Основы Perfect Developer

Transcription

1 Основы Perfect Developer Краткий курс

2 Содержание Session 1: начало работы Configuring Perfect Developer and creating a project Expressions, types, constants, functions, properties Classes, data, invariants, functions, schemas, constructors Session 2: погружение Interfacing to a Java front-end Sequences and recursion Session 3: корректировка методов и данных Statement lists, statement types, loops, nested refinement. Internal data, retrieve functions Session 4: наследование Derived and deferred classes Defining and redefining inherited methods

3 Конфигурация Конфигурация Perfect Developer заключается в выборе редактора Загрузите Project Manager Выберите Options Editor Найдите исполняемый файл редактора Выберите тип редактора Конфигурация редактора для автоматического распознавания файлов Perfect Developer См. инструкции в папке Editor Customizations где установлен Perfect Developer

4 Создание проекта Выберите New project из меню или иконку Выберите папку для записи файлов, задайте имя проекта и щелкните Save и OK Щелчком на иконку Create file создайте файл Examples Добавьте текст: property (a, b, c: int) pre a < b, b < c assert a < c; Сохраните файл Щелкните на иконку Verify для запуска проверки

5 Некоторые предопределенные классы bool char int real set of X bag of X seq of X map of (X -> Y) Set, bag, sequence и map типы являются конечными коллекциями. См. Language Reference Manual

6 Выражения Все обычные арифметические операции a < b < c означает точно то, что вы ожидали a / b (integer) и a % b удовлетворяют precondition b > 0 a / b (integer) округляется в сторону - a.. b обозначает последовательность {a, a+1, a+2 b} #c обозначает cardinality или длину коллекции c a # c обозначает число появлений a в c

7 Booleans, Conditionals etc. Boolean операции: & ==> <== <==> Conditional выражения: ( [a > 0]: a, [b > 0]: b, []: 0) Let-декларация: ( let t ^= a - b; t * t ) Embedded assertion: ( assert a > 0, b > 0; a / b ) Законченный пример: ( let t ^= a - b; assert t > 0; [t > 10]: 1, []: 10 / t )

8 Вызовы конструктора Вызов конструктора возвращает объект заданного типа Без параметров: seq of int{} MyClass{} С параметрами: seq of int{a, b, c} MyClass{42} Некоторые классы предполагают наличие предусловий (preconditions) int{s} это ok при s = "123" но не для s = "lemon"! [precondition is: ~s.empty & (forall c::s :- c.isdigit)]

9 Квантификаторы и etc. Если c имеет тип set of T, bag of T или seq of T, и p(x) это Boolean выражение содержащее x: Expression forall x::c :- p(x) forall x: T :- p(x) exists x::c :- p(x) exists x: T :- p(x) that x::c :- p(x) T any x::c :- p(x) those x::c :- p(x) Return type bool bool set / seq / bag of T for x::c yield v(x) set / seq / bag of type of v for those x::c :- p(x) yield v(x)

10 Декларация констант и функций Декларация констант: const four: int ^= 2 + 2; const smallprimes: seq of int ^= those x:: :- ~(exists y::2..<x :- x % y = 0); const two ^= 2; Type can be omitted in simple cases Декларация функций: function half(x: int): int pre x > 0 Precondition (if needed) ^= x / 2;

11 Декларация свойств (properties) Используйте декларацию свойств для формулировки теорем: property assert half(four) = two; Неявная универсальная квантификация всех параметров property (x: int) pre x > 0, Предпологаемые данные x % 2 = 0 assert half(x) < x, (let h ^= half(x); h + h = x); Следствия, трующие доказательства

12 Exercise 1: см. лаб 10 All the integers from 0 to 100 inclusive, in ascending order. Verify that your solution contains 42 but does not contain 101. The integer j (which is known to be greater than 0) divides the integer i exactly. The squares of all the prime numbers from 2 to 100 inclusive. The highest integer in a set S of integers that is known to be non-empty

13 Декларация перечислений class Currency ^= enum unspecified, euro, pound, USdollar end; const localcurrency ^= localcurrency.tostring

14 Декларация классов class Money ^= abstract interna l confined interface end; variables, invariants, methods, constructors [never mind for now] [never mind for now] access redeclarations, methods, constructors, properties Декларируемые здесь переменные, образуют абстрактную модель данных класса Инварианты здесь являются ограничениями на данные Эти методы и конструкторы для использования в confined и/или interface методах и конструкторах Access redeclarations позволяют получить доступ к данным и методам извне класса Эти методы и конструкторы могут вызываться извне класса Обязательной является только секция interface

15 Декларирование данных и Переменная amt типа int abstract var amt: int, ccy: Currency; инвариантов Пременная ccy типа Currency invariant amt = 0 ccy ~= unspecified@currency; Ограничения на amt и ccy

16 Функции и операторы Name No () if no parameters Return type function worthhaving: bool ^= amt > 0; function plus(m: Money): Money pre m.ccy = ccy ^= Currency{amt + m.amt, ccy} assert result.ccy = ccy; operator (n: int) * : Money ^= Currency{amt * n, ccy}; Result expression Optional precondition Optional postassertion Operator declarations are the same as function declarations apart from the header Use nonmember prefix for methods & properties with no self object

17 Декларация Schema No self object No () if no parameters Parameter is modified nonmember schema swap(a!, b!: Money) pre a.ccy = b.ccy post change a,b satisfy a =b, b =a assert a.plus(b) = b.plus(a ); Postcondition includes frame This one modifies instance variables schema!inflate(howmuch: int) pre 0 < howmuch < 200 post amt! = (amt * howmuch)/100; Сокращение для: change amt satisfy amt = (amt * howmuch)/100

18 Декларация конструкторов Note parameter list in {} build{a: int, c: Currency} pre a > 0 post amt! = a, ccy! = c; build{!amt: int} post ccy! = euro@currency; build{} ^= Money {0, unspecified@currency}; This constructor is defined in terms of another one Postcondition must initialise all instance variables* Initialise instance variable directly from the parameter Сокращение для: change amt satisfy amt = a We do use {} if no parameters *except for variables whose when-guards are false

19 Использование access redeclarations abstract переменные могут быть redeclared в interface: function v1; selector v2; разрешает чтение v1 разрешает чтение и запись v2 Разрешение записи в переменную следует избегать Except for convenience classes, e.g. class pair Разрешение чтения переменной сложного типа следует избегать Поскольку это приводит к трудностям ее дальнейшего преобразования Константы могут быть redeclared как nonmember functions Use access redeclarations sparingly!

20 Exercise 2: Specification (followed by coffee break) (см. лаб.10) You have been provided with a Perfect specification of class Money Try to verify it (there will be 3 verification errors) Fix the specification to remove the verification errors Verify that multiplying a Money object by 2 is equivalent to adding it to itself Declare a + operator that works like the plus function except that if the amount of either operand is zero, we don t care what the corresponding currency is

21 Использование Perfect с графическим UI Java front-end class MyApp implements ActionListener MyApp() Button 1 Button 2 constructor calls when pressed calls when pressed calls Perfect back-end class Application ^= interface build{} function f ( ) schema! s ( ) Избегайте предусловий для методов, вызываемых в Java!

22 Использование Perfect с графическим UI Декларируйте Perfect класс Application Декларируйте интерфейс функции/схемы для вызова в Java Декларируйте интерфейс конструктор для вызова в Java В графической среде: Import Application.java Instantiate a single Application object during initialisation Call member functions/schemas when buttons are pressed Convert parameter types as necessary Имеется пример в файле TutorialExample.java

23 Exercise 3: Build the sample program Open project TutorialExample.pdp Verify the project Click the Build tool icon Check for error messages Locate and run output\app.jar Try making your own changes to Application.pd e.g. print some of the expressions you wrote earlier [tips follow ]

24 Tips To use constants and functions from Examples.pd: Add file Examples.pd to the project Add to Application.pd: import "Examples.pd"; You can convert any expression to a string By calling.tostring on it To make your application robust: Verify your version of Application.pd Don t add any preconditions to the methods called from Java!

25 Sequences and Strings The standard collection types are: set of X, bag of X, seq of X (where X is any type you like) string seq of char Members of class seq of X include: head tail front back append(x) prepend(x) ++(s) # (x)in take(n) drop(n) slice(offset, length) isndec isninc permndec permninc isordered(cp)!sort(cp) findfirst(x) findlast(x) Useful global functions include: flatten(ss: seq of seq of X) interleave(ss, s) See the Library Reference for details

26 Recursive and templated functions Indicates that T can be any type function reverse(s: seq of class T): seq of T decrease #s ^= ( [#s <= 1]: s, []: reverse(s.front).prepend(s.last) ); Recursion variant Recursive call

27 Рекрсивные варианты Общая форма: decrease e1, e2, e3 e1, e2 один из типов int, bool, char или перечисление Вариант должен убывать на каждом шаге рекурсии Либо e1 должен убывать либо e1 остается прежним, но e2 убывает либо e1 и e2 остаются прежними, но e3 убывает Целочисленные компоненты не могут становиться отрицательными

28 Exercise 4: Sequences Specify the following functions: numleadingspaces(s: string): nat returns the index of the first character in s that is not a space, or the length of s if it is all spaces removeleadingspaces(s: string): string returns s with any leading spaces removed firstword(s: string): string returns the leading characters of s up to but not including the first space character in s splitintowords(s: string): seq of string splits the sentence s into individual words (hint: use recursion!)

29 Lunch break!

30 Refinement There are three types of refinement in Perfect: Refining result expressions to statement lists Refining postconditions to statement lists Refining abstract data to implementation data When you refine the abstract data of a class, you normally need to refine the method specifications as well So we will start with refining specifications

31 Refining specifications Specification refinement serves these purposes: To implement a specification where Perfect Developer fails to To implement a specification more efficiently To take account of data refinement in affected methods You can refine these sorts of specification: Expressions that follow the ^= symbol Postconditions To refine a specification, append to it: via statement-list end

32 Some simple refinements function square(x: int): int ^= x^2 via value x*x end; schema swap(a!, b!: class X) post a!= b, b!= a via let temp ^= a; a! = b; b! = temp end; value statement returns a value from the via..end Semicolon separates and sequences the statements A postcondition can be used as a statement

33 Nested Refinements You can refine not just method specifications but also: Postcondition statements Let-declarations in statement lists function fourth(x: int): int ^= x^4 via let x2 ^= x^2 via value x*x end; value x2*x2 end; value yielded by the inner via..end value yielded by the outer via..end

34 Types of Statement Let-declaration Assertion Variable declaration Postcondition pass statement Exactly the same as in bracketed expressions Same as in postconditions Omit the post keyword! Does nothing If-statement value and done statements Loop statement Block statement

35 If-statement if [c in `a`..`z`]: isaletter! = true; valid! = true; Guard Statement list [c in `0`..`9`]: isaletter! = false; valid! = true; []: valid! = false fi Optional else part [] fi means the same as []: pass fi

36 value statement function max(a,b,c: class X): X satisfy result >= a & result >= b & result >= c & (result=a result=b result=c) via if [a > b]: value max(a, c); []: value max(b, c) fi end; Every path in an expression refinement must end at a value statement

37 done statement schema max(a!,b,c: class X) post change a satisfy a >= a & a >= b & a >= c & (a = a a = b a = c) via if [a > b]: a!= max(a, c); done; [] fi; a!= max(b, c) end; A postcondition refinement may contain one or more done statements Implicit done statement here

38 Loop statement // Calculate a^b Start of loop statement var rslt: int! = 1; loop var j: nat! = 0; change rslt keep rslt = a^j until j = b decrease b - j ; rslt! * b, j! + 1 end; End of loop statement Loop variable declaration List of what the loop can change Loop invariant list Termination condition Loop variant Loop body

39 Loop statement loop local variable declarations (optional) change list (optional) invariant termination condition (optional) variant body statements end If no change list is given, only the local variables can be changed If no termination condition is given, the loop terminates when the variant can decrease no more

40 Designing loop invariants Variables in loop invariants may be primed or unprimed Primed = current values at the start of an iteration Unprimed = value before the loop started The invariant is the only source of information about current values of changing variables The state when the loop completes is given by: invariant & until-part The invariant should comprise: A generalisation of the state that the loop is meant to achieve; Additional constraints needed to make the invariant, until-part, variant and body well-formed

41 Example of invariant design Given s: seq of int we wish to achieve total = + over s Generalise this to tot = + over s.take(j ) for some loop counter j When j = #s then the generalisation becomes the required state because s.take(#s) = s This generalisation forms part of the invariant But s.take(j ) has precondition 0 <= j <= #s So we must either add this precondition as an earlier invariant Or as a type constraint in the declaration of j

42 Loop example (incorrect) var totl: int! = 0; loop var j: int! = 0; change totl keep totl = + over s.take(j ) until j = #s decrease #s - j ; totl! + s[j], j! + 1 end; Problem! These expressions are not universally wellformed

43 Loop example (version 1) var totl: int! = 0; loop var j: int! = 0; change totl keep 0 <= j <= #s, totl = + over s.take(j ) until j = #s decrease #s - j ; totl! + s[j], j! + 1 end; Added this extra invariant at the start This is now well-formed This is also well-formed (provided the untilcondition is false)

44 Loop example (version 2) var totl: int! = 0; loop var j: (int in 0..#s)! = 0; change totl keep totl = over s.take(j ) until j = #s decrease #s - j ; totl! + s[j], j! + 1 end; Added this type constraint This is now well-formed This is also well-formed (provided the untilcondition is false)

45 Refining recursion to loops function rev(s: seq of int): seq of int decrease #s ^= ([s.empty]: s, []: rev(s.tail).append(s.head)) via var rslt: seq of int! = seq of int{}; loop var j: (nat in 0..#s)! = 0; change rslt keep rslt = rev(s.take(j )) until j = #s decrease #s - j ; rslt! = rslt.prepend(s[j]), j! + 1 end; value rslt end;

46 Refining recursion to loops Is the preceding example correct? Probably! But Perfect Developer cannot verify it! The definition builds the result from front to back Using append The implementation builds the result from back to front Using prepend They are equivalent only because of associativity (a ++ b) ++ c = a ++ (b ++ c) reverse(x.tail).append(x.head) = reverse(x.front).prepend(x.last) To prove this we need an inductive prover!

47 Refining recursion to loops function rev(s: seq of int): seq of int decrease #s ^= ([s.empty]: s, []: rev(s.tail).append(s.head)) via var rslt: seq of int! = seq of int{}; loop var j: (nat in 0..#s)! = #s; change rslt keep rslt = rev(s.drop(j )) until j = 0 decrease j ; j! - 1, rslt! = rslt.append(s[j ]) end; value rslt end;

48 Loops: a summary Getting the invariant correct is critical It must describe the relationships between all variables changed by the loop (including the local loop variables) Its main part is a generalisation of the desired state after the loop When the until condition is satisfied, the generalisation must reduce to the desired state You may also need to include constraints on variables To make expressions in the loop well-formed If refining a recursive definition, make sure that the loop builds the result in the same order as the definition

49 Exercise 5: Method refinement Refine the following specifications function min2(x, y: int): int satisfy result <= x, result <= y, result = x result = y; function findfirst(s: seq of int, x: int): int satisfy 0 <= result <= #s, result = #s s[result] = x, forall j::0..<result :- s[j] ~= x; Function numleadingspaces from exercise 4 Function splitintowords from exercise 4

50 Data refinement When designing a class, we should always use the simplest possible abstract data model Avoid redundancy! Don t be concerned with efficiency at this stage! The methods are specified in terms of this model This keeps the specifications simple! The data should not be directly accessible from outside So we can change the implementation of the data without changing the class interface [Except for very simple classes like pair]

51 Data Refinement (cont d) Perfect supports two sorts of data refinement: Replacing abstract variables by internal variables Use a retrieve function to indicate that a variable is replaced Examples: see Dictionary.pd and Queue.pd in C:\Program Files\Escher Technologies \Perfect Developer\Examples\Refinement Supplementing abstract variables by internal variables The new internal data adds no new information Declare internal invariants to specify the relationship Example: add an index to a data structure The internal data may be changed even within a function

52 Data Refinement Example We have a class that maintains a list of numbers Its constructor creates an empty list We provide a method to append a number to the list We provide a method to return the sum of all the numbers in the list

53 List of integers class function sum(s: seq of int): int decrease #s ^= ([s.empty]: 0, []: sum(s.front) + s.last); class ListOfNumbers ^= abstract var list: seq of int; interface function list; build{} post list! = seq of int{}; schema!addnumber(n: int) post list! = list.append(n); function getsum: int ^= sum(list); end;

54 Data Refinement Example Suppose that method sum is called frequently Save time by caching the sum of the list

55 Refined list of integers class class ListOfNumbers ^= abstract var list: seq of int; internal var totl: int; invariant totl = sum(list); interface function list; build{} post list! = seq of int{} via list! = seq of int{}, totl! = 0; end;

56 Refined list of integers class schema!addnumber(n: int) post list! = list.append(n) via list! = list.append(n), totl! + n end; function getsum: int ^= sum(list) via value totl end; end;

57 Exercise 6: Data Refinement Write a recursive function longest which, given a list of strings, returns the longest string in the list (or the empty string if the list is empty, or the latest one of several equal-length longest strings) Write a class that maintains a list of strings. You should provide: A constructor, which sets the list to an empty list A member schema to append a new string to the list A member function to return the longest string in the list Refine the class to make the implementation of the longest member function more efficient

58 Inheritance When declaring a class you can inherit another class Declare class UniversityMember Then class Student ^= inherits UniversityMember And class StaffMember ^= inherits UniversityMember And class Professor ^= inherits StaffMember A derived class inherits the variables of its parent But they are not [normally] visible in the derived class A derived class inherits the methods of its parent But only confined and interface members of the parent are visible

59 The confined section The confined section behaves like the interface section You can put the same types of declaration in it i.e. Methods, operators, constructors, access redeclarations Not constants, variables or invariants But confined declarations are only visible within the current class and its descendents Not to the public at large! cf. protected in Java and C++

60 Redefining methods Functions, selectors, schemas and operators that are inherited from a parent class may be redefined This must be indicated using the redefine keyword The parameter and result types in the redefinition must be identical to those in the overridden function

61 Example of overriding class UniversityMember ^= abstract var firstnames: seq of string, lastname: string; interface function getsalary: Money ^= 0; end; class StaffMember ^= inherits UniversityMember abstract var salary: Money; interface redefine function getsalary: Money ^= salary; end;

62 from types and Dynamic Binding You may declare a variable (or parameter, or result) to be of type from C where C is a class e.g. var member: from UniversityMember The variable may be assigned a value of type C or any of its descendants So member may be assigned a value of type Student, Professor from C actually means the union of all non-deferred classes in the set comprising C and its direct and indirect descendents When calling a member function on such a variable, the [re]definition appropriate to the actual type is called e.g. the relevant version of getsalary

63 Deferred methods You can also declare a method in a class deferred The method is left undefined in that class This avoids the risk of classes inheriting what may be an unsuitable definition The class itself must also be flagged deferred and may not be instantiated Descendent classes may define the method using the define keyword Any descendent class that does not define it is also a deferred class

64 Example of deferred method deferred class UniversityMember ^= abstract var firstnames: seq of string, lastname: string; interface deferred function getsalary: Money; end; class StaffMember ^= inherits UniversityMember abstract var salary: Money; interface define function getsalary: Money ^= salary; end;

65 Final classes and methods A method can be declared final to prevent it from being redefined in a descendent class final function getsalary: Money ^= You can also declare a method final when defining or redefining it define final function getsalary: Money ^= redefine final function getsalary: Money ^= You can declare a class final to mean that no other class may inherit it final class Professor ^=

66 Some consequences If D is a deferred class: var x: D is illegal But you can use var x: from D If F is a final class: var x: from F is illegal But you can use: var x: F If C is a non-final class, f is a final method and g is a nonfinal method, and given var x: from C : In x.f the prover can assume the full postcondition of f In x.g the prover can assume only the postassertion of g

67 Preconditions and inheritance When a method is inherited, by default the precondition is inherited too You may override the inherited precondition by giving a new one in the method definition or redefinition The new precondition must be satisfied whenever the old one would have been satisfied i.e. you may only weaken the precondition To get round this, have the precondition call a method that you can redefine

68 Inherited precondition example Suppose we declare a deferred method ispaid in class UniversityMember define this to return false for class Student, true for class StaffMember Add precondition pre ispaid to method getsalary

69 Inherited precondition example deferred class UniversityMember ^= abstract var firstnames: seq of string, lastname: string; interface deferred function ispaid: bool; deferred function getsalary: Money pre ispaid; end; class StaffMember ^= inherits UniversityMember abstract var salary: int; interface define function ispaid: bool ^= true; define function getsalary: Money ^= salary;

70 Inherited precondition example That worked OK for class StaffMember, but what about class Student? Method getsalary can never be called on class Student because its precondition is always false How should we declare it?

71 Absurd method example deferred class UniversityMember ^= abstract var firstnames: seq of string, lastname: string; interface deferred function ispaid: bool; deferred function getsalary: Money pre ispaid; end; class Student ^= inherits UniversityMember interface define function ispaid: bool ^= false; absurd function getsalary;

72 Absurd methods Declaring a method absurd means that its precondition is always false Repeat the parameter list of the method but not its return type An absurd method declaration has these consequences: The method is defined or redefined such that calling it will raise an exception A verification condition is generated (i.e. that the precondition is always false) It avoids the Given false, so proof is trivial warnings you will otherwise see

73 Inheritance and postassertions When defining or redefining an inherited method, by default the postassertion is inherited You may override the postassertion by giving a new one The old postassertion must be satisfied whenever the new one is i.e. you may only strengthen the postassertion You can also use: assert, q This means assert the inherited postassertion and then q

74 Inheritance tips When using inheritance, declare methods final where possible This is not necessary in leaf classes which are declared final For non-final methods of non-final classes, postassertions are very important Because the prover needs them when the methods are called on from types Does not apply to defining methods like ispaid Only use from types where you really need to allow different types at run-time

75 Inheritance exercises Design a UniversityMember or Employee class hierarchy that reflects the properties and privileges of members of your organisation Specify a family of shopping scanners, as outlined at the end of the Shopping Scanner worked example at:

76 What we didn t cover Lots! after expressions over expressions Guarded variable declarations Selectors Members of classes set and bag Declaring templated classes Other library classes, e.g. map of (X -> Y) How to solve verification problems Serialization Declaring axioms

77 Further Reading Perfect Developer 3.0 Language Reference Manual Start -> Programs -> Perfect Developer -> Documentation Or click on the book tool in the Project Manager Also available at Online tutorial via Support -> Self-help section of the web site Teaching materials via Support -> Self-help -> Teaching materials

78 Thank you for participating!