Difference between pages "D45 General Platform Maintenance" and "Tasking Event-B Tutorial"

From Event-B
(Difference between pages)
Jump to navigationJump to search
imported>Tommy
 
imported>Andy
 
Line 1: Line 1:
= Core Platform Maintenance =
+
For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk
 +
=== Tasking Event-B Tutorial Overview ===
 +
This tutorial follows on from the abstract development described [http://wiki.event-b.org/index.php/Development_of_a_Heating_Controller_System here].
  
== Overview ==
+
This code generation tutorial extends the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces implementable Ada code, and also an Event-B model. It is a model of the implementation, and contains flow control variables that model the flow of execution through the task body. The Ada code is produced from an intermediate model that is not visible to the user. The Common Language model (CLM), is generated from the Tasking Event-B by a translation tool. Ada (and other implementations) may be generated from the CLM. An overview of Tasking Event-B can be found [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview here].
The Rodin platform versions concerned by this deliverable are:
 
* 2.1(08.02.2011),
 
* 2.2(01.06.2011),
 
* 2.2.2(01.08.2011),
 
* 2.3(04.10.2011),
 
* 2.4(31.01.2012),
 
* 2.5(30.04.2012).
 
This year, the maintenance carried on fixing identified bugs, although an emphasis was put on rectifying usability issues. Indeed, during the annual meeting in Nice, the WP9 members agreed to refocus on addressing some specific bugs and issues reported by DEPLOY partners, and wished resolved by the end of DEPLOY. Thus, no new features were implemented but those mentioned in the description of work. The tasks to be performed by the WP9 members were then scheduled, prioritized and regularly updated during the WP9 bi-weekly teleconferences. The updates allowed to capture and integrate rapidly some minor changes to enhance the usability of the platform which were required by the DEPLOY partners. The following paragraphs will give an overview of the the work that has been performed concerning maintenance on the existing platform components (i.e. core platform and plug-ins).
 
  
See the Release Notes<ref name="documentation">http://wiki.event-b.org/index.php/D32_General_Platform_Maintenance#Available_Documentation</ref> and the SourceForge<ref name=documentation>http://wiki.event-b.org/index.php/D45_General_Platform_Maintenance#Available_Documentation</ref> databases (bugs and feature requests) for details about the previous and upcoming releases of the Rodin platform.
+
In the example so far, the Heating Controller has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines modelling tasks, shared objects and the environment are identified, and extended with the appropriate implementation details.
  
Some other which were later added and prioritized are worth to mention:
+
The example/tutorial projects are are available in the [http://deploy-eprints.ecs.soton.ac.uk/304/ e-prints archive], or on [https://codegenerationd.svn.sourceforge.net/svnroot/codegenerationd/Examples/HeatingController_Tutorial_v0.1.4/ SVN].
:*Possibility to highlight patterns in the Proving UI,
 
:*A better output providing warnings and errors in case of wrong or missing building configurations,
 
:*The switch to Eclipse 3.7,
 
:*A Handbook to complete and enhance the existing documentation.
 
  
== Motivations ==
+
{| border="1"
The tasks to resolve the issues faced by the DEPLOY industrial partners have been listed and have been assigned to groups according to their priority. A high priority means a high need in the outcome of a given task. Group 1 has the highest priority, group 2 has an intermediate priority, and group 3 has the lowest priority. Group 4 concerns topics that could not be resourced during the lifetime of DEPLOY.
+
|Heating_ControllerTutorial_Completed
 
+
|An example project generating an environment simulation. Generates code, where environment variables are monitored and controlled using subroutine calls. Contains a completed Tasking Development with generated Event-B and Ada code.
{{SimpleHeader}}
 
|-
 
! scope=col | Group 1 (highest priority) || Responsible || Group 2 || Responsible || Group 3 || Responsible || Group 4
 
|-
 
|Performance <br /> - Core (large models, etc.) <br /> - GUI (incl. prover UI, edition, etc.) || SYSTEREL || Prover Performances <br /> - SMT provers integration <br /> - connection with Isabelle  <br /> - Mathematical extensions <br /> - ProB || . <br />SYSTEREL <br /> ETH Zürich <br /> Southampton/SYSTEREL <br /> Düsseldorf || Scalability <br /> - Generic instantiation <br /> - UML-B maintenance <br /> || . <br /> ETH Zürich/Southampton <br /> Southampton || Prover Integrity
 
|-
 
|Prover Performances <br /> - New rewriting rules / inference rules <br /> - Automatic tactics (preferences, timeout, etc.) || SYSTEREL || Scalability <br /> - Decomposition <br /> - Modularisation plug-in <br /> - Team-Based Development || . <br /> Southampton <br /> Newcastle <br /> Southampton ||Code Generation || Southampton ||Integrity of Code Generation
 
 
|-
 
|-
|ProB Disprover (incl. counter examples to DLF POs) || Düsseldorf || Plug-in incompatibilities || Newcastle
+
|Heating_ControllerTutorial_Step1
 +
|A bare project for step 1 of the [[Code_Generation_Tutorial#The_Tutorial |tutorial]].
 
|-
 
|-
|Stability (crash, corruption, etc.|| SYSTEREL || Model-based testing || Pitesti/Düsseldorf
+
|Heating_ControllerTutorial_Step2
|-
+
|A partially completed tasking development for steps 2, and 4 of the [[Code_Generation_Tutorial#The_Tutorial |tutorial]] (step 3 not required here).
|Editors || SYSTEREL/Düsseldorf || ProR || Düsseldorf
+
<!--|- -->
 +
<!--|Heating_Controller5AddressedSim_Completed-->
 +
<!--|A completed example that uses Addressed Variables in the tasks, and also in the environment simulation. Generates Memory Mapped IO for sensing and actuation.  -->
 +
<!--|- -->
 +
<!--|Heating_Controller5AddressedNotSim_Completed-->
 +
<!--|A completed example that uses Addressed Variables in the tasks only. Generates Deployable Memory Mapped IO for sensing and actuation. Similar to above but we discard the environment task from generated code.--> 
 
|}
 
|}
  
The platform maintenance, as it can be deduced from the above tables, mainly concerned stability and performance improvement. These topics will be discussed and detailed in a separate chapter about scalability improvements.<br>
 
 
Other improvements of utmost importance were made on the platform. These improvements either came from DEPLOY partners specific needs, or were corresponding to previously identified needs (listed in [http://wiki.event-b.org/index.php/Category:D32_Deliverable D32 - Model Construction tools & Analysis III Deliverable]).
 
Hence we review below the motivations of some noteworthy implemented features:
 
* Possibility to highlight patterns in the Prover UI
 
This feature came from a request of DEPLOY partners<ref name="searchInPUI">https://sourceforge.net/tracker/?func=detail&atid=651672&aid=3092835&group_id=108850</ref>, often facing the need to find particular patterns such as expressions in long predicates (e.g. long goals). Since Rodin 2.2, and its new Proving UI interface, a feature has been added, allowing to search and highlight a string pattern into the whole Proving UI views and editors. This function has also been enabled on direct selection of text in this UI.
 
* A better output providing warnings and errors in case of wrong or missing building configurations
 
This issue, often being seen as a bug or as a plug-in incompatibility, was raised when a user imports and tries to use a model on a platform with some missing required plug-ins. The user often thought his models corrupted whereas Rodin was not able to build them, and hid this information to the user. This is why, since Rodin 2.3, an output has been provided in such case, taking the form of warnings or errors that any user can understand and review.
 
* The switch to Eclipse 3.7
 
Due to the major improvements made every year in Eclipse releases and the continuously growing number of contributing projects, some of them used as basis for Rodin plug-ins, the Rodin platform follows the evolution and is adapted every year quickly to the latest Eclipse version available. This year, Rodin 2.3 originated the switch from Eclipse 3.6 to Eclipse 3.7.
 
* A Handbook to complete and enhance the existing documentation
 
At the DEPLOY Plenary Meeting in Zürich in 2010, it has been stated that the current documentation, in its state at that time, would not support an engineer starting using the tools without significant help of an expert<ref name="documentationoverhaul>http://wiki.event-b.org/index.php/User_Documentation_Overhaul</ref>. Significant efforts to improve the documentation were performed and coordinated by Düsseldorf, and took form of a handbook<ref name="RodinHandbook">http://handbook.event-b.org/</ref>. The Rodin handbook has the aim to minimize the access to an expert, by providing the necessary assistance to an engineer in the need to be productive using Event-B and the Rodin toolset. The contents of the handbook, user oriented, were originated by some contents of the Event-B wiki.
 
 
== Choices / Decisions ==
 
* Revisited task priority
 
This year, the process of giving priority to maintenance tasks was revisited according to the refocus mentioned above. The aim was to address all the major scalability issues before the end of DEPLOY. Thus, the requests coming from DEPLOY partners were given high priorities, and they were also prioritized against the already planned tasks coming from both DEPLOY partners and the Description of Work.
 
* Keep 32-bit versions of the Rodin platform on Linux and Windows systems
 
It was asked by end users to make both 32-bit and 64-bit versions of the Rodin platform available for Linux and Windows platforms. Only a 64-bit version of Rodin is available on Mac platforms as 32-bit Mac (early 2006) platforms are no longer maintained. The request to offer 64-bit was motivated by the possibility to increase for them the available Java heap size for some memory greedy platforms (these before Rodin 2.3). After having ensured to get all physical platforms to test the different versions, and despite the drawbacks of assembling and maintaining more platforms (5 platforms instead of 3), Rodin 2.4 has started a new era where Rodin platforms are available on Linux and Windows 64-bit as well as 32-bit.
 
 
== Available Documentation ==
 
The following pages give useful information about the Rodin platform releases:
 
* Release notes<ref>http://wiki.event-b.org/index.php/Rodin_Platform_Releases</ref>
 
Two trackers follow and document the platform status in terms of knows bugs and feature requests:
 
* Bugs,<ref>https://sourceforge.net/tracker/?group_id=108850&atid=651669</ref>
 
* Feature requests<ref>https://sourceforge.net/tracker/?group_id=108850&atid=651672</ref>.
 
The Rodin handbook is available as a PDF version, a HTML version, and help contents within Rodin<ref name="RodinHandbook">http://handbook.event-b.org/</ref>
 
 
== Status ==
 
By the end of DEPLOY, the ultimate version of the Rodin platform is 2.5.
 
One can download it on the sourceforge [http://sourceforge.net/projects/rodin-b-sharp/files/Core_Rodin_Platform/2.5/ repository] and read the [http://wiki.event-b.org/index.php/Rodin_Platform_2.5_Release_Notes release notes] on the wiki.
 
 
<!-- /////////////////////////////////////////////////////////////////////// -->
 
 
= Plug-in incompatibilities =
 
 
== Overview ==
 
Some plug-in incompatibilities occured and were continuously handled throught the lifetime of the project.
 
 
== Motivations ==
 
By its extensibility nature, the Rodin platform is susceptible to incompatibilities. Indeed, there are many ways in which incompatibilities could occur, and some occurred in the lifetime of DEPLOY. A good example, is the dependency management. Suppose that a bundle x_v1.0 is needed by a plug-in A (i.e. a dependency from A has been defined to x in at most the version 1.0) and installed in Rodin. Furthermore the plug-in x_v1.1 is needed by a plug-in B. Both versions 1.0 and 1.1 of x could not be installed and used at the same time and thus create some usage incompatibility.
 
 
== Choices / Decisions ==
 
It has been decided in cooperation with all the WP9 partners to find better ways to address the plug-in incompatibility issues. First of all, the various partners refined the concept of "plug-in incompatibility". Hence, various aspects could be identified and some specific answers were given to each of them. The user could then defined more clearly the incompatibility faced. Plug-in incompatibilities can be separated in two categories:
 
:* Rodin platform/plug-in incompatibilities, due to some incorrect matches between Rodin included packages and the plug-in dependencies (i.e. required packages). These incompatibilities, when reported, allowed the plug-in developers to contact SYSTEREL in charge of managing the packages shipped with a given version of Rodin. It could also allow traceability of incompatibilities and information to the user through a specific and actualized table on each Rodin release notes page on the Wiki<ref name="incompTableA">http://wiki.event-b.org/index.php/Rodin_Platform_Releases#Current_plug-ins</ref>.
 
:* Plug-in/plug-in incompatibilities, due to some incorrect matches between needed/installed packages, or API/resources incompatible usage. A table was created on each release notes wiki page, and a procedure was defined<ref name="incompTableB">http://wiki.event-b.org/index.php/Rodin_Platform_Releases#Known_plug-in_incompatibilities</ref> so that identified incompatibilities are listed and corrected by the concerned developers.
 
It appeared that cases of using a model which references some missing plug-ins were formerly often seen as compatibility issues although they were not.<br>
 
After the incompatibilities have been identified, the concerned developing counterparts assigned special tasks and coordinated to solve issues as soon as possible. Incompatibilities are often due to little glitches or desynchronisation. As a result, direct coordination of counterparts appeared to be appropriate because of its promptness and effectiveness.
 
 
== Available Documentation ==
 
*The process to report plug-in incompatibilities is documented on each release notes page right after the plug-in availability tables. [http://wiki.event-b.org/index.php/Rodin_Platform_2.4_External_Plug-ins][http://wiki.event-b.org/index.php/Rodin_Platform_2.5_External_Plug-ins]
 
 
== Status ==
 
As the time of writing this deliverable, no plug-in incompatibilities are left or have been reported between the platform and plug-ins or between plug-ins.
 
 
<!-- /////////////////////////////////////////////////////////////////////// -->
 
 
= Mathematical extensions/ Theory Plug-in =
 
 
== Overview ==
 
Mathematical extensions have been co-developed by Systerel (for the Core Rodin platform) and Southampton (for the Theory plug-in). The main purpose of this new feature was to provide the Rodin user with a way to extend the standard Event-B mathematical language by supporting user-defined operators, basic predicates and algebraic types. Along with these additional notations, the user can also define new proof rules (prover extensions).
 
The scope of the ongoing work on the Theory plug-in centers around bug fixes, improving usability and performance and exploring other venues for operator definitions.
 
 
== Motivations ==
 
The Theory plug-in provides a high-level interface to the Rodin core platform capabilities which enables the definition of mathematical and prover extensions grouped into modules called theories. These mathematical and prover extensions are new algebraic types, new operators/predicates and new proof rules. Theories are developed in the Rodin workspace, and proof obligations are generated to validate prover and mathematical extensions. When a theory is completed and (optionally) validated, the user can make it available for use in models (this action is called the deployment of a theory). Theories are deployed to the current workspace (i.e., Workspace Scope), and the user can use any defined extensions in any project within the workspace.
 
The Rule-based Prover was originally devised to provide a usable mechanism for user-defined rewrite rules through theories. Theories were, then, deemed a natural choice for defining mathematical extensions as well as proof rules to reason about such extensions. In essence, the Theory plug-in provides a systematic platform for defining and validating extensions through a familiar technique: proof obligations.
 
 
Support for using polymorphic theorems in proofs was added in version 1.1.
 
 
== Choices / Decisions ==
 
The Theory plug-in contributes a theory construct to the Rodin database. Theories were used in the Rule-based Prover (before it was discontinued) as a placeholder for rewrite rules. Given the usability advantages of the theory component, it was decided to use it to define mathematical extensions (new operators and new datatypes). Another advantage of using the theory construct is the possibility of using proof obligations to ensure that the soundness of the formalism is not compromised. Proof obligations are generated to validate any properties of new operators (e.g., associativity). With regards to prover extensions, it was decided that the Theory plug-in inherits the capabilities to define and validate rewrite rules from the Rule-based Prover. Furthermore, support for a simple yet powerful subset of inference rules is added, and polymorphic theorems can be defined within the same setting. Proof obligations are, again, used as a filter against potentially unsound proof rules.
 
 
== Available Documentation ==
 
* Pre-studies (states of the art, proposals, discussions)
 
** [http://deploy-eprints.ecs.soton.ac.uk/216/ ''Proposals for Mathematical Extensions for Event-B'']
 
** [http://deploy-eprints.ecs.soton.ac.uk/251/ ''Mathematical Extension in Event-B through the Rodin Theory Component'']
 
** [http://wiki.event-b.org/index.php/Constrained_Dynamic_Parser#Design_Alternatives ''Generic Parser's Design Alternatives'' ]
 
** [http://wiki.event-b.org/index.php/Structured_Types ''Theoretical Description of Structured Types'']
 
* Technical details (specifications)
 
** [http://wiki.event-b.org/index.php/Mathematical_Extensions ''Mathematical_Extensions wiki page'']
 
** [http://wiki.event-b.org/index.php/Constrained_Dynamic_Lexer ''Constrained Dynamic Lexer wiki page'']
 
** [http://wiki.event-b.org/index.php/Constrained_Dynamic_Parser ''Constrained Dynamic Parser wiki page'']
 
** [http://wiki.event-b.org/index.php/Theory_Plug-in ''Theory plug-in wiki page]
 
** [http://wiki.event-b.org/index.php/Records_Extension ''Records Extension Documentation on wiki'']
 
* User's guides
 
** [http://wiki.event-b.org/images/Theory_UM.pdf ''Theory Plug-in User Manual'']
 
 
== Status ==
 
Work on the Theory plug-in includes:
 
* Bug fixes.
 
* Usability improvements.
 
* Exploring other potential ways of defining operators and types (e.g., axiomatic definitions).
 
 
<!-- /////////////////////////////////////////////////////////////////////// -->
 
 
= Decomposition =
 
 
== Overview ==
 
Decomposition can advantageously be used to decrease the complexity and increase the modularity of large systems, especially after several refinements. Main benefits are the distribution of proof obligations over the sub-components which are expected to be easier to be discharged and the further refinement of independent sub-components in parallel introducing team development of a model which is attractive for the industry. Shared variable and shared event decomposition are supported in the same tool: the former seems to be suitable when designing concurrent programs while the latter seems to be particularly suitable for message-passing distributed programs. The tool was initially developed in ETH Zurich. Further development of the tool was a collaboration between ETH Zurich, Southampton and Systerel. After some user feedback, the tool was improved in terms of usability and performance. The ongoing work aims for a more automated tool that can propagate changes in the sub-components and minimise the user intervention as much as possible while maintaining or enhancing the performance.
 
 
== Motivations ==
 
The ''top-down'' style is one of the most used in modelling in Event-B. It allows the introduction of new events and data-refinement of variables during refinement steps. A consequence of this development style is an increasing complexity of the refinement process when dealing with many events and state variables. The main purpose of the model decomposition is precisely to address such difficulty by separating a large model into smaller components. Two methods have been identified for the Event-B decomposition: shared variable (proposed by Abrial) and shared event (proposed by Butler). We developed a plug-in in the Rodin platform that supports these two decomposition methods for Event-B. Because decomposition is monotonic, the generated sub-components can be further refined independently. Therefore we can expand the team development options: several developers share parts of the same model and work independently in parallel. Moreover the decomposition also partitions the proof obligations which are expected to be easier to discharge in sub-components.
 
 
== Choices / Decisions ==
 
The tasks performed on the decomposition plug-in were focused on consolidation.
 
 
== Available Documentation ==
 
*[http://wiki.event-b.org/index.php/Decomposition_Plug-in_User_Guide ''The Decomposition Plug-in User Guide'']
 
*[http://wiki.event-b.org/index.php/Event_Model_Decomposition ''The event model decomposition wiki page'']
 
 
== Status ==
 
The decomposition plug-in is available in version 1.2.2 and works on Rodin 2.4 and 2.5. It is available from the main Rodin update site.
 
 
<!-- /////////////////////////////////////////////////////////////////////// -->
 
 
= Team-Based Development=
 
== Overview ==
 
The Team-Based Development plug-in enables Rodin models to be stored in a version repository such as SVN. During the final year of DEPLOY, the development concerned mostly consolidation and interface enhancement.
 
 
== Motivations ==
 
To achieve the storage of Rodin models in SVN, the Team-Based Development plug-in allows maintaining a synchronised copy of the model resources in an EMF format. EMF comparison tools can then be used to examine differences between versions.
 
 
== Choices / Decisions ==
 
The EMF default XMI format was used to store models in a form that can be accessed independently of the Rodin database. Since an EMF framework for Event-B already existed (but relied on serialisation into the Rodin database), it was easy to provide an option to serialise into the XMI format. The EMF compare was customised to provide a more user friendly comparison.
 
 
== Available Documentation ==
 
* [http://wiki.event-b.org/index.php/Team-based_development Team-based Development Documentation on wiki]
 
 
== Status ==
 
The Team-Based Development plug-in is available on the main Rodin update site. Currently 3-way comparison is not supported. (3-way comparison is needed if 2 people check out and change the model so that there are 2 working copies as well as a repository baseline).
 
 
<!-- /////////////////////////////////////////////////////////////////////// -->
 
 
= Modularisation =
 
== Overview ==
 
Modularisation offers an intuitive yet rigorous mechanism for structuring large developments. Its main distinguishing feature is the use of ''interface'' components - a special form of an abstract machine defining callable operations and external variables. To decompose a design using modularisation a designer needs to identify a self-contained part of a design and captures it in an independent ''module''. A module is an Event-B development starting with an interface as its top-level abstraction. Modules may be included into machines and offer ''operations'' that may be used to define actions of an including machine. Variables of an interface may not be modified directly and thus the invariant property of an interface holds at all times. An essential part of a decomposition step is identifying a part of an abstract state that is removed and said to be realised by one of the included modules. Modularisation works well for sequential and concurrent systems.
 
 
== Motivations ==
 
The major motivation for the initial design and the continuing development of the modularisation extension is the desire to deal with large-scale specification using Event-B notation and refinement-based development. Generally, users find the modularisation approach fairly intuitive and flexible.
 
 
== Choices / Decisions ==
 
Modularisation is not a simple extension and it changes both the syntax and semantics (the set of proof obligations) of Event-B. It is possible to encode all of the modularisation concepts directly in the Event-B notation. However, it was deemed very important to offer high-level structuring concepts - interfaces and operations - that engineers may relate to. Although an operation call in modularisation is merely a metaphore, the syntactic resemblances of an procedure call in a programming language significantly improves model readability. A similar idea motivated the introduction of an interface component - sensible syntax and efficient set of proof obligations are paramount.
 
 
== Available Documentation ==
 
* See the [[Modularisation_Plug-in]]  wiki page
 
 
== Status ==
 
The modularisation plug-in is available for Platform versions 1.6 - 2.4. Starting from Platform version 2.3, modularisation is compatible with the ProB animator and model checker. The modularisation is not compatible with Camille text editor.
 
 
<!-- /////////////////////////////////////////////////////////////////////// -->
 
 
= UML-B =
 
== Overview ==
 
The UML-B plug-in supports modelling in a UML-like diagrammatic notation with conversion to Event-B for verification. UML-B supports class and state machine diagrams as well as a project structure diagram (showing machines and contexts). UML-B continues to be supported but currently is not undergoing new development. Some enhancements were made last year in order to improve the usability of state machines, however, most new development concentrates on the new Event-B diagrammatic extensions to Event-B (such as the Event-B Statemachines plug-in).
 
  
The Event-B Statemachines plug-in is a new tool, based on the UML-B state machine diagrams, which allows to integrate state machines into normal Event-B machines. It provides a graphical diagram editor, an Event-B generator and, as an optional plug-in, diagram animator for ProB.
 
  
== Motivations ==
+
== Using the Tasking Extension ==
The Event-B Statemachines plug-in has been introduced as a result of the necessity to integrate higher level constructs into established Event-B modelling process. From the experience of working with the UML-B tool it became apparent that a tighter integration is required between Event-B models under development and high level extensions such as state machines. In particular, this integration should be flexible enough to make it easy for an user to add new constructs at any point of Event-B development and work with them through refinement, which is a key feature of the Event-B language and Rodin tool.
+
The steps needed to generate code from an Event-B model, in this tutorial, are as follows,
 +
* Step 1 - [[Tasking Event-B_Tutorial#Providing the Annotations for Implementations|Add Tasking annotations]].
 +
* Step 2 - [[Tasking Event-B_Tutorial#Invoking the Translation|Invoke translators]].
  
== Choices / Decisions ==
+
==== 'Flattening' the Implementation Machines ====
For the Event-B Statemachines plug-in the following key decisions were made:
 
* The UML-B state machines example was taken as a concept.
 
* Well-established Eclipse development frameworks — EMF and GMF — were chosen for implementation of the new plug-in and simplified (from the original UML-B state machines) EMF metamodel and diagram have been implemented.
 
* The integration idea between Event-B and state machines was based on EMF extension mechanism and serialisation principle: a state machine was designed as an extension to EMF Event-B metamodel that would be serialised as a string to an attribute in Rodin database, thus making the details of it transparent to Rodin.
 
* For the translation of state machines to Event-B the QVT framework has been selected, considering it as a well-supported framework, used in other Eclipse projects such as GMF, and more declarative nature of it compared to pure Java, which would improve maintainability.
 
  
As a result of work on Event-B Statemachines plug-in a set of additional plug-ins has been developed that forms a framework to support developer effort in implementing other similar tools and high level extensions for Event-B. These plug-ins include generic serialised persistence and navigator support for new EMF extensions, generic diagram metamodel and navigator actions, generic refinement and Event-B generator modules for new extensions.
+
?????????????
  
== Available Documentation ==
+
==== Providing the correct Composed Machine ====
* [http://wiki.event-b.org/index.php/Event-B_Statemachines "Event-B State-machines Documentation on wiki"]
 
  
== Status ==
+
?????????????
The Event-B State machines plug-in is available on the main Rodin update site.
 
  
<!-- /////////////////////////////////////////////////////////////////////// -->
 
  
= ProR =
+
===== The Temp_Ctrl_Task1Impl Machine =====
 +
In the partially complete tutorial project we have already identified the ''Temp_Ctrl_Task1Impl'' as an ''Auto Task'' Tasking Machine, by adding the ''Auto Task'' extension. ''Auto Tasks'' are tasks that will be declared and defined in the ''Main'' procedure of the implementation. The effect of this is that the ''Auto Tasks'' are created when the program first loads, and then activated (made ready to run) before the ''Main'' procedure body runs. We have set the task type to ''Periodic'', and set a period of 250 milliseconds. We have provided a screenshot of the completed ''Temp_Ctrl_Task1Impl'' [http://wiki.event-b.org/images/Temp_Ctrl_Task1Impl.pdf here], it can be read in conjunction with the tutorial.
  
== Overview ==
+
The next step is to construct the task body using the TaskBody Editor, with control constructs such as sequence, branch, loop and output. These constructs are discussed in the [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview overview] of Tasking Event-B. We will now complete the sequence that has been partially defined in the task body.
ProR is a replacement of the original requirements plug-in, which got discontinued in 2010.  It is based on the OMG ReqIF standard<ref name="reqif">http://www.omg.org/spec/ReqIF/</ref>, which provides interoperability with industry tools. It evolved into the Eclipse Foundation project "Requirements Modeling Framework" (RMF<ref name="rmf">http://eclipse.org/rmf</ref>), resulting in significant visibility.  ProR is independent from Rodin.  Integration is achieved with a separate plug-in that provides support for traceability and model integration.
 
  
== Motivations ==
+
?????????????????????????????
While the original requirements plug-in for Rodin was useful as a prototype, a number of shortcomings lead to a new development.  In particular, the original plug-in was a traceability tool with externally managed requirements.  With ProR, requirements are authored and edited within Eclipse.  The original plug-in supported only a limited number of attributes and flat (unstructured) requirements.  ProR supports all data structures that the ReqIF standard<ref name="reqif">http://www.omg.org/spec/ReqIF/</ref> supports. Further, ReqIF-support for industry tools like Rational DOORS, MKS or IRqA is expected in the near future, while the original plug-in required a custom adaptor for each data format.
 
  
ProR is developed independently from Rodin.  Dependencies to Rodin exist only in the Rodin integration plug-in. This significantly decreases the maintenance effort for the integration plugin, while increasing the visibility of ProR in the Open Source community.  The move of ProR from the University of Düsseldorf to the Eclipse Foundation increases visibility even further.  The Rodin integration plug-in is maintained as an independent project at GitHub.
+
By relating the sensing events in this way we describe a simulation of the interaction between the task and environment. The details of the interaction are embodied in the events themselves; and this is implemented in the simulation code by reading the values of the environment variables.  
  
== Choices / Decisions ==
+
Next we look at the sensing event ''TCSense_Temperatures'' event in ''Temp_Ctrl_Task1Impl''. Sensing (and actuating) can be viewed as a kind of synchronisation. Synchronisation between tasks and shared objects are represented as subroutine calls. The sensing/actuating synchronisations only occur between tasks and the environment.
The following key decisions were made when developing ProR:
 
  
* '''New development, rather than continuing the original plug-in''' - the architecture of ProR differs significantly from that of the original plug-in (as explained earlier). In addition, new technologies like EMF promised a cleaner, more powerful framework for an implementation.
+
*'''Add The Sensed Event Extension'''.
 +
** Right-click on the ''TCSense_Temperatures'' Event node.
 +
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Sensing''.
  
* '''ReqIF as the underlying data model''' - the ReqIF standard<ref name="reqif">http://www.omg.org/spec/ReqIF/</ref> is gaining traction and promises interoperability with industry tools.  In addition, a digital version of the data model was available for free and could serve as the foundation for the model code.
+
===== The Shared Machine =====
  
* '''The Eclipse Modeling Framework''' (EMF) was identified as a technology that would allow a quick and clean foundation for an implementation. Further, the Rodin EMF-plug-in represents a convenient interface for integrating ProR and ProBLast, the digital data model from the OMG could be imported directly into EMF and used for generating the model code.
+
The next step is to identify the ''Shared_Object1Impl'' machine as a ''Shared Machine''. A screenshot of the [http://wiki.event-b.org/images/Shared_Object1Impl.pdf Shared_Object1Impl] shared machine can be read in conjunction with the text.
 +
* Optionally collapse open branches of the EMF editor to remove clutter.   
 +
* Right-click on the ''Shared_Object'' Machine node in the Rose Editor.
 +
* Select ''New Child/Shared Machine'' from the menu.
  
* '''Keeping ProR independent from Rodin''' - There is significant interest in ReqIF right now, but this interest is unrelated to formal methods. By providing an implementation that is independent from Rodin, we have a much larger target group of potential users and developersBy carefully designing extension points, we can still provide a powerful Rodin integration.
+
===== The Environ Machine =====
 +
In the prepared machine we have identified the ''Envir1Impl'' as an ''Environ Machine'', by adding the ''Environ Machine'' extension. ''Envir1Impl'' models a task that simulates the environment, and can be used to generate simulation code. For deployment in a non-simulated environment the environ machine's generated code can be ignored; we provide details of non-simulated code using addressed variables later. As before, a screenshot is available [http://wiki.event-b.org/images/Envir1Impl_2.pdf here]. In the prepared Environment Machine we have already set task type to ''Periodic'' extension, and set a period of 100 milliseconds.
 +
   
 +
We will now complete the sequence that has been partially defined in the task body. The following specification models simulation of a temperature change; the temperature value is represented by a monitored variable in the environment. The generated code simulates the temperature change in the environment by changing the monitored value.
  
* '''Eclipse Foundation Project''' - we were actively establishing an open source community around ProR.  By recruiting engaged partners early on, development progressed faster than anticipated.  By becoming an Eclipse Foundation project <ref name="rmf">http://eclipse.org/rmf</ref>, we exceeded our goals in this respect.
+
*'''Model Temperature Change in the environment'''.
 +
??????
  
== Available Documentation ==
+
* Output to the screen during the simulation can be specified as follows:
* ProR at the Eclipse Foundation <ref name="rmf">http://eclipse.org/rmf</ref>
+
??????
* ProR Documentation for end users and plugin developers <ref>http://pror.org</ref>
 
  
== Status ==
+
The generated code will print the text, and the value of the variable, to the screen.  
ProR took on a life on its own as part of the Requirements Modeling Framework<ref name="rmf">http://eclipse.org/rmf</ref>.  It is currently in the incubation stage of an Eclipse project.  There are currently five committers in total, with two from the Rodin project, namely Michael Jastram (Project Lead) and Lukas Ladenberger.
 
  
The Rodin integration supports:
+
The final step is to complete the ''ENSense_Temperatures'' event. The event is a sensing event, sensing is a kind of synchronisation, it synchronises with the ''TCSense_Temperatures'' event in the ''Temp_Ctrl_Task1'' tasking machine. We add formal parameters annotations corresponding to the actual parameters that we have already defined in the task.
  
* Creating traces between model elements and requirements,
+
*'''Add The Sensed Event Extension'''.
* Highlighting of model elements in the requirements text,
+
** Right-click on the ''ENSense_Temperatures'' Event node.
* Marking of invalidated traces, where either the requirement or model element had changed.
+
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Sensing''.
  
The Rodin integration is hosted at GitHub.
+
We have identified the event as a sensing event. Now we add the parameter direction:
  
<!-- /////////////////////////////////////////////////////////////////////// -->
+
===== A Summary of Steps =====
= BMotion Studio =
+
For a Tasking Machine definition:
 +
# Add the Tasking Machine type (Auto etc).
 +
# Set the task type (Periodic etc.).
 +
# Set the task priority.
 +
# Specify the task body.
 +
# For sensing/actuating events, add the Event Type.
  
== Overview ==
+
For a Shared Machine definition:
BMotion Studio is a visual editor which enables the developer of a formal model to set-up easily a domain specific visualisation for discussing it with the domain expert. BMotion Studio comes with a graphical editor that allows to create a visualisation within the modeling environment. Also, it does not require to use a different notation for gluing the state and its visualisation. BMotion Studio is based on the ProB animator and is integrated into Rodin. However, BMotion Studio is independent from Rodin. Integration is achieved with a separate plug-in.
+
# Add the ''SharedMachine'' Machine type.
  
* BMotion Studio has been quite successful, and besides a number of bug fixes and some performance profiling and tuning, the useability of the tool was improved.
+
For an Environ Machine definition:
* One of our students made experiments towards visualizing industry standards with BMotion Studio. The first experiments were quite successful.
+
# Make the type an Environ Machine type.
* First experiments towards visualizing mathematical assertions found in formal specifications using Venn Diagrams/Euler Diagrams/Constraint Diagrams were made.
+
# Set the task type Periodic; a shorter period than the shortest task period is best for simulation.
 +
# Set the task priority.
 +
# Specify the task body, it will contain a simulation of changes in the environment.
 +
# For each sensing/actuating event, add the Event Type.
  
== Motivations ==
+
== Invoking the Translators ==
The communication between a developer and a domain expert (or manager) is very important for successful deployment of formal methods. On the one hand it is crucial for the developer to get feedback from the domain expert for further development. On the other hand the domain expert needs to check whether his expectations are met. To avoid this problem, it is useful to create domain specific visualisations. However, creating the code that defines the mapping between a state and its graphical representation is a rather time consuming task. It can take several weeks to develop a custom visualisation. To overcome this problem, BMotion Studio comes with a graphical editor that allows to create a visualisation  with static images and drag and drop within the modelling environment, not requiring additional skills.
 
  
An often stated limitation in using formal methods is the difficulty in understanding the formal notation. To overcome this problem and to support the user we made first experiments towards visualizing mathematical assertions found in formal specifications using Venn Diagrams/Euler Diagrams/Constraint Diagrams.
+
* To Generate Ada,
 +
** Right-Click on the composed machine, or any machine in the development, select ''Code Generation/Translate Event-B to Ada''.
 +
** Open the generated ''code'' directory in the project to view the source files. A refresh will be necessary to make the code visible. The .gpr file has been provided for AdaCore GPS users.
  
== Choices / Status ==
+
* To create the Event-B model of the implementation,
The following key decisions were made when developing BMotion Studio:
+
** Right-Click on the composed machine, or any machine in the development, select ''Code Generation/Translate Tasking Event-B to Event-B''.
* '''Keeping BMotion Studio user-friendly''' - The user should be able to create a visualization not requiring additional skills in programming languages.
 
* '''ProB as animator for providing state information''' - With the ProB animator, we have a powerful tool for interacting with the model.
 
* '''Provide extensibility for specific domains''' - By carefully designing extension points, we can provide a powerful integration for specific domains.
 
* '''Keeping BMotion Studio independent from Rodin''' - By providing an implementation that is independent from Rodin, we have a much larger target group of potential users and developers.
 
  
== Available Documentation ==
+
== Optional Annotations for Addressed Variables ==
* BMotion Studio Documentation for end users and plugin developers <ref>http://www.stups.uni-duesseldorf.de/BMotionStudio</ref>
+
To use memory mapped IO (Addressed Variables) in our generated code we can specify which addresses to use in our [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Implementing_Events sensing and actuating events]. The addresses are added to the event parameters of  a Tasking Machine's sensing and actuating events. The addresses may also be added to the Environ machine's machine variables, for use in simulation. It should be noted that the use of addressed variables, in simulation, has to be done cautiously to prevent memory errors. In the current release the translator generates code for all of these situations, and the environment task should be discarded if simulation is not required.
* Context sensitive help is in work
 
  
== Status ==
+
We now add addressed variable to the ''TCSense_Temperatures'' event in ''Temp_Ctrl_Task1Impl'', a PrettyPrint view is available [http://wiki.event-b.org/images/AddressedVarsTask.pdf here].
The tool is available as a part of the ProB animator and is ready for use for visualizing Event-B models within the Rodin tool. Of course, we are working on new features.
 
  
<!-- /////////////////////////////////////////////////////////////////////// -->
+
* '''Add Address Information to Event Parameters'''.
= Mode/FT Views =
+
** Right-click on the parameter node.
 +
** Select ''New Child/Addressed Variable''.
 +
** Go to the ''Addressed Variable'' properties view and set the ''Address'' and ''Base'' properties to appropriate values.
  
== Overview ==
+
Reads of the monitored variables of the sensing event can therefore be made directly from the address specified. Their is also a ''base'' property which can be set to indicate the base of the property value. The default value is 16. The environment simulation may also make use of addressed variables, but in this case the extension is made to the Environ Machine machine variables and used as shown [http://wiki.event-b.org/images/AddressedVarsEnvir.pdf here].
The Mode/FT Views plug-in is a modelling environment for constructing modal and fault tolerance features in a diagrammatic form and formally linking them to Event-B models. The consistency conditions between the modal/FT views and Event-B models are ensured by additional proof obligations. The views form a refinement chain of system modal and fault tolerant behaviour which contribute to the main Event-B development. The views reserve a place for tracing modal and FT requirements.
 
  
== Motivations ==
+
Invocation of the translators proceeds as detailed above.
There are two major motivations for creating the Mode/FT Views plug-in:
 
* An overview of the requirements documents within DEPLOY indicated that systems are often described in terms of operational modes and configurations. This led to a work on formal definition of modal systems.
 
* Fault-tolerance is the crucial part of the behaviour of dependable critical systems that needs to benefit from formal modelling as functionality does. The requirements documents for the pilot studies in DEPLOY contain a high number of requirements related to fault handling and fault tolerant behaviour. A significant part of them are also described by using recoveries and degraded modes.
 
The plug-in provides an environment for specifying modal and fault tolerant behaviours which are often interrelated. By having a refinement chain of system-level modal diagrams, the development benefits from additional modelling constraints and improved requirements traceability.
 
  
== Choices / Decisions ==
+
== Generated Code ==  
The following key decisions were made when developing Mode/FT Views:
+
The Ada Code generated by the translator is available at the following links:
* '''The Eclipse Graphical Modelling Framework (GMF)''' was used as a platform for building a user-friendly modelling environment.
 
* '''Proof obligations for the views are injected into the standard PO repository of the models''' - This ensures that all the tools related to theorem proving can be used in the same way as they are used for Event-B proof obligations.
 
  
== Available Documentation ==
+
for simulation of environment without addressed variables, [http://wiki.event-b.org/images/Code_Heating_ControllerTutorial_Completed.pdf Heating_ControllerTutorial_Completed]
* Mode/FT Views documentation for users <ref name="modeft">http://wiki.event-b.org/index.php/Mode/FT_Views</ref>
 
* Papers
 
** [http://deploy-eprints.ecs.soton.ac.uk/105/ ''Structuring Specifications with Modes'']
 
** [http://deploy-eprints.ecs.soton.ac.uk/153/ ''Modal Systems: Specification, Refinement and Realisation'']
 
** [http://deploy-eprints.ecs.soton.ac.uk/253/ ''On Fault Tolerance Reuse during Refinement'']
 
  
== Status ==
+
for simulation of environment with addressed variables, [http://wiki.event-b.org/images/Code_Heating_Controller5AddressedSim_Completed.pdf Heating_Controller5AddressedSim_Completed]
The Mode/FT Views is a plug-in for the Rodin platform. The tool is available from its update site <ref name="modeft">http://wiki.event-b.org/index.php/Mode/FT_Views</ref>
 
  
= Shared references =
+
Removal of the environment task from the ''Heating_Controller5AddressedSim_Completed'' should be deployable.
<references/>
 
  
[[Category:D45 Deliverable]]
+
[[Category:User documentation]]

Revision as of 09:39, 29 November 2011

For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk

Tasking Event-B Tutorial Overview

This tutorial follows on from the abstract development described here.

This code generation tutorial extends the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces implementable Ada code, and also an Event-B model. It is a model of the implementation, and contains flow control variables that model the flow of execution through the task body. The Ada code is produced from an intermediate model that is not visible to the user. The Common Language model (CLM), is generated from the Tasking Event-B by a translation tool. Ada (and other implementations) may be generated from the CLM. An overview of Tasking Event-B can be found here.

In the example so far, the Heating Controller has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines modelling tasks, shared objects and the environment are identified, and extended with the appropriate implementation details.

The example/tutorial projects are are available in the e-prints archive, or on SVN.

Heating_ControllerTutorial_Completed An example project generating an environment simulation. Generates code, where environment variables are monitored and controlled using subroutine calls. Contains a completed Tasking Development with generated Event-B and Ada code.
Heating_ControllerTutorial_Step1 A bare project for step 1 of the tutorial.
Heating_ControllerTutorial_Step2 A partially completed tasking development for steps 2, and 4 of the tutorial (step 3 not required here).


Using the Tasking Extension

The steps needed to generate code from an Event-B model, in this tutorial, are as follows,

'Flattening' the Implementation Machines

?????????????

Providing the correct Composed Machine

?????????????


The Temp_Ctrl_Task1Impl Machine

In the partially complete tutorial project we have already identified the Temp_Ctrl_Task1Impl as an Auto Task Tasking Machine, by adding the Auto Task extension. Auto Tasks are tasks that will be declared and defined in the Main procedure of the implementation. The effect of this is that the Auto Tasks are created when the program first loads, and then activated (made ready to run) before the Main procedure body runs. We have set the task type to Periodic, and set a period of 250 milliseconds. We have provided a screenshot of the completed Temp_Ctrl_Task1Impl here, it can be read in conjunction with the tutorial.

The next step is to construct the task body using the TaskBody Editor, with control constructs such as sequence, branch, loop and output. These constructs are discussed in the overview of Tasking Event-B. We will now complete the sequence that has been partially defined in the task body.

?????????????????????????????

By relating the sensing events in this way we describe a simulation of the interaction between the task and environment. The details of the interaction are embodied in the events themselves; and this is implemented in the simulation code by reading the values of the environment variables.

Next we look at the sensing event TCSense_Temperatures event in Temp_Ctrl_Task1Impl. Sensing (and actuating) can be viewed as a kind of synchronisation. Synchronisation between tasks and shared objects are represented as subroutine calls. The sensing/actuating synchronisations only occur between tasks and the environment.

  • Add The Sensed Event Extension.
    • Right-click on the TCSense_Temperatures Event node.
    • Select New Child/Implementation from the menu.
    • Go to the Implementation properties view and set the Implementation Type property to Sensing.
The Shared Machine

The next step is to identify the Shared_Object1Impl machine as a Shared Machine. A screenshot of the Shared_Object1Impl shared machine can be read in conjunction with the text.

  • Optionally collapse open branches of the EMF editor to remove clutter.
  • Right-click on the Shared_Object Machine node in the Rose Editor.
  • Select New Child/Shared Machine from the menu.
The Environ Machine

In the prepared machine we have identified the Envir1Impl as an Environ Machine, by adding the Environ Machine extension. Envir1Impl models a task that simulates the environment, and can be used to generate simulation code. For deployment in a non-simulated environment the environ machine's generated code can be ignored; we provide details of non-simulated code using addressed variables later. As before, a screenshot is available here. In the prepared Environment Machine we have already set task type to Periodic extension, and set a period of 100 milliseconds.

We will now complete the sequence that has been partially defined in the task body. The following specification models simulation of a temperature change; the temperature value is represented by a monitored variable in the environment. The generated code simulates the temperature change in the environment by changing the monitored value.

  • Model Temperature Change in the environment.

??????

  • Output to the screen during the simulation can be specified as follows:

??????

The generated code will print the text, and the value of the variable, to the screen.

The final step is to complete the ENSense_Temperatures event. The event is a sensing event, sensing is a kind of synchronisation, it synchronises with the TCSense_Temperatures event in the Temp_Ctrl_Task1 tasking machine. We add formal parameters annotations corresponding to the actual parameters that we have already defined in the task.

  • Add The Sensed Event Extension.
    • Right-click on the ENSense_Temperatures Event node.
    • Select New Child/Implementation from the menu.
    • Go to the Implementation properties view and set the Implementation Type property to Sensing.

We have identified the event as a sensing event. Now we add the parameter direction:

A Summary of Steps

For a Tasking Machine definition:

  1. Add the Tasking Machine type (Auto etc).
  2. Set the task type (Periodic etc.).
  3. Set the task priority.
  4. Specify the task body.
  5. For sensing/actuating events, add the Event Type.

For a Shared Machine definition:

  1. Add the SharedMachine Machine type.

For an Environ Machine definition:

  1. Make the type an Environ Machine type.
  2. Set the task type Periodic; a shorter period than the shortest task period is best for simulation.
  3. Set the task priority.
  4. Specify the task body, it will contain a simulation of changes in the environment.
  5. For each sensing/actuating event, add the Event Type.

Invoking the Translators

  • To Generate Ada,
    • Right-Click on the composed machine, or any machine in the development, select Code Generation/Translate Event-B to Ada.
    • Open the generated code directory in the project to view the source files. A refresh will be necessary to make the code visible. The .gpr file has been provided for AdaCore GPS users.
  • To create the Event-B model of the implementation,
    • Right-Click on the composed machine, or any machine in the development, select Code Generation/Translate Tasking Event-B to Event-B.

Optional Annotations for Addressed Variables

To use memory mapped IO (Addressed Variables) in our generated code we can specify which addresses to use in our sensing and actuating events. The addresses are added to the event parameters of a Tasking Machine's sensing and actuating events. The addresses may also be added to the Environ machine's machine variables, for use in simulation. It should be noted that the use of addressed variables, in simulation, has to be done cautiously to prevent memory errors. In the current release the translator generates code for all of these situations, and the environment task should be discarded if simulation is not required.

We now add addressed variable to the TCSense_Temperatures event in Temp_Ctrl_Task1Impl, a PrettyPrint view is available here.

  • Add Address Information to Event Parameters.
    • Right-click on the parameter node.
    • Select New Child/Addressed Variable.
    • Go to the Addressed Variable properties view and set the Address and Base properties to appropriate values.

Reads of the monitored variables of the sensing event can therefore be made directly from the address specified. Their is also a base property which can be set to indicate the base of the property value. The default value is 16. The environment simulation may also make use of addressed variables, but in this case the extension is made to the Environ Machine machine variables and used as shown here.

Invocation of the translators proceeds as detailed above.

Generated Code

The Ada Code generated by the translator is available at the following links:

for simulation of environment without addressed variables, Heating_ControllerTutorial_Completed

for simulation of environment with addressed variables, Heating_Controller5AddressedSim_Completed

Removal of the environment task from the Heating_Controller5AddressedSim_Completed should be deployable.