Weak refinement in Z

An important aspect in the specification of distributed systems is the role of the internal (or unobservable) operation. Such operations are not part of the user interface (i.e. the user cannot invoke them), however, they are essential to our understanding and correct modelling of the system. Various conventions have been employed to model internal operations when specifying distributed systems in Z. If internal operations are distinguished in the specification notation, then refinement needs to deal with internal operations in appropriate ways. However, in the presence of internal operations, standard Z refinement leads to undesirable implementations. In this paper we present a generalization of Z refinement, called weak refinement, which treats internal operations differently from observable operations when refining a system. We illustrate some of the properties of weak refinement through a specification of a telecommunications protocol

Five years of observations of ozone profiles over Lauder, New Zealand

Altitude profiles of ozone (O3) over Lauder (45°S, 170°E) performed using a lidar, ozonesondes, and the satellite-borne Stratospheric Aerosol and Gas Experiment (SAGE II) instrument are presented. These data form one of the few long-term sets of O3 profiles at a Southern Hemisphere location. In the 5 years of data presented, the dominant variation is the annual cycle, the phase and amplitude of which differ below and above 27.5 km. Superposed are irregular episodic variations, caused by various processes. The first process studied is stratosphere-troposphere exchange, characterized by dry and O3-rich air residing in the troposphere, which was found in 21% of the measurements. The second relates to the positioning of the higher polar vortex over Lauder, often in combination with the exchange of air between midlatitude and subtropical stratospheric regions. We present examples of this which were observed over Lauder during the 1997 winter. This winter was selected for further study because of the record-low O3 amounts measured. The third process is mixing of O3-depleted vortex air with midlatitude air after the vortex breakup. We present one example, which shows that a filament originating from the depleted Antarctic vortex significantly lowers O3 amounts over Lauder around 27 November 1997. There is thus a connection between Antarctic O3 depletion and later decrease of O3 amounts at a Southern Hemisphere midlatitude location, namely Lauder

Testing refinements by refining tests

One of the potential benefits of formal methods is that they offer the possibility of reducing the costs of testing. A specification acts as both the benchmark against which any implementation is tested, and also as the means by which tests are generated. There has therefore been interest in developing test generation techniques from formal specifications, and a number of different methods have been derived for state based languages such as Z, B and VDM. However, in addition to deriving tests from a formal specification, we might wish to refine the specification further before its implementation. The purpose of this paper is to explore the relationship between testing and refinement. As our model for test generation we use a DNF partition analysis for operations written in Z, which produces a number of disjoint test cases for each operation. In this paper we discuss how the partition analysis of an operation alters upon refinement, and we develop techniques that allow us to refine abstract tests in order to generate test cases for a refinement. To do so we use (and extend existing) methods for calculating the weakest data refinement of a specification

Dependability for high-tech systems: an industry-as-laboratory approach

Abstrac

Viewpoint consistency in Z and LOTOS: A case study

Specification by viewpoints is advocated as a suitable method of specifying complex systems. Each viewpoint describes the envisaged system from a particular perspective, using concepts and specification languages best suited for that perspective. Inherent in any viewpoint approach is the need to check or manage the consistency of viewpoints and to show that the different viewpoints do not impose contradictory requirements. In previous work we have described a range of techniques for consistency checking, refinement, and translation between viewpoint specifications, in particular for the languages LOTOS and Z. These two languages are advocated in a particular viewpoint model, viz. that of the Open Distributed Processing (ODP) reference model. In this paper we present a case study which demonstrates how all these techniques can be combined in order to show consistency between a viewpoint specified in LOTOS and one specified in Z. Keywords: Viewpoints; Consistency; Z; LOTOS; ODP

Therapeutic and educational objectives in robot assisted play for children with autism

“This material is presented to ensure timely dissemination of scholarly and technical work. Copyright and all rights therein are retained by authors or by other copyright holders. All persons copying this information are expected to adhere to the terms and constraints invoked by each author's copyright. In most cases, these works may not be reposted without the explicit permission of the copyright holder." “Copyright IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.” DOI: 10.1109/ROMAN.2009.5326251This article is a methodological paper that describes the therapeutic and educational objectives that were identified during the design process of a robot aimed at robot assisted play. The work described in this paper is part of the IROMEC project (Interactive Robotic Social Mediators as Companions) that recognizes the important role of play in child development and targets children who are prevented from or inhibited in playing. The project investigates the role of an interactive, autonomous robotic toy in therapy and education for children with special needs. This paper specifically addresses the therapeutic and educational objectives related to children with autism. In recent years, robots have already been used to teach basic social interaction skills to children with autism. The added value of the IROMEC robot is that play scenarios have been developed taking children's specific strengths and needs into consideration and covering a wide range of objectives in children's development areas (sensory, communicational and interaction, motor, cognitive and social and emotional). The paper describes children's developmental areas and illustrates how different experiences and interactions with the IROMEC robot are designed to target objectives in these areas.Final Published versio

Validation of IFE-1.6 SCIAMACHY limb ozone profiles

International audienceThe IFE-1.6 scientific data set of SCIAMACHY limb ozone profiles is validated for the period August?December 2002. The data set provides ozone profiles over an altitude range of 15?45 km. The main uncertainty in the profiles is the imprecise knowledge of the pointing of the instrument, leading to retrieved profiles that are shifted in altitude direction. To obtain a first order correction for the pointing error and the remaining uncertainties, the retrieved profiles are compared to their a-priori value and ozone sondes based on absolute distance and equivalent latitude criteria. A vertical shift of the satellite profiles with 2 km downward is found to be an appropriate correction for the data set studied. A total root-mean-square difference between limb profiles and sondes of 10?15% remains for the stratospheric ozone profile after application of the correction. Small biases are left above and below the ozone maximum at mid latitudes, where the vertical gradients in the retrieved product are in general too strong

Causal ambiguity and partial orders in event structures

Event structure models often have some constraint which ensures that for each\ud system run it is clear what are the causal predecessors of an event (i.e. there is no causal ambiguity). In this contribution we study what happens if we remove\ud such constraints. We define five different partial order semantics that are intentional in the sense that they refer to syntactic aspects of the model. We also define an observational partial order semantics, that derives a partial order from just the event traces. It appears that this corresponds to the so-called early intentional semantics; the other intentional semantics cannot be observationally characterized. We study the equivalences induced by the different partial order definitions, and their interrelations