This page gives highlights of past lectures and provides lecture notes, reading assignments, and exercises.
Dates  Topics and Readings  Homework 

Aug 21 Aug 23 
Course introduction and administration. Introduction to Formal Methods. Introduction to sets and relations Required Readings: Recommended Readings: 
All exercises in lecture notes 
Aug 28 Aug 30 Sep 04 Sep 06 
Modeling general software systems. Introduction tothe Alloy modeling language. Alloy's foundadiots. Signatures, fields, and multiplicity constrainst. Modeling simple domains in Alloy. Generating and analyzing model instances with the Alloy Analyzer. Alloy's foundations. Signatures, fields and multiplicity constraints. Modeling simple domains in Alloy. Generating and analyzing model instances with the Alloy Analyzer. Relations and operations on them. Formulas, Boolean operators and quantifiers. Expressing constraints on relations using Alloy formulas. Functions and predicates. Examples. Required Readings:

All exercises in covered lecture notes 
Sep 11 Sep 13 
Practice with modeling in Alloy: the Academia domain. Examples and exercises. Alloy's module system. Motivations and uses. Parametric modules. An example: the predefined Ordering module. Required Readings:

All exercises in covered lecture notes 
Sep 18 Sep 20 
Modeling dynamic systems in Alloy. Example: making the family model dynamic. General approach: dynamic systems as state transition systems. Operators. Preconditions, postconditions and frame conditions. Examples of operators for the family model. Required Readings:

All exercises in covered lecture notes 
Sep 25 Sep 27 
More on modeling dynamic systems in Alloy. Example: rovers on a twodimensional space. Group exercises. A complete Alloy modeling case study: the hotel room lock system. Required Readings:

All exercises in covered lecture notes 
Oct 02 Oct 04 Oct 09 
Introduction to reactive systems. Introduction to the Lustre specification language. Examples of Lustre programs. Specifying simple reactive systems in Lustre. Simulating Lustre programs with the Kind 2 tool (online examples). Practice with writing Lustre models and expressing their properties. Simulating Lustre programs with the Kind 2 tool (online examples). Required Readings: 
All exercises in covered lecture notes 
Oct 11 
First midterm exam. 

Oct 16 Oct 18 
More practice with writing Lustre models and expressnig their properties. Checking properties via synchronous observers. Useful temporal operators. A few examples. Checking properties. Boolean Switches and traffic light examples. Inclass exercises. Required Readings:

Simulate and verify in Kind 2 all Lustre examples in the readings. 
Oct 23 Oct 30 Nov 01 
Contractbased specification and compositional verification. Motivation and uses. Extending Lustre with contracts. Contract basics: assumptions, guarantees and execution modes. Example of contracts. Required Readings:

Simulate and verify in Kind 2 all Lustre examples in the readings. 
Nov 06 Nov 08 
Specifying and verifying programs in highlevel programming languages. Introduction to Dafny. Main features. Method contracts in Dafny. Specifying pre and postconditions. Compositional verification of methods through the use of contracts. Abstraction of while loops by loop invariants. Examples. Required Readings:

Exercises 06 in [Koen12] 
Nov 13 Nov 15 
More on loop invariants in Dafny. Functions and predicates. Complex specifications using recursive functions. Reading Frames. Termination of while loops and recursive functions in Dafny. Arrays and quantified verification conditions. Loop invariants for arrays. Examples. Required Readings:

Exercises 710 in [Koen12] 
Nov 20 Nov 22 
Thanksgiving break.


Nov 27 
Introduction to value types in Dafny: sets and sequences. Required Readings:


Nov 29 
Second midterm exam. 

Dec 4 Dec 6 
Classes. Constructors, fields and class methods. Class invariants. Ghost fields. Using ghost fields to represent abstract states. Connecting concrete and abstract state in a class. Examples. Required Readings:

