Difference between pages "Rodin Proving Perspective" and "Tasking Event-B Tutorial"

From Event-B
(Difference between pages)
Jump to navigationJump to search
imported>Tommy
 
imported>Andy
 
Line 1: Line 1:
−
{{Navigation|Previous= [[The_Event-B_Explorer_(Rodin_User_Manual)|The Event-B Explorer]]|Next= [[The_Mathematical_Language_(Rodin_User_Manual)|The Mathematical Language]]|Up= [[index_(Rodin_User_Manual)|User_Manual_index]]}}
+
THIS PAGE IS UNDER CONSTRUCTION !!!!!!
−
{{TOCright}}
 
−
== Overview ==
 
−
When proof obligations (POs) are not discharged automatically the user can attempt to discharge them interactively using the Proving Perspective. This page provides an overview of the Proving Perspective and its use. If the Proving Perspective is not visible as a tab on the top right-hand corner of the main interface, the user can switch to it via "Window -> Open Perspective".
 
  
−
The Proving Perspective consists of a number of views: the Proof Tree, the Goal, the Selected Hypotheses, the Proof Control, the Search Hypotheses, the Cache Hypotheses and the Proof Information. In the discussion that follows we look at each of these views individually. Below is a screenshot of the Proving Perspective:
+
For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk
 +
=== Tasking Event-B Tutorial Overview ===
  
−
[[Image:ProvPers.png|center]]
+
This code generation tutorial supplements the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces implementable Ada code, and also an Event-B project which models the implementation. The Ada code is produced using a pretty printer tool from an intermediate model, the Common Language model (IL1), generated by a translation tool. An overview of Tasking Event-B can be found on the [[Tasking_Event-B_Overview]] page.
  
−
== Loading a Proof ==
+
The Heating Controller development has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines that are to be implemented (and their seen Contexts) are selected and added to a ''Tasking Development''; the Tasking Development files have the file extension ''.tasking''. The machines in the Tasking Development are then extended with implementation details.
−
To work on an un-discharged PO it is necessary to load the proof into the Proving Perspective. To do this switch to the Proving Perspective; select the project from the Event-B Explorer; select and expand the component (context or machine); and finally select (double-click) the proof obligation of interest. A number of views will be updated with details of the corresponding proof.
 
−
[[Image:ExplorerView.png|center]]
 
  
−
Note that pressing [[Image:Discharged.gif]] button on the top left hand side of the Event-B Explorer will remove all discharged proof obligations (PO's) from the view.
+
The example/tutorial projects are,
  
−
== The Proof Tree ==
+
{| border="1"
−
The proof tree view provides a graphical representation of each individual proof step, as seen in the following screenshot:
+
|Heating_ControllerTutorial_Completed
 +
|An example project with a completed Tasking Development and IL1 model (post IL1 translation, but before Event-B translation).
 +
|-
 +
|Heating_ControllerTutorial_Completed_Gen
 +
|Same as the example project above, but with Event-B model translations. The difference being that this development includes a model of the implementation. These are refinements that include a program counter to describe flow of execution in each task.
 +
|-
 +
|Heating_ControllerTutorial_Step1
 +
|A bare project for step 1 of the [[Code_Generation_Tutorial#The_Tutorial |tutorial]].
 +
|-
 +
|Heating_ControllerTutorial_Step2
 +
|A partially completed tasking development for steps 2, 3 and 4 of the [[Code_Generation_Tutorial#The_Tutorial |tutorial]].
 +
|}
  
−
[[Image:ProTree.png|center]]
+
== Preliminaries ==
 +
Before further discussion of the modelling aspects, we take a look at the PrettyPrint viewers. The PrettyPrinters make the viewing of IL1 and tasking models easier; it also provides a route to generate source code. The source code can easily be pasted from the IL1 Pretty Printer window into an the Ada source file .
 +
==== The PrettyPrint View of a Tasking Development ====
 +
To open the Tasking PrettyPrint viewer,
 +
* from the top-menu select ''Window/Show View/Other/Tasking Pretty Printer''.
  
−
Each node in the tree corresponds to a sequent. A line is right shifted when the corresponding node is a direct descendant of the node of the previous line. Each node is labelled with a comment which indicates which rule has been applied, or which prover discharged the proof. By selecting a node in the proof tree, the corresponding sequent is loaded: the hypotheses of the sequent are loaded to the Selected Hypotheses window, and the goal of the sequent is loaded to the Goal view.
+
Note that the Tasking PrettyPrinter may have to be closed when editing the Tasking Development, since it can give rise to exceptions. The PrettyPrinter would need further work to make it robust, however it is intended only as a short-term solution.
  
−
=== Decoration===
+
* Open the ''Heating_ControllerTutorial_Completed'' Project and switch to the Resource Perspective.
−
The leaves of the tree are decorated with one of three icons:
+
* Open the ''.tasking'' model and inspect it. Clicking on the Main, Machine or Event nodes updates the pretty print window.
  
−
* [[Image:Discharged.gif]] means that this leaf is discharged,
+
==== Viewing Source Code ====
−
* [[Image:Pending.gif]] means that this leaf is not discharged,
+
aka. The PrettyPrint View of an IL1 Model.
−
* [[Image:Reviewed.gif]] means that this leaf has been reviewed.
 
  
−
Internal nodes in the proof tree are decorated in reverse colours. Note that a "reviewed" leaf is one that is not discharged yet by the prover. Instead, it has been "seen" by the user who decided to postpone the proof. Marking nodes as "reviewed" is very convenient since the provers will ignore these leaves and focus on specific areas of interest. This allows interactive proof in a gradual fashion. In order to discharge a "reviewed" node, select it and prune the tree at that node: the node will become "brown" again (undischarged) and you can now try to discharge it.
+
To view Ada source code,
 +
* from the top-menu select ''Window/Show View/Other/IL1 Pretty Printer''.
 +
* Open the ''Heating_ControllerTutorial_Completed'' Project and switch to the Resource Perspective.
 +
* Open the ''.il1'' model and inspect it. Clicking on the Protected, Main Entry, or Task nodes updates the pretty print window.
  
−
=== Navigation within the Proof Tree===
+
==== Cleaning the Tasking Development ====
−
On top of the proof tree view, one can see three buttons:
+
If the ''.tasking'' file has errors, then it may need cleaning. To do this right-click on the ''Main'' node, select ''Epsilon Translation/CleanUp''. If a model has errors it can still be viewed by clicking on the ''Selection'' tab at the bottom of the tasking editor window.
  
−
* the "'''G'''" buttons allows you to see the goal of the sequent corresponding to each node,
+
== The Tutorial ==
−
* the "'''+'''" button allows you to fully expand the proof tree,
+
The steps needed to generate code from an Event-B model, in this tutorial, are as follows,
−
* the "'''-'''" allows you to fully collapse the tree: only the root stays visible.
+
* Step 1 - [[Tasking Event-B_Tutorial#Creating The Tasking Development|Create the tasking development]].
 +
* Step 2 - [[Tasking Event-B_Tutorial#Providing the Annotations for Implementations|Add Tasking annotations]].
 +
* Step 3 - [[Tasking Event-B_Tutorial#Optional Annotations for Addressed Variables|Add annotations for addressed variables (optional)]].
 +
* Step 4 - [[Tasking Event-B_Tutorial#Invoking the Translation|Invoke translators]].
  
−
=== Manipulating the Proof Tree===
+
==== Creating The Tasking Development ====
 +
* Change to the Event-B Perspective.
 +
* Open the ''Heating_ControllerTutorial_Step1'' Project.
 +
* Select the following Machines: Display_Update_Task1, Envir1, Heater_Monitor_Task1, Shared_Object1, Temp_Ctrl_Task1 and HC_CONTEXT.
 +
* Right-click and select ''Make Tasking Development/Generate Tasking Development''.
  
−
==== Hiding ====
+
The new Tasking Development will not be visible in the Event-B perspective, change to the resource perspective, open and inspect the new ''.tasking'' file. The Tasking Development contains (the EMF representation of) the machines that we wish to provide implementations for. In order to introduce the new concepts we have prepared a partially complete development.  
−
The little square (with a "+" or "-" inside) next to each node in the proof tree allows you to expand or collapse the subtree starting at that node.
 
  
−
==== Pruning ====
+
* Change the tasking development, if necessary, so that the machine that models the environment is at the top of the tree of machines.
−
The proof tree can be pruned at a selected node; the subtree of the selected node is removed from the proof tree. The selected node becomes a leaf and is decorated with [[Image:Pending.gif]] . The proof activity can then be resumed from this node. After selecting a node in the proof tree pruning can be performed in two ways:
 
−
* by right-clicking and then selecting "Prune",
 
−
* by clicking on the [[Image:Pn_prover.gif]] button in the proof control view.
 
  
−
Note that after pruning, the post-tactic is not applied to the new current sequent. The post-tactic should be applied manually, if required, by clicking on the post-tactic button in the Proof Control view. This is useful, in particular, when you want to redo a proof from the beginning. The proof tree can be pruned at its root node and then the proof can proceed again, with invocation of internal or external provers; or with interactive proof.
+
In the simulation implementation, elements of the Environ machine must be declared first.
  
−
Before pruning a particular node, the node (and its subtree) can be copied to the clipboard. If the new proof strategy subsequently fails, the copied version can be pasted back into the pruned node (see the next section).
+
Change to the Project ''Heating_ControllerTutorial_Step2'' to begin the next step.
  
−
==== Copy/Paste ====
+
==== Providing the Annotations for Implementations ====
 +
* Close any Tasking Pretty Print Viewers that remain open. The incomplete model will give rise to exceptions.
 +
* Go to the to the Resource Perspective.
 +
* Open and inspect the ''.tasking'' machine.
  
−
By selecting a node in the proof tree and then right-clicking with the mouse, you can copy the part of the proof tree starting at that sequent (the node and its subtree). Pasting the node and subtree back in is done in a similar manner, with a right mouse click on a proof node. This allows reuse of part of a proof tree in the same, or even in another, proof.
+
The ''Temp_Ctrl_Task1Impl'', ''Envir1'' and ''Shared_Object1'' machines are incomplete. We will take the necessary steps to provide implementation details.  
  
−
== Goal and Selected Hypotheses ==
+
===== The Temp_Ctrl_Task1Impl Machine =====
−
The nodes in the proof tree view correspond to sequents. A user will work with one selected node, and thus one sequent, at a time; attempting various strategies in an effort to show that the sequent goal is true. The "Goal" and "Selected Hypotheses" views provide information to the user about the currently selected sequent. Here is an example:
+
In the partially complete tutorial project we have already identified the ''Temp_Ctrl_Task1Impl'' as an ''Auto Task'' Tasking Machine, by adding the ''Auto Task'' extension. ''Auto Tasks'' are tasks that will be declared and defined in the ''Main'' procedure of the implementation. The effect of this is that the ''Auto Tasks'' are created when the program first loads, and then activated (made ready to run) before the ''Main'' procedure body runs. We have added the ''Periodic Task'' extension to the ''Auto Task'', and set a period of 250 milliseconds. We will now complete the sequence that has been partially defined in the task body.
−
[[Image:GoalHyp.png|center]]
 
  
−
A hypothesis can be removed from the list of selected hypotheses by selecting the check the box situated next to it (you can click on several boxes) and then by clicking on the [[Image:remove.gif]] button at the top of the selected hypotheses window:
+
*'''Add Sensing between TCSense_Temperatures and ENSense_Temperatures'''.
 +
** Expand the Temp_Ctrl_Task1Impl ''Auto Task Machine'' node.
 +
** Expand the ''Seq'' sub-tree.
 +
** Right-click on the ''Seq'' node and select ''New Child/Left Branch EventWrapper''.
 +
** Provide the event label ''tc1'' using the properties view.
 +
** Right-click on Event Wrapper and select ''New Child/ Synch Events''.
 +
** Select ''Synch Events'' and go to the drop-down menu of the ''Local Event'' property.
 +
** At this point the drop-down box displays a number of event names, select the '''second''' ''TCSense_Temperatures'' event.
 +
** Go to the drop-down menu of the ''Remote Event'' property.
 +
** From the list of events select the '''first''' ''ENSense_Temperatures'' event.
  
−
[[Image:GoalHypSelect.png|center]]
+
By relating the sensing events in this way we describe a simulation of the interaction between the task and environment. The details of the interaction are embodied in the events themselves. This is implemented in the simulation code as a write to environment variables using a subroutine call.  
  
−
Here is the result:
+
Note that the Synch Events construct is used in several ways. We use it to implement [[Tasking Event-B Overview#Control Constructs|Event Synchronisation]]; sensing and actuation; and as a simple event wrapper. An example of its use in a simple event wrapper follows. The simple event wrapper is used to update local state; there is no synchronisation, as such, but we re-use the constructs that already exist rather than create new ones. We now add a wrapped event to the sequence,
  
−
[[Image:GoalHypSelectRes.png|center]]
+
*'''Add the Wrapped Event TCCalculate_Average_Temperature'''.
 +
** Expand the sub-tree of the second ''Seq'' node.
 +
** Right-click on the ''Seq'' node and select ''New Child/Left Branch EventWrapper''.
 +
** Provide the event label ''tc2'' using the properties view.
 +
** Right-click on Event Wrapper and select ''New Child/ Synch Events''.
 +
** Select ''Synch Events'' and go to the drop-down menu of the ''Local Event'' property.
 +
** From the list of events select the ''TCCalculate_Average_Temperature'' event.
  
−
Note that the deselected hypotheses are not lost: you can find them again using the Search Hypotheses [[Image:sh_prover.gif]] button in the Proof Control view. Other buttons are used as follows:
+
The addition of the wrapped event, to the sequence, is simply specification of event ordering. It is implemented in code as a sequential subroutine call statement. We now specify event synchronisation between the task and shared object.  
  
 +
*'''Add Synchronisation between TCGet_Target_Temperature2 and SOGet_Target_Temperature2'''.
 +
** Further expand the ''Seq'' sub-tree until Eventwrapper tc3 appears.
 +
** Right-click on the sibling ''Seq'' node (lowest in the tree) and select ''New Child/Left Branch EventWrapper''.
 +
** Provide the event label ''tc4'' using the properties view.
 +
** Right-click on Event Wrapper and select ''New Child/ Synch Events''.
 +
** Select ''Synch Events'' and go to the drop-down menu of the ''Local Event'' property.
 +
** At this point the drop-down box displays a number of event names, select the '''second''' ''TCGet_Target_Temperature2'' event.
 +
** Go to the drop-down menu of the ''Remote Event'' property.
 +
** From the list of events select the '''second''' ''SOGet_Target_Temperature2'' event.
  
−
* [[Image:select_all_prover.gif]] select all hypotheses.  
+
We have now completed the task body, and next provide additional details for events. In the first instance we focus on the the ''TCGet_Target_Temperature2 '' event in ''Temp_Ctrl_Task1Impl'' which is to be synchronized with the ''SOGet_Target_Temperature2 '' event in ''Shared_ObjectImpl''.  
  
 +
*'''Add The Event Extension'''.
 +
** Right-click on the ''TCGet_Target_Temperature2'' Event node.
 +
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''ProcedureSynch''.
  
−
* [[Image:inv_prover.gif]] invert the selection.
+
We have identified the event as one that partakes in a synchronisation.
  
 +
*'''Identify a parameter direction'''.
 +
** Right-click on the ''tm'' node.
 +
** Select''New Child/Parameter Type''.
 +
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''actualIn''.
  
−
* [[Image:falsify_prover.gif]] next to the goal - proof by contradiction 1: The negation of the '''goal''' becomes a selected hypothesis and the goal becomes "'''⊥'''".  
+
We have now identified the parameter as an actualIn (this models a call's return value).
  
 +
===== The Shared Machine =====
  
−
* [[Image:falsify_prover.gif]] next to a selected hypothesis - proof by contradiction 2: The negation of the '''hypothesis''' becomes the goal and the negated goal becomes a selected hypothesis.
+
The next step is to identify the ''SharedObj'' machine as a ''Shared Machine''. The ''SharedObj'' Machine will be extended using the Event-B EMF extension mechanism.
 +
* Right-click on the ''SharedObj'' Machine node in the ''.tasking'' file.
 +
* Select ''New Child/Extension''.
 +
* Right-click on the ''Extension'' node and select ''New Child/Shared Machine'' from the menu.
  
 +
We now show how to extend the ''SWrite'' event of the Shared Machine with details about its implementation. The ''SWrite'' event in ''SharedObj'' is to be synchronized with the ''TWrite'' event in the ''WriterTsk''.
 +
* '''Identify SWrite as a Syncronisation'''.
 +
** Right-click on the ''SWrite'' Event node.
 +
** Select ''New Child/Extension''.
 +
** Right-click on the ''Extension'' node and select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''ProcedureSynch''.
  
−
=== Applying Proof Rules ===
+
* '''Identify incoming and outgoing parameters'''.
−
A user wishing to attempt an interactive proof has a number of proof rules available, and these may be either rewrite rules or inference rules. In the Goal and the Selected Hypotheses views various operators may appear in red coloured font. The red font indicates that some interactive proof rule(s) are applicable and may be applied as a step in the proof attempt. When the mouse hovers over such an operator a number of applicable rules may be displayed; the user may choose to apply one of the rules by clicking on it.
+
** Right-click on the ''inFP'' node and add an ''Extension''.
 +
** Right-click on the ''Extension'' and select''New Child/Parameter Type''.
 +
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''formalIn''.
 +
** Right-click on the ''outFP'' node and add an ''Extension''.
 +
** Right-click on the ''Extension'' and select''New Child/Parameter Type''.
 +
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''formalOut''.
  
−
Other proof rules can be applied when green buttons appear in the Goal and Selected Hypotheses views. Examples are proof by contradiction [[Image:falsify_prover.gif]], that we have already encountered; and [[Image:ConjI_prover.gif]] for conjunction introduction in the goal.
+
==== Optional Annotations for Addressed Variables ====
  
−
[[Image:ApplyRewRule.png|center]]
+
Link To Addressed Variables!!!!!
  
−
To instantiate a quantifier the user enters the desired expression in the box behind the quantifier and clicks on the quantifier:
 
  
−
[[Image:InstQuantifier.png|center]]
+
===== A Summary of Steps =====
 +
If generating environment simulation code:
 +
# Ensure the Environ Machine is first machine in the development.
  
−
==== Rewrite Rules ====
+
For a Tasking Machine definition:
−
Rewrite rules are one-directional equalities (and equivalences) that can be used to simplify formulas (the goal or a single hypothesis). A rewrite rule is applied from left to right when its ''side condition'' holds; it can be applied either in the goal predicate, or in one of the selected hypotheses.
+
# Add the Tasking Machine type (Auto etc).
 +
# Add the task type (Periodic etc.).
 +
# Define the task priority.
 +
# Define the task body.
 +
# For each event, add the Event Type.
 +
# For each event parameter, add the Parameter Type.
 +
# Optionally define addressed variables.
  
−
A rewrite rule is applied either automatically ('''A''') or manually ('''M'''):
+
For a Shared Machine definition:
−
* automatically, when post-tactics are run.
+
# Add the ''SharedMachine'' Machine type.
−
* automatically, when auto-tactics are run.
+
# For each event, define the Event Type.
−
* manually, through an interactive command. These rules gather non equivalence laws, definition laws, distributivity laws and derived laws.
+
# For each event parameter, define the Parameter Type.
  
−
Automatic rewrite rules are equivalence simplification laws.
+
==== Invoking the Translation ====
  
−
Each rule name indicates the rule's characteristics according to the following convention:
+
* To create the IL1 model,
 +
** Right-Click on the Main node, select ''Epsilon Translation/Translate Task Mch 2 IL1 EMF''.
 +
** Open the Resource Perspective.
 +
** Right-click on the ''sharedbuffer20100819Tutorial2'' project folder.
 +
** Select refresh, the ''.il1'' file should appear in the project.
 +
** Open and inspect the file, and view the source code by opening the IL1 Pretty Print view if desired.
  
−
* the law category: simplification law (SIMP), definition law (DEF), distributivity law (DISTRI), or else derived law (DERIV).
+
* To create the Event-B model of the implementation,
−
* the root operator of the formula on the left-hand side of the rule, e.g. predicate AND, expression BUNION.
+
** Return to the Rodin Modelling Perspective.
−
* (optionally) the terminal elements on the left-hand side of the rule: special element (SPECIAL) such as the empty-set, type expression (TYPE), same element occurring more than once (MULTI), literal (LIT). A type expression is either a basic type (<math>\intg, \Bool</math>, any carrier set), or <math>\pow</math>(type expression), or type expression<math>\cprod</math>type expression.
+
** Right-Click on the Main node, select ''Epsilon Translation/Translate Task Mch 2 Event-B EMF''.
−
* (optionally) some other description of a characteristic, e.g. left (L), right (R).
+
** The ''sharedbuffer20100819bTasking'' project is generated, it can be opened and inspected.
  
−
Rewrite rules having a symmetric operator on the left-hand side may also describe other rules. eg: the rule:
+
There are errors in the generated machines (not investigated the cause yet); these can be fixed in the following way.
 +
* Open a Machine in the Event-B Machine Editor.
 +
* Select the Edit tab.
 +
* Open the REFINES section, the error lies here.
 +
* The correct machine is refined, but choose a different machine to refine (any one, it doesn't matter).
 +
* Select the original refined machine again.
 +
* Save and clean the project, and the error should disappear.
 +
* Repeat for the same errors in the other machines; save and clean again.
 +
* The machines can viewed as normal using the Rodin editors.
  
−
<center><math>  \True  = \False  \;\;\defi\;\;  \bfalse </math></center>
+
[[Category:User documentation]]
−
 
 
−
should also produce the rule:
 
−
 
 
−
<center><math>  \False  = \True  \;\;\defi\;\;  \bfalse </math></center>
 
−
 
 
−
For associative operators in connection with distributive laws as in:
 
−
 
 
−
<center><math> P  \land (Q~ {\color{red}{\lor}} \ldots \lor R) </math></center>
 
−
 
 
−
it has been decided to highlight the first associative/commutative operator (the <math>{\color{red}{\lor}} </math>). A menu is presented when hovering the mouse over the operator: the first menu option distributes all associative/commutative operators, the second option distributes only the first associative/commutative operator. In order to simplify the explanation we write associative/commutative operators with two parameters only. However, ''we must emphasise here'', that generally we may have a sequence of more than two parameters. So, we write <math> Q \lor R </math> instead of <math> Q \lor \ldots \lor R </math>. Rules are sorted according to their purpose.
 
−
 
 
−
Rules marked with a star in the first column are implemented in the current prover.  Rules without a star are planned for implementation.
 
−
 
 
−
Rewrite rules are split into:
 
−
 
 
−
* [[Set Rewrite Rules]]
 
−
* [[Relation Rewrite Rules]]
 
−
* [[Arithmetic Rewrite Rules]]
 
−
 
 
−
They are also available in a single large page [[All Rewrite Rules]].
 
−
 
 
−
==== Inference Rules ====
 
−
Inference rules (see [[Proof Rules]]) are applied either automatically (A) or manually (M).
 
−
 
 
−
Inference rules applied automatically are applied at the end of each proof step. They have the following possible effects:
 
−
 
 
−
* they discharge the goal,
 
−
* they simplify the goal and add a selected hypothesis,
 
−
* they simplify the goal by decomposing it into several simpler goals,
 
−
* they simplify a selected hypothesis,
 
−
* they simplify a selected hypothesis by decomposing it into several simpler selected hypotheses.
 
−
 
 
−
Inference rules applied manually are used to perform an interactive proof. They can be invoked by clicking on the red highlighted operators in the goal or the hypotheses. A menu is presented when there are several options.
 
−
 
 
−
See [[Inference Rules]] list.
 
−
 
 
−
== The Proof Control View==
 
−
 
 
−
The Proof Control view contains the buttons which you can use to perform an interactive proof.
 
−
 
 
−
[[Image:PControl.png|center]]
 
−
 
 
−
The Proof Control view offers a number of buttons whose effects we briefly describe next; moving from left to right on the toolbar:
 
−
 
 
−
* ('''nPP''') invokes the new predicate prover, a drop-down list indicates alternative strategies.
 
−
* ('''R''') indicates that a node has been reviewed: in an attempt by the user to carry out proofs in a stepwise fashion, they might decide to postpone the task of discharging some proofs until a later stage. To do this the proofs can be marked as reviewed by choosing the proof node and clicking on this button. This indicates that by visually checking the proof the user is convinced that they can discharge it later, but they do not want to do it right now.
 
−
* ('''p0''') the PP and ML provers can be invoked from the drop-down list using different forces.
 
−
* ('''dc''') do proof by cases: the proof is split into two branches. In the first branch:- the predicate supplied by the user is added to the Selected Hypotheses, and the user attempts to discharge this branch. In the second branch :- the predicate supplied by the user is negated and added to the Selected Hypotheses; the user then attempts to discharge this branch.
 
−
 
 
−
* ('''ah''') add a new lemma: the predicate in the editing area should be proved by the user. It is then added as a new selected hypothesis.
 
−
* ('''ae''') abstract expression: the expression in the editing area is given a fresh name.
 
−
* '''the robot''': invokes the auto-prover which attempts to discharge the goal. The auto-prover is applied automatically on all proof obligations after a "save" without any intervention of the user. Using this button, you can invoke the auto-prover within an interactive proof.
 
−
* the '''post-tactic''' is executed ,
 
−
* '''lasoo''': load into the Selected Hypotheses window those hidden hypotheses that contain identifiers in common with the goal, and with the selected hypotheses.
 
−
* '''backtrack''' form the current node (i.e., prune its parent),
 
−
* '''scissors''': prune the proof tree from the node selected in the proof tree,
 
−
* '''Search Hypotheses''': find hypotheses containing the character string in the editing area, and display in the Search Hypothesis view.
 
−
* '''Cache Hypotheses''': press this to display the ''"Cache Hypotheses"'' view. This view displays all hypotheses that are related to the current goal.
 
−
* load the '''previous''' undischarged proof obligation,
 
−
* load the '''next''' undischarged proof obligation,
 
−
* '''(i)''' show information corresponding to the current proof obligation in the corresponding window. This information correspond to the elements that directly took part in the proof obligation generation (events, invariant, etc.),
 
−
* goto the next '''pending''' node of the current proof tree,
 
−
* load the next '''reviewed''' node of the current proof tree.
 
−
* '''Disable/Enable Post-tactics''': allows the user to choose whether post-tactics run after each interactive proof step.
 
−
=== The Smiley ===
 
−
The smiley can be one of three different colors: (1) red, indicates that the proof tree contains one or more undischarged sequents, (2) blue, indicates that all undischarged sequents of the proof tree have been reviewed, (3) green, indicates that all sequents of the proof tree are discharged.
 
−
 
 
−
=== The Editing Area ===
 
−
The editing area allows the user to supply parameters for proof commands. For example, when the user attempts to add a new hypothesis (by clicking on the lemma '''ah''' button), the new hypothesis should have been written by the user in the editing area.
 
−
 
 
−
=== ML/PP and Hypotheses ===
 
−
 
 
−
==== ML ====
 
−
ML (mono-lemma) prover appears in the drop-down list under the button ('''pp''') as M0, M1, M2, M3, ML.
 
−
The different configuration (e.g., M0) refer to the proof force of the ML prover. '''All hypotheses''' are passed to ML.
 
−
 
 
−
==== PP ====
 
−
PP (predicate prover) appears in the drop-down list under the button ('''pp''') as P0, P1, PP.
 
−
* P0 uses '''all selected hypotheses''' (the ones in '''Selected Hypotheses''' window).
 
−
* P1 employs a '''lasoo''' operation to the selected hypotheses and the goal, and uses the resulting hypotheses.
 
−
* PP uses '''all hypotheses'''.
 
−
 
 
−
== The Search Hypotheses View==
 
−
By typing a string in the '''Proof Control''' window and pressing the '''Search Hypotheses''' button a window is provided which contains the hypotheses having a character string in common with the one entered by the user in the editing area. For example, if we search for hypotheses involving the character string "cr", then after pressing the '''Search Hypothesis''' button on the proof control window, we obtain the following:
 
−
 
 
−
[[Image:um-0102.png|center]]
 
−
 
 
−
This view also integrates a "quick search" area (A), that allows us to search quickly hypotheses involving short character strings such as "cr". A '''search hypothesis button (B)''' that behaves the same as the button of the proving window, a '''refresh button (C)''' that updates the window manually for more control, and a '''drop down menu (D)''' to set the preferences of the view up.
 
−
 
 
−
By pressing '''return''' key or the button (B) (once a short string has been given in the input area (A)), hypotheses can be searched quickly as if we used the '''Proof Control''' as described before.
 
−
 
 
−
The drop down menu (D) is accessible to set some preferences over the searched hypotheses :
 
−
 
 
−
[[Image:SearchHyp_view_menu.png|center]]
 
−
 
 
−
If we change preferences for the search, we might need to "update" manually the view with the button (C).
 
−
By selecting "Consider hidden hypotheses in search" option, we can review all hypotheses that have been unselected in the selected hypotheses window(more info about[[Rodin_Proving_Perspective#Goal and Selected Hypotheses| selected/hidden hypotheses]]...).
 
−
 
 
−
[[Image:SearchHyp.png|center]]
 
−
 
 
−
To move any of these hypotheses to the '''Selected Hypotheses''' window, select those required (using the check boxes) and press the [[Image:Add.gif]] button. Adding these hypotheses to the selected hypotheses means that they will be visible to the prover. They can then be used during the next interactive proof phase.
 
−
 
 
−
To remove hypotheses from the '''Search Hypotheses''' window use the [[Image:Remove.gif]] button. This button also appears above the selected hypotheses, and allows the user to remove any hypothesis from the '''Selected Hypotheses''' window.
 
−
 
 
−
The other button, situated to the left each hypotheses, is the [[Image:falsify_prover.gif]] button. clicking on this will attempt a proof by contradiction. The effect is the same as if the hypothesis were in the '''Selected Hypotheses'''.
 
−
 
 
−
== The Cache Hypotheses Window ==
 
−
 
 
−
This window allows the user to keep track of recently manipulated (e.g., used, removed, selected) hypotheses for any PO. For example, when the user applies a rewrite to an hypothesis, a new hypothesis (after the rewriting) is selected, and the original hypothesis is deselected and put in the '''Cache Hypotheses''' window.
 
−
 
 
−
Similar operations (to that of the '''Selected Hypotheses''' and '''Search Hypotheses''' windows) such as removing, selecting and proof by contradiction ('''ct''') are also available for the cached hypotheses. Interactive proof steps (e.g., rewriting) can also be carried out from the '''Cache Hypotheses''' window as well as the '''Search Hypotheses''' window.
 
−
 
 
−
== Proof Information View ==
 
−
 
 
−
This view displays information so that the user can relate a proof obligation to the model. For example, typical information for an event invariant preservation PO includes the event; as well as the invariant in question. In the following example, the hyperlinks 'CreateToken' and 'inv2' can be used to navigate to the containing machine.
 
−
 
 
−
[[Image:PInfo.png|center]]
 
−
 
 
−
== Rule Details View ==
 
−
 
 
−
This view displays the information relative to a given proof tree node, on which a rule was applied.<br>
 
−
A command is available when right-clicking on a proof tree node, in order to reveal the Rule Details View (See picture below).
 
−
 
 
−
[[Image:ShowRuleDetailsView.png|center]]
 
−
 
 
−
By default, this view is a fast view. A button (identified by the view's icon) is then available at the bottom left of the workbench, to show up this view.
 
−
 
 
−
Here is an overview of the Rule details view :
 
−
 
 
−
[[Image:RuleDetailsView.png|center]]
 
−
 
 
−
A quick view on the applied rule contents is provided. On the picture above, we display the contents of the rule named "∀ hyp mp" where an input has been used to instantiate an hypothesis.<br> One can see quickly which was the input used by the instanciation (following '''instantiated with'''), and which was the hypothesis considered by this rule (this is given by the hypothesis of '''Input Sequent''').<br>
 
−
Furthermore, it is possible to view the antecedents created by this rule in details (i.e. child proof tree nodes) and the actions performed on hypotheses : selection, deselection, etc.
 
−
 
 
−
== Auto-tactic and Post-tactic ==
 
−
 
 
−
The auto-tactic applies a combination (i.e. ordered list) of ''rewrite'', ''inference'' and ''external provers'' to newly generated proof obligations. However, they can also be invoked by the user by clicking on the [[Image:auto_prover.png]] button in the '''Proof Control''' view. The user can deactivate the automatic application of the auto-prover by unselecting '''Prove automatically''' available from the menu Project.
 
−
 
 
−
Post-tactic is also a combination of ''rewrite'', ''inference'' and ''external provers'', and is applied <u>automatically after each interactive proof step</u>. However, it can also be invoked manually by clicking on the [[Image:Broom_prover.gif]] button in the '''Proof Control''' view.
 
−
 
 
−
Note that the post-tactic can be disabled quickly by clicking on the little arrow (marked with an A on the figure below) of the '''Proof Control''' view (right upper corner) and then on "Disable post-tactic" (B):
 
−
[[Image:Disable_xp_prover.png|center]]
 
−
 
 
−
=== Principles ===
 
−
 
 
−
The ordered list of  ''rewrite'', ''inference'' and ''external provers'' that should be applied is called a '''profile'''. There are two default profiles, one for the auto-tactic and one for the post-tactic. These default profiles are immutable in time, but can be duplicated for further modification by the user. Indeed, the user can edit a profile and select it to run as automatic or post tactic. The idea is to have a set of available tactic profiles to be used as needed.
 
−
Moreover, these edited profiles are shipped with projects if defined at this scope, or can be imported or exported if defined at a workspace level, which is very useful to share them.
 
−
 
 
−
There are two ways to run the automatic or post tactics:
 
−
* the manual way consists into clicking on the [[Image:auto_prover.png]] button, or the [[Image:Broom_prover.gif]] button in the Proof Control view, to respectively launch the auto-tactic (with the selected auto-tactic profile) and the post-tactic (with the selected post-tactic profile).
 
−
mandatory condition for post-tactics or auto-tactics to automatically run is that they should be activated from their preference or property.
 
−
* the automatical way if such preference is activated. (Auto-tactic after each proof step, and post-tactic at each step and rebuild)
 
−
 
 
−
The user can separately define tactic profiles and assign them to post and auto tactics. Therefore, there are two tabs in the "Auto/Post Tactic" preference page to address these choices. These tabs will be descibed in the two next sections.
 
−
 
 
−
=== Preferences for the selected auto and post tactic profile ===
 
−
There are two scopes to set up preferences for the auto and post tactics : at workspace level, and at project level.
 
−
Note that if the automatic application of tactics (auto or post) is decided only at workspace level, and this choice is held at project level.
 
−
 
 
−
To access these preferences, one as to go open the "Auto/Post Tactic" preference page that can be found after "Window > Preference > Sequent Prover".
 
−
 
 
−
The figure below shows the "Auto/Post Tactic" Preference page:
 
−
 
 
−
[[Image:AutoPostTactic_Preference_Capture1.png|650px|center]]
 
−
 
 
−
The buttons 1 and 2 are activating/deactivating the automatic use of auto or post tactics.
 
−
One can also see on this picture the selected profile to be use as auto and post tactic.<br>
 
−
'''Note that there is always a profile selected, and this profile can be changed whether the tactic are automatically launched or not, as there is alway a way to manually launch auto and post tactics.'''<br>
 
−
On the preference appearing above, the ''Default Auto Tactic Profile'' is used to compose the automatic tactic, and the ''Default Post Tactic Profile'' is used to compose the post-tactic.
 
−
 
 
−
The figure below shows the "Auto/Post Tactic" Preference page with both auto-tactic and post-tactic to automatically run, and where the user selects the profile "MyFirstTacticProfile" to be used as auto-tactic profile.
 
−
 
 
−
[[Image:AutoPostTactic_Preference_Capture4.png|650px|center]]
 
−
 
 
−
=== Preferences for available profiles ===
 
−
 
 
−
 
 
−
 
 
−
=== Project specific settings ===
 
−
 
 
−
 
 
−
[[Category:User documentation|The Proving Perspective]]
 
−
[[Category:Rodin Platform|The Proving Perspective]]
 
−
[[Category:User manual|The Proving Perspective]]
 

Revision as of 13:19, 28 April 2011

THIS PAGE IS UNDER CONSTRUCTION !!!!!!

For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk

Tasking Event-B Tutorial Overview

This code generation tutorial supplements the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces implementable Ada code, and also an Event-B project which models the implementation. The Ada code is produced using a pretty printer tool from an intermediate model, the Common Language model (IL1), generated by a translation tool. An overview of Tasking Event-B can be found on the Tasking_Event-B_Overview page.

The Heating Controller development has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines that are to be implemented (and their seen Contexts) are selected and added to a Tasking Development; the Tasking Development files have the file extension .tasking. The machines in the Tasking Development are then extended with implementation details.

The example/tutorial projects are,

Heating_ControllerTutorial_Completed An example project with a completed Tasking Development and IL1 model (post IL1 translation, but before Event-B translation).
Heating_ControllerTutorial_Completed_Gen Same as the example project above, but with Event-B model translations. The difference being that this development includes a model of the implementation. These are refinements that include a program counter to describe flow of execution in each task.
Heating_ControllerTutorial_Step1 A bare project for step 1 of the tutorial.
Heating_ControllerTutorial_Step2 A partially completed tasking development for steps 2, 3 and 4 of the tutorial.

Preliminaries

Before further discussion of the modelling aspects, we take a look at the PrettyPrint viewers. The PrettyPrinters make the viewing of IL1 and tasking models easier; it also provides a route to generate source code. The source code can easily be pasted from the IL1 Pretty Printer window into an the Ada source file .

The PrettyPrint View of a Tasking Development

To open the Tasking PrettyPrint viewer,

  • from the top-menu select Window/Show View/Other/Tasking Pretty Printer.

Note that the Tasking PrettyPrinter may have to be closed when editing the Tasking Development, since it can give rise to exceptions. The PrettyPrinter would need further work to make it robust, however it is intended only as a short-term solution.

  • Open the Heating_ControllerTutorial_Completed Project and switch to the Resource Perspective.
  • Open the .tasking model and inspect it. Clicking on the Main, Machine or Event nodes updates the pretty print window.

Viewing Source Code

aka. The PrettyPrint View of an IL1 Model.

To view Ada source code,

  • from the top-menu select Window/Show View/Other/IL1 Pretty Printer.
  • Open the Heating_ControllerTutorial_Completed Project and switch to the Resource Perspective.
  • Open the .il1 model and inspect it. Clicking on the Protected, Main Entry, or Task nodes updates the pretty print window.

Cleaning the Tasking Development

If the .tasking file has errors, then it may need cleaning. To do this right-click on the Main node, select Epsilon Translation/CleanUp. If a model has errors it can still be viewed by clicking on the Selection tab at the bottom of the tasking editor window.

The Tutorial

The steps needed to generate code from an Event-B model, in this tutorial, are as follows,

Creating The Tasking Development

  • Change to the Event-B Perspective.
  • Open the Heating_ControllerTutorial_Step1 Project.
  • Select the following Machines: Display_Update_Task1, Envir1, Heater_Monitor_Task1, Shared_Object1, Temp_Ctrl_Task1 and HC_CONTEXT.
  • Right-click and select Make Tasking Development/Generate Tasking Development.

The new Tasking Development will not be visible in the Event-B perspective, change to the resource perspective, open and inspect the new .tasking file. The Tasking Development contains (the EMF representation of) the machines that we wish to provide implementations for. In order to introduce the new concepts we have prepared a partially complete development.

  • Change the tasking development, if necessary, so that the machine that models the environment is at the top of the tree of machines.

In the simulation implementation, elements of the Environ machine must be declared first.

Change to the Project Heating_ControllerTutorial_Step2 to begin the next step.

Providing the Annotations for Implementations

  • Close any Tasking Pretty Print Viewers that remain open. The incomplete model will give rise to exceptions.
  • Go to the to the Resource Perspective.
  • Open and inspect the .tasking machine.

The Temp_Ctrl_Task1Impl, Envir1 and Shared_Object1 machines are incomplete. We will take the necessary steps to provide implementation details.

The Temp_Ctrl_Task1Impl Machine

In the partially complete tutorial project we have already identified the Temp_Ctrl_Task1Impl as an Auto Task Tasking Machine, by adding the Auto Task extension. Auto Tasks are tasks that will be declared and defined in the Main procedure of the implementation. The effect of this is that the Auto Tasks are created when the program first loads, and then activated (made ready to run) before the Main procedure body runs. We have added the Periodic Task extension to the Auto Task, and set a period of 250 milliseconds. We will now complete the sequence that has been partially defined in the task body.

  • Add Sensing between TCSense_Temperatures and ENSense_Temperatures.
    • Expand the Temp_Ctrl_Task1Impl Auto Task Machine node.
    • Expand the Seq sub-tree.
    • Right-click on the Seq node and select New Child/Left Branch EventWrapper.
    • Provide the event label tc1 using the properties view.
    • Right-click on Event Wrapper and select New Child/ Synch Events.
    • Select Synch Events and go to the drop-down menu of the Local Event property.
    • At this point the drop-down box displays a number of event names, select the second TCSense_Temperatures event.
    • Go to the drop-down menu of the Remote Event property.
    • From the list of events select the first ENSense_Temperatures event.

By relating the sensing events in this way we describe a simulation of the interaction between the task and environment. The details of the interaction are embodied in the events themselves. This is implemented in the simulation code as a write to environment variables using a subroutine call.

Note that the Synch Events construct is used in several ways. We use it to implement Event Synchronisation; sensing and actuation; and as a simple event wrapper. An example of its use in a simple event wrapper follows. The simple event wrapper is used to update local state; there is no synchronisation, as such, but we re-use the constructs that already exist rather than create new ones. We now add a wrapped event to the sequence,

  • Add the Wrapped Event TCCalculate_Average_Temperature.
    • Expand the sub-tree of the second Seq node.
    • Right-click on the Seq node and select New Child/Left Branch EventWrapper.
    • Provide the event label tc2 using the properties view.
    • Right-click on Event Wrapper and select New Child/ Synch Events.
    • Select Synch Events and go to the drop-down menu of the Local Event property.
    • From the list of events select the TCCalculate_Average_Temperature event.

The addition of the wrapped event, to the sequence, is simply specification of event ordering. It is implemented in code as a sequential subroutine call statement. We now specify event synchronisation between the task and shared object.

  • Add Synchronisation between TCGet_Target_Temperature2 and SOGet_Target_Temperature2.
    • Further expand the Seq sub-tree until Eventwrapper tc3 appears.
    • Right-click on the sibling Seq node (lowest in the tree) and select New Child/Left Branch EventWrapper.
    • Provide the event label tc4 using the properties view.
    • Right-click on Event Wrapper and select New Child/ Synch Events.
    • Select Synch Events and go to the drop-down menu of the Local Event property.
    • At this point the drop-down box displays a number of event names, select the second TCGet_Target_Temperature2 event.
    • Go to the drop-down menu of the Remote Event property.
    • From the list of events select the second SOGet_Target_Temperature2 event.

We have now completed the task body, and next provide additional details for events. In the first instance we focus on the the TCGet_Target_Temperature2 event in Temp_Ctrl_Task1Impl which is to be synchronized with the SOGet_Target_Temperature2 event in Shared_ObjectImpl.

  • Add The Event Extension.
    • Right-click on the TCGet_Target_Temperature2 Event node.
    • Select New Child/Implementation from the menu.
    • Go to the Implementation properties view and set the Implementation Type property to ProcedureSynch.

We have identified the event as one that partakes in a synchronisation.

  • Identify a parameter direction.
    • Right-click on the tm node.
    • SelectNew Child/Parameter Type.
    • Go to the Parameter Type properties view and set the Parameter Type property to actualIn.

We have now identified the parameter as an actualIn (this models a call's return value).

The Shared Machine

The next step is to identify the SharedObj machine as a Shared Machine. The SharedObj Machine will be extended using the Event-B EMF extension mechanism.

  • Right-click on the SharedObj Machine node in the .tasking file.
  • Select New Child/Extension.
  • Right-click on the Extension node and select New Child/Shared Machine from the menu.

We now show how to extend the SWrite event of the Shared Machine with details about its implementation. The SWrite event in SharedObj is to be synchronized with the TWrite event in the WriterTsk.

  • Identify SWrite as a Syncronisation.
    • Right-click on the SWrite Event node.
    • Select New Child/Extension.
    • Right-click on the Extension node and select New Child/Implementation from the menu.
    • Go to the Implementation properties view and set the Implementation Type property to ProcedureSynch.
  • Identify incoming and outgoing parameters.
    • Right-click on the inFP node and add an Extension.
    • Right-click on the Extension and selectNew Child/Parameter Type.
    • Go to the Parameter Type properties view and set the Parameter Type property to formalIn.
    • Right-click on the outFP node and add an Extension.
    • Right-click on the Extension and selectNew Child/Parameter Type.
    • Go to the Parameter Type properties view and set the Parameter Type property to formalOut.

Optional Annotations for Addressed Variables

Link To Addressed Variables!!!!!


A Summary of Steps

If generating environment simulation code:

  1. Ensure the Environ Machine is first machine in the development.

For a Tasking Machine definition:

  1. Add the Tasking Machine type (Auto etc).
  2. Add the task type (Periodic etc.).
  3. Define the task priority.
  4. Define the task body.
  5. For each event, add the Event Type.
  6. For each event parameter, add the Parameter Type.
  7. Optionally define addressed variables.

For a Shared Machine definition:

  1. Add the SharedMachine Machine type.
  2. For each event, define the Event Type.
  3. For each event parameter, define the Parameter Type.

Invoking the Translation

  • To create the IL1 model,
    • Right-Click on the Main node, select Epsilon Translation/Translate Task Mch 2 IL1 EMF.
    • Open the Resource Perspective.
    • Right-click on the sharedbuffer20100819Tutorial2 project folder.
    • Select refresh, the .il1 file should appear in the project.
    • Open and inspect the file, and view the source code by opening the IL1 Pretty Print view if desired.
  • To create the Event-B model of the implementation,
    • Return to the Rodin Modelling Perspective.
    • Right-Click on the Main node, select Epsilon Translation/Translate Task Mch 2 Event-B EMF.
    • The sharedbuffer20100819bTasking project is generated, it can be opened and inspected.

There are errors in the generated machines (not investigated the cause yet); these can be fixed in the following way.

  • Open a Machine in the Event-B Machine Editor.
  • Select the Edit tab.
  • Open the REFINES section, the error lies here.
  • The correct machine is refined, but choose a different machine to refine (any one, it doesn't matter).
  • Select the original refined machine again.
  • Save and clean the project, and the error should disappear.
  • Repeat for the same errors in the other machines; save and clean again.
  • The machines can viewed as normal using the Rodin editors.
Retrieved from ‘https://wiki.event-b.org/index.php?title=Rodin_Proving_Perspective&oldid=9810’