Table Of ContentTextsinComputerScience
Editors
DavidGries
FredB.Schneider
Forothertitlespublishedinthisseries,goto
www.springer.com/series/3191
(cid:2)
V.S. Alagar K. Periyasamy
Specification
of Software
Systems
2ndedition
Prof.V.S.Alagar Prof.K.Periyasamy
Dept.ComputerScienceandSoftwareEng. ComputerScienceDepartment
ConcordiaUniversity UniversityofWisconsin-LaCrosse
St.CatherineStreetWest1515 StateStreet1725
H3G1M8Montreal,Québec 54601LaCrosse,WI
Canada USA
[email protected] [email protected]
SeriesEditors
DavidGries FredB.Schneider
DepartmentofComputerScience DepartmentofComputerScience
UpsonHall UpsonHall
CornellUniversity CornellUniversity
Ithaca,NY14853-7501,USA Ithaca,NY14853-7501,USA
ISSN1868-0941 e-ISSN1868-095X
ISBN978-0-85729-276-6 e-ISBN978-0-85729-277-3
DOI10.1007/978-0-85729-277-3
SpringerLondonDordrechtHeidelbergNewYork
BritishLibraryCataloguinginPublicationData
AcataloguerecordforthisbookisavailablefromtheBritishLibrary
LibraryofCongressControlNumber:2011922494
©Springer-VerlagLondonLimited1998,2011
Apartfromanyfairdealingforthepurposesofresearchorprivatestudy,orcriticismorreview,asper-
mittedundertheCopyright,DesignsandPatentsAct1988,thispublicationmayonlybereproduced,
storedortransmitted,inanyformorbyanymeans,withthepriorpermissioninwritingofthepublish-
ers,orinthecaseofreprographicreproductioninaccordancewiththetermsoflicensesissuedbythe
CopyrightLicensingAgency.Enquiriesconcerningreproductionoutsidethosetermsshouldbesentto
thepublishers.
Theuseofregisterednames,trademarks,etc.,inthispublicationdoesnotimply,evenintheabsenceofa
specificstatement,thatsuchnamesareexemptfromtherelevantlawsandregulationsandthereforefree
forgeneraluse.
Thepublishermakesnorepresentation,expressorimplied,withregardtotheaccuracyoftheinformation
containedinthisbookandcannotacceptanylegalresponsibilityorliabilityforanyerrorsoromissions
thatmaybemade.
Coverdesign:deblik
Printedonacid-freepaper
SpringerispartofSpringerScience+BusinessMedia(www.springer.com)
Preface to the Second Edition
This is the second edition of the textbook in which most of the concepts introduced in
the first edition are extended and updated, and a significant amount of new material has
been added. While preserving the original intent of focusing on software specification,
thiseditionemphasizesthepracticeofformalmethodsforspecificationandverification
activitiesfordifferenttypesofsoftwaresystemsandatdifferentstagesofdevelopingthe
softwaresystems.Thisexpandedviewisreinforcedbothintheorganizationofthebook
and in the presentation of its contents. The primary driving force for writing the second
editioncamefromSpringer-Verlag,London,whoexpressedagreatdesireandstrongin-
terestincateringtothegrowingneedsofstudentsandresearchers intheareaofFormal
SoftwareEngineering.
BackgroundandMotivation
Althoughduringtheinitialstagesofformalmethodsresearchtherewasonlyamarginal
use of formal methods in industry, new languages, techniques and tools developed dur-
ing early 1990s have spurred great interest in adapting formal methods in industries. In
fact,the1990switnessedanexplosionofnewdevelopmentsinformalmethodsresearch.
NASALangleyResearchCenterwasthefirsthubofformalmethodsresearchandpractice.
TheresearchersatLangleyfocusedonlargescalecommercialprojectsthataresuitablefor
injectingformalmethods.Theyfeltthattheindustrieswerereluctanttouseformalmeth-
odsbecauseofinadequatetools,inadequatebackground,andlackofadequateexamples.
However,thissituationstartedchanginggraduallyduring1995–2004whennewdirections
of research and development of tools in the three areas Software Specification Methods,
ModelChecking,andTheoremProvingprovidedagreatspurforformaldevelopmentac-
tivityinindustries.Mostnotably,softwareengineersatnuclearpowerstations,aerospace
andtransportationindustriesusedformalmethodstoformallyspecifyandverifytheprop-
ertiesofsafetycriticalpartsinsystems.In1998,thefullyautomaticdriverlesssubwaywas
launchedinParisMetroand,in2006,thefullyautomaticdriverlessshuttleservicingthe
variousterminalsatRoissyAirport,Pariswaslaunched.Withsuccessstoriessuchasthese
v
vi PrefacetotheSecondEdition
aroseadesireinacademiaandindustriestolearnformalmethodsmoresystematically.In
ordertochooseamethodthatisappropriateforaspecificapplicationthatdemandscon-
ceptssuchascausality,concurrency,andconflictavoidanceacertainlevelofexpertisein
formalmethodseducationisnecessary.Gettingtoknowthatitispossibletomixdifferent
abstractions from different languages to model heterogeneous systems is an asset for an
efficientdevelopmentprocess.Nowadaysformalmethodsoftenarebundledupwithtools,
many available as open source software, to support architectural principles ofgenerality
andorthogonality.Inviewofthesespectrumofchangesandsuccessstories,softwareen-
gineers now have several case studies to learn from and choose languages and methods
witharichrepertoireofappropriateconceptsfortheirintendedapplications.Inkeepingup
withthistrendthissecondeditionisoffered.Inwritingthissecondedition,theexpectation
is that formal methods will be well integrated into the teaching of software engineering
programs.Inthishope,topicsrelatedtotheintegrationofformalmethodsinsoftwarede-
velopmentprocessarediscussedquiteearlyinthetextandarefollowedbypresentations
ofabstractionprinciples,formalismdefinitions,notationsofformalism,andawidevariety
offairlydetailedspecificationexamples.
WhatisNewintheSecondEdition?
Oldmaterialhasbeenupdatedtoimprovebothcontentandpresentation.Somechapters
in the first edition of the text have undergone extensive revisions. In some cases, an old
chapterhasbeensplitintotwoormorechaptersandineachofthemextensivenewma-
terial have been added. New chapters that discuss Object-Z, B-Method, and Calculus of
Communicating Systems have been added. The entire book has been structured into six
parts.Thedistinguishingfeaturesofthisrestructuredandexpandedsecondeditionareas
follows.
PartI Thefirstpartofthebookintroducesspecificationfundamentals.Thematerialis
presented in four chapters. An elaborate introduction to the role of specification is fol-
lowed bydiscussions onspecification activities andspecification qualities. Thefirst part
concludeswithadiscussiononabstractionprinciples,illustratedwithadomainabstraction
example.
PartII Thesecondpartintroducesthebasicsofformalism,automatanotationsusedin
formallanguages,studyextensionstothebasicautomatanotation,andconcludeswitha
discussion on the classification of formal specification techniques. This material is pre-
sentedinfourchapters.Thechaptersthatdiscussautomataandextendedstatemachineno-
tationsarealmostself-contained.Avarietyofexamplesthatariseinsoftwareconstruction
aretakenupforformalmodelingusingdifferentvariationsofstatemachines.Top-down
andbottom-upconstructionsofformalmodels,theirsequentialandparallelcompositions
arediscussedandillustratedwithexamples.
PrefacetotheSecondEdition vii
PartIII Thethirdpartofthebookisentirelydevotedtologic.Propositionallogic,pred-
icatelogic,andtemporallogicaretreatedinthreeseparatechapters.Thepresentationfo-
cuses on introducing the logics as formal languages, and hence introduces their syntax,
semantics,andreasoningmethodsinsuccession.Theexpressivepowerofpredicatelogic
isillustratedforrepresentingknowledge,policies,aswellasservingasaxiomaticsystem
forprogramverification.Forthelatterpurpose,Hoareaxiomsarepresentedandillustrated
byverifyingsimplesequentialprograms.Temporallogicchaptergivesadetaileddiscus-
sionofthesyntax,andsemanticsoflineartemporallogic.Manyexamplesfromreactive
systemsandconcurrentsystemsarechosentoemphasizetheexpressivityofthelogiclan-
guages in specifying such systems and their properties. A discussion ofaxiomatic proof
methodandmodelcheckingareincluded.
Part IV Most of the model-based specification languages are based on set theory and
first-order predicate logic. Therefore, it is essential to have a strong background in set
theoryandrelations.Thispartofthebookincludesonechapteronsettheoryandrelations.
Mostpartsofthischapterareretainedfromthepreviouseditionofthebook.
PartV Threespecificationmethodsarediscussedtoillustratetheproperty-orientedap-
proachtospecifications.Twoofthechapters,AlgebraicSpecificationsandLarch,areleft
unchanged.ThechapterCalculusofCommunicatingSystemsisnewanditdiscussesMil-
ner’s algebraic approach to specifying communication and concurrency. Some examples
discussedinTemporalLogicchapteraredrawninheretostrikeacomparisonbetweenthe
twoapproaches. Aneffort has been madeto make thediscussion inthis chapter simple,
rigorous,andself-contained.
Part VI This part is devoted to model-based specification techniques. Four such tech-
niques aredescribed indetail. TheseareVDM-SL,Z,Object-Z andtheB-Method. Ma-
terial on VDM-SL and Z are retained from the previous edition of the book, while the
bibliographicreferenceshavebeenupdated.Twonewchaptershavebeenintroduced,one
forObject-ZandanotherfortheB-Method.Thematerialfornewchaptersarepresentedin
thesamestyleasintheoldchapters.Also,thetwonewchaptersincludeextensiveexam-
plesandcasestudies,andprovideadetailedtutorialofthetechniquesintroducedinthose
chapters.
HowtoUsetheBook
Inthesecondeditionofthebook,wehaveaddedconsiderablenewmaterialandwehave
also restructured the chapters into various parts. Consequently, those who have used the
first edition may see a different layout of the book. The book includes several different
specificationtechniquesgroupedintovariouscategories.Inaddition,italsoincludeschap-
terswithnecessarymathematicalbackgroundforthesetechniques.Becauseofthediverse
natureofthesetechniques,thebookcanbeusedbydifferentgroupsofpeoplefordifferent
purposes.Belowwesuggestafewstreamsofcourseofferingstofitdifferentcurriculum
needs.
viii PrefacetotheSecondEdition
1. ChaptersinPartIarerequiredforfurtherreadingofthebook.
2. BasedonPartI,PartII,Chaps.9,10ofPartIII,andPartIVaone-semesterundergradu-
atecoursewithinasoftwareengineeringprogramcanbegiven.Thiscourseisintended
tobeanIntroductiontoFormalSoftwareEngineeringMethods.Thecoursecanbeex-
tendedintoanothersemesterbycoveringthematerialfromoneofthefourspecification
languagesdiscussedinChaps.16through19,andchoosingaprojectinwhichthestu-
dentswouldwriteacompletespecificationandanalyzethespecification.Theexamples
andcasestudiesgiveninthesechapterswouldhelpthestudentstoachievethisgoal.
3. ChaptersinPartII,PartIII,andChap.15fromPartVcanbeofferedasaone-semester
courseforseniorundergraduatestudentsorfirstyeargraduatestudentsincomputersci-
enceandcomputerengineeringprograms.ThiscourseisintendedtobeanIntroduction
toFormalMethods.
4. PartsVandVIaredevotedtovariousformalspecificationtechniques.Eachchapterin
thesepartsgivesathoroughtutorialofonespecificationtechnique.Togetherwiththe
mathematicalfundamentalsdescribedinPartIV,eachchapterinPartsVandVIcanbe
individuallyusedtoteachaone-semestercourseonaparticularspecificationtechnique.
Thecoursewillintroducetheformalmethodinsomedepth,choosingappropriatetools
suggestedinthebibliographicnotesofthesechapters.Itissuitabletoteachthiscourse
atseniorundergraduateleveloratthegraduatelevelprovidedthatthestudentsareex-
posedtosomeofthemathematicalfundamentalsdescribedinPartsIthroughIVbefore
takingthiscourse.Alternately,aquickoverviewofthefundamentalscanbecoveredin
fewweeksandtherestofthesemestercanbespentonthesyntaxandsemanticsofthe
chosenspecificationtechnique.
5. Anadvancedgraduate-levelcoursecanbetaughtusinganyoneofthetechniquesdis-
cussedinPartsVandVIwithemphasisondevelopingcompletespecificationforafairly
largeproblem.Thiswouldinvolverefinement,proofobligation,andimplementation.
6. Anotheroptionwouldbetoteachanadvancedgraduate-levelcoursethatrequiresthe
studentstocriticallycomparethetechniquesineachgroupandwriteareport.Forex-
ample,onecoursecouldbetaughtonmodel-basedspecificationtechniques,allchapters
inPartVI.Studentsinthiscoursewillgetanin-depthunderstandingofthetechniques
andalsowouldbeabletochoosetheappropriatetechniqueforagivenproblem.
7. Practitioners of formal methods, especially those who use formal methods for indus-
trialapplications,canusethisbookasareference.Inparticular,thechaptersinPartsV
andVIhavebeenwritteninsuchawaythatapractitionerwhoisfamiliarwithonetech-
niquecanquicklyjumpstartwithanothertechniquewithlittletime.Theexamplesand
casestudiesineachchapterinthesetwopartsprovidesufficientinformationforaprac-
titionertostartwritingthespecificationforanewapplicationwithoutmuchpreparation
time.
IntendedAudience
ThisbookiswrittentoserveasatextbookforstudentsinSoftwareEngineering,Computer
Science, Computer Engineering and Information Systems Engineering. Software profes-
sionals who want to familiarize themselves with formal methods can use this book as a
PrefacetotheSecondEdition ix
goodreference.Thewidecoverageofvariousformalspecificationtechniquesandthetu-
torialnatureofdescriptionsofeachindividualtechniquemakethebookasagoodresource
for formal methods, all in one place. The bibliographic notes given at the end of each
chapterprovokesthereadertoexpandtheirhorizonbeyondthematerialsdiscussedinthat
chapteralongwithinformationontoolsupport.
Acknowledgments
OursincerethanksgototheeditorialboardofSpringer-Verlag,Londonwhosepersistent
persuasiongaveussufficientmotivationtoengageinthisventure.Manypeoplehaveas-
sistedusinbringingoutthesecondeditionofthisbook.Firstofall,thosewhohavehelped
usduringthefirsteditiondeserveasecondroundofapplause.Duringtheextensiverevi-
sionsandadditionstothesecondeditionwereceivedgreatsupportfromLeiFeng,Pankaj
Goyal, Naseem Ibrahim, Diep Mai, Ka Lok Man, Mubarak Mohammad, Shiri Nematol-
laah,andOlgaOrmandjieva.Weexpressoursincerethanksfortheirdedicationandtimely
support.
Preface
This is a textbook on software specification emphasizing formal methods that are rele-
vanttorequirementsanddesignstagesofsoftwaredevelopment.Theaimofthebookisto
teachthefundamentalprinciplesofformalmethodsintheconstructionofmodularandver-
ifiableformalspecifications.Thebookintroducesseveralformalspecificationtechniques
andillustratestheexpressivepowerofeachtechniquewithanumberofexamples.
GeneralCharacteristics
Traditionaltextbooksonsoftwareengineeringdiscussthedifficultiesandchallengesthat
lieonthepathfromrequirementsanalysistoimplementationofasoftwareproduct.Most
of these books describe some techniques in detail and give hints on implementation of
thesetechniques.Onlyafewamongthemdealwithimportantsoftwareengineeringprin-
ciplesandtechniques,anddiscusshowaparticulartechniquemaybeusedtoimplement
a given principle. There is very little exposure in these books to a rigorous approach to,
orasystematicstudyof,theconstructionofverifiablesoftware.Thosewhohaveacquired
an understanding of the fundamental principles of software engineering from traditional
textbookswillfindthefollowingcharacteristicsofthisbookquiterelevanttothepractice
ofsoftwareengineering.
• Thebookdealswithspecification.
The principal characteristic of this book is to discuss formalisms that provide a theo-
reticalfoundationfortheprinciplesofsoftwareengineering,andareappropriatetothe
requirementsanddesignstagesofsoftwaredevelopment.Wediscusstheconceptofab-
straction, the need for formalism in software development, the mathematical basis of
formalmethods,componentsofaformalsystem,specificationlanguages,differentlev-
elsofrigorinapplyinglanguages,andtheneedfortoolsupporttouseformalmethods
fordifferentstagesofsoftwaredevelopment.Wediscusstherelationshipbetweenspec-
ificationsandimplementations,aswellassubjectingspecificationstorigorousanalyses
andformalproofs.
xi
xii Preface
• Thebookemphasizesmathematicalprinciples.
Formalapproachestosoftwaredevelopmentcanbeunderstoodandpracticedbystudy-
ingthemathematicstheyuse.Aprimaryobjectiveofthebookistorelatediscretemath-
ematicalstructurestothestudyofabstractdatatypes,andtobringstudentstothelevel
of mathematical maturity where they can write and reason about small specifications.
Once the students acquire the basic mathematical skills that a formalism is based on,
mastery of formal specification languages, techniques for refinements, and proofs be-
come easy to understand and apply. We believe that the use of tools and techniques
becomeeffectivewhentheirunderlyingprinciplesareproperlyunderstood.
• Thebookteachesformalspecificationlanguages.
Unlike many recent books that are devoted to one formal specification language, we
discuss four specification languages to emphasize their design philosophies and their
practical applicability. We also discuss formal specifications based on set theory and
logic without regard to any specification language. The purpose here is to teach the
readerthatthesemathematicalabstractionsformtheformalbasisofthefourspecifica-
tionlanguages.ThelanguagesdiscussedinthebookareOBJ3,VDM,Z,andLarch.We
illustratetheirexpressivepowerfordifferentclassesofapplications.Weexpectthatour
treatmentofthesubjectwillpreparethereadertolearnmoresophisticatedlanguagesand
toolsthatmaybedevelopedinthefuture.Itisourbeliefthatmasteryoftheselanguages
willallowthereadertochoosethelanguagethatissuitableforagivenapplication.
• Thebookpresentsproofs.
Informalargumentsconductedinconjunctionwithaformalspecificationoftenleadto
a proof construction, which can be presented in a justifiable manner. Proofs ensure a
measure of certainty on claims that can be made of specified system properties. We
presentproofsinrigorousaswellasinformalstyles.Weavoidlengthyproofs,andput
moreemphasisonmodeling,specification,andrigorousreasoningofthespecifications.
• Thebookpresentsengineeringprinciples.
Thisbookdiscussesthegeneralprinciplesfordatarefinement,operationrefinement,and
interfacespecification,andillustrateshowtheseareconstructedforparticularspecifica-
tionlanguages.Thepresentationinthebookaimstoenablethereadertounderstandwhy
aparticulartechniqueisimportantandhowtoapplythetechnique.
Audience
Thisbookisdesignedtobeusedasatextbookbystudentsofcomputerscience,software
engineering,andinformationengineering.Softwareprofessionalswhowanttolearnformal
specification languages and use formal methods in their work will find the material in
the book useful for serious self-study. The sections on bibliographic notes give a broad
accountofworkrelatedtothetopicdiscussedineachchapter;thisshouldhelpsoftware
professionalstoidentifyindustrialapplicationsandlearnfromtheexperiencereportedon
theuseoftools.
