Transformational Programming and the Derivation of Algorithms

Refining informal ideas into appropriate formal expressions is an essential and skillful activity in writing pre-post style formal specifications. This activity usually involves decisions to be made by the writer and can be error-prone. Experience shows that this activity is also a challenge to many practitioners, and a big hurdle for introducing formal specification techniques into industry. This paper describes a pattern system approach to deal with this problem. The pattern system is composed of a set of inter-related patterns, and each pattern provides a framework for constructing certain kind of formal expression with some common properties. Unlike the way conventional design patterns are used, our pattern system is expected to support a systematic and automated formalization of informal ideas, with the characteristic that the writer only needs to work on the informal level while an appropriate formal expression will be efficiently derived. We focus on discussions of the issues such as pattern definition, pattern classification, the structure of pattern system, and mechanism to use the pattern system.

An alternative scheme to formal software specification is explicitly proposed. In our approach, a formal software specification is formally defined as a set of decision rules performed by a software system. We propose a set of graphical notations called Requirements Particle Network (RPN), to describe the essential preconditions and operations needed by a software system according to the decision rules. A RPN consists of a set of particles and edges to construct a visual model of a decision rule during the software analysis phase. In addition, a number of transformation rules are proposed to perform the formal specification synthesis. A set of predefined formal requirements particle definitions is written in prior and reused during the transformation steps. A developer is provided a practical mean to write a formal specification with a brief experience in mathematical background. In this research, we demonstrate the Z formal specification synthesis using RPN. The usability of the RPN approach is investigated by conducting a workshop. The result indicates that a developer with experience in writing data flow diagram is capable to produce a complete and consistent RPN. Moreover, we show a case study of applying RPN to construct a composite operation to be used in database applications

The paper reports about a case study in algebraic specification. It describes TransLog, a transformation tool for pure Prolog programs. TransLog supports the interactive transformation of (a part of) a program. Six transformation steps are supported: unfolding, folding, goal definition, argument permutation (an instance of goal replacement), goal switching and definition elimination. As much as possible, pure Prolog semantics are preserved. The tool is equipped with navigation options, which allow the user to switch from the current program to another program in a transformation sequence. TransLog has been implemented with the ASF+SDFMeta-environment. The paper focuses on the algebraic specification of the tool, not on the underlying theory of (logic) program transformation. The specification is presented at a global level, only the specification of the unfold and fold step is discussed more in depth.

The design of an electronic funds-transfer (EFT) system, using the UNITY parallel programming methodology, is presented. The process begins with a high-level specification that captures the essence of transaction processing in the system. In a series of refinement steps, this specification is transformed into one that leads directly to a program suitable for execution on the distributed architecture of the EFT system. Each refinement step involves replacing a data structure by a distributed version that can be implemented efficiently on the target architecture. By defining a correspondence between the replaced data structure and its distributed counterpart, it can be demonstrated formally that each refinement step preserves the intent of the original specification.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Traditionally, practitioners use formal methods pre-dominately for one half of the quality-assurance process: verification (do we build the software right?). The other half - validation (do we build the right software?) - has been given comparatively little attention. While verification is the core of refinement-based formal methods, where each new refinement step must preserve all properties of its abstract model, validation is usually postponed until the latest stages of the development, when models can be automatically executed. Thus mistakes in requirementsor in their interpretation are caught too late: usually at the endof the development process. In this paper, we present a novelapproach to check compliance between requirements and theirformal refinement-based specification during the earlier stages ofdevelopment. Our proposed approach - "validation obligations"- is based on the simple idea that both verification and validationare an integral part of all refinement steps of a system.

The Java object oriented programming language has been the subject of an important involvement from programmers and the industry. Especially for applications related to the Web. The problem of such a rapid penetration of Java programs into commercial products is that software engineers do not have any methodology and have to develop complex parallel applications. We present a formal development methodology based on the stepwise refinement of CO-OPN/2 formal specifications, using a real Web parallel application. Starting from a centralized view, we present the following refinement steps: data distribution, behavior distribution, communication layer, and Java program. During the whole refinement process, we study the evolution and the verification of one specific property.

Integrating methods for the design of real-time systems

A set of metalinguistic features and their applications in formal parallel-program transformation are described. Program transformation is an effective methodology for developing correct and efficient parallel programs. However, manually carrying out the transformation is usually very cumbersome and error-prone. These metalinguistic features provide convenient language constructs for expressing and automating transformation steps. These features include a rationalized version of quoting and unquoting, a set a constructors, selectors, and predicates, and a collection of semantics preserving operators. The authors describe the metalinguistic features, illustrate how Crystal programs are conveniently manipulated with these meta constructs, and present a formal denotational semantics of the rationalized quoting and unquoting. They demonstrate the applications of these metalinguistic features by formally deriving a class of parallel palindrome recognition programs.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Improving PROPLANE, a Specifications Development Framework

Obtaining good performance when programming heterogeneous computing platforms poses significant challenges. We present a program transformation environment, implemented in Haskell, where architecture-agnostic scientific C code with semantic annotations is transformed into functionally equivalent code better suited for a given platform. The transformation steps are represented as rules that can be fired when certain syntactic and semantic conditions are fulfilled. These rules are not hard-wired into the rewriting engine: they are written in a C-like language and are automatically processed and incorporated into the rewriting engine. That makes it possible for end-users to add their own rules or to provide sets of rules that are adapted to certain specific domains or purposes.

Formal specifications of software systems are extremely useful because they can be rigorously analyzed, verified, and validated, giving high confidence that the specification captures the desired behavior. To transfer this confidence to the actual source code implementation, a formal link is needed between the specification and the implementation. Generating the implementation directly from the specification provides one such link. A program transformation system such as Paige's APTS can be useful in developing a source code generator. This paper describes a case study in which APTS was used to produce code generators that construct C source code from a requirements specification in the SCR (Software Cost Reduction) tabular notation. In the study, two different code generation strategies were explored. The first strategy uses rewrite rules to transform the parse tree of an SCR specification into a parse tree for the corresponding C code. The second strategy associates a relation with each node of the specification parse tree. Each member of this relation acts as an attribute, holding the C code corresponding to the tree at the associated nodes the root of the tree has the entire C program as its member of the relation. This paper describes the two code generators supported by APTS, how each was used to synthesize code for two example SCR requirements specifications, and what was learned about APTS from these implementations.

State-based formal specifications benefit from data structuring mechanisms, which collate associated properties and efficiently declare complex types. For example, ‘record’ data structures, similar to those used in programming languages, can be built into the concrete syntax of a language as an enhancement over flat data relationships. While this is relatively simple to achieve for a single-level specification, it becomes significantly more involved when the specification language allows for progressive refinement of the data supporting the specification. Individual fields may be added to create sub-records within a refinement and replaced to create refined records during a refinement step. The impact on the ability to verify invariant and refinement proof obligations must be considered. Here we describe a record structuring syntax that includes notions of extension and inheritance that can be used in a refinement-based formal method. We illustrate the approach using extensions to the Event-B formal method.

This thesis presents a refinement calculus for transforming highly abstract specifications into programs written in a functional programming language. Refinement calculi allow the derivation of a program from a formal specification by a sequence of correctness-preserving transformation steps. Most refinement calculi target imperative programming languages. Functional programming languages are often more expressive than imperative programming languages. This expressive power leads to a reduced gap between the concepts used to express a problem (as a specification) and the concepts used to express its solution (as a program). Thus, a refinement calculus which targets a functional programming language can lead to a simpler development process which produces a final product more quickly. We build a refinement calculus for functional programs by adding specification constructs to a functional language and examining transformations over the resulting language.This thesis complements other work in the area in two major ways. Firstly, we investigate the addition of truly-nondeterministic, rather than underdetermined, choice constructs to a functional language. These constructs allow specifications which are more abstract and which admit more implementations. Secondly, most refinement calculi for functional programs add erratic choice constructs to a functional language. We investigate the addition of both demonic and angelic nondeterminism to a functional language. Demonic and erratic choice are similar: given a number of alternatives, they choose any one. In contrast, given a number of alternatives angelic choice always makes the correct choice, if one exists. Angelic choice is difficult to reason about, but allows the concise specification of powerful parallel constructs.

The notion of refactoring --transforming the source-code of an object-oriented program without changing its external behaviour-- has increased the need for a precise definition of refactorings and their properties. This paper introduces a graph representation of those aspects of the source code that should be preserved by a refactoring, and graph rewriting rules as a formal specification for the refactoring transformations themselves. To this aim, we use type graphs, forbidden subgraphs, embedding mechansims, negative application conditions and controlled graph rewriting. We show that it is feasible to reason about the effect of refactorings on object-oriented programs independently of the programming language being used. This is crucial for the next generation of refactoring tools.

In this paper we make use of formal methods and tools as means to specify and reason about the behavior of distributed systems in the presence of faults. The approach used is based on the observation that a fault behavior can be modeled as an unwanted but possible transition of a system. It is then possible to define a transformation of a model M 1 of a distributed system into a model M 2 representing the behavior of the original system in the presence of a selected fault. We use a formal specification language called Object Based Graph Grammars to describe models of asynchronous distributed systems and present, for models written in terms of this language, the transformation steps for introducing a set of classical fault models found in the literature. As a result of this process, over the transformed model(s) it is possible for the developer to reason about the behavior of the original model(s) in the presence of a selected fault behavior. As a case study, we present the specification of a pull-based failure detector, then we transform this model to include the behavior of the crash fault model and analyze, through simulation, the behavior of the pull-based failure detector in the presence of a crash.