| Foreword |
|
ix | |
| Preface |
|
xi | |
| PART I DESCRIPTION AND SPECIFICATION |
|
1 | (136) |
|
|
|
|
|
|
|
|
7 | (22) |
|
|
|
|
|
|
Using Assertions About Traces to Write Abstract Specifications for Software Modules |
|
|
9 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
9 | (3) |
|
A Formal Notation for Specification Based on Traces |
|
|
12 | (3) |
|
|
|
15 | (2) |
|
Discussion of the Simple Examples |
|
|
17 | (2) |
|
A Compressed History of the Development of an Abstract Specification |
|
|
19 | (7) |
|
|
|
26 | (3) |
|
|
|
29 | (20) |
|
|
|
|
|
|
Less Restrictive Constructs for Structured Programs |
|
|
31 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
31 | (1) |
|
|
|
31 | (1) |
|
The State of a Computing Machine |
|
|
32 | (1) |
|
|
|
32 | (1) |
|
|
|
32 | (1) |
|
|
|
33 | (1) |
|
Control Constructs and Constructed Programs |
|
|
34 | (1) |
|
Defining the Semantics of Constructed Programs |
|
|
34 | (1) |
|
|
|
34 | (1) |
|
The Syntax of the Constructs |
|
|
34 | (1) |
|
|
|
35 | (1) |
|
|
|
35 | (1) |
|
The Semantics of a Limited Component |
|
|
36 | (1) |
|
The Semantics of Limited Component Lists |
|
|
36 | (1) |
|
|
|
36 | (1) |
|
The Semantics of ``stop'', ``go'' and ``init'' |
|
|
36 | (1) |
|
Semantics of the Iterative Construct (it ti) |
|
|
37 | (1) |
|
The Semantics of Parentheses |
|
|
38 | (1) |
|
|
|
38 | (1) |
|
|
|
39 | (1) |
|
|
|
39 | (1) |
|
A Very Simple Example Done Three Ways |
|
|
40 | (1) |
|
|
|
41 | (1) |
|
|
|
42 | (7) |
|
|
|
49 | (18) |
|
|
|
|
|
|
Predicate Logic for Software Engineering |
|
|
51 | (1) |
|
|
|
|
|
|
|
|
51 | (1) |
|
|
|
51 | (1) |
|
The Structure of This Paper |
|
|
52 | (1) |
|
Comparison with Other Work |
|
|
53 | (2) |
|
|
|
55 | (2) |
|
The Syntax of Logical Expressions |
|
|
57 | (1) |
|
The Meaning of Logical Expressions |
|
|
58 | (2) |
|
Examples of the Use of This Logic in Software Documentation |
|
|
60 | (3) |
|
|
|
63 | (4) |
|
|
|
67 | (22) |
|
|
|
|
|
|
Tabular Representations in Relational Documents |
|
|
71 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
71 | (1) |
|
A Relational Model of Documentation |
|
|
71 | (2) |
|
Industrial Experience with Relational Documentation |
|
|
73 | (2) |
|
Why Use Tabular Representations of Relations? |
|
|
75 | (2) |
|
Formalisation of a Wide Class of Tables |
|
|
77 | (5) |
|
Transformations of Tables of One Kind to Another |
|
|
82 | (3) |
|
|
|
85 | (4) |
|
|
|
89 | (18) |
|
|
|
|
|
|
Precise Description and Specification of Software |
|
|
93 | (1) |
|
|
|
|
|
|
|
|
93 | (1) |
|
|
|
93 | (1) |
|
Language Is Not the Issue |
|
|
94 | (1) |
|
A Polemic About Four Words |
|
|
95 | (2) |
|
Four Types of Software Products |
|
|
97 | (1) |
|
|
|
98 | (1) |
|
A Mathematical Interlude: LD-Relations |
|
|
99 | (1) |
|
Program Construction Tools |
|
|
99 | (1) |
|
|
|
100 | (2) |
|
|
|
102 | (2) |
|
|
|
104 | (1) |
|
Descriptions and Specifications of Objects |
|
|
104 | (1) |
|
|
|
105 | (2) |
|
|
|
107 | (30) |
|
|
|
|
|
|
Specifying Software Requirements for Complex Systems: New Techniques and Their Application |
|
|
111 | (1) |
|
|
|
|
|
|
|
|
111 | (1) |
|
|
|
111 | (1) |
|
A-7 Program Characteristics |
|
|
112 | (1) |
|
Requirements Document Objectives |
|
|
113 | (1) |
|
Requirements Document Design Principles |
|
|
114 | (2) |
|
Techniques for Describing Hardware Interfaces |
|
|
116 | (5) |
|
Techniques for Describing Software Functions |
|
|
121 | (9) |
|
Techniques for Specifying Undesired Events |
|
|
130 | (1) |
|
Techniques for Characterizing Types of Changes |
|
|
131 | (1) |
|
|
|
131 | (1) |
|
|
|
132 | (5) |
| PART II SOFTWARE DESIGN |
|
137 | (246) |
|
|
|
|
|
|
|
|
143 | (14) |
|
|
|
|
|
|
On the Criteria to Be Used in Decomposing Systems into Modules |
|
|
145 | (1) |
|
|
|
|
|
|
|
|
145 | (1) |
|
|
|
145 | (1) |
|
|
|
146 | (1) |
|
Expected Benefits of Modular Programming |
|
|
146 | (1) |
|
|
|
146 | (1) |
|
Example System 1: A KWIC Index Production System |
|
|
146 | (7) |
|
|
|
153 | (1) |
|
|
|
154 | (3) |
|
|
|
157 | (14) |
|
|
|
|
|
|
On a ``Buzzword'': Hierarchical Structure |
|
|
161 | (1) |
|
|
|
|
|
|
|
|
161 | (1) |
|
|
|
161 | (1) |
|
General Properties of All Uses of the Phrase ``Hierarchical Structure'' |
|
|
161 | (7) |
|
|
|
168 | (3) |
|
|
|
171 | (20) |
|
|
|
|
|
|
Use of the Concept of Transparency in the Design of Hierarchically Structured Systems |
|
|
173 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
173 | (1) |
|
|
|
173 | (1) |
|
The ``Top Down'' or ``Outside In'' Approach |
|
|
173 | (2) |
|
``Transparency'' of an Abstraction |
|
|
175 | (1) |
|
|
|
175 | (3) |
|
``Register'' for Markov Algorithm Machine |
|
|
178 | (4) |
|
|
|
182 | (4) |
|
An Unsolved Transparency Problem from the Operating System Area |
|
|
186 | (2) |
|
``Suggestive Transparency'' |
|
|
188 | (1) |
|
``Misleading Transparency'' |
|
|
188 | (1) |
|
Outside In and Bottom Up Procedures in Combination |
|
|
189 | (2) |
|
|
|
191 | (24) |
|
|
|
|
|
|
On the Design and Development of Program Families |
|
|
193 | (1) |
|
|
|
|
|
|
|
|
193 | (1) |
|
|
|
193 | (1) |
|
Motivation for Interest in Families |
|
|
194 | (1) |
|
Classical Method of Producing Program Families |
|
|
194 | (2) |
|
|
|
196 | (1) |
|
Representing the Intermediate Stages |
|
|
197 | (1) |
|
Programming by Stepwise Refinement |
|
|
198 | (2) |
|
Technique of Module Specification |
|
|
200 | (1) |
|
Comparison Based on the KWIC Example |
|
|
201 | (1) |
|
Comparative Remarks Based on Dijkstra's Prime Program |
|
|
202 | (1) |
|
Comparative Remarks Based on an Operating System Problem |
|
|
202 | (2) |
|
Design Decisions in Stage 1 |
|
|
204 | (1) |
|
|
|
205 | (3) |
|
How the Module Specifications Define a Family |
|
|
208 | (1) |
|
|
|
209 | (1) |
|
Relation of the Question of Program Families to Program Generators |
|
|
210 | (1) |
|
|
|
210 | (1) |
|
|
|
211 | (4) |
|
|
|
215 | (14) |
|
|
|
|
|
|
Abstract Types Defined as Classes of Variables |
|
|
217 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
217 | (1) |
|
|
|
217 | (1) |
|
Motivations for Type Extensions |
|
|
218 | (2) |
|
|
|
220 | (6) |
|
Applying These Concepts to Designing a Language |
|
|
226 | (3) |
|
|
|
229 | (26) |
|
|
|
|
|
|
Response to Undesired Events in Software Systems |
|
|
231 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
231 | (1) |
|
|
|
231 | (2) |
|
Difficulties Introduced by a ``Leveled Structure'' |
|
|
233 | (1) |
|
The Effect of Undesired Events on Code Complexity |
|
|
233 | (1) |
|
|
|
234 | (1) |
|
Error Types and Direction of Propogation |
|
|
235 | (1) |
|
Continuation After UE ``Handling'' |
|
|
236 | (1) |
|
Specifying the Error Indications |
|
|
237 | (3) |
|
Redundancy and Efficiency |
|
|
240 | (1) |
|
Degrees of Undesired Events |
|
|
241 | (3) |
|
|
|
244 | (1) |
|
|
|
244 | (11) |
|
Annotated Example of Module Design in Light of Errors |
|
|
247 | (8) |
|
|
|
255 | (12) |
|
|
|
|
|
|
Some Software Engineering Principles |
|
|
257 | (1) |
|
|
|
|
|
|
|
|
257 | (1) |
|
|
|
257 | (1) |
|
What Is a Well-Structured Program? |
|
|
258 | (1) |
|
|
|
259 | (1) |
|
Two Techniques for Controlling the Structure of Systems Programs |
|
|
260 | (1) |
|
|
|
261 | (1) |
|
|
|
262 | (1) |
|
Hierarchical Structure and Subsetable Systems |
|
|
263 | (1) |
|
Designing Abstract Interfaces |
|
|
263 | (1) |
|
|
|
264 | (3) |
|
|
|
267 | (24) |
|
|
|
|
|
|
Designing Software for Ease of Extension and Contraction |
|
|
269 | (1) |
|
|
|
|
|
|
|
|
269 | (1) |
|
|
|
269 | (1) |
|
Software as a Family of Programs |
|
|
270 | (1) |
|
How Does the Lack of Subsets and Extensions Manifest Itself? |
|
|
271 | (2) |
|
Steps Toward a Better Structure |
|
|
273 | (6) |
|
Example: An Address-Processing Subsystem |
|
|
279 | (7) |
|
Some Remarks on Operating Systems: Why Generals Are Superior to Colonels |
|
|
286 | (1) |
|
|
|
286 | (5) |
|
|
|
291 | (24) |
|
|
|
|
|
|
A Procedure for Designing Abstract Interfaces for Device Interface Modules |
|
|
295 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
295 | (1) |
|
|
|
295 | (1) |
|
|
|
296 | (3) |
|
|
|
299 | (2) |
|
|
|
301 | (6) |
|
|
|
307 | (6) |
|
|
|
313 | (2) |
|
|
|
315 | (22) |
|
|
|
|
|
|
The Modular Structure of Complex Systems |
|
|
319 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
319 | (1) |
|
|
|
319 | (2) |
|
Background and Guiding Principles |
|
|
321 | (4) |
|
|
|
325 | (10) |
|
|
|
335 | (2) |
|
|
|
337 | (16) |
|
|
|
|
|
|
Active Design Reviews: Principles and Practices |
|
|
339 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
339 | (1) |
|
|
|
339 | (1) |
|
Objectives of Design Reviews |
|
|
340 | (1) |
|
Conventional Design Reviews |
|
|
341 | (2) |
|
A More Effective Review Process |
|
|
343 | (7) |
|
|
|
350 | (3) |
|
|
|
353 | (16) |
|
|
|
|
|
|
A Rational Design Process: How and Why to Fake It |
|
|
355 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
355 | (1) |
|
The Search for the Philosopher's Stone: Why Do We Want a Rational Design Process? |
|
|
355 | (1) |
|
Why Will a Software Design ``Process'' Always Be an Idealization? |
|
|
356 | (1) |
|
Why Is a Description of a Rational Idealized Process Useful Nonetheless? |
|
|
357 | (1) |
|
What Should the Description of the Development Process Tell Us? |
|
|
358 | (1) |
|
What Is the Rational Design Process? |
|
|
358 | (6) |
|
What Is the Role of Documentation in This Process? |
|
|
364 | (2) |
|
|
|
366 | (1) |
|
|
|
367 | (2) |
|
|
|
369 | (14) |
|
|
|
|
|
|
Inspection of Safety-Critical Software Using Program-Function Tables |
|
|
371 | (1) |
|
|
|
|
|
|
|
|
371 | (1) |
|
|
|
371 | (2) |
|
Safety-Critical Software in the Darlington Nuclear Power Generating Station |
|
|
373 | (1) |
|
Why Is Software Inspection Difficult? |
|
|
374 | (1) |
|
|
|
375 | (1) |
|
|
|
376 | (2) |
|
|
|
378 | (2) |
|
Hazard Analysis Using Functional Documentation |
|
|
380 | (1) |
|
|
|
380 | (3) |
| PART III CONCURRENCY AND SCHEDULING |
|
383 | (84) |
|
|
|
|
|
|
|
|
387 | (6) |
|
|
|
|
|
|
Concurrent Control with ``Readers'' and ``Writers'' |
|
|
389 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
389 | (1) |
|
|
|
389 | (1) |
|
|
|
389 | (1) |
|
|
|
390 | (1) |
|
|
|
391 | (2) |
|
|
|
393 | (10) |
|
|
|
|
|
|
On a Solution to the Cigarette Smoker's Problem (without conditional statements) |
|
|
395 | (1) |
|
|
|
|
|
|
|
|
395 | (1) |
|
|
|
395 | (2) |
|
|
|
397 | (1) |
|
|
|
397 | (1) |
|
|
|
397 | (1) |
|
On a Complication Arising from the Introduction of Semaphore Arrays |
|
|
398 | (1) |
|
On the Yet Unsolved Problem |
|
|
398 | (1) |
|
On More Powerful Primitives |
|
|
399 | (4) |
|
|
|
403 | (34) |
|
|
|
|
|
|
On Synchronization in Hard-Real-Time Systems |
|
|
407 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
407 | (1) |
|
|
|
407 | (1) |
|
The Need for a Separation of Concerns |
|
|
408 | (2) |
|
A Two-Level Approach to Synchronization |
|
|
410 | (1) |
|
Considerations at the Lower Level |
|
|
410 | (1) |
|
The Lower-Level Synchronization Primitives |
|
|
411 | (2) |
|
Considerations at the Upper Level |
|
|
413 | (5) |
|
The STE Synchronization Mechanisms |
|
|
418 | (8) |
|
Implementation in Terms of the Lower-Level Mechanism |
|
|
426 | (2) |
|
The Pre-Run-Time Scheduler |
|
|
428 | (2) |
|
Why Another Synchronization Mechanism? |
|
|
430 | (1) |
|
|
|
430 | (2) |
|
|
|
432 | (5) |
|
|
|
437 | (30) |
|
|
|
|
|
|
Scheduling Processes with Release Times, Deadlines, Precedence, and Exclusion Relations |
|
|
439 | (1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
439 | (1) |
|
|
|
439 | (3) |
|
Overview of the Algorithm |
|
|
442 | (2) |
|
|
|
444 | (3) |
|
How to Improve on a Valid Initial Solution |
|
|
447 | (2) |
|
Searching for an Optimal or Feasible Solution |
|
|
449 | (2) |
|
Empirical Behavior of the Algorithm |
|
|
451 | (1) |
|
|
|
452 | (15) |
|
An Implementation of the Procedure for Computing a Valid Initial Solution |
|
|
455 | (2) |
|
An Implementation of the Main Algorithm |
|
|
457 | (3) |
|
|
|
460 | (7) |
| PART IV COMMENTARY |
|
467 | (140) |
|
|
|
|
|
|
|
|
471 | (6) |
|
|
|
|
|
|
Building Reliable Software in Blowhard |
|
|
473 | (1) |
|
|
|
|
|
|
|
|
473 | (1) |
|
|
|
473 | (1) |
|
Four Views of a Programming Language |
|
|
474 | (1) |
|
Resolving Conflicts of Viewpoints in the Design of Blowhard |
|
|
474 | (1) |
|
|
|
475 | (1) |
|
|
|
475 | (2) |
|
|
|
477 | (16) |
|
|
|
|
|
|
The Impact of Money-Free Computer Assisted Barter Systems |
|
|
479 | (1) |
|
|
|
|
|
|
|
|
479 | (1) |
|
Money Versus Barter as a Mechanism for Exchanging Our Current Goods and Services |
|
|
480 | (4) |
|
Money Versus Barter for Future Sales? |
|
|
484 | (2) |
|
What Would Barter Mean for Foreign Trade? |
|
|
486 | (1) |
|
Are CABS a Dream or Are They Current Technology? |
|
|
487 | (1) |
|
Turning Theory into Practice |
|
|
488 | (2) |
|
What Would Be the Net Effect of the Use of CABS? |
|
|
490 | (1) |
|
Can a Materialistic, ``Rational'', System Be Humane? |
|
|
490 | (1) |
|
CABS and the Moral Illnesses in the Bishop's Report |
|
|
491 | (2) |
|
|
|
493 | (26) |
|
|
|
|
|
|
Software Aspects of Strategic Defense Systems |
|
|
497 | (1) |
|
|
|
|
|
|
|
|
497 | (1) |
|
|
|
497 | (2) |
|
Why Software Is Unreliable |
|
|
499 | (2) |
|
Why the SDI Software System Will Be Untrustworthy |
|
|
501 | (3) |
|
Why Conventional Software Development Does Not Produce Reliable Programs |
|
|
504 | (2) |
|
The Limits of Software Engineering Methods |
|
|
506 | (4) |
|
Artificial Intelligence and the Strategic Defense Initative |
|
|
510 | (2) |
|
Can Automatic Programming Solve the SDI Software Problem? |
|
|
512 | (2) |
|
Can Program Verification Make the SDI Software Reliable? |
|
|
514 | (2) |
|
Is SDIO an Efficient Way to Fund Worthwhile Research? |
|
|
516 | (3) |
|
SDI: A Violation of Professional Responsibility |
|
|
519 | (14) |
|
|
|
|
|
|
|
|
519 | (1) |
|
|
|
520 | (2) |
|
|
|
522 | (1) |
|
|
|
523 | (1) |
|
|
|
524 | (4) |
|
|
|
528 | (5) |
|
|
|
533 | (16) |
|
|
|
|
|
|
The Professional Responsibilities of Software Engineers |
|
|
537 | (1) |
|
|
|
|
|
|
|
|
537 | (1) |
|
Personal Responsibility, Social Responsibility, and Professional Responsibility |
|
|
537 | (1) |
|
The Social Responsibility of Scientists and Engineers |
|
|
538 | (2) |
|
The Professional Responsibilities of Engineers |
|
|
540 | (2) |
|
What Are the Obligations of the Engineer? |
|
|
542 | (1) |
|
Professional Practice in Software Development |
|
|
543 | (1) |
|
A Simple Example, Pacemakers |
|
|
543 | (2) |
|
|
|
545 | (1) |
|
The ``Know How'' Isn't There |
|
|
546 | (1) |
|
How to Improve the Level of Professionalism in Software Development |
|
|
546 | (3) |
|
|
|
549 | (20) |
|
|
|
|
|
|
|
|
551 | (1) |
|
|
|
|
|
|
|
|
551 | (1) |
|
|
|
551 | (1) |
|
The Causes of Software Aging |
|
|
552 | (1) |
|
|
|
553 | (1) |
|
The Costs of Software Aging |
|
|
553 | (1) |
|
Reducing the Costs of Software Aging |
|
|
554 | (1) |
|
|
|
555 | (4) |
|
|
|
559 | (3) |
|
|
|
562 | (1) |
|
|
|
563 | (2) |
|
Conclusions for Our Profession |
|
|
565 | (4) |
|
|
|
569 | (8) |
|
|
|
|
|
|
On ICSE's ``Most Influential'' Papers |
|
|
571 | (1) |
|
|
|
|
|
|
|
|
571 | (1) |
|
What Are the Best Papers of Our Most Important Software Engineering Conference? |
|
|
571 | (1) |
|
We Must Be Doing Something(s) Wrong! |
|
|
572 | (3) |
|
We Need to Change Something |
|
|
575 | (1) |
|
|
|
576 | (1) |
|
|
|
577 | (16) |
|
|
|
|
|
|
Teaching Programming as Engineering |
|
|
579 | (1) |
|
|
|
|
|
|
|
|
579 | (1) |
|
Programming Courses and Engineering |
|
|
579 | (1) |
|
The Important Characteristics of Programming Courses |
|
|
580 | (1) |
|
The Role of Mathematics in Engineering |
|
|
581 | (1) |
|
The Role of Programming in Engineering, Business, and Science |
|
|
581 | (1) |
|
The Content of Most ``Standard'' Programming Courses |
|
|
582 | (1) |
|
Programming Courses Are Not Science Courses |
|
|
582 | (2) |
|
A New Approach to Teaching Programming |
|
|
584 | (1) |
|
The Mathematics Needed for Professional Programming |
|
|
584 | (3) |
|
Teaching Programming with This Mathematical Background |
|
|
587 | (3) |
|
|
|
590 | (1) |
|
|
|
591 | (2) |
|
|
|
593 | (4) |
|
|
|
|
|
|
Software Engineering: An Unconsummated Marriage |
|
|
595 | (1) |
|
|
|
|
|
|
Software Engineering Education |
|
|
595 | (2) |
|
|
|
597 | (10) |
|
|
|
|
|
|
Who Taught Me About Software Engineering Research? |
|
|
599 | (1) |
|
|
|
|
|
|
|
|
599 | (1) |
|
|
|
599 | (2) |
|
|
|
601 | (1) |
|
|
|
602 | (1) |
|
|
|
603 | (2) |
|
|
|
605 | (2) |
| PART V BIBLIOGRAPHY |
|
607 | (2) |
| Bibliography |
|
609 | (16) |
| Biographics |
|
625 | (6) |
| Credits |
|
631 | (4) |
| Index |
|
635 | |