CS:5810 Formal Methods in Software Engineering
Fall 2014

Course introduction and administration. Introduction to Formal Methods.

• Syllabus
• Course overview [pdf]
• [Haxt10] An introduction to formal methods, with examples of industrial usage.

• [Barr13] A sobering reading on the probable causes of the fatal sudden acceleration problem in some Toyota cars. See also this EE times article
• [vLam00] An introduction to formal specifications, and a survey of formal specification approaches.

Introduction to Formal Methods continued.

• Course introduction [pdf]
• [Medv00] Excellent complementary class notes introducing FM's.
• [Haxt10] An introduction to formal methods, with examples of industrial usage.

• [Beck06] A look at the state of the art in formal methods and a discussion of the developments that make successful applications possible.
• [Wood09] A fairly recent survey on the use and practice of FM.

Formal methods: main goals and challenges.
Recap of basic notions in set theory.

• Course introduction [pdf]
• Lecture notes on sets and relations (as needed) [pdf]

More on relations and relational operators. Modeling general software systems. Introduction to the Alloy modeling language.

• Lecture notes on sets and relations (as needed) [pdf]
• Lecture notes: An introduction to Alloy 4 - Part 1 [pdf]

• Alloy FAQ

Alloy's foundations. Signatures, fields and multiplicity constraints.
Modeling simple domains in Alloy. Relations and operations on them.
Formulas, Boolean operators and quantifiers. Expressing constraints on relations using Alloy formulas.

• Lecture notes: an introduction to Alloy 4 - Part 1 [pdf] and 2 [pdf]
• Family examples from the notes
• models/examples/toys/genealogy.als sample model in the Alloy Analyzer
• Alloy 4 tutorial Part 1, notes by Greg Dennis and Rob Seater [pdf]

More features of the Alloy language: functions and predicates, facts and assertions.
Practice with modeling in Alloy: the Academia domain.
Examples and exercises.

• Lecture notes: an introduction to Alloy 4 - Part 1 [pdf] and 2 [pdf]
• Family examples from the notes
• Lecture notes: the Academia model [pdf]
• Academia examples from the notes

Alloy's module system. Motivations and uses. Parametric modules. An example: the predefined Ordering module.
Modeling dynamic systems in Alloy. General approach: dymanic systems as state transition systems. Operators. Preconditions, postconditions and frame conditions.

• Lecture notes: Alloy Modules [pdf]
• Lecture notes: Dynamic Models in Alloy [pdf]
• Family examples

• util/ordering.als sample model in the Alloy Analyzer

More on modeling dynamic systems in Alloy. Example: rovers on a two-dimentional space.
A complete Alloy modeling case study: the hotel room lock system.
Brief discussion of Homework 1 and its solution.

• Lecture notes: Dynamic Models in Alloy [pdf]
• rover.als Rover model in dynamic systems examples
• Lecture notes: Hotel Lock System [pdf]
• book/chapter6/hotel*.als sample models (first 2 only) in the Alloy Analyzer

Introduction to reactive systems. Introduction to the Lustre specification language.
Examples of Lustre programs. Specifying simple reactive systems in Lustre.

• Lecture notes: Reactive Systems and the Lustre language, Part 1 [pdf] and 2 [pdf]

• Lustre/Luke examples
• Chap. 1 of [Halb02], a Lustre tutorial

Practice with writing Lustre models and expressing their properties. Checking properties via synchronous observers.
Simulating Lustre programs with the Kind 2 tool (online examples).
Useful temporal operators. A few examples.

• Lecture notes: Reactive Systems and the Lustre language, Part 1 [pdf] and 2 [pdf]
• Lustre examples seens in class
• Notes on synchronous observers
• Chap. 1 of [Halb02], a Lustre tutorial

• [Halb91], the main reference paper for Lustre
• [Halb99], an introduction to verification and testing with Lustre

More practice with writing Lustre models and expressing their properties. Checking properties via synchronous observers. In-class exercises. Boolean Switches and traffic light examples.

• Lustre examples seens in class
• Notes on synchronous observers

• [Halb91], the main reference paper for Lustre
• [Halb99], an introduction to verification and testing with Lustre

Discussion of Homework 2 and its solution.

Modeling systems and building simulators. The elevator case study.

• Description of Elevator problem in Exercise 5

Midterm exam.

Discussion of midterm solutions.

Specifying and verifying programs in high-level programming languages. Introduction to Dafny. Main features. Specifying pre and post-conditions. Examples.

• [Koen12], an introduction to the Dafny language
  (also available as an online tutorial)

More on Dafny. Loop invariants. Complex specifications using recursive functions. Arrays and quantified verification conditions. Predicates. Examples.

• [Koen12], an introduction to the Dafny language

• Dafny on-line tutorials
• Dafny quick reference

Termination of while loops and recursive functions in Dafny. Reading Frames. Classes. Class invariants. Constructors, fields and class methods. Ghost fields. Using ghost fields to represent abstract states. Connecting concrete and abstract state in class. Examples.
Brief introduction to value types in Dafny: finite sets, multisets and sequences.

• [Herb11] and [Lein13], lecture and tutorial notes on Dafny
• Dafny on-line tutorial on termination
• Dafny on-line tutorials on sets, multisets and sequences
• Abstract counter example seen in class
• Abstract integer set example seen in class

• Dafny quick reference
• Language reference for the Dafny type system
  (which also describes available expressions for each type)

No class (Thanksgiving recess)

Discussion of Homework 3 solutions.
More on specifying classes and methods in terms of abstract state. Abstract FIFO queue example. More on frames and on developing code and specifications in Dafny. Common issues and pitfalls.

• FIFO queue example
• Dafny on-line tutorials on sets, multisets and sequences

Dynamic Frames in Dafny. Motivation and uses. Counter example revised.
An overview to Frama-C and ACSL.

• Counter example with dynamic frames
• [Herb11]

• Lecture notes by V. Prevosto on Frama C and ACSL
• ACSL reference manual