61999192
Dataflex multi-user features
159149811
Workgroup kingpin
3001328
An Iterator Construct for the Refinement Calculus
This paper concerns the introduction of an iterator into the refinement calculus. The construct is based on concepts from functional programming, and the work gives an interesting example of cross-fertilisation between the functional and imperative programming worlds. Specifically, the iterator construct it..ti uses the idea of a catamorphism -- the unique homomorphism from an initial algebra. The datatype for which the iterator is to be defined is considered as an initial algebra of an appropriate functor. The it..ti construct is formally defined as a recursive procedure, and it is shown that, if the value to be obtained by an iteration can be expressed as a catamorphism, then the it..ti construct provides a very natural implementation. Examples are given to show typical uses of the new construct.
206586397
Extending Ravenscar with CSP Channels
The Ravenscar Profile is a restricted subset of the Ada tasking model, designed to meet the requirements of producing analysable and deterministic code. A central feature of Ravenscar is the use of protected objects to ensure mutually exclusive access to shared data. This paper uses Ravenscar protected objects to implement CSP channels in Ada – the proposed implementation is formally verified using model checking. The advantage of these Ravenscar channels is transforming the data-oriented asynchronous tasking model of Ravenscar into the cleaner message-passing synchronous model of CSP. Thus, formal proofs and techniques for model-checking CSP specifications can be applied to Ravenscar programs. In turn, this increases confidence in these programs and their reliability. Indeed, elsewhere, we use the proposed Ravenscar channels as the basis for a cost-effective technique for verifying concurrent safety-critical system.
5897834
‘The Standard Logic for Z’: A Clarification
Abstract. Some clarification is made of a recent article in Formal Aspects of Computing [Hen98]. Specifically, it is noted that the inconsistency found is in a draft logic, which is clearly unfinished. The latest news of the position of the Z Standards Panel on a logic for Z is given.
2013482
Is Proof More Cost-Effective Than Testing?
The paper describes the use of formal development methods on an industrial safety-critical application. The Z notation was used for documenting the system specification and part of the design, and the SPARK subset of Ada was used for coding. However, perhaps the most distinctive nature of the project lies in the amount of proof that was carried out: proofs were carried out both at the Z level (approximately 150 proofs in 500 pages) and at the SPARK code level (approximately 9000 verification conditions generated and discharged). The project was carried out under UK Interim Defence Standards 00-55 and 00-56, which require the use of formal methods on safety-critical applications. It is believed to be the first to be completed against the rigorous demands of the 1991 version of these standards. The paper includes comparisons of proof with the various types of testing employed, in terms of their efficiency at finding faults. The most striking result is that the Z proof appears to be substantially more efficient at finding faults than the most efficient testing phase. Given the importance of early fault detection, we believe this helps to show the significant benefit and practicality of large-scale proof on projects of this kind.
42984951
A Circus Semantics for Ravenscar Protected Objects
The Ravenscar profile is a subset of the Ada 95 tasking model: it is certifiable, deterministic, supports schedulability analysis, and meets tight memory constraints and performance requirements. A central feature of Ravenscar is the use of protected objects to ensure mutually exclusive access to shared data. We give a semantics to protected objects using Circus, a combination of Z and CSP, and prove several important properties; this is the first time that these properties have been verified. Interestingly, all the proofs are conducted in Z, even the ones concerning reactive behaviour.