CS686 - Dependable Computing

Idea!
Discrete Mathematics Clear
Mathematics!
High Quality
Program!

Write Build
Specification Implementation
As To Make
A Brief Survey* A Set Of Predicates
Predicates True

*See me if this is unfamiliar Formal

Specification
Discrete Mathematics (CS686 John Knight 2009) 1 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
2 University of Virginia

Model-Based Specifications
State Description
(Sets, relations, etc)
Invariants
(Predicate Calculus)

Propositions
Operation Name
& Pre/Post Condx
REALLY Important
REALLY Important (Pred Calculus)

Pre Condition Post Condition

What Has To Be True Before An What Has To Be True After An
Operation Can Be Applied Operation Is Applied

Discrete Mathematics (CS686 John Knight 2009)

3 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
4 University of Virginia

Propositions Examples
‡ A proposition is a statement that is either true or false: ‡ The Sun is shining.
Alice Is A Super User ‡ The Earth is a planet.
Edit Is A USER Command ‡ A term in the Senate is six years.

‡ Such statements can be formalized as propositional ‡ It is dark outside.

variables: ‡ We can represent these propositions as
Alice_is_a_superuser propositional variables:
Edit_is_USER_command „ s “The Sun is shining.”
‡ Carefully distinguish between: „ e “The Earth is a planet.”
„ t “A term in the Senate is six years.”
„ A symbol: Alice_is_a_superuser
„ d “It is dark outside.”
„ A meaning: Alice is a super user

Discrete Mathematics (CS686 John Knight 2009)

5 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
6 University of Virginia

1
CS686 - Dependable Computing

Propositions And Specification Propositional Expressions

Complex propositions built using logical operators:
‡ State what has to be true when the software ‡

runs LOGIC NAME SYMBOL INTUITIVE MEANING

„ Negation ¬ not
‡ Nothing about how
„ Conjunction ∧ and
‡ Implementation written to make it true „ Disjunction ∨ or
‡ Informal example—what is this? „ Implication ⇒ if then
„ Equivalence ⇔ same as
„ Input: a positive real number
„ Output: a positive real number ‡ Truth tables tabulate results of logical operators:
„ Output * Output = Input A B ¬A A∨B A∧B A⇒B A⇔B
F F T F F T T
„ Note equality not assignment F T T T F T F
T F F T F F F
T T F T T T T

Discrete Mathematics (CS686 John Knight 2009)

7 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
8 University of Virginia

Examples Uses Of The Operators

‡ Recall the propositional variables:
„ s “The Sun is shining.” ¬shortpassword
„ e “The Earth is a planet.”
„ t “A term in the Senate is six years.” singleuser ∨ multiuser
„ d “It is dark outside.”
‡ Here are some expressions: legaluser ∧ passwordcorrect
„ ¬e
„ ¬t singleuser ⇒ nouserlogin
„ s∧d Note carefully:
Value of expressions is determined superuser ⇔ allfilesreadable
„ ¬s⇒d by truth tables, not your intuition.

Discrete Mathematics (CS686 John Knight 2009)

9 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
10 University of Virginia

Uses Of Implication
‡ Following natural-language fragments translate to A ⇒ B:
„ A implies B.
„ If A then B.
„ B if A.
Implication „
„
A only if B.
A is sufficient for B.
„ B is necessary for A.
‡ Example of why natural language can be confusing
‡ BE CAREFUL WITH IMPLICATION—MAJOR SOURCE
OF ERRORS
(p1 ⇒ p2) does not mean (p2 ⇒ p1)

Discrete Mathematics (CS686 John Knight 2009)

11 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
12 University of Virginia

2
CS686 - Dependable Computing

Complete Example Shutdown System Specification

‡ Specification for very simple shutdown system for a ‡ Specification: a set of propositions:
nuclear reactor „ core_thermal_alarm ⇒ reactor_shutdown ∧
‡ Propositional variables and their meanings: audible_alarm
„ cooling_system_on cooling water pumps working
„ building_radiation_alarm ⇒ reactor_shutdown ∧
„ sensor_system_on all sensors working audible_alarm
„ operators_on_duty all operators in control room
„ reactor_power_high reactor at 1,000 MWatts „ reactor_power_high ⇒ cooling_system_on ∧
„ reactor_power_low reactor at 10 MWatts sensor_system_on ∧
„ reactor_shutdown reactor core shutdown operators_on_duty
„ core_thermal_alarm thermal sensor has triggered „ reactor_low_power ⇒ operators_on_duty
„ building_radiation_alarm radiation sensor has triggered
„ audible_alarm plant emergency warning sounds

Discrete Mathematics (CS686 John Knight 2009)

13 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
14 University of Virginia

Predicates
‡ Predicates are:
„ Expressions containing variables
„ Boolean valued expressions when variables have values
‡ Typical predicates define relationships
Predicates ‡ Example predicates:
„ Expressions built with relational operators
<, ≤, =, ≠, ≥, >
‡ Compound expressions are built with operators from
propositional calculus
‡ Examples:
temperature < temperature_limit
filesize < 1000 ∧ ((date-lastref) < 100)

Discrete Mathematics (CS686 John Knight 2009)

15 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
16 University of Virginia

Quantifiers Quantifiers
‡ Propositions cannot express facts easily about classes of Three quantifiers are:
objects „ Existential ∃
‡ Examples: Fact is true for at least one member of a class
„ If any one of the control computers is not available, the air traffic
„ Unique ∃1
control system must not operate.
Fact is true for exactly one member of a class
„ All of the files in the file system that have been changed since the
last backup was taken are scheduled to be written to tape. „ Universal ∀
‡ Quantifiers are a notation for expressing facts about classes Fact is true for every member of a class
of objects ‡ Quantified expressions are propositions - they are
either true or false

Discrete Mathematics (CS686 John Knight 2009)

17 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
18 University of Virginia

3
CS686 - Dependable Computing

Existential Quantifiers Bound

Variables
Existential Quantifiers
‡ General Form: ‡ Unique existential quantifier is identical except
∃ variable_list | predicate1 • predicate2 there is only one item in the class
‡ Where: ‡ Examples:
variable_list is a lists of variable declarations
predicate1 and predicate2 are predicates ∃ x : 1..10 | even(x) • x < 3 (True)
predicate1 restricts quantified variables
predicate2 defines the truth or falsehood of quantifier ∃1 p : P | userprogram(p) • running(p)
‡ Read:
∃ i, j : 1..100 | i = j+1 • i*i + j*j = 2 (False)
∃ ‘‘There Exists’’
| ‘‘Such That’’ ∃ file : F | modified(file) • size(file) > 1000
• ‘‘For Which’’
There Such For
Exists That Which
Discrete Mathematics (CS686 John Knight 2009)
19 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
20 University of Virginia

Universal Quantifier Bound

Variables
Universal Quantifier
‡ General Form: ‡ Examples:
∀ variable_list | predicate1 • predicate2
‡ Where:
variable_list is a lists of variable declarations ∀ x : 1..10 | even(x) • x*x < 100 (False)
predicate1 and predicate2 are predicates
predicate1 restricts quantified variables ∀ p : P | userprogram(p) • user(p)
predicate2 defines the truth or falsehood of quantifier
∀ s : Student | cs686(s) • smart(s) (True)
‡ Read:
∀ ‘‘For All’’
∀ file : F | modified(file) • backup(file)
| ‘‘Such That’’
• ‘‘It Is The Case That’’ For
Such It Is The
Every Case
That
That
Discrete Mathematics (CS686 John Knight 2009)
21 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
22 University of Virginia

Sets
‡ A set is:
An unordered collection of items
without replication
‡ Elements come from a Universe of elements
Sets ‡ Sets can be defined by enumeration:
colors == {red, green, blue, grey}
sizes == {1, 3, 10, 7, 36}
people == {Jack, John, Jim, Joanne}
‡ Sets can also be defined by comprehension
„ Sometimes called “set builder notation”

Discrete Mathematics (CS686 John Knight 2009)

23 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
24 University of Virginia

4
CS686 - Dependable Computing

Set Comprehension Examples

‡ An elegant, compact notation for defining large
‡ The set of squares of the integers between 1
sets
and 10
‡ Syntax of comprehension:
„ {x : 1..1000 | x ≤ 10 • x * x}
{signature | predicate • term}
{1, 49, 4, 100, 9, 16, 25, 81, 36, 64}
‡ The signature declares variables
‡ The set of pairs with first element < second
‡ The predicate:
element and first and second elements between
„ Restricts the values of the variables
1 & 10
„ Can be omitted (omit | also) for default case of true
„ {a : 1..10; b : 1..10 | a < b • (a, b)}
‡ The term: {(1, 2), (1, 3), (1, 4), (1, 5), ..., (9, 10)}
„ Is an expression defining the structure of set
elements
„ Can be omitted (omit • also) if expression is identity
Discrete Mathematics (CS686 John Knight 2009)
25 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
26 University of Virginia

Predefined Sets Set Membership

‡ Certain sets are used so frequently that they are ‡ Syntax: x ∈ A, x ∉ A
predefined ‡ Meaning: x an element of A
‡ N - the set of natural numbers x not an element of A
„ N = {0, 1, 2, 3, 4, ... }
‡ Examples:
‡ N1 - the set of positive natural numbers
red ∈ colors
„ N1 = {1, 2, 3, 4, ... }
(True)
‡ Z - the set of integers
„ Z = { ... -4, -3, -2, -1, 0, 1, 2, 3, 4, ... }
black ∉ colors
‡ (R - the set of real numbers) (True)
‡ The empty set ∅

Discrete Mathematics (CS686 John Knight 2009)

27 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
28 University of Virginia

Set Cardinality Complement Sets

‡ Syntax: #A ‡ Formal definition for the complement of a set:
‡ Meaning: Number of elements in A A={x|x∉A}
‡ Examples:
„ Or U – A, where U is the universal set
#colors = 4 ‡ Examples (assuming U = Z)
#sizes = 5 „ {1, 2, 3} = { …, -2, -1, 0, 4, 5, 6, … }
‡ What about: „ {New York, Washington} - {3, 4} = {New York,
Washington}
#Z
„ {1, 2} - ∅ = {1, 2}
‡ The difference of any set S with the empty set will be the set
S

Discrete Mathematics (CS686 John Knight 2009)

29 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
30 University of Virginia

5
CS686 - Dependable Computing

Complement Sets Subset

‡ Properties of complement sets ‡ Syntax: A ⊂ B, A ⊆ B, A ⊄ B
‡ Meaning: One set a proper subset
¯
¯
„ A =A Complementation law (subset) of another
¯ =U
AUA Complement law
„ ‡ Examples:
„ ¯ =∅
A∩A Complement law Recall sizes == {1, 3, 10, 7, 36}
{3, 7, 36} ⊂ sizes (True)
{3, 25} ⊂ sizes (False)
‡ A proper subset of a set is a subset with
cardinality less than the set

Discrete Mathematics (CS686 John Knight 2009)

31 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
32 University of Virginia

Set Union Properties Of Set Union

‡ Formal definition for the union of two sets: ‡ AU∅=A Identity law
A U B = { x | x ∈ A or x ∈ B } ‡ AUU=U Domination law
‡ Examples: ‡ AUA=A Idempotent law
„ {1, 2, 3} U {3, 4, 5} = {1, 2, 3, 4, 5}
‡ AUB=BUA Commutative law
„ {New York, Washington} U {3, 4}
‡ A U (B U C) = (A U B) U C Associative law
= {New York, Washington, 3, 4}
„ {1, 2} U ∅ = {1, 2}

Discrete Mathematics (CS686 John Knight 2009)

33 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
34 University of Virginia

Set Intersection Properties Of Set Intersection

‡ Formal definition for the intersection of two sets: ‡ A∩U=A Identity law
A ∩ B = { x | x ∈ A and x ∈ B }
‡ A∩∅=∅ Domination law
‡ Examples
‡ A∩A=A Idempotent law
„ {1, 2, 3} ∩ {3, 4, 5} = {3}
„ {New York, Washington} ∩ {3, 4} = ∅ ‡ A∩B=B∩A Commutative law
‡ No elements in common
‡ A ∩ (B ∩ C) = (A ∩ B) ∩ C Associative law
„ {1, 2} ∩ ∅ = ∅
‡ Any set intersection with the empty set yields the empty set

Discrete Mathematics (CS686 John Knight 2009)

35 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
36 University of Virginia

6
CS686 - Dependable Computing

Disjoint Sets Set Difference

‡ Formal definition for disjoint sets: two sets are ‡ Formal definition for the difference of two sets:
disjoint if their intersection is the empty set A - B = { x | x_ ∈ A and x ∉ B }
A - B = A ∩ B Å Important!
‡ Further examples
‡ Further examples
„ {1, 2, 3} and {3, 4, 5} are not disjoint
„ {1, 2, 3} - {3, 4, 5} = {1, 2}
„ {New York, Washington} and {3, 4} are disjoint „ {New York, Washington} - {3, 4} = {New York,
„ {1, 2} and ∅ are disjoint Washington}
‡ Their intersection is the empty set „ {1, 2} - ∅ = {1, 2}
‡ The difference of any set S with the empty set will be the set
„ ∅ and ∅ are disjoint! S
‡ Their intersection is the empty set

Discrete Mathematics (CS686 John Knight 2009)

37 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
38 University of Virginia

Symmetric Difference Powersets

‡ Formal definition for the symmetric difference of ‡ The powerset of a set is the set of all subsets of
two sets: that set
‡ The powerset of a set X is denoted ¡ X
A ⊕ B = { x | (x ∈ A or x ∈ B) and x ∉ A ∩ B}
‡ Example:
A ⊕ B = (A U B) – (A ∩ B) Å Important!
„ ¡ {1,2} = {{}, {1}, {2}, {1,2}}
‡ Further examples
‡ Used frequently in specification to define
„ {1, 2, 3} ⊕ {3, 4, 5} = {1, 2, 4, 5} restrictions on types
„ {New York, Washington} ⊕ {3, 4} = {New York,
‡ Example:
Washington, 3, 4}
X is the set of all users
„ {1, 2} ⊕ ∅ = {1, 2} privileged_users ∈ ¡ X
‡ The symmetric difference of any set S with the empty set will
be the set S
Discrete Mathematics (CS686 John Knight 2009)
39 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
40 University of Virginia

Cross (Cartesian) Product

‡ Quick review…
‡ Two sets A and B
‡ Cross (aka Cartesian) product is:
Relations „ Set of two-tuples
„ First element from A
„ Second element from B
‡ Cartesian product of A and B, written (A × B), is:
{(a, b) | a ∈ A ∧ b ∈ B}
‡ Note, this is all members of A and B
‡ So it might be huge and it is of limited value

Discrete Mathematics (CS686 John Knight 2009)

41 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
42 University of Virginia

7
CS686 - Dependable Computing

Binary Relations Domain And Range

‡ A relation is a set of ordered pairs - usually with ‡ Domain of a relation:
a name „ Set of items first in pair
‡ Each element of the pair comes from a set ‡ Example:
‡ So a relation is a subset of the Cartesian product
dom memory = {Sun03, Sun06, Mac2}
of two sets
‡ More precisely for a relation R on sets A and B:
‡ Range of a relation:
Element „ Set of items second in pair
Constructor
R ⊆ (A × B) ‡ Example:
R = {a : A; b : B | p(a,b) • (a, b)} ran memory = {512, 1024, 128}
where p(a, b) defines the relationship
44

Discrete Mathematics (CS686 John Knight 2009)

43 University of Virginia
Discrete Mathematics (CS686 John Knight 2009)
University of Virginia

Relation Inverse
‡ Inverse of a relation is a relation!
‡ Inverse of a relation:
„ Reverse order of pairs
„ Denoted by superscript -1 Functions
‡ Example:
memory-1 = {512 ¯ Sun03, 1024 ¯ Sun06,
128 ¯ Mac2}
‡ Note the power available with the inverse

45
Discrete Mathematics (CS686 John Knight 2009)
University of Virginia 46 University of Virginia
Discrete Mathematics (CS686 John Knight 2009)

A Bit Of Terminology Frequent Special Use Of Relations

‡ Relation R on sets A and B: R ⊆ (A × B)
‡ Not all elements of A or B need be in R
‡ So there are four sets that we need to be
concerned about:
„ A
„ B
„ The part of A actually used in R
„ The part of B actually used in R
‡ Note: These definitions are not universally
agreed
‡ Examples of special relations:
„ Toothbrushes to people in a household
„ People to ages
„ Social Security Numbers to credit reports
„ People to seats in a ballpark
Source set ‡ All these examples are relations with the following property:
Target set
Domain Each Item In The Domain Maps To One Item In The Range
Range
‡ This property occurs frequently in specification
‡ Shorthand notation for this is a function

Discrete Mathematics (CS686 John Knight 2009)

47 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
48 University of Virginia

8
CS686 - Dependable Computing

Functions Partial And Total Functions

‡ A function is a special kind of relation ‡ A function is total if mapping is defined for all
‡ Each item in the domain maps to one item in the items in the source set, i.e., domain=source set
range ‡ A function is partial if mapping is defined for
‡ Example: some items in the source set

TOTAL FUNCTION PARTIAL FUNCTION

Discrete Mathematics (CS686 John Knight 2009)

49 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
50 University of Virginia

Injective Functions Surjective Functions

‡ A (partial or total) function is injective if its ‡ A (partial or total) function is surjective if domain
inverse is also a function: Notice: maps to all of target set:
Injective & Inverse
‡ Also called One-to-One functions ‡ Also called Onto functions

INJECTIVE FUNCTION NON-INJECTIVE FUNCTION SURJECTIVE FUNCTION NON-SURJECTIVE FUNCTION

Discrete Mathematics (CS686 John Knight 2009)

51 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
52 University of Virginia

Bijective Functions A Notation For Functions

‡ A (partial or total) function is bijective if it is ‡ Function declaration (different arrows for
injective and surjective: different types of functions):
‡ Also referred to as One-to-One correspondence F:X→Y
‡ Function notations:
TOTAL PARTIAL
Function
Injection
Surjection
Bijection
‡ Function use:
TOTAL PARTIAL (x, y) ³ f written as f x = y or f(x) = y
BIJECTIVE FUNCTION BIJECTIVE FUNCTION

Discrete Mathematics (CS686 John Knight 2009)

53 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
54 University of Virginia

9
CS686 - Dependable Computing

Varieties Of Functions Varieties of Functions

relations
Injection Partial Surjection
partial functions

injective

bijective total

surjective
Function

Bijection

Discrete Mathematics (CS686 John Knight 2009)

55 University of Virginia Discrete Mathematics (CS686 John Knight 2009)
56 University of Virginia

Using Functions In Specification

‡ Functions are useful as:
„ Parts of the state
„ Descriptions of functionality
‡ Examples:
„ State elements such as:
‡ Mapping users to home directories
‡ Courses to classrooms
‡ People to offices
„ Functionality such as:
‡ Trigonometric functions in navigation
‡ Computation of interest, payment amounts, etc. in financial
software

Discrete Mathematics (CS686 John Knight 2009)

57 University of Virginia

10