imported>Tommy |
imported>Andy |
| Line 1: |
Line 1: |
| − | = Overview = | + | === Overview === |
| | | | |
| − | We think that animation and model checking are important tools when building a model.
| + | The code generation activity has been undertaken at the University of Southampton. This has been a new line of work for DEPLOY that was not identified in the original Description of Work for the project. Development of the approach, and the tools to support, it involved a number of team members at Southampton; and also at other institutions. The code generation approach draws on our recent experience with technologies such as ''Shared Event Decomposition'' [[http://wiki.event-b.org/index.php/Event_Model_Decomposition]], and the ''EMF Framework for Event-B'' [[http://wiki.event-b.org/index.php/EMF_framework_for_Event-B]]. There was collaboration at an early stage with Newcastle University, where we explored the commonalities between their work on work-flow [[http://wiki.event-b.org/index.php/Flows]] and the algorithmic structures used in our approach. Collaboration with the University of York was also established since we chose to use their ''Epsilon'' [[http://www.eclipse.org/gmt/epsilon/]] model-to-model transformation technology. |
| − | Animation allows the user to validate if the model corresponds to the user's intentions.
| |
| − | Model checking allows to check if the model contains errors and provides counter-examples that help to understand the problem before.
| |
| − | Moreover, it allows to verify some properties (like temporal logic or physical units) that have currently no proof support.
| |
| | | | |
| − | The following activities were pursued within the project:
| + | === Motivations === |
| | | | |
| − | * The constraint solving capabilities of ProB have been continuously improved along with scalability improvements.
| + | The decision was taken in 2009 [[http://wiki.event-b.org/index.php/D23_Code_Generation]] to include code generation as a project goal, and to focus our efforts on supporting the generation of code for typical real-time embedded control software. To this end we have developed a multi-tasking approach such as that supported by the Ada tasking model. Individual tasks are treated as sequential programs. These are modelled by an extension to Event-B, called ''Tasking Machines''. Tasks have mutually exclusive access to state variables through the use of protected resources. The protected resources correspond to Event-B machines. For real-time control, periodic and one-shot activation is currently supported; and it is planned to support aperiodic tasks in the near future. Tasks have priorities to ensure appropriate responsiveness of the control software. |
| | | | |
| − | * A conversion from TLA to B has been added. ProB now supports TLA+. The motivation is to extend the reach of the project and to learn from TLA concerning certain features relevant for cyber-physical systems (e.g. real number support).
| + | For the DEPLOY pilots, it was regarded as sufficient to support construction of programs with a fixed number of tasks and a fixed number of shared variables – no dynamic creation of processes or objects has been accommodated. In the past year our goal has been to provide an approach, and tool support, to act as a proof-of-concept. We also gained much practical experience with the development of a code generation framework. |
| | | | |
| − | * There is work in progress towards full support of Theory plug-in: Support for external and recursive functions has been added.
| |
| | | | |
| − | * The conversion to the relational logic solver Kodkod has been completed and experiments with Kodkod and SMT translators have been conducted.
| |
| | | | |
| − | * We are working on an analysis of the use of physical units in a formal model.
| + | This paragraph shall express the motivation for each tool extension and improvement. More precisely, it shall first indicate the state before the work, the encountered difficulties, and shall highlight the requirements (eg. those of industrial partners). Then, it shall summarize how these requirements are addressed and what are the main benefits. |
| | | | |
| − | * We improved the usability of the LTL model checker.
| + | === Choices / Decisions === |
| | | | |
| − | * Regarding BMotion Studio, we focused on fixing identified bugs and rectifying usability issues.
| + | This paragraph shall summarize the decisions (eg. design decisions) and justify them. Thus, it may present the studied solutions, through their main advantages and inconvenients, to legitimate the final choices. |
| | | | |
| − | = Motivations / Decisions = | + | === Available Documentation === |
| | | | |
| − | == Improvements to Constraint-Solving ==
| + | This paragraph shall give pointers to the available wiki pages or related publications. This documentation may contain: |
| | | | |
| − | ProB's constraint solving capabilities are at the core of many of ProB's features: animation of high-level models with complicated predicates, model-based testing, constraint-based invariant and deadlock checking, etc.
| + | * Requirements. |
| − | It is thus important to improve this aspect of ProB.
| + | * Pre-studies (states of the art, proposals, discussions). |
| − | In particular, we have continuously improved the performance of the kernel, as can be seen in the figure below showing the performance of ProB (in seconds) on the N-Queens problem for 100 queens.
| + | * Technical details (specifications). |
| − | Other improvements lie in better expansion of universal and existential quantifiers, reification for the the <tt>bool</tt> operator and support for infinite and recursive functions.
| + | * Teaching materials (tutorials). |
| − | The latter is particularly important in light of the Theory Plug-In work below.
| + | * User's guides. |
| | | | |
| − | [[Image:performance of ProB on the N-Queens problem for 100 queens.jpg|240px]]
| + | A distinction shall be made on the one hand between these different categories, and on the other hand between documentation written for developers and documentation written for end-users. |
| | | | |
| − | == TLA2B == | + | === Planning === |
| | | | |
| − | TLA+ and B share the common base of predicate logic, arithmetic and set theory.
| + | This paragraph shall give a timeline and current status (as of 28 Jan 2011). |
| − | However, there are still considerable differences, such as very different approaches to typing and modularization. Some features of TLA+ are interesting in the context of cyber-physical systems, such as real numbers.
| |
| − | There is also considerable difference in the available tool support. In particular, we wanted to compare ProB with TLC and gain insights about performance.
| |
| − | | |
| − | == Physical Units ==
| |
| − | Formal models of cyber physical systems will contain variables which represent values with physical units.
| |
| − | We are thus exploring to use the ProB model checker as a tool to infer and validate physical units usage in formal models.
| |
| − | In particular, we want to make sure that the physical units in a model are used in a consistent way.
| |
| − | | |
| − | == Theory Plug-in and Mathematical Extensions ==
| |
| − | | |
| − | | |
| − | In the ProB core, we have improved ProB to better deal with infinite and recursive functions.
| |
| − | This can be used to provide formal specifications for mathematical extensions which can be animated and model checked by ProB. | |
| − | Using the newly developed external function mechanism, it should also be possible to support floats or reals, which will be important for certain cyber-physical systems.
| |
| − | | |
| − | On the technical side, we have extended the ProB internal representation of predicates and expressions to support the theory plug-in. As soon as the theory plug-in allows ProB to access the definitions (this is not yet implemented in the theory plug-in) we will finalize the implementation.
| |
| − | | |
| − | == Kodkod ==
| |
| − | We have integrated a translation of B predicates to the relational logic solver "Kodkod" and evaluated how ProB's constraint solving compares to Kodkod's SAT solving.
| |
| − | The integration allows to apply SAT solving to predicates where a translation is possible and a fallback to constraint solving for the remaining predicates.
| |
| − | Our experiments have shown that the translation can be highly beneficial for certain kinds of constraints, and as such opens up new ways to analyze and validate formal specifications in Event-B. However, the experiments have also shown that the constraint logic programming approach of ProB can be superior in a considerable number of scenarios; the translation to Kodkod and down to SAT is not (yet) the panacea. The same can be said of the existing translations from B to SMT.
| |
| − | As such, we believe that much more research required to reap the best of both worlds (SAT/SMT and constraint programming).
| |
| − | A side-effect of the translation to Kodkod is that the ProB toolset now provides a double-chain (relying on technology developed independently and using different programming languages and paradigms) of validation for first-order predicates, which should prove relevant in high safety integrity level contexts.
| |
| − | | |
| − | In comparision with other formalisms Kodkod has the advantage that is provides good support for relations and sets which play an essential role in Event-B's mathematical notation.
| |
| − | | |
| − | == LTL ==
| |
| − | ProB supports LTL model checking. One problem when using LTL to validate a model is that counter-examples returned by the model checker are often hard to understand.
| |
| − | A counter-example typically consists of a lasso-chaped sequence of states and events. Instead of just loading the sequence into the history of the animator, we have
| |
| − | implemented a dedicated visualisation for LTL counter-examples. The visualisation which is now part of ProB's Rodin plug-in shows why an LTL operator is true or false in each state of the sequence.
| |
| − | | |
| − | == CSP and B ==
| |
| − | | |
| − | ProB supports also other formalisms like CSP. CSP can also be used to guide B and Event-B models and can also be used for specifying scenarios or for model testing.
| |
| − | Within the project this feature of ProB was continuously maintained and improved. We have extended the implementation of the CSP interpreter and animator to be able to support more complex and larger data types (e.g. mixing of dot and non-associative tuples) as well as supporting more complicated pattern matching inside set comprehensions and function definitions. Some effort for supporting more of CSP built-in functions (like seq(-), set(-) and card(-))was made as well.
| |
| − | Finally, ProB now supports checking LTL-assertions directly from the CSP model by using pragmas ({-# assert_ltl = … #-}). The syntax is the same as for LTL-assertions in DEFINTION clauses in B models.
| |
| − | | |
| − | = Available Documentation =
| |
| − | | |
| − | == Constraint Solving ==
| |
| − | | |
| − | The improvements are available in the nightly builds of ProB.
| |
| − | | |
| − | Two specific pages have been added to the ProB user manual: <ref>http://www.stups.uni-duesseldorf.de/ProB/index.php5/Recursively_Defined_Functions Recursive functions entry in ProB user manual</ref>, <ref>http://www.stups.uni-duesseldorf.de/ProB/index.php5/External_Functions External functions entry in ProB user manual</ref>.
| |
| − | | |
| − | == TLA2B ==
| |
| − | The TLA+ to B translation has been published at the iFM'2012 conference. A technical report is available<ref>http://www.stups.uni-duesseldorf.de/w/Special:Publication/HansenLeuschelTLA2012 Translating TLA+ to B for Validation with ProB. Technical Report, 2012.</ref>
| |
| − | A presentation at the FM'2012 TLA+ workshop will also be made.
| |
| − | A page has been added to the ProB user manual: <ref>http://www.stups.uni-duesseldorf.de/ProB/index.php5/TLA TLA2B entry in ProB user manual</ref>.
| |
| − | | |
| − | == Physical Units ==
| |
| − | This work is still in progress. A first tutorial page is available in the ProB online documentation <ref>http://www.stups.uni-duesseldorf.de/ProB/index.php5/Tutorial_Unit_Plugin Unit Plug-in Tutorial entry in ProB user manual</ref>. Full documentation will be made available later in the project.
| |
| − | The latest nightly build of ProB contains an experimental version of the analysis.
| |
| − | | |
| − | == Kodkod ==
| |
| − | | |
| − | A technical report has been published on the validation using ProB and Kodkod <ref>http://www.stups.uni-duesseldorf.de/w/Special:Publication/PlaggeLeuschel_Kodkod2012 Validating B,Z and TLA+ using ProB and Kodkod. Technical Report, 2012.</ref>. The paper has been accepted for FM'2012.
| |
| − | | |
| − | == LTL ==
| |
| − | | |
| − | The concept and implemenation of the visualisation is described in <ref>http://www.stups.uni-duesseldorf.de/w/Visualisierung_von_LTL-Gegenbeispielen Andriy Tolstoy: Visualisierung von LTL-Gegenbeispielen, Master thesis, University of Düsseldorf, 2012</ref>.
| |
| − | | |
| − | == BMotion Studio ==
| |
| − | | |
| − | A developer-, user documentation, tutorial and examples are available at <ref>http://www.stups.uni-duesseldorf.de/bmotionstudio</ref>.
| |
| − | | |
| − | = Planning =
| |
| − | | |
| − | === Physical Units ===
| |
| − | Physical units work will be completed.
| |
| − | First experiments with industrial models from Alstom are encouraging.
| |
| − | | |
| − | == Kodkod ==
| |
| − | Currently the translation to Kodkod is only applied to axioms when trying to find values for the constants and during the constraint based deadlock check.
| |
| − | We plan to restructure ProB's internal programming interfaces in a way that allows to apply Kodkod more easily and make it available for other checks (e.g. constraint-based invariant check, assertion checks).
| |
| − | | |
| − | We will evaluate how we can employ more SMT based techniques in ProB.
| |
| − | | |
| − | == Constraint Solving ==
| |
| − | | |
| − | During the further development of ProB's constraint solving it became apparent that it would be
| |
| − | helpful to represent the cardinality of a set by a CLP(FD) variable.
| |
| − | We plan to change ProB's internal representation of sets in a way that its cardinality can
| |
| − | be accessed in this way.
| |
| − | | |
| − | To allow a translation from ProB to Kodkod, we implemented an integer interval analysis.
| |
| − | We plan to adapt the analysis to set up sizes of deferred sets. This is necessary because ProB
| |
| − | chooses a fixed size for a deferred set and sometimes a model has only solutions for a certain size.
| |
| − | Currently a user must supply a size manually.
| |
| − | | |
| − | == LTL ==
| |
| − | Fairness properties are very common when specifying LTL formula. Fairness can be encoded by using standard LTL, but it makes the formula significantly larger. The complexity of the model checking algorithm grows exponentially with the number of used LTL operators in a formula. We plan to incorporate support for fairness directly into the model checker which should lead to a drastic improvement in performance when fairness is used. Additionally, the usability of the model checker is improved by having the ability to specify fairness conditions seperatly from the rest of the LTL formula.
| |
| − | | |
| − | == BMotion Studio ==
| |
| − | | |
| − | We will provide a way to link up other Java-based simulation tools with BMotion Studio. Furthermore, beside working on identified bugs and and rectifying usability issues, we want to create more visual elements to aid humans understand large-scale simulations.
| |
| − | | |
| − | = References =
| |
| − | <references/>
| |
| − | | |
| − | [[Category:ADVANCE D3.2 Deliverable]]
| |
Overview
The code generation activity has been undertaken at the University of Southampton. This has been a new line of work for DEPLOY that was not identified in the original Description of Work for the project. Development of the approach, and the tools to support, it involved a number of team members at Southampton; and also at other institutions. The code generation approach draws on our recent experience with technologies such as Shared Event Decomposition [[1]], and the EMF Framework for Event-B [[2]]. There was collaboration at an early stage with Newcastle University, where we explored the commonalities between their work on work-flow [[3]] and the algorithmic structures used in our approach. Collaboration with the University of York was also established since we chose to use their Epsilon [[4]] model-to-model transformation technology.
Motivations
The decision was taken in 2009 [[5]] to include code generation as a project goal, and to focus our efforts on supporting the generation of code for typical real-time embedded control software. To this end we have developed a multi-tasking approach such as that supported by the Ada tasking model. Individual tasks are treated as sequential programs. These are modelled by an extension to Event-B, called Tasking Machines. Tasks have mutually exclusive access to state variables through the use of protected resources. The protected resources correspond to Event-B machines. For real-time control, periodic and one-shot activation is currently supported; and it is planned to support aperiodic tasks in the near future. Tasks have priorities to ensure appropriate responsiveness of the control software.
For the DEPLOY pilots, it was regarded as sufficient to support construction of programs with a fixed number of tasks and a fixed number of shared variables – no dynamic creation of processes or objects has been accommodated. In the past year our goal has been to provide an approach, and tool support, to act as a proof-of-concept. We also gained much practical experience with the development of a code generation framework.
This paragraph shall express the motivation for each tool extension and improvement. More precisely, it shall first indicate the state before the work, the encountered difficulties, and shall highlight the requirements (eg. those of industrial partners). Then, it shall summarize how these requirements are addressed and what are the main benefits.
Choices / Decisions
This paragraph shall summarize the decisions (eg. design decisions) and justify them. Thus, it may present the studied solutions, through their main advantages and inconvenients, to legitimate the final choices.
Available Documentation
This paragraph shall give pointers to the available wiki pages or related publications. This documentation may contain:
* Requirements.
* Pre-studies (states of the art, proposals, discussions).
* Technical details (specifications).
* Teaching materials (tutorials).
* User's guides.
A distinction shall be made on the one hand between these different categories, and on the other hand between documentation written for developers and documentation written for end-users.
Planning
This paragraph shall give a timeline and current status (as of 28 Jan 2011).
