State-based Specifications Research Articles

An Introduction to Real-Time Object-Z

Abstract. This paper presents Real-Time Object-Z: an integration of the object-oriented, state-based specification language Object-Z with the timed trace notation of the timed refinement calculus. This integration provides a method of formally specifying and refining systems involving continuous variables and real-time constraints. The basis of the integration is a mapping of the existing Object-Z history semantics to timed traces.

Implementing reactive closed-system specifications

The objective of implementation is to bridge the gap between the specification model and available implementation technology. The ongoing trend in electronic design automation is to widen this gap by introducing more abstract specification models to produce increasingly complex systems within shorter time spans. At the same time, advances in implementation tools and methods have been less dramatic. In this paper, we discuss a case study that models an access cycle in the Industry Standard Architecture bus and present systematic methods for implementing state-based specifications in software and hardware. We focus on the formal properties known as safety—characterizations of the kind ‘nothing bad ever happens’—and liveness—characterizations of the kind ‘something good eventually happens’. Particular emphasis is laid on liveness properties and scheduling since these are the driving force that make things happen in operational specifications. We represent specifications graphically using the Temporal Logic of Actions, a logic that models system behaviour by sequences of states.

Specification, Refinement and Verification of Concurrent Systems—An Integration of Object-Z and CSP

This paper presents a method of formally specifying, refining and verifying concurrent systems which uses the object-oriented state-based specification language Object-Z together with the process algebra CSP. Object-Z provides a convenient way of modelling complex data structures needed to define the component processes of such systems, and CSP enables the concise specification of process interactions. The basis of the integration is a semantics of Object-Z classes identical to that of CSP processes. This allows classes specified in Object-Z to be used directly within the CSP part of the specification. In addition to specification, we also discuss refinement and verification in this model. The common semantic basis enables a unified method of refinement to be used, based upon CSP refinement. To enable state-based techniques to be used for the Object-Z components of a specification we develop state-based refinement relations which are sound and complete with respect to CSP refinement. In addition, a verification method for static and dynamic properties is presented. The method allows us to verify properties of the CSP system specification in terms of its component Object-Z classes by using the laws of the CSP operators together with the logic for Object-Z.

Stochastic dynamic programming with factored representations

Markov decision processes (MDPs) have proven to be popular models for decision-theoretic planning, but standard dynamic programming algorithms for solving MDPs rely on explicit, state-based specifications and computations. To alleviate the combinatorial problems associated with such methods, we propose new representational and computational techniques for MDPs that exploit certain types of problem structure. We use dynamic Bayesian networks (with decision trees representing the local families of conditional probability distributions) to represent stochastic actions in an MDP, together with a decision-tree representation of rewards. Based on this representation, we develop versions of standard dynamic programming algorithms that directly manipulate decision-tree representations of policies and value functions. This generally obviates the need for state-by-state computation, aggregating states at the leaves of these trees and requiring computations only for each aggregate state. The key to these algorithms is a decision-theoretic generalization of classic regression analysis, in which we determine the features relevant to predicting expected value. We demonstrate the method empirically on several planning problems, showing significant savings for certain types of domains. We also identify certain classes of problems for which this technique fails to perform well and suggest extensions and related ideas that may prove useful in such circumstances. We also briefly describe an approximation scheme based on this approach.

Calculating upward and downward simulations of state-based specifications

This paper concerns calculational methods of refinement in state-based specification languages. Data refinement is a well-established technique for transforming specifications of abstract data types into ones, which are closer to an eventual implementation. The conditions under which a transformation is a correct refinement are encapsulated into two simulation rules: downward and upward simulations. One approach for refining an abstract system is to specify the concrete data type, and then attempt to verify that it is a valid refinement of the abstract type. An alternative approach is to calculate the concrete specification based upon the abstract specification and a retrieve relation, which links the abstract and concrete states. In this paper we generalise existing calculational methods for downward simulations and derive similar results for upward simulations; we also document their use and application in a particular specification language, namely Z.

Action systems for security specification

To be generally useful a theory must be both theoretically sound and practically applicable. We consider the noninterference approach to security specification, focusing in particular on Roscoe's work on nondeterminism. This provides a starting point

A region-based theory for state assignment in speed-independent circuits

State assignment problems still need satisfactory solutions to make asynchronous circuit synthesis more practical. A well-known example of such a problem is that of complete state coding (CSC), which happens when a pair of different states in a specification has the same binary encoding. A standard way to approach state coding conflicts is to insert new state signals into the original specification in such a way that the original behavior remains intact. This paper proposes a method which improves over existing approaches by coupling generality, optimality, and efficiency. The method is based on the use of a class of "ground objects", called regions, that play the role of a bridge between state-based specifications (transition systems, TS's) and event-based specifications (signal transition graphs, STG's), We need to deal with both types of specification because designers usually prefer a timing diagram-like notation, such as STG, while optimization and cost analysis work better at the state level. A region in a transition system is a set of states that corresponds to a place in an STG (or the underlying Petri net). Regions are tightly connected with a set of properties that are to be preserved across the state encoding process, namely, 1) trace equivalence between the original and the encoded specification, and 2) implementability as a speed-independent circuit. We will build on a theoretical body of work that has shown the significance of regions for such property-preserving transformations, and describe a set of algorithms aimed at efficiently solving the encoding problem. The algorithms have been implemented in a software tool called petrify. Unlike many existing tools, petrify represents the encoded specification as an STG. This significantly improves the readability of the result (compared to a state-based description in which concurrency is represented implicitly by interleaving), and allows the designer to be more closely involved in the synthesis process. The efficiency of the method is demonstrated on a number of "difficult" examples.

A Constraint Oriented Proof Methodology based on Modal Transition Systems

In this paper, we present a constraint-oriented state-based proof methodology for concurrent software systems which exploits compositionality and abstraction for the reduction of the verification problem under investigation. Formal basis for this methodology are Modal Transition Systems allowing loose state-based specifications, which can be refined by successively adding constraints. Key concepts of our method are <em>projective views</em>, <em>separation of proof obligations</em>, <em> Skolemization</em> and <em>abstraction</em>. The method is even applicable to real time systems

The rest stays unchanged (concurrency and state-based specification)

Abstract Pre-/postconditions have been extensively used in program specification, e.g. Z [Spi89], VDM [Jon86], and proof, e.g. Hoare logic, Dijkstra's guarded commands [DiF88]. In [ScP86, SPB90] the authors introduced neutral and central relations to formalise the concept of “the rest stays the same”. In this paper we abstract away from the specific definition of neutral relation given in [SPB90], through the mechanism of relational boolean algebras. This leads to the definition of implicitly central relations which are easier for the user in practical examples and facilitate the use of pre-/postcondition reasoning about truly concurrent behaviour.

Formal specification of a look manager

A formal specification of the look manager of a dialog system is presented. The look manager deals with the presentation of visual aspects of objects and the editing of those visual aspects. A formal model for specifying the look of objects based on the notion of texturing objects is presented. The texturing model is built from the observed real-life use of overlays of slides. The specification takes as a given hypothesis an invariant relation between the logical display of objects and their layout on the physical screen. The look on the screen is characterized as an invariant ideal show relation. The formalization achieves modularity for the look manager. The specifications are written using the Z notation. The experiment is an integral part of a larger effort in the formal design of a dialog system. It shows that the state-based specification methodology Z is very well suited for description of graphical interface software. Further, the formal specification yields insight into the inherent complexity of building graphical interfaces and their associated displays. >

The date refinement calculator for Z specifications

This paper concerns calculational methods of refinement in state-based specification languages. Data refinement is a well-established technique for transforming specifications of abstract data types into ones, which are closer to an eventual implementation. The conditions under which a transformation is a correct refinement are encapsulated into two simulation rules: downward and upward simulations.One approach for refining an abstract system is to specify the concrete data type, and then attempt to verify that it is a valid refinement of the abstract type. An alternative approach is to calculate the concrete specification based upon the abstract specification and a retrieve relation, which links the abstract and concrete states. In this paper we generalise existing calculational methods for downward simulations and derive similar results for upward simulations; we also document their use and application in a particular specification language, namely Z.

Specification statements and refinement

We discuss the development of executable programs from state-based specifications written in the language of first-order predicate calculus. Notable examples of such specifications are those written using the techniques Z and VDM; but our interest will be in the rigorous derivation of the algorithms from which they deliberately abstract. This is of course the role of a development method.