Difference between pages "Rodin Workshop 2009" and "Tasking Event-B Tutorial"

From Event-B
(Difference between pages)
Jump to navigationJump to search
imported>Matoussi
 
imported>Andy
 
Line 1: Line 1:
{{TOCright}}
+
For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk
 +
=== Tasking Event-B Tutorial Overview ===
  
 +
<span style="color: RED">'''Caution''': This Page is under Construction - some parts are incomplete</span>
  
= Rodin User and Developer Workshop July 15-17 2009 =
+
This tutorial follows on from the abstract development described [http://wiki.event-b.org/index.php/Development_of_a_Heating_Controller_System here].
  
 +
This code generation tutorial extends the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces implementable Ada code, and also an Event-B model. It is a model of the implementation, and contains flow control variables that model the flow of execution through the task body. The Ada code is produced from an intermediate model that is not visible to the user. The Common Language model (CLM), is generated from the Tasking Event-B by a translation tool. Ada (and other implementations) may be generated from the CLM. An overview of Tasking Event-B can be found [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview here].
  
While much of the continued development and use of Rodin takes place within the DEPLOY Project, there is a growing group of users and plug-in developers outside of DEPLOY. In July 2009, DEPLOY organised a workshop at the University of Southampton to bring together existing and potential users and developers of the Rodin toolset and to foster a broader community of Rodin users and developers.  For Rodin users the workshop provided an opportunity to share tool experiences and to gain an understanding of on-going tool developments. For plug-in developers the workshop provided an opportunity to showcase their tools and to achieve better coordination of tool development effort.  Moving towards an open source development project will mean that features that cannot be resourced from within the project can be developed outside the project. It will also help to guarantee the longer-term future of the Rodin platform.
+
In the example so far, the Heating Controller has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines modelling tasks, shared objects and the environment are identified, and  extended with the appropriate implementation details.
This report contains the abstracts of the presentations at the workshop on 16 and 17 July 2009. The workshop was preceded by a tutorial for Rodin Plug-in developers on 15 July.
 
  
We would like to acknowledge the support of the School of Electronics and Computer Science at the University of Southampton (especially the organisational work of Maggie Bond), the DEPLOY project and additional government funding.
+
The example/tutorial projects are are available in the [http://deploy-eprints.ecs.soton.ac.uk/304/ e-prints archive], or on [https://codegenerationd.svn.sourceforge.net/svnroot/codegenerationd/Examples/Heating_ControllerTutorial_v0.2.0/ SVN].
  
 +
{| border="1"
 +
|Heating_ControllerTutorial2_Completed
 +
|An example project with an environment simulation. The environment variables are monitored and controlled using subroutine calls. The project contains a complete Tasking Development with generated Event-B and Ada code.
 +
|-
 +
|Heating_ControllerTutorial2_Partial1
 +
|A project with the final decomposition completed.
 +
|-
 +
|Heating_ControllerTutorial2_Partial2
 +
|A partially complete project, complete the required steps before generating code, and a model of the implementation.
 +
|}
  
'''Organisers'''
+
== Using the Tasking Extension ==
 +
The steps needed to generate code from an Event-B model, in this tutorial, are as follows,
 +
* Step 1 - [[Tasking Event-B_Tutorial#Adding the Implementation Level Refinement|Adding the Implementation Level Refinement]]
 +
* Step 2 - [[Tasking Event-B_Tutorial#Pre-processing|Pre-processing]]
 +
* Step 3 - [[Tasking Event-B_Tutorial#Providing the Annotations for Implementations|Add Tasking annotations]].
 +
* Step 4 - [[Tasking Event-B_Tutorial#Invoking the Translation|Invoke translators]].
 +
=== Adding the Implementation Level Refinement ===
 +
The final decomposition generates the machines that are required for code generation. However, it is not possible to edit the machines since they are machine generated, and therefore this is prohibited. In order to be able to modify the models we will refine the generated machines. To do this we can make use of the automatic refinement feature but this presents us with two problems that are dealt with in the pre-processing step.
  
Michael Butler, University of Southampton
+
=== Pre-processing ===
  
Stefan Hallerstede, Heinrich-Heine-Universität Düsseldorf
+
The pre-processing step should be a temporary, the solutions can be incorporated into the tool to automatically perform the changes that are required.
  
Laurent Voisin, Systerel
+
* The Code Generator requires a flattened version of each machine; all of the Event-B elements should be available in the implementation level machine.
 +
* Composed machines are not currently able to be refined, so anything that requires synchronization of events requires some manual updates.
  
 +
===== 'Flattening' the Implementation Machines =====
  
== [http://deploy-eprints.ecs.soton.ac.uk/137/  Report containing the abstracts is available here] ==
+
The temporary solution for flattening:
 +
* Make events ''not extended''.
 +
* Copy missing invariants.
  
== Slides from presentations are available from the links below ==
+
I found the Event-B Machine Editor's synthesis view useful for this. Invariants can be copy-pasted into the implementation machine from the abstraction. (A dummy invariant can be added and selected for pasting)
  
=== Wednesday 15 July ===
+
===== Providing the correct Composed Machine =====
  
Laurent Voisin and
+
The composed machine problem is sub-divided into two sub-problems. Firstly composed machines cannot be refined, and secondly when a machine is further decomposed there is no link between the first composed machine and the newly generated composed machine. So one or both of these problems may occur, depending on the number of decompositions.
Stefan Hallerstede,  
 
Rodin Plug-in Development Tutorial
 
  
===Thursday 16 July===
+
We must manually add the information to the composed machines to address these two problems.
  
* Michael Butler, [http://wiki.event-b.org/images/Intro.pdf Introduction]
+
The temporary solution for composed machines:
 +
* Modify the lowest level decomposed machine, HCtrl_M1_cmp, to ''include'' the implementation level machines (task names ending in *Impl). To do this,
 +
* open the composed machine editor. Open the INCLUDES edit feature.
 +
* select the second drop-down box and find the *Impl version of each machine.
  
* Ken Robinson, System Modelling and Design: Refining Software Engineering
+
=== Adding Tasking Event-B ===
 +
==== The Temp_Ctrl_Task1Impl Machine ====
 +
In the partially complete tutorial project we have already identified the ''Temp_Ctrl_Task1Impl'' as an ''Auto Task'' Tasking Machine, by adding the ''Auto Task'' extension. ''Auto Tasks'' are tasks that will be declared and defined in the ''Main'' procedure of the implementation. The effect of this is that the ''Auto Tasks'' are created when the program first loads, and then activated (made ready to run) before the ''Main'' procedure body runs. We have set the task type to ''Periodic'', and set a period of 250 milliseconds. We have provided a screenshot of the completed ''Temp_Ctrl_Task1Impl'' [http://wiki.event-b.org/images/Temp_Ctrl_Task1Impl.pdf here], it can be read in conjunction with the tutorial.
  
* Jean-Raymond Abrial, Doing Mathematics with the Rodin Platform
+
The next step is to construct the task body using the TaskBody Editor, with control constructs such as sequence, branch, loop and output. These constructs are discussed in the [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview overview] of Tasking Event-B. We will now complete the sequence that has been partially defined in the task body.
  
* Stephen Wright, Experiences with a Quite Big Event-B Model
+
?????????????????????????????
  
* John Colley,  On Proving with Event-B that a Pipelined Processor Model Implements its ISA Specification
+
By relating the sensing events in this way we describe a simulation of the interaction between the task and environment. The details of the interaction are embodied in the events themselves; and this is implemented in the simulation code by reading the values of the environment variables.
  
* Fangfang Yuan, Quantitative Design Decisions Measurement using Formal Method
+
Next we look at the sensing event ''TCSense_Temperatures'' event in ''Temp_Ctrl_Task1Impl''. Sensing (and actuating) can be viewed as a kind of synchronisation. Synchronisation between tasks and shared objects are represented as subroutine calls. The sensing/actuating synchronisations only occur between tasks and the environment.
  
* Kriangsak Damchoom and Michael Butler,  [http://www.event-b.org/rodin09/FlashFileSysRodinWorkshopJuly2009.ppt An Experiment in Applying Event-B and Rodin to a Flash-Based Filestore]
+
*'''Add The Sensed Event Extension'''.
 +
** Right-click on the ''TCSense_Temperatures'' Event node.
 +
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Sensing''.
  
* Philipp Ruemmer,  A Theory of Finite Sets, Lists, and Maps for the SMT-Lib Standard
+
==== The Shared Machine ====
  
* Matthias Schmalz, [http://wiki.event-b.org/images/Atp_improvements.pdf Better automated theorem proving in Event-B]
+
The next step is to identify the ''Shared_Object1Impl'' machine as a ''Shared Machine''. A screenshot of the [http://wiki.event-b.org/images/Shared_Object1Impl.pdf Shared_Object1Impl] shared machine can be read in conjunction with the text.
 +
* Optionally collapse open branches of the EMF editor to remove clutter. 
 +
* Right-click on the ''Shared_Object'' Machine node in the Rose Editor.
 +
* Select ''New Child/Shared Machine'' from the menu.
  
* Issam Maamria, Proposal for an extensible rule-based prover for Event-B
+
==== The Environ Machine ====
 +
In the prepared machine we have identified the ''Envir1Impl'' as an ''Environ Machine'', by adding the ''Environ Machine'' extension. ''Envir1Impl'' models a task that simulates the environment, and can be used to generate simulation code. For deployment in a non-simulated environment the environ machine's generated code can be ignored; we provide details of non-simulated code using addressed variables later. As before, a screenshot is available [http://wiki.event-b.org/images/Envir1Impl_2.pdf here]. In the prepared Environment Machine we have already set task type to ''Periodic'' extension, and set a period of 100 milliseconds.
 +
 +
We will now complete the sequence that has been partially defined in the task body. The following specification models simulation of a temperature change; the temperature value is represented by a monitored variable in the environment. The generated code simulates the temperature change in the environment by changing the monitored value. 
  
* Gudmund Grov,  [http://wiki.event-b.org/images/Reasoned_modelling.pdf A Proposal for a Rodin Proof Planner & Reasoned Modelling Plug-in]
+
*'''Model Temperature Change in the environment'''.
 +
??????
  
* Jens Bendisposto, Using and Extending ProB
+
* Output to the screen during the simulation can be specified as follows:
 +
??????
  
* Ilya Lopatkin, Towards the SAL plugin for the Rodin platform
+
The generated code will print the text, and the value of the variable, to the screen.
  
* Kenneth Lausdahl and Miguel Ferreira, An Overview of Overture
+
The final step is to complete the ''ENSense_Temperatures'' event. The event is a sensing event, sensing is a kind of synchronisation, it synchronises with the ''TCSense_Temperatures'' event in the ''Temp_Ctrl_Task1'' tasking machine. We add formal parameters annotations corresponding to the actual parameters that we have already defined in the task.
  
* Michael Butler,  [http://wiki.event-b.org/images/Roadmap.pdf Roadmap for the Rodin Tool]
+
*'''Add The Sensed Event Extension'''.
 +
** Right-click on the ''ENSense_Temperatures'' Event node.
 +
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Sensing''.
  
===Friday 17 July===
+
We have identified the event as a sensing event. Now we add the parameter direction:
  
* Aryldo G Russo, [http://wiki.event-b.org/images/ICFEM_2009_revised_presentation.pdf Formal Methods Outside the Mother Land  ]
+
=== A Summary of Steps ===
 +
For a Tasking Machine definition:
 +
# Add the Tasking Machine type (Auto etc).
 +
# Set the task type (Periodic etc.).
 +
# Set the task priority.
 +
# Specify the task body.
 +
# For sensing/actuating events, add the Event Type.
  
* Maria Teresa Llano, System Evolution via Animation and Reasoning
+
For a Shared Machine definition:
 +
# Add the ''SharedMachine'' Machine type.
  
* Atif Mashkoor, BRANIMATION
+
For an Environ Machine definition:
 +
# Make the type an Environ Machine type.
 +
# Set the task type Periodic; a shorter period than the shortest task period is best for simulation.
 +
# Set the task priority.
 +
# Specify the task body, it will contain a simulation of changes in the environment.
 +
# For each sensing/actuating event, add the Event Type.
  
* Fredrik Degerlund and Richard Grönblom, A Framework for Code Generation and Scheduling of Event-B Models
+
== Invoking the Translators ==
  
* Andy Edmunds, Code Generation from Event-B
+
* To generate Ada code,
 +
** Right-Click on the composed machine, or any tasking machine in the development, select ''Code Generation/Translate Event-B to Ada''.
 +
** Open the generated ''code'' directory in the project to view the source files. A refresh will be necessary to make the code visible. The .gpr file has been provided for AdaCore GPS users.
  
* Alexei Iliasov, On Event-B and Control Flow
+
* To create the Event-B model of the implementation,
 +
** Right-Click on the composed machine, or any tasking machine in the development, select ''Code Generation/Translate Tasking Event-B to Event-B''.
 +
** The Event-B model should be updated with the flow control variables. Users are not able to manually edit the generated elements. The additions can be removed using the menu option ''Code Generation/Remove Generated Event-B''
  
* Michael Jastram, [http://wiki.event-b.org/images/Requirements-quo-vadis.pdf Requirements Traceability]
+
== Generated Code ==
 +
The Ada Code generated by the translator is available at the following links:
  
* Joris Rehm, LORIA, A Rodin plugin for quantitative timed models
+
for simulation of environment without addressed variables, [http://wiki.event-b.org/images/Code_Heating_ControllerTutorial_Completed.pdf Heating_ControllerTutorial_Completed]
  
* Renato Silva, [http://wiki.event-b.org/images/Composition,_Renaming_and_Generic_Instantiation.pdf Composition, Renaming and Generic Instantiation in Event-B Development]
+
for simulation of environment with addressed variables, [http://wiki.event-b.org/images/Code_Heating_Controller5AddressedSim_Completed.pdf Heating_Controller5AddressedSim_Completed]
  
* Abderrahman Matoussi, [http://wiki.event-b.org/images/Slides_matoussi_-Southampton-.pdf Expressing KAOS Goal Refinement Patterns with Event-B ]
+
Removal of the environment task from the ''Heating_Controller5AddressedSim_Completed'' should be deployable.
  
* Eduardo Mazza, A tool for specifying and validating software responsibility
+
[[Category:User documentation]]
 
 
* Mar Yah Said, Language and Tool Support for Class and State Machine Refinement in UML-B
 
 
 
* Colin Snook, [http://wiki.event-b.org/images/An_EMF_framework_for_EventB.pdf An EMF Framework for Event-B]
 
 
 
* James Sharp, Using CSP Refusal Specifications to Ensure Event-B Refinement
 

Revision as of 12:27, 29 November 2011

For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk

Tasking Event-B Tutorial Overview

Caution: This Page is under Construction - some parts are incomplete

This tutorial follows on from the abstract development described here.

This code generation tutorial extends the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces implementable Ada code, and also an Event-B model. It is a model of the implementation, and contains flow control variables that model the flow of execution through the task body. The Ada code is produced from an intermediate model that is not visible to the user. The Common Language model (CLM), is generated from the Tasking Event-B by a translation tool. Ada (and other implementations) may be generated from the CLM. An overview of Tasking Event-B can be found here.

In the example so far, the Heating Controller has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines modelling tasks, shared objects and the environment are identified, and extended with the appropriate implementation details.

The example/tutorial projects are are available in the e-prints archive, or on SVN.

Heating_ControllerTutorial2_Completed An example project with an environment simulation. The environment variables are monitored and controlled using subroutine calls. The project contains a complete Tasking Development with generated Event-B and Ada code.
Heating_ControllerTutorial2_Partial1 A project with the final decomposition completed.
Heating_ControllerTutorial2_Partial2 A partially complete project, complete the required steps before generating code, and a model of the implementation.

Using the Tasking Extension

The steps needed to generate code from an Event-B model, in this tutorial, are as follows,

Adding the Implementation Level Refinement

The final decomposition generates the machines that are required for code generation. However, it is not possible to edit the machines since they are machine generated, and therefore this is prohibited. In order to be able to modify the models we will refine the generated machines. To do this we can make use of the automatic refinement feature but this presents us with two problems that are dealt with in the pre-processing step.

Pre-processing

The pre-processing step should be a temporary, the solutions can be incorporated into the tool to automatically perform the changes that are required.

  • The Code Generator requires a flattened version of each machine; all of the Event-B elements should be available in the implementation level machine.
  • Composed machines are not currently able to be refined, so anything that requires synchronization of events requires some manual updates.
'Flattening' the Implementation Machines

The temporary solution for flattening:

  • Make events not extended.
  • Copy missing invariants.

I found the Event-B Machine Editor's synthesis view useful for this. Invariants can be copy-pasted into the implementation machine from the abstraction. (A dummy invariant can be added and selected for pasting)

Providing the correct Composed Machine

The composed machine problem is sub-divided into two sub-problems. Firstly composed machines cannot be refined, and secondly when a machine is further decomposed there is no link between the first composed machine and the newly generated composed machine. So one or both of these problems may occur, depending on the number of decompositions.

We must manually add the information to the composed machines to address these two problems.

The temporary solution for composed machines:

  • Modify the lowest level decomposed machine, HCtrl_M1_cmp, to include the implementation level machines (task names ending in *Impl). To do this,
  • open the composed machine editor. Open the INCLUDES edit feature.
  • select the second drop-down box and find the *Impl version of each machine.

Adding Tasking Event-B

The Temp_Ctrl_Task1Impl Machine

In the partially complete tutorial project we have already identified the Temp_Ctrl_Task1Impl as an Auto Task Tasking Machine, by adding the Auto Task extension. Auto Tasks are tasks that will be declared and defined in the Main procedure of the implementation. The effect of this is that the Auto Tasks are created when the program first loads, and then activated (made ready to run) before the Main procedure body runs. We have set the task type to Periodic, and set a period of 250 milliseconds. We have provided a screenshot of the completed Temp_Ctrl_Task1Impl here, it can be read in conjunction with the tutorial.

The next step is to construct the task body using the TaskBody Editor, with control constructs such as sequence, branch, loop and output. These constructs are discussed in the overview of Tasking Event-B. We will now complete the sequence that has been partially defined in the task body.

?????????????????????????????

By relating the sensing events in this way we describe a simulation of the interaction between the task and environment. The details of the interaction are embodied in the events themselves; and this is implemented in the simulation code by reading the values of the environment variables.

Next we look at the sensing event TCSense_Temperatures event in Temp_Ctrl_Task1Impl. Sensing (and actuating) can be viewed as a kind of synchronisation. Synchronisation between tasks and shared objects are represented as subroutine calls. The sensing/actuating synchronisations only occur between tasks and the environment.

  • Add The Sensed Event Extension.
    • Right-click on the TCSense_Temperatures Event node.
    • Select New Child/Implementation from the menu.
    • Go to the Implementation properties view and set the Implementation Type property to Sensing.

The Shared Machine

The next step is to identify the Shared_Object1Impl machine as a Shared Machine. A screenshot of the Shared_Object1Impl shared machine can be read in conjunction with the text.

  • Optionally collapse open branches of the EMF editor to remove clutter.
  • Right-click on the Shared_Object Machine node in the Rose Editor.
  • Select New Child/Shared Machine from the menu.

The Environ Machine

In the prepared machine we have identified the Envir1Impl as an Environ Machine, by adding the Environ Machine extension. Envir1Impl models a task that simulates the environment, and can be used to generate simulation code. For deployment in a non-simulated environment the environ machine's generated code can be ignored; we provide details of non-simulated code using addressed variables later. As before, a screenshot is available here. In the prepared Environment Machine we have already set task type to Periodic extension, and set a period of 100 milliseconds.

We will now complete the sequence that has been partially defined in the task body. The following specification models simulation of a temperature change; the temperature value is represented by a monitored variable in the environment. The generated code simulates the temperature change in the environment by changing the monitored value.

  • Model Temperature Change in the environment.

??????

  • Output to the screen during the simulation can be specified as follows:

??????

The generated code will print the text, and the value of the variable, to the screen.

The final step is to complete the ENSense_Temperatures event. The event is a sensing event, sensing is a kind of synchronisation, it synchronises with the TCSense_Temperatures event in the Temp_Ctrl_Task1 tasking machine. We add formal parameters annotations corresponding to the actual parameters that we have already defined in the task.

  • Add The Sensed Event Extension.
    • Right-click on the ENSense_Temperatures Event node.
    • Select New Child/Implementation from the menu.
    • Go to the Implementation properties view and set the Implementation Type property to Sensing.

We have identified the event as a sensing event. Now we add the parameter direction:

A Summary of Steps

For a Tasking Machine definition:

  1. Add the Tasking Machine type (Auto etc).
  2. Set the task type (Periodic etc.).
  3. Set the task priority.
  4. Specify the task body.
  5. For sensing/actuating events, add the Event Type.

For a Shared Machine definition:

  1. Add the SharedMachine Machine type.

For an Environ Machine definition:

  1. Make the type an Environ Machine type.
  2. Set the task type Periodic; a shorter period than the shortest task period is best for simulation.
  3. Set the task priority.
  4. Specify the task body, it will contain a simulation of changes in the environment.
  5. For each sensing/actuating event, add the Event Type.

Invoking the Translators

  • To generate Ada code,
    • Right-Click on the composed machine, or any tasking machine in the development, select Code Generation/Translate Event-B to Ada.
    • Open the generated code directory in the project to view the source files. A refresh will be necessary to make the code visible. The .gpr file has been provided for AdaCore GPS users.
  • To create the Event-B model of the implementation,
    • Right-Click on the composed machine, or any tasking machine in the development, select Code Generation/Translate Tasking Event-B to Event-B.
    • The Event-B model should be updated with the flow control variables. Users are not able to manually edit the generated elements. The additions can be removed using the menu option Code Generation/Remove Generated Event-B

Generated Code

The Ada Code generated by the translator is available at the following links:

for simulation of environment without addressed variables, Heating_ControllerTutorial_Completed

for simulation of environment with addressed variables, Heating_Controller5AddressedSim_Completed

Removal of the environment task from the Heating_Controller5AddressedSim_Completed should be deployable.