Vienna Development Method

1. Vienna Development Method SIM5104

2. one of the longest-established Formal Methods for the development of computer-based systems • Originating in work done at IBM's Vienna Laboratory in the 1970s • has grown to include a group of techniques and tools based on a formal specification language - the VDM Specification Language (VDM-SL).

3. VDM features • Basic Types: numeric, character, token and quote types • bool, boolean datatype, false, true • nat, natural numbers (including zero)0, 1, 2, 3,… • nat1, natural numbers (excluding zero)1, 2, 3, 4,.. • int, integers, ..., -3, -2, -1, 0, 1, 2, 3, ... • rat, rational numbers a/b, where a and b are integers, b is not 0 • real, real numbers, ... • char, characters, A, B, C, ... • token, structureless tokens... • <A>, the quote type containing the value <A>...

4. VDM features • Type Constructors • Union of types T1,...,Tn • T1 | T2 | ... | Tn • Example : SignalColour = <Red> | <Amber> | <FlashingAmber> | <Green> • Cartesian product of types T1,...,Tn • T1*T2*...*Tn • Composite (Record) type • T :: f1:T1 ... fn:Tn

5. The composite or record type is a Cartesian product with labels for the fields. The type T :: f1:A1 f2:A2 ... fn:An is the Cartesian product with fields labelled f1,…,fn.

6. For example, the type Date :: day:nat1 month:nat1 year:nat inv mk_Date(d,m,y) == day <=31 and month<=12

7. Collection • The set type constructor (written set of T where T is a predefined type) constructs the type composed of all finite sets of values drawn from the type T. • For example, the type definition UGroup = set of UserId

8. set

9. Sequence • The finite sequence type constructor (written seq of T where T is a predefined type) constructs the type composed of all finite lists of values drawn from the type T. • For example, the type definition String = seq of char Defines a type String composed of all finite strings of characters

10. Operators on sequence

11. Finite mapping • A finite mapping is a correspondence between two sets, the domain and range, with the domain indexing elements of the range. It is therefore similar to a finite function. • The mapping type constructor (written map T1 to T2) where T1 and T2 are predefined types) constructs the type composed of all finite mappings from sets of T1 values to sets of T2 values. • For example, the type definition Birthdays = map String to Date Defines a type Birthdays which maps character strings to Date

12. Operators on mapping

13. Functional Modelling • functions are defined over the data types defined in a model • Support for abstraction requires that it should be possible to characterize the result that a function should compute without having to say how it should be computed • The main mechanism for doing this is the implicit function definition in which, instead of a formula computing a result, a logical predicate over the input and result variables, termed a postcondition, gives the result's properties • For example, a function SQRT for calculating a square root of a natural number might be defined as follows: SQRT(x:nat)r:real post r*r = n

14. A more constrained function specification is arrived at by strengthening the postcondition. • For example the following definition constrains the function to return the positive root. SQRT(x:nat)r:real post r*r = n and r>=0

15. All function specifications may be restricted by preconditions which are logical predicates over the input variables only and which describe constraints that are assumed to be satisfied when the function is executed. • For example, a square root calculating function that works only on positive real numbers might be specified as follows: SQRTP(x:real)r:real pre x >=0 post r*r = n and r>=0 • The precondition and postcondition together form a contract that to be satisfied by any program claiming to implement the function

16. In an explicit function definition, the result is defined by means of an expression over the inputs. • For example, a function that produces a list of the squares of a list of numbers might be defined as follows: SqList: seq of nat -> seq of nat SqList(s) == if s = [ ] then [ ] else [(hd s)**2] ^ SqList(tl s)

17. State-based Modelling • functions do not have side-effects such as changing the state of a persistent global variable. This is a useful ability in many programming languages, so a similar concept exists; instead of functions, operations are used to change state variables (AKA globals). • For example, if we have a state consisting of a single variable someStateRegister : nat, we could define this as: state Register of someStateRegister : nat end

18. An operation to load a value into this variable might be specified as: LOAD(i:nat) ext wr someStateRegister:nat post someStateRegister = i • The externals clause (ext) specifies which parts of the state can be accessed by the operation; rd indicating read-only access and wr being read/write access

19. Sometimes it is important to refer to the value of a state before it was modified • for example, an operation to add a value to the variable may be specified as: ADD(i:nat) ext wr someStateRegister : nat post someStateRegister = someStateRegister~ + i • Where the ~ symbol on the state variable in the postcondition indicates the value of the state variable before execution of the operation.

20. Queue abstract data type • The queue is modelled as a sequence composed of elements of a type Qelt. The representation is Qelt is immaterial and so is defined as a token type. types Qelt = token; Queue = seq of Qelt; state TheQueue of q : Queue end

21. ENQUEUE(e:Qelt) ext wr q:Queue post q = q~ ^ [e]; DEQUEUE()e:Qelt ext wr q:Queue pre q <> [ ] post q~ = [e]^q; IS-EMPTY()r:bool ext rd q:Queue post r <=> (len q = 0)