李彤《软件工程》教学课件ch10.pptVIP

The structure of a Z schema Modelling the insulin pump The Z schema for the insulin pump declares a number of state variables including: Input variables such as switch? (the device switch), InsulinReservoir? (the current quantity of insulin in the reservoir) and Reading? (the reading from the sensor); Output variables such as alarm! (a system alarm), display1!, display2! (the displays on the pump) and dose! (the dose of insulin to be delivered). Schema invariant Each Z schema has an invariant part which defines conditions that are always true. For the insulin pump schema it is always true that The dose must be less than or equal to the capacity of the insulin reservoir; No single dose may be more than 4 units of insulin and the total dose delivered in a time period must not exceed 25 units of insulin. This is a safety constraint; display2! shows the amount of insulin to be delivered. Insulin pump schema State invariants The dosage computation The insulin pump computes the amount of insulin required by comparing the current reading with two previous readings. If these suggest that blood glucose is rising then insulin is delivered. Information about the total dose delivered is maintained to allow the safety check invariant to be applied. Note that this invariant always applies - there is no need to repeat it in the dosage computation. RUN schema (1) RUN schema (2) Sugar OK schema Key points Formal system specification complements informal specification techniques. Formal specifications are precise and unambiguous. They remove areas of doubt in a specification. Formal specification forces an analysis of the system requirements at an early stage. Correcting errors at this stage is cheaper than modifying a delivered system. Formal specification techniques are most applicable in the development of critical systems and standards. Key points Algebraic techniques are suited to interface specification where the interface is defined as a set of object classes. Model-based t