20544062
The Use of Z
During 1990 and 1991 we carried out a survey of Z users in the UK; in this paper we present the results. Z is being used by a wide variety of companies for many different applications. Many institutions use Z because they choose to, rather than because it is mandated by a defence or security related client. Half of the participants in the survey were first- time users of Z; with a little training and some expert guidance they were soon able to produce Z specifications. Nearly all the institutions who have used Z intend to do so again; those who don’t plan to use a formal method more appropriate to their needs. We did not uncover many really large projects using Z, but most of those which we did survey are of a reasonable size. Over half the projects surveyed are using tools, with the majority of them employing type checking support. Tools use grows with the size of the project, although several large specifications have been produced without the use of tools. Not many people are proving their specifications, nor stating desirable theorems or proof obligations. However, many people expressed an interest in this with the unavailability of appropriate tool support being given as a reason for not attempting proof.
28202446
A demonstrably correct compiler
As critical applications grow in size and complexity, high level languages, rather than better-trusted assembly languages, will be used in their development. This adds potential for extra errors to creep in, especially in the now necessary compiler. To avoid these new errors, it is necessary to have a formal specification of the high level language, and a formal development of its compiler. We outline what we believe is a practical route for achieving a demonstrably correct compiler, and describe a prototype compiler we have built by this route for a small, but non-trivial, language.
2090341
Z in practice
Using Z. Structure, Process, Fluency. The Established Strategy. Security Properties. Other Approaches to Z Specification. Validation. Putting Together Your Method. House Style. A Word Counting Utility. Roles in Space. Structuring a Video Shop. Promoting Snakes and Ladders. Refining the Tower of Hanoi. Be Abstract. Sets or Functions?. Sets, Quantifiers, or Toolkit?. Sequences are Functions are Relations are Sets. Error Handling Styles. Promotion. Using Free Types. Using Bags. A Function Calculator. Making Schemas Work for you. Exploiting the Power of the Language. A Real Number Toolkit. and Finally...
9257101
More Powerful Z Data Refinement: Pushing the State of the Art in Industrial Refinement
We have recently completed the specification and full refinement proof of a large, industrial scale application. The application was security critical, and the modelling and proof was done to increase the client’s assurance that the implemented system had no design flaws with security implications. Here we describe the application, and then discuss an essential lesson to learn concerning large proof contracts: that one must forge a path between mathematical formality on the one hand and practical achievement of results on the other. We present a number of examples of such decision points, explaining the considerations that must be made in each case.
10533628
Formal Methods for Industrial Products
We have recently completed the specification and security proof of a large, industrial scale application. The application is security critical, and the modelling and proof were done to increase the client's assurance that the implemented system had no design flaws with security implications. Here we describe the application, specification structure, and proof approach. 
 
One of the security properties of our system is of the kind not preserved in general by refinement. We had to perform a proof that this property, expressed over traces, holds in our state-and-operations style model.
60884961
The benefit of information technology in managing outcomes focused curriculum development across related degree programs
This paper describes an interactive, web-based tool that provides access to an Outcomes Database for managing an Outcomes Focused curriculum plan. The approach provides a rapid way to involve subject specialists, course controllers, curriculum designers and educational consultants in the curriculum design and review process. The Outcomes Database is used to capture the relationships between units (i.e. subjects), Unit Learning Outcomes, Course Learning Outcomes, Generic Graduate Attributes and assessments. This is undertaken across courses (i.e. undergraduate degree programs) sharing common units in Information Technology, Computer Science, and Software Engineering. Automatically generated database reports that show how units contribute to the development of the generic graduate attributes are compared to those derived manually on a unit-by-unit basis. Preliminary experience with this IT-based approach demonstrates that automatically generated database reports effectively highlight areas requiring further attention during subsequent curriculum development iterations. The tools and approach described here show how the Outcomes Database can assist in making the transition from an existing program to one using an Outcomes Focused approach.
36780179
President's information technology advisory committee (PITAC): subcommittee on transforming the government
A method for controlling a force-commutated inverter coupled between an electrochemical cell and a power grid for adjusting the magnitude and direction of the electrical energy flowing therebetween. Both the real power component and the reactive power component of AC electrical energy flow can be independently varied through the switching waveform presented to the intermediately coupled inverter. A var error signal is derived from a comparison of a var command signal with a signal proportional to the actual reactive power circulating between the inverter and the power grid. This signal is presented to a voltage controller which essentially varies only the effective magnitude of the fundamental voltage waveform out of the inverter, thereby leaving the real power component substantially unaffected. In a similar manner, a power error signal is derived by a comparison of a power command signal with a signal proportional to the actual real power flowing between the electrochemical cell and the power grid. This signal is presented to a phase controller which varies only the phase of the fundamental component of the voltage waveform out of the inverter relative to that of the power grid and changes only the real power in proportion thereto, thus leaving the reactive power component substantially unaffected.
41108071
Using geometric properties of correspondence vectors for the registration of free-form shapes
The registration of free-form shapes by the iterative closest point algorithm (ICP) has attracted much attention from the computer vision and image processing community since it was first proposed in 1992. Many methods, mainly based on incorporating invariants described in a single coordinate frame have been devised to improve the accuracy and efficiency of the algorithm. In this paper, a novel method to improve image registration is proposed based on rigid constraints derived from geometric properties of correspondence vectors synthesised into a singe coordinate frame. False matches, which occur in almost every iteration of the ICP algorithm are eliminated through properties of the motion. For an accurate estimation of the geometric parameters of the motion, the Monte Carlo method is used in conjunction with a median filter. Experimental results based on both synthetic data and real images show that the improved method can effectively eliminate false matches, is accurate, robust, and efficient for the registration of free-form shapes with small motions.
35983610
Sorting of textual data bases: A variety generation approach to distribution sorting
Abstract A method of sorting large textual data-bases by computer using external storage is proposed. The range of sort-keys in a sample of data to be sorted is divided into a fixed set of partitions, which should also give an adequate representation of new data from a similar source. The partitions are composed of ordered key ranges. An incoming data stream is distributed into a series of bins according to the partition in which the key lies, and the bins are then seperately sorted, using an internal sort, to give an ordered file. It is shown how the number of disc accesses needed depends on the manner in which the bins become filled, and thus on statistics of the data. Experiments using an INSPEC data-base give information on which estimates of the efficiency of the method can be based.
583415
Using dependence graphs to assist manual and automated object oriented software inspections
Many researchers have demonstrated the value of software inspections in finding and fixing defects early in the development process. However, manual inspection can be a labour-intensive process. We present a tool that applies dependence graphs to aid object oriented software inspection. Our tool, Coffee Grinder, uses control and data dependence graphs both to immediately visualise a Java system and to facilitate the development of scripts to find defects or locate areas of potential inspection interest. These scripts can output results textually or graphically. We present the design of Coffee Grinder and several example scripts. Coffee Grinder illustrates the case for extensible tool support in the software inspection process