. As in everyday life, the tool
must suit the task. The same applies to the language chosen for specification
and, therefore, knowledge of other languages may help in making an informed
choice. On the other hand, these formalisms are interesting from the mathe
matical point of view as well. Turning to the formalisms chosen for exposition
here, the aim of covering VD M has been to broaden the experience. In the
case of algebraic specification, the aim has been both to broaden the experi
ence of specification approaches and deepen the knowledge of mathematics.
Chapter 1 is a general introduction to formal specification and its place
in the wider context of software engineering. It is primarily intended as a mo
tivation for the study but it also discusses some important issues concerning
formal specification.
Chapters 2-7 are devoted to the specification language Z. Chapter 2 in
troduces its extended mathematical notation, namely the Schema Language,
with equal emphasis on its role as a language and its use in specifying state
based systems. It is an informal introduction to the language using small
Preface IX
examples and follows the style of a reference source; this is because the mate
rial concerned is widely available (see the recommended literature). Chapter 3
is a specification case study of reasonable complexity and concerns an air
line booking system. It places great emphasis on writing specifications and,
in particular, on abstraction, modularisation and specification reuse. Chap
ter 4 is the first introduction to specification. It uses the party game Musical
Chairs and the board game Snakes and Ladders as small case studies in or
der to illustrate some ideas in specification, in particular, the decomposition
of systems for the purpose of specification. Chapter 5 is another case study,
developed with the twin aims of specification and as a vehicle for discussion
about proofs in the next chapter. Chapter 6 introduces the reader to different
kinds of proofs encountered in formal methods. However, the material in this
chapter is geared towards establishing logical implement ability of specifica
tions. Chapter 7 is another case study showing the application of a language
like Z to a realistic computational task, namely the specification of a network
protocol. It also shows how one may use Z as a design medium.
Although they continue to use specification constructs of Z, Chapters 8
and 9 are really aimed at widening our experience to other areas. Chapter 8
introduces an object oriented extension of Z and shows how specifications can
be structured differently, namely around objects with a notion of an inter
nal state. Object orientation enables the encapsulation of all the operations
relevant to an object as part of its definition and offers other benefits such
as the avoidance of information replication relying on inheritance. Chapter 9
illustrates the use of a language such as Z for specifying safety requirements
in critical applications. The application of formal methods is seen as essential
to the design of critical systems and this chapter shows the benefits to be
gained, particularly in relation to the specification activity. However, it is to
be noted that different languages offer different capabilities and, therefore,
usage of any particular language in critical systems design may be limited to
different aspects of the system under consideration or to different phases of
the development process.
Chapter 10 is a brief introduction to the specification language VDM and
relies on experience with Z. This is achieved primarily through a comparison
of the two languages, but should be sufficient to demonstrate the similarities
between the two languages and that VDM is within easy reach of anyone
with some experience in Z.
Chapters 11 and 12 are devoted to algebraic specification. Chapter 11
introduces algebraic specification in general, dealing with different kinds of
algebras, the relationship between algebraic specifications and associated al
gebras and the widely known initial and terminal algebras and their signifi
cance in specification. Chapter 12 is an introduction to a particular language,
namely CLEAR, in order to illustrate algebraic specification. This is done
using a case study on a filing system.
X Preface
The text includes three appendices. The first two contain exercises which
may be attempted any time after the coverage of the material in Chapter 2.
Depending on the interest of the reader or the course of study, these exercises
may also be used as exercises for Chapters 10 and 11. The exercises at the end
of chapters, if given, concern only the chapter material itself. Appendix A pro
vides two case studies and suggests another from a published reference for the
purpose of improving specification reading skills. Appendix B, on the other
hand, suggests a number of case studies for improving specification writing
skills. Appendix C provides a brief summary of the mathematical notation
used, mainly that of Z. Throughout the book the symbol 0, appearing near
the right hand side margin, signifies the end of an example.
I am grateful to Ali Abdallah for suggestions, stimulating discussions
and encouragement and to Simeon Veloudis for valuable comments on the
manuscript. Certain aspects of the case study on clocks in Chapter 5, Fig
ures 5.1, 5.2, 5.3 and 9.2, and a part of Appendix C also appear in [41]; I am
grateful to Addison Wesley Longman for permission to reuse this material.
lowe a special word of thanks to Rosie Kemp of Springer-Verlag (London)
Ltd for for her patience and advice in bringing this book into existence. lowe
my greatest debt to my family: Machiko, Samaya and Hikaru, for constant
support, understanding and love.
Reading, U.K. 1999 Nimal Nissanke
Contents
1. Introduction.............................................. 1
1.1 Specification and Correctness ... . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 Specification as a Contract .............................. 2
1.3 Specification as a Design Aid ............................ 3
1.4 Specification as a Human Endeavour.. . . . . . . . . . . . . . . . . . . . . 3
1.5 Specification as Abstraction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.6 Modularity in Specifications ............................. 6
1.7 Benefits Beyond Precision ............................... 6
1.8 Formal Specification as an Emerging Technology ........... 8
1.9 Specification Techniques. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2. Schema Language. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 11
2.1 Introduction........................................... 11
2.2 Type Definitions in Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 12
2.2.1 Generic Types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 13
2.2.2 Free (Enumerated) Types ......................... 13
2.2.3 Types Defined by Schemas ........................ 14
2.3 Mathematical Definitions in Z. . . . . . . . . . . . . . . . . . . . . . . . . . .. 14
2.3.1 Schema......................................... 15
2.3.2 Axiomatic Definitions. . . . . . . . . . . . . . . . . . . . . . . . . . . .. 15
2.3.3 Generic Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 16
2.4 Presentation of Schemas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 17
2.5 Schema Manipulation. . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . .. 18
2.5.1 Schema Extension. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 19
2.5.2 Merging Schemas. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 20
2.5.3 Schema Negation.. . . . . .. . . . . . . . . . . . . . . . . . . . . . . . .. 24
2.6 Significance of Schemas ................................. 24
2.6.1 Schemas Instead of Declarations. . . . . . . . . . . . . . . . . . .. 25
2.6.2 Schemas and Mathematical Relations. . . . . . . . . . . . . .. 25
2.6.3 Bindings........................................ 26
2.6.4 Schemas as Sets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 26
2.6.5 Schemas as Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 27
2.6.6 In Lambda Notation. . . . . .. . . . .. . . . . . . . . . . . . . . . . .. 28
2.6.7 Schemas in Predicate Logic Formulae . . . . . . . . . . . . . .. 28
