Skip to content
GitLab
Projects
Groups
Snippets
Help
Loading...
Help
What's new
10
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Open sidebar
isa-afp
afp-devel
Commits
ea3b38fc54d6
Commit
e68e1996
authored
Oct 13, 2015
by
Frédéric Tuong
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
synchronize with hol-testgen/r12148
parent
57bb43378d6f
Changes
41
Expand all
Hide whitespace changes
Inline
Side-by-side
Showing
41 changed files
with
13352 additions
and
1546 deletions
+13352
-1546
thys/Featherweight_OCL/ROOT
thys/Featherweight_OCL/ROOT
+55
-11
thys/Featherweight_OCL/document/formalization.tex
thys/Featherweight_OCL/document/formalization.tex
+0
-25
thys/Featherweight_OCL/document/root.tex
thys/Featherweight_OCL/document/root.tex
+0
-150
thys/Featherweight_OCL/examples/Employee_AnalysisModel_OCLPart.thy
...herweight_OCL/examples/Employee_AnalysisModel_OCLPart.thy
+0
-143
thys/Featherweight_OCL/examples/Employee_Model/Analysis/Analysis_OCL.thy
...ght_OCL/examples/Employee_Model/Analysis/Analysis_OCL.thy
+362
-0
thys/Featherweight_OCL/examples/Employee_Model/Analysis/Analysis_UML.thy
...ght_OCL/examples/Employee_Model/Analysis/Analysis_UML.thy
+290
-290
thys/Featherweight_OCL/examples/Employee_Model/Design/Design_OCL.thy
...rweight_OCL/examples/Employee_Model/Design/Design_OCL.thy
+137
-0
thys/Featherweight_OCL/examples/Employee_Model/Design/Design_UML.thy
...rweight_OCL/examples/Employee_Model/Design/Design_UML.thy
+268
-246
thys/Featherweight_OCL/readme.txt
thys/Featherweight_OCL/readme.txt
+76
-0
thys/Featherweight_OCL/src/UML_Contracts.thy
thys/Featherweight_OCL/src/UML_Contracts.thy
+413
-0
thys/Featherweight_OCL/src/UML_Library.thy
thys/Featherweight_OCL/src/UML_Library.thy
+260
-0
thys/Featherweight_OCL/src/UML_Logic.thy
thys/Featherweight_OCL/src/UML_Logic.thy
+250
-408
thys/Featherweight_OCL/src/UML_Main.thy
thys/Featherweight_OCL/src/UML_Main.thy
+6
-6
thys/Featherweight_OCL/src/UML_PropertyProfiles.thy
thys/Featherweight_OCL/src/UML_PropertyProfiles.thy
+376
-0
thys/Featherweight_OCL/src/UML_State.thy
thys/Featherweight_OCL/src/UML_State.thy
+446
-234
thys/Featherweight_OCL/src/UML_Tools.thy
thys/Featherweight_OCL/src/UML_Tools.thy
+137
-0
thys/Featherweight_OCL/src/UML_Types.thy
thys/Featherweight_OCL/src/UML_Types.thy
+653
-0
thys/Featherweight_OCL/src/basic_types/UML_Boolean.thy
thys/Featherweight_OCL/src/basic_types/UML_Boolean.thy
+123
-0
thys/Featherweight_OCL/src/basic_types/UML_Integer.thy
thys/Featherweight_OCL/src/basic_types/UML_Integer.thy
+285
-0
thys/Featherweight_OCL/src/basic_types/UML_Real.thy
thys/Featherweight_OCL/src/basic_types/UML_Real.thy
+284
-0
thys/Featherweight_OCL/src/basic_types/UML_String.thy
thys/Featherweight_OCL/src/basic_types/UML_String.thy
+164
-0
thys/Featherweight_OCL/src/basic_types/UML_Void.thy
thys/Featherweight_OCL/src/basic_types/UML_Void.thy
+134
-0
thys/Featherweight_OCL/src/collection_types/UML_Bag.thy
thys/Featherweight_OCL/src/collection_types/UML_Bag.thy
+1069
-0
thys/Featherweight_OCL/src/collection_types/UML_Pair.thy
thys/Featherweight_OCL/src/collection_types/UML_Pair.thy
+216
-0
thys/Featherweight_OCL/src/collection_types/UML_Sequence.thy
thys/Featherweight_OCL/src/collection_types/UML_Sequence.thy
+568
-0
thys/Featherweight_OCL/src/collection_types/UML_Set.thy
thys/Featherweight_OCL/src/collection_types/UML_Set.thy
+3166
-0
thys/Featherweight_OCL/src/document/FOCL_Syntax.tex
thys/Featherweight_OCL/src/document/FOCL_Syntax.tex
+1085
-0
thys/Featherweight_OCL/src/document/conclusion.tex
thys/Featherweight_OCL/src/document/conclusion.tex
+22
-21
thys/Featherweight_OCL/src/document/figures/AbstractSimpleChair.mp
...herweight_OCL/src/document/figures/AbstractSimpleChair.mp
+0
-0
thys/Featherweight_OCL/src/document/figures/AbstractSimpleChair.pdf
...erweight_OCL/src/document/figures/AbstractSimpleChair.pdf
+0
-0
thys/Featherweight_OCL/src/document/figures/jedit.png
thys/Featherweight_OCL/src/document/figures/jedit.png
+0
-0
thys/Featherweight_OCL/src/document/figures/pdf.png
thys/Featherweight_OCL/src/document/figures/pdf.png
+0
-0
thys/Featherweight_OCL/src/document/figures/person.png
thys/Featherweight_OCL/src/document/figures/person.png
+0
-0
thys/Featherweight_OCL/src/document/figures/pre-post.pdf
thys/Featherweight_OCL/src/document/figures/pre-post.pdf
+0
-0
thys/Featherweight_OCL/src/document/hol-ocl-isar.sty
thys/Featherweight_OCL/src/document/hol-ocl-isar.sty
+6
-0
thys/Featherweight_OCL/src/document/introduction.tex
thys/Featherweight_OCL/src/document/introduction.tex
+2115
-0
thys/Featherweight_OCL/src/document/lstisar.sty
thys/Featherweight_OCL/src/document/lstisar.sty
+0
-0
thys/Featherweight_OCL/src/document/omg.sty
thys/Featherweight_OCL/src/document/omg.sty
+28
-0
thys/Featherweight_OCL/src/document/prooftree.sty
thys/Featherweight_OCL/src/document/prooftree.sty
+0
-0
thys/Featherweight_OCL/src/document/root.bib
thys/Featherweight_OCL/src/document/root.bib
+75
-12
thys/Featherweight_OCL/src/document/root.tex
thys/Featherweight_OCL/src/document/root.tex
+283
-0
No files found.
thys/Featherweight_OCL/ROOT
View file @
ea3b38fc
(*****************************************************************************
* Featherweight-OCL --- A Formal Semantics for UML-OCL Version OCL 2.5
* for the OMG Standard.
* http://www.brucker.ch/projects/hol-testgen/
*
* This file is part of HOL-TestGen.
*
* Copyright (c) 2013-2015 Université Paris-Saclay, Univ. Paris-Sud, France
* 2013-2015 IRT SystemX, France
* 2013-2015 Achim D. Brucker, Germany
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are
* met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* * Redistributions in binary form must reproduce the above
* copyright notice, this list of conditions and the following
* disclaimer in the documentation and/or other materials provided
* with the distribution.
*
* * Neither the name of the copyright holders nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
******************************************************************************)
chapter AFP
session Featherweight_OCL (AFP) = HOL +
session Featherweight_OCL (AFP)
in "src"
= HOL +
description {* Featherweight-OCL *}
options [document_variants = "document:outline=/proof,/ML"]
options [document_variants = "annex-a=annexa,-theory,-afp,-proof,-ML:document=afp,-annexa:outline=-annexa,afp,/proof,/ML",
show_question_marks = false]
theories
"
OC
L_
m
ain"
"examples/Employee_Analysis
Model_OCLPart
"
"examples/Employee_
DesignModel_OCLPart
"
"
UM
L_
M
ain"
"
../
examples/Employee_
Model/
Analysis
/Analysis_OCL
"
"
../
examples/Employee_
Model/Design/Design_OCL
"
document_files
"conclusion.tex"
"formalization.tex"
"figures/AbstractSimpleChair.pdf"
"figures/jedit.png"
"figures/pdf.png"
"figures/person.png"
"figures/pre-post.pdf"
"hol-ocl-isar.sty"
"introduction.tex"
"lstisar.sty"
"omg.sty"
"prooftree.sty"
"root.bib"
"root.tex"
"figures/AbstractSimpleChair.pdf"
"figures/jedit.png"
"figures/pdf.png"
"figures/person.png"
"figures/pre-post.pdf"
"FOCL_Syntax.tex"
thys/Featherweight_OCL/document/formalization.tex
deleted
100644 → 0
View file @
57bb4337
\part
{
A Proposal for Formal Semantics of OCL 2.5
}
\input
{
OCL
_
core.tex
}
\input
{
OCL
_
lib.tex
}
\input
{
OCL
_
state.tex
}
\input
{
OCL
_
tools.tex
}
\input
{
OCL
_
main.tex
}
\part
{
Examples
}
\chapter
{
The Employee Analysis Model
}
\label
{
ex:employee-analysis
}
\input
{
Employee
_
AnalysisModel
_
UMLPart.tex
}
\input
{
Employee
_
AnalysisModel
_
OCLPart.tex
}
\chapter
{
The Employee Design Model
}
\label
{
ex:employee-design
}
\input
{
Employee
_
DesignModel
_
UMLPart.tex
}
\input
{
Employee
_
DesignModel
_
OCLPart.tex
}
%%% Local Variables:
%%% mode: latex
%%% TeX-master: "root"
%%% End:
thys/Featherweight_OCL/document/root.tex
deleted
100644 → 0
View file @
57bb4337
\documentclass
[fontsize=11pt,paper=a4,open=right,twoside,abstract=true]
{
scrreprt
}
\usepackage
{
fixltx2e
}
\usepackage
{
isabelle,isabellesym
}
\usepackage
[nocolortable, noaclist]
{
hol-ocl-isar
}
\usepackage
{
booktabs
}
\usepackage
{
graphicx
}
\usepackage
{
amssymb
}
\usepackage
[numbers, sort&compress, sectionbib]
{
natbib
}
\usepackage
[caption=false]
{
subfig
}
\usepackage
{
lstisar
}
\usepackage
{
tabu
}
\usepackage
[]
{
mathtools
}
\usepackage
{
prooftree
}
\usepackage
[english]
{
babel
}
\usepackage
[pdfpagelabels, pageanchor=false, plainpages=false]
{
hyperref
}
% \usepackage[draft]{fixme}
% MathOCl expressions
\colorlet
{
MathOclColor
}{
Black
}
\colorlet
{
HolOclColor
}{
Black
}
\colorlet
{
OclColor
}{
Black
}
%
\sloppy
\uchyph
=0
\graphicspath
{{
data/
}
,
{
figures/
}}
\allowdisplaybreaks
\renewcommand
{
\HolTrue
}{
\mathrm
{
true
}}
\renewcommand
{
\HolFalse
}{
\mathrm
{
false
}}
\newcommand
{
\ptmi
}
[1]
{
\using
{
\mi
{
#1
}}}
\newcommand
{
\Lemma
}
[1]
{{
\color
{
BrickRed
}
%
\mathbf
{
\operatorname
{
lemma
}}}
~
\text
{
#1:
}
\quad
}
\newcommand
{
\done
}{{
\color
{
OliveGreen
}
\operatorname
{
done
}}}
\newcommand
{
\apply
}
[1]
{{
\holoclthykeywordstyle
%
\operatorname
{
apply
}}
(
\text
{
#1
}
)
}
\newcommand
{
\fun
}
{{
\holoclthykeywordstyle\operatorname
{
fun
}}}
\newcommand
{
\definitionS
}
{{
\holoclthykeywordstyle\operatorname
{
definition
}}}
\newcommand
{
\where
}
{{
\holoclthykeywordstyle\operatorname
{
where
}}}
\newcommand
{
\datatype
}
{{
\holoclthykeywordstyle\operatorname
{
datatype
}}}
\newcommand
{
\types
}
{{
\holoclthykeywordstyle\operatorname
{
types
}}}
\newcommand
{
\pglabel
}
[1]
{
\text
{
#1
}}
\renewcommand
{
\isasymOclUndefined
}{
\ensuremath
{
\mathtt
{
invalid
}}}
\newcommand
{
\isasymOclNull
}{
\ensuremath
{
\mathtt
{
null
}}}
\newcommand
{
\isasymOclInvalid
}{
\isasymOclUndefined
}
\DeclareMathOperator
{
\inv
}{
inv
}
\newcommand
{
\Null
}
[1]
{{
\ensuremath
{
\mathtt
{
null
}_
\text
{{
#1
}}}}}
\newcommand
{
\testgen
}{
HOL-TestGen
\xspace
}
\newcommand
{
\HolOption
}{
\mathrm
{
option
}}
\newcommand
{
\ran
}{
\mathrm
{
ran
}}
\newcommand
{
\dom
}{
\mathrm
{
dom
}}
\newcommand
{
\typedef
}{
\mathrm
{
typedef
}}
\newcommand
{
\mi
}
[1]
{
\,\text
{
#1
}}
\newcommand
{
\state
}
[1]
{
\ifthenelse
{
\equal
{}{
#1
}}
%
{
\operatorname
{
state
}}
%
{
\operatorname
{
\mathit
{
state
}}
(#1)
}
%
}
\newcommand
{
\mocl
}
[1]
{
\text
{
\inlineocl
|#1|
}}
\DeclareMathOperator
{
\TCnull
}{
null
}
\DeclareMathOperator
{
\HolNull
}{
null
}
\DeclareMathOperator
{
\HolBot
}{
bot
}
% urls in roman style, theory text in math-similar italics
\urlstyle
{
rm
}
\isabellestyle
{
it
}
\newcommand
{
\ie
}{
i.
\,
e.
\xspace
}
\newcommand
{
\eg
}{
e.
\,
g.
\xspace
}
\begin{document}
\renewcommand
{
\subsubsectionautorefname
}{
Section
}
\renewcommand
{
\subsectionautorefname
}{
Section
}
\renewcommand
{
\sectionautorefname
}{
Section
}
\renewcommand
{
\chapterautorefname
}{
Chapter
}
\newcommand
{
\subtableautorefname
}{
\tableautorefname
}
\newcommand
{
\subfigureautorefname
}{
\figureautorefname
}
\title
{
Featherweight OCL
}
\subtitle
{
A Proposal for a Machine-Checked Formal Semantics for OCL 2.5
}
\author
{
%
\href
{
http://www.brucker.ch/
}{
Achim D. Brucker
}
\footnotemark
[1]
\and
\href
{
https://www.lri.fr/~tuong/
}{
Fr
\'
ed
\'
eric Tuong
}
\footnotemark
[3]
\and
\href
{
https://www.lri.fr/~wolff/
}{
Burkhart Wolff
}
\footnotemark
[2]
}
\publishers
{
%
\footnotemark
[1]
~SAP AG, Vincenz-Priessnitz-Str. 1, 76131 Karlsruhe,
Germany
\texorpdfstring
{
\\
}{}
\href
{
mailto:"Achim D. Brucker"
<achim.brucker@sap.com>
}{
achim.brucker@sap.com
}
\\
[2em]
%
\footnotemark
[3]
~Univ. Paris-Sud, IRT SystemX, 8 av.~de la Vauve,
\\
91120 Palaiseau, France
\\
frederic.tuong@
\{
u-psud, irt-systemx
\}
.fr
\\
[2em]
%
\footnotemark
[2]
~Univ. Paris-Sud, Laboratoire LRI, UMR8623, 91405 Orsay, France
\\
CNRS, 91405 Orsay, France
\texorpdfstring
{
\\
}{}
\href
{
mailto:"Burkhart Wolff" <burkhart.wolff@lri.fr>
}{
burkhart.wolff@lri.fr
}
}
\maketitle
\begin{abstract}
The Unified Modeling Language (UML) is one of the few modeling
languages that is widely used in industry. While UML is mostly known
as diagrammatic modeling language (
\eg
, visualizing class models),
it is complemented by a textual language, called Object Constraint
Language (OCL). OCL is a textual annotation language, based on a
three-valued logic, that turns UML into a formal language.
Unfortunately the semantics of this specification language, captured
in the ``Annex A'' of the OCL standard, leads to different
interpretations of corner cases. Many of these corner cases had
been subject to formal analysis since more than ten years.
The situation complicated when with version 2.3 the OCL was aligned
with the latest version of UML: this led to the extension of the
three-valued logic by a second exception element, called
\inlineocl
{
null
}
. While the first exception element
\inlineocl
{
invalid
}
has a strict semantics,
\inlineocl
{
null
}
has a
non strict semantic interpretation. These semantic difficulties lead
to remarkable confusion for implementors of OCL compilers and
interpreters.
In this paper, we provide a formalization of the core of OCL in
HOL
\@
. It provides denotational definitions, a logical calculus and
operational rules that allow for the execution of OCL expressions by
a mixture of term rewriting and code compilation. Our formalization
reveals several inconsistencies and contradictions in the current
version of the OCL standard. They reflect a challenge to define and
implement OCL tools in a uniform manner. Overall, this document is
intended to provide the basis for a machine-checked text ``Annex A''
of the OCL standard targeting at tool implementors.
\end{abstract}
\tableofcontents
\include
{
introduction
}
\include
{
formalization
}
\include
{
conclusion
}
\bibliographystyle
{
abbrvnat
}
\bibliography
{
root
}
\end{document}
%%% Local Variables:
%%% mode: latex
%%% TeX-master: t
%%% End:
% LocalWords: implementors denotational OCL UML
thys/Featherweight_OCL/examples/Employee_AnalysisModel_OCLPart.thy
deleted
100644 → 0
View file @
57bb4337
(*****************************************************************************
* Featherweight-OCL --- A Formal Semantics for UML-OCL Version OCL 2.4
* for the OMG Standard.
* http://www.brucker.ch/projects/hol-testgen/
*
* Employee_DesignModel_OCLPart.thy --- OCL Contracts and an Example.
* This file is part of HOL-TestGen.
*
* Copyright (c) 2012-2013 Université Paris-Sud, France
* 2013 IRT SystemX, France
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are
* met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* * Redistributions in binary form must reproduce the above
* copyright notice, this list of conditions and the following
* disclaimer in the documentation and/or other materials provided
* with the distribution.
*
* * Neither the name of the copyright holders nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
******************************************************************************)
section{* The Employee Analysis Model (OCL) *}
theory
Employee_AnalysisModel_OCLPart
imports
Employee_AnalysisModel_UMLPart
begin
text {* \label{ex:employee-analysis:ocl} *}
subsection{* Standard State Infrastructure *}
text{* Ideally, these definitions are automatically generated from the class model. *}
subsection{* Invariant *}
text{* These recursive predicates can be defined conservatively
by greatest fix-point
constructions---automatically. See~\cite{brucker.ea:hol-ocl-book:2006,brucker:interactive:2007}
for details. For the purpose of this example, we state them as axioms
here. *}
axiomatization inv_Person :: "Person \<Rightarrow> Boolean"
where A : "(\<tau> \<Turnstile> (\<delta> self)) \<longrightarrow>
(\<tau> \<Turnstile> inv_Person(self)) =
((\<tau> \<Turnstile> (self .boss \<doteq> null)) \<or>
( \<tau> \<Turnstile> (self .boss <> null) \<and> (\<tau> \<Turnstile> ((self .salary) `\<le> (self .boss .salary))) \<and>
(\<tau> \<Turnstile> (inv_Person(self .boss))))) "
axiomatization inv_Person_at_pre :: "Person \<Rightarrow> Boolean"
where B : "(\<tau> \<Turnstile> (\<delta> self)) \<longrightarrow>
(\<tau> \<Turnstile> inv_Person_at_pre(self)) =
((\<tau> \<Turnstile> (self .boss@pre \<doteq> null)) \<or>
( \<tau> \<Turnstile> (self .boss@pre <> null) \<and>
(\<tau> \<Turnstile> (self .boss@pre .salary@pre `\<le> self .salary@pre)) \<and>
(\<tau> \<Turnstile> (inv_Person_at_pre(self .boss@pre))))) "
text{* A very first attempt to characterize the axiomatization by an inductive
definition - this can not be the last word since too weak (should be equality!) *}
coinductive inv :: "Person \<Rightarrow> (\<AA>)st \<Rightarrow> bool" where
"(\<tau> \<Turnstile> (\<delta> self)) \<Longrightarrow> ((\<tau> \<Turnstile> (self .boss \<doteq> null)) \<or>
(\<tau> \<Turnstile> (self .boss <> null) \<and> (\<tau> \<Turnstile> (self .boss .salary `\<le> self .salary)) \<and>
( (inv(self .boss))\<tau> )))
\<Longrightarrow> ( inv self \<tau>)"
subsection{* The Contract of a Recursive Query *}
text{* The original specification of a recursive query :
\begin{ocl}
context Person::contents():Set(Integer)
post: result = if self.boss = null
then Set{i}
else self.boss.contents()->including(i)
endif
\end{ocl} *}
consts dot_contents :: "Person \<Rightarrow> Set_Integer" ("(1(_).contents'('))" 50)
axiomatization where dot_contents_def:
"(\<tau> \<Turnstile> ((self).contents() \<triangleq> result)) =
(if (\<delta> self) \<tau> = true \<tau>
then ((\<tau> \<Turnstile> true) \<and>
(\<tau> \<Turnstile> (result \<triangleq> if (self .boss \<doteq> null)
then (Set{self .salary})
else (self .boss .contents()->including(self .salary))
endif)))
else \<tau> \<Turnstile> result \<triangleq> invalid)"
consts dot_contents_AT_pre :: "Person \<Rightarrow> Set_Integer" ("(1(_).contents@pre'('))" 50)
axiomatization where dot_contents_AT_pre_def:
"(\<tau> \<Turnstile> (self).contents@pre() \<triangleq> result) =
(if (\<delta> self) \<tau> = true \<tau>
then \<tau> \<Turnstile> true \<and> (* pre *)
\<tau> \<Turnstile> (result \<triangleq> if (self).boss@pre \<doteq> null (* post *)
then Set{(self).salary@pre}
else (self).boss@pre .contents@pre()->including(self .salary@pre)
endif)
else \<tau> \<Turnstile> result \<triangleq> invalid)"
text{* These \inlineocl{@pre} variants on methods are only available on queries, \ie,
operations without side-effect. *}
subsection{* The Contract of a Method *}
text{*
The specification in high-level OCL input syntax reads as follows:
\begin{ocl}
context Person::insert(x:Integer)
post: contents():Set(Integer)
contents() = contents@pre()->including(x)
\end{ocl}
*}
consts dot_insert :: "Person \<Rightarrow> Integer \<Rightarrow> Void" ("(1(_).insert'(_'))" 50)
axiomatization where dot_insert_def:
"(\<tau> \<Turnstile> ((self).insert(x) \<triangleq> result)) =
(if (\<delta> self) \<tau> = true \<tau> \<and> (\<upsilon> x) \<tau> = true \<tau>
then \<tau> \<Turnstile> true \<and>
\<tau> \<Turnstile> ((self).contents() \<triangleq> (self).contents@pre()->including(x))
else \<tau> \<Turnstile> ((self).insert(x) \<triangleq> invalid))"
end
thys/Featherweight_OCL/examples/Employee_Model/Analysis/Analysis_OCL.thy
0 → 100644
View file @
ea3b38fc
This diff is collapsed.
Click to expand it.
thys/Featherweight_OCL/examples/Employee_Analysis
Model_UMLPart
.thy
→
thys/Featherweight_OCL/examples/Employee_
Model/
Analysis
/Analysis_UML
.thy
View file @
ea3b38fc
This diff is collapsed.
Click to expand it.
thys/Featherweight_OCL/examples/Employee_
DesignModel_OCLPart
.thy
→
thys/Featherweight_OCL/examples/Employee_
Model/Design/Design_OCL
.thy
View file @
ea3b38fc
(*****************************************************************************
* Featherweight-OCL --- A Formal Semantics for UML-OCL Version OCL 2.
4
* Featherweight-OCL --- A Formal Semantics for UML-OCL Version OCL 2.
5
* for the OMG Standard.
* http://www.brucker.ch/projects/hol-testgen/
*
*
Employee_DesignModel_OCLPart
.thy --- OCL Contracts and an Example.
*
Design_OCL
.thy --- OCL Contracts and an Example.
* This file is part of HOL-TestGen.
*
* Copyright (c) 2012-201
3
Université Paris-Sud, France
* 2013
IRT SystemX, France
* Copyright (c) 2012-201
5
Université
Paris-Saclay, Univ.
Paris-Sud, France
* 2013
-2015
IRT SystemX, France
*
* All rights reserved.
*
...
...
@@ -40,104 +40,98 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
******************************************************************************)
section{* The Employee Design Model (OCL) *}
theory
Employee_DesignModel_OCLPart
Design_OCL
imports
Employee_DesignModel_UMLPart
Design_UML
begin
text {* \label{ex:employee-design:ocl} *}
subsection{* Standard State Infrastructure *}
text{* Ideally, these definitions are automatically generated from the class model. *}
sub
section{* Invariant *}
section{*
OCL Part:
Invariant *}
text{* These recursive predicates can be defined conservatively
by greatest fix-point
constructions---automatically. See~\cite{brucker.ea:hol-ocl-book:2006,brucker:interactive:2007}
for details. For the purpose of this example, we state them as axioms
here. *}
axiomatization inv_Person :: "Person \<Rightarrow> Boolean"
where A : "(\<tau> \<Turnstile> (\<delta> self)) \<longrightarrow>
(\<tau> \<Turnstile> inv_Person(self)) =
((\<tau> \<Turnstile> (self .boss \<doteq> null)) \<or>
( \<tau> \<Turnstile> (self .boss <> null) \<and> (\<tau> \<Turnstile> ((self .salary) `\<le> (self .boss .salary))) \<and>
(\<tau> \<Turnstile> (inv_Person(self .boss))))) "
axiomatization inv_Person_at_pre :: "Person \<Rightarrow> Boolean"
where B : "(\<tau> \<Turnstile> (\<delta> self)) \<longrightarrow>
(\<tau> \<Turnstile> inv_Person_at_pre(self)) =
((\<tau> \<Turnstile> (self .boss@pre \<doteq> null)) \<or>
( \<tau> \<Turnstile> (self .boss@pre <> null) \<and>
(\<tau> \<Turnstile> (self .boss@pre .salary@pre `\<le> self .salary@pre)) \<and>
(\<tau> \<Turnstile> (inv_Person_at_pre(self .boss@pre))))) "
here.
\begin{ocl}
context Person
inv label : self .boss <> null implies (self .salary \<le> ((self .boss) .salary))
\end{ocl}
*}
definition Person_label\<^sub>i\<^sub>n\<^sub>v :: "Person \<Rightarrow> Boolean"
where "Person_label\<^sub>i\<^sub>n\<^sub>v (self) \<equiv>
(self .boss <> null implies (self .salary \<le>\<^sub>i\<^sub>n\<^sub>t ((self .boss) .salary)))"
definition Person_label\<^sub>i\<^sub>n\<^sub>v\<^sub>A\<^sub>T\<^sub>p\<^sub>r\<^sub>e :: "Person \<Rightarrow> Boolean"
where "Person_label\<^sub>i\<^sub>n\<^sub>v\<^sub>A\<^sub>T\<^sub>p\<^sub>r\<^sub>e (self) \<equiv>
(self .boss@pre <> null implies (self .salary@pre \<le>\<^sub>i\<^sub>n\<^sub>t ((self .boss@pre) .salary@pre)))"
definition Person_label\<^sub>g\<^sub>l\<^sub>o\<^sub>b\<^sub>a\<^sub>l\<^sub>i\<^sub>n\<^sub>v :: "Boolean"
where "Person_label\<^sub>g\<^sub>l\<^sub>o\<^sub>b\<^sub>a\<^sub>l\<^sub>i\<^sub>n\<^sub>v \<equiv> (Person .allInstances()->forAll\<^sub>S\<^sub>e\<^sub>t(x | Person_label\<^sub>i\<^sub>n\<^sub>v (x)) and
(Person .allInstances@pre()->forAll\<^sub>S\<^sub>e\<^sub>t(x | Person_label\<^sub>i\<^sub>n\<^sub>v\<^sub>A\<^sub>T\<^sub>p\<^sub>r\<^sub>e (x))))"
lemma "\<tau> \<Turnstile> \<delta> (X .boss) \<Longrightarrow> \<tau> \<Turnstile> Person .allInstances()->includes\<^sub>S\<^sub>e\<^sub>t(X .boss) \<and>
\<tau> \<Turnstile> Person .allInstances()->includes\<^sub>S\<^sub>e\<^sub>t(X) "
oops
(* To be generated generically ... hard, but crucial lemma that should hold.
It means that X and it successor are object representation that actually
occur in the state. *)
lemma REC_pre : "\<tau> \<Turnstile> Person_label\<^sub>g\<^sub>l\<^sub>o\<^sub>b\<^sub>a\<^sub>l\<^sub>i\<^sub>n\<^sub>v
\<Longrightarrow> \<tau> \<Turnstile> Person .allInstances()->includes\<^sub>S\<^sub>e\<^sub>t(X) (* X represented object in state *)
\<Longrightarrow> \<exists> REC. \<tau> \<Turnstile> REC(X) \<triangleq> (Person_label\<^sub>i\<^sub>n\<^sub>v (X) and (X .boss <> null implies REC(X .boss)))"
oops (* Attempt to allegiate the burden of he following axiomatizations: could be
a witness for a constant specification ...*)
text{* This allows to state a predicate: *}
axiomatization inv\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n\<^sub>_\<^sub>l\<^sub>a\<^sub>b\<^sub>e\<^sub>l :: "Person \<Rightarrow> Boolean"
where inv\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n\<^sub>_\<^sub>l\<^sub>a\<^sub>b\<^sub>e\<^sub>l_def:
"(\<tau> \<Turnstile> Person .allInstances()->includes\<^sub>S\<^sub>e\<^sub>t(self)) \<Longrightarrow>
(\<tau> \<Turnstile> (inv\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n\<^sub>_\<^sub>l\<^sub>a\<^sub>b\<^sub>e\<^sub>l(self) \<triangleq> (self .boss <> null implies
(self .salary \<le>\<^sub>i\<^sub>n\<^sub>t ((self .boss) .salary)) and
inv\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n\<^sub>_\<^sub>l\<^sub>a\<^sub>b\<^sub>e\<^sub>l(self .boss))))"
axiomatization inv\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n\<^sub>_\<^sub>l\<^sub>a\<^sub>b\<^sub>e\<^sub>l\<^sub>A\<^sub>T\<^sub>p\<^sub>r\<^sub>e :: "Person \<Rightarrow> Boolean"
where inv\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n\<^sub>_\<^sub>l\<^sub>a\<^sub>b\<^sub>e\<^sub>l\<^sub>A\<^sub>T\<^sub>p\<^sub>r\<^sub>e_def:
"(\<tau> \<Turnstile> Person .allInstances@pre()->includes\<^sub>S\<^sub>e\<^sub>t(self)) \<Longrightarrow>
(\<tau> \<Turnstile> (inv\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n\<^sub>_\<^sub>l\<^sub>a\<^sub>b\<^sub>e\<^sub>l\<^sub>A\<^sub>T\<^sub>p\<^sub>r\<^sub>e(self) \<triangleq> (self .boss@pre <> null implies
(self .salary@pre \<le>\<^sub>i\<^sub>n\<^sub>t ((self .boss@pre) .salary@pre)) and
inv\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n\<^sub>_\<^sub>l\<^sub>a\<^sub>b\<^sub>e\<^sub>l\<^sub>A\<^sub>T\<^sub>p\<^sub>r\<^sub>e(self .boss@pre))))"
lemma inv_1 :
"(\<tau> \<Turnstile> Person .allInstances()->includes\<^sub>S\<^sub>e\<^sub>t(self)) \<Longrightarrow>
(\<tau> \<Turnstile> inv\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n\<^sub>_\<^sub>l\<^sub>a\<^sub>b\<^sub>e\<^sub>l(self) = ((\<tau> \<Turnstile> (self .boss \<doteq> null)) \<or>
( \<tau> \<Turnstile> (self .boss <> null) \<and>
\<tau> \<Turnstile> ((self .salary) \<le>\<^sub>i\<^sub>n\<^sub>t (self .boss .salary)) \<and>
\<tau> \<Turnstile> (inv\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n\<^sub>_\<^sub>l\<^sub>a\<^sub>b\<^sub>e\<^sub>l(self .boss))))) "
oops (* Let's hope that this holds ... *)
lemma inv_2 :
"(\<tau> \<Turnstile> Person .allInstances@pre()->includes\<^sub>S\<^sub>e\<^sub>t(self)) \<Longrightarrow>
(\<tau> \<Turnstile> inv\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n\<^sub>_\<^sub>l\<^sub>a\<^sub>b\<^sub>e\<^sub>l\<^sub>A\<^sub>T\<^sub>p\<^sub>r\<^sub>e(self)) = ((\<tau> \<Turnstile> (self .boss@pre \<doteq> null)) \<or>
(\<tau> \<Turnstile> (self .boss@pre <> null) \<and>
(\<tau> \<Turnstile> (self .boss@pre .salary@pre \<le>\<^sub>i\<^sub>n\<^sub>t self .salary@pre)) \<and>
(\<tau> \<Turnstile> (inv\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n\<^sub>_\<^sub>l\<^sub>a\<^sub>b\<^sub>e\<^sub>l\<^sub>A\<^sub>T\<^sub>p\<^sub>r\<^sub>e(self .boss@pre)))))"
oops (* Let's hope that this holds ... *)
text{* A very first attempt to characterize the axiomatization by an inductive
definition - this can not be the last word since too weak (should be equality!) *}
coinductive inv :: "Person \<Rightarrow> (\<AA>)st \<Rightarrow> bool" where
"(\<tau> \<Turnstile> (\<delta> self)) \<Longrightarrow> ((\<tau> \<Turnstile> (self .boss \<doteq> null)) \<or>
(\<tau> \<Turnstile> (self .boss <> null) \<and> (\<tau> \<Turnstile> (self .boss .salary
`
\<le> self .salary)) \<and>
(\<tau> \<Turnstile> (self .boss <> null) \<and> (\<tau> \<Turnstile> (self .boss .salary \<le>
\<^sub>i\<^sub>n\<^sub>t
self .salary)) \<and>
( (inv(self .boss))\<tau> )))
\<Longrightarrow> ( inv self \<tau>)"
subsection{* The Contract of a Recursive Query *}
text{* The original specification of a recursive query :
\begin{ocl}
context Person::contents():Set(Integer)
post: result = if self.boss = null
then Set{i}
else self.boss.contents()->including(i)
endif
\end{ocl} *}
consts dot_contents :: "Person \<Rightarrow> Set_Integer" ("(1(_).contents'('))" 50)
axiomatization where dot_contents_def:
"(\<tau> \<Turnstile> ((self).contents() \<triangleq> result)) =
(if (\<delta> self) \<tau> = true \<tau>
then ((\<tau> \<Turnstile> true) \<and>
(\<tau> \<Turnstile> (result \<triangleq> if (self .boss \<doteq> null)
then (Set{self .salary})
else (self .boss .contents()->including(self .salary))
endif)))
else \<tau> \<Turnstile> result \<triangleq> invalid)"
consts dot_contents_AT_pre :: "Person \<Rightarrow> Set_Integer" ("(1(_).contents@pre'('))" 50)
axiomatization where dot_contents_AT_pre_def:
"(\<tau> \<Turnstile> (self).contents@pre() \<triangleq> result) =
(if (\<delta> self) \<tau> = true \<tau>
then \<tau> \<Turnstile> true \<and> (* pre *)
\<tau> \<Turnstile> (result \<triangleq> if (self).boss@pre \<doteq> null (* post *)
then Set{(self).salary@pre}
else (self).boss@pre .contents@pre()->including(self .salary@pre)
endif)
else \<tau> \<Turnstile> result \<triangleq> invalid)"
text{* These \inlineocl{@pre} variants on methods are only available on queries, \ie,
operations without side-effect. *}
subsection{* The Contract of a Method *}
text{*
The specification in high-level OCL input syntax reads as follows:
\begin{ocl}
context Person::insert(x:Integer)
post: contents():Set(Integer)
contents() = contents@pre()->including(x)
\end{ocl}
*}
consts dot_insert :: "Person \<Rightarrow> Integer \<Rightarrow> Void" ("(1(_).insert'(_'))" 50)
section{* OCL Part: The Contract of a Recursive Query *}
text{* This part is analogous to the Analysis Model and skipped here. *}
axiomatization where dot_insert_def:
"(\<tau> \<Turnstile> ((self).insert(x) \<triangleq> result)) =
(if (\<delta> self) \<tau> = true \<tau> \<and> (\<upsilon> x) \<tau> = true \<tau>
then \<tau> \<Turnstile> true \<and>