checklist-tester/formal/checklist.vdmsl

module Checklist
exports all
definitions

values
    -- Before Start Checklist
    -- Items in Aircraft
    -- Flight Deck... (can't check)
    fuel: ItemObject = mk_ItemObject(<SWITCH>, mk_Switch(<OFF>, false));
    pax_sign: ItemObject = mk_ItemObject(<SWITCH>, mk_Switch(<OFF>, true));
    windows: ItemObject = mk_ItemObject(<SWITCH>, mk_Switch(<ON>, false));
    -- Preflight steps
    acol: ItemObject = mk_ItemObject(<SWITCH>, mk_Switch(<OFF>, false));

    aircraft_panels: Items = {"Fuel Pump" |-> fuel, "Passenger Signs" |-> pax_sign, "Windows" |-> windows, "Anti Collision Lights" |-> acol};

    -- Checklist
    -- Flight Deck... (can't check)
    fuel_chkl: ChecklistItem = mk_ChecklistItem("Fuel Pump", <SWITCH>, <ON>, false);
    pax_sign_chkl: ChecklistItem = mk_ChecklistItem("Passenger Signs", <SWITCH>, <ON>, false);
    windows_chkl: ChecklistItem = mk_ChecklistItem("Windows", <SWITCH>, <ON>, false);
    -- Preflight steps
    acol_chkl: ChecklistItem = mk_ChecklistItem("Anti Collision Lights", <SWITCH>, <ON>, false);

    before_start_procedure: Procedure = [fuel_chkl, pax_sign_chkl, windows_chkl, acol_chkl];

    aircraft = mk_Aircraft(aircraft_panels, {"Before Start" |-> before_start_procedure});
types
    String = seq of char;

    -- Aircraft

    -- Switches
    --@doc The state a switch can be in
    -- 1 means off
    SwitchState = <OFF> | <MIDDLE> | <ON>;

    ItemState = SwitchState;

    --@doc A switch, with the possible states it can be in, and the state that it is in
    Switch :: 
                position : SwitchState
                middlePosition : bool
                inv s == 
                    if s.middlePosition = false then 
                        s.position <> <MIDDLE>
                    else true;

    -- Knob
    Knob :: 
            position : nat1
            states : seq of int
            inv k == k.position <= len k.states;

    Lever = nat
        inv t == t <= 100;

    Throttle :: 
                thrust: Lever
                reverser: Lever
                inv t ==
                    if t.thrust > 0 then
                        t.reverser = 0
                    else 
                        t.reverser >= 0;

    --@doc The type that the action of the button is
    ItemType = <SWITCH> | <KNOB> | <BUTTON> | <THROTTLE>;

    --@doc The unique switch/knob/etc of that aircraft
    ItemObject ::
        type : ItemType
        object : Switch | Knob | Throttle
        inv i ==
            let type = i.type, object = i.object in
                (type = <SWITCH> and is_Switch(object))
                or (type = <KNOB> and is_Knob(object))
                or (type = <THROTTLE> and is_Throttle(object));
                --TODO add check for button

    --@doc Contains each ItemObject in the Aircraft, e.g. Fuel Pump switch
    Items = map String to ItemObject;

    --@doc Contains the panels (all the items in the aircraft) and the checklist
    Aircraft ::
        items : Items
        checklist : Checklist;

    -- Checklist

    --@doc Item of a checklist, e.g. Landing gear down
    ChecklistItem ::
                    procedure : String
                    type : ItemType
                    --TODO Check is not only SwitchState
                    check : SwitchState
                    checked : bool;

    --@doc A section of a checklist, e.g. Landing Checklist
    Procedure = seq of ChecklistItem
        inv p == 
            len p > 0 and
            false not in set { 
                let first = p(x-1).checked, second = p(x).checked in 
                    (first = second) or ((first = true) and (second = false))
                | x in set {2,...,len p}};
    
    --@doc Full checklist, e.g. Startup, Descent, Landing Checklist
    Checklist = map String to Procedure;

functions
    -- PROCEDURES
    --@doc Finds the index of the next item in the procedure that needs to be completed
    procedure_next_index: Procedure -> nat1
    procedure_next_index(p) ==
        hd [ x | x in set {1,...,len p} & p(x).checked = false]
    pre
        -- Checks procedure has not already been completed
        procedure_completed(p) = false
    post
        -- Checks that the index of the item is the next one to be completed
        p(RESULT).checked = false
        and if RESULT > 1 then 
            p(RESULT-1).checked = true
        else 
            true;

    --@doc Checks if the procedure has been completed
    procedure_completed: Procedure -> bool
    procedure_completed(p) ==
        false not in set { p(x).checked | x in set {1,...,len p} };

    --@doc Checks if the next item in the procedure has been completed
    check_proc_item_complete: Procedure * Aircraft -> bool
    check_proc_item_complete(p, a) ==
        let procItem = p(procedure_next_index(p)),
            item = a.items(procItem.procedure) in
            
            --TODO need to be able to check for different types of Items
            procItem.check = item.object.position
    pre
        procedure_completed(p) = false;

    --@doc Marks next item in procedure as complete
    mark_proc_item_complete: Procedure -> Procedure
    mark_proc_item_complete(p) ==
        let i = procedure_next_index(p), item = p(i) in
            p ++ {i |-> complete_item(item)}
        pre
            procedure_completed(p) = false;

    --@doc Completes an Item in the procedure on the Aircraft
    do_proc_item: ChecklistItem * Aircraft -> Aircraft
    do_proc_item(p, a) ==
        let itemName = p.procedure, item = a.items(p.procedure), objective = p.check in
            -- Checks if the item is in the objective desired by the checklist
            if check_item_in_position(item, objective) then
                a
            else
                mk_Aircraft(a.items ++ {itemName |-> move_item(a.items(itemName), objective)}, a.checklist)
    pre
        p.checked = false;

    --@doc Completes a procedure step by step
    complete_procedure: String * Aircraft -> Aircraft
    complete_procedure(p, a) ==
        is not yet specified;

    -- AIRCRAFT ITEMS
    --@doc Marks ChecklistItem as complete
    complete_item: ChecklistItem -> ChecklistItem
    complete_item(i) ==
        mk_ChecklistItem(i.procedure, i.type, i.check, true)
    pre
        i.checked = false;

    --@doc Moves any type of Item
    move_item: ItemObject * ItemState -> ItemObject
    move_item(i, s) ==
        -- if is_Switch(i) then (implement later)
            let switch: Switch = i.object in
                if check_switch_onoff(switch) and (s <> <MIDDLE>) then
                    mk_ItemObject(i.type, move_switch(move_switch(switch, <MIDDLE>), s))
                else
                    mk_ItemObject(i.type, move_switch(switch, s))
    pre
        wf_item_itemstate(i, s)
        and not check_item_in_position(i, s)
        and (wf_switch_move(i.object, s));

    --@doc Moves a specific switch in the aircraft
    move_switch: Switch * SwitchState -> Switch
    move_switch(i, s) ==
        mk_Switch(s, i.middlePosition)
    pre
        wf_switch_move(i, s)       
    post
        RESULT.position = s;

    --@doc Checks if the switch is in the on or off position
    check_switch_onoff: Switch -> bool
    check_switch_onoff(s) ==
        let position = s.position in
            position = <OFF> or position = <ON>
    post
        -- Only one can be true at a time
        -- If the switch is in the middle position, then RESULT cannot be true
        -- If the switch is in the on/off position, then the RESULT will be true 
        (s.position = <MIDDLE>) <> RESULT;

    --@doc Checks if the item is already in position for the desired state for that item
    check_item_in_position: ItemObject * ItemState -> bool
    check_item_in_position(i, s) ==
        -- if is_Switch(i) then (implement later)
            i.object.position = s
    pre
        wf_item_itemstate(i,s);

    --@doc Checks if the Item.object is the same type for the ItemState
    wf_item_itemstate: ItemObject * ItemState -> bool
    wf_item_itemstate(i, s) ==
        (is_Switch(i.object) and is_SwitchState(s) and i.type = <SWITCH>)
        --TODO check that the item has not already been completed before moving item
        --TODO add other types of Items
        ;

    --@doc Checks if the move of the Switch is a valid
    wf_switch_move: Switch * SwitchState -> bool
    wf_switch_move(i, s) ==
        -- Checks that the switch not already in the desired state
        i.position <> s and
        -- The switch has to move one at a time
        -- Reasoning for this is that some switches cannot be moved in one quick move
        if i.middlePosition = true then
            -- Checks moving the switch away from the middle position
            (i.position = <MIDDLE> and s <> <MIDDLE>)
            -- Checks moving the siwtch to the middle position
            <> (check_switch_onoff(i) = true and s = <MIDDLE>)
        else
            check_switch_onoff(i) and s <> <MIDDLE>;


end Checklist