► To cite this version:

Dines Bjørner, Christian Gram, Ole N. Oest, Leif Rystrøm. Dansk Datamatik Center. 3rd History of Nordic Computing (HiNC), Oct 2010, Stockholm, Sweden. pp.350-359, 10.1007/978-3-642-23315-9_39. hal-01564662

HAL Id: hal-01564662

https://inria.hal.science/hal-01564662

Submitted on 19 Jul 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
Dansk Datamatik Center

Dines Bjørner<fnref n="1" />, Christian Gram², Ole N. Oest³, and Leif Rystrøm⁴

¹DTU, Denmark
bjorner@gmail.com

²DTU, Denmark
chr.gram@ddf.dk

³DDC-I Inc., Phoenix, Arizona 85020, USA
ooest@attglobal.net

⁴Danish Road Directorate, Copenhagen, Denmark
rystroem@mail.dk

**Abstract.** In 1979, a software research and development center was created to demonstrate the power of systematic and formal methods in software development. One of the first and biggest projects at Dansk Datamatik Center (DDC) was to develop an Ada compiler and run-time system. DDC made the first department of Defense (DoD) validated Ada compiler in Europe, and the Ada project was carried on in a subsidiary called DDC-I, Inc. This paper describes the background and start of DDC and some aspects of the formal development method called "Rigorous Approach to Industrial Software Engineering" (RAISE) as well as other DDC activities.

**Keywords:** Formal methods, software development, technology transfer

# 1 A History of DDC

The idea of Dansk Datamatik Center (DDC) was first aired by Christian Gram of the Department of Computer Science at the Technical University of Denmark (DTU) and discussed with his colleague Dines Bjørner during the spring of 1979. Software development in business, administration, and industry was then still very unsatisfactory. Already in 1968, the NATO Science Committee arranged a conference on software engineering [1] on "a problem crucial to the use of computers, viz. the so-called software, or program, developed to control their action." Many projects were late, more expensive than estimated, and full of errors. "The phrase 'software engineering' was deliberately chosen as being provocative, in implying the need for software manufacture to be based on the types of theoretical foundations and practical disciplines, that are traditional in

<footnote n="1">¹ The DDC 'cube' was designed by Danish Design award winning Ole Friis.</footnote>
the established branches of engineering.” Even after a second conference on the same problem area, problems with software development in practice continued. We felt in 1979 that computer scientists had developed foundations and theories that – if properly implemented – could make programming a more professional, engineer-like profession and allow developing large, reliable programs on schedule.

We contacted ATV, the Danish Academy for Technical Sciences, an umbrella organization for a significant number of ‘Science-Engineering-Technology’ institutes working to help industry applying the newest technologies in their field. ATV responded positively, and ten of the largest users and/or producers of IT in Denmark agreed to become members of the institute, each paying 100,000 DKK per year. DDC was created in September 1979 as an ATV society for advanced software development. The members of DDC were Christian Rovsing A/S, Crone & Koch edb, Danish Defense Research Establishment, Datacentralen af 1959, Jydsk Telefon A/S, Kommunedata, Regnecentralen af 1979 (RC), Sparekassernes Datacenter (SDC), Teleteknisk Forskningslaboratorium (TFL) and ØK Data. An attempt to make Danish financial institutes interested in DDC failed.

Most projects used formal specification methods – VDM, the Vienna Development Method [3, 4] developed at IBM, and later RAISE, Rigorous Approach to Industrial Software Engineering [5], a method co-developed at DDC.

A main goal was to act as a link between Danish IT companies and Danish/European IT research; in order to make DDC capable of using the most advanced software design and development tools.

DDC had very little cooperation with the IT research in Nordic countries. We felt that there was not the same interest for and emphasis on the use of formal methods for software development. Because Denmark was a member of EU (and the only Nordic member at that time), it was natural for us to seek partners and financial support among EU members. However, from 1984 we cooperated with the Swedish Försvarets Materielverk on the Ada project, and later with Ericsson and Bofors.

The Ada compiler project was so successful that a separate company, DDC International A/S, was created in 1985 to market, sell, and further develop the Ada system. DDC International later created the limited company, DDC-I Inc., which is still in the market, and the Ada system and other systems developed at DDC-I were sold in USA, China, and other countries. Some years ago, the headquarters moved to Arizona, USA.

Over the years, some of the original member companies lost interest in DDC and its services and it became difficult to find funding for the kind of projects, DDC wanted to further. After almost ten years, it was decided to close down DDC, but some larger projects were carried on under new hats. The development of Ada systems continued in DDC-I. The RAISE project and the people working on it were transferred to the Danish software house CRI Inc. (CRI) that completed the project and used it as a base for the Large-scale Correct Systems (LaCoS) project using formal methods.
## 2 The Use of Formal Techniques at DDC

Both the CHILL and the Ada compilers were developed roughly as follows. The static and dynamic semantics of the languages were described in denotational form. Then, in several stages of refinement, they systematically developed more and more concrete prescriptions, covering both static and dynamic semantics for sequential and parallel language features [6]. These prescriptions (in the VDM language) included the expression of a number of “standard” compiler requirements for microprocessor-based compilation as well as execution platforms. From the concrete requirements prescriptions multi-pass compilation administrators were developed and subsequently, the *N* passes of the compiler were coded (for Ada *N* was 9) [4, 7].

In both projects, the VDM approach was one of systematic development: Formal specifications of all phases, stages and steps; however, it used no formal proof of correctness. See Section 3.2 for more details.

## 3 DDC Activities 1979–89

The thirty to thirty-five member professional staff worked with *advanced software development projects* (the CHILL and Ada compilers), *research* (the CHILL and Ada formal definitions), *explorative studies* (formal methods appraisal, office automation), and *other activities* (seminars, courses, and other dissemination).

### 3.1 The CHILL Projects

#### The Formal Definition of CHILL

In 1978, Prof. A. Kjerbye Nielsen, director of TFL, asked Dines Bjørner to follow the development of the CHILL programming language by an international group of the C.C.I.T.T.<fnref n="2" /> (today ITU<fnref n="3" />). It was the intention to attempt a formal description of CHILL. Through the work of Dines Bjørner, his colleague, Hans Bruun, and some master students' formal descriptions were researched and experimentally developed at DTU. Once DDC was established, that work was completed at DDC [8, 9].

The benefit of making formal descriptions may be illustrated by the following. Hans Bruun found – during his painstaking analysis and in discussions with members of the C.C.I.T.T. group – a tiny identifier scope issue that, if simply removed, would shorten the definition by some 20 percent. The group ended up nullifying that scope issue – significantly simplifying any CHILL compiler.

#### The CHILL Compiler Development

<footnote n="2">² Comité Consultatif International Téléphonique et Télégraphique.</footnote>

<footnote n="3">³ International Telecommunication Union.</footnote>
In 1979, before the formation of DDC, work started on the development of a compiler for the full CHILL language (CCITT High Level Language). Peter Haff and Søren Prehn did the work, funded partially by TFL. The CHILL compiler was for the full CHILL programming language – including, for example, its three “independent” sets of parallel programming constructs. When completed, the compiler became public property by TFL and DDC and it played a significant role in the teaching of CHILL worldwide [9].

## 3.2 The Ada Projects

### The Ada Compiler Project

*The Danish/Italian Collaboration and the Initial Contract*

The Ada programming language had been designed on behalf of the U.S. Department of Defense as a new cure-it-all standard programming language targeting development of embedded software. At the time more than two hundred languages were in use within the U.S. DoD and significant savings would be possible if this number could be reduced to just one, Ada.

The Commission of the European Communities (CEC) had set aside significant funding for the development of a European Ada compiler system because the CEC thought that similar savings might be possible within European software development. A French/German consortium was slated to receive the funding for this European Ada Compiler System.

Shortly before the call for proposal ended, DDC formed a consortium with Olivetti (Italy) and Christian Rovsing (CR) (Denmark) and in record time developed a bid for the funding.

Several months of hectic technical evaluations of the DDC/Olivetti/CR proposal followed. It was very inconvenient for certain people in the CEC, that this Danish/Italian consortium competed for money intended for the French/German consortium. Each time we went to Brussels for another technical evaluation, the experts found some 'show-stoppers' not discussed at the previous meeting. Nevertheless, in early 1981, it ended up with a contract where 50 percent funding came from the CEC and 50 percent from Danish sources. DDC's part of the project was to develop a portable Ada compiler for small computers.

Some years later, after the Ada standard finalized, DDC won a contract for developing a formal specification of the language. We considered that a significant acknowledgment of VDM and of DDC's high technical level.

*Technical Approach*

The driving method behind the development of the DDC Ada Compiler System was the Vienna Development Method (VDM) [3, 4] and the demonstration of the viability of using VDM was initially perhaps considered more important to DDC and its members than the end-product itself.

In 1980, a team of master's students from DTU had developed a formal definition of Ada and of the underlying execution model [10]. This specification
became the foundation for the actual compiler development. The compiler was
developed as a number of refinements of this specification.

It was a requirement on the Danish/Italian consortium that the Ada compiler
should be suitable for mini computers with limited memory resources. It was
therefore designed as a multi-pass compiler, and the systematic development of
the Ada compiler was basically refined into buckets, where each bucket would
correspond to a compiler pass.

Even though the Ada language and the host computer platform underwent
changes in this period, the project became a success and resulted in a
commercial viable product. The DDC team even managed to achieve formal
U.S. DoD approval (validation) of the compiler ahead of the French/German
project [11, 12].

The project – part of which was research-oriented – exceeded the original
budget by less than 20 percent, but it was on time, which was significantly better
than most software projects.

The First Commercial Sales

DDC presented the DDC Ada compiler project and the use of VDM at several
conferences [11, 12]. These presentations showed not only the high level of
correctness of the compiler but also provided productivity numbers which showed
that VDM was a cost-effective development method even when used without
the support of computerized tools which only became available much later [5,
13].

Those technical presentations persuaded Nokia to license the DDC compiler
technology for developing an Ada compiler for a proprietary minicomputer.
Without any sales and marketing organization, DDC made its first commercial
sale of what became known as the DDC OEM Compiler Kit.

Honeywell heard through Nokia of the DDC technology. Honeywell had two
projects needing an Ada compiler, a mini computer and a mainframe system.
They talked with the French/German consortium but ended up placing both
orders with DDC. Significant sales were also made to the COSTIND, China and
NEC, Japan.

The Formation of DDC International (DDC-I)

Several other OEM contracts followed. In 1985, DDC created a subsidiary,
DDC-I, to commercialize the DDC Ada Compiler System. The system became an
important part of many projects (aircrafts like Boeing 777, MD-80 and MD-90,
satellites, and various military programs) and in 2010, it is still generating revenue
for DDC-I.

Commercializing the other outcome of the project, the successful use of VDM,
turned out to be much more troublesome. The industry was not ready to adopt
formal methods until some twenty years later, where formal methods had become
mandatory in validation of, for example, the Multiple Independent Levels of
Security (MILS) operating systems.

The Formal Definition of Ada

During the early 1980s, a lively discussion forum supported by CEC resulted in
the CEC supporting the R&D of a formal definition of Ada. A group was formed, again anchored in Denmark (DDC) and again with Italian partners at the universities in Pisa and in Genoa, Istituto di Elaborazione della Informazione (IEI) and CRAI, respectively. The Ada formal definition project (1984–87) was truly a research project. It was not known from the outset how the result would look [14–18] such as which specific abstraction and modeling techniques to deploy or which abstractions to use. During the project a number of exciting research problems were solved and many scientific papers were published.

## 3.3 The RAISE Project

The RAISE project had two parts: a precursor project, FMA, and a main project called the RAISE development project.

### The Formal Methods Appraisal Project

During the developments of the CHILL and Ada compilers the need for a revision of VDM was identified. Other formal techniques to software development and especially additional formal specification constructs were introduced in the late 1970s and the early 1980s. In 1983, DDC obtained funds for a formal methods appraisal (FMA) study [19, 20]. It ended with a number of requirements that formal specification languages should satisfy when applied to problems involving distributed, real-time and concurrent systems.

### The RAISE Development

We make a distinction between the RAISE project and the RAISE product.

#### The RAISE Project

After the FMA project, a Danish/British consortium was formed and eventually DDC, ABB (Asea Brown Bovery, DK), ICL (UK) and STL (UK), obtained a contract with the CEC for researching and developing a successor to VDM. Thus, RAISE was initially developed under that contract, from 1985 to 1990, with the aim of providing a unifying improvement over formal methods such as VDM, Z, CSP, Larch, and OBJ. From 1990 to 1995, RAISE further developed (after DDC) in the Large-scale Correct Systems (LaCoS) project using formal methods.

RAISE stands for Rigorous Approach to Industrial Software Engineering and it introduces the use of formal (mathematical) techniques in the development of software; that is, in requirements analysis and formulation, specification, design, and development.

#### The RAISE Product

There are three facets to the RAISE product. (i) The RAISE Specification Language (RSL) which provides a rich, mathematically based notation in which requirements, specifications and steps of design of software may be formulated and reasoned about. RSL is a wide-spectrum language since it facilitates abstract, axiomatic styles of description as well as concrete, operational styles.
It may be used from initial domain and requirements analysis through design to a level at which the specification may be translated into code. (ii) The RAISE method provides a set of techniques and recommendations for ways to use RSL in the various life-cycle phases of software development as well as techniques for verifying properties of specifications, implementations, and their relationships, formally, rigorously or informally. (iii) The RAISE Tool Set, which supports the use of RSL and the RAISE method.

RAISE comes with comprehensive documentation. Books on the language RSL [13] and the method [5] are provided, and further information is available on internet [21–24].

## 3.4 Office Automation Projects

DDC concluded several office automation projects during its existence. In 1981, a study was performed describing office automation systems. An office automation system was understood as a computer-based system assisting the office staff in their daily tasks. At the time, there was a growing amount of literature and commercial products concerning office automation. The two main purposes of the project were:

* to contribute to the understanding of the office automation area by establishing a taxonomy and a terminology for the area;

* to contribute to the further development of the area by specifying a generic office automation system (a system with special features for adaption to the tasks and working methods of a specific office).

The project also helped technology transfer, as persons from DDC together with persons from DDC members carried out the project.

In the taxonomy part of the project [25], the concepts of the office automation area were identified, analyzed, and classified. In the terminology part general terms, concepts and abbreviations used within office automation were explained and listed alphabetically. More than seventy items were explained.

To overcome the problems with a general office automation system: not fulfilling the requirements of a specific office, tailored system; being expensive to update as the needs of an office changes – a generic office automation system was specified and characterized. The generic office automation system was modeled using the VDM formal specification language. The model was also described informally and could thus be used by persons without knowledge of the VDM language.

Another office automation project was FAOR, Functional Analysis of Office Requirements. The project was supported by the CEC. Organizations from UK, Germany and Denmark participated in the project from 1983 to 1987. The Danish participant was a DDC member, ØK Data with DDC as subcontractor.

The purpose of the project was to develop a method that could help systems analysts to analyze and specify the office automation requirements to IT-systems. The work processes in an office for which IT-support was needed in the 1980s became more and more complex and were often unstructured. The FAOR project addressed this challenge of analyzing the complex office work and
specifying functional requirements to IT-solutions. The method gives the analyst detailed instructions for the analysis and refers to a set of techniques and tools to use. The method was tried in field studies within the FAOR project with good results. The project is described in [26].

## 3.5 Technology Transfer

### Cubus

In 1987, DDC expanded its technology transfer activities, bringing its knowhow out to Danish IT companies, by introducing a quarterly magazine Cubus.<fnref n="4" />

The main content in Cubus was technical and scientific articles. They covered subjects in which DDC had deep insight from actual project work. The articles were mainly addressed to an IT-knowledgeable audience, but they did not require special knowledge in the subject covered. Cubus also had articles for a wider audience and overviews/summaries of conferences, and it listed new DDC project reports.

### Seminars and Courses

DDC also arranged seminars and courses covering subjects from DDC projects and topics of general interest, but within the area of software design and development. Examples of seminar subjects included topics such as object-oriented programming, why and how to change Ada, local area data net, and selling Danish software worldwide.

### Reports

The results of DDC projects were largely publicly available through reports prepared during the projects. The reports appeared in the magazine Cubus and they sold for the reproduction costs.

## 4 Appraisal of DDC

In the mid 1980s, some forty people worked at DDC. Half of them had a master's degree in computing. The two large compiler projects Ada and CHILL lead to usable and useful products. However, in the longrun it was difficult to derive advantage and profit from these products. Ada did not gain the expected widespread use despite its U.S. DoD and CEC support. The knowledge and the rights for the Ada system were transferred to the subsidiary DDC-I Inc., which earned money but not sufficient to give a surplus to DDC. CHILL was developed for Danish teleauthorities as a new standard language for the international telecommunity CCITT, but after completion, CHILL did not generate income for DDC. At the same time, these products had very little interest for several of the DDC members.

A third large project was the RAISE software engineering method. Its scope was too ambitious to be of immediate interest to DDC's members. The project

<footnote n="4">⁴ Please note the DDC 'cube' adorning the beginning of this paper.</footnote>
was transferred to the software company CRI Inc., where it was completed,
used, and marketed with some success.

Besides the above compiler-oriented projects, DDC had a number of smaller
software development projects, including user-friendly software and
administrative database projects.

To assess what benefit DDC achieved for the Danish software milieu is
difficult. However, in our opinion the major effects of DDC were as follows.

o Some of the larger Danish IT users and producers became aware of
modern software development techniques.

o A reliable, DoD-verified Ada system was produced and became the basis
for the incorporated company DDC-I Inc. still existing.

o RAISE and LaCoS – methods and tools for large-scale reliable software
development – were developed and brought to market by CRI Inc.,
which took over leading staff and all project rights from DDC.

o Between fifty and a hundred young master's students in computer science
obtained experience using advanced software technology and they carried
it with them into other companies in Denmark and abroad.

o DDC completed a number of large projects with better performance and
higher product quality than was common in the 1980s.

Where DDC failed was to major Danish companies of the benefits of using
reliable software development based on formal methods. (But, DDC did not try
very much.) However, some of DDC's software engineers went to work for CRI
Inc. (later sold to Terma), where they proceeded using formal methods "lite" in
major European Space Agency and U.S. defense industry projects.

**Acknowledgments.** This is not the time and place for thanking those many people and institutions that made DDC possible. Nevertheless, we do wish to acknowledge the help of Assoc. Prof., Dr. Hans Bruun (emeritus). Without his diligent and painstaking investigations of how to formalize the static semantics of CHILL and Ada, DDC could not have gotten off the ground. In writing this paper, we received help from Messrs Peter L. Haff, Klaus Havelund and Jan Storbank Pedersen, and we acknowledge their help with gratitude.

References

1. Naur, P., Randall, B. (eds.): Software Engineering: The Garmisch Conference. NATO Science Committee, Brussels (1969)

2. Løvengreen, H.H.: Metodikker og værktøjer til konstruktion af programmel (KOMET). Report DDC-05, 229 pp. (February 1981)

3. Bekič, H., Bjørner, D., Henhapl, W., Jones, C.B., Lucas, P.: A Formal Definition of a PL/I Subset. Technical Report 25.139, IBM Laboratory, Vienna (December 1974)

4. Bjørner, D., Jones, C.B. (eds.): The Vienna Development Method: The Meta-Language, vol. 61 of LNCS. Springer (1978)

5. George, C.W., Haxthausen, A.E., Hughes, S., Milne, R., Prehn, S., Storbank Pedersen, J.: The RAISE Development Method. The BCS Practitioner Series.
Prentice-Hall, Hemel Hampstead (1995)

6. Bjørner, D.: Programming Languages: Linguistics and Semantics. In International Computing Symposium 77, pp. 511–536. European ACM, North-Holland Publ. Co., Amsterdam (1977)

7. Bjørner, D., Jones, C.B. (eds.): Formal Specification and Software Development. Prentice-Hall (1982)

8. Haff, P.L. (ed.): The Formal Definition of CHILL. ITU (Intl. Telecomm. Union), Geneva (1981)

9. Haff, P., Olsen, A.V.: Use of VDM within CCITT. In: VDM – A Formal Method at Work, eds. Bjørner, D., Jones, C.B., Micheal Mac an Airchinnigh and Erich J. Neuhold, pp. 324–330. Springer, Lecture Notes in Computer Science, vol. 252, March 1987. Proc. VDM-Europe Symposium 1987, Brussels (1987)

10. Bjørner, D., Oest, O.N. (eds.): Towards a Formal Description of Ada, vol. 98 of LNCS. Springer (1980)

11. Clemmensen, C.B., Oest, O.N.: Formal specification and development of an Ada compiler – a VDM case study. In: Proc. 7th International Conf. on Software Engineering, March 1984, Orlando, Florida, pp. 430–440. IEEE (1984)

12. Oest, O.N.: VDM From Research to Practice. In: Kugler, H.-J. (ed.) Information Processing '86, pp. 527–533. IFIP World Congress Proceedings, North-Holland Publ. Co., Amsterdam (1986)

13. George, C.W., Haff, P., Havelund, K., Haxthausen, A.E., Milne, R., Bendix Nielsen, C., Prehn, S., Ritter Wagner, K.: The RAISE Specification Language. The BCS Practitioner Series. Prentice-Hall, Hemel Hampstead (1992)

14. Reggio, G., Invarardi, P., Astesiano, E., Fantechi, A., Giovani, A., Mazzanti, F., Zucca, E.: The Draft Formal Definition of Ada, The User Manual of the Meta-Language. Technical report, CRAI/IEI/University of Genoa (January 1986)

15. Astesiano, E., Bendix Nielsen, C., Fantechi, A., Giovani, A., Karlsen, E.W., Mazzanti, F., Reggio, G., Zucca, E.: The Draft Formal Definition of Ada, The Dynamic Semantics Definition. Technical report, Dansk Datamatik Center/CRAI/IEI/University of Genoa (January 1987)

16. Botta, N., Storbank Pedersen, J.: The Draft Formal Definition of Ada, The Static Semantics Definition. Technical report, Dansk Datamatik Center (January 1987)

17. Storbank Pedersen, J.: VDM in Three Generations of Ada Formal Descriptions. In: VDM87, VDM – A Formal Method at Work, volume 252 of Lecture Notes in Computer Science. Springer (March 1987)

18. DDC, Univ. of Pisa, CRAI, CNRS IEI Pisa, Univ. of Genoa (ed.): The Draft Formal Definition of Ada. 3 parts. Dansk Datamatik Center (1987)

19. Prehn, S., Hansen, I.Ø., Palm, S.U., Gøbel, P.: Formal methods appraisal, first report. Technical Report DDC 86/1983-06-24, Dansk Datamatik Center, Lyngby (1983)

20. Prehn, S., Hansen, I.Ø.: Formal Methods Appraisal. Technical report, Dansk Datamatik Center (1983)

21. George, C.W.: Download for the RAISE Tool Set. ftp://ftp.iist.unu.edu/pub/RAISE/method book/. United Nations University's International Institute for Software Technology, P.O.Box 3058, Macao SAR, China

22. George, C.W.: UNU-IIST's RAISE Web Pages. http://www.iist.unu.edu/raise/ United Nations University's International Institute for Software Technology, P.O.Box 3058, Macao SAR, China

23. Storbank Pedersen, J.: Information about industrial use of RAISE. http://spd-web.terma.com/Projects/RAISE/project.html. Terma Inc., Herlev, Denmark
24. Storbank Pedersen, J.: Terma Information about the RAISE Tool Set. http://spd-web.terma.com/Projects/RAISE. Terma Inc., Herlev, Denmark

25. Bundgaard, J., Schmeltz Pedersen, J., Storbank Pedersen, J., Hansen, K., Kvorning, P., Nilsson, B.: Kontor-Automations-Systemer (KAS) – Et studieprojekt. DDC document: DDC 04/1981-04-30

26. Schmidt, K.: Kontorarbejde og kontoranalyse. In: Cubus (July 1987)