280 likes | 383 Views
Cleanroom Method. CS 415, Software Engineering II Mark Ardis, Rose-Hulman Institute March 20, 2003. Outline. Harlan Mills Cleanroom method Industrial use of cleanroom. Harlan Mills. 1919 - 1996. Mathematics and Programming. Roman accounting
E N D
Cleanroom Method CS 415, Software Engineering II Mark Ardis, Rose-Hulman Institute March 20, 2003
Outline • Harlan Mills • Cleanroom method • Industrial use of cleanroom
Harlan Mills 1919 - 1996
Mathematics and Programming • Roman accounting • "to go from programming as an instinctive, intuitive process to a more systematic, constructive process"
Cleanroom Method • Incremental (spiral) • Box structure specification and design • Design verification • No debugging • Statistical testing
Box Structures • Black boxes: behavior only • State Boxes: behavior + state • Clear boxes: procedures
S1S2...Sn R stimulus history response Black Boxes
State Boxes State Data S R stimulus, old state response, new state
Clear Boxes State Data S R Procedures stimulus, old state response, new state
Box Description Language (BDL) • Invocation: use <type> <name> <args> • Sequence: do B1; B2od • Alternation: if <cond> then B1else B2fi • Iteration: while <cond> do B od
Box Structure Hierarchy BB SB CB BB BB BB SB SB SB CB CB CB
Design Verification • Procedures in BDL are checked for correctness with their higher-level descriptions • All boxes (and all procedures) describe functions • Formal proofs of correctness can be performed (but often informal proofs are done, instead)
Verification of Sequence Given a high-level function [f] for statement: do [g]; [h] od Does [g] followed by [h] compute the same function as [f]? Example: [f](x) = 2 * x + 7 [g](x) = 2 * x [h](x) = x + 7
Verification of Selection Given a high-level function [f] for statement: if <cond> then[g]else[h]fi • Whenever <cond> is true, does [g] compute the same function as [f]? • Whenever <cond> is false, does [h] compute the same function as [f]?
Verification of Iteration Given a high-level function [f] for statement: while <cond> do[g]od • Whenever <cond> is true, does [g] followed by [f] compute the same function as [f]? • Does the loop always terminate? • Whenever <cond> is false, does the empty function compute the same function as [f]?
Usage Testing • Develop an operational profile of use • Generate random tests that fit the probabilities
Industrial Use • Used in a few areas of IBM • Used by some military contractors • Tried at NASA
Software Engineering Laboratory (SEL) • Joint program of NASA Goddard Space Center, Computer Sciences Corporation, and the University of Maryland • Conduct experiments and case studies on new software technology
SEL Experience • First trial at University of Maryland • controlled experiment (10 experiment teams,5 control teams • FORTRAN • 1.5 KLOC • 3 case studies at Goddard • flight-dynamics ground support systems • FORTRAN • 40 KLOC, 22 KLOC, 160 KLOC
SEL Results – University Experiment • Cleanroom teams • use fewer computer resources • satisfy requirements more successfully • make higher percentage of scheduled deliveries
SEL Results – Goddard • More effort spent in design • Better reliability of final product • Smaller projects achieve higher productivity, but large project just average
Summary • Cleanroom may be an effective method for achieving higher reliability • Requires some culture change (no debugging) • Still being investigated by researchers and practitioners
References Victor Basili and Scott Green, "Software process evolution at the SEL", IEEE Software 11(4), 58-66, July 1994.