Testing is an important part of the software engineering process to help ensure that systems will behave as expected. In this paper we investigate interactive system testing, taking into consideration the different components of the system. Interactive systems have three different components, the interactive, functional and overlap. The interactive component is the interface of the interactive system, the functional the underlying instructions of the interactive system, and the overlap component the point at which the interactive and functional components intersect. The interactive and functional components are often tested separately, however, problems can occur where these components overlap. Therefore, in this paper we present a model-based testing approach specifically designed to inspect the overlap component behaviour and to ensure that it behaves as expected.

To gain confidence in safety-critical interactive systems, formal modelling and analysis plays a vital role. The aim of this paper is to use Coloured Petri Nets to model and analyze safety-critical interactive systems. We present a technique to construct a single Coloured Petri Net model of the user interface, interaction and functionality of safety-critical interactive systems and then analyze the achieved Coloured Petri Net model using a state space analysis method. There are several reasons for using Coloured Petri Nets. Coloured Petri Nets provides a graphical representation and hierarchical structuring mechanism, and a state space verification technique, which allows querying the state space to investigate behaviours of a system. There are several tools that supports Coloured Petri Nets including the CPN Tool which helps in building CPN models and allows simulation and analysis using state spaces. The technique to model and analyze safety-critical interactive systems is illustrated using a simplified infusion pump example.

For validation or for communication with a client, it is useful to create a visualisation of a specification. It is important that the visualisation does not mislead the user. In this work we look at how to characterise the conditions for a micro-chart visualisation to be sound. This is done by introducing a new operator to the micro-chart semantics, allowing us to use Z data refinement to find a refinement relation between a Z specification and its (claimed sound) micro-chart visualisation. If the relation does not hold, then the visualisation is not sound.

Model-based development of interactive systems provides a number of benefits which can support the creation of robust and correct systems, particularly important when the interactive systems are safety-critical. Many different approaches have been proposed which target the models at different aspects of the development process (for example task analysis, interface layouts, functional behaviours etc.) and which can be used in different ways (verification of correctness, plasticity, usability). One of the aims for any modelling method should be simplicity - we are after all trying to hide complexity via abstraction in order to make reasoning about systems more tractable than working at the programming level. One of the challenges that exists however we do our modelling is ensuring the consistency between the model of the interface and interactivity and model of the functional behaviour of the system. This is primarily due to the different types of models that most naturally describe these different elements. In this paper we propose a method of tightening the integration of models of these different components of the system by generating obligations which explicitly describe the coupling of functional behaviour with interactive elements. We then show how these obligations can be used to support the development process during the programming and testing of the system.

No abstract available.

No abstract available.

No abstract available.

Abstract Formal approaches to software development require that we correctly describe (or specify) systems in order to prove properties about our proposed solution prior to building it. We must then follow a rigorous process to transform our specification into an implementation to ensure that the properties we have proved are retained. Different transformation, or refinement, methods exist for different formal methods, but they all seek to ensure that we can guide the transformation in a way which preserves the desired properties of the system. Refinement methods also allow us to subsequently compare two systems to see if a refinement relation exists between the two. When we design and build the user interfaces of our systems we are similarly keen to ensure that they have certain properties before we build them. For example, do they satisfy the requirements of the user? Are they designed with known good design principles and usability considerations in mind? Are they correct in terms of the overall system specification? However, when we come to implement our interface designs we do not have a defined process to follow which ensures that we maintain these properties as we transform the design into code. Instead, we rely on our judgement and belief that we are doing the right thing and subsequent user testing to ensure that our final solution remains useable and satisfactory. We suggest an alternative approach, which is to define a refinement process for user interfaces which will allow us to maintain the same rigorous standards we apply to the rest of the system when we implement our user interface designs.

Abstract In this paper, we give simple example abstract data types, with atomic operations, that are related by data refinement under a definition used widely in the literature, but these same abstract data types are not related by singleton failure refinement. This contradicts results found in the literature.

This paper presents supervisory control theory in a process-algebraic setting, and proposes a way of synthesising modular supervisors that guarantee nonblocking. The framework used includes the possibility of hiding actions which results in nondeterminism. As modularity crucially depends on the process equivalence used, the paper studies possible equivalences and points out that, in order to be consistent with respect to the nonblocking property and to supervisor synthesis, a conflict-preserving equivalence must be used. It applies the results to synthesise nonblocking modular supervisors for a manufacturing system.

Development by formal stepwise refinement offers a guarantee that an implementation satisfies a specification. But refinement is frequently defined in such a restrictive way as to disallow some useful development steps. Here we define feature refinement to overcome some limitations of refinement and show its usefulness by applying it to examples taken from the literature. Using partial relations as a canonical state-based semantics and labelled transition systems as a canonical event-based semantics, we define functions formally linking the state- and event-based operational semantics. We can then use this link to move notions of refinement between the event- and state-based worlds. An advantage of this abstract approach is that it is not restricted to a specific syntax or even a specific interpretation of the operational semantics.

Abstract. We show how a theory of specification refinement and program development can be constructed as a conservative extension of our existing logic for Z. The resulting system can be set up as a development method for a Z-like specification language, or as a generalisation of a refinement calculus (with a novel semantics). In addition to the technical development we illustrate how the theory can be used in practice.

Stepwise design involves the process of deriving a concrete model of a software system from a given abstract one. This process is sometimes known as refinement. There are numerous refinement theories proposed in the literature, each of which stipulates the nature of the relationship between an abstract specification and its concrete counterpart. This paper considers six refinement theories in Z that have been proposed by various people over the years. However no systematic investigation of these theories, or results on the relationships between them, have been presented or published before. This paper shows that these theories fall into two important categories and proves that the theories in each category are equivalent.

Abstract A new style of formal methods course is described, based on a pragmatic approach that emphasizes testing. The course introduces students to formal specification using Z, and shows how formal specification and testing can benefit each other, in both the validation and verification phases. It uses a tools‐based approach, with practical work that reinforces formal specification techniques as well as traditional software engineering skills, such as unit and system testing, inspection and defensive programming with assertions. The two main results are to identify several practical uses of formal specifications that are not widely practised or taught, and to demonstrate that teaching them results in a more interesting and relevant formal methods course. Copyright © 2001 John Wiley & Sons, Ltd.

/spl mu/-Charts are a way of specifying reactive systems, i.e. systems which are in some environment to which they have to react, based on the well-established formalism Statecharts. This paper gives (very abbreviated) examples of translating /spl mu/-charts to Z, which is itself a well-established language for specifying computational systems with tried and tested methods and support tools which guide its effective use in systems development. We undertake this translation in order that investigation of the modelled system can be performed before expensive and lengthy implementation is considered. We also present an extension of the /spl mu/-charts and the related Z to deal with a simple command language, local variables and integer-valued signals.

In this paper we introduce and investigate an improved kernel logic Zc for the specification language Z. Unlike standard accounts, this logic is consistent and is easily shown to be sound. We show how a complete shema calculus can be derived within this logic and in doing so we reveal a high degree of logical organization within the language. Finally, our approach eschews all non-standard concepts introduced in the standard approach, notably object level notions of substitution and entities which share properties both of constants and variables. We show, in addition, that these unusual notions are derivable in Zc and are, therefore, unnecessary innovations.

Abstract. This is the first of two related papers. We introduce a simple specification logic Z C comprising a logic and a semantics (in ZF set theory) within which the logic is sound. We then provide an interpretation for (a rational reconstruction of) the specification language Z within Z C . As a result we obtain a sound logic for Z, including a basic schema calculus.

Abstract. This is the second of two related papers. In “Revising Z: Part I - logic and semantics” (this journal) we introduced a simple specification logic Z C comprising a logic and a semantics (in ZF set theory). We then provided an interpretation for (a rational reconstruction of) the specification language Z within Z C . As a result we obtained a sound logic for Z, including the basic schema calculus. In this paper we extend the basic framework with more sophisticated features (including schema operations) and we mount a critique of a number of concepts used in Z. We further demonstrate that the complications and confusions which these concepts introduce can be avoided without compromising expressibility.

There has been an explosion of interest in the use of logic in computer science in recent years. This is in part due to theoretical developments within academic computer science and in part due to the recent popularity of Formal Methods amongst software engineers. There is now a widespread and growing popularity of Formal Methods amongst software engineers. There is now a widespread and growing recognition that formal techniques are central to the subject and that a good grasp of them is essential for a practising computer scientist. This recognition that computer science has become a much more rigorous subject has lead a number of influential academics to call for changes to its curriculum that reflect this new rigour [8,12]. At the same time, it is a commonplace amongst computer science teachers that students find formal techniques difficult to learn. The growth of interest in logic has therefore been accompanied by a further recognition that certain kinds of mechanical support are necessary in order for logic to be used effectively. The purpose of this article is to describe a number of programs which have been developed to support the teaching of logic. Three broad criteria have been used in evaluating these systems. We consider their logical generality (the power of the encoded logic), their usability (the quality of the user interface) and their pedagogic value as teaching tools. We hope the review will act as a useful reference for the design and development of logic curricular within computer science.