Using VDM with rely and guarantee-conditions: Experiences from a real project

Abstract

In his extension of VDM, Jones added a rely and a guarantee-condition to the usual pre and post-condition pair. This extension to the technique permits the specification and development of concurrent, shared-variable systems. We describe the technique in detail by giving an example of a simple, but formal, development. A description of part of a substantial system development that has been carried out on a real project is given in the full version of this paper [Woodcock & Dickinson, 1988]. Conclusions are drawn, both about the rules for concurrent data reification, and about the efficacy of the technique and of the industrial use of formal methods in general.