Difference between pages "Tasking Event-B Overview" and "Tasking Event-B Tutorial"

From Event-B
(Difference between pages)
Jump to navigationJump to search
imported>Andy
 
imported>Andy
 
Line 1: Line 1:
−
=== Tasking Event-B ===
+
For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk
−
Tasking Event-B can be viewed as an extension of the existing Event-B language. We use the existing approaches of refinement and decomposition to structure a project that is suitable for a Tasking Development. During the modelling phase parameters are introduced to facilitate decomposition. As a result of the decomposition process, parameters become part of the interface that enables event synchronization. We make use of this interface and add information (see [[#Implementing Events]]) to facilitate code generation. The tasking extension consists of the constructs in the following table.
+
=== Tasking Event-B Tutorial Overview ===
 +
 
 +
This tutorial follows on from the abstract development described [http://wiki.event-b.org/index.php/Development_of_a_Heating_Controller_System here].
 +
 
 +
This code generation tutorial extends the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces implementable Ada code, and also an Event-B model. It is a model of the implementation, and contains flow control variables that model the flow of execution through the task body. The Ada code is produced from an intermediate model that is not visible to the user. The Common Language model (CLM), is generated from the Tasking Event-B by a translation tool. Ada (and other implementations) may be generated from the CLM. An overview of Tasking Event-B can be found [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview here].
 +
 
 +
In the example so far, the Heating Controller has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines modelling tasks, shared objects and the environment are identified, and extended with the appropriate implementation details.
 +
 
 +
The example/tutorial projects are are available in the [http://deploy-eprints.ecs.soton.ac.uk/304/ e-prints archive], or on [https://codegenerationd.svn.sourceforge.net/svnroot/codegenerationd/Examples/Heating_ControllerTutorial_v0.2.0/ SVN].
  
−
<center>
 
 
{| border="1"
 
{| border="1"
−
!Construct
+
|Heating_ControllerTutorial2_Completed
−
!Options
+
|An example project with an environment simulation. The environment variables are monitored and controlled using subroutine calls. The project contains a complete Tasking Development with generated Event-B and Ada code.
−
|-
 
−
|Machine Type
 
−
|DeclaredTask, [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Tasking_Machines AutoTask], [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Shared_Machines SharedMachine], [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#The_Environ_Machine Environ]
 
−
|-
 
−
|[http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Control_Constructs Control]
 
−
|Sequence, Loop, Branch, Event, Output
 
 
|-
 
|-
−
|[http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Tasking_Machines Task Type]
+
|Heating_ControllerTutorial2_Partial1
−
|Periodic(n), Triggered, Repeating, OneShot
+
|A project with the final decomposition completed, ready to begin Tasking Event-B Development.
 
|-
 
|-
−
|Priority
+
|Heating_ControllerTutorial2_Partial2
−
| -
+
|A partially completed tasking specification for the continuation of the tutorial.
 
|-
 
|-
−
|[http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Implementing_Events Event Role]
+
|TheoriesForCG
−
| Actuating, Sensing
+
|Contains the mathematical language translations; encoded as rules in a theory plug-in rule-base.
−
|-  
 
−
|[http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Addressed_Variables Addressed Variable]
 
−
|Address, Base
 
 
|}
 
|}
−
</center>
 
  
−
==== Tasking Machines ====
+
== Using the Tasking Extension ==
−
The following constructs relate to Tasking and Environ Machines, and provide implementation details. Timing of periodic tasks is not modelled formally. Tasking and Environ Machines model Ada tasks, so they can be implemented easily in Ada; in C using the pthread library, or in Java using threads.
+
The steps needed to generate code from an Event-B model, in this tutorial, are as follows,
 +
* Step 1 - [[Tasking Event-B_Tutorial#Adding the Implementation Level Refinement|Adding the Implementation Level Refinement]]
 +
* Step 2 - [[Tasking Event-B_Tutorial#Pre-processing|Pre-processing]]
 +
* Step 3 - [[Tasking Event-B_Tutorial#Adding Tasking Event-B|Add Tasking annotations]].
 +
* Step 4 - [[Tasking Event-B_Tutorial#Invoking the Translation|Invoke translators]].
 +
=== Download and Copy the Theories ===
 +
The translations of the Event-B mathematical language to the target language constructs are specified as rules in the theory plug-in. Three rule files are included for the example, and are available in the [https://codegenerationd.svn.sourceforge.net/svnroot/codegenerationd/Examples/TheoriesForCG SVN]. The files can be downloaded and copied into an Event-B project called ''MathExtensions''. The theory must then be deployed. Right-Click on the theory file and select deploy to do this. The non-Event-B project, the original download may now be deleted.
 +
 
 +
=== Adding the Implementation Level Refinement ===
 +
The final decomposition generates the machines that are required for code generation. However, it is not possible to edit the machines since they are machine generated, and therefore this is prohibited. In order to be able to modify the models we will refine the generated machines. This is where we begin with the ''Heating_ControllerTutorial2_Partial1'' project (Where the pre-processing steps, described below, have been performed already). To refine the machines we can use the automatic refinement feature, but this presents us with two problems that are dealt with in the pre-processing steps.
 +
 
 +
=== Pre-processing ===
 +
 
 +
The pre-processing steps, described here, should be a temporary solution. The steps can be performed automatically, if appropriate changes are made to facilitate refinement of composed machines, and flattening of files.
 +
 
 +
* The Code Generator requires a flattened version of each machine; all of the Event-B elements should be available in the implementation level machine.  
 +
* Composed machines are not currently able to be refined, so anything that requires synchronization of events requires some manual updates.
 +
 
 +
===== 'Flattening' the Implementation Machines =====
 +
 
 +
The temporary solution for flattening:
 +
* Make events ''not extended''.
 +
* Copy missing invariants.
 +
 
 +
I found the Event-B Machine Editor's synthesis view useful for this. Invariants can be copy-pasted into the implementation machine from the abstraction. (A dummy invariant can be added and selected for pasting)
 +
 
 +
===== Providing the correct Composed Machine =====
 +
 
 +
The composed machine problem is sub-divided into two sub-problems. Firstly composed machines cannot be refined, and secondly when a machine is further decomposed there is no link between the first composed machine and the newly generated composed machine. So one or both of these problems may occur, depending on the number of decompositions.
 +
 
 +
We must manually add the information to the composed machines to address these two problems.
 +
 
 +
The temporary solution for composed machines:
 +
* Modify the lowest level decomposed machine, HCtrl_M1_cmp, to ''include'' the implementation level machines (task names ending in *Impl). To do this,
 +
* open the composed machine editor. Open the INCLUDES edit feature.
 +
* Select the second drop-down box and find the *Impl version of each machine.
 +
* Save the composed machine.
 +
* Now add missing synchronizations to the composed machine. Add the ''Envir1Impl'' to the includes of HCtrl_M1_cmp.
 +
* Each composed event in the task, that synchronizes with the Environ machine, must have the remote event synchronization added manually. This can only be done by inspection of each composed event. We need to update Sense_Temperatures, Display_Current_Temperature, Actuate_OverHeat_Alram, Actuate_Heat_Source, Sense_Heater_Status, Actuate_NoHeat_Alarm, Sense_PressIncrease_Target_Temperature, Sense_PressDecrease_Target_Temperature, Display_Target_Temperature. One by one, expand the events in the composed events section of the composed machine editor; add a new event in the combines events section, select ''Envir1Impl'' and add the synchronizing event from the list-box to the right.
 +
 
 +
=== Removing Non-deterministic Constructs ===
 +
 
 +
It is also at this stage that any remaining non-deterministic constructs should be removed by replacing them with deterministic constructs.
 +
 
 +
TIP: Non-deterministic constructs cause strange characters to appear in the source code. If you see strange characters in the generated code, check for non-deterministic constructs in the implementation level machines.
 +
 
 +
Alter_Temperature_Sensor1 in Envir1Impl: action becomes ts1 := ts1 + 1
 +
Alter_Temperature_Sensor2 in Envir1Impl: action becomes ts1 := ts1 + 1
 +
Alter_Heater_Status in Envir1Impl: action becomes hss := FALSE
 +
INITIALISATION in Heater_Monitor_TaskImpl: becomes shs := FALSE
 +
 
 +
We also need to add a typing flag to an invariant. We need to add it in only one place, and this is where an invariant is used type a variable, in the Heating Controller machine. The flag is used to guide the translator to the typing invariant. This is because there may be more than one invariant involving that particular variable. They may also be added to guards where parameters are typed in guards, and the parameters are referred to in more than one guard.
  
−
* Tasking Machines may be one of the following types:
+
* Go to the ''Heater_Monitor_TaskImpl typing_shs'' invariant.
−
** AutoTasks - Anonymous Tasks running from start-up.
+
* Add the typing flag, by right-clicking on the invariant and selecting typing from the menu.
−
** Declared tasks - (Not currently used) A task template relating to an Ada ''tasktype'' declaration.  
 
  
−
''Auto Tasks'' are tasks that will be declared and defined in the ''Main'' procedure of the implementation. The effect of this is that the ''Auto Tasks'' are created when the program first loads, and then activated (made ready to run) before the ''Main'' procedure body runs.
+
=== Adding Tasking Event-B ===
 +
We will now work with the last of the tutorial projects, ''Heating_ControllerTutorial2_Partial2''.
  
−
* Tasking and Environ Machines options are:
+
*Setting Context attributes.
−
** TaskType - Defines the scheduling, cycle and lifetime of a task. i.e. one-shot periodic or triggered. The period of a task is specified in milliseconds.
+
**Open the project ''Heating_ControllerTutorial2_Partial2''.  
−
** Priority - An integer value is supplied, the task with the highest value priority takes precedence when being scheduled. The default priority is 5.
+
**Open the context, select the Tasking Context drop-down box, and select Tasking, as the type for the context.  
  
−
==== Shared Machines ====
+
This will ensure that code generation related static checks are performed. Select the 'Typing' option for Axioms ''axm3'' and ''axm4'', i.e. ''Min'' and ''Max'' are Typing axioms. The other axioms should be set to non-typing.
−
A Shared Machine models a protected resource, such as a monitor. It may be implemented in Ada as a Protected Object, in C using mutex locking, or in Java as a monitor.
 
  
−
* A Shared Machine is identified using the ''Shared Machine'' annotation.
+
Each Machine should be completed as follows.
 +
==== The Temp_Ctrl_TaskImpl Machine ====
 +
During this part of the tutorial we will cut and paste from ''Heating_ControllerTutorial2_Completed'' model when, specifying the task bodies, to save typing.
  
−
==== The Environ Machine ====
+
*Set the Task Type to ''Auto Task''
−
An Environ machine is a model of the environment. It can be used to generate code for use in a simulation, or be discarded in the case that a simulated environment is not required.
+
**Open The Tasking section of the Event-B editor.
 +
**Click on + to add a new Machine Type.
 +
**Ensure Auto Task is selected in the Drop-down box.
  
−
* An Environ Machine is identified using the ''Environ Machine'' annotation.
+
''Auto Tasks'' are tasks that will be declared and defined in the ''Main'' procedure of the implementation. The effect of this is that the ''Auto Tasks'' are created when the program first loads, and then activated (made ready to run) before the ''Main'' procedure body runs.  
  
−
=== Control of Program Flow ===
+
*'''Add a new TaskBody'''.
−
At the implementation stage we need to think about controlling the flow of execution; and where interaction with the environment is concerned, how events should be implemented. The following section describes the constructs that we have introduced to facilitate this.
+
**Open Task Type (click on |> right arrow) in the Machine Type element
−
==== Control Constructs ====
+
**Set the task type to ''Periodic'',
−
Each Tasking Machine has a ''task body'' which contains the flow control (algorithmic constructs).
+
**Set a period of 250 milliseconds.
 +
**Add a new Task Body section.
 +
**Copy and paste the task body from ''Heating_ControllerTutorial2_Completed/Temp_Ctrl_TaskImpl''
 +
**Save the model and rectify any problems highlighted.
 +
<!-- We now look at the sensing event ''Sense_Temperatures'' event in ''Temp_Ctrl_TaskImpl''. In order to assist with the translation we add the following annotation:
  
−
* We have the following constructs available in the Tasking Machine body:
+
*'''Add a Sensed Event Annotation'''.
−
** Sequence - for imposing an order on events.
+
** Right-click on the ''Sense_Temperatures'' Event node.
−
** Branch - choice between a number of mutually exclusive events.
+
** Select ''New Child/Implementation'' from the menu.
−
** Loop - event repetition while it's guard remains true.
+
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Sensing''.
−
** Event - a wrapper for the Event-B element (soon to be redundant).
 
−
** Text Output - writes textual output to the screen.
 
  
−
The syntax for task bodies, as used in the Rose TaskBody editor, is as follows:
+
We now look at the actuating event ''Display_Current_Temperatures'' event in ''Temp_Ctrl_TaskImpl''. In order to assist with the translation we add the following annotation:
  
−
<br/>
+
*'''Add an Actuating Event Annotation'''.
−
[[Image:Syntax.png]]
+
** Right-click on the ''Display_Current_Temperatures'' Event node.
−
<br/>
+
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Actuating''.
 +
-->
  
−
The ''String'' will be an event name, a variable name, or a text fragment to be output to the screen. The concrete syntax is shown in bold red font. '*' indicates 0 or more; [] indicates 0 or 1.
+
==== The Shared Machine ====
  
−
===== Event Translation =====
+
The next step is to identify the ''Shared_ObjectImpl'' machine as a ''Shared Machine''.
−
When an event, used in the task body, is translated to an implementation its translation depends on where it is used in the task body. The mappings are relatively simple for branch, loop, and sequence; but, in addition to the parent construct, the Event translation depends on whether it is part of a synchronization. Obviously the simplest translation is when no synchronization is involved. The translator checks the composed machine to see if the event is paired in a combined event. We say that events is a Tasking machine are local, and that events in a Shared or Environ machine, are remote. If there is no synchronization, then the actions of the local event are expanded in-line in the subroutine body.  
+
*Open the Tasking Section.
 +
*Add a Machine Type by clicking +.
 +
* Select ''Shared'' in the Machine Type drop Down box.
  
−
'''NOTE''': As a result of the decomposition process, the tool can produce a remote event, without a corresponding local event. A local event, with no guards and skip action, must be added manually to the tasking machine, and composed machine in order to facilitate code generation. This will be automated in a pre-processing step in the near future tooling. It is not necessary to have a dummy remote event if a remote event does not exist.
+
==== The Environ Machine ====
 +
In the prepared machine we identify the ''Envir1Impl'' as an ''Environ Machine'',
  
−
===== Synchronization =====
+
*Open the Tasking Section in the Machine Editor
 +
* Click on + to add a machine type.
 +
*Select ''Environ Machine'' in the drop down box.
  
−
Synchronization between local events (in AutoTasks) and remote events (in shared/Environ Machines) is determined using the composed machine. To use an event simply enter its name in the TaskBody editor. The translator will in-line any local actions, and add a call to perform remote updates, and obtain remote data.
+
In the implementation, ''Environ Tasks'' are declared and defined in the ''Main'' procedure . The ''Envir1Impl'' machine models a task that simulates the environment, and can be used to generate simulation code. For deployment in a non-simulated environment the environ machine's generated code can be ignored. To specify the Environment task's behaviour we add edit the task body.
  
−
Interim measure ......
+
*'''Add the Task Details'''.
 +
**Open the Task Type section.
 +
**Set the task type to ''Periodic'',
 +
**Set a period of 100 milliseconds.  
 +
**Add a new Task Body by clicking + in the Task Body section
 +
**Copy and paste the task body from ''Heating_ControllerTutorial2_Completed/Envir1Impl''
 +
**Save the model.
 +
**Resolve any problems that are highlighted.
  
−
Synchronization corresponds to:
+
When saving, the task body text is sent to the parser. If parsing is successful then a builder adds the structure to the underlying EMF tree. If parsing fails then an error panel displays the source of the error.
−
* a subroutine call from task to shared machine, or,
+
<!-- The final step is to complete the ''Sense_Temperatures'' event. The event, being a kind of synchronization, synchronizes with the ''Sense_Temperatures'' event in the ''Temp_Ctrl_Task'' tasking machine. We annotate the model with sensing and actuating implementation types.
−
* sensing or actuating of environment variables.
 
  
−
In the case of a subroutine call the subroutine is an atomic (with respect to an external viewer) update to state. The updates in the protected resource are implemented by a procedure call to a protected object, and tasks do no share state.  The synchronization construct also provides the means to specify parameter passing, both in and out of the task.
+
*'''Add a Sensed Event Annotation'''.
 +
** Right-click on the ''Sense_Temperatures'' Event node.
 +
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Sensing''.
  
−
In the case of a sensing or actuating event, the updates of the action correspond to reads of monitored variables, and writes to controlled variables of the environment.
+
*'''Add an Actuating Event Annotation'''.
 +
** Right-click on the ''Display_Current_Temperatures'' Event node.
 +
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Actuating''.
 +
-->
  
−
==== Implementing Events ====
 
−
An event's role in the implementation is identified using the following extensions which are added to the event. Events used in task bodies are 'references' that make use of existing event definitions from the abstract development. The events are extended. to assist with translation, with a keyword indicating their role in the implementation.
 
  
−
* Event implementation role.
 
−
** Branch - In essence a task's event is split in the implementation; guards are mapped to branch conditions and actions are mapped to the branch body. If the branch refers to a Shared Machine event (procedureDef) then this is mapped to a simple procedure call.
 
−
** Loop - The task's event guard maps to the loop condition and actions to to loop body. If the loop refers to a Shared Machine event then it is mapped to a simple procedure call.
 
−
** ProcedureSynch - This usually indicates to the translator that the event maps to a subroutine, but an event in a task may not require a subroutine implementation if its role is simply to provide parameters for a procedure call.
 
−
** ProcedureDef - Identifies an event that maps to a (potentially blocking) subroutine definition. Event guards are implemented as a conditional wait; in Ada this is an entry barrier, and in C may use a pthread condition variable .
 
−
** Sensing - Identifies an event that maps to a read from the environment. If the environment is simulated without address variables then the sensing event is similar to a ProcedureSynch event, in that it has an update action that models assignment of a return value from a subroutine call. The event parameters act like the ''actualIn'' parameters of a ProcedureSynch event. On the other hand, if the event has addressed variables associated with its event parameters, then they map to direct reads from memory mapped variables in the generated code.
 
−
** Actuating - Identifies an event that maps to a write to the environment. If the environment is simulated without address variables then the actuating event has no update action, the parameters act like ''actualOut'' parameters of a ProcedureSynch event. If a sensing event has addressed variables associated with its parameters then they map to direct writes to memory mapped variables in the generated code.
 
  
−
Sensing (and actuating) can be viewed as a kind of synchronisation. Synchronisation between tasks and shared objects are represented as subroutine calls. The sensing/actuating synchronisations only occur between tasks and the environment. In implementable code, when an subroutine is defined, its formal parameters are replaced by actual parameter values at run-time. To assist the code generator we extend the Event-B parameters. We identify formal and actual parameters in the implementation, and add the following keywords to the event parameters, as follows:
+
=== A Summary of Steps ===
 +
For a Tasking Machine definition:
 +
# Select the Tasking Machine type (Auto etc).
 +
# Set the task type (Periodic etc.).
 +
# Set the task priority.
 +
# Specify the task body.
 +
<!-- # For sensing/actuating events, add the Event Type. -->
  
−
* Event parameter types - Note: formal parameters are place-holders in a subroutine; they are replaced by the actual parameters at call time.
+
For a Shared Machine definition:
−
** FormalIn or FormalOut - event parameters are extended with the ParameterType construct. Extension with formal parameters indicates a mapping to formal parameters in the implementation.
+
# Add the ''SharedMachine'' Machine type.
−
** ActualIn or ActualOut - Extension with an actual parameter indicates a mapping to an actual parameter in the implementation.
 
  
−
===== Addressed Variables =====
+
For an Environ Machine definition:
−
When sensing monitored variables, or actuating controlled variables in the environment, we may wish to use explicit memory addresses for use in the final implementation, or perhaps in the environment simulation too. We can link a task's event parameters, and an Environ machines variables, with specific addresses and use these in the generated code.
+
# Make the type an Environ Machine type.
 +
# Set the task type Periodic; a shorter period than the shortest task period is best for simulation.
 +
# Set the task priority.
 +
# Specify the task body, it will contain a simulation of changes in the environment.
 +
# For each sensing/actuating event, add the Event Type.
  
−
== References ==
+
== Invoking the Translators ==
  
−
<references/>
+
* To generate Ada code,
 +
** Right-Click on the composed machine, or any tasking machine in the development, select ''Code Generation/Translate Event-B to Ada''.
 +
** Open the generated ''code'' directory in the project to view the source files. A refresh will be necessary to make the code visible. The .gpr file has been provided for AdaCore GPS users.
  
 +
* To create the Event-B model of the implementation,
 +
** Right-Click on the composed machine, or any tasking machine in the development, select ''Code Generation/Translate Tasking Event-B to Event-B''.
 +
** The Event-B model should be updated with the flow control variables. Users are not able to manually edit the generated elements. The additions can be removed using the menu option ''Code Generation/Remove Generated Event-B''
  
 +
=== Generated Code ===
 +
Generated code will be visible in the code directory, in the Event-B project. However a refresh of the workspace is required. The directory is visible in the resource view; or alternatively, click on the view menu in the Event-B perspective, select customize view, and uncheck the ''all file and folders'' filter.
 
[[Category:User documentation]]
 
[[Category:User documentation]]

Revision as of 13:20, 8 May 2012

For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk

Tasking Event-B Tutorial Overview

This tutorial follows on from the abstract development described here.

This code generation tutorial extends the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces implementable Ada code, and also an Event-B model. It is a model of the implementation, and contains flow control variables that model the flow of execution through the task body. The Ada code is produced from an intermediate model that is not visible to the user. The Common Language model (CLM), is generated from the Tasking Event-B by a translation tool. Ada (and other implementations) may be generated from the CLM. An overview of Tasking Event-B can be found here.

In the example so far, the Heating Controller has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines modelling tasks, shared objects and the environment are identified, and extended with the appropriate implementation details.

The example/tutorial projects are are available in the e-prints archive, or on SVN.

Heating_ControllerTutorial2_Completed An example project with an environment simulation. The environment variables are monitored and controlled using subroutine calls. The project contains a complete Tasking Development with generated Event-B and Ada code.
Heating_ControllerTutorial2_Partial1 A project with the final decomposition completed, ready to begin Tasking Event-B Development.
Heating_ControllerTutorial2_Partial2 A partially completed tasking specification for the continuation of the tutorial.
TheoriesForCG Contains the mathematical language translations; encoded as rules in a theory plug-in rule-base.

Using the Tasking Extension

The steps needed to generate code from an Event-B model, in this tutorial, are as follows,

Download and Copy the Theories

The translations of the Event-B mathematical language to the target language constructs are specified as rules in the theory plug-in. Three rule files are included for the example, and are available in the SVN. The files can be downloaded and copied into an Event-B project called MathExtensions. The theory must then be deployed. Right-Click on the theory file and select deploy to do this. The non-Event-B project, the original download may now be deleted.

Adding the Implementation Level Refinement

The final decomposition generates the machines that are required for code generation. However, it is not possible to edit the machines since they are machine generated, and therefore this is prohibited. In order to be able to modify the models we will refine the generated machines. This is where we begin with the Heating_ControllerTutorial2_Partial1 project (Where the pre-processing steps, described below, have been performed already). To refine the machines we can use the automatic refinement feature, but this presents us with two problems that are dealt with in the pre-processing steps.

Pre-processing

The pre-processing steps, described here, should be a temporary solution. The steps can be performed automatically, if appropriate changes are made to facilitate refinement of composed machines, and flattening of files.

  • The Code Generator requires a flattened version of each machine; all of the Event-B elements should be available in the implementation level machine.
  • Composed machines are not currently able to be refined, so anything that requires synchronization of events requires some manual updates.
'Flattening' the Implementation Machines

The temporary solution for flattening:

  • Make events not extended.
  • Copy missing invariants.

I found the Event-B Machine Editor's synthesis view useful for this. Invariants can be copy-pasted into the implementation machine from the abstraction. (A dummy invariant can be added and selected for pasting)

Providing the correct Composed Machine

The composed machine problem is sub-divided into two sub-problems. Firstly composed machines cannot be refined, and secondly when a machine is further decomposed there is no link between the first composed machine and the newly generated composed machine. So one or both of these problems may occur, depending on the number of decompositions.

We must manually add the information to the composed machines to address these two problems.

The temporary solution for composed machines:

  • Modify the lowest level decomposed machine, HCtrl_M1_cmp, to include the implementation level machines (task names ending in *Impl). To do this,
  • open the composed machine editor. Open the INCLUDES edit feature.
  • Select the second drop-down box and find the *Impl version of each machine.
  • Save the composed machine.
  • Now add missing synchronizations to the composed machine. Add the Envir1Impl to the includes of HCtrl_M1_cmp.
  • Each composed event in the task, that synchronizes with the Environ machine, must have the remote event synchronization added manually. This can only be done by inspection of each composed event. We need to update Sense_Temperatures, Display_Current_Temperature, Actuate_OverHeat_Alram, Actuate_Heat_Source, Sense_Heater_Status, Actuate_NoHeat_Alarm, Sense_PressIncrease_Target_Temperature, Sense_PressDecrease_Target_Temperature, Display_Target_Temperature. One by one, expand the events in the composed events section of the composed machine editor; add a new event in the combines events section, select Envir1Impl and add the synchronizing event from the list-box to the right.

Removing Non-deterministic Constructs

It is also at this stage that any remaining non-deterministic constructs should be removed by replacing them with deterministic constructs.

TIP: Non-deterministic constructs cause strange characters to appear in the source code. If you see strange characters in the generated code, check for non-deterministic constructs in the implementation level machines. 

Alter_Temperature_Sensor1 in Envir1Impl: action becomes ts1 := ts1 + 1
Alter_Temperature_Sensor2 in Envir1Impl: action becomes ts1 := ts1 + 1
Alter_Heater_Status in Envir1Impl: action becomes hss := FALSE
INITIALISATION in Heater_Monitor_TaskImpl: becomes shs := FALSE

We also need to add a typing flag to an invariant. We need to add it in only one place, and this is where an invariant is used type a variable, in the Heating Controller machine. The flag is used to guide the translator to the typing invariant. This is because there may be more than one invariant involving that particular variable. They may also be added to guards where parameters are typed in guards, and the parameters are referred to in more than one guard.

  • Go to the Heater_Monitor_TaskImpl typing_shs invariant.
  • Add the typing flag, by right-clicking on the invariant and selecting typing from the menu.

Adding Tasking Event-B

We will now work with the last of the tutorial projects, Heating_ControllerTutorial2_Partial2.

  • Setting Context attributes.
    • Open the project Heating_ControllerTutorial2_Partial2.
    • Open the context, select the Tasking Context drop-down box, and select Tasking, as the type for the context.

This will ensure that code generation related static checks are performed. Select the 'Typing' option for Axioms axm3 and axm4, i.e. Min and Max are Typing axioms. The other axioms should be set to non-typing.

Each Machine should be completed as follows.

The Temp_Ctrl_TaskImpl Machine

During this part of the tutorial we will cut and paste from Heating_ControllerTutorial2_Completed model when, specifying the task bodies, to save typing.

  • Set the Task Type to Auto Task
    • Open The Tasking section of the Event-B editor.
    • Click on + to add a new Machine Type.
    • Ensure Auto Task is selected in the Drop-down box.

Auto Tasks are tasks that will be declared and defined in the Main procedure of the implementation. The effect of this is that the Auto Tasks are created when the program first loads, and then activated (made ready to run) before the Main procedure body runs.

  • Add a new TaskBody.
    • Open Task Type (click on |> right arrow) in the Machine Type element
    • Set the task type to Periodic,
    • Set a period of 250 milliseconds.
    • Add a new Task Body section.
    • Copy and paste the task body from Heating_ControllerTutorial2_Completed/Temp_Ctrl_TaskImpl
    • Save the model and rectify any problems highlighted.

The Shared Machine

The next step is to identify the Shared_ObjectImpl machine as a Shared Machine.

  • Open the Tasking Section.
  • Add a Machine Type by clicking +.
  • Select Shared in the Machine Type drop Down box.

The Environ Machine

In the prepared machine we identify the Envir1Impl as an Environ Machine,

  • Open the Tasking Section in the Machine Editor
  • Click on + to add a machine type.
  • Select Environ Machine in the drop down box.

In the implementation, Environ Tasks are declared and defined in the Main procedure . The Envir1Impl machine models a task that simulates the environment, and can be used to generate simulation code. For deployment in a non-simulated environment the environ machine's generated code can be ignored. To specify the Environment task's behaviour we add edit the task body.

  • Add the Task Details.
    • Open the Task Type section.
    • Set the task type to Periodic,
    • Set a period of 100 milliseconds.
    • Add a new Task Body by clicking + in the Task Body section
    • Copy and paste the task body from Heating_ControllerTutorial2_Completed/Envir1Impl
    • Save the model.
    • Resolve any problems that are highlighted.

When saving, the task body text is sent to the parser. If parsing is successful then a builder adds the structure to the underlying EMF tree. If parsing fails then an error panel displays the source of the error.


A Summary of Steps

For a Tasking Machine definition:

  1. Select the Tasking Machine type (Auto etc).
  2. Set the task type (Periodic etc.).
  3. Set the task priority.
  4. Specify the task body.

For a Shared Machine definition:

  1. Add the SharedMachine Machine type.

For an Environ Machine definition:

  1. Make the type an Environ Machine type.
  2. Set the task type Periodic; a shorter period than the shortest task period is best for simulation.
  3. Set the task priority.
  4. Specify the task body, it will contain a simulation of changes in the environment.
  5. For each sensing/actuating event, add the Event Type.

Invoking the Translators

  • To generate Ada code,
    • Right-Click on the composed machine, or any tasking machine in the development, select Code Generation/Translate Event-B to Ada.
    • Open the generated code directory in the project to view the source files. A refresh will be necessary to make the code visible. The .gpr file has been provided for AdaCore GPS users.
  • To create the Event-B model of the implementation,
    • Right-Click on the composed machine, or any tasking machine in the development, select Code Generation/Translate Tasking Event-B to Event-B.
    • The Event-B model should be updated with the flow control variables. Users are not able to manually edit the generated elements. The additions can be removed using the menu option Code Generation/Remove Generated Event-B

Generated Code

Generated code will be visible in the code directory, in the Event-B project. However a refresh of the workspace is required. The directory is visible in the resource view; or alternatively, click on the view menu in the Event-B perspective, select customize view, and uncheck the all file and folders filter.

Retrieved from ‘https://wiki.event-b.org/index.php?title=Tasking_Event-B_Overview&oldid=10072’