Formal Methods of Programming
Total Page:16
File Type:pdf, Size:1020Kb
Taking command DR ERIC HEHNER of software design Dr Eric Hehner entered the world of computing shortly after the discipline emerged. With over 40 years of experience, he has helped shape the formal methods underpinning in programming evolution a lot of money playing guitars badly). And today, not just the best I could make it 10 people teach themselves to program (as I years ago. I stopped calling editions ‘first’, did), but that doesn’t make them software ‘second’ and so on, and started calling them engineers (though a lot of people make a lot by year-month-day. I also keep a change log, of money writing programs badly). available for all to see. When I wrote my first programs, I had no Formal methods you have helped create idea that writing a program could be as could one day become the industry norm. reliable as proving a mathematical theorem. Could you highlight some of the real- That’s what you learn from a formal world applications seen to date? methods course. I am not saying anything against teaching yourself to throw a ball, Formal methods, not just mine, have strum a guitar or program; they are all fun. been used to develop and verify But if you want to advance to the next level, telephone switching systems and internet you need a course. As it happens, I offer communication protocols, as well as an online course that is free, you can start aeroplane cabin communications. They have anytime, and proceed at your own pace to be used for safety-critical software such (www.cs.utoronto.ca/~hehner/FMSD). as medical systems, nuclear power plant Who has been influencing and supporting controls and aircraft attitude monitors. The your research at the University Among your achievements, you published largest software that uses formal methods of Toronto? a Practical Theory of Programming in is a compiler, and the largest hardware is 1993. How have you revised the book to a processor (CPU). More commonly, it is In 1977 I was fortunate to be invited to join keep the information up to date? used for parts of systems, like the kernel the International Federation for Information of a secure distributed operating system Processing (IFIP) Working Group 2.3, a team 1993 was a couple of years before the (software), and a floating-point unit of about 30 people from all over the world internet became widely available. By 2002 (hardware). Formal methods were used to who collectively invented formal methods, I had accumulated a list of improvements develop Paris’ automated (driverless) metro, winning all the top awards in computer and updates and some new material, and it and China’s railway controls. BMW uses science, including six Turing Awards. We was time for a second edition. By then, the formal methods to develop its monitoring meet for one week every nine months or so internet was well established, and I wanted and reaction systems. But formal methods and discuss our shared research. They have to make my book freely available on the are not yet used for banking and financial all been an influence on me, and perhaps I internet. Springer, who owned the copyright, software, nor for most application software. have been an influence on them. I can’t list refused. How can they and I make money if them all, but I will mention just two. Edsger our product is freely available? What does the future hold for Dijkstra was both an inspiration and a good quantum computing? friend; Sir Tony Hoare still is an inspiration To an author of an advanced-level book, and good friend. the money is not significant; it can never According to the principles of quantum repay the work of writing the book. I didn’t physics, quantum computers should be able Programming is a useful skill to have, give up the fight, and I had some powerful to perform computations that are infeasible with the number of people teaching allies, so in the end Springer allowed me to on today’s computers. I am no expert themselves growing daily. What advice put the book on the web. From my point at building quantum computers. Those would you give to these individuals to of view, the main benefit was the ability that have been built have very few qubits improve their theory and practice? to make changes. When I discovered how (quantum bits) of memory, and there are probabilistic programming could benefit serious problems with decoherence (loss of People teach themselves to throw a ball, but from my formal methods, I added a quantum properties) happening after only a that doesn’t make them ballistics experts. section. Anytime I saw a way to improve few seconds of operation. I don’t know when People teach themselves to strum a guitar, an explanation, or to shorten a proof, I quantum computers will become practical, but that doesn’t make them musicians made the change that same day. I always but when they do, we have the formal (though I admit that a lot of people make want my book to be the best I can make it methods for programming them reliably. WWW.RESEARCHMEDIA.EU 77 DR ERIC HEHNER Formal methods of software design The formal methods group in the Department of Computer Science at the University of Toronto has been working to provide a mathematical foundation for software engineering, helping engineers write precise specifications to say what the software will be for, and then design software whose executions provably satisfy the specifications DESIGNING ERROR-FREE software is One of the features of Netty is that it keeps Hehner’s theory is simpler, using a single Boolean difficult, but it is essential for software on track of all specifications and implementations expression for specifications. The theory is also which lives depend, such as aircraft control or that it has been used for. Then, when anyone more general, applying to both terminating pacemaker software. The correctness of each uses it again for a task, or a part of a task, that is and nonterminating computation, sequential step in the design and development has to be the same as or sufficiently similar to one that it and parallel computation, stand-alone and proven in the same way that mathematical has already been used for, Netty completes the interactive computation. It also includes time theorems are proven. At present, it is possible software development automatically. bounds, both for algorithm classification and to develop small and medium-sized programs for tightly constrained real-time applications. and the critical parts of large programs this A US Government report noted: “In the most HOW IT WORKS way. In the future, scaling up the use of formal advanced manifestation, formulated by methods to large software projects requires Hehner’s main innovation is to treat programs Eric Hehner, programming is identified with the support of a software development tool the same way as specifications, so that pieces mathematical logic. Although it remains to be that includes an automated prover. of program and pieces of specification can be seen whether this degree of mathematisation freely mixed and connected. Specifications can will eventually become common practice, the employ programming notations whenever they history of engineering analysis suggests that this NETTY are helpful, and engineers can reason about outcome is likely”. Dr Eric Hehner, together with his student Lev computations in the full logic, using both the Naiman and former students Anya Tafliovich logic notations and the programming notations. OTHER APPLICATIONS and Robert Will, all at the formal methods The reason this is valuable is that engineers start group in the Department of Computer with a specification, end with a program, and in Along with former student Professor Theo Science at the University of Toronto, Canada, the middle of software development they have Norvell, now at Memorial University, Hehner are designing and implementing a software a meaningful mixture. During development they has applied the same theory to the automation development tool named Netty, after Netty are privy to whether the development is correct; of the logical aspects of digital circuit design, van Gasteren, a pioneer in calculational proof. they do not have to wait until the end to find making it possible to design large-scale circuits For a long time there have been compilers bugs. The same formal methods that tell when that are entirely verified. To design a circuit, one that tell when a syntax error is made, telling a mistake is made during software development exactly what the error is and exactly where it also tell when a mistake is made during software occurs. Netty takes the next step: it is a logic modification, and that is a big source of bugs. The team checker that tells when a logic error is made, and tells exactly what it is and where it occurs. Hehner’s theory is described in his book a The formal methods group at the University To build such tools and to use them effectively Practical Theory of Programming (first edition of Toronto consists of Professors Eric requires knowledge of formal methods. The Springer 1993, current edition free online at Hehner, Marsha Chechik, Azadeh Farzan word ‘formal’ refers to the use of formal www.cs.utoronto.ca/~hehner/aPToP). There and their students. Hehner develops formal languages for specification and proof so that were previous theories, starting in 1969 with methods as an aid to software design and the entire software development process, Hoare Logic, which uses a pair of predicates modification. Chechik and Farzan develop including proof of correctness, is at least for specification.