A Case Study in Representing a Model: to Z or not to Z?

As part of the Domino project on distributed system management, a model of 'Delegation of Authority' was created. A formal description method was used as the basis of the model in order to achieve precision and generality. Z was chosen for this purpose, supplemented by Prolog to animate the specification so that it could be validated with examples. It was found that other representation methods were necessary for visualising the model and for meaningful communication in discussions between colleagues. Three different methods were used for discussions: plain English, an ad hoc graphical method for representing domain structures and Petri net diagrams. In this paper we discuss the roles of each method of representation, its uses and limitations, and their interrelationship. Formal interpretations in Z of the graphical methods are shown. 1. INTRODUCTION This paper reviews the representation methods used in an abstract model of 'Delegation of Authority'. It aims to show how Z fitted into this scheme, and the limitations which made other methods also essential. As part of the IED/SERC Domino project 1 on distributed system management, a model of 'Delegation of Authority' was created. The informal requirements for it were derived from our experience of commercial systems. We aimed to model a framework and policies at least as complex as would be met in real commercial conditions. The subject was one which was well suited to a formal approach, because of the need for precision and the desire to take a more abstract approach than could be achieved by use of a conventional programming language. Z was chosen, as a well-established formal method which met our needs; its set-oriented style matched our approach, and we had no need to use either concurrency or modal logic concepts,which it does not provide.