280 likes | 394 Views
Explore the Cleanroom method developed by Harlan Mills for industrial use, emphasizing systematic programming and design verification processes. Learn about Box Structures, Design Verification, and Verification Techniques. Discover the industrial applications and results of using Cleanroom in software development.
E N D
Cleanroom Method CS 415, Software Engineering II Mark Ardis, Rose-Hulman Institute March 20, 2003
Outline • Harlan Mills • Cleanroom method • Industrial use of cleanroom
Harlan Mills 1919 - 1996
Mathematics and Programming • Roman accounting • "to go from programming as an instinctive, intuitive process to a more systematic, constructive process"
Cleanroom Method • Incremental (spiral) • Box structure specification and design • Design verification • No debugging • Statistical testing
Box Structures • Black boxes: behavior only • State Boxes: behavior + state • Clear boxes: procedures
S1S2...Sn R stimulus history response Black Boxes
State Boxes State Data S R stimulus, old state response, new state
Clear Boxes State Data S R Procedures stimulus, old state response, new state
Box Description Language (BDL) • Invocation: use <type> <name> <args> • Sequence: do B1; B2od • Alternation: if <cond> then B1else B2fi • Iteration: while <cond> do B od
Box Structure Hierarchy BB SB CB BB BB BB SB SB SB CB CB CB
Design Verification • Procedures in BDL are checked for correctness with their higher-level descriptions • All boxes (and all procedures) describe functions • Formal proofs of correctness can be performed (but often informal proofs are done, instead)
Verification of Sequence Given a high-level function [f] for statement: do [g]; [h] od Does [g] followed by [h] compute the same function as [f]? Example: [f](x) = 2 * x + 7 [g](x) = 2 * x [h](x) = x + 7
Verification of Selection Given a high-level function [f] for statement: if <cond> then[g]else[h]fi • Whenever <cond> is true, does [g] compute the same function as [f]? • Whenever <cond> is false, does [h] compute the same function as [f]?
Verification of Iteration Given a high-level function [f] for statement: while <cond> do[g]od • Whenever <cond> is true, does [g] followed by [f] compute the same function as [f]? • Does the loop always terminate? • Whenever <cond> is false, does the empty function compute the same function as [f]?
Usage Testing • Develop an operational profile of use • Generate random tests that fit the probabilities
Industrial Use • Used in a few areas of IBM • Used by some military contractors • Tried at NASA
Software Engineering Laboratory (SEL) • Joint program of NASA Goddard Space Center, Computer Sciences Corporation, and the University of Maryland • Conduct experiments and case studies on new software technology
SEL Experience • First trial at University of Maryland • controlled experiment (10 experiment teams,5 control teams • FORTRAN • 1.5 KLOC • 3 case studies at Goddard • flight-dynamics ground support systems • FORTRAN • 40 KLOC, 22 KLOC, 160 KLOC
SEL Results – University Experiment • Cleanroom teams • use fewer computer resources • satisfy requirements more successfully • make higher percentage of scheduled deliveries
SEL Results – Goddard • More effort spent in design • Better reliability of final product • Smaller projects achieve higher productivity, but large project just average
Summary • Cleanroom may be an effective method for achieving higher reliability • Requires some culture change (no debugging) • Still being investigated by researchers and practitioners
References Victor Basili and Scott Green, "Software process evolution at the SEL", IEEE Software 11(4), 58-66, July 1994.