Case Study: Hotel Lock System Copyright 2007-17 Laurence Pilard, and Cesare Tinelli. Produced by Cesare Tinelli from notes originally written by Laurence Pilard at the University of Iowa. These notes are copyrighted materials and may not be used in other course settings outside of the University of Iowa in their current form or modified form without the express written permission of one of the copyright holders. During this course, students are prohibited from selling notes to or being paid for taking notes by any person or commercial firm without the express written permission of one of the copyright holder. CS:5810 Formal Methods in Software Engineering
32
Embed
CS:5810 Formal Methods in Software Engineeringhomepage.cs.uiowa.edu/~tinelli/classes/181/Fall17/... · • There is a counter-example (seefile hotel1.als) CS:5810 -- Formal Methods
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
CaseStudy:HotelLockSystem
Copyright 2007-17 Laurence Pilard, and Cesare Tinelli. Produced by Cesare Tinelli from notes originally written by Laurence Pilard at the University of Iowa. These notes are copyrighted materials and may not be used in other course settings outside of the University of Iowa in their current form or modified form without the express written permission of one of the copyright holders. During this course, students are prohibited from selling notes to or being paid for taking notes by any person or commercial firm without the express written permission of one of the copyright holder.
15CS:5810 -- Formal Methods in Software Engineering Fall 2017
HotelOperations: GuestEntrypred entry[ g:Guest, r:Room, k:Key, t,t’:Time ] {-- the key used to open the lock is one of-- the keys the guest is holdingk in g.keys.t-- pre and post conditions
let ck = r.currentKey |-- not a new guest(k = ck.t and ck.t' = ck.t) or-- new guest(k = nextKey[ck.t, r.keys] and ck.t' = k)
let lk = FrontDesk.lastKey | {-- the room has no current occupantno r.occ.t-- the input key is the successor of the last key in -- the sequence associated to the roomk = nextKey[r.lk.t, r.keys]-- the guest becomes the new occupant of the roomocc.t' = occ.t + r->g -- the guest holds the input key g.keys.t' = g.keys.t + k-- the input key becomes the room’s current keylk.t' = lk.t ++ r->k
} 23CS:5810 -- Formal Methods in Software Engineering Fall 2017
Analysis• Let’s checkifunauthorized entriesarepossible:– Ifaguest g enters roomr at timet,andthefrontdeskrecordsshowr asoccupied at that time,then gmustbearecorded occupantofr.
assert noBadEntry {all t: Time, r: Room, g: Guest, k: Key | let t' = TO/next[t] |let o = r.FrontDesk.occupant.t |
(entry[g, r, k, t, t’] and some o)implies g in o
}
24CS:5810 -- Formal Methods in Software Engineering Fall 2017
Analysischeck noBadEntry for 3
but 2 Room, 2 Guest, 5 Time
• It is enough tocheckforproblem already with just 2guests and 2rooms
• Time’s scopemustbe at least5because at least4timestepsareneeded toexecute each operationonce.
• Thereis acounter-example (see filehotel1.als)25CS:5810 -- Formal Methods in Software Engineering Fall 2017