This page gives highlights of past lectures and provides lecture notes, reading assignments, and exercises.


Dates Topics and Readings Homework
Aug 21

Aug 23

Course introduction and administration. Introduction to Formal Methods.

Introduction to sets and relations


Required Readings:
  • Syllabus
  • Course overview [pdf] and introduction [pdf]
  • [Haxt10] An introduction to formal methods, with examples of industrial usage
  • Lecture notes on sets and relations (as needed) [pdf]
Recommended Readings:
  • [vLam00] An introduction to formal specifications, and a survey of formal specification approaches.
  • Chap. 1-2 of [Gara13] A fairly comprehensive recent survey on the use and practice of FM.
  • [Barr13] Notes on expert reports and testimony of the Toyota Unintended Acceleration Litigation.
All exercises in lecture notes
Aug 28

Aug 30

Sep 04

Sep 06

Modeling general software systems. Introduction tothe Alloy modeling language. Alloy's foundadiots. Signatures, fields, and multiplicity constrainst.

Modeling simple domains in Alloy. Generating and analyzing model instances with the Alloy Analyzer. Alloy's foundations. Signatures, fields and multiplicity constraints.

Modeling simple domains in Alloy. Generating and analyzing model instances with the Alloy Analyzer.

Relations and operations on them. Formulas, Boolean operators and quantifiers. Expressing constraints on relations using Alloy formulas.

Functions and predicates. Examples.


Required Readings:
  • Lecture notes on sets and relations (as needed) [pdf]
  • Lecture notes on: An introduction to Alloy 4 [part 1, part 2]
Recommended Readings:
All exercises in covered lecture notes
Sep 11

Sep 13

Practice with modeling in Alloy: the Academia domain. Examples and exercises.

Alloy's module system. Motivations and uses. Parametric modules. An example: the predefined Ordering module.


Required Readings: Recommended Readings:
All exercises in covered lecture notes
Sep 18

Sep 20

Modeling dynamic systems in Alloy. Example: making the family model dynamic.

General approach: dynamic systems as state transition systems. Operators. Preconditions, postconditions and frame conditions.

Examples of operators for the family model.


Required Readings:
All exercises in covered lecture notes
Sep 25

Sep 27

More on modeling dynamic systems in Alloy. Example: rovers on a two-dimensional space. Group exercises.

A complete Alloy modeling case study: the hotel room lock system.


Required Readings:
  • Lecture notes: Autonomous Rovers [pdf]
  • The rover.als rover model in dynamic systems examples
  • Lecture notes: Hotel Lock System [pdf]
  • The book/chapter6/hotel*.als sample models (first 2 only) in the Alloy Analyzer
All exercises in covered lecture notes
Oct 02

Oct 04

Oct 09

Introduction to reactive systems. Introduction to the Lustre specification language.

Examples of Lustre programs. Specifying simple reactive systems in Lustre. Simulating Lustre programs with the Kind 2 tool (online examples).

Practice with writing Lustre models and expressing their properties.

Simulating Lustre programs with the Kind 2 tool (online examples).


Required Readings:
  • Lecture notes: Reactive Systems and the Lustre Language [Part 1, Part 2]
  • Chap. 1 of [Halb02], a Lustre tutorial
All exercises in covered lecture notes
Oct 11

First midterm exam.

Oct 16

Oct 18

More practice with writing Lustre models and expressnig their properties.

Checking properties via synchronous observers. Useful temporal operators.

A few examples. Checking properties. Boolean Switches and traffic light examples. In-class exercises.


Required Readings:
  • Lustre examples on the Kind 2 online page except for CruiseController.
Simulate and verify in Kind 2 all Lustre examples in the readings.
Oct 23
Oct 30
Nov 01

Contract-based specification and compositional verification.

Motivation and uses. Extending Lustre with contracts. Contract basics: assumptions, guarantees and execution modes. Example of contracts.


Required Readings:
  • Lecture notes: a Mode-aware Contract Language for Reactive Systems [pdf]
  • StopwatchSpec and ElevatorSpec examples on the Kind 2 online page.
Recommended Readings:
Simulate and verify in Kind 2 all Lustre examples in the readings.
Nov 06

Nov 08

Specifying and verifying programs in high-level programming languages. Introduction to Dafny. Main features. Method contracts in Dafny. Specifying pre and post-conditions. Compositional verification of methods through the use of contracts. Abstraction of while loops by loop invariants. Examples.


Required Readings: Recommended Readings:
  • [Wing95], which provides several hints to specifiers
Exercises 0-6 in [Koen12]
Nov 13

Nov 15

More on loop invariants in Dafny. Functions and predicates. Complex specifications using recursive functions. Reading Frames. Termination of while loops and recursive functions in Dafny. Arrays and quantified verification conditions. Loop invariants for arrays. Examples.


Required Readings: Recommended Readings:
Exercises 7-10 in [Koen12]
Nov 20
Nov 22

Thanksgiving break.

Nov 27

Introduction to value types in Dafny: sets and sequences.


Required Readings:
Nov 29

Second midterm exam.

Dec 4
Dec 6

Classes. Constructors, fields and class methods. Class invariants. Ghost fields. Using ghost fields to represent abstract states. Connecting concrete and abstract state in a class. Examples.


Required Readings: