DOCSLIB.ORG

Deductive Software Verification— the Key Book

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Deductive Software Verification— the Key Book Wolfgang Ahrendt, Bernhard Beckert, Richard Bubel, Reiner Hähnle, Peter H. Schmitt, Mattias Ulbrich (Editors) Deductive Software Verification— The KeY Book From Theory to Practice Springer Chapter 2 First-Order Logic Peter H. Schmitt 2.1 Introduction The ultimate goal of first-order logic in the context of this book, and this applies to a great extent also to Computer Science in general, is the formalization of and reasoning with natural language specifications of systems and programs. This chapter provides the logical foundations for doing so in three steps. In Section 2.2 basic first-order logic (FOL) is introduced much in the tradition of Mathematical Logic as it evolved during the 20th century as a universal theory not tailored towards a particular application area. Already this section goes beyond what is usually found in textbooks on logic for computer science in that type hierarchies are included from the start. In the short Section 2.3 two features will be added to the basic logic, that did not interest the mathematical logicians very much but are indispensable for practical reasoning. In Section 2.4 the extended basic logic will be instantiated to Java first-order logic (JFOL), tailored for the particular task of reasoning about Java programs. The focus in the present chapter is on statements; programs themselves and formulas talking about more than one program state at once will enter the scene in Chapter3. 2.2 Basic First-Order Logic 2.2.1 Syntax Definition 2.1. A type hierarchy is a pair T = (TSym;v), where 1. TSym is a set of type symbols; 2. v is a reflexive, transitive relation on TSym, called the subtype relation; 3. there are two designated type symbols, the empty type ? 2 TSym and the universal type > 2 TSym with ? v A v > for all A 2 TSym. 23 24 2 First-Order Logic We point out that no restrictions are placed on type hierarchies in contrast to other approaches requiring the existence of unique lower bounds. Two types A, B in T are called incomparable if neither A v B nor B v A. Definition 2.2. A signature, which is sometimes also called vocabulary, S = (FSym;PSym;VSym) for a given type hierarchy T is made up of 1. a set FSym of typed function symbols, by f : A1 × ::: × An ! A we declare the argument types of f 2 FSym to be A1;:::;An in the given order and its result type to be A, 2. a set PSym of typed predicate symbols, by p(A1;:::;An) we declare the argument types of p 2 PSym to be A1;:::;An in the given order, : PSym obligatory contains the binary dedicated symbol =(>;>) for equality. and the two 0-place predicate symbols true and false. 3. a set VSym of typed variable symbols, by v : A for v 2 VSym we declare v to be a variable of type A. All types A, Ai in this definition must be different from ?.A 0-ary function symbol c : ! A is called a constant symbol of type A.A 0-ary predicate symbol p() is called a propositional variable or propositional atom. We do not allow overloading: The same symbol may not occur in FSym [ PSym [ VSym with different typing. The next two definitions define by mutual induction the syntactic categories of terms and formulas of typed first-order logic. Definition 2.3. Let T be a type hierarchy, and S a signature for T . The set TrmA of terms of type A, for A 6= ?, is inductively defined by 1. v 2 TrmA for each variable symbol v : A 2 VSym of type A. 2. f (t1;:::;tn) 2 TrmA for each f : A1 × ::: × An ! A 2 FSym and all terms ti 2 TrmBi with Bi v Ai for 1 ≤ i ≤ n. 3. (if f then t1 else t2) 2 TrmA for f 2 Fml and ti 2 TrmAi such that A2 v A1 = A or A1 v A2 = A. If t 2 TrmA we say that t is of (static) type A and write a(t) = A. Note, that item (2) in Definition3 entails c 2 TrmA for each constant symbol c : ! A 2 FSym. Since we do not allow overloading there is for every term only one type A with t 2 TrmA. This justifies the use of the function symbol a. Terms of the form defined in item (3) are called conditional terms. They are a mere convenience. For every formula with conditional terms there is an equivalent formula without them. More liberal typing rules are possible. The theoretically most satisfying solution would be to declare the type of (if f then t1 else t2) to be the least common supertype A1 t A2 of A1 and A2. But, the assumption that A1 t A2 always exists would lead to strange consequences in the program verification setting. Definition 2.4. The set Fml of formulas of first-order logic for a given type hierar- chy T and signature S is inductively defined as: 2.2. Basic First-Order Logic 25 1. p(t1;:::;tn) 2 Fml for p(A1;:::;An) 2 PSym, and ti 2 TrmBi with Bi v Ai for all 1 ≤ i ≤ n. As a consequence of item2 in Definition 2.2 we know : t1 = t2 2 Fml for arbitrary terms ti and true and false are in Fml. 2. (:f), (f ^ y), (f _ y), (f ! y), (f $ y) are in Fml for arbitrary f;y 2 Fml. 3. 8v;f, 9v;f are in Fml for f 2 Fml and v : A 2 VSym. As an inline footnote we remark that the notation for conditional terms can also be used for formulas. The conditional formula (if f1 then f2 else f3) is equivalent to (f1 ^ f2) _ (:f1 ^ f3). If need arises we will make dependence of these definitions on S and T explicit by writing TrmA;S , FmlS or TrmA;T ;S , FmlT ;S . When convenient we will also use the redundant notation 8 A v;f, 9 A v;f for a variable v : A 2 VSym. Formulas built by clause (1) only are called atomic formulas. Definition 2.5. For terms t and formulas f we define the sets var(t), var(f) of all variables occurring in t or f and the sets fv(t), fv(f) of all variables with at least one free occurrence in t or f: var(v) = fvg fv(v) = fvg for v 2 VSym Sn Sn var(t) = i=1 var(ti) fv(t) = 1=i fv(ti) for t = f (t1;:::;tn) var(t) = var(f) [ fv(t) = fv(f) [ for t = var(t1) [ var(t2) fv(t1) [ fv(t2) (if f then t1 else t2) Sn Sn var(f) = i=1 var(ti) fv(f) = i=1 fv(ti) for f = p(t1;:::;tn) var(:f) = var(f) fv(:f) = fv(f) var(f) = var(f1) [ var(f2) fv(f) = fv(f1) [ fv(f2) for f = f1 ◦ f2 where ◦ is any binary Boolean operation var(Q v:f) = var(f) fv(Q v:f) = var(f) n fvg where Q 2 f8;9g A term without free variables is called a ground term, a formula without free variables a ground formula or closed formula. It is an obvious consequence of this definition that every occurrence of a variable v in a term or formula with empty set of free variables is within the scope of a quantifier Q v. One of the most important syntactical manipulations of terms and formulas are substitutions, that replace variables by terms. They will play a crucial role in proofs of quantified formulas as well as equations. Definition 2.6. A substitution t is a function that associates with every variable v a type compatible term t(v), i.e., if v is of type A then t(v) is a term of type A0 such that A0 v A. We write t = [u1=t1;:::;un=tn] to denote the substitution defined by dom(t) = fu1;:::;ung and t(ui) = ti. A substitution t is called a ground substitution if t(v) is a ground term for all v 2 dom(t). 26 2 First-Order Logic We will only encounter substitutions t such that t(v) = v for all but finitely many variables v. The set fv 2 VSym j t(v) 6= vg is called the domain of t. It remains to make precise how a substitution t is applied to terms and formulas. Definition 2.7. Let t be a substitution and t a term, then t(t) is recursively defined by: 1. t(x) = x if x 62 dom(t) 2. t(x) as in the definition of t if x 2 dom(t) 3. t( f (t1;:::;tk)) = f (t(t1);:::;t(tk)) if t = f (t1;:::;tk) Let t be a ground substitution and f a formula, then t(f) is recursive defined 4. t(true) = true, t(false) = false 5. t(p(t ;:::;t )) = p(t(t );:::;t(t )) if f is the atomic formula p(t ;:::;t ) :1 k : 1 k 1 k 6. t(t1 = tk) = t(t1) = t(tk) 7. t(:f) = :t(f) 8. t(f1 ◦ f2) = t(f1) ◦ t(f2) for propositional operators ◦ 2 f^;_;!;$g 9. t(Qv:f) = Qv:tv(f) for Q 2 f9;8g and dom(tv) = dom(t) n fvg with tv(x) = t(x) for x 2 dom(tv). There are some easy conclusions from these definitions: 0 0 • If t 2 TrmA then t(t) is a term of type A with A v A.
Load more

Recommended publications
  • Proofs for the Working Engineer
    Research Collection Doctoral Thesis Proofs for the working engineer Author(s): Mehta, Farhad Dinshaw Publication Date: 2008 Permanent Link: https://doi.org/10.3929/ethz-a-005635243 Rights / License: In Copyright - Non-Commercial Use Permitted This page was generated automatically upon download from the ETH Zurich Research Collection. For more information please consult the Terms of use. ETH Library DISS. ETH NO. 17671 Proofs for the Working Engineer A dissertation submitted to ETH ZURICH for the degree of Doctor of Sciences presented by Farhad Dinshaw Mehta Master of Science, Technische Universit¨atM¨unchen Bachelor of Technology, Indian Institute of Technology Delhi born 11.01.1980 citizen of India accepted on the recommendation of Prof. Jean-Raymond Abrial Prof. Peter M¨uller Prof. Cliff Jones 2008 Abstract Over the last couple of decades the advantages of including formal proof within the development process for computer based systems has become in- creasingly clear. This has lead to a plethora of logics and proof tools that propose to fulfill this need. Nevertheless, the inclusion of theorem proving within the development process, even in domains where clear benefits can be expected, is rather an exception than the rule. One of the main goals of the formal methods endeavour is to bring the ac- tivity of formal theorem proving closer to the engineer developing computer based systems. This thesis makes some important practical contributions towards realising this goal. It hopes to shows that proper tool support can not only ease theorem proving, but also strenghten its role as a design aid. It shows that it is feasible to integrate interactive proof within a reactive development environment for formal systems.
    [Show full text]
  • Fiendish Designs
    Fiendish Designs A Software Engineering Odyssey © Tim Denvir 2011 1 Preface These are notes, incomplete but extensive, for a book which I hope will give a personal view of the first forty years or so of Software Engineering. Whether the book will ever see the light of day, I am not sure. These notes have come, I realise, to be a memoir of my working life in SE. I want to capture not only the evolution of the technical discipline which is software engineering, but also the climate of social practice in the industry, which has changed hugely over time. To what extent, if at all, others will find this interesting, I have very little idea. I mention other, real people by name here and there. If anyone prefers me not to refer to them, or wishes to offer corrections on any item, they can email me (see Contact on Home Page). Introduction Everybody today encounters computers. There are computers inside petrol pumps, in cash tills, behind the dashboard instruments in modern cars, and in libraries, doctors’ surgeries and beside the dentist’s chair. A large proportion of people have personal computers in their homes and may use them at work, without having to be specialists in computing. Most people have at least some idea that computers contain software, lists of instructions which drive the computer and enable it to perform different tasks. The term “software engineering” wasn’t coined until 1968, at a NATO-funded conference, but the activity that it stands for had been carried out for at least ten years before that.
    [Show full text]
  • Oral History of Sir Antony Hoare
    Oral History of Sir Antony Hoare Interviewed by: Jonathan P. Bowen Recorded: September 8, 2006 Cambridge, United Kingdom CHM Reference number: X3698.2007 © 2006 Computer History Museum Oral History of Sir Antony Hoare Jonathan Bowen: Hello, Tony. Would you like to introduce yourself briefly? Sir Antony Hoare: I’m Tony Hoare, principal researcher at Microsoft Research Limited in Cambridge. Thank you for coming here to talk to me. Bowen: Thank you, Tony. I’m looking forward to our talk together. It would be interesting to know, first of all, how you grew up, and what your mother and father did. Hoare: My father was a colonial civil servant, and my mother was the daughter of a tea planter in Ceylon. She was called out to Ceylon to act as social secretary for my grandfather, and they met in Ceylon, married there, and I was born there. Bowen: And do you have any memories of Ceylon? Hoare: Oh, yes, I have quite vivid memories of going to school there. In those days it was still quite a wild place, and we used to go out to the country -- indeed into the forest -- to see animals and elephants and tigers. Had quite exciting adventures there in the school party. Bowen: And you had brothers and sisters? Hoare: I have two younger brothers and two younger sisters. My second brother was also born in Ceylon. Bowen: And you all got on well together? You were a happy family? Hoare: Oh, yes, in the end anyway. Bowen: Yes, like all families. Yes. Hoare: We still have the opportunity to meet quite frequently.
    [Show full text]
  • Roadmap for Enhanced Languages and Methods to Aid Verification Gary T
    Computer Science Technical Reports Computer Science 7-2006 Roadmap for Enhanced Languages and Methods to Aid Verification Gary T. Leavens Iowa State University Jean-Raymond Abrial ETH Zürich Don Batory University of Texas Michael Butler University of Southampton Alessandro Coglio Kestrel Institute See next page for additional authors Follow this and additional works at: https://lib.dr.iastate.edu/cs_techreports Part of the Computational Engineering Commons, Programming Languages and Compilers Commons, and the Software Engineering Commons Recommended Citation Leavens, Gary T.; Abrial, Jean-Raymond; Batory, Don; Butler, Michael; Coglio, Alessandro; Fisler, Kathi; Hehner, Eric; Jones, Cliff; Miller, Dale; Peyton-Jones, Simon; Sitaraman, Murali; Smith, Douglas R.; and Stump, Aaron, "Roadmap for Enhanced Languages and Methods to Aid Verification" (2006). Computer Science Technical Reports. 6. https://lib.dr.iastate.edu/cs_techreports/6 This Article is brought to you for free and open access by the Computer Science at Iowa State University Digital Repository. It has been accepted for inclusion in Computer Science Technical Reports by an authorized administrator of Iowa State University Digital Repository. For more information, please contact [email protected]. Roadmap for Enhanced Languages and Methods to Aid Verification Abstract This roadmap describes ways that researchers in four areas -- specification languages, program generation, correctness by construction, and programming languages -- might help further the goal of verified software. It also describes what advances the ``verified software'' grand challenge might anticipate or demand from work in these areas. That is, the roadmap is intended to help foster collaboration between the grand challenge and these research areas. A common goal for research in these areas is to establish language designs and tool architectures that would allow multiple annotations and tools to be used on a single program.
    [Show full text]
  • Application of Link Integrity Techniques from Hypermedia to the Semantic Web
    UNIVERSITY OF SOUTHAMPTON Faculty of Engineering and Applied Science Department of Electronics and Computer Science A mini-thesis submitted for transfer from MPhil to PhD Supervisor: Prof. Wendy Hall and Dr Les Carr Examiner: Dr Nick Gibbins Application of Link Integrity techniques from Hypermedia to the Semantic Web by Rob Vesse February 10, 2011 UNIVERSITY OF SOUTHAMPTON ABSTRACT FACULTY OF ENGINEERING AND APPLIED SCIENCE DEPARTMENT OF ELECTRONICS AND COMPUTER SCIENCE A mini-thesis submitted for transfer from MPhil to PhD by Rob Vesse As the Web of Linked Data expands it will become increasingly important to preserve data and links such that the data remains available and usable. In this work I present a method for locating linked data to preserve which functions even when the URI the user wishes to preserve does not resolve (i.e. is broken/not RDF) and an application for monitoring and preserving the data. This work is based upon the principle of adapting ideas from hypermedia link integrity in order to apply them to the Semantic Web. Contents 1 Introduction 1 1.1 Hypothesis . .2 1.2 Report Overview . .8 2 Literature Review 9 2.1 Problems in Link Integrity . .9 2.1.1 The `Dangling-Link' Problem . .9 2.1.2 The Editing Problem . 10 2.1.3 URI Identity & Meaning . 10 2.1.4 The Coreference Problem . 11 2.2 Hypermedia . 11 2.2.1 Early Hypermedia . 11 2.2.1.1 Halasz's 7 Issues . 12 2.2.2 Open Hypermedia . 14 2.2.2.1 Dexter Model . 14 2.2.3 The World Wide Web .
    [Show full text]
  • Conference Program
    FM 6 Conference Program August 21 – 27, 2006, McMaster University, Hamilton, Ontario, Canada Program at a Glance Monday Tuesday Wednesday Thursday Friday Saturday Sunday August 21 August 22 August 23 August 24 August 25 August 26 August 27 8:00–9:00 Registration Registration Registration Registration Registration Registration 8:45–12:30 Morning Tutorial T1 Tutorial T8 Opening Remarks Invited Talk Invited Talk Tutorial T10 Workshop W3 9:00–12:30 Tutorial T9 Invited Talk Technical Symp. Technical Symp. Workshop W2 Workshop W4 Doctoral Symp. Industry Day Workshop W3 Technical Symp. Workshop W4 Noon Posters & Tools Posters & Tools Posters & Tools 12:30–14:00 B. Russell Archive B. Russell Archive FME Meeting Afternoon Tutorial T2 Tutorial T6 Invited Talk Technical Symp. Invited Talk Tutorial T10 14:00–17:30 Tutorial T3 Tutorial T8 Industry Day Technical Symp. Workshop W2 Tutorial T4 Tutorial T9 Technical Symp. Closing Remarks Workshop W3 Workshop W1 Doctoral Symp. 15:00–22:00 Workshop W4 Excursion & Banquet Evening 18:00–20:00 Reception Welcome It is our pleasure to welcome you to FM’06, the premier international forum for practitioners and researchers applying mathematical methods to the design of highly reliable computer systems. This is the 14th event in this series, and for the first time takes place in North America, at McMaster University in Hamilton, Ontario, Canada. A program of five invited talks and 36 outstanding research papers provides the opportunity to learn about the newest developments in the theory and application of formal methods. The program covers a wide range of topics, including theorem proving, modeling, real-time, specification, education, programming languages, and testing.
    [Show full text]
  • Retrospective and Prospective for Unifying Theories of Programming
    2006-2-5 Unifying Theories of Programming, Springer LNCS 4010 p.1-17 0 Retrospective and Prospective for Unifying Theories of Programming Eric Hehner Department of Computer Science, University of Toronto, Toronto ON M5S 2E4 Canada [email protected] Abstract This paper presents a personal account of developments leading to Unifying Theories of Programming, and some opinions about the direction the work should take in the future. It also speculates on consequences the work will have for all of computer science. 0 UTP and me My introduction to formal methods was the book a Discipline of Programming [2] by Edsger Dijkstra in 1976. I wrote a small contribution in a paper named do considered od [14] in that same year. In that paper I proposed recursive refinement as a way of composing programs, and a different way of generating the sequence of approximations for loop semantics that is more general than the one in Dijkstra's book, applying to all looping constructs, including general recursion. It was standard in semantics work then (and for some people, it remains so today) to use a meaning function (sometimes written as ⟦ ⟧ ) that maps program text to its meaning. In Dijkstra's book, he used the wp function to map a program text and postcondition to a precondition. If S is some program text, and R is a postcondition, then wp(S, R) is the exact precondition1 for execution of S to 1 The English meaning of “precondition” is “something that is necessary beforehand”. Dijkstra was using it to mean “something that is sufficient beforehand”.
    [Show full text]
  • Calendar 2008-2009
    University of Toronto School of Graduate Studies 2008 / 2009 Calendar Graduate Programs: Web Site: Student Services at SGS: For admission and application www.sgs.utoronto.ca Telephone: (416) 978-6614 information, contact the graduate unit Fax: (416) 978-4367 directly. Contact information and Web E-mail: site addresses are listed in each unit's [email protected] entry. [email protected] 63/65 St. George Street, Toronto, Ontario, Canada, M5S 2Z9 Mission Statement Dean’s Welcome The mission of the School of Graduate Studies I am delighted to welcome you to the many graduate is to promote excellence in graduate education and communities of the University of Toronto. We are proud of research University-wide and ensure consistency and our accomplishments as a centre for graduate education high standards across the divisions. Sharing respon- that integrates advanced scholarship and research into sibility for graduate studies with graduate units and every degree program. Please use this site to learn more divisions, and operating through a system of collegial about the excellent programs we offer. governance, consultation and decanal leadership, Here at the largest graduate school in Canada, over SGS defines and administers university-wide regula- 13,000 graduate students are studying in an extraordi- tions for graduate education. nary range of scholarly fields. The diversity of our depart- SGS also provides expertise, advice and information; ments, centres, and institutes means that the focus and oversees the design and delivery of programs; organizes expertise that you seek is very likely to be found within reviews and develops performance standards; supports the graduate offerings at U of T.
    [Show full text]
  • University of Southampton Research Repository Eprints Soton
    University of Southampton Research Repository ePrints Soton Copyright © and Moral Rights for this thesis are retained by the author and/or other copyright owners. A copy can be downloaded for personal non-commercial research or study, without prior permission or charge. This thesis cannot be reproduced or quoted extensively from without first obtaining permission in writing from the copyright holder/s. The content must not be changed in any way or sold commercially in any format or medium without the formal permission of the copyright holders. When referring to this work, full bibliographic details including the author, title, awarding institution and date of the thesis must be given e.g. AUTHOR (year of submission) "Full thesis title", University of Southampton, name of the University School or Department, PhD Thesis, pagination http://eprints.soton.ac.uk Performance-Oriented Refinement Stefan Hallerstede A thesis submitted for the degree of Doctor of Philosophy Department of Electronics and Computer Science University of Southampton United Kingdom July 2001 UNIVERSITY OF SOUTHAMPTON ABSTRACT FACULTY OF ENGINEERING AND APPLIED SCIENCE Doctor of Philosophy Performance-Oriented Refinement Stefan Hallerstede We introduce the probabilistic action system formalism which combines re- finement with performance. Performance is expressed by means of probabil- ity and expected costs. Probability is needed to express uncertainty present in physical environments. Expected costs express physical or abstract quan- tities that describe a system. They encode the performance objective. The behaviour of probabilistic action systems is described by traces of expected costs. Corresponding notions of refinement and simulation-based proof rules are introduced. Formal notations like B [2] or action systems [8] support a notion of refinement.
    [Show full text]
  • Deductive Software Verification— the Key Book
    Part VI Appendices Appendix A Java Modeling Language Reference Daniel Grahl This appendix serves as a comprehensive reference for the syntax and semantics the dialect of the Java Modeling Language (JML) that is used in the KeY system, version 2.6. The extensions for information flow introduced in Section 13.4 are also included. Section A.1 presents the full syntax of JML as it is supported by the KeY system. In Section A.2, the semantics of JML expressions is given through a translation to JavaDL. Refer to Chapters7 ff. for in depth explanations and a discussion on these items. Contract semantics are not covered here; they are treated extensively in Section 8.2. We cover the issue of well-definedness in Section A.3. A.1 JML Syntax The syntax of JML is heavily intertwined with the syntax of the Java language. The JML reference manual [Leavens et al., 2013] presents a complete grammar for Java enriched with (standard) JML specifications. This includes every grammatical feature—from lexical tokens to compilation units. Here, in this appendix, we take on another approach in not reiterating the entire Java syntax, but indicating where the given definitions would be injected into it. This section only describes syntax; we assume that it is clear from the context how to produce expressions that are well-typed; in doubt, refer to the JML reference manual [Leavens et al., 2013]. Since JML has been designed for other analysis approaches, not all constructs that are introduced in the JML reference manual [Leavens et al., 2013]do make sense for the KeY approach.
    [Show full text]
  • Funding a Revolution: Government Support for Computing Research
    Funding a Revolution: Government Support for Computing Research FUNDING A REVOLUTION GOVERNMENT SUPPORT FOR COMPUTING RESEARCH Committee on Innovations in Computing and Communications: Lessons from History Computer Science and Telecommunications Board Commission on Physical Sciences, Mathematics, and Applications National Research Council NATIONAL ACADEMY PRESS Washington, D.C. 1999 Copyright National Academy of Sciences. All rights reserved. Funding a Revolution: Government Support for Computing Research NOTICE: The project that is the subject of this report was approved by the Governing Board of the National Research Council, whose members are drawn from the councils of the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine. The members of the committee responsible for the report were chosen for their special competences and with regard for appropriate balance. The National Academy of Sciences is a private, nonprofit, self-perpetuating society of distinguished scholars engaged in scientific and engineering research, dedicated to the fur- therance of science and technology and to their use for the general welfare. Upon the authority of the charter granted to it by the Congress in 1863, the Academy has a mandate that requires it to advise the federal government on scientific and technical matters. Dr. Bruce Alberts is president of the National Academy of Sciences. The National Academy of Engineering was established in 1964, under the charter of the National Academy of Sciences, as a parallel organization of outstanding engineers. It is autonomous in its administration and in the selection of its members, sharing with the National Academy of Sciences the responsibility for advising the federal government.
    [Show full text]
  • Formal Methods of Programming
    Taking command DR ERIC HEHNER of software design Dr Eric Hehner entered the world of computing shortly after the discipline emerged. With over 40 years of experience, he has helped shape the formal methods underpinning in programming evolution a lot of money playing guitars badly). And today, not just the best I could make it 10 people teach themselves to program (as I years ago. I stopped calling editions ‘first’, did), but that doesn’t make them software ‘second’ and so on, and started calling them engineers (though a lot of people make a lot by year-month-day. I also keep a change log, of money writing programs badly). available for all to see. When I wrote my first programs, I had no Formal methods you have helped create idea that writing a program could be as could one day become the industry norm. reliable as proving a mathematical theorem. Could you highlight some of the real- That’s what you learn from a formal world applications seen to date? methods course. I am not saying anything against teaching yourself to throw a ball, Formal methods, not just mine, have strum a guitar or program; they are all fun. been used to develop and verify But if you want to advance to the next level, telephone switching systems and internet you need a course. As it happens, I offer communication protocols, as well as an online course that is free, you can start aeroplane cabin communications. They have anytime, and proceed at your own pace to be used for safety-critical software such (www.cs.utoronto.ca/~hehner/FMSD).
    [Show full text]