Eiffel Refinement Calculus for OOSystems R.Paige and J.Ostroff

1
Eiffel Refinement Calculus for
OO-Systems(R.Paige and J.Ostroff)
ERC

• Presented by Jared Schirm

2
Overview

• Motivation
• Refinement
• Eiffel
• Eiffel Refinement
• Outlook and Conclusion

3
Motivation

• Seamless Development with OO-Techniques
• A core set of modelling constructs
• .. applied throughout entire development process
• OO Refinement Calculus
• for provably correct code
• achieved in modular manner
• with Eiffels built-in specification mechanism
• .. all in one

4
Seamless Development

• OO can model everything
• late requirements
• SW architectures
• detailed specification and design
• implementation
• testing
• .. so a refinement calculus should directly lead
  to all OO-language constructs (including the
  standard imperative/procedural)

5
Refinement

• first order logic for specification
• for imperative programs
• from specification to implementation
• constructive approach
• via proof obligations
• complementary to static checking

6
Refinement An Approach

• math
• Equation x² 1
• Solutions x 1 , x -1
• refinement
• Specification x x² 1
• Programs x 1 , x -1

7
Contract Notation

• specification w pre, post
• frame w
• the bunch of variables, which may be modified
• precondition pre
• a single state predicate on the prestate space
• postcondition post
• a double state predicate on the space of pre-
  poststate
• Example a,y,z y?0, xy² ? ?yltza

8
Special Contracts(with abbreviation w post
for w true, post )

• abort w false, true
• choose w true
• skip true
• magic w false

9
The Refinement Process

• spec ? mixed1 ? .. ? mixedn ? code
• more clear more executable
• step by step
• x,y true, x9 ? y²x spec
• ? x true, x9 y true, y²x spec
• ? x9 y true, y²x mixed
• ? x9 ysqrt(x) code
• ? x9 y3 code

10
Basic Refinement Laws

• strengthen postcondition
• iff post ? post then w pre, post ? w
  pre, post
• weaken precondition
• iff pre ? pre then w pre, post ? w
  pre, post
• assign
• iff pre ? post w\E then w,x pre, post ?
  wE
• feasibility
• iff pre ? (?wT ? post) then wpre, post is
  feasible

11
Eiffel The Language

• is purely OO
• goes the next natural steps in this technique
• multiple inheritance with name conflict
  management
• expanded classes
• addition to OO paradigm
• separate queries and commands
• pre- and postconditions for routines,
• class- and loop invariants
• has the desired specification through contracts ..

12
Eiffel The Class
class CITIZEN feature ANY name, sex
STRING spouse CITIZEN children
SETCITIZEN single BOOLEAN ensure Result
(spouse Void) divorce modifies single,
spouse require ?single ensure single ? (old
spouse).single invariant single_or_married
single ? spouse.spouse Current number_of_paren
ts parents.count ? 2 symmetry ? c ? children
? ? p ? c.parents ? p Current end
13
ERC - Notaion

• ?s, s pre- and poststate
• r.spec ?r.pre ? r.post ? t ? ?t ? t ? ?
• time
• e ?S, D? ?S ? D ? time ? ?(e)
• ?(w) ?(s-w)
• spec ? impl (? ?s,s ? impl ? spec)

??????
14
ERC Core Rule Setfor imperative program
constructs
skip
e1 ?e1 ? e2 ?e2 ? ... ? en ?en ? time
e1exp
defined(?exp ) ? e1 ?exp ? e2 ?e2 ? ... ? time
if b then P else Q
( ?b ? P ) ? ( ?b ? Q ) ? time
P Q
? s1 ? P s s1 ? Q ?s s1
(local e T P)
(? e,?e T ? P)
15
Reuse of Z and Morgan Rules

• infeasible specs cant be expressed in Z
• Z-spec P is typedecl ? pre ? post ,
• P.pre is (? s ? P) ? (P.pre, P)
• Z style
• P1 ?z P2 (? ?s,s ? P1.pre ? P2.pre ? P2 ? P1)
• ? ERC, Morgan style
• P1 ? P2 (? ?s,s ? (P2.pre ? P2) ? (P1.pre ? P1))
  
• ?
• ?z ? ?

16
Entity Groups for References

• r.? reference entities reachable from r
• attrs of class, args and local vars
• e entity group the set of entities referring
  to same object as e
• r.? bunch of entity groups
• ee2,e3 e e,e2,e3
• reference equality
• (e1 e2) ? (e1 e2)

17
Rule for create statement

• create e
• modifies e, t
• ensure ee ? remove(e) ? default(e)
• remove(e) ? ei ? ?e ? ei ? e ? ei ?ei e
• default(e) each e.a is set to default vaule

18
Rule for assigned feature call

• e1 e2.q(e3)
• modifies e1, t
• require e2 ? Void
• q.preae2.a, Currente2, x2 e3
• ensure q.posta?e2.a, Current?e2, x e3,
  Resulte1
• e1 e2.q(e3)

19
Eiffel Refinement Process

• write Eiffel classes with contracts
• start refinement at the root class
• refine only one class at a time
• .. routine by routine
• from the dependees use the contracts
• take some dependee and refine, refine, ..

20
Outlook and Conclusion

• What is the benefit?
• a refinement calculus for producing immediately
  executable Eiffel programs
• What is missing?
• support for expanded types, exception handlers
  and agents
• Tool support for the calculus