imported>Andy |
imported>Kriangsak |
| Line 1: |
Line 1: |
| − | '''THIS DOCUMENT IS NOT YET COMPLETE !!!'''
| + | Nowadays, many formal methods are used in the area of software development accompanied by a number of advanced theories and tools. However, more experiments are still required in order to provide significant evidence that will convince and encourage users to use, and gain more benefits from, those theories and tools. Event-B is a formalism used for specifying and reasoning about systems. Rodin is an open and extensible toolset for Event-B specification, refinement and proof. The flash file system is a complex system that is challenging to specify and verify at this moment in time. This system was chosen as a case study for our experiments, carried out using Event-B and the Rodin tool. The experiments were aimed at developing a rigorous model of flash-based file system, and providing useful evidence and guidelines to developers and the software industry. We believe that these would convince users and make formal methods more accessible. |
| | | | |
| − | == General Overview ==
| + | Our work on the development of a flash-based file system are listed below |
| | | | |
| − | The code generation activity has been undertaken at the University of Southampton. This has been a new line of work for DEPLOY that was not identified in the original Description of Work for the project. The development of the approach, and the tools to support, it involved a number of team members at Southampton; and also at other institutions. This work draws on our recent experience with technologies such as ''Shared Event Decomposition'' <ref name = "SharedEventDecomp">http://wiki.event-b.org/index.php/Event_Model_Decomposition</ref>, and the ''EMF Framework for Event-B'' <ref name = "EMF4EventB">http://wiki.event-b.org/index.php/EMF_framework_for_Event-B</ref>. There was collaboration at an early stage with Newcastle University, where we explored the commonalities between their flow plug-in <ref name = "flow">http://wiki.event-b.org/index.php/Flows </ref> and the algorithmic structures used in our approach. Collaboration with the University of York was also established since we chose to use their ''Epsilon'' <ref name = "Epsilon"> http://www.eclipse.org/gmt/epsilon/</ref> model-to-model transformation technology.
| + | === [http://deploy-eprints.ecs.soton.ac.uk/22/ Modelling and proof of a Tree-structured File System] === |
| | + | By ''Damchoom, Kriangsak and Butler, Michael and Abrial, Jean-Raymond''. |
| | + | in ICFEM 2008 |
| | | | |
| − | == Motivations ==
| + | We present a verified model of a tree-structured file system which was carried out using Event-B and the Rodin platform. The model is focused on basic functionalities affecting the tree structure including create, copy, delete and move. This work is aimed at constructing a clear and accurate model with all proof obligations discharged. While constructing the model of a file system, we begin with an abstract model of a file system and subsequently refine it by adding more details through refinement steps. We have found that careful formulation of invariants and useful theorems that can be reused for discharging similar proof obligations make models simpler and easier to prove. |
| | | | |
| − | The decision was taken in 2009 to include code generation as a project goal <ref name = "d23"> http://wiki.event-b.org/index.php/D23_Code_Generation </ref>. It had been recognised that support for generation of code from refined Event-B models would be an important factor in ensuring eventual deployment of the DEPLOY approach within their organisations. This was especially true for Bosch and Space Systems Finland (SSF). After receiving more detailed requirements from Bosch and SSF, it became clear we should focus our efforts on supporting the generation of code for typical real-time embedded control software.
| + | === [http://deploy-eprints.ecs.soton.ac.uk/125/ Applying Event and Machine Decomposition to a Flash-Based Filestore] === |
| | + | By ''Damchoom, Kriangsak and Butler, Michael. |
| | + | in SBMF 2009 |
| | | | |
| − | == Choices / Decisions == | + | === An Incremental Refinement Approach to a Development of a Flash File System [http://deploy-eprints.ecs.soton.ac.uk/243/ archive] === |
| − | === Strategic Overview ===
| + | By ''Damchoom, Kriangsak and Butler, Michael''. |
| − | During the last year we have focussed on supporting the generation of code for typical real-time embedded control software. To this end we have evolved a multi-tasking approach which is conceptually similar to that of the Ada tasking model. Individual tasks are treated as sequential programs; these tasks are modelled by an extension to Event-B, called ''Tasking Machines''. Tasks have mutually exclusive access to state variables through the use of protected resources. The protected resources correspond to Event-B machines. For real-time control, periodic and one-shot activation is currently supported; and it is planned to support aperiodic tasks in the near future. Tasks have priorities to ensure appropriate responsiveness of the control software. For the DEPLOY project, it was regarded as sufficient to support construction of programs with a fixed number of tasks and a fixed number of shared variables – no dynamic creation of processes or objects has been accommodated.
| |
| | | | |
| − | Our main goal this year has been to devise an approach for, and provide tool support for, code generation. In accord with the resources available during the year it was decided to limit the provision of tool support to that of a demonstrator tool. The tool is a proof-of-concept only, and lacks the productivity enhancements expected in a more mature tool. Nevertheless much insight has been gained in undertaking this work; it lays a foundation for future research, and will be useful since it will allow interested parties to explore the approach.
| + | An incremental refinement was chosen as a strategy in our development. The refinement |
| | + | was used for two different purposes: feature augmentation and structural refinement (covering event and |
| | + | machine decomposition). Several techniques and styles of modelling were investigated and compared; to |
| | + | produce some useful guidelines for modelling, refinement and proof. The model of the flash-based file system |
| | + | we have completed covers three main issues: fault-tolerance, concurrency and wear-levelling process. Our |
| | + | model can deal with concurrent read/write operations and other processes such as block relocation and |
| | + | block erasure. The model tolerates faults that may occur during reading/writing of files. We believe our |
| | + | development acts as an exemplar that other developers can learn from. |
| | | | |
| − | === The Tasking Extension for Event-B === | + | === Multi-Levelled Refinement and Evolution of a Flash File System Model in Event-B and Rodin [http://deploy-eprints.ecs.soton.ac.uk/243/ archive ] === |
| | + | By ''Damchoom, Kriangsak and Butler, Michael''. |
| | | | |
| − | The following text can be read in conjunction with the slides<ref name = "Zurich2010Slides">http://bscw.cs.ncl.ac.uk/bscw/bscw.cgi/d108734/Andy%20Edmunds%20-%20Code%20Generation%20Slides.pdf</ref> from the Deploy Plenary Meeting - Zurich 2010.
| + | This work is an extension of the work presented above. The focus of this work is to outline an evolution of the model when the requirements change. Evolution of the models is necessary when |
| − | | + | the requirements change. The point is how to deal with this. How much changes that impact the models? How reusability |
| − | Tasking Event-B can be viewed as an extension of the existing Event-B language. We use the existing approaches of refinement and decomposition to structure a development that is suitable for construction of a Tasking Development. At some point during the modelling phase parameters may have to be introduced to facilitate decomposition. This constitutes a natural part of the refinement process as it moves towards decomposition and on to the implementation level. During decomposition parameters form part of the interface that enables event synchronization. We make use of this interface and add information (see [[#Events For Tasking]]) to facilitate code generation.
| + | can be achieved? and how flexibility of the language and tool are? |
| − | | |
| − | A Tasking Development is generated programmatically, at the direction of the user; the Tasking Development consists of a number of machines (and perhaps associated contexts). In our approach we make use of the Event-B EMF extension mechanism which allows addition of new constructs to a model. The tasking extension consists of the constructs in the following table.
| |
| − | | |
| − | <center>
| |
| − | {| border="1"
| |
| − | |Construct
| |
| − | |Options
| |
| − | |-
| |
| − | |Machine Type
| |
| − | |DeclaredTask, AutoTask, SharedMachine
| |
| − | |-
| |
| − | |Control
| |
| − | |Sequence, Loop, Branch, EventSynch
| |
| − | |-
| |
| − | |Task Type
| |
| − | |Periodic(n), Triggered, Repeating, OneShot
| |
| − | |-
| |
| − | |Priority
| |
| − | | -
| |
| − | |-
| |
| − | |Event Type
| |
| − | |Branch, Loop, ProcedureDef, ProcedureSynch
| |
| − | |-
| |
| − | |Parameter Type
| |
| − | |ActualIn, ActualOut, FormalIn, FormalOut
| |
| − | |}
| |
| − | </center>
| |
| − | | |
| − | The machines in the Tasking Development are extended with the constructs shown in the table, and may be viewed as keywords in a textual representation of the language. With extensions added, a Tasking Development can be translated to a common language model for mapping to implementation source code. There is also a translator that constructs new machines/contexts modelling the implementation, and these should refine/extend the existing elements of the Event-B project.
| |
| − | | |
| − | === Tasking Machines ===
| |
| − | The following constructs relate only to Tasking Machines, and provide implementation details. Timing of periodic tasks is not modelled formally. Tasking Machines map to the concept of a process/thread/task. These can be implemented by Ada tasks, use of the pthread library in C, or Java threads.
| |
| − | | |
| − | * Tasking Machines may be characterised by the following types:
| |
| − | ** AutoTasks - Singleton Tasks.
| |
| − | ** Declared tasks - (Not currently used) A task template relating to an Ada ''tasktype'' declaration.
| |
| − | ** TaskType - Defines the scheduling, cycle and lifetime of a task. i.e. one-shot periodic or triggered.
| |
| − | ** Priority - An integer value is supplied, the task with the highest value priority takes precedence when being scheduled.
| |
| − | | |
| − | === Shared Machines ===
| |
| − | Shared Machines map to the concept of a protected resource, or monitor. They may be implemented in Ada as a protected object, in C using a mutex lock, or Java monitor.
| |
| − | | |
| − | * Applied to the Shared Machine we have:
| |
| − | ** A SharedMachine ''keyword'' that identifies a machine as a Shared Machine.
| |
| − | | |
| − | === More Details ===
| |
| − | ==== Control Constructs ====
| |
| − | Each Tasking Machine has a ''task body'' which contains the flow control, or algorithmic, constructs.
| |
| − | | |
| − | * We have the following constructs available in the Tasking Machine body:
| |
| − | ** Sequence - for imposing an order on events.
| |
| − | ** Branch - choice between a number of mutually exclusive events.
| |
| − | ** Loop - event repetition while it's guard remains true.
| |
| − | ** Event Synchronisation - synchronization between an event in a Tasking Machine and an event in a Shared Machine.
| |
| − | ** Event-wrappers - The synchronization construct is contained in an event wrapper. The wrapper may also contain a single event (we re-use the synchronization construct, but do not use it for this purpose). The event may belong to the Tasking Machine, or to a Shared Machine that is visible to the task. Single events in a wrapper correspond to a subroutine call in an implementation.
| |
| − | | |
| − | ==== Events In Tasking Developments ====
| |
| − | Event implementation. Branch, Loop, ProcedureSych, ProcedureDef
| |
| − | | |
| − | Event parameter types. FormalIn FormalOut, ActualIn, ActualOut
| |
| − | | |
| − | * In Shared Machines:
| |
| − | ** events can only be designated as ProcedureDef or ProcedureSynch.
| |
| − | ** parameters of ProcedureSynch can only be FormalIn or FormalOut
| |
| − | | |
| − | * In procedureDef
| |
| − | ** parameters are not allowed.
| |
| − | | |
| − | === Other Technical Issues ===
| |
| − | | |
| − | Meta-models: The use of Epsilon for translation.
| |
| − | | |
| − | === The Deliverable ===
| |
| − | The demonstrator tool was released on 30 November 2010, and is available as an update site, or bundled Rodin package from:
| |
| − | https://sourceforge.net/projects/codegenerationd/files
| |
| − | | |
| − | Sources are available from:
| |
| − | https://codegenerationd.svn.sourceforge.net/svnroot/codegenerationd
| |
| − | | |
| − | The tool is based on a build of Rodin 1.3.1 (not Rodin 2.0.0 due to dependency conflicts).
| |
| − | | |
| − | * The Code Generation tool consists of,
| |
| − | ** a Tasking Development Generator.
| |
| − | ** a Tasking Development Editor (Based on an EMF Tree Editor).
| |
| − | ** a translator, from Tasking Development to Common Language Model (IL1).
| |
| − | ** a translator, from the Tasking Development to Event-B model of the implementation.
| |
| − | ** a pretty-printer for the Tasking Development.
| |
| − | ** a pretty-printer for Common Language Model, which generates Ada Source Code.
| |
| − | | |
| − | == Available Documentation ==
| |
| − | | |
| − | | |
| − | Much insight was gained during the work on code generation reported in the thesis ''Providing Concurrent Implementations for Event-B Developments'' <ref name="aeThesis">http://eprints.ecs.soton.ac.uk/20826/</ref>
| |
| − | | |
| − | Tooling issues were reported in a paper ''Tool Support for Event-B Code Generation''
| |
| − | <ref name = "toolSupport">http://eprints.ecs.soton.ac.uk/20824/</ref>
| |
| − | which was presented at ''Workshop on Tool Building in Formal Methods'',
| |
| − | http://abzconference.org/
| |
| − | | |
| − | There are technical notes available <ref name = "techNotes">http://wiki.event-b.org/images/Translation.pdf</ref>, that give more precise details of the approach and the mapping between Event-B and the common language meta-model, and its corresponding Event-B model.
| |
| − | | |
| − | === For users ===
| |
| − | | |
| − | There is a wiki page at http://wiki.event-b.org/index.php/Code_Generation_Activity
| |
| − | | |
| − | There is a tutorial at http://wiki.event-b.org/index.php/Code_Generation_Tutorial
| |
| − | | |
| − | == Planning ==
| |
| − | | |
| − | This paragraph shall give a timeline and current status (as of 28 Jan 2011).
| |
| − | | |
| − | == References ==
| |
| − | | |
| − | <references/>
| |
Nowadays, many formal methods are used in the area of software development accompanied by a number of advanced theories and tools. However, more experiments are still required in order to provide significant evidence that will convince and encourage users to use, and gain more benefits from, those theories and tools. Event-B is a formalism used for specifying and reasoning about systems. Rodin is an open and extensible toolset for Event-B specification, refinement and proof. The flash file system is a complex system that is challenging to specify and verify at this moment in time. This system was chosen as a case study for our experiments, carried out using Event-B and the Rodin tool. The experiments were aimed at developing a rigorous model of flash-based file system, and providing useful evidence and guidelines to developers and the software industry. We believe that these would convince users and make formal methods more accessible.
Our work on the development of a flash-based file system are listed below
By Damchoom, Kriangsak and Butler, Michael and Abrial, Jean-Raymond.
in ICFEM 2008
We present a verified model of a tree-structured file system which was carried out using Event-B and the Rodin platform. The model is focused on basic functionalities affecting the tree structure including create, copy, delete and move. This work is aimed at constructing a clear and accurate model with all proof obligations discharged. While constructing the model of a file system, we begin with an abstract model of a file system and subsequently refine it by adding more details through refinement steps. We have found that careful formulation of invariants and useful theorems that can be reused for discharging similar proof obligations make models simpler and easier to prove.
By Damchoom, Kriangsak and Butler, Michael.
in SBMF 2009
An Incremental Refinement Approach to a Development of a Flash File System archive
By Damchoom, Kriangsak and Butler, Michael.
An incremental refinement was chosen as a strategy in our development. The refinement
was used for two different purposes: feature augmentation and structural refinement (covering event and
machine decomposition). Several techniques and styles of modelling were investigated and compared; to
produce some useful guidelines for modelling, refinement and proof. The model of the flash-based file system
we have completed covers three main issues: fault-tolerance, concurrency and wear-levelling process. Our
model can deal with concurrent read/write operations and other processes such as block relocation and
block erasure. The model tolerates faults that may occur during reading/writing of files. We believe our
development acts as an exemplar that other developers can learn from.
Multi-Levelled Refinement and Evolution of a Flash File System Model in Event-B and Rodin archive
By Damchoom, Kriangsak and Butler, Michael.
This work is an extension of the work presented above. The focus of this work is to outline an evolution of the model when the requirements change. Evolution of the models is necessary when
the requirements change. The point is how to deal with this. How much changes that impact the models? How reusability
can be achieved? and how flexibility of the language and tool are?
