Revision as of 09:44, 29 November 2010

Model Animation

Overview

Siemens Application

The most important additions of the last 12 months are:

Application of ProB in three active deployments, namely the upgrading of the Paris Metro Line 1 for driverless trains, line 4 of the S\~{a}o Paulo metro and line 9 of the Barcelona metro. We also briefly report on experiments on the models of the CDGVAL shuttle. The paper ^[1] only contained the initial San Juan case study, which was used to evaluate the potential of our approach.
In this article we describe the previous method adopted by Siemens in much more detail, as well as explaining the performance issues with Atelier B.
Comparisons and empirical evaluations with other potential approaches and alternate tools (Brama, AnimB, BZ-TT and TLC) have been conducted.
We provide more details about the ongoing validation process of ProB, which is required by Siemens for it to use ProB to replace the existing method.

The validation also lead to the discovery of errors in the English version of the Atelier B reference manual.

Also, since ^[2], ProB itself has been further improved inspired by the application, resulting in new optimisations in the kernel (see below).

More details:

^[3]
^[4]

Multi-level Animation

(ABZ'2010 & SCP journal paper)

Improvements to the ProB Constraint solver and empirical evaluation

Various industrial applications have shown the need for improved constraint-solving capabilities (see CBC Deadlock, Test-Case Generation). In order to evaluate ProB, and detect areas for improvement, we have studied to what extent classical constraint satisfaction problems can be conveniently expressed as B predicates, and then solved by ProB. In particular, we have studied problems such as the n-Queens problem, graph colouring, graph isomorphism detection, time tabling, Sudoku, Hanoi, magic squares, Alphametic puzzles, and several more. We have then compared the performance with respect to other tools, such as the model checker TLC for TLA+, AnimB for Event-B, and Alloy.

The experiments show that some constraint satisfaction problems can be expressed very conveniently in B and solved very effectively with ProB. For example, TLC takes 8747 seconds (2 hours 25 minuts) to solve the 9-queens problem expressed as a logical predicate; Alloy 4.1.10 with minisat takes 0.406 seconds, ProB 1.3.3 takes 0.01 seconds. For 32 queens, ProB 1.3.3 takes 0.28 seconds, while Alloy 4.1.10 with minisat takes over 4 minutes. For some others, the performance of ProB is still sub-optimal with respect to, e.g., Alloy; we plan to overcome this shortcoming in the future. Our long term goal is that B can not only be used to as a formal method for developing safety critical software, but also as a high-level constraint programming language.

Constraint-Based Deadlock Checking

Ensuring the absence of deadlocks is important for certain applications, in particular for Bosch's Adaptive Cruise Control. We are tackling the problem of finding deadlocks via constraint solving rather than by model checking. Indeed, model checking is problematic when the out-degree is very large. In particular, quite often there can be a practically infinite number of ways to instantiate the constants of a B model. In this case, model checking will only find deadlocks for the given constants chosen.

Idea: solve constraints of axioms, invariant together with a constraint specifying a deadlock.

Required Developments:

implementation of the algorithm, with semantic relevance filtering (to be able to restrict the deadlock search to certain scenarios: in Bosch's case due to the flow plugin, one wants to restrict deadlock checking e.g. to states with the variable Counter set to 10).
Improvements to ProB's constraint solving engine: (reification of constraints, more precise information propagation for membership constraints, performance improvments in the typchecker and other parts of the kernel)

Success: Model 1 and Model 2: CrCtrl_Comb2Final; relevance of Counter=10 due to flow

Deadlock Freedom PO: 34 pages of ASCII, could not be loaded in Rodin "Java Heap Space Error". Counter examples found for 8 versions in 1-18 seconds.

BMotionStudio for Industrial Models

Previously, we presented BMotion Studio, a visual editor which enables the developer of a formal model to set-up easily a domain specific visualization for discussing it with the domain expert. However, BMotion Studio had not yet reached the status of an Industrial strength tool due to the lack of important features known from modern editors.

In this work we present the improvements to BMotion Studio mainly aimed at upgrading it to an industrial strength tool and to show that we can apply the benefits of BMotion Studio for visualizing more complex models which are on the level of industrial applications. In order to reach this level the contribution of this work consists of three parts:

We added a lot of new features to the graphical editor known from modern editors like: Copy-paste support, undo-redo support, rulers, guides and error reporting. One step towards was the redesign of the graphical editor with GEF.
Since extensibility is a very important design principle for reaching the level of an industrial strength tool we pointed up the extensibility options of BMotion Studio.
We introduced the visualization for two models which are on the level of industrial applications in order to demonstrate that we can apply the benefits of BMotion Studio for visualizing more complex models. The first model is a mechanical press controller and the second model is a train system which manages the crossing of trains in a certain track network.

Various other improvements

mainly inspired by Siemens and Bosch Applications

Improved AVL algorithms, more operators

record support, treatment of infinite sets,

Motivations

The above works were motivated mainly to support the following three industrial deployments:

Siemens: enable Siemens to use ProB in their SIL4 development chain, replacing Atelier B for data validation.
Bosch: provide animation and constraint-based deadlock detection for the Adaptive Cruise Control
SAP: provide a way to generate test cases using constraint-based animation

Available Documentation

References

↑ Leuschel et al. FM'2009
↑ Leuschel et al. FM'2009
↑ Leuschel et al. FAC, special issue of FM'2009
↑ Leuschel et al. Draft of Validation Report

Planning

Finish Validation Report
Write up Constraint-Based Deadlock Checking and integrate fully into Rodin Platform
Support mathematical extensions in ProB

[1] Leuschel et al. FM'2009

[2] Leuschel et al. FM'2009

[3] Leuschel et al. FAC, special issue of FM'2009

[4] Leuschel et al. Draft of Validation Report

[1]

[2]

[3]

[4]

@@ Line 1: / Line 1: @@
-= Overview =
+= Model Animation =
-We think that animation and model checking are important tools when building a model.
+== Overview ==
-Animation allows the user to validate if the model corresponds to the user's intentions.
+=== Siemens Application===
-Model checking allows to check if the model contains errors and provides counter-examples that help to understand the problem beforehand.
+The most important additions of the last 12 months are:
-Moreover, it allows to reason with domains (like physical units) and verify some properties (like temporal logic ones), that have currently no matching proof support.
+* Application of ProB in three active deployments, namely the upgrading of the Paris Metro Line 1 for driverless trains, line 4 of the S\~{a}o Paulo metro and line 9 of the Barcelona metro. We also briefly report on experiments on the models of the CDGVAL shuttle. The paper <ref>Leuschel et al. FM'2009</ref> only contained the initial San Juan case study, which was used to evaluate the potential of our approach.
+* In this article we describe the previous method adopted by Siemens in much more detail,  as well as explaining the performance issues with Atelier B.
+* Comparisons and empirical evaluations with other potential approaches and alternate tools (Brama, AnimB, BZ-TT and TLC) have been conducted.
+* We provide more details about the ongoing validation process of ProB, which is required by Siemens for it to use ProB to replace the existing method.
-The following activities were pursued within the project:
+ The validation also lead to the discovery of errors in the English version of the Atelier B reference manual.
+Also, since  <ref>Leuschel et al. FM'2009</ref>, ProB itself has been further improved inspired by the application, resulting in new optimisations in the kernel (see below).
-* The constraint solving capabilities of ProB have been continuously improved along with scalability improvements.
+More details:
+* <ref>Leuschel et al. FAC, special issue of FM'2009</ref>
+* <ref>Leuschel et al. Draft of Validation Report</ref>
-* A conversion from TLA to B has been added. ProB now supports TLA+. The motivation is to extend the reach of the project and to learn from TLA concerning certain features relevant for cyber-physical systems (e.g. real number support).
+=== Multi-level Animation ===
+ (ABZ'2010 & SCP journal paper)
-* There is work in progress towards full support of Theory plug-in: support for external and recursive functions has been added.
+=== Improvements to the ProB Constraint solver and empirical evaluation ===
+Various industrial applications have shown the need for improved constraint-solving capabilities (see CBC Deadlock, Test-Case Generation). In order to evaluate ProB, and detect areas for improvement, we have studied to what extent classical constraint satisfaction problems can be  conveniently expressed as B predicates, and then solved by ProB. In particular, we have studied problems such as the n-Queens problem, graph colouring, graph isomorphism detection, time tabling, Sudoku, Hanoi, magic squares, Alphametic puzzles, and several more. We have then compared the performance with respect to other tools, such as the model checker TLC  for TLA+, AnimB for Event-B,  and Alloy.
+The experiments show that some constraint satisfaction problems can be expressed very conveniently in B and solved very effectively with ProB. For example, TLC takes 8747 seconds (2 hours 25 minuts) to solve the 9-queens problem expressed as a logical predicate; Alloy 4.1.10 with minisat takes 0.406 seconds, ProB 1.3.3 takes 0.01 seconds. For 32 queens, ProB 1.3.3 takes 0.28 seconds, while Alloy 4.1.10 with minisat takes over 4 minutes. For some others, the performance of ProB is still sub-optimal with respect to, e.g., Alloy; we plan to overcome this shortcoming in the future. Our long term goal is that B can not only be used to as a formal method for developing safety critical software, but also as a high-level constraint  programming language.
-* The conversion to the relational logic solver Kodkod has been completed and experiments with Kodkod and SMT translators have been conducted.
+=== Constraint-Based Deadlock Checking ===
+Ensuring the absence of deadlocks is important for certain applications, in particular for Bosch's Adaptive Cruise Control. We are tackling the problem of finding deadlocks via constraint solving rather than by model checking. Indeed, model checking is problematic when the out-degree is very large. In particular, quite often there can be a practically infinite number of ways to instantiate the constants of a B model. In this case, model checking will only find deadlocks for the given constants
+chosen.
-* We are working on an analysis of the use of physical units in a formal model.
+Idea: solve constraints of axioms, invariant together with a constraint specifying a deadlock.
-* We improved the usability of the LTL model checker.
+Required Developments:
+* implementation of the algorithm, with semantic relevance filtering (to be able to restrict the deadlock search to certain scenarios: in Bosch's case due to the flow plugin, one wants to restrict deadlock checking e.g. to states with the variable Counter set to 10).
+* Improvements to ProB's constraint solving engine: (reification of constraints, more precise information propagation for membership constraints, performance improvments in the typchecker and other parts of the kernel)
-* Regarding BMotion Studio, we focused on fixing identified bugs and rectifying usability issues.
+Success: Model 1 and Model 2: CrCtrl_Comb2Final;
+relevance of Counter=10 due to flow
-= Motivations / Decisions =
+Deadlock Freedom PO: 34 pages of ASCII, could not be loaded in Rodin "Java Heap Space Error". Counter examples found for 8 versions in 1-18 seconds.
-== Improvements to Constraint-Solving ==
+=== BMotionStudio for Industrial Models ===
-ProB's constraint solving capabilities are at the core of many of ProB's features: animation of high-level models with complicated predicates, model-based testing, constraint-based invariant and deadlock checking, etc.
+Previously, we presented BMotion Studio, a visual editor which enables the developer of a formal model to set-up easily a domain specific visualization for discussing it with the domain expert. However, BMotion Studio had not yet reached the status of an Industrial strength tool due to the lack of important features known from modern editors.
-It is thus important to improve this aspect of ProB.
-In particular, we have continuously improved the performance of the kernel, as can be seen in the figure below showing the performance of ProB (in seconds) on the N-Queens problem for 100 queens.
-Other improvements lie in better expansion of universal and existential quantifiers, reification for the the <tt>bool</tt> operator and support for infinite and recursive functions.
-The latter is particularly important in light of the Theory Plug-In work below.
-[[Image:performance of ProB on the N-Queens problem for 100 queens.jpg|240px]]
+In this work we present the improvements to BMotion Studio mainly aimed at upgrading it to an industrial strength tool and to show that we can apply the benefits of BMotion Studio for visualizing more complex models which are on the level of industrial applications. In order to reach this level the contribution of this work consists of three parts:
-== TLA2B ==
+* We added a lot of new features to the graphical editor known from modern editors like: Copy-paste support, undo-redo support, rulers, guides and error reporting. One step towards was the redesign of the graphical editor with GEF.
+* Since extensibility is a very important design principle for reaching the level of an industrial strength tool we pointed up the extensibility options of BMotion Studio.
+* We introduced the visualization for two models which are on the level of industrial applications in order to demonstrate that we can apply the benefits of BMotion Studio for visualizing more complex models. The first model is a mechanical press controller and the second model is a train system which manages the crossing of trains in a certain track network.
-TLA+ and B share the common base of predicate logic, arithmetic and set theory.
+=== Various other improvements ===
-However, there are still considerable differences, such as very different approaches to typing and modularization. Some features of TLA+ are interesting in the context of cyber-physical systems, such as real numbers.
-There is also considerable difference in the available tool support. In particular, we wanted to compare ProB with TLC and gain insights about performance.
-== Physical Units ==
+mainly inspired by Siemens and Bosch Applications
-Formal models of cyber physical systems will contain variables which represent values with physical units.
-We are thus exploring to use the ProB model checker as a tool to infer and validate physical units usage in formal models.
-In particular, we want to make sure that the physical units in a model are used in a consistent way.
-== Theory Plug-in and Mathematical Extensions ==
+Improved AVL algorithms, more operators
+ record support, treatment of infinite sets,
-In the ProB core, we have improved ProB to better deal with infinite and recursive functions.
+== Motivations ==
-This can be used to provide formal specifications for mathematical extensions which can be animated and model checked by ProB.
-Using the newly developed external function mechanism, it should also be possible to support floats or reals, which will be important for certain cyber-physical systems.
-On the technical side, we have extended the ProB internal representation of predicates and expressions to support the Theory plug-in. The implementation will be finalize as the Theory plug-in will allow access to definitions will be granted to ProB.
+The above works were motivated mainly to support the following three industrial deployments:
+* Siemens: enable Siemens to use ProB in their SIL4 development chain, replacing Atelier B for data validation.
+* Bosch: provide animation and constraint-based deadlock detection for the Adaptive Cruise Control
+* SAP: provide a way to generate test cases using constraint-based animation
-== Kodkod ==
+== Available Documentation ==
-We have integrated a translation of B predicates to the relational logic solver "Kodkod" and evaluated how ProB's constraint solving compares to Kodkod's SAT solving.
-The integration allows to apply SAT solving to predicates where a translation is possible and a fallback to constraint solving for the remaining predicates.
-Our experiments have shown that the translation can be highly beneficial for certain kinds of constraints, and as such opens up new ways to analyze and validate formal specifications in Event-B. However, the experiments have also shown that the constraint logic programming approach of ProB can be superior in a considerable number of scenarios; the translation to Kodkod and down to SAT is not (yet) the panacea. The same can be said of the existing translations from B to SMT.
-As such, we believe that much more research required to reap the best of both worlds (SAT/SMT and constraint programming).
-A side-effect of the translation to Kodkod is that the ProB toolset now provides a double-chain (relying on technology developed independently and using different programming languages and paradigms) of validation for first-order predicates, which should prove relevant in high safety integrity level contexts.
-In comparision with other formalisms Kodkod has the advantage that is provides good support for relations and sets which play an essential role in Event-B's mathematical notation.
+=== References ===
+<references/>
-== LTL ==
-ProB supports LTL model checking. One problem when using LTL to validate a model is that counter-examples returned by the model checker are often hard to understand.
-A counter-example typically consists of a lasso-chaped sequence of states and events. Instead of just loading the sequence into the history of the animator, we have
-implemented a dedicated visualisation for LTL counter-examples. The visualisation which is now part of ProB's Rodin plug-in shows why an LTL operator is true or false in each state of the sequence.
-== CSP and B ==
-ProB supports also other formalisms like CSP. CSP can also be used to guide B and Event-B models and can also be used for specifying scenarios or for model testing.
-Within the project this feature of ProB was continuously maintained and improved. We have extended the implementation of the CSP interpreter and animator to be able to support more complex and larger data types (e.g. mixing of dot and non-associative tuples) as well as supporting more complicated pattern matching inside set comprehensions and function definitions. Some effort for supporting more of CSP built-in functions (like seq(-), set(-) and card(-))was made as well.
-Finally, ProB now supports checking LTL-assertions directly from the CSP model by using pragmas ({-# assert_ltl = … #-}). The syntax is the same as for LTL-assertions in DEFINTION clauses in B models.
-= Available Documentation =
-== Constraint Solving ==
-The improvements are available in the nightly builds of ProB.
-Two specific pages have been added to the ProB user manual:  <ref>http://www.stups.uni-duesseldorf.de/ProB/index.php5/Recursively_Defined_Functions Recursive functions entry in ProB user manual</ref>,  <ref>http://www.stups.uni-duesseldorf.de/ProB/index.php5/External_Functions External functions entry in ProB user manual</ref>.
-== TLA2B ==
-The TLA+ to B translation has been published at the iFM'2012 conference. A technical report is available<ref>http://www.stups.uni-duesseldorf.de/w/Special:Publication/HansenLeuschelTLA2012 Translating TLA+ to B for Validation with ProB. Technical Report, 2012.</ref>
-A presentation at the FM'2012 TLA+ workshop will also be made.
-A page has been added to the ProB user manual: <ref>http://www.stups.uni-duesseldorf.de/ProB/index.php5/TLA TLA2B entry in ProB user manual</ref>.
-== Physical Units ==
-This work is still in progress. A first tutorial page is available in the ProB online documentation <ref>http://www.stups.uni-duesseldorf.de/ProB/index.php5/Tutorial_Unit_Plugin Unit Plug-in Tutorial entry in ProB user manual</ref>. Full documentation will be made available later in the project.
-The latest nightly build of ProB contains an experimental version of the analysis.
-== Kodkod ==
+== Planning ==
-A technical report has been published on the validation using ProB and Kodkod <ref>http://www.stups.uni-duesseldorf.de/w/Special:Publication/PlaggeLeuschel_Kodkod2012 Validating B,Z and TLA+ using ProB and Kodkod. Technical Report, 2012.</ref>. The paper has been accepted for FM'2012.
-== LTL ==
-The concept and implemenation of the visualisation is described in <ref>http://www.stups.uni-duesseldorf.de/w/Visualisierung_von_LTL-Gegenbeispielen Andriy Tolstoy: Visualisierung von LTL-Gegenbeispielen, Master thesis, University of Düsseldorf, 2012</ref>.
-== BMotion Studio ==
-A developer-, user documentation, tutorial and examples are available at <ref>http://www.stups.uni-duesseldorf.de/bmotionstudio</ref>.
-= Planning =
-=== Physical Units ===
-Physical units work will be completed.
-First experiments with industrial models from Alstom are encouraging.
-== Kodkod ==
-Currently the translation to Kodkod is only applied to axioms when trying to find values for the constants and during the constraint based deadlock check.
-We plan to restructure ProB's internal programming interfaces in a way that allows to apply Kodkod more easily and make it available for other checks (e.g. constraint-based invariant check, assertion checks).
-We will evaluate how we can employ more SMT based techniques in ProB.
-== Constraint Solving ==
-During the further development of ProB's constraint solving it became apparent that it would be
-helpful to represent the cardinality of a set by a CLP(FD) variable.
-We plan to change ProB's internal representation of sets in a way that its cardinality can
-be accessed in this way.
-To allow a translation from ProB to Kodkod, we implemented an integer interval analysis.
-We plan to adapt the analysis to set up sizes of deferred sets. This is necessary because ProB
-chooses a fixed size for a deferred set and sometimes a model has only solutions for a certain size.
-Currently a user must supply a size manually.
-== LTL ==
-Fairness properties are very common when specifying LTL formula. Fairness can be encoded by using standard LTL, but it makes the formula significantly larger. The complexity of the model checking algorithm grows exponentially with the number of used LTL operators in a formula. We plan to incorporate support for fairness directly into the model checker which should lead to a drastic improvement in performance when fairness is used. Additionally, the usability of the model checker is improved by having the ability to specify fairness conditions seperatly from the rest of the LTL formula.
-== BMotion Studio ==
-We will provide a way to link up other Java-based simulation tools with BMotion Studio. Furthermore, beside working on identified bugs and and rectifying usability issues, we want to create more visual elements to aid humans understand large-scale simulations.
-= References =
-<references/>
-[[Category:ADVANCE D3.2 Deliverable]]
+* Finish Validation Report
+* Write up Constraint-Based Deadlock Checking and integrate fully into Rodin Platform
+* Support mathematical extensions in ProB

Difference between pages "ADVANCE D3.2 Model Checking" and "D32 Model Animation"

Revision as of 09:44, 29 November 2010

Contents

Model Animation

Overview

Siemens Application

Multi-level Animation

Improvements to the ProB Constraint solver and empirical evaluation

Constraint-Based Deadlock Checking

BMotionStudio for Industrial Models

Various other improvements

Motivations

Available Documentation

References

Planning

Navigation menu

Page actions

Page actions

Personal tools

Navigation

contribute

Search

Tools