University is to explore the semantics of Problem Frames. The motivation to develop the semantics... more University is to explore the semantics of Problem Frames. The motivation to develop the semantics is shared with many graphical notations -a formal semantics contributes to a solution. As argued in problem frame manipulations (e.g., problem representation, transformation, decomposition and recomposition) supported by the semantics can be regarded as a formal refinement from the problem towards the specification. Therefore, the semantics of Problem Frames can be applied to underpin software development problems.
Lyceum is an audio and visual conferencing system for the Internet. Using Lyceum participants can... more Lyceum is an audio and visual conferencing system for the Internet. Using Lyceum participants can exchange audio messages and share visual applications in real-time. The system is under development at the Open University to be deployed on distance learning courses. This document describes the system and its architecture. * Previously a member of the Learning and Teaching Services of the Open University.
A key challenge for software engineering is to learn how to reconcile the formal world of the mac... more A key challenge for software engineering is to learn how to reconcile the formal world of the machine and its software with the non-formal real world. In this paper, we discuss elements of Problem Oriented Software Engineering (POSE), an approach that brings both nonformal and formal aspects of software development together in a single theoretical framework for software engineering design.
Standards demand that assurance cases support safety critical developments. It is widely acknowle... more Standards demand that assurance cases support safety critical developments. It is widely acknowledged, however, that the current practice of post-hoc assurance-that the product is built and only then argued for safety-leads to many engineering process deficiencies, extra expense, and poorer products. This paper shows how the Problem Oriented Software Engineering framework supports the concurrent design of a safe product and its safety case, by which these deficiencies can be addressed.
We define an algebra comprising a class of basic Petri nets, enhanced with place and transition l... more We define an algebra comprising a class of basic Petri nets, enhanced with place and transition labels, together with operations of sequence, choice, parallel, iteration, prioritised choice and label hiding. An important characteristic of the algebra is that it combines transition-based composition for modelling synchronous communication, as in Petri net semantics for CCS or TCSP, with place composition for modelling shared variables. We use the algebra to give a family of net semantics for a version of OCCAM, comprising a full semantics, for which we have consistency with the Laws of OCCAM, and a range of semantics for partial data abstraction which give smaller nets (for more practical use of net tools and techniques) with a limited consistency such that safety (but not liveness) properties transfer from more-abstracted to less-abstracted semantics.
This paper introduces a formal conceptual framework for software development, based on a problem-... more This paper introduces a formal conceptual framework for software development, based on a problem-oriented perspective that stretches from requirements engineering through to program code.
Normal design is, essentially, when an engineer knows that the design they are working on will wo... more Normal design is, essentially, when an engineer knows that the design they are working on will work. Routine 'traditional' engineering works through normal design. Software engineering has more often been assessed as being closer to radical design, i.e., repeated innovation. One of the aims of the Problem Oriented Software Engineering framework (POSE) is to provide a foundation for software engineering to be considered an application of normal design. To achieve this software engineering must mesh with traditional, normal forms of engineering, such as aeronautical engineering. The POSE approach for normalising software development, from early requirements through to code (and beyond), is to provide a structure within which the results of different development activities can be recorded, combined and reconciled. The approach elaborates, transforms and analyses the project requirements, reasons about the effect of (partially detailed) candidate architectures, and traceably audits design rationale through iterative development, to produce a justified (where warranted) fit-for-purpose solution. In this paper we show how POSE supports the development task of a safety-critical system. A normal 'pattern of development' for software safety under POSE is proposed and validated through its application to an industrial case study
Normal design is, essentially, when an engineer knows that the design they are working on will wo... more Normal design is, essentially, when an engineer knows that the design they are working on will work. Routine ‘traditional’ engineering works through normal design. Software engineering has more often been assessed as being closer to radical design, i.e., repeated innovation. One of the aims of the Problem Oriented Software Engineering framework (POSE) is to provide a foundation for software engineering to be considered an application of normal design. To achieve this software engineering must mesh with traditional, normal forms of engineering, such as aeronautical engineering. The POSE approach for normalising software development, from early requirements through to code (and beyond), is to provide a structure within which the results of different development activities can be recorded, combined and reconciled. The approach elaborates, transforms and analyses the project requirements, reasons about the effect of (partially detailed) candidate architectures, and audits design rationale through iterative development, to produce a justified (where warranted) fit-for-purpose solution. In this paper we show how POSE supports the development task of a safety-critical system. A normal ‘pattern of development’ for software safety under POSE is proposed and validated through its application to an industrial case study.
Parallel (lazy) functional programs must describe both computation and coordination, i.e., what t... more Parallel (lazy) functional programs must describe both computation and coordination, i.e., what to compute and how to arrange the computation in parallel. The formal manipulation of the behaviours of such programs requires a semantics which accurately captures lazy evaluation, and the dependence of execution on the availability of (physical) resources. In this paper we present a lockstep semantics as a rst step towards this goal which, we hope, will allow us to reason about the coordination in a lazy setting.
This paper presents a framework for understanding Problem Frames , their components, their frame ... more This paper presents a framework for understanding Problem Frames , their components, their frame concerns, and the flexibility that is inherent in their definition.
Programmable logic devices (PLDs) are now common components of critical systems, and are increasi... more Programmable logic devices (PLDs) are now common components of critical systems, and are increasingly used for safety-related or safety-critical functionality. Since 1999 avionics-and defence-related safety standards have advised and prescribed various approaches for PLD programming in safety-related systems. There are many differences between current and recommended practice, and safety engineers differ on how to apply the existing standards. This paper describes past and current practice in programming PLDs in critical systems. It summarises the relevant safety and security standards and anticipates forthcoming changes to UK standards. It describes the work that the authors and others have done in the field of specifying, designing and proving correct PLD programs and maps out avenues of work that the authors believe necessary for PLD programming technology to keep pace with PLD functionality.
Real Time Logic (RTL,) was introduced as a formalism for reasoning about the absolute timing prop... more Real Time Logic (RTL,) was introduced as a formalism for reasoning about the absolute timing properties of discrete real-time systems. The development of RTL came from the perceived inextensibility of . . . ] research at that time] from relative timing problems of systems to absolute timings. In this paper we present Extended Real Time Logic (ERTL) 3] as a formal notation for the modelling and analysis of relative and absolute timing properties of hybrid systems. ERTL embeds the discrete time model of RTL into a continuous model provided by the non-negative reals which, together with other extensions, permits the consideration of piece-wise continuous functions through predicates over real valued variables.
Achieving a proper understanding of the problem space before providing the design in the solution... more Achieving a proper understanding of the problem space before providing the design in the solution space is one of the basic tenets in requirements engineering. The Problem Frames approach provides a way for people to understand and solve software problems.
The paper introduces a software problem calculus based on a view of requirements engineering prop... more The paper introduces a software problem calculus based on a view of requirements engineering proposed by Zave and Jackson, that we hope can underpin techniques and processes in requirements engineering and early software design. The approach is centred around the notion of problem and problem transformation. It is propositional in nature in that it allows for heterogeneous problem descriptions and correctness argumentation for the validation and verification of solutions. We present a number of fundamental rules to populate the calculus including 'divide-and-conquer' problem decomposition, description reification, prior-solution reuse, the use of architectures for solution structuring. In addition, and central to the foundational nature of the calculus is the interpretation and subsequent incorporation into our framework of others' work as problem transformations. This is an on-going task: examples presented in this paper include interpretations of simple goal-oriented decompositions and viewpoints. The calculus also provides rich traceability of the requirements of an original problem through transformation to those of its solution. We use the design of a sluice gate as a simple running example throughout the paper.
The design of assurance cases has been hampered by the posit-and-prove approach to software and s... more The design of assurance cases has been hampered by the posit-and-prove approach to software and systems engineering; it has been observed that, traditionally, a product is produced and then evidence from the development is looked for to build an assurance case. Although assured development is possible, there has been a recent drive towards the proactive design of the assurance case. Assurance-driven design is a development method that considers the assurance argument - similar to an assurance case - to be as important as the product. In this paper, we introduce assurance-driven design, as part of our problem oriented engineering framework, and show how software and assurance argument can be built together.
An early version of the Z Standard included the deductive system W for reasoning about Z specific... more An early version of the Z Standard included the deductive system W for reasoning about Z specifications. Later versions contain a different deductive system. In this paper we sketch a proof that W is relatively sound with respect to this new deductive system. We do this by demonstrating a semantic basis for a correspondence between the two systems, then showing that each of the inference rules of W can be simulated as derived rules in the new system. These new rules are presented as tactics over the the inference rules of the new deductive system. the antecedent (it being an implicit part of the specification 4 , and can be used when necessary.) 3 A semicolon is typically used to separate declarations in Z. It does not introduce order, however, so that X : P N; x : X is not typically acceptable. In proof, such declarations may be desirable, and so the dagger symbol is introduced, so that in X : PN y x : X,
Jackson's Problem Frames provide a means of analysing and decomposing problems. They emphasise th... more Jackson's Problem Frames provide a means of analysing and decomposing problems. They emphasise the world outside of the computer helping the developer to focus on the problem domain instead of drifting into inventing solutions. The intention is to delay consideration of the solution space until a good understanding of the problem is gained.
The Reference Model of , provides a framework for describing and analyzing key software engineeri... more The Reference Model of , provides a framework for describing and analyzing key software engineering artifacts and their properties. In this paper we propose a reification of this framework in which behaviour is explicitly trace-based. We find that this benefits the formalism in adding structure in ways which are meaningful and practical from an engineering viewpoint. In particular, we develop notions of points of introduction and reachability in the new framework, and show how they strengthen the properties of the Reference Model.
University is to explore the semantics of Problem Frames. The motivation to develop the semantics... more University is to explore the semantics of Problem Frames. The motivation to develop the semantics is shared with many graphical notations -a formal semantics contributes to a solution. As argued in problem frame manipulations (e.g., problem representation, transformation, decomposition and recomposition) supported by the semantics can be regarded as a formal refinement from the problem towards the specification. Therefore, the semantics of Problem Frames can be applied to underpin software development problems.
Lyceum is an audio and visual conferencing system for the Internet. Using Lyceum participants can... more Lyceum is an audio and visual conferencing system for the Internet. Using Lyceum participants can exchange audio messages and share visual applications in real-time. The system is under development at the Open University to be deployed on distance learning courses. This document describes the system and its architecture. * Previously a member of the Learning and Teaching Services of the Open University.
A key challenge for software engineering is to learn how to reconcile the formal world of the mac... more A key challenge for software engineering is to learn how to reconcile the formal world of the machine and its software with the non-formal real world. In this paper, we discuss elements of Problem Oriented Software Engineering (POSE), an approach that brings both nonformal and formal aspects of software development together in a single theoretical framework for software engineering design.
Standards demand that assurance cases support safety critical developments. It is widely acknowle... more Standards demand that assurance cases support safety critical developments. It is widely acknowledged, however, that the current practice of post-hoc assurance-that the product is built and only then argued for safety-leads to many engineering process deficiencies, extra expense, and poorer products. This paper shows how the Problem Oriented Software Engineering framework supports the concurrent design of a safe product and its safety case, by which these deficiencies can be addressed.
We define an algebra comprising a class of basic Petri nets, enhanced with place and transition l... more We define an algebra comprising a class of basic Petri nets, enhanced with place and transition labels, together with operations of sequence, choice, parallel, iteration, prioritised choice and label hiding. An important characteristic of the algebra is that it combines transition-based composition for modelling synchronous communication, as in Petri net semantics for CCS or TCSP, with place composition for modelling shared variables. We use the algebra to give a family of net semantics for a version of OCCAM, comprising a full semantics, for which we have consistency with the Laws of OCCAM, and a range of semantics for partial data abstraction which give smaller nets (for more practical use of net tools and techniques) with a limited consistency such that safety (but not liveness) properties transfer from more-abstracted to less-abstracted semantics.
This paper introduces a formal conceptual framework for software development, based on a problem-... more This paper introduces a formal conceptual framework for software development, based on a problem-oriented perspective that stretches from requirements engineering through to program code.
Normal design is, essentially, when an engineer knows that the design they are working on will wo... more Normal design is, essentially, when an engineer knows that the design they are working on will work. Routine 'traditional' engineering works through normal design. Software engineering has more often been assessed as being closer to radical design, i.e., repeated innovation. One of the aims of the Problem Oriented Software Engineering framework (POSE) is to provide a foundation for software engineering to be considered an application of normal design. To achieve this software engineering must mesh with traditional, normal forms of engineering, such as aeronautical engineering. The POSE approach for normalising software development, from early requirements through to code (and beyond), is to provide a structure within which the results of different development activities can be recorded, combined and reconciled. The approach elaborates, transforms and analyses the project requirements, reasons about the effect of (partially detailed) candidate architectures, and traceably audits design rationale through iterative development, to produce a justified (where warranted) fit-for-purpose solution. In this paper we show how POSE supports the development task of a safety-critical system. A normal 'pattern of development' for software safety under POSE is proposed and validated through its application to an industrial case study
Normal design is, essentially, when an engineer knows that the design they are working on will wo... more Normal design is, essentially, when an engineer knows that the design they are working on will work. Routine ‘traditional’ engineering works through normal design. Software engineering has more often been assessed as being closer to radical design, i.e., repeated innovation. One of the aims of the Problem Oriented Software Engineering framework (POSE) is to provide a foundation for software engineering to be considered an application of normal design. To achieve this software engineering must mesh with traditional, normal forms of engineering, such as aeronautical engineering. The POSE approach for normalising software development, from early requirements through to code (and beyond), is to provide a structure within which the results of different development activities can be recorded, combined and reconciled. The approach elaborates, transforms and analyses the project requirements, reasons about the effect of (partially detailed) candidate architectures, and audits design rationale through iterative development, to produce a justified (where warranted) fit-for-purpose solution. In this paper we show how POSE supports the development task of a safety-critical system. A normal ‘pattern of development’ for software safety under POSE is proposed and validated through its application to an industrial case study.
Parallel (lazy) functional programs must describe both computation and coordination, i.e., what t... more Parallel (lazy) functional programs must describe both computation and coordination, i.e., what to compute and how to arrange the computation in parallel. The formal manipulation of the behaviours of such programs requires a semantics which accurately captures lazy evaluation, and the dependence of execution on the availability of (physical) resources. In this paper we present a lockstep semantics as a rst step towards this goal which, we hope, will allow us to reason about the coordination in a lazy setting.
This paper presents a framework for understanding Problem Frames , their components, their frame ... more This paper presents a framework for understanding Problem Frames , their components, their frame concerns, and the flexibility that is inherent in their definition.
Programmable logic devices (PLDs) are now common components of critical systems, and are increasi... more Programmable logic devices (PLDs) are now common components of critical systems, and are increasingly used for safety-related or safety-critical functionality. Since 1999 avionics-and defence-related safety standards have advised and prescribed various approaches for PLD programming in safety-related systems. There are many differences between current and recommended practice, and safety engineers differ on how to apply the existing standards. This paper describes past and current practice in programming PLDs in critical systems. It summarises the relevant safety and security standards and anticipates forthcoming changes to UK standards. It describes the work that the authors and others have done in the field of specifying, designing and proving correct PLD programs and maps out avenues of work that the authors believe necessary for PLD programming technology to keep pace with PLD functionality.
Real Time Logic (RTL,) was introduced as a formalism for reasoning about the absolute timing prop... more Real Time Logic (RTL,) was introduced as a formalism for reasoning about the absolute timing properties of discrete real-time systems. The development of RTL came from the perceived inextensibility of . . . ] research at that time] from relative timing problems of systems to absolute timings. In this paper we present Extended Real Time Logic (ERTL) 3] as a formal notation for the modelling and analysis of relative and absolute timing properties of hybrid systems. ERTL embeds the discrete time model of RTL into a continuous model provided by the non-negative reals which, together with other extensions, permits the consideration of piece-wise continuous functions through predicates over real valued variables.
Achieving a proper understanding of the problem space before providing the design in the solution... more Achieving a proper understanding of the problem space before providing the design in the solution space is one of the basic tenets in requirements engineering. The Problem Frames approach provides a way for people to understand and solve software problems.
The paper introduces a software problem calculus based on a view of requirements engineering prop... more The paper introduces a software problem calculus based on a view of requirements engineering proposed by Zave and Jackson, that we hope can underpin techniques and processes in requirements engineering and early software design. The approach is centred around the notion of problem and problem transformation. It is propositional in nature in that it allows for heterogeneous problem descriptions and correctness argumentation for the validation and verification of solutions. We present a number of fundamental rules to populate the calculus including 'divide-and-conquer' problem decomposition, description reification, prior-solution reuse, the use of architectures for solution structuring. In addition, and central to the foundational nature of the calculus is the interpretation and subsequent incorporation into our framework of others' work as problem transformations. This is an on-going task: examples presented in this paper include interpretations of simple goal-oriented decompositions and viewpoints. The calculus also provides rich traceability of the requirements of an original problem through transformation to those of its solution. We use the design of a sluice gate as a simple running example throughout the paper.
The design of assurance cases has been hampered by the posit-and-prove approach to software and s... more The design of assurance cases has been hampered by the posit-and-prove approach to software and systems engineering; it has been observed that, traditionally, a product is produced and then evidence from the development is looked for to build an assurance case. Although assured development is possible, there has been a recent drive towards the proactive design of the assurance case. Assurance-driven design is a development method that considers the assurance argument - similar to an assurance case - to be as important as the product. In this paper, we introduce assurance-driven design, as part of our problem oriented engineering framework, and show how software and assurance argument can be built together.
An early version of the Z Standard included the deductive system W for reasoning about Z specific... more An early version of the Z Standard included the deductive system W for reasoning about Z specifications. Later versions contain a different deductive system. In this paper we sketch a proof that W is relatively sound with respect to this new deductive system. We do this by demonstrating a semantic basis for a correspondence between the two systems, then showing that each of the inference rules of W can be simulated as derived rules in the new system. These new rules are presented as tactics over the the inference rules of the new deductive system. the antecedent (it being an implicit part of the specification 4 , and can be used when necessary.) 3 A semicolon is typically used to separate declarations in Z. It does not introduce order, however, so that X : P N; x : X is not typically acceptable. In proof, such declarations may be desirable, and so the dagger symbol is introduced, so that in X : PN y x : X,
Jackson's Problem Frames provide a means of analysing and decomposing problems. They emphasise th... more Jackson's Problem Frames provide a means of analysing and decomposing problems. They emphasise the world outside of the computer helping the developer to focus on the problem domain instead of drifting into inventing solutions. The intention is to delay consideration of the solution space until a good understanding of the problem is gained.
The Reference Model of , provides a framework for describing and analyzing key software engineeri... more The Reference Model of , provides a framework for describing and analyzing key software engineering artifacts and their properties. In this paper we propose a reification of this framework in which behaviour is explicitly trace-based. We find that this benefits the formalism in adding structure in ways which are meaningful and practical from an engineering viewpoint. In particular, we develop notions of points of introduction and reachability in the new framework, and show how they strengthen the properties of the Reference Model.
Uploads
Papers by Jon Hall