Правительство Российской Федерации Федеральное государственное автономное образовательное учреждение высшего профессионального образования
«Национальный исследовательский университет «Высшая школа экономики» Факультет Бизнес Информатика
Отделение Программная Инженерия Программа дисциплины Формальные методы программной инженерии для направления 231000.68  «Программная инженерия»
подготовки магистра Автор программы
Профессор, д.ф.м.н. И.А.Ломазова
ilomazova@hse.ru
Рекомендована секцией УМС Одобрена на заседании кафедры по бизнесинформатике Управление разработкой
программного обеспечения
Председатель Ю.В.Таратухина Зав. кафедрой С.М.Авдошин
________________________________ _________________________________
«_____» __________________ 2011г. «____»_____________________ 2011 г
Утверждена Ученым Советом НИУ ВШЭ
Ученый секретарь Н.Ю. Савельева
________________________________
« ____» ___________________2011 г.
Москва 2011
I. Introductory Note
Program Author: Professor, Dr. Irina A. Lomazova, Dr. Sci. (Comp.Sci.) General Description of the Curriculum:
The course is delivered to master students of software engineering department, business informatics faculty, The State University  Higher School of Economics/HSE (master program “Software engineering”).
It is a part of general scientific curricula unit, and it is delivered in modules 14 of the first academic year. The course length is 104 academic hours of audience classes divided into 52 lecture hours and 52 seminar hours and 256 academic hours for students selfstudy.
The covered number of credits is 10. Academic control forms are one home assignment, one test, one written exam after module 2, and one written exam after module 4.
Prerequisites
The course is based on the knowledge of foundations of discrete mathematics, computer science, mathematical logic, algorithm theory and computer programming.
Course Objective The objective of the Formal methods in software engineering course delivery is to train students to treat the specification of software as a very important stage of software development, and also to appreciate the advantages and problems associated with this approach for future projects.
One of the important aspects of formal methods is that, even for quite simple problems, they force the students to think very carefully about the specification, and not to get involved in the coding too quickly. Even for students who have done a lot of programming before the ideas behind formal methods are likely to be completely new, and can draw their attention to problems of program correctness and reliability.
Another very important reason for teaching formal methods is that they are gradually being used in more industrial projects, and thus students should be familiar with at least the ideas associated with the approach, even if they have not learnt the specific formal specification language that their particular industry may require.
Abstract In computer science and software engineering, formal methods are a particular kind of mathematicallybased techniques for the specification, development and verification of software and hardware systems. The use of formal methods for software and hardware design is motivated by the fact that, as in other engineering disciplines, performing appropriate mathematical analysis can contribute to the reliability and robustness of a design.
Formal methods are best described as the application of a fairly broad variety of theoretical computer science fundamentals, in particular logic calculi, formal languages, automata theory, and program semantics, but also type systems and algebraic data types to problems in software and hardware specification and verification.
Formal methods can:
Be a foundation for describing complex systems.
Be a foundation for reasoning about systems.
Provide support for program development.
In contrast to other design systems, formal methods use mathematical proof as a complement to system testing in order to ensure correct behavior. As systems become more complicated, and safety becomes a more important issue, the formal approach to system design offers another level of insurance.
Formal methods differ from other design systems through the use of formal verification schemes, the basic principles of the system must be proven correct before they are accepted. Traditional system design has used extensive testing to verify behavior, but testing is capable of only finite conclusions. Dijkstra and others have demonstrated that tests can only show the situations where a system won't fail, but cannot say anything about the behavior of the system outside of the testing scenarios. In contrast, once a theorem is proven true it remains true.
It is very important to note that formal verification does not obviate the need for testing. Formal verification cannot fix bad assumptions in the design, but it can help identify errors in reasoning which would otherwise be left unverified. In several cases, engineers have reported finding flaws in systems once they reviewed their designs formally.
Roughly speaking, formal design can be seen as a three step process, following the outline given here:
1. Formal Specification: During the formal specification phase, the engineer rigorously defines a system using a modeling language. Modeling languages are fixed formalisms which allow users to model complex structures out of predefined types. This process of formal specification is similar to the process of converting a word problem into algebraic notation.
In many ways, this step of the formal design process is similar to the formal software engineering technique developed by Rumbaugh, Booch and others. At the minimum, both techniques help engineers to clearly define their problems, goals and solutions. However, formal modeling languages are more rigorously defined. And the clarity that this stage produces is a benefit in itself.
2. Verification: As stated above, formal methods differ from other specification systems by their heavy emphasis on provability and correctness. By building a system using a formal specification, the designer is actually developing a set of theorems about his/her system.
Verification is a difficult process, largely because even the simplest system has several dozen theorems, each of which has to be proven. Even a traditional mathematical proof is a complex affair. Given the demands of complexity, almost all formal systems use an automated theorem proving tool of some form. These tools can prove simple theorems, verify the semantics of theorems, and provide assistance for verifying more complicated proofs.
3. Implementation: Once the model has been specified and verified, it is implemented by converting the specification into code. As the difference between software and hardware design grows narrower, formal methods for developing embedded systems have been developed. LARCH, for example, has a VHDL implementation. Similarly, hardware systems such as the VIPER and AAMP5 processors have been developed using formal approaches.
Formal methods offer additional benefits outside of provability, and these benefits do deserve some mention.
Discipline: By virtue of their rigor, formal systems require an engineer to think out his design in a more thorough fashion. In particular, a formal proof of correctness is going to require a rigorous specification of goals, not just operation. This thorough approach can help identify faulty reasoning far earlier than in traditional design.
The discipline involved in formal specification has proved useful even on already existing systems. Engineers using the PVS system, for example, reported identifying several microcode errors in one of their microprocessor designs.
Precision: Traditionally, disciplines have moved into jargons and formal notation as the weaknesses of natural language descriptions become more glaringly obvious. There is no reason that systems engineering should differ, and there are several formal methods which are used almost exclusively for notation.
For engineers designing safetycritical systems, the benefits of formal methods lie in their clarity. Unlike many other design approaches, the formal verification requires very clearly defined goals and approaches. In a safety critical system, ambiguity can be extremely dangerous, and one of the primary benefits of the formal approach is the elimination of ambiguity.
The purpose of this course is to learn how to specify behavior of systems and to experience the design of a system where you can prove that the behavior is correct. Students will learn how to formally specify requirements and to prove (or disprove) them on the behavior. The behavior of systems will be represented by such formalisms as
finite state machines;
process algebras;
Petri nets;
temporal logics.
With a practical assignment students will experience how to apply the techniques in practice.
The first part of this course focuses on the study of the semantics of a variety of programming language constructs. We will study structural operational semantics as a way to formalize the intended execution and implementation of languages, axiomatic semantics, useful in developing as well as verifying programs, and denotational semantics, whose deep mathematical underpinnings make it the most versatile of all.
Then the special emphasis will be put on parallel and distributed systems modeling, specification and analysis. We consider two basic approaches to concurrent systems specification and analysis: process algebras and Petri nets.
Process algebra is a mathematical framework in which system behavior is expressed in the form of algebraic terms, enhancing the available techniques for manipulation. Fundamental to process algebra is a parallel operator, to break down systems into their concurrent components. A set of equations is imposed to derive whether two terms are behaviorally equivalent. In this framework, nontrivial properties of systems can be established in an elegant fashion. For example, it may be possible to equate an implementation to the specification of its required input/output relation. In recent years a variety of automated tools have been developed to facilitate the derivation of such properties.
Applications of process algebra exist in diverse fields such as safety critical systems, network protocols, and biology. In the educational vein, process algebra has been recognized to teach skills to deal with complex concurrent systems, by representing and reasoning about such systems in a mathematically clear and precise manner.
Petri nets is another popular formalism for modeling, analyzing and verifying reactive and distributed systems. Their strength are their simple but precise semantics, their clear graphical notation, and many methods and algorithms for analysis and verification.
The course introduces Petri nets and their theory by the help of examples from different application domains. The focus, however, will be on traditional Petri net theory, in particular on Place/TransitionSystems and on concepts such as place and transition invariants, deadlocks and traps, and the coverability tree. The course also covers different versions and variants of Petri nets as well as different modeling and analysis techniques for particular application areas. Thus we consider an urgent topic of modeling and analysis of workflow processes in more details.
The forth module covers a prominent verification technique that has emerged in the last thirty years – model checking. This approach is based on systematical check whether a model of a given system satisfies a property such as deadlock freedom, invariants, or requestresponse. This automated technique for verification and debugging has developed into a mature and widelyused industrial approach with many applications in software and hardware. It is used (and further developed) by companies and institutes such as IBM, Intel, NASA, Cadence, Microsoft, and Siemens, to mention a few, and has culminated in a series of mostly freely downloadable software tools that allow the automated verification of, for instance, C#programs or combinational hardware circuits.
Subtle errors, for instance due to multithreading, that remain undiscovered using simulation or peer reviewing can potentially be revealed using model checking. Model checking is thus an effective technique to expose potential design errors and improve software and hardware reliability.
This course provides an introduction to the theory of model checking and its theoretical complexity. We introduce transition systems, safety, liveness and fairness properties, as well as omegaregular automata. We then cover the temporal logics LTL, CTL and CTL*, compare them, and treat their modelchecking algorithms. Techniques to combat the statespace explosion problem are at the heart of the success of model checking.
We will show that model checking is based on wellknown paradigms from automata theory, graph algorithms, logic, and data structures. Its complexity is analyzed using standard techniques from complexity theory.
Training Objectives:
During the course, the students will:
Study the basic principles of using formal methods for specification and analysis of software systems;
Study basic notions and modes of formal semantics for sequential and concurrent programs.
Study formalism, such as process algebras and Petri nets, and methods for modeling and analysis of concurrent and distributed systems.
Study methods and algorithms for model checking of concurrent systems;
Master methods and tools of software specification, analysis and verification;
Acquire practical skills in design, specification and analysis of model distributed systems examples.
At the end of the course, students should be able to: understand the language of studied formalisms; model various classes of systems using these formalisms; apply specific analytical techniques; prove properties of discrete systems using process algebras, Petri nets and appropriate specification formalisms.
II. TopicWise Curricula Plan
№
 Topic Name
 Course Hours, Total
 Audience Hours
 SelfStudy
 Lectures
 Practical Studies
 Module 1 (32 hrs.)
 1
 Formal methods as a basis for software reliability.
 18
 2
 2
 14
 2
 Finite state machines (FSMs): basic definitions, operational semantics. Categories of FSMs. Extended FSMs. Modeling concurrent systems with communicating FSMs.
 24
 4
 4
 16
 3
 Petri nets: basic notions, definitions and classification. Modeling distributed systems with Petri nets.
 30
 6
 6
 18
 4
 Petri nets analysis. Checking structural and behavioral properties.
 24
 4
 4
 16

 Module 1, totally:
 96
 16
 16
 64
 