imported>Andy |
|
| Line 1: |
Line 1: |
| − | === Tasking Event-B === | + | ==9th Rodin User and Developer Workshop== |
| − | Tasking Event-B can be viewed as an extension of the existing Event-B language. We use the existing approaches of refinement and decomposition to structure a project that is suitable for a Tasking Development. During the modelling phase parameters are introduced to facilitate decomposition. As a result of the decomposition process, parameters become part of the interface that enables event synchronization. We make use of this interface and add information (see [[#Implementing Events]]) to facilitate code generation. The tasking extension consists of the constructs in the following table.
| |
| | | | |
| − | <center>
| + | The 9th Rodin User and Developer Workshop, 8 June, 2021, Ulm, Germany (Virtual) |
| − | {| border="1"
| |
| − | !Construct
| |
| − | !Options
| |
| − | |-
| |
| − | |Machine Type
| |
| − | |DeclaredTask, [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Tasking_Machines AutoTask], [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Shared_Machines SharedMachine], [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#The_Environ_Machine Environ]
| |
| − | |-
| |
| − | |[http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Control_Constructs Control]
| |
| − | |Sequence, Loop, Branch, Event, Output
| |
| − | |-
| |
| − | |[http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Tasking_Machines Task Type]
| |
| − | |Periodic(n), Triggered, Repeating, OneShot
| |
| − | |-
| |
| − | |Priority
| |
| − | | -
| |
| − | |-
| |
| − | |[http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Implementing_Events Event Role]
| |
| − | | Actuating, Sensing
| |
| − | |-
| |
| − | |[http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Addressed_Variables Addressed Variable]
| |
| − | |Address, Base
| |
| − | |}
| |
| − | </center>
| |
| | | | |
| − | ==== Tasking Machines ====
| + | ''The proceedings of the workshop is now available as a [technical report] at the University of Southampton.'' |
| − | The following constructs relate to Tasking and Environ Machines, and provide implementation details. Timing of periodic tasks is not modelled formally. Tasking and Environ Machines model Ada tasks, so they can be implemented easily in Ada; in C using the pthread library, or in Java using threads. | |
| | | | |
| − | * Tasking Machines may be one of the following types:
| + | The programme now available on [https://abz2021.uni-ulm.de/program-overview the ABZ2021 website] and [[#Programme|below]] (with texts). |
| − | ** AutoTasks - Anonymous Tasks running from start-up.
| |
| − | ** Declared tasks - (Not currently used) A task template relating to an Ada ''tasktype'' declaration.
| |
| | | | |
| − | ''Auto Tasks'' are tasks that will be declared and defined in the ''Main'' procedure of the implementation. The effect of this is that the ''Auto Tasks'' are created when the program first loads, and then activated (made ready to run) before the ''Main'' procedure body runs.
| + | Event-B is a formal method for system-level modelling and analysis. The |
| | + | Rodin Platform is an Eclipse-based toolset for Event-B that provides |
| | + | effective support for modelling and automated proof. The platform is open |
| | + | source and is further extendable with plug-ins. A range of plug-ins have |
| | + | already been developed. |
| | | | |
| − | * Tasking and Environ Machines options are:
| + | The 9th Rodin workshop will be collocated with the [https://abz2021.uni-ulm.de/ ABZ 2021 Conference]. |
| − | ** TaskType - Defines the scheduling, cycle and lifetime of a task. i.e. one-shot periodic or triggered. The period of a task is specified in milliseconds.
| |
| − | ** Priority - An integer value is supplied, the task with the highest value priority takes precedence when being scheduled. The default priority is 5.
| |
| | | | |
| − | ==== Shared Machines ====
| + | The purpose of this workshop is to bring together existing and potential |
| − | A Shared Machine models a protected resource, such as a monitor. It may be implemented in Ada as a Protected Object, in C using mutex locking, or in Java as a monitor.
| + | users and developers of the Rodin toolset and to foster a broader community |
| | + | of Rodin users and developers. |
| | | | |
| − | * A Shared Machine is identified using the ''Shared Machine'' annotation.
| + | For Rodin users the workshop will provide an opportunity to share tool |
| | + | experiences and to gain an understanding of on-going tool developments. |
| | + | For plug-in developers the workshop will provide an opportunity to showcase |
| | + | their tools and to achieve better coordination of tool development effort. |
| | | | |
| − | ==== The Environ Machine ====
| |
| − | An Environ machine is a model of the environment. It can be used to generate code for use in a simulation, or be discarded in the case that a simulated environment is not required.
| |
| | | | |
| − | * An Environ Machine is identified using the ''Environ Machine'' annotation.
| + | === Programme === |
| | | | |
| − | === Control of Program Flow ===
| + | '''09:00 - 10:30''' |
| − | At the implementation stage we need to think about controlling the flow of execution; and where interaction with the environment is concerned, how events should be implemented. The following section describes the constructs that we have introduced to facilitate this.
| + | * Domain knowledge as Ontology-based Event-B Theories - ''I. Mendil, Y. Aït-Ameur, N. K. Singh, D. Méry, and P. Palanque'' ([[Media:RodinWorkshop2021_Domain knowledge as Ontology-based Event-B Theories.pdf|pdf]], [[Media:RodinWorkshop2021_Domain knowledge as Ontology-based Event-B Theories_slides.pdf|slides]]) |
| − | ==== Control Constructs ====
| + | * OntoEventB: A Generator of Event-B contexts from Ontologies - ''Idir Ait-Sadoune'' ([[Media:RodinWorkshop2021_OntoEventB.pdf|pdf]], [[Media:RodinWorkshop2021_OntoEventB_slides.pdf|slides]]) |
| − | Each Tasking Machine has a ''task body'' which contains the flow control (algorithmic constructs).
| + | * EVBT — an Event-B tool for code generation and documentation - ''Fredrik Öhrström'' ([[Media:RodinWorkshop2021_EVBT.pdf|pdf]]) |
| | + | * Scenario Checker: An Event-B tool for validating abstract models - ''Colin Snook, Thai Son Hoang, Asieh Salehi Fathabadi, Dana Dghaym, Michael Butler'' ([[Media:RodinWorkshop2021_Scenario Checker.pdf|pdf]], [[Media:RodinWorkshop2021_Scenario Checker_slides.pdf|slides]]) |
| | | | |
| − | * We have the following constructs available in the Tasking Machine body:
| + | '''10:30 - 11:00''' ''Break'' |
| − | ** Sequence - for imposing an order on events.
| |
| − | ** Branch - choice between a number of mutually exclusive events.
| |
| − | ** Loop - event repetition while it's guard remains true.
| |
| − | ** Event - a wrapper for the Event-B element (soon to be redundant).
| |
| − | ** Text Output - writes textual output to the screen.
| |
| | | | |
| − | The syntax for task bodies, as used in the Rose TaskBody editor, is as follows:
| + | '''11:00--12:30''' |
| | + | * Context instantiation plug-in: a new approach to genericity in Rodin - ''Guillaume Verdier, Laurent Voisin'' ([[Media:RodinWorkshop2021_Context instantiation plug-in.pdf|pdf]], [[Media:RodinWorkshop2021_Context instantiation plug-in_slides.pdf|slides]]) |
| | + | * Examples of using the Instantiation Plug-in - ''Dominique Cansell, Jean-Raymond Abrial'' ([[Media:RodinWorkshop2021_Examples of using the Instantiation Plug-in.pdf|pdf]], [[MEDIA:RodinWorkshop2021_Examples of using the Instantiation Plug-in_slides.pdf|slides]]) |
| | + | * Data-types definitions: Use of Theory and Context instantiations Plugins - ''Peter Riviere, Yamine Ait-Ameur, and Neeraj Kumar Singh'' ([[Media:RodinWorkshop2021_Data-types_definitions.pdf|pdf]], [[Media:RodinWorkshop2021_Data-types_definitions_slides.pdf|slides]]) |
| | + | * Towards CamilleX 3.0 - ''Thai Son Hoang, Colin Snook, Asieh Salehi Fathabadi, Dana Dghaym, Michael Butler'' ([[Media:RodinWorkshop2021_Towards CamilleX 3.0.pdf|pdf]], [[Media:RodinWorkshop2021_Towards CamilleX 3.0_slides.pdf|slides]]) |
| | | | |
| − | <br/>
| + | '''12:30--13:30''' ''Lunch'' |
| − | [[Image:Syntax.png]]
| |
| − | <br/>
| |
| | | | |
| − | The ''String'' will be an event name, a variable name, or a text fragment to be output to the screen. The concrete syntax is shown in bold red font. '*' indicates 0 or more; [] indicates 0 or 1.
| + | '''13:30--15:00''' |
| | + | * Keynote: Safety and Security Case Study Experiences with Event-B and Rodin - ''Jonathan Hammond, Capgemini Engineering'' ([[Media:RodinWorkshop2021_Safety and Security Case Study Experiences with Event-B and Rodin.pdf|slides]]) |
| | + | * Large Scale Biological Models in Rodin - ''Usman Sanwal, Thai Son Hoang, Luigia Petre, and Ion Petre'' ([[Media:RodinWorkshop2021_Large Scale Biological Models in Rodin.pdf|pdf]], [[Media:RodinWorkshop2021_Large Scale Biological Models in Rodin_slides.pdf|slides]]) |
| | + | * Formal Verification of EULYNX Models Using Event-B and RODIN - ''Abdul Rasheeq, Shubhangi Salunkhe'' ([[Media:RodinWorkshop2021_Formal Verification of EULYNX Models Using Event-B and RODIN.pdf|pdf]], [[MEDIA:RodinWorkshop2021_Formal Verification of EULYNX Models Using Event-B and RODIN_slides.pdf|slides]]) |
| | | | |
| − | ===== Event Translation ===== | + | === Organisers === |
| − | When an event, used in the task body, is translated to an implementation its translation depends on where it is used in the task body. The mappings are relatively simple for branch, loop, and sequence; but, in addition to the parent construct, the Event translation depends on whether it is part of a synchronization. Obviously the simplest translation is when no synchronization is involved. The translator checks the composed machine to see if the event is paired in a combined event. We say that events is a Tasking machine are local, and that events in a Shared or Environ machine, are remote. If there is no synchronization, then the actions of the local event are expanded in-line in the subroutine body.
| + | <p>Chair: Asieh Salehi Fathabadi, University of Southampton, UK</p> |
| − | | + | <p>Co-chair: Thai Son Hoang, University of Southampton, UK</p> |
| − | <span style="color: RED">'''NOTE''': As a result of the decomposition process, the tool can produce a remote event, without a corresponding local event. A local event, with no guards and skip action, must be added manually to the tasking machine, and composed machine in order to facilitate code generation. This relates to an implementation with a subroutine call, where there are no parameters passed, and no local updates i.e. remote updates only. The addition of the 'dummy' event will be automated in a pre-processing step in the near future. It is not necessary to have a dummy remote event if a remote event does not exist.</span> | + | <p>Co-chair: Colin Snook, University of Southampton, UK</p> |
| − | | + | <p>Co-chair: Yamine Ait Ameur, Toulouse National Polytechnique Institute, France</p> |
| − | ===== Synchronization =====
| |
| − | | |
| − | Synchronization between local events (in AutoTasks) and remote events (in shared/Environ Machines) is determined using the composed machine. To use an event simply enter its name in the TaskBody editor. The translator will in-line any local actions, and add a call to perform remote updates, and obtain remote data.
| |
| − | | |
| − | Synchronization corresponds to:
| |
| − | * a subroutine call from task to shared machine, or,
| |
| − | * sensing or actuating of environment variables.
| |
| − | | |
| − | In the case of a subroutine call the subroutine is an atomic (with respect to an external viewer) update to state. The updates in the protected resource are implemented by a procedure call to a protected object, and tasks do not share state. The synchronization construct also provides the means to specify parameter passing, both in and out of the task.
| |
| − | | |
| − | In the case of a sensing or actuating event, the updates of the action correspond to reads of monitored variables, and writes to controlled variables of the environment.
| |
| − | | |
| − | ==== Implementing Events ====
| |
| − | An event's role in the implementation is identified by its parent in the task body. A description follows, in general terms, of the possible implementations of an event.
| |
| − | | |
| − | <span style="color: RED">Note: An event can be to referred only '''once''' in a task body specification. Of course, shared events (in Shared machines) can be re-used, but this is done through synchronization. The task body only refers to local events</span> | |
| − | | |
| − | * Event roles in implementation:
| |
| − | ** Branching: an event is split in the implementation; guards are mapped to branch conditions, and actions are mapped to the branch body. If the branch synchronizes with a Shared machine's event then this is mapped to a procedure call.
| |
| − | ** Looping: as in branching, the event is split; the guard maps to the loop condition, and actions to to loop body. If the event synchronizes with a Shared Machine event then it is mapped to a procedure call.
| |
| − | ** Event: if the event is not contained in a branch or loop then it is one of the following:
| |
| − | *** A local-only event - the event only contains local updates, which are expanded to update actions in the implementation. In this case guards not permitted in the event.
| |
| − | *** A synchronizing event - local updates are expanded to become update actions in the implementation, remote updates are performed by subroutine call. Guards in the remote event may block; in Ada this is implemented as an entry barrier, and in C can be implemented using a pthread condition variable.
| |
| − | ** Sensing annotation - This annotation is added to an event in the EMF tree. It identifies an event as one that maps to a read, from the environment. If the environment is simulated, i.e. without address variables, then the sensing event has an update action that models assignment of a return value from a subroutine call. If the event has addressed variables associated with its event parameters, then they map to direct reads from memory mapped variables in the generated code.
| |
| − | ** Actuating - This annotation is added to an event in the EMF tree. It identifies an event as one that maps to a write, to some variable in the environment. If the environment is simulated, without address variables, then the actuating event has no update action. If a sensing event has addressed variables associated with its parameters then they map to direct writes, to memory mapped variables in the generated code.
| |
| − | | |
| − | Sensing (and actuating) events make use of synchronization. The sensing/actuating synchronizations only occur between AutoTasks and Environ machines. The data exchange, in sensing and actuating events, is modelled by the event parameters, and the result from the decomposition step. Shared machine events are mapped to subroutine declarations, and their parameters are always implemented as formal parameters. Formal parameters are place-holders in a subroutine; they are replaced by the actual parameters at run-time. To assist the code generator, we automatically identify the parameter direction during translation. We identify them as either ''in'' or ''out'' parameters.
| |
| − | | |
| − | ===== Addressed Variables =====
| |
| − | When sensing monitored variables, or actuating controlled variables, in the environment we can use explicit memory addresses. We can link a task's event parameters, and an Environ machines machine variables with specific addresses, we then implement these in such a way that we can read/write from these in the generated code.
| |
| − | | |
| − | == References ==
| |
| − | | |
| − | <references/> | |
| − | | |
| − | | |
| − | [[Category:User documentation]]
| |
9th Rodin User and Developer Workshop
The 9th Rodin User and Developer Workshop, 8 June, 2021, Ulm, Germany (Virtual)
The proceedings of the workshop is now available as a [technical report] at the University of Southampton.
The programme now available on the ABZ2021 website and below (with texts).
Event-B is a formal method for system-level modelling and analysis. The
Rodin Platform is an Eclipse-based toolset for Event-B that provides
effective support for modelling and automated proof. The platform is open
source and is further extendable with plug-ins. A range of plug-ins have
already been developed.
The 9th Rodin workshop will be collocated with the ABZ 2021 Conference.
The purpose of this workshop is to bring together existing and potential
users and developers of the Rodin toolset and to foster a broader community
of Rodin users and developers.
For Rodin users the workshop will provide an opportunity to share tool
experiences and to gain an understanding of on-going tool developments.
For plug-in developers the workshop will provide an opportunity to showcase
their tools and to achieve better coordination of tool development effort.
Programme
09:00 - 10:30
- Domain knowledge as Ontology-based Event-B Theories - I. Mendil, Y. Aït-Ameur, N. K. Singh, D. Méry, and P. Palanque (pdf, slides)
- OntoEventB: A Generator of Event-B contexts from Ontologies - Idir Ait-Sadoune (pdf, slides)
- EVBT — an Event-B tool for code generation and documentation - Fredrik Öhrström (pdf)
- Scenario Checker: An Event-B tool for validating abstract models - Colin Snook, Thai Son Hoang, Asieh Salehi Fathabadi, Dana Dghaym, Michael Butler (pdf, slides)
10:30 - 11:00 Break
11:00--12:30
- Context instantiation plug-in: a new approach to genericity in Rodin - Guillaume Verdier, Laurent Voisin (pdf, slides)
- Examples of using the Instantiation Plug-in - Dominique Cansell, Jean-Raymond Abrial (pdf, slides)
- Data-types definitions: Use of Theory and Context instantiations Plugins - Peter Riviere, Yamine Ait-Ameur, and Neeraj Kumar Singh (pdf, slides)
- Towards CamilleX 3.0 - Thai Son Hoang, Colin Snook, Asieh Salehi Fathabadi, Dana Dghaym, Michael Butler (pdf, slides)
12:30--13:30 Lunch
13:30--15:00
- Keynote: Safety and Security Case Study Experiences with Event-B and Rodin - Jonathan Hammond, Capgemini Engineering (slides)
- Large Scale Biological Models in Rodin - Usman Sanwal, Thai Son Hoang, Luigia Petre, and Ion Petre (pdf, slides)
- Formal Verification of EULYNX Models Using Event-B and RODIN - Abdul Rasheeq, Shubhangi Salunkhe (pdf, slides)
Organisers
Chair: Asieh Salehi Fathabadi, University of Southampton, UK
Co-chair: Thai Son Hoang, University of Southampton, UK
Co-chair: Colin Snook, University of Southampton, UK
Co-chair: Yamine Ait Ameur, Toulouse National Polytechnique Institute, France
