Marc Frappier

Integration of sequential scenarios

We give a formal relation-based definition of scenarios and we show how different scenarios can be integrated to obtain a more global view of user-system interactions. We restrict ourselves to the sequential case, meaning that we suppose that there is only one user (thus, the scenarios we wish to integrate cannot occur concurrently). Our view of scenarios is state-based, rather than event-based, like most of the other approaches, and can be grafted to the well-established specification language Z. Also, the end product of scenario integration, the specification of the functional aspects of the system, is given as a relation; this specification can be refined using independently developed methods. Our formal description is coupled with a diagram-based, transition-system like, presentation of scenarios, which is better suited to communication between clients and specifiers.

Comparison of model checking tools for information systems

This paper compares six model checkers (ALLOY, CADP, FDR2, NUSMV, PROB, SPIN) for the validation of information system specifications. The same case study (a library system) is specified using each model checker. Fifteen properties of various types are checked using temporal logics (CTL and LTL), first-order logic and failure-divergence (FDR2). Three characteristics are evaluated: ease of specifying information system i) behavior, ii) properties, and iii) the number of IS entity instances that can be checked. The paper then identifies the most suitable features required to validate information systems using a model checker.

EB3: an entity-based black-box specification method for information systems

This paper describes a formal method for specifying the observable (external) behavior of information systems using a process algebra and input-output traces. Its notation is mainly based on the entity concept, borrowed from the Jackson System Development method, and integrated with the requirements class diagram to represent data structures and associations. The specification process promotes modular and incremental description of the behavior of each entity through process abstraction, entity type patterns, and entity attribute function patterns. Valid system input traces result from the composition of entity traces by using parallel composition operations. The association between input traces and outputs through an input-output relation completes the specification process.

μcROSE: automated measurement of COSMIC-FFP for Rational Rose RealTime

Abstract During the last 10 years, many organizations have invested resources and energy in order to be rated at the highest level as possible according to some maturity models for software development. Since measures play an important role in these models, it is essential that CASE tools offer facilities to automatically measure the sizes of various documents produced using them. This paper introduces a tool, called μcROSE, that automatically measures the functional software size, as defined by the COSMIC-FFP method, for Rational Rose RealTime models. μ c ROSE streamlines the measurement process, ensuring repeatability and consistency in measurement while reducing measurement cost. It is the first tool to address automatic measurement of COSMIC-FFP and it can be integrated into the Rational Rose RealTime toolset.

Extending statecharts with process algebra operators

This paper describes an adaptation of statecharts to take advantage of process algebra operators like those found in CSP and EB3. The resulting notation is called algebraic state transition diagrams (ASTDs). The process algebra operators considered include sequence, iteration, parallel composition, and quantified synchronization. Quantification is one of the salient features of ASTDs, because it provides a powerful mechanism to precisely and explicitly define cardinalities in a dynamic model. The formal semantics of ASTDs is expressed using the operational style typically used in process algebras. The target application domain is the specification and implementation of information systems.

Formalizing COSMIC-FFP using ROOM

We propose a formalization of the COSMIC Full Function Point (COSMIC-FFP) measure for the Real-time Object Oriented Modeling (ROOM) language. COSMIC-FFP is a measure of the functional size of software. It has been proposed by the COSMIC group as an adaptation of the function point measure for real-time systems. The definition of COSMIC-FFP is general and can be applied to any specification language. The benefits of our formalization are twofold. First it eliminates measurement variance, because the COSMIC informal definition is subject to interpretation by COSMIC-FFP raters, which may lead to different counts for the same specification, depending on the interpretation made by each rater. Second it allows the automation of COSMIC-FFP measurement for ROOM specifications, which reduces measurement costs. Finally, the formal definition of COSMIC-FFP can provide a clear and unambiguous characterization of COSMIC-FFP concepts which is helpful for measuring COSMIC-FFP for other object-oriented notations like UML.

Combining UML, ASTD and B for the formal specification of an access control filter

Combination of formal and semi-formal methods is more and more required to produce specifications that can be, on the one hand, understood and thus validated by both designers and users and, on the other hand, precise enough to be verified by formal methods. This motivates our aim to use these complementary paradigms in order to deal with security aspects of information systems. This paper presents a methodology to specify access control policies starting with a set of graphical diagrams: UML for the functional model, SecureUML for static access control and ASTD for dynamic access control. These diagrams are then translated into a set of B machines. Finally, we present the formal specification of an access control filter that coordinates the different kinds of access control rules and the specification of functional operations. The goal of such B specifications is to rigorously check the access control policy of an information system taking advantage of tools from the B method.

Retrieving software components that minimize adaptation effort

Given a software library whose entries are represented by formal specifications, we distinguish between two retrieval procedures: exact retrieval, whereby, given a query K, we identify all the library components that are correct with respect to K; approximate retrieval, which is invoked when exact retrieval fails, and identifies the library components that minimize adaptation effort. To this effect, we define four measures of functional distance between specifications, and discuss algorithms that minimize these measures over a set of components; then we discuss whether these measures can be used to predict adaptation effort.

State-based versus event-based specifications for information systems: a comparison of B and eb 3

This paper compares two formal methods, B and eb3, for specifying information systems. These two methods are chosen as examples of the state-based paradigm and the event-based paradigm, respectively. The paper considers four viewpoints: functional behavior expression, validation, verification, and evolution. Issues in expressing event ordering constraints, data integrity constraints, and modularity are thereby considered. A simple case study is used to illustrate the comparison, namely, a library management system. Two equivalent specifications are presented using each method. The paper concludes that B and eb3 are complementary. The former is better at expressing complex ordering and static data integrity constraints, whereas the latter provides a simpler, modular, explicit representation of dynamic constraints that are closer to the user’s point of view, while providing loosely coupled definitions of data attributes. The generality of these results from the state-based paradigm and the event-based paradigm perspective are discussed.

A Formal Definition of Function Points for Automated Measurement of B Specifications

This paper proposes a formalization of the IFPUG Function Point (FP) definition for automated measurement of B specifications. This formal definition allows to: i) reduce the variance in FP counts due to rater interpretation of the IFPUG FP informal definition; ii) provide a better understanding of how the IFPUG FP definition should be applied; iii) automate the FP counts for B specifications, which can reduce measurement costs; and iv) identify specific holes in the IFPUG FP definition. We propose modifications to ensure completeness.