Difference between pages "Code Generation Tutorial" and "D23 Decomposition"

From Event-B
(Difference between pages)
Jump to navigationJump to search
imported>Andy
 
imported>Pascal
 
Line 1: Line 1:
−
'''This Page is Under Construction!!!!'''
+
= Overview =
 +
The Event-B model decomposition is a new feature in the Rodin platform.
  
−
=== Tutorial Overview ===
+
Two methods have been identified in the DEPLOY project for model decomposition: the ''shared variable'' decomposition (or A-style decomposition, after Abrial), and the ''shared event'' decomposition (or B-style decomposition, after Butler). They both answer to the same requirement, namely the possibility to decompose a model <math>M</math> into several independent sub-models <math>M_1, ...,M_n</math>.
  
−
The aim of the tutorial is to allow users to explore the approach with a relatively simple example. The example uses a shared buffer with reader and writer processes. The tutorial is presented in three stages, making use of the example projects from the download site. There are two translations performed, one is to a common language model (IL1). The second is to an Event-B project which includes a model of the implementation. There is a PrettyPrinter for Ada source code, which uses the common language model. An overview of Tasking Event-B can be found at http://wiki.event-b.org/index.php/Tasking_Event-B_Overview.
+
Academic (ETH Zurich, University of Southampton) and industrial (Systerel) partners were involved in the specifications and developments. Systerel, which could have useful discussions with Jean-Raymond Abrial on the topic, was more especially responsible of the A-style decomposition. The University of Southampton, where Michael Butler is professor, was in charge of the B-style decomposition.
  
−
A typical Event-B development may be refined to the point where it is ready for implementation, but the Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines that are to be implemented (and their seen Contexts) are selected and added to a ''Tasking Development''; the Tasking Development files have the file extension ''.tasking''. The machines in the Tasking Development are then extended with implementation details.
+
= Motivations =
 +
One of the most important feature of the Event-B approach is the possibility to introduce new events and data-refinement of variables during refinement steps.
  
−
The example/tutorial projects are,
+
It however results in an increasing complexity of the refinement process when having to deal with many events, many state variables, and consequently many proof obligations.
 +
This is well illustrated in the ''Event build-up'' slide of the Wright presentation during the Rodin Workshop 2009.
 +
: See [http://wiki.event-b.org/index.php/Image:Steve_Wright_Quite_Big_Model_Presentation.pdf http://wiki.event-b.org/index.php/Image:Steve_Wright_Quite_Big_Model_Presentation.pdf].
  
−
{| border="1"
+
The purpose of the Event-B model decomposition is precisely to give a way to address such a difficulty, by cutting a large model <math>M</math> into smaller sub-models <math>M_1, ..., M_n</math>. The sub-models can then be refined separately and more comfortably than the whole. The constraint that shall be satisfied by the decomposition is that these refined models might be recomposed into a whole model <math>MR</math> in a way that guarantees that <math>MR</math> refines <math>M</math>.
−
|SharedBuffer20100819Demo
 
−
|An example project with a completed Tasking Development and IL1 model (post IL1 translation, but before Event-B translation).
 
−
|-
 
−
|Sharedbuffer20100819Tasking
 
−
|Same as the example project above, but with Event-B model translations. The difference being that this development includes a model of the implementation. These are refinements that include a program counter to describe flow of execution in each task.
 
−
|-
 
−
|SharedBuffer20100819Tutorial
 
−
|A bare project for step 1 of the tutorial.
 
−
|-
 
−
|Sharedbuffer20100819Tutorial2
 
−
|A partially completed tasking development for steps 2 and 3 of the tutorial.
 
−
|}
 
  
−
== Preliminaries ==
+
The model decomposition leads to some interesting benefits:
−
Before further discussion of the modelling aspects, we take a look at the PrettyPrint viewers. The PrettyPrinters make the viewing of IL1 and tasking models easier; it also provides a route to generate source code. The source code can easily be pasted from the IL1 Pretty Printer window into an the Ada source file .
+
* Design/architectural decision. It applies in particular when it is noticed that it is not necessary to consider the whole model for a given refinement step, because only a few events and variables are involved instead.
−
==== The PrettyPrint View of a Tasking Development ====
+
* Complexity management. In other words, it alleviates the complexity by splitting the proof obligations over the sub-models.
−
To open the Tasking PrettyPrint viewer,
+
* Team development. More precisely, it gives a way for several developers to share the parts of a decomposed model, and to work independently and possibly in parallel on them.
−
* from the top-menu select ''Window/Show View/Other/Tasking Pretty Printer''.
 
  
−
Note that the Tasking PrettyPrinter may have to be closed when editing the Tasking Development, since it can give rise to exceptions. The PrettyPrinter would need further work to make it robust, however it is intended only as a short-term solution.
+
Note that the possibility of team development is among the current priorities for all industrial partners. The model decomposition is a first answer to this issue.
  
−
* Open the ''SharedBuffer20100819Demo'' Project and switch to the Resource Perspective.
+
= Choices / Decisions =
−
* Open the ''.tasking'' model and inspect it. Clicking on the Main, Machine or Event nodes updates the pretty print window.
+
The main decision concerning the implementation of the Event-B model decomposition in the Rodin platform is to make available both decomposition styles (''shared variables'' vs. ''shared events'') through one single plug-in. These approaches are indeed complementary and the end-user may take advantage of the former or of the latter, depending on the model (eg. the ''shared variables'' approach seems more suitable when modelling parallel system and the ''shared events'' approach seems more suitable when modelling message-passing distributed systems).
  
−
==== Viewing Source Code ====
+
Choices, either related to the plug-in core or to the plug-in graphical user interface, have been made with the following constraints in mind:
−
aka. The PrettyPrint View of an IL1 Model.
+
* Planning. Some options, such as using the Graphical Modelling Framework for the decomposition visualization, or outsourcing the context decomposition, have not been explored (at least in the first instance), mainly because of time constraints (according to the DEPLOY description of work, the decomposition support was expected by the end of 2009).
 +
* Easy-to-use (however not simplistic) tool. It applies on the one hand to the tool implementation (decomposition wizard, configuration file to replay the decomposition) and on the other hand to the tool documentation (the purpose of the user's guide is to provide useful information for beginners and for more advanced users, in particular through a ''Tips and Tricks'' section).
 +
* Modularity and consistency. In particular, the developments have not been performed in the Event-B core. Instead the Eclipse extension mechanisms have been used to keep the plug-in independent (eg. the static checker, the proof obligation generator and the editor have been extended).
 +
* Performance.
 +
* Recursivity. Thus, it is possible to decompose a previously decomposed model.
  
−
To view Ada source code,
+
Other technical decisions are justified in the specification wiki pages.
−
* from the top-menu select ''Window/Show View/Other/IL1 Pretty Printer''.
 
−
* Open the ''SharedBuffer20100819Demo'' Project and switch to the Resource Perspective.
 
−
* Open the ''.il1'' model and inspect it. Clicking on the Protected, Main Entry, or Task nodes updates the pretty print window.
 
  
−
==== Cleaning the Tasking Development ====
+
= Available Documentation =
−
If the ''.tasking'' file has errors, then it may need cleaning. To do this right-click on the ''Main'' node, select ''Epsilon Translation/CleanUp''. If a model has errors it can still be viewed by clicking on the ''Selection'' tab at the bottom of the tasking editor window.
+
The following wiki pages have been respectively written for developers and end-users to document the Event-B model decomposition:
 +
* Shared variables (A-style) decomposition specification.
 +
:See [[Event_Model_Decomposition | http://wiki.event-b.org/index.php/Event_Model_Decomposition]].
 +
* Decomposition plug-in user's guide.
 +
:See [[Decomposition_Plug-in_User's_Guide | http://wiki.event-b.org/index.php/Decomposition_Plug-in_User's_Guide]].
  
−
== The Tutorial ==
+
= Planning =
−
The steps needed to generate code from an Event-B model, in this tutorial, are as follows,
+
The decomposition plug-in is available since release 1.2 of the platform.
−
* Step 1 - [http://wiki.event-b.org/index.php/Code_Generation_Tutorial#Creating_The_Tasking_Development Create the tasking development].
+
:See [http://wiki.event-b.org/index.php/Rodin_Platform_1.2_Release_Notes  http://wiki.event-b.org/index.php/Rodin_Platform_1.2_Release_Notes].
−
* Step 2 - [http://wiki.event-b.org/index.php/Code_Generation_Tutorial#Providing_the_Annotations_for_Implementations Add annotations]
+
:and [http://wiki.event-b.org/index.php/Decomposition_Release_History http://wiki.event-b.org/index.php/Decomposition_Release_History].
−
* Step 3 - [http://wiki.event-b.org/index.php/Code_Generation_Tutorial#Invoking_the_Translation Invoke translators].
 
−
 
 
−
==== Creating The Tasking Development ====
 
−
* Change to the Event-B Perspective.
 
−
* Open the ''SharedBuffer20100819Tutorial'' Project.
 
−
* Select the following Machines: Reader, Writer and Shared.
 
−
* Right-click and select ''Make Tasking Development/Generate Tasking Development''.
 
−
 
 
−
The new Tasking Development will not be visible in the Event-B perspective, change to the resource perspective, open and inspect the new ''.tasking'' file. The Tasking Development contains (the EMF representation of) the machines that we wish to provide implementations for. In order to introduce the new concepts we have prepared a partially complete development.
 
−
 
 
−
Change to the Project ''SharedBuffer20100819Tutorial2'' to begin the next step.
 
−
 
 
−
==== Providing the Annotations for Implementations ====
 
−
* Close any Tasking Pretty Print Viewers that remain open. The incomplete model will give rise to exceptions.
 
−
* Go to the to the Resource Perspective.
 
−
* Open and inspect the ''.tasking'' machine.
 
−
 
 
−
The ''WriterTsk'' and ''SharedObj'' machines are incomplete. We will take the steps to necessary to provide implementation details.
 
−
 
 
−
===== The WriterTsk Machine =====
 
−
In the partially complete tutorial project we already identified the ''WriterTsk'' as an ''Auto Task'' Tasking Machine, by adding the ''Auto Task'' extension. ''Auto Tasks'' are tasks that will be declared and defined in the ''Main'' procedure of the implementation. The effect of this is that the ''Auto Tasks'' are created when the program first loads, and then activated (made ready to run) before the ''Main'' procedure body runs. We have added the ''Periodic Task'' extension to the ''Auto Task'', and set a period of 250 milliseconds. We will now complete the sequence that has been partially defined in the task body.
 
−
 
 
−
*'''Add Synchronisation between TWrite and SWrite'''.
 
−
** Expand the ''Auto Task Machine'' node.
 
−
** Expand the ''Seq'' sub-tree.
 
−
** Right-click on the ''Seq'' node and select ''New Child/Left Branch EventWrapper''.
 
−
** Provide the event label ''w1'' using the properties view.
 
−
** Right-click on Event Wrapper and select ''New Child/ Synch Events''.
 
−
** Select ''Synch Events'' and go to the drop-down menu of the ''Local Event'' property.
 
−
** At this point the drop-down box displays a number of event names, select the ''TWrite'' event.
 
−
** Go to the drop-down menu of the ''Remote Event'' property.
 
−
** From the list of events select the ''SWrite'' event.
 
−
 
 
−
The Synch Events construct is used to implement [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Control_Constructs Event Synchronisation]. The next step wraps an event in an Event Wrapper in order to update the local state; there is no synchronisation as such but we will re-use the constructs that already exist.
 
−
 
 
−
*'''Add the Wrapped Event TcalcWVal'''.
 
−
** Expand the sub-tree of the second ''Seq'' node.
 
−
** Right-click on the ''Seq'' node and select ''New Child/Left Branch EventWrapper''.
 
−
** Provide the event label ''w2'' using the properties view.
 
−
** Right-click on Event Wrapper and select ''New Child/ Synch Events''.
 
−
** Select ''Synch Events'' and go to the drop-down menu of the ''Local Event'' property.
 
−
** From the list of events select the ''TcalcWVal'' event.
 
−
 
 
−
We have now completed the task body, and it just remains to complete provide details for the ''TWrite'' event. The ''TWrite'' event in ''WriterTsk'' is to be synchronized with the ''SWrite'' event in the ''SharedObj''.
 
−
*'''Add Event Extensions'''.
 
−
** Right-click on the ''TWrite'' Event node.
 
−
** Select ''New Child/Extension''.
 
−
** Right-click on the ''Extension'' node and select ''New Child/Implementation'' from the menu.
 
−
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''ProcedureSynch''.
 
−
 
 
−
*'''Identify Incoming and Outgoing parameters'''.
 
−
** Right-click on the ''outAP'' node and add an ''Extension''.
 
−
** Right-click on the ''Extension'' and select''New Child/Parameter Type''.
 
−
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''actualOut''.
 
−
** Right-click on the ''inAP'' node and add an ''Extension''.
 
−
** Right-click on the ''Extension'' and select''New Child/Parameter Type''.
 
−
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''actualIn''.
 
−
 
 
−
===== The Shared Machine =====
 
−
 
 
−
The next step is to identify the ''SharedObj'' machine as a ''Shared Machine''. The ''SharedObj'' Machine will be extended using the Event-B EMF extension mechanism.
 
−
* Right-click on the ''SharedObj'' Machine node in the ''.tasking'' file.
 
−
* Select ''New Child/Extension''.
 
−
* Right-click on the ''Extension'' node and select ''New Child/Shared Machine'' from the menu.
 
−
 
 
−
We now show how to extend the ''SWrite'' event of the Shared Machine with details about its implementation. The ''SWrite'' event in ''SharedObj'' is to be synchronized with the ''TWrite'' event in the ''WriterTsk''.
 
−
* '''Identify SWrite as a Syncronisation'''.
 
−
** Right-click on the ''SWrite'' Event node.
 
−
** Select ''New Child/Extension''.
 
−
** Right-click on the ''Extension'' node and select ''New Child/Implementation'' from the menu.
 
−
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''ProcedureSynch''.
 
−
 
 
−
* '''Identify incoming and outgoing parameters'''.
 
−
** Right-click on the ''inFP'' node and add an ''Extension''.
 
−
** Right-click on the ''Extension'' and select''New Child/Parameter Type''.
 
−
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''formalIn''.
 
−
** Right-click on the ''outFP'' node and add an ''Extension''.
 
−
** Right-click on the ''Extension'' and select''New Child/Parameter Type''.
 
−
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''formalOut''.
 
−
 
 
−
===== A Summary of Steps =====
 
−
 
 
−
For a Tasking Machine definition:
 
−
# Add the Tasking Machine type (Auto etc).
 
−
# Add the task type (Periodic etc.).
 
−
# Define the task priority.
 
−
# Define the task body.
 
−
# For each event, add the Event Type.
 
−
# For each event parameter, add the Parameter Type.
 
−
 
 
−
 
 
−
For a Shared Machine definition:
 
−
# Add the ''SharedMachine'' Machine type.
 
−
# For each event, define the Event Type.
 
−
# For each event parameter, define the Parameter Type.
 
−
 
 
−
==== Invoking the Translation ====
 

Revision as of 15:45, 10 November 2009

Overview

The Event-B model decomposition is a new feature in the Rodin platform.

Two methods have been identified in the DEPLOY project for model decomposition: the shared variable decomposition (or A-style decomposition, after Abrial), and the shared event decomposition (or B-style decomposition, after Butler). They both answer to the same requirement, namely the possibility to decompose a model M into several independent sub-models M_1, ...,M_n.

Academic (ETH Zurich, University of Southampton) and industrial (Systerel) partners were involved in the specifications and developments. Systerel, which could have useful discussions with Jean-Raymond Abrial on the topic, was more especially responsible of the A-style decomposition. The University of Southampton, where Michael Butler is professor, was in charge of the B-style decomposition.

Motivations

One of the most important feature of the Event-B approach is the possibility to introduce new events and data-refinement of variables during refinement steps.

It however results in an increasing complexity of the refinement process when having to deal with many events, many state variables, and consequently many proof obligations. This is well illustrated in the Event build-up slide of the Wright presentation during the Rodin Workshop 2009.

See http://wiki.event-b.org/index.php/Image:Steve_Wright_Quite_Big_Model_Presentation.pdf.

The purpose of the Event-B model decomposition is precisely to give a way to address such a difficulty, by cutting a large model M into smaller sub-models M_1, ..., M_n. The sub-models can then be refined separately and more comfortably than the whole. The constraint that shall be satisfied by the decomposition is that these refined models might be recomposed into a whole model MR in a way that guarantees that MR refines M.

The model decomposition leads to some interesting benefits:

  • Design/architectural decision. It applies in particular when it is noticed that it is not necessary to consider the whole model for a given refinement step, because only a few events and variables are involved instead.
  • Complexity management. In other words, it alleviates the complexity by splitting the proof obligations over the sub-models.
  • Team development. More precisely, it gives a way for several developers to share the parts of a decomposed model, and to work independently and possibly in parallel on them.

Note that the possibility of team development is among the current priorities for all industrial partners. The model decomposition is a first answer to this issue.

Choices / Decisions

The main decision concerning the implementation of the Event-B model decomposition in the Rodin platform is to make available both decomposition styles (shared variables vs. shared events) through one single plug-in. These approaches are indeed complementary and the end-user may take advantage of the former or of the latter, depending on the model (eg. the shared variables approach seems more suitable when modelling parallel system and the shared events approach seems more suitable when modelling message-passing distributed systems).

Choices, either related to the plug-in core or to the plug-in graphical user interface, have been made with the following constraints in mind:

  • Planning. Some options, such as using the Graphical Modelling Framework for the decomposition visualization, or outsourcing the context decomposition, have not been explored (at least in the first instance), mainly because of time constraints (according to the DEPLOY description of work, the decomposition support was expected by the end of 2009).
  • Easy-to-use (however not simplistic) tool. It applies on the one hand to the tool implementation (decomposition wizard, configuration file to replay the decomposition) and on the other hand to the tool documentation (the purpose of the user's guide is to provide useful information for beginners and for more advanced users, in particular through a Tips and Tricks section).
  • Modularity and consistency. In particular, the developments have not been performed in the Event-B core. Instead the Eclipse extension mechanisms have been used to keep the plug-in independent (eg. the static checker, the proof obligation generator and the editor have been extended).
  • Performance.
  • Recursivity. Thus, it is possible to decompose a previously decomposed model.

Other technical decisions are justified in the specification wiki pages.

Available Documentation

The following wiki pages have been respectively written for developers and end-users to document the Event-B model decomposition:

  • Shared variables (A-style) decomposition specification.
See http://wiki.event-b.org/index.php/Event_Model_Decomposition.
  • Decomposition plug-in user's guide.
See http://wiki.event-b.org/index.php/Decomposition_Plug-in_User's_Guide.

Planning

The decomposition plug-in is available since release 1.2 of the platform.

See http://wiki.event-b.org/index.php/Rodin_Platform_1.2_Release_Notes.
and http://wiki.event-b.org/index.php/Decomposition_Release_History.
Retrieved from ‘https://wiki.event-b.org/index.php?title=Code_Generation_Tutorial&oldid=1877’