SLIDE 1
Dynamic Logic Semantics for UML Consistency Greg OKeefe Computer - - PowerPoint PPT Presentation
Dynamic Logic Semantics for UML Consistency Greg OKeefe Computer - - PowerPoint PPT Presentation
Dynamic Logic Semantics for UML Consistency Greg OKeefe Computer Sciences Laboratory Australian National University The Big Picture a model is a statement about systems The Big Picture a model is a statement about systems but its meaning
SLIDE 2
SLIDE 3
The Big Picture
a model is a statement about systems but its meaning is only approximate
SLIDE 4
The Big Picture
a model is a statement about systems but its meaning is only approximate so we can not say if it is consistent
SLIDE 5
The Big Picture
a model is an approximate statement about systems
SLIDE 6
The Big Picture
a model is an approximate statement about systems a dynamic logic formula is also a statement about systems
SLIDE 7
The Big Picture
a model is an approximate statement about systems a dynamic logic formula is also a statement about systems its meaning is exact
SLIDE 8
The Big Picture
a model is an approximate statement about systems a dynamic logic formula is also a statement about systems its meaning is exact and we can automatically determine its consistency
SLIDE 9
The Big Picture
a model is an approximate statement about systems a dynamic logic formula is also a statement about systems its meaning is exact and we can automatically determine its consistency (undecidable, but most of the time)
SLIDE 10
The Big Picture
a model is an approximate statement about systems a dynamic logic formula is a precise statement about systems
SLIDE 11
The Big Picture
a model is an approximate statement about systems a dynamic logic formula is a precise statement about systems so we translate models into dynamic logic ...
SLIDE 12
Consistency (Logic 101)
In a situation, each statement is true or false. The circle is red. true The circle is red. false
SLIDE 13
Consistency (Logic 101)
In a situation, each statement is true or false. The circle is red. true The circle is red. false A statement is consistent if it is true in some situation. The circle is red. consistent The circle is square. inconsistent
SLIDE 14
A model is a statement about systems
Given a system, each model is true or false. situation/system statement/model true? false?
SLIDE 15
A model is a statement about systems
Given a system, each model is true or false. situation/system statement/model true? false? To answer model consistency questions, we need definitions of:
SLIDE 16
A model is a statement about systems
Given a system, each model is true or false. situation/system statement/model true? false? To answer model consistency questions, we need definitions of: model (syntax) system (semantic domain)
SLIDE 17
A model is a statement about systems
Given a system, each model is true or false. situation/system statement/model true? false? To answer model consistency questions, we need definitions of: model (syntax) system (semantic domain) when a model is true of a system (semantics)
SLIDE 18
A model is a statement about systems
Given a system, each model is true or false. situation/system statement/model true? false? To answer model consistency questions, we need definitions of: model (syntax) system (semantic domain) when a model is true of a system (semantics) Do we have this in the OMG documents?
SLIDE 19
A model is a statement about systems
Given a system, each model is true or false. situation/system statement/model true? false? To answer model consistency questions, we need definitions of: model (syntax) system (semantic domain) when a model is true of a system (semantics) Do we have this in the OMG documents? To answer the questions automatically, we need a procedure to search the (infinte) space of systems.
SLIDE 20
Mellor’s Challenge
Class Diagram State Machine for Class A Entry Action for State s′
send X to self.ex
SLIDE 21
Mellor’s Challenge
Sequence Diagram Class Diagram State Machine for Class A Entry Action for State s′
send X to self.ex
SLIDE 22
Mellor’s Challenge
We want semantics to say this is inconsistent Sequence Diagram Class Diagram State Machine for Class A Entry Action for State s′
send X to self.ex
SLIDE 23
Mellor’s Challenge
We want semantics to say this is inconsistent tools to detect it Sequence Diagram Class Diagram State Machine for Class A Entry Action for State s′
send X to self.ex
SLIDE 24
Dynamic Logic (Logic 201)
First Order Logic syntax example: ∀x • f(x) = y
SLIDE 25
Dynamic Logic (Logic 201)
First Order Logic syntax example: ∀x • f(x) = y interpretation M gives us a function f M
SLIDE 26
Dynamic Logic (Logic 201)
First Order Logic syntax example: ∀x • f(x) = y interpretation M gives us a function f M valuation u gives us individuals xu, yu
SLIDE 27
Dynamic Logic (Logic 201)
First Order Logic syntax example: ∀x • f(x) = y interpretation M gives us a function f M valuation u gives us individuals xu, yu ∀x needs truth of f(x) = y under all x-variants of u
SLIDE 28
Dynamic Logic (Logic 201)
First Order Logic syntax example: ∀x • f(x) = y interpretation M gives us a function f M valuation u gives us individuals xu, yu ∀x needs truth of f(x) = y under all x-variants of u example formula is true iff f M is constant with value yu
SLIDE 29
Dynamic Logic (Logic 201)
First Order Logic syntax example: ∀x • f(x) = y interpretation M gives us a function f M valuation u gives us individuals xu, yu ∀x needs truth of f(x) = y under all x-variants of u example formula is true iff f M is constant with value yu Dynamic Logic syntax example: y := f(x)x = y
SLIDE 30
Dynamic Logic (Logic 201)
First Order Logic syntax example: ∀x • f(x) = y interpretation M gives us a function f M valuation u gives us individuals xu, yu ∀x needs truth of f(x) = y under all x-variants of u example formula is true iff f M is constant with value yu Dynamic Logic syntax example: y := f(x)x = y programϕ means ϕ might be true after program runs
SLIDE 31
Dynamic Logic (Logic 201)
First Order Logic syntax example: ∀x • f(x) = y interpretation M gives us a function f M valuation u gives us individuals xu, yu ∀x needs truth of f(x) = y under all x-variants of u example formula is true iff f M is constant with value yu Dynamic Logic syntax example: y := f(x)x = y programϕ means ϕ might be true after program runs program means binary relation over valuations
SLIDE 32
Dynamic Logic (Logic 201)
First Order Logic syntax example: ∀x • f(x) = y interpretation M gives us a function f M valuation u gives us individuals xu, yu ∀x needs truth of f(x) = y under all x-variants of u example formula is true iff f M is constant with value yu Dynamic Logic syntax example: y := f(x)x = y programϕ means ϕ might be true after program runs program means binary relation over valuations x := t relates u to the x-variant with x → tM,u
SLIDE 33
Dynamic Logic (Logic 201)
First Order Logic syntax example: ∀x • f(x) = y interpretation M gives us a function f M valuation u gives us individuals xu, yu ∀x needs truth of f(x) = y under all x-variants of u example formula is true iff f M is constant with value yu Dynamic Logic syntax example: y := f(x)x = y programϕ means ϕ might be true after program runs program means binary relation over valuations x := t relates u to the x-variant with x → tM,u more syntax: ρ; ρ′ ρ ∪ ρ′ ρ∗ ϕ? [ρ]ϕ
SLIDE 34
System States and Evolution
Statics: What is a system state?
SLIDE 35
System States and Evolution
Statics: What is a system state? a system state is a valuation
SLIDE 36
System States and Evolution
Statics: What is a system state? a system state is a valuation
- bjects are individuals, they persist
SLIDE 37
System States and Evolution
Statics: What is a system state? a system state is a valuation
- bjects are individuals, they persist
attributes, association ends are “array” variables
SLIDE 38
System States and Evolution
Statics: What is a system state? a system state is a valuation
- bjects are individuals, they persist
attributes, association ends are “array” variables Dynamics: How can a system evolve? Objects do actions, if conditions allow:
SLIDE 39
System States and Evolution
Statics: What is a system state? a system state is a valuation
- bjects are individuals, they persist
attributes, association ends are “array” variables Dynamics: How can a system evolve? Objects do actions, if conditions allow: guard?; action
SLIDE 40
System States and Evolution
Statics: What is a system state? a system state is a valuation
- bjects are individuals, they persist
attributes, association ends are “array” variables Dynamics: How can a system evolve? Objects do actions, if conditions allow: ε ≡ ((sc(x, M, y)?; x.send M to y) ∪ (ac(x)?; x.accept))∗
SLIDE 41
System States and Evolution
Statics: What is a system state? a system state is a valuation
- bjects are individuals, they persist
attributes, association ends are “array” variables Dynamics: How can a system evolve? Objects do actions, if conditions allow: ε ≡ ((sc(x, M, y)?; x.send M to y) ∪ (ac(x)?; x.accept))∗ sc(x, M, y) ≡ x.class = ExternalEntity ∨ (head(x.todo) = send M to y) x.send M to y ≡ y.intray := append(y.intray, M); x.todo := tail(x.todo)
SLIDE 42
Class Diagram
For each diagram, a range of interpretations is possible, even
- desirable. Here we give rather weak ones.
SLIDE 43
Class Diagram
For each diagram, a range of interpretations is possible, even
- desirable. Here we give rather weak ones. (They are shorter!)
SLIDE 44
Class Diagram
For each diagram, a range of interpretations is possible, even
- desirable. Here we give rather weak ones. (They are shorter!)
CD ≡ [ε](∀x • x.class = A
- size(x.ex) = 1 ∧
(∀y • y ∈ x.ex
y.class = B))
SLIDE 45
State Machine Diagram
We do not yet specify which objects the state machine diagram applies to, so the formulae have a free variable.
SLIDE 46
State Machine Diagram
We do not yet specify which objects the state machine diagram applies to, so the formulae have a free variable. SMs(x) ≡ [ε](x.state = s ∨ x.state = s′) SMt(x) ≡ [ε](x.state = s ∧ head(x.intray) = W
[x.accept] x.state = s′)
SLIDE 47
Weaving as Formation
Aspect Oriented Modelling and model “weaving” are hot research topics. In this formal setting, it is clear and simple.
SLIDE 48
Weaving as Formation
Aspect Oriented Modelling and model “weaving” are hot research topics. In this formal setting, it is clear and simple. action - state join Put action on todo list when object enters state. SMp(x) ≡ [ε][x.accept]( x.state = s′
- x.todo = send X to x.ex)
SLIDE 49
Weaving as Formation
Aspect Oriented Modelling and model “weaving” are hot research topics. In this formal setting, it is clear and simple. action - state join Put action on todo list when object enters state. SMp(x) ≡ [ε][x.accept]( x.state = s′
- x.todo = send X to x.ex)
state machine - class join Make objects of class A obey state machine formulae. SM ≡ [ε](∀x • x.class = A
SMs(x) ∧ SMt(x) ∧ SMp(x))
SLIDE 50
Sequence Diagram
SEQ ≡ class(ee) = ExternalEntity ∧ a.class = A ∧ b.class = B ∧ ε(sc(ee, W, a) ∧ ee.send W to a ε(ac(a) ∧ a.accept ε(sc(a, Y, b) ∧ a.send Y to b⊤)))
SLIDE 51
Consistency: the search for a satisfying system
Semantic tableaux theorem provers
SLIDE 52
Consistency: the search for a satisfying system
Semantic tableaux theorem provers a formula ϕ is valid iff ¬ϕ is inconsistent
SLIDE 53
Consistency: the search for a satisfying system
Semantic tableaux theorem provers a formula ϕ is valid iff ¬ϕ is inconsistent if a complete search for an interpretation to satisfy ¬ϕ finds none, then it is a proof of ϕ
SLIDE 54
Consistency: the search for a satisfying system
Semantic tableaux theorem provers a formula ϕ is valid iff ¬ϕ is inconsistent if a complete search for an interpretation to satisfy ¬ϕ finds none, then it is a proof of ϕ we can use these interpretation finders to demonstrate model consistency
SLIDE 55
Consistency: the search for a satisfying system
Semantic tableaux theorem provers a formula ϕ is valid iff ¬ϕ is inconsistent if a complete search for an interpretation to satisfy ¬ϕ finds none, then it is a proof of ϕ we can use these interpretation finders to demonstrate model consistency Our search
SLIDE 56
Consistency: the search for a satisfying system
Semantic tableaux theorem provers a formula ϕ is valid iff ¬ϕ is inconsistent if a complete search for an interpretation to satisfy ¬ϕ finds none, then it is a proof of ϕ we can use these interpretation finders to demonstrate model consistency Our search we drop CD ∧ SM ∧ SEQ into a tableau prover, turn the handle and then . . .
SLIDE 57
Consistency: the search for a satisfying system
Semantic tableaux theorem provers a formula ϕ is valid iff ¬ϕ is inconsistent if a complete search for an interpretation to satisfy ¬ϕ finds none, then it is a proof of ϕ we can use these interpretation finders to demonstrate model consistency Our search we drop CD ∧ SM ∧ SEQ into a tableau prover, turn the handle and then . . . it gives us a system where X = Y, showing that the UML model is consistent, hmmm!
SLIDE 58
Consistency: the search for a satisfying system
Semantic tableaux theorem provers a formula ϕ is valid iff ¬ϕ is inconsistent if a complete search for an interpretation to satisfy ¬ϕ finds none, then it is a proof of ϕ we can use these interpretation finders to demonstrate model consistency Our search we drop CD ∧ SM ∧ SEQ into a tableau prover, turn the handle and then . . . it gives us a system where X = Y, showing that the UML model is consistent, hmmm! so next time we add X.name = “X” etc. to our theory
SLIDE 59
Consistency: the search for a satisfying system
Semantic tableaux theorem provers a formula ϕ is valid iff ¬ϕ is inconsistent if a complete search for an interpretation to satisfy ¬ϕ finds none, then it is a proof of ϕ we can use these interpretation finders to demonstrate model consistency Our search we drop CD ∧ SM ∧ SEQ into a tableau prover, turn the handle and then . . . it gives us a system where X = Y, showing that the UML model is consistent, hmmm! so next time we add X.name = “X” etc. to our theory and then the UML model can be shown inconsistent
SLIDE 60
Summary
By translating models into dynamic logic we
SLIDE 61
Summary
By translating models into dynamic logic we
give precise meaning
SLIDE 62
Summary
By translating models into dynamic logic we
give precise meaning enable consistency check
SLIDE 63
Summary
By translating models into dynamic logic we
give precise meaning enable consistency check
Why DL? Why not TLA+, Z, ASM’s, OCL (?!), ...?
SLIDE 64
Summary
By translating models into dynamic logic we
give precise meaning enable consistency check
Why DL? Why not TLA+, Z, ASM’s, OCL (?!), ...? With DL we have made action outline statements.
SLIDE 65
Summary
By translating models into dynamic logic we
give precise meaning enable consistency check
Why DL? Why not TLA+, Z, ASM’s, OCL (?!), ...? With DL we have made action outline statements.
ignore irrelevant detail
SLIDE 66