Experiences in Translating Z Designs to Haskell Implementations

Concrete s? P enrolled s? P ran (testlist ˆ nottested) ((testlist9 = testlist e {s?} ` nottested9 = nottested) ~ enrolled9 = enrolled\{s?} (testlist9 = testlist ` nottested 9 = nottested e {s?})) ((s? P tested ` tested9 = tested\{s?} ((s9 P ran testlist ` testlist9 = testlist e {s?} ` r! = cert) ` r! = cert) ~ (s? P/ tested ` tested9 = tested ~ (s? P/ ran testlist ` testlist9 = testlist ` r! = nocert)) ` r! = nocert)) of the Leave operation, Table I illustrates each of its predicates on both the abstract state Class and the concrete state ConClass. Schema CNotEnrolled appears below without explanation since its derivation is straightforward. To obtain predicates on the concrete state ConClass, one can perform a natural translation using schema ForSim from the previous section. This approach works well for the first and third predicates in the abstract column, but the second predicate translates as (ran (testlist ˆ nottested))9 = (ran (testlist ˆ nottested)) \ {s?} The left-hand side of this predicate needs to be in terms of testlist9 and nottested9, and the right-hand side can be expressed more clearly. Referring to schema ConClass, observe that a student is either a value of sequence testlist or sequence nottested, but not both. Therefore, the disjunction of two predicates represents a concrete equivalent of predicate enrolled9 = enrolled \ {s?}. If a student completed the exercises, then he or she must be removed from testlist; otherwise, the student is deleted from nottested. The Z operator e, range subtraction, specifies student removal from the appropriate set.