</pre><p>If we go back and look at our model window we can see that our Tabular Expression block has updated based on our specified inputs and outputs.</p><p><imgvspace="5"hspace="5"src="walk5.png"alt=""></p><h2>Proving a Table<aname="6"></a></h2><p>Let us assume that a table designer has specified the following function table:</p><p><imgvspace="5"hspace="5"src="walk6.png"alt=""></p><p>In order for a tabular expression to be considered "proper" it must satisfy a <b>Completness</b> and <b>Disjointness</b> condition</p><div><ul><li>Completness means that in the specification of a function we have considered all possible inputs in a condition cell.</li><li>Disjointness means that in the specification of a function all condition cells in a grid are pairwise disjoint, in other words for all possible inputs it is not the case that two conditions are true at the same time.</li></ul></div><p>We desire these properties to ensure that our function is total and is deterministic. A function that is not total or not deterministic can have undesired effects, potentially causing safety critical problems depending on the requirements of the software. The graphical layout of a table helps the designer to evaluate a table for these conditions. Some times it is a non-trivial problem to determine if these conditions have been meet, so we employ the use of a theorem proving software to mechanically prove the properties.</p><p>Consider our example table, the designer of this table has failed to consider the case when x is equal to 1, the completness condition is not satisfied. Clicking on the PVS button will start the proof and popup a process dialog as shown below:</p><p><imgvspace="5"hspace="5"src="walk7.png"alt=""></p><p>If the proof fails it will pop up a dialog giving the user some feedback of why the proof failed as seen in the next image.</p><p><imgvspace="5"hspace="5"src="walk8.png"alt=""></p><p>The Typecheck summary window will display the formula for which a proof was not found. If a proof fails PVS attempts to find a counter example. In this senario pvs has found that a counter example to the formula is x = 1. When a counter example is found the tool will give visual feedback on which conditions were true and which were false for that counter example. A condition coloured red indicates that the condition was false for the given counter example, a green colour indicates that a condition is true. For this example we can see that both possible conditions are false for the counter example indicating to the table designer that they failed to consider a case of the input.</p><p><imgvspace="5"hspace="5"src="walk9.png"alt=""></p><p>In the example above, the designer of the table has captured the case where x = 0 in both conditions of the table. The tool has highlighted both cells green to indicate to the user that for the counter example of x = 0 both of these conditions are true.</p><pclass="footer"><br>
</pre><p>If we go back and look at our model window we can see that our Tabular Expression block has updated based on our specified inputs and outputs.</p><p><imgvspace="5"hspace="5"src="walk5.png"alt=""></p><h2>Proving a Table<aname="6"></a></h2><p>Let us assume that a table designer has specified the following function table:</p><p><imgvspace="5"hspace="5"src="walk6.png"alt=""></p><p>In order for a tabular expression to be considered "proper" it must satisfy a <b>Completness</b> and <b>Disjointness</b> condition</p><div><ul><li>Completness means that in the specification of a function we have considered all possible inputs in a condition cell.</li><li>Disjointness means that in the specification of a function all condition cells in a grid are pairwise disjoint, in other words for all possible inputs it is not the case that two conditions are true at the same time.</li></ul></div><p>We desire these properties to ensure that our function is total and is deterministic. A function that is not total or not deterministic can have undesired effects, potentially causing safety critical problems depending on the requirements of the software. The graphical layout of a table helps the designer to evaluate a table for these conditions. Some times it is a non-trivial problem to determine if these conditions have been meet, so we employ the use of a theorem proving software to mechanically prove the properties.</p><p>Consider our example table, the designer of this table has failed to consider the case when x is equal to 1, the completness condition is not satisfied. Clicking on the PVS button will start the proof and popup a process dialog as shown below:</p><p><imgvspace="5"hspace="5"src="walk7.png"alt=""></p><p>If the proof fails it will pop up a dialog giving the user some feedback of why the proof failed as seen in the next image.</p><p><imgvspace="5"hspace="5"src="walk8.png"alt=""></p><p>The Typecheck summary window will display the formula for which a proof was not found. If a proof fails PVS attempts to find a counter example. In this senario pvs has found that a counter example to the formula is x = 1. When a counter example is found the tool will give visual feedback on which conditions were true and which were false for that counter example. A condition coloured red indicates that the condition was false for the given counter example, a green colour indicates that a condition is true. For this example we can see that both possible conditions are false for the counter example indicating to the table designer that they failed to consider a case of the input.</p><p><imgvspace="5"hspace="5"src="walk9.png"alt=""></p><p>In the example above, the designer of the table has captured the case where x = 0 in both conditions of the table. The tool has highlighted both cells green to indicate to the user that for the counter example of x = 0 both of these conditions are true, the designer has failed to unambiguosly specify what should happen in this senario.</p><pclass="footer"><br>
Published with MATLAB® 7.10<br></p></div><!--
##### SOURCE BEGIN #####
%% Product Overview
@@ -213,7 +213,9 @@ end
% In the example above, the designer of the table has captured the case
% where x = 0 in both conditions of the table. The tool has highlighted
% both cells green to indicate to the user that for the counter example of
% x = 0 both of these conditions are true.
% x = 0 both of these conditions are true, the designer has failed to
% unambiguosly specify what should happen in this senario.