Roelf J. Wieringa

A survey of structured and object-oriented software specification methods and techniques

This article surveys techniques used in structured and object-oriented software specification methods. The techniques are classified as techniques for the specification of external interaction and internal decomposition. The external specification techniques are further subdivided into techniques for the specification of functions, behavior, and communication. After surveying the techniques, we summarize the way they are used in structured and object-oriented methods and indicate ways in which they can be combined. This article ends with a plea for simplicity in diagram techniques and for the use of formal semantics to define these techniques. The appendices show how the reviewed techniques are used in 6 structured and 19 object-oriented specification methods.

The role of deontic logic in the specification of information systems

In this paper we discuss the role that deontic logic plays in the specification of information systems, either because constraints on the systems directly concern norms or, and even more importantly, system constraints are considered ideal but violable (so-called `soft? constraints). nTo overcome the traditional problems with deontic logic (the so-called paradoxes), we first state the importance of distinguishing between ought-to-be and ought-to-do constraints and next focus on the most severe paradox, the so-called Chisholm paradox, involving contrary-to-duty norms. We present a multi-modal extension of standard deontic logic (SDL) to represent the ought-to-be version of the Chisholm set properly. For the ought-to-do variant we employ a reduction to dynamic logic, and show how the Chisholm set can be treated adequately in this setting. Finally we discuss a way of integrating both ought-to-be and ought-to-do reasoning, enabling one to draw conclusions from ought-to-be constraints to ought-to-do ones, and show by an example the use(fulness) of this.

A Modal Approach to Intentions, Commitments and Obligations: Intention plus Commitment yields Obligation

In this paper we introduce some new operators that make it possible to reason about decisions and commitments to do actions. In our framework, a decision leads to an intention to do an action. The decision in itself does not change the state of the world; a commitment to actually perform the intended action changes the deontic state of the world such that the intended action becomes obligated. Of course, the obligated action may never actually occur. In our semantic structure, we use static (ough-to-be) and dynamic (ought-to-do) obligation operators. The static operator resembles the classical conception of obligation as truth in ideal worlds, except that it takes the current state as well as the past history of the world into account. This is necessary because it allows us to compare the way a state is actually reached with the way we committed ourselves to reach it. We show that some situations that could formerly not be expressed easily in deontic logic can be described in a natural way using the extended logic described in this paper.

An integrated framework for ought-to-be and ought-to-do constraints

Deontic logic is the logic to reason about ideal and actual behaviour. Besides the traditional role as an underlying logic for law and ethics (for a survey see Meyer and Wieringa, 1993), deontic logic has been proposed as a logic for the specification of legal expert systems [Biagioli et al., 1987; Stamper, 1980], authorization mechanisms [Minsky and Lockman, 1985] decision support systems [Kimbrough, 1988; Lee, 1988a, 1988b], database security rules [Glasgow et al., 1988], fault-tolerant software [Khosla and Mailbaum, 1987; Coenen, 1993], and database integrity constraints [Wieringa et al., 1989, 1991]. A survey of applications can be found in [Wieringa and Meyer, 1993]. In all these areas, we must be able to reason about the difference between ideal and actual behaviour. In many cases, it is important to distinguish ought-to-do statements (which may be interpreted as expressing imperatives of the form an actor ought to perform an action) from ought-to-be statements (which express a desired state of affairs without necessarily mentioning actors and actions bearing relations with that state of affairs). There are situations where we would like to relate the two oughts with each other. For example, suppose we want to specify deontic integrity constraints for a bank data base. From the ought-to-be constraint (1.) The balance of a bank account must be non-negative we would like to derive the ought-to-do statement (2.) If the balance of a bank account is n and n m < 0, then it is forbidden to withdraw m from the account. In addition, we would like to be able to express

Actors, actions, and initiative in normative system specification

The logic of norms, called deontic logic, has been used to specify normative constraints for information systems. For example, one can specify in deontic logic the constraints that a book borrowed from a library should be returned within three weeks, and that if it is not returned, the library should send a reminder. Thus, the notion of obligation to perform an action arises naturally in system specification. Intuitively, deontic logic presupposes the concept of anactor who undertakes actions and is responsible for fulfilling obligations. However, the concept of an actor has not been formalized until now in deontic logic. We present a formalization in dynamic logic, which allows us to express the actor who initiates actions or choices. This is then combined with a formalization, presented earlier, of deontic logic in dynamic logic, which allows us to specify obligations, permissions, and prohibitions to perform an action. The addition of actors allows us to expresswho has the responsibility to perform an action. In addition to the application of the concept of an actor in deontic logic, we discuss two other applications of actors. First, we show how to generalize an approach taken up by De Nicola and Hennessy, who eliminate τ from CCS in favor of internal and external choice. We show that our generalization allows a more accurate specification of system behavior than is possible without it. Second, we show that actors can be used to resolve a long-standing paradox of deontic logic, called the paradox of free-choice permission. Towards the end of the paper, we discuss whether the concept of an actor can be combined with that of an object to formalize the concept of active objects.

Free choice and contextually permitted actions

We present a solution to the paradox of free choice permission by introducing strong and weak permission in a deontic logic of action. It is shown how counterintuitive consequences of strong permission can be avoided by limiting the contexts in which an action can be performed. This is done by introducing the only operator, which allows us to say that only α is performed (and nothing else), and by introducing contextual interpretation of action terms.

Integrating semi-formal and formal software specification techniques

In this paper, we report on the integration of informal, semiformal and formal system specification techniques. We present a framework for system specification called TRADE, within which several well-known semiformal specification techniques are placed. TRADE is based on an analysis of structured and object-oriented requirements specification methods. In this paper, we combine TRADE with the logic-based specification language Albert II and show that this leads to a coherent formal and semiformal requirements specification. We illustrate our approach with examples taken from a large distributed telecommunication application case study, performed in the context of the Esprit project 2RARE.

Steps towards a method for the formal modeling of dynamic objects

Fragments of a method to formally specify object-oriented models of a universe of discourse are presented. The task of finding such models is divided into three subtasks, object classification, event specification, and the specification of the life cycle of an object. Each of these subtasks is further subdivided, and for each of the subtasks heuristics are given that can aid the analyst in deciding how to represent a particular aspect of the real world. The main sources of inspiration are Jackson System Development, algebraic specification of data- and object types, and algebraic specification of processes.

Subsystem design guidelines for extensible general-purpose software

We discuss subsystem design for extensible general-purpose information systemswe extract guidelines from a case study of the redesign and extension of an advanced workflow management system and place them into the context of existing software engineering research. Key aspect is the distinction between essential and physical architectures, related to software clustering and distribution.

Combining static and dynamic modelling methods: a comparison of four methods

A conceptual model of a system is an explicit description of the behaviour required of the system. Methods for conceptual modelling include entity-relationship (ER) modelling, data flow modelling, Jackson System Development (JSD) and several object-oriented analysis method. Given the current diversity of modelling methods, it is important for teaching as well as using these methods to know what the relationships between them is and to be able to indicate what the (im)possibilities of integrating different methods are. This paper compares three classical modelling methods (ER, data flow, JSD) on their possibilities for integration and combination. It is shown that there is a common core of these methods, which centres around the concept of system transaction and that unifies the static view of a system taken by ER modelling, with the dynamic view taken by JSD and the functional view taken by data flow modelling. Several object-oriented analysis methods integrate these three views. This paper illustrates how this is done in the analysis stage of Object Modelling Technique. Finally, it is shown that the transaction decomposition table can be used as a pivot around which to combine different methods. The results of this paper can be used in teaching to explain the relationships and differences between the methods analysed here, and in system development practice to ease the transition from structured to object-oriented methods