This page gives highlights of past lectures and provides lecture notes, reading assignments, and exercises.
| Dates | Topics and Readings | Exercises |
|---|---|---|
| Aug 23 |
Course introduction and administration. Introduction to Formal Methods. What are formal methods and how they help in software development. Required Readings: Recommended Readings: |
|
| Aug 25 |
More on Formal Methods. Introduction to sets and relations. Recap of basic notions in set theory. Relations and relational operators. Required Readings: |
All exercises in set and relations notes |
|
Aug 30 Sep 1 |
More on relations. Functions as relations. Operations on relations. Modeling general software systems. Introduction to the Alloy modeling language. Alloy's foundations. Signatures, fields and multiplicity constraints. Modeling simple domains in Alloy. Generating and analyzing model instances with the Alloy Analyzer. Relations and operations on them. Formulas, Boolean operators and quantifiers. Required Readings:
|
All exercises in lecture notes notes |
|
Sep 6 Sep 8 |
Relational operators in Alloy. Expressing constraints on relations using Alloy formulas. Examples of constraints. Operator precedence and parsing. Facts. Checking models with the Alloy Analyzer. Signature scopes. Exercises. Required Readings:
|
Exercises in Part 2 of lecture notes |
|
Sep 13 Sep 15 |
In-class modeling exercises. Assertions. Checking assertions. Scope restrictions. Functions and predicates. Examples and exercises. Practice with modeling in Alloy: the Academia domain. Required Readings:
|
All exercises in the Part 2 and 3 of lecture notes |
|
Sep 20 Sep 22 |
More practice with modeling in Alloy: the Academia domain. Examples and exercises. Modeling dynamic systems in Alloy. Explicit time modeling time modelling. Example: making the family model dynamic. Required Readings:
|
- All exercises in the Academia Model notes - First exercise in Dynamic Models notes |
|
Sep 27 Sep 29 |
More on dynamic models. Explicit time implicit time modelling in Alloy 6. Trace semantics. Temporal operators and their semantics. Examples. General approach to model dynamic systems: state transition systems. Operators. Preconditions, postconditions and frame conditions. Examples of operators for the family model. Required Readings:
|
All exercises in Dynamic Models notes |
|
Oct 4 Oct 6 |
More on modeling and analyzing dynamic systems in Alloy.
Family and traffic light examples.
Introduction to reactive systems. Introduction to the Lustre specification language. Main constructs and operators. Examples of Lustre programs. Required Readings:
|
|
|
Oct 11 Oct 13 |
Specifying simple reactive systems in Lustre. Practice with writing Lustre models and expressing their properties. Simulating and checking Lustre models with Kind 2 (online examples) In-class exercises. Checking properties via synchronous observers. Useful temporal operators. Examples. Required Readings: Recommended Readings: |
Exercises in Lustre notes |
| Oct 18 |
Midterm exam |
|
| Oct 20 |
More practice with writing Lustre models and expressing their properties. Using counterexamples to debug the model. Switch examples. Required Readings:
|
Simulate and verify in Kind 2 all Lustre examples in the readings |
|
Oct 25 Oct 27 |
Comparing systems for (conditional) observational equivalence in Lustre. Examples in Lustre. Specifying and analyzing the behavior of a simple traffic light controller. Contract-based specification and compositional verification. Motivation and uses. Extending Lustre with contracts. Contract basics: assumptions and guarantees. Examples of contracts. Required Readings:
|
|
|
Nov 1 Nov 3 |
More on contract-based specification. Specifying system modes in Kind 2's contract language. Modular and compositional analysis in Kind 2. Motivation and examples. Required Readings:
|
|
|
Nov 8 Nov 10 |
Specifying and verifying programs in high-level programming languages. Introduction to Dafny. Method contracts in Dafny. Specifying pre and post-conditions. Compositional verification of methods through the use of contracts. Introduction to Floyd-Hoare logic. Formalizing program behavior with Hoare triples. Strongest postconditions and weakest preconditions. The WP and SP operators. Computing WPs and SPs for assignments, variable introduction and sequential composition. Required Readings:
|
Exercises in lecture notes Reasoning About Programs |
|
Nov 15 Nov 17 |
WPs and SPs for conditional statements and methods calls. Assert and assume statements. Method vs function calls in Dafny. Partial expressions.
Dafny in action. Various examples.
Required Readings:
|
Exercises in lecture notes |
|
Nov 22 Nov 24 |
Fall break |
|
|
Nov 29 Dec 1 |
More on loops.
Examples.
Loop termination.
Required Readings:
|
Exercises in lecture notes |
|
Dec 6 Dec 8 |
Classes and Objects in Dafny. Specifying classes as abstract data types to separate observable behavior from internal implementation. Examples: counters and alternative implementations of FIFO queues. The use of dynamic frames in Dafny to specify and verify programs using objects. Motivation and uses. Queue, counter, bank account and linked list examples. Required Readings:
|
|
| Dec 13 |
Final Exam |
|