Refining UML specifications. - the STAIRS method. Ragnhild Kobro Runde. Joint work with Ketil Stølen and Øystein Haugen. Ragnhild Kobro Runde

Transcription

1 Refining UML specifications - the STAIRS method Joint work with Ketil Stølen and Øystein Haugen SARDAS-seminar / Refining UML specifications / Slide 1

2 Outline Introduction to sequence diagrams. What is refinement? The pragmatics of creating sequence diagrams. The pragmatics of refining sequence diagrams. Summary. SARDAS-seminar / Refining UML specifications / Slide 2

3 Example: Appointment system MakeAppointment CancelAppointment DecideAppTime SARDAS-seminar / Refining UML specifications / Slide 3

4 UML sequence diagrams sd CancelAppointment Message Send-event :Client :AppSystem cancel(appointment) appointmentcancelled() appointmentsuggestion(time) yes() appointmentmade() Lifeline (instance) Receive-event Partial ordering of events: - The send event is ordered before the corresponding receive event. - Events on the same lifeline are ordered from the top and downwards. CancelAppointment specifies two traces. SARDAS-seminar / Refining UML specifications / Slide 4

5 Referencing sd DecideAppTime :Client :AppSystem appointmentsuggestion(time) yes() appointmentmade() SARDAS-seminar / Refining UML specifications / Slide 5

6 UML 2.x operators sd D2 :L1 :L2 a loop {0...4} b SARDAS-seminar / Refining UML specifications / Slide 6

7 Sequence diagrams as example runs sd CancelAppointment :Client :AppSystem cancel(appointment) appointmentcancelled() appointmentsuggestion(time) yes() appointmentmade() A sequence diagram is a partial description! Positive traces represent valid system behaviour. Negative traces represent invalid system behaviour. All remaining traces are called inconclusive. Positive Inconclusive Negative SARDAS-seminar / Refining UML specifications / Slide 7

8 Outline Introduction to sequence diagrams. What is refinement? The pragmatics of creating sequence diagrams. The pragmatics of refining sequence diagrams. Summary. SARDAS-seminar / Refining UML specifications / Slide 8

9 Refinement Refinement is a development step, adding more information to the model. Step-wise refinement. Compositional refinement. SARDAS-seminar / Refining UML specifications / Slide 9

10 Other changes Not all changes are refinements! - Correcting errors. - Handling changed requirements. - Describing the system addressing a different concern, i.e. from a different viewpoint. SARDAS-seminar / Refining UML specifications / Slide 10

11 Outline Introduction to sequence diagrams. What is refinement? The pragmatics of creating sequence diagrams. - The pragmatics of alternative behaviour - The pragmatics of guards - The pragmatics of negative behaviour The pragmatics of refining sequence diagrams. Summary. SARDAS-seminar / Refining UML specifications / Slide 11

12 Alternative behaviour sd DecideAppTime :Client :AppSystem appointmentsuggestion(time) xalt yes() appointmentmade() no() noappointment() alt similar traces, giving implementation freedom xalt traces that must all be present in the system SARDAS-seminar / Refining UML specifications / Slide 12

13 Alternative behaviour (2) SARDAS-seminar / Refining UML specifications / Slide 13

14 Guards sd CancelAppointment :Client :AppSystem cancel(appointment) xalt [ appointment < now + 24h ] errormessage() [ else ] appointmentcancelled() ref DecideAppTime Use guards to constrain the situations in which the different alternatives are positive. Traces with a false guard are negative. Always make sure that for each alternative, the guard is sufficiently general to capture all possible situations in which the described traces are positive. SARDAS-seminar / Refining UML specifications / Slide 14

15 Guards (2) sd MakeAppointment :Client :AppSystem alt [ true ] needapp() [ date today ] needapp(date) [ 7 hour 17 ] needapp(hour) ref DecideAppTime In an alt-construct, make sure that the guards are exhaustive. If doing nothing is valid, specify this by using the empty diagram, skip. SARDAS-seminar / Refining UML specifications / Slide 15

16 Negative behaviour To effectively constrain the implementation, the specification should include a reasonable set of negative traces. Use veto when the empty trace (i.e. doing nothing) should be positive, as when specifying a negative message in an otherwise positive scenario. Use refuse when specifying that one of the alternatives in an altconstruct represents negative traces. Use assert on an interaction fragment when all possible positive traces for that fragment have been described. SARDAS-seminar / Refining UML specifications / Slide 16

17 Outline Introduction to sequence diagrams. What is refinement? The pragmatics of creating sequence diagrams. The pragmatics of refining sequence diagrams. Summary. SARDAS-seminar / Refining UML specifications / Slide 17

18 Refinement in STAIRS Positive Supplementing Inconclusive Negative Narrowing SARDAS-seminar / Refining UML specifications / Slide 18

19 Supplementing sd DecideAppTime :Client :AppSystem appointmentsuggestion(time) xalt yes() appointmentmade() no() noappointment() Use supplementing to add positive or negative traces to the model. All of the original positive traces must remain positive and all of the original negative traces must remain negative. Do not use supplementing on the operand of an assert. SARDAS-seminar / Refining UML specifications / Slide 19

20 Narrowing sd MakeAppointment sd MakeAppointment :Client :AppSystem :Client :AppSystem alt [ true ] needapp() [ date today ] needapp(date) [ 7 hour 17 ] needapp(hour) alt [ true ] needapp() [ date today ] needapp(date) refuse needapp(hour) ref DecideAppTime ref DecideAppTime Use narrowing to remove underspecification by redefining positive traces as negative. All original negative traces must remain negative. SARDAS-seminar / Refining UML specifications / Slide 20

21 Narrowing (2) sd CancelAppointment :Client :AppSystem cancel(appointment) xalt [ appointment < now + 24h ] errormessage() [ else ] appointmentcancelled() ref DecideAppTime Guards may be added to an alt/xalt-construct as a legal narrowing step. Guards may be narrowed, i.e. the refined condition must imply the original one. SARDAS-seminar / Refining UML specifications / Slide 21

22 Outline Introduction to sequence diagrams. What is refinement? The pragmatics of creating sequence diagrams. The pragmatics of refining sequence diagrams. Summary. SARDAS-seminar / Refining UML specifications / Slide 22

23 Summary Take special care when specifying - alternative behaviours - negative behaviours Refinement means adding more information - supplementing: new positive/negative traces - narrowing: positive traces redefined as negative These refinement notions enable - step-wise refinement - compositional refinement SARDAS-seminar / Refining UML specifications / Slide 23

24 Evaluation Formal proofs - Transitivity. - Monotonicity. Other examples/cases - Automatic teller machine. - Vending machine with tea/coffee. - Network communication. - Games: tic-tac-toe, flipping a coin, throwing a dice. - Gambling machine. - BuddySync: automatically matching service providers with users of those services. SARDAS-seminar / Refining UML specifications / Slide 24

25 Thank you! SARDAS-seminar / Refining UML specifications / Slide 25