Difference between pages "Tasking Event-B Tutorial" and "Theory Plug-in"

From Event-B
(Difference between pages)
Jump to navigationJump to search
imported>Andy
 
(Add to Theory Plug-in category)
 
Line 1: Line 1:
For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk
+
Return to [[Rodin Plug-ins]]
=== Tasking Event-B Tutorial Overview ===
 
  
This tutorial follows on from the abstract development described [http://wiki.event-b.org/index.php/Development_of_a_Heating_Controller_System here].
+
See also [[Theory Release History]]
  
This code generation tutorial extends the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces implementable Ada code, and also an Event-B model. It is a model of the implementation, and contains flow control variables that model the flow of execution through the task body. The Ada code is produced from an intermediate model that is not visible to the user. The Common Language model (CLM), is generated from the Tasking Event-B by a translation tool. Ada (and other implementations) may be generated from the CLM. An overview of Tasking Event-B can be found [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview here].
+
The Theory plug-in provides capabilities to extend the Event-B language and the proving infrastructure in a familiar fashion to Rodin users. This page provides useful information about the plug-in and its capabilities.
  
In the example so far, the Heating Controller has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines modelling tasks, shared objects and the environment are identified, and extended with the appropriate implementation details.
+
===Motivation===
 +
Up to Rodin v2.0, the mathematical language used in Event-B has been fixed. As such, it was not possible to define reusable polymorphic operators. A workaround was to define any required operators as set constructs in contexts. Originally, contexts were supposed to provide a parametrization of machines. The aforementioned limitations of the Event-B language lead to users to use contexts for purposes for which they were not intentionally devised. Examples of operators that can be useful to users include the sequence operator (which was present in classical B mathematical language) and the bag operator.
  
The example/tutorial projects are are available in the [http://deploy-eprints.ecs.soton.ac.uk/304/ e-prints archive], or on [https://codegenerationd.svn.sourceforge.net/svnroot/codegenerationd/Examples/Heating_ControllerTutorial_v0.2.0/ SVN].
+
In Rodin v2.0, support for customised syntactic symbols was introduced. The Theory plug-in, as a result, evolved from being just a component to define rewrite rules to a versatile platform to define and validate proof and language extensions.
  
{| border="1"
+
The latest Theory plug-in is released for Rodin v2.8.
|Heating_ControllerTutorial2_Completed
 
|An example project with an environment simulation. The environment variables are monitored and controlled using subroutine calls. The project contains a complete Tasking Development with generated Event-B and Ada code.
 
|-
 
|Heating_ControllerTutorial2_Partial1
 
|A project with the final decomposition completed, ready to begin Tasking Event-B Development.
 
|-
 
|Heating_ControllerTutorial2_Partial2
 
|A partially completed tasking specification for the continuation of the tutorial.
 
|-
 
|TheoriesForCG
 
|Contains the mathematical language translations; encoded as rules in a theory plug-in rule-base.
 
|}
 
  
== Using the Tasking Extension ==
+
===Overview===
The steps needed to generate code from an Event-B model, in this tutorial, are as follows,
+
The Theory plug-in is a Rodin extension that provides the facility to define '''''mathematical extensions''''' as well as '''''prover extensions'''''.
* Step 1 - [[Tasking Event-B_Tutorial#Adding the Implementation Level Refinement|Adding the Implementation Level Refinement]]
+
Mathematical extensions are new operator definitions and new datatype definitions and axiomatic definitions. Operator definitions can be expression operators (e.g., ''card'') and predicate operators (e.g., ''finite''). Datatypes extensions can be used to define enumerated datatypes (e.g., ''DIRECTION'') as well as inductive datatypes (e.g., ''Tree''). Axiomatic definitions can be used to define new data types like "REAL".
* Step 2 - [[Tasking Event-B_Tutorial#Pre-processing|Pre-processing]]
 
* Step 3 - [[Tasking Event-B_Tutorial#Adding Tasking Event-B|Add Tasking annotations]].
 
* Step 4 - [[Tasking Event-B_Tutorial#Invoking the Translation|Invoke translators]].
 
=== Download and Copy the Theories ===
 
The translations of the Event-B mathematical language to the target language constructs are specified as rules in the theory plug-in. Three rule files are included for the example, and are available in the [https://codegenerationd.svn.sourceforge.net/svnroot/codegenerationd/Examples/TheoriesForCG SVN]. The files can be downloaded and copied into an Event-B project called ''MathExtensions''. The theory must then be deployed. Right-Click on the theory file and select deploy to do this. The non-Event-B project, the original download may now be deleted.
 
  
=== Adding the Implementation Level Refinement ===
+
The placeholder for mathematical and prover extensions is a Theory construct which looks similar to contexts and machines. A theory can include datatypes definitions, operator definitions, axiomatic definitions, inference and rewrite rules as well as polymorphic theorems. The [http://wiki.event-b.org/images/Theory_Plugin.pdf user manual] provides a guide to developing and using theories.
The final decomposition generates the machines that are required for code generation. However, it is not possible to edit the machines since they are machine generated, and therefore this is prohibited. In order to be able to modify the models we will refine the generated machines. This is where we begin with the ''Heating_ControllerTutorial2_Partial1'' project (Where the changes, described below, have been made already). To refine the machines we can use the automatic refinement feature, but this presents us with two problems that are dealt with in the pre-processing step. It is also at this stage that any remaining non-deterministic constructs should be removed by replacing them with deterministic constructs.
 
  
TIP: Non-deterministic constructs cause strange characters to appear in the source code. If you see strange characters in the generated code, check for non-deterministic constructs in the implementation level machines.
+
=== Installation & Update ===
  
Alter_Temperature_Sensor1 in Envir1Impl: action becomes ts1 := ts1 + 1
+
The installation or update for the Theory plug-in is available under the main Rodin Update site (http://rodin-b-sharp.sourceforge.net/updates) under the category "Modelling Extensions". Like always, after the installation, restarting Rodin is recommended.
Alter_Temperature_Sensor2 in Envir1Impl: action becomes ts1 := ts1 + 1
 
Alter_Heater_Status in Envir1Impl: action becomes hss := FALSE
 
INITIALISATION in Heater_Monitor_TaskImpl: becomes shs := FALSE
 
  
We also need to add a typing flag to an invariant. We need to add it in only one place, and this is where an invariant is used type a variable, in the Heating Controller machine. The flag is used to guide the translator to the typing invariant. This is because there is more than one invariant involving that particular variable. They may also be added to guards where parameters are typed in guards, and the parameters are referred to in more than one guard.
+
===User Manual===
 +
The user manual is available here: [http://wiki.event-b.org/images/Theory_Plugin.pdf Theory User Manual]. Below is the presentation of the sequence theory which its description can be found in the user manual:
  
* Go to the ''Heater_Monitor_TaskImpl typing_shs'' invariant.
+
[[image:SeqTheory.png|center|thumb|1500px|'''Theory of Sequence''']]
* Add the typing flag, by right-clicking on the invariant and selecting typing from the menu.
 
  
=== Pre-processing ===
+
===Standard Library===
 +
In this section, you find a set of standard theories and some models using some of these theories.
  
The pre-processing steps, described here, should be a temporary solution. The steps can be performed automatically, if appropriate changes are made to facilitate refinement of composed machines, and flattening of files.  
+
The standard library of the theories is available to download:
 +
[https://sourceforge.net/projects/rodin-b-sharp/files/Theory_StdLib/StandardTheory0.1.zip/download here] for Rodin2.8 and
 +
[https://sourceforge.net/projects/rodin-b-sharp/files/Theory_StdLib/StandardTheory0.2.zip/download here] for Rodin3.1.
 +
This library includes:
 +
* BasicTheory project: including theories of BinaryTree, BoolOps, List, PEANO, SUMandPRODUCT and Seq.
 +
* RelationOrderTheory project: including theories of Connectivity, FixPoint, Relation, Well_Fondation, closure, complement and galois.
 +
* RealTheory project: including theory of Real.
  
* The Code Generator requires a flattened version of each machine; all of the Event-B elements should be available in the implementation level machine.
+
Also it includes three simple Event-B models that use some of the theories:
* Composed machines are not currently able to be refined, so anything that requires synchronization of events requires some manual updates.
+
* Data project: using SUMandPRODUCT theory
 +
* Queue project: using Seq theory
 +
* SimpleNetwork project: using closure theory
  
===== 'Flattening' the Implementation Machines =====
+
In order to keep the POs discharged, you need to install "Atelier B provers" as well.
  
The temporary solution for flattening:
+
===Capabilities===
* Make events ''not extended''.
+
The Theory plug-in has the following capabilities:
* Copy missing invariants.
 
  
I found the Event-B Machine Editor's synthesis view useful for this. Invariants can be copy-pasted into the implementation machine from the abstraction. (A dummy invariant can be added and selected for pasting)
+
* Theory Definition:
 +
** Definition of datatypes: datatypes are defined by supplying the types on which they are polymorphic, a set of constructors one of which has to be a base constructor. Each constructor may or may not have destructors.
 +
** Definition of operators: operators can be defined as predicate or expression operators. An expression operator is an operator that "returns" an expression, an example existing operator is ''card''. A predicate operator is one that "returns" a predicate, an example existing predicate operator is ''finite''.
 +
** Definition of axiomatic definitions: axiomatic definitions are defined by supplying the types, a set of operators, and a set of axioms.
 +
** Definition of rewrite rules: rewrite rules are one-directional equalities that can be applied from left to right. The Theory plug-in can be used to define rewrite rules.
 +
** Definition of inference rules: inference rules can be used to infer new hypotheses, split a goal into sub-goals or discharge sequents.
 +
** Definition of polymorphic theorems: theorems can be defined and validated once, and can then be imported into sequents of proof obligations if a suitable type instantiation is available.
 +
** Validation of extensions: where appropriate, proof obligations are generated to ensure soundness of extensions. This includes, proof obligations for validity of inference and rewrite rules, as well as proof obligations to validate operator properties such as associativity and commutativity.
 +
*Theory Deployment: this step signifies that a theory is ready for use. Theories can be deployed after they have been optionally validated by the user. It is strongly advisable to discharge all proof obligations before deployment.
 +
Once a theory has been deployed to its designated project, all its extensions (mathematical and prover extensions) can be used in models.
  
===== Providing the correct Composed Machine =====
+
===Insider Look===
 +
The Theory plug-in partially satisfies the requirements outlined in the following document:
 +
* [http://deploy-eprints.ecs.soton.ac.uk/80/ Abrial, Jean-Raymond and Butler, Michael and Schmalz, Matthias and Hallerstede, Stefan and Voisin, Laurent. Mathematical Extensions Proposal]
  
The composed machine problem is sub-divided into two sub-problems. Firstly composed machines cannot be refined, and secondly when a machine is further decomposed there is no link between the first composed machine and the newly generated composed machine. So one or both of these problems may occur, depending on the number of decompositions.
+
A more accurate description of the implemented functionalities of the plug-in can be found in the following document:
 +
* [http://deploy-eprints.ecs.soton.ac.uk/251/ Michael Butler, Issam Maamria. Mathematical Extensions Summary]
  
We must manually add the information to the composed machines to address these two problems.
+
The following two papers describe rewriting and well-definedness issues that has to be accounted for:
  
The temporary solution for composed machines:
+
* [http://eprints.ecs.soton.ac.uk/18269/ Issam Maamria, Michael Butler, Andrew Edmunds, and Abdolbaghi Rezazadeh. On an Extensible Rule-based Prover for Event-B, ABZ'2010.]
* Modify the lowest level decomposed machine, HCtrl_M1_cmp, to ''include'' the implementation level machines (task names ending in *Impl). To do this,
+
* [http://eprints.ecs.soton.ac.uk/21221/ Issam Maamria, Michael Butler. Rewriting and Well-Definedness within a Proof System.]
* open the composed machine editor. Open the INCLUDES edit feature.
 
* Select the second drop-down box and find the *Impl version of each machine.
 
* Save the composed machine.
 
* Now add missing synchronizations to the composed machine. Add the ''Envir1Impl'' to the includes of HCtrl_M1_cmp.
 
* Each composed event in the task, that synchronizes with the Environ machine, must have the remote event synchronization added manually. This can only be done by inspection of each composed event. We need to update Sense_Temperatures, Display_Current_Temperature, Actuate_OverHeat_Alram, Actuate_Heat_Source, Sense_Heater_Status, Actuate_NoHeat_Alarm, Sense_PressIncrease_Target_Temperature, Sense_PressDecrease_Target_Temperature, Display_Target_Temperature. One by one, expand the events in the composed events section of the composed machine editor; add a new event in the combines events section, select ''Envir1Impl'' and add the synchronizing event from the list-box to the right.
 
  
=== Adding Tasking Event-B ===
 
Open the context and ensure Axioms ''axm3'' and ''axm4'', for typing ''Min'' and ''Max'' are Typing axioms, as indicated by the drop down selection.
 
  
Each Machine should be completed as follows.
+
[[Category:Plugin]]
==== The Temp_Ctrl_TaskImpl Machine ====
 
Continuing with the tutorial project ''Heating_ControllerTutorial2_Partial2'', we need to make changes to the following machines. During the tutorial we will cut and paste from ''Heating_ControllerTutorial2_Completed'' model when, specifying the task bodies, to save typing.
 
 
 
*Set the Task Type to ''Auto Task''
 
**Open The Tasking section of the Event-B editor.
 
**Click on + to add a new Machine Type.
 
**Ensure Auto Task is selected in the Drop-down box.
 
 
 
''Auto Tasks'' are tasks that will be declared and defined in the ''Main'' procedure of the implementation. The effect of this is that the ''Auto Tasks'' are created when the program first loads, and then activated (made ready to run) before the ''Main'' procedure body runs.
 
 
 
*'''Add a new TaskBody'''.
 
**Open Task Type in the Machine Type element
 
**Set the task type to ''Periodic'',
 
**Set a period of 250 milliseconds.
 
**Add a new Task Body section.
 
**Copy and paste the task body from ''Heating_ControllerTutorial2_Completed/Temp_Ctrl_TaskImpl''
 
**Save the model and rectify any problems highlighted.
 
<!-- We now look at the sensing event ''Sense_Temperatures'' event in ''Temp_Ctrl_TaskImpl''. In order to assist with the translation we add the following annotation:
 
 
 
*'''Add a Sensed Event Annotation'''.
 
** Right-click on the ''Sense_Temperatures'' Event node.
 
** Select ''New Child/Implementation'' from the menu.
 
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Sensing''.
 
 
 
We now look at the actuating event ''Display_Current_Temperatures'' event in ''Temp_Ctrl_TaskImpl''. In order to assist with the translation we add the following annotation:
 
 
 
*'''Add an Actuating Event Annotation'''.
 
** Right-click on the ''Display_Current_Temperatures'' Event node.
 
** Select ''New Child/Implementation'' from the menu.
 
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Actuating''.
 
-->
 
 
 
==== The Shared Machine ====
 
 
 
The next step is to identify the ''Shared_ObjectImpl'' machine as a ''Shared Machine''.
 
*Open the Tasking Section.
 
*Add a Machine Type by clicking +.
 
* Select ''Shared'' in the Machine Type drop Down box.
 
 
 
==== The Environ Machine ====
 
In the prepared machine we identify the ''Envir1Impl'' as an ''Environ Machine'',
 
 
 
*Open the Tasking Section in the Machine Editor
 
* Click on + to add a machine type.
 
*Select ''Environ Machine'' in the drop down box.
 
 
 
In the implementation, ''Environ Tasks'' are declared and defined in the ''Main'' procedure . The ''Envir1Impl'' machine models a task that simulates the environment, and can be used to generate simulation code. For deployment in a non-simulated environment the environ machine's generated code can be ignored. To specify the Environment task's behaviour we add edit the task body.
 
 
 
*'''Add the Task Details'''.
 
**Open the Task Type section.
 
**Set the task type to ''Periodic'',
 
**Set a period of 100 milliseconds.
 
**Add a new Task Body by clicking + in the Task Body section
 
**Copy and paste the task body from ''Heating_ControllerTutorial2_Completed/Envir1Impl''
 
**Save the model.
 
**Resolve any problems that are highlighted.
 
 
 
When saving, the task body text is sent to the parser. If parsing is successful then a builder adds the structure to the underlying EMF tree. If parsing fails then an error panel displays the source of the error.
 
<!-- The final step is to complete the ''Sense_Temperatures'' event. The event, being a kind of synchronization, synchronizes with the ''Sense_Temperatures'' event in the ''Temp_Ctrl_Task'' tasking machine. We annotate the model with sensing and actuating implementation types.
 
 
 
*'''Add a Sensed Event Annotation'''.
 
** Right-click on the ''Sense_Temperatures'' Event node.
 
** Select ''New Child/Implementation'' from the menu.
 
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Sensing''.
 
 
 
*'''Add an Actuating Event Annotation'''.
 
** Right-click on the ''Display_Current_Temperatures'' Event node.
 
** Select ''New Child/Implementation'' from the menu.
 
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Actuating''.
 
-->
 
 
 
=== A Summary of Steps ===
 
For a Tasking Machine definition:
 
# Select the Tasking Machine type (Auto etc).
 
# Set the task type (Periodic etc.).
 
# Set the task priority.
 
# Specify the task body.
 
<!-- # For sensing/actuating events, add the Event Type. -->
 
 
 
For a Shared Machine definition:
 
# Add the ''SharedMachine'' Machine type.
 
 
 
For an Environ Machine definition:
 
# Make the type an Environ Machine type.
 
# Set the task type Periodic; a shorter period than the shortest task period is best for simulation.
 
# Set the task priority.
 
# Specify the task body, it will contain a simulation of changes in the environment.
 
# For each sensing/actuating event, add the Event Type.
 
 
 
== Invoking the Translators ==
 
 
 
* To generate Ada code,
 
** Right-Click on the composed machine, or any tasking machine in the development, select ''Code Generation/Translate Event-B to Ada''.
 
** Open the generated ''code'' directory in the project to view the source files. A refresh will be necessary to make the code visible. The .gpr file has been provided for AdaCore GPS users.
 
 
 
* To create the Event-B model of the implementation,
 
** Right-Click on the composed machine, or any tasking machine in the development, select ''Code Generation/Translate Tasking Event-B to Event-B''.
 
** The Event-B model should be updated with the flow control variables. Users are not able to manually edit the generated elements. The additions can be removed using the menu option ''Code Generation/Remove Generated Event-B''
 
 
 
=== Generated Code ===
 
Generated code will be visible in the code directory, in the Event-B project. However a refresh of the workspace is required. The directory is visible in the resource view; or alternatively, click on the view menu in the Event-B perspective, select customize view, and uncheck the ''all file and folders'' filter.
 
 
[[Category:User documentation]]
 
[[Category:User documentation]]
 +
[[Category:Proof]]
 +
[[Category:Theory Plug-in]]

Latest revision as of 14:53, 14 June 2021

Return to Rodin Plug-ins

See also Theory Release History

The Theory plug-in provides capabilities to extend the Event-B language and the proving infrastructure in a familiar fashion to Rodin users. This page provides useful information about the plug-in and its capabilities.

Motivation

Up to Rodin v2.0, the mathematical language used in Event-B has been fixed. As such, it was not possible to define reusable polymorphic operators. A workaround was to define any required operators as set constructs in contexts. Originally, contexts were supposed to provide a parametrization of machines. The aforementioned limitations of the Event-B language lead to users to use contexts for purposes for which they were not intentionally devised. Examples of operators that can be useful to users include the sequence operator (which was present in classical B mathematical language) and the bag operator.

In Rodin v2.0, support for customised syntactic symbols was introduced. The Theory plug-in, as a result, evolved from being just a component to define rewrite rules to a versatile platform to define and validate proof and language extensions.

The latest Theory plug-in is released for Rodin v2.8.

Overview

The Theory plug-in is a Rodin extension that provides the facility to define mathematical extensions as well as prover extensions. Mathematical extensions are new operator definitions and new datatype definitions and axiomatic definitions. Operator definitions can be expression operators (e.g., card) and predicate operators (e.g., finite). Datatypes extensions can be used to define enumerated datatypes (e.g., DIRECTION) as well as inductive datatypes (e.g., Tree). Axiomatic definitions can be used to define new data types like "REAL".

The placeholder for mathematical and prover extensions is a Theory construct which looks similar to contexts and machines. A theory can include datatypes definitions, operator definitions, axiomatic definitions, inference and rewrite rules as well as polymorphic theorems. The user manual provides a guide to developing and using theories.

Installation & Update

The installation or update for the Theory plug-in is available under the main Rodin Update site (http://rodin-b-sharp.sourceforge.net/updates) under the category "Modelling Extensions". Like always, after the installation, restarting Rodin is recommended.

User Manual

The user manual is available here: Theory User Manual. Below is the presentation of the sequence theory which its description can be found in the user manual:

Theory of Sequence

Standard Library

In this section, you find a set of standard theories and some models using some of these theories.

The standard library of the theories is available to download:

here for Rodin2.8 and
here for Rodin3.1. 

This library includes:

  • BasicTheory project: including theories of BinaryTree, BoolOps, List, PEANO, SUMandPRODUCT and Seq.
  • RelationOrderTheory project: including theories of Connectivity, FixPoint, Relation, Well_Fondation, closure, complement and galois.
  • RealTheory project: including theory of Real.

Also it includes three simple Event-B models that use some of the theories:

  • Data project: using SUMandPRODUCT theory
  • Queue project: using Seq theory
  • SimpleNetwork project: using closure theory

In order to keep the POs discharged, you need to install "Atelier B provers" as well.

Capabilities

The Theory plug-in has the following capabilities:

  • Theory Definition:
    • Definition of datatypes: datatypes are defined by supplying the types on which they are polymorphic, a set of constructors one of which has to be a base constructor. Each constructor may or may not have destructors.
    • Definition of operators: operators can be defined as predicate or expression operators. An expression operator is an operator that "returns" an expression, an example existing operator is card. A predicate operator is one that "returns" a predicate, an example existing predicate operator is finite.
    • Definition of axiomatic definitions: axiomatic definitions are defined by supplying the types, a set of operators, and a set of axioms.
    • Definition of rewrite rules: rewrite rules are one-directional equalities that can be applied from left to right. The Theory plug-in can be used to define rewrite rules.
    • Definition of inference rules: inference rules can be used to infer new hypotheses, split a goal into sub-goals or discharge sequents.
    • Definition of polymorphic theorems: theorems can be defined and validated once, and can then be imported into sequents of proof obligations if a suitable type instantiation is available.
    • Validation of extensions: where appropriate, proof obligations are generated to ensure soundness of extensions. This includes, proof obligations for validity of inference and rewrite rules, as well as proof obligations to validate operator properties such as associativity and commutativity.
  • Theory Deployment: this step signifies that a theory is ready for use. Theories can be deployed after they have been optionally validated by the user. It is strongly advisable to discharge all proof obligations before deployment.

Once a theory has been deployed to its designated project, all its extensions (mathematical and prover extensions) can be used in models.

Insider Look

The Theory plug-in partially satisfies the requirements outlined in the following document:

A more accurate description of the implemented functionalities of the plug-in can be found in the following document:

The following two papers describe rewriting and well-definedness issues that has to be accounted for: