Difference between pages "Rodin Proving Perspective" and "Tasking Event-B Tutorial"

From Event-B
(Difference between pages)
Jump to navigationJump to search
imported>Laurent
 
imported>Andy
 
Line 1: Line 1:
−
{{Navigation|Previous= [[The_Event-B_Explorer_(Rodin_User_Manual)|The Event-B Explorer]]|Next= [[The_Mathematical_Language_(Rodin_User_Manual)|The Mathematical Language]]|Up= [[index_(Rodin_User_Manual)|User_Manual_index]]}}
+
For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk
−
{{TOCright}}
+
=== Tasking Event-B Tutorial Overview ===
−
== Overview ==
+
This tutorial follows on from the abstract development described [http://wiki.event-b.org/index.php/Development_of_a_Heating_Controller_System here].
−
When proof obligations (POs) are not discharged automatically the user can attempt to discharge them interactively using the Proving Perspective. This page provides an overview of the Proving Perspective and its use. If the Proving Perspective is not visible as a tab on the top right-hand corner of the main interface, the user can switch to it via "Window -> Open Perspective".
 
  
−
The Proving Perspective consists of a number of views: the Proof Tree, the Goal, the Selected Hypotheses, the Proof Control, the Search Hypotheses, the Cache Hypotheses and the Proof Information. In the discussion that follows we look at each of these views individually. Below is a screenshot of the Proving Perspective:
+
This code generation tutorial extends the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces implementable Ada code, and also an Event-B model. It is a model of the implementation, and contains flow control variables that model the flow of execution through the task body. The Ada code is produced from an intermediate model that is not visible to the user. The Common Language model (CLM), is generated from the Tasking Event-B by a translation tool. Ada (and other implementations) may be generated from the CLM. An overview of Tasking Event-B can be found [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview here].
  
−
[[Image:ProvPers.png|center]]
+
In the example so far, the Heating Controller has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines modelling tasks, shared objects and the environment are identified, and  extended with the appropriate implementation details.
  
−
== Loading a Proof ==
+
The example/tutorial projects are are available in the [http://deploy-eprints.ecs.soton.ac.uk/304/ e-prints archive], or on [https://codegenerationd.svn.sourceforge.net/svnroot/codegenerationd/Examples/HeatingController_Tutorial_v0.1.4/ SVN].
−
To work on an un-discharged PO it is necessary to load the proof into the Proving Perspective. To do this switch to the Proving Perspective; select the project from the Event-B Explorer; select and expand the component (context or machine); and finally select (double-click) the proof obligation of interest. A number of views will be updated with details of the corresponding proof.
 
−
[[Image:ExplorerView.png|center]]
 
  
−
Note that pressing [[Image:Discharged.gif]] button on the top left hand side of the Event-B Explorer will remove all discharged proof obligations (PO's) from the view.
+
{| border="1"
 +
|Heating_ControllerTutorial_Completed
 +
|An example project generating an environment simulation. Generates code, where environment variables are monitored and controlled using subroutine calls. Contains a completed Tasking Development with generated Event-B and Ada code.
 +
|-
 +
|Heating_ControllerTutorial_Step1
 +
|A bare project for step 1 of the [[Code_Generation_Tutorial#The_Tutorial |tutorial]].
 +
|-
 +
|Heating_ControllerTutorial_Step2
 +
|A partially completed tasking development for steps 2, and 4 of the [[Code_Generation_Tutorial#The_Tutorial |tutorial]] (step 3 not required here).
 +
<!--|- >
 +
<!--|Heating_Controller5AddressedSim_Completed>
 +
<!--|A completed example that uses Addressed Variables in the tasks, and also in the environment simulation. Generates Memory Mapped IO for sensing and actuation.  >
 +
<!--|->
 +
<!--|Heating_Controller5AddressedNotSim_Completed>
 +
<!--|A completed example that uses Addressed Variables in the tasks only. Generates Deployable Memory Mapped IO for sensing and actuation. Similar to above but we discard the environment task from generated code.> 
 +
|}
  
−
== The Proof Tree ==
+
== Preliminaries ==
−
The proof tree view provides a graphical representation of each individual proof step, as seen in the following screenshot:
+
Before further discussion of the modelling aspects, we take a look at the PrettyPrint viewers. The PrettyPrinters make the viewing of IL1 and tasking models easier; it also provides a route to generate source code. The source code can easily be pasted from the IL1 Pretty Printer window into an the Ada source file .
 +
==== The PrettyPrint View of a Tasking Development ====
 +
To open the Tasking PrettyPrint viewer,
 +
* from the top-menu select ''Window/Show View/Other/Tasking Pretty Printer''.
  
−
[[Image:ProTree.png|center]]
+
Note that the Tasking PrettyPrinter may have to be closed when editing the Tasking Development, since it can give rise to exceptions. The PrettyPrinter would need further work to make it robust, however it is intended only as a short-term solution.
  
−
Each node in the tree corresponds to a sequent. A line is right shifted when the corresponding node is a direct descendant of the node of the previous line. Each node is labelled with a comment which indicates which rule has been applied, or which prover discharged the proof. By selecting a node in the proof tree, the corresponding sequent is loaded: the hypotheses of the sequent are loaded to the Selected Hypotheses window, and the goal of the sequent is loaded to the Goal view.
+
* Open the ''Heating_ControllerTutorial_Completed'' Project and switch to the Resource Perspective.
 +
* Open the ''.tasking'' model and inspect it. Clicking on the Main, Machine or Event nodes updates the pretty print window.
  
−
=== Decoration===
+
==== Viewing Source Code ====
−
The leaves of the tree are decorated with one of three icons:
+
aka. The PrettyPrint View of an IL1 Model.
  
−
* [[Image:Discharged.gif]] means that this leaf is discharged,
+
To view Ada source code,
−
* [[Image:Pending.gif]] means that this leaf is not discharged,
+
* from the top-menu select ''Window/Show View/Other/IL1 Pretty Printer''.
−
* [[Image:Reviewed.gif]] means that this leaf has been reviewed.
+
* Open the ''Heating_ControllerTutorial_Completed'' Project and switch to the Resource Perspective.
 +
* Open the ''.il1'' model and inspect it. Clicking on the Protected, Main Entry, or Task nodes updates the pretty print window.
  
−
Internal nodes in the proof tree are decorated in reverse colours. Note that a "reviewed" leaf is one that is not discharged yet by the prover. Instead, it has been "seen" by the user who decided to postpone the proof. Marking nodes as "reviewed" is very convenient since the provers will ignore these leaves and focus on specific areas of interest. This allows interactive proof in a gradual fashion. In order to discharge a "reviewed" node, select it and prune the tree at that node: the node will become "brown" again (undischarged) and you can now try to discharge it.
+
==== Cleaning the Tasking Development ====
 +
If the ''.tasking'' file has errors, then it may need cleaning. To do this right-click on the ''Main'' node, select ''Epsilon Translation/CleanUp''. If a model has errors it can still be viewed by clicking on the ''Selection'' tab at the bottom of the tasking editor window.
  
−
=== Navigation within the Proof Tree===
+
== Using the Tasking Extension ==
−
On top of the proof tree view, one can see three buttons:
+
The steps needed to generate code from an Event-B model, in this tutorial, are as follows,
 +
* Step 1 - [[Tasking Event-B_Tutorial#Creating The Tasking Development|Create the tasking development]].
 +
* Step 2 - [[Tasking Event-B_Tutorial#Providing the Annotations for Implementations|Add Tasking annotations]].
 +
* Step 3 - [[Tasking Event-B_Tutorial#Optional Annotations for Addressed Variables|Add annotations for addressed variables (optional)]].
 +
* Step 4 - [[Tasking Event-B_Tutorial#Invoking the Translation|Invoke translators]].
  
−
* the "'''G'''" buttons allows you to see the goal of the sequent corresponding to each node,
+
==== Creating The Tasking Development ====
−
* the "'''+'''" button allows you to fully expand the proof tree,
+
* Change to the Event-B Perspective.
−
* the "'''-'''" allows you to fully collapse the tree: only the root stays visible.
+
* Open the ''Heating_ControllerTutorial_Step1'' Project.
 +
* Select the following Machines: Display_Update_Task1, Envir1, Heater_Monitor_Task1, Shared_Object1, Temp_Ctrl_Task1 and HC_CONTEXT.
 +
* Right-click and select ''Make Tasking Development/Generate Tasking Development''.
  
−
=== Manipulating the Proof Tree===
+
The new Tasking Development will not be visible in the Event-B perspective, change to the resource perspective, open and inspect the new ''.tasking'' file. The Tasking Development contains (the EMF representation of) the machines that we wish to provide implementations for. In order to introduce the new concepts we have prepared a partially complete development.
  
−
==== Hiding ====
+
* Change the tasking development, if necessary, so that the machine that models the environment is at the top of the list of machines.
−
The little square (with a "+" or "-" inside) next to each node in the proof tree allows you to expand or collapse the subtree starting at that node.
 
  
−
==== Pruning ====
+
This is due to a temporary technical limitation in the translator.
−
The proof tree can be pruned at a selected node; the subtree of the selected node is removed from the proof tree. The selected node becomes a leaf and is decorated with [[Image:Pending.gif]] . The proof activity can then be resumed from this node. After selecting a node in the proof tree pruning can be performed in two ways:
 
−
* by right-clicking and then selecting "Prune",
 
−
* by clicking on the [[Image:Pn_prover.gif]] button in the proof control view.
 
  
−
Note that after pruning, the post-tactic is not applied to the new current sequent. The post-tactic should be applied manually, if required, by clicking on the post-tactic button in the Proof Control view. This is useful, in particular, when you want to redo a proof from the beginning. The proof tree can be pruned at its root node and then the proof can proceed again, with invocation of internal or external provers; or with interactive proof.
+
Change to the Project ''Heating_ControllerTutorial_Step2'' to begin the next step.
  
−
Before pruning a particular node, the node (and its subtree) can be copied to the clipboard. If the new proof strategy subsequently fails, the copied version can be pasted back into the pruned node (see the next section).
+
==== Providing the Annotations for Implementations ====
 +
* Close any Tasking Pretty Print Viewers that remain open. The incomplete model will give rise to exceptions.
 +
* Go to the to the Resource Perspective.
 +
* Open and inspect the ''.tasking'' machine.
  
−
==== Copy/Paste ====
+
The ''Temp_Ctrl_Task1Impl'', ''Envir1'' and ''Shared_Object1'' machines are incomplete. We will take the necessary steps to provide implementation details.
  
−
By selecting a node in the proof tree and then right-clicking with the mouse, you can copy the part of the proof tree starting at that sequent (the node and its subtree). Pasting the node and subtree back in is done in a similar manner, with a right mouse click on a proof node. This allows reuse of part of a proof tree in the same, or even in another, proof.
+
===== The Temp_Ctrl_Task1Impl Machine =====
 +
In the partially complete tutorial project we have already identified the ''Temp_Ctrl_Task1Impl'' as an ''Auto Task'' Tasking Machine, by adding the ''Auto Task'' extension. ''Auto Tasks'' are tasks that will be declared and defined in the ''Main'' procedure of the implementation. The effect of this is that the ''Auto Tasks'' are created when the program first loads, and then activated (made ready to run) before the ''Main'' procedure body runs. We have added the ''Periodic Task'' extension to the ''Auto Task'', and set a period of 250 milliseconds. We have provided a PrettyPrint view of the completed ''Temp_Ctrl_Task1Impl'' [http://wiki.event-b.org/images/Temp_Ctrl_Task1Impl.pdf here], it can be read in conjunction with the tutorial.
  
−
== Goal and Selected Hypotheses ==
+
The next step is to construct the task body using control constructs such as sequence, branch, loop and output. These constructs are discussed in the [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview overview] of Tasking Event-B. We will now complete the sequence that has been partially defined in the task body.
−
The nodes in the proof tree view correspond to sequents. A user will work with one selected node, and thus one sequent, at a time; attempting various strategies in an effort to show that the sequent goal is true. The "Goal" and "Selected Hypotheses" views provide information to the user about the currently selected sequent. Here is an example:
 
−
[[Image:GoalHyp.png|center]]
 
  
−
A hypothesis can be removed from the list of selected hypotheses by selecting the check the box situated next to it (you can click on several boxes) and then by clicking on the [[Image:remove.gif]] button at the top of the selected hypotheses window:
+
*'''Synchronize Sensing between TCSense_Temperatures and ENSense_Temperatures'''.
 +
** Expand the Temp_Ctrl_Task1Impl ''Auto Task Machine'' node.
 +
** Expand the ''Seq'' sub-tree.
 +
** Right-click on the first ''Seq'' node and select ''New Child/Left Branch EventWrapper''.
 +
** Provide the event label ''tc1'' using the properties view.
 +
** Right-click on Event Wrapper and select ''New Child/ Synch Events''.
 +
** Select ''Synch Events'' and go to the drop-down menu of the ''Local Event'' property in the properties view.
 +
** At this point the drop-down box displays a number of event names, select the '''second''' ''TCSense_Temperatures'' event.
 +
** Go to the drop-down menu of the ''Remote Event'' property.
 +
** From the list of events select the '''second''' ''ENSense_Temperatures'' event.
  
−
[[Image:GoalHypSelect.png|center]]
+
By relating the sensing events in this way we describe a simulation of the interaction between the task and environment. The details of the interaction are embodied in the events themselves; and this is implemented in the simulation code by reading the values of the environment variables.  
  
−
Here is the result:
+
Note that the Synch Events construct is used in several ways. We use it to implement [[Tasking Event-B Overview#Control Constructs|Event Synchronisation]]; sensing and actuation; and as a simple event wrapper. An example of its use in a simple event wrapper follows. The simple event wrapper is used to update local state; there is no synchronisation, as such, but we re-use the constructs that already exist rather than create new ones. We now add a wrapped event to the sequence:
  
−
[[Image:GoalHypSelectRes.png|center]]
+
*'''Add the Wrapped Event TCCalculate_Average_Temperature'''.
 +
** Expand the sub-tree of the second ''Seq'' node.
 +
** Right-click on this (same as above) ''Seq'' node and select ''New Child/Left Branch EventWrapper''.
 +
** Provide the event label ''tc2'' using the properties view.
 +
** Right-click on Event Wrapper and select ''New Child/ Synch Events''.
 +
** Select ''Synch Events'' and go to the drop-down menu of the ''Local Event'' property.
 +
** From the list of events select the '''second''' ''TCCalculate_Average_Temperature'' event.
  
−
Note that the deselected hypotheses are not lost: you can find them again using the Search Hypotheses [[Image:sh_prover.gif]] button in the Proof Control view. Other buttons are used as follows:  
+
The addition of the wrapped event, to the sequence, is simply specification of event ordering. It is implemented in code as a sequential subroutine call statement. We now specify event synchronisation between the task and shared object:  
  
 +
*'''Add Synchronisation between TCGet_Target_Temperature2 and SOGet_Target_Temperature2'''.
 +
** Further expand the ''Seq'' sub-tree until Eventwrapper tc3 appears.
 +
** Right-click on the sibling ''Seq'' node (lowest in the tree) and select ''New Child/Left Branch EventWrapper''.
 +
** Provide the event label ''tc4'' using the properties view.
 +
** Right-click on Event Wrapper and select ''New Child/ Synch Events''.
 +
** Select ''Synch Events'' and go to the drop-down menu of the ''Local Event'' property.
 +
** At this point the drop-down box displays a number of event names, select the '''second''' ''TCGet_Target_Temperature2'' event.
 +
** Go to the drop-down menu of the ''Remote Event'' property.
 +
** From the list of events select the '''second''' ''SOGet_Target_Temperature2'' event.
  
−
* [[Image:select_all_prover.gif]] select all hypotheses.  
+
We have now completed the task body, and next provide additional details for events. In the first instance we focus on the the ''TCGet_Target_Temperature2 '' event in ''Temp_Ctrl_Task1Impl'' which is to be synchronized with the ''SOGet_Target_Temperature2 '' event in ''Shared_Object1Impl''.  
  
 +
*'''Add The Event Synchronisation Extension'''.
 +
** Navigate to the list of events in the machine.
 +
** Right-click on the ''TCGet_Target_Temperature2'' Event node.
 +
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''ProcedureSynch''.
  
−
* [[Image:inv_prover.gif]] invert the selection.
+
We have identified the event as one that partakes in a synchronisation. The corresponding event in the Shared machine is dealt with [http://wiki.event-b.org/index.php/Tasking_Event-B_Tutorial#The_Shared_Machine here]
  
 +
*'''Identify a parameter direction'''.
 +
** Right-click on the ''tm'' node.
 +
** Select''New Child/Parameter Type''.
 +
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''actualIn''.
  
−
* [[Image:falsify_prover.gif]] next to the goal - proof by contradiction 1: The negation of the '''goal''' becomes a selected hypothesis and the goal becomes "'''⊥'''".  
+
We have now identified the parameter as an actualIn (this models a call's return value).
  
 +
Next we look at the sensing event ''TCSense_Temperatures'' event in ''Temp_Ctrl_Task1Impl''. Sensing (and actuating) can be viewed as a kind of synchronisation. Synchronisation between tasks and shared objects are represented as subroutine calls. The sensing/actuating synchronisations only occur between tasks and the environment.
  
−
* [[Image:falsify_prover.gif]] next to a selected hypothesis - proof by contradiction 2: The negation of the '''hypothesis''' becomes the goal and the negated goal becomes a selected hypothesis.
+
*'''Add The Sensed Event Extension'''.
 +
** Right-click on the ''TCSense_Temperatures'' Event node.
 +
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Sensing''.
  
 +
We have identified the event as a sensing event. Now we add the parameter direction:
  
−
=== Applying Proof Rules ===
+
*'''Identify parameter directions'''.
−
A user wishing to attempt an interactive proof has a number of proof rules available, and these may be either rewrite rules or inference rules. In the Goal and the Selected Hypotheses views various operators may appear in red coloured font. The red font indicates that some interactive proof rule(s) are applicable and may be applied as a step in the proof attempt. When the mouse hovers over such an operator a number of applicable rules may be displayed; the user may choose to apply one of the rules by clicking on it.
+
** Right-click on the ''t1'' node.
 +
** Select''New Child/Parameter Type''.
 +
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''actualIn''.
 +
** Right-click on the ''t2'' node.
 +
** Select''New Child/Parameter Type''.
 +
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''actualIn''.
  
−
Other proof rules can be applied when green buttons appear in the Goal and Selected Hypotheses views. Examples are proof by contradiction [[Image:falsify_prover.gif]], that we have already encountered; and [[Image:ConjI_prover.gif]] for conjunction introduction in the goal.  
+
We have now identified the parameters as an actualIn (modelling a received value from the environment).
  
−
[[Image:ApplyRewRule.png|center]]
+
===== The Shared Machine =====
  
−
To instantiate a quantifier the user enters the desired expression in the box behind the quantifier and clicks on the quantifier:
+
The next step is to identify the ''Shared_Object1Impl'' machine as a ''Shared Machine''. A PrettyPrint view of the [http://wiki.event-b.org/images/Shared_Object1Impl.pdf Shared_Object1Impl] shared machine can be read in conjunction with the text.
 +
* Optionally collapse open branches of the EMF editor to remove clutter. 
 +
* Right-click on the ''Shared_Object'' Machine node in the ''.tasking'' file.
 +
* Select ''New Child/Shared Machine'' from the menu.
  
−
[[Image:InstQuantifier.png|center]]
+
We now show how to extend the ''SOGet_Target_Temperature2'' event of the Shared Machine with details about its implementation. The ''SOGet_Target_Temperature2'' event in ''Shared_Object1Impl'' synchronizes with the ''TCGet_Target_Temperature2'' event in the '' Temp_Ctrl_Task1Impl''.
  
−
==== Rewrite Rules ====
+
* '''Identify SOGet_Target_Temperature2 as a Synchronized event'''.
−
Rewrite rules are one-directional equalities (and equivalences) that can be used to simplify formulas (the goal or a single hypothesis). A rewrite rule is applied from left to right when its ''side condition'' holds; it can be applied either in the goal predicate, or in one of the selected hypotheses.
+
** Right-click on the ''SOGet_Target_Temperature2 '' Event node.
 +
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''ProcedureSynch''.
  
−
A rewrite rule is applied either automatically ('''A''') or manually ('''M'''):
+
* '''Identify the outgoing (return) parameter'''.
−
* automatically, when post-tactics are run.
+
** Right-click on the ''tm'' node.
−
* automatically, when auto-tactics are run.
+
** Select ''New Child/Parameter Type''.
−
* manually, through an interactive command. These rules gather non equivalence laws, definition laws, distributivity laws and derived laws.
+
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''formalOut''.
  
−
Automatic rewrite rules are equivalence simplification laws.
+
===== The Environ Machine =====
 +
In the prepared machine we have identified the ''Envir1Impl'' as an ''Environ Machine'', by adding the ''Environ Machine'' extension. ''Envir1Impl'' models a task that simulates the environment, and can be used to generate simulation code. For deployment in a non-simulated environment the environ machine's generated code can be ignored; we provide details of non-simulated code using addressed variables later. As before, a PrettyPrint view is available [http://wiki.event-b.org/images/Envir1Impl_2.pdf here]. In the prepared Environment Machine we have already added a ''Periodic Task'' extension, and set a period of 100 milliseconds.
 +
 +
We will now complete the sequence that has been partially defined in the task body. The following specification models simulation of a temperature change; the temperature value is represented by a monitored variable in the environment. The generated code simulates the temperature change in the environment by changing the monitored value. 
  
−
Each rule name indicates the rule's characteristics according to the following convention:
+
*'''Model Temperature Change in the environment'''.
 +
** Optionally collapse open branches of the EMF editor to remove clutter. 
 +
** Expand the Environ1Impl ''Environ Machine'' node.
 +
** Expand the ''Seq'' sub-tree fully.
 +
** Right-click on the last ''Seq'' node in the tree and and select ''New Child/Left Branch EventWrapper''.
 +
** Provide the event label ''e4'' using the properties view.
 +
** Right-click on Event Wrapper and select ''New Child/ Synch Events''.
 +
** Select ''Synch Events'' and go to the drop-down menu of the ''Local Event'' property.
 +
** At this point the drop-down box displays a number of event names, select the '''second''' ''ENAlter_Temperature_Sensor1'' event.
  
−
* the law category: simplification law (SIMP), definition law (DEF), distributivity law (DISTRI), or else derived law (DERIV).
+
Output to the screen during the simulation can be specified as follows:
−
* the root operator of the formula on the left-hand side of the rule, e.g. predicate AND, expression BUNION.
 
−
* (optionally) the terminal elements on the left-hand side of the rule: special element (SPECIAL) such as the empty-set, type expression (TYPE), same element occurring more than once (MULTI), literal (LIT). A type expression is either a basic type (<math>\intg, \Bool</math>, any carrier set), or <math>\pow</math>(type expression), or type expression<math>\cprod</math>type expression.
 
−
* (optionally) some other description of a characteristic, e.g. left (L), right (R).
 
  
−
Rewrite rules having a symmetric operator on the left-hand side may also describe other rules. eg: the rule:
+
*'''Text Output during Simulation.'''.
 +
** Right-click on the last ''Seq'' node in the tree and and select ''New Child/Right Branch Output''.
 +
** Select the ''Output'' node, and in the properties menu select the ''Element'' property drop down box.
 +
** Select the ''last'' variable ''ctd'' that appears in the list.
 +
** In the ''Text'' property field, add a textual description to accompany the text output.
  
−
<center><math>  \True  = \False  \;\;\defi\;\;  \bfalse </math></center>
+
The generated code will print the text, and the value of the variable, to the screen. The next step is to identify the ''ENAlter_Temperature_Sensor1'' as a ''ProcedureDef''. This event enables the environment to manipulate the monitored variable.
  
−
should also produce the rule:
+
* '''Identify ENAlter_Temperature_Sensor1 as a ProcedureDef event'''.
 +
** Right-click on the ''ENAlter_Temperature_Sensor1'' Event node.
 +
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''ProcedureDef''.
  
−
<center><math>  \False  = \True  \;\;\defi\;\;  \bfalse </math></center>
+
The final step is to complete the ''ENSense_Temperatures'' event. The event is a sensing event, sensing is a kind of synchronisation, it synchronises with the ''TCSense_Temperatures'' event in the ''Temp_Ctrl_Task1'' tasking machine. We add formal parameters annotations corresponding to the actual parameters that we have already defined in the task.
  
−
For associative operators in connection with distributive laws as in:
+
*'''Add The Sensed Event Extension'''.
 +
** Right-click on the ''ENSense_Temperatures'' Event node.
 +
** Select ''New Child/Implementation'' from the menu.
 +
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Sensing''.
  
−
<center><math> P  \land (Q~ {\color{red}{\lor}} \ldots \lor R) </math></center>
+
We have identified the event as a sensing event. Now we add the parameter direction:
  
−
it has been decided to highlight the first associative/commutative operator (the <math>{\color{red}{\lor}} </math>). A menu is presented when hovering the mouse over the operator: the first menu option distributes all associative/commutative operators, the second option distributes only the first associative/commutative operator. In order to simplify the explanation we write associative/commutative operators with two parameters only. However, ''we must emphasise here'', that generally we may have a sequence of more than two parameters. So, we write <math> Q \lor R </math> instead of <math> Q \lor \ldots \lor R </math>. Rules are sorted according to their purpose.
+
*'''Identify parameter directions'''.
 +
** Right-click on the ''t1'' node.
 +
** Select''New Child/Parameter Type''.
 +
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''formalOut''.
 +
** Right-click on the ''t2'' node.
 +
** Select''New Child/Parameter Type''.
 +
** Go to the ''Parameter Type'' properties view and set the ''Parameter Type'' property to ''formalOut''.
  
−
Rules marked with a star in the first column are implemented in the current prover. Rules without a star are planned for implementation.
+
We have now identified the parameters as an formalOut (modelling a simulation's subroutine call return value). This completes the necessary annotations for the simulation, and we can proceed to the translation step. In the event that memory mapped IO is required (non-simulation) then addresses can be added to the model at this stage, before translation takes place. See section on [http://wiki.event-b.org/index.php/Tasking_Event-B_Tutorial#Optional_Annotations_for_Addressed_Variables Addressed Variables] for details.
  
−
Rewrite rules are split into:
+
==== A Quick Check ====
  
−
* [[Set Rewrite Rules]]
+
It should now be possible to open the tasking PrettyPrinter view (Window menu) without errors. If the PrettyPrint fails, then this is a sign that the model has been incorrectly constructed. The point of failure (the extent of the printout before failure) may indicate the location of the error in the model.
−
* [[Relation Rewrite Rules]]
 
−
* [[Arithmetic Rewrite Rules]]
 
  
−
They are also available in a single large page [[All Rewrite Rules]].
+
===== A Summary of Steps =====
 +
If generating environment simulation code:
 +
# Ensure the Environ Machine is first machine in the development.
  
−
==== Inference Rules ====
+
For a Tasking Machine definition:
−
Inference rules (see [[Proof Rules]]) are applied either automatically (A) or manually (M).
+
# Add the Tasking Machine type (Auto etc).
 +
# Add the task type (Periodic etc.).
 +
# Define the task priority.
 +
# Define the task body.
 +
# For each event, add the Event Type.
 +
# For each event parameter, add the Parameter Type.
 +
# Optionally define addressed variables.
  
−
Inference rules applied automatically are applied at the end of each proof step. They have the following possible effects:
+
For a Shared Machine definition:
 +
# Add the ''SharedMachine'' Machine type.
 +
# For each event, define the Event Type.
 +
# For each event parameter, define the Parameter Type.
  
−
* they discharge the goal,
+
For an Environ Machine definition:
−
* they simplify the goal and add a selected hypothesis,
+
# Make the type an Environ Machine type.
−
* they simplify the goal by decomposing it into several simpler goals,
+
# Make the task type Periodic; a shorter period than the shortest task period is best for simulation.
−
* they simplify a selected hypothesis,
+
# Define the task priority.
−
* they simplify a selected hypothesis by decomposing it into several simpler selected hypotheses.
+
# Define the task body, it will contain a simulation of changes in the environment.
 +
# For each event, add the Event Type.
 +
# For each event parameter, add the Parameter Type.
 +
# Optionally define addressed variables.
  
−
Inference rules applied manually are used to perform an interactive proof. They can be invoked by clicking on the red highlighted operators in the goal or the hypotheses. A menu is presented when there are several options.
+
== Invoking the Translators ==
  
−
See [[Inference Rules]] list.
+
* To create the IL1 model,
 +
** Right-Click on the Main node, select ''Epsilon Translation/Translate Task Mch 2 IL1 EMF''.
 +
** Open the Resource Perspective.
 +
** Right-click on the ''Heating_ControllerTutorial_Step2'' project folder.
 +
** Select refresh, the ''.il1'' file should appear in the project.
 +
** Open and inspect the file, and view the source code by opening the IL1 Pretty Print view if desired.
  
−
== The Proof Control View==
+
In the event that the translator fails check that the correct events have been selected in the ''synchEvents'' construct. This can be done by looking at each task's ''taskBody'' construct, in the Tasking Pretty Printer view. In the PrettyPrinter view, each synchronization has a ''target'' and ''event'' seprated by dot-notation. The target is either the name of a shared machine or an environ machine. In this example check that the ''target'' refers to the correct machine, i.e. ''Envir1Impl'' rather than ''Envir1''; ''Temp_Ctrl_Task1Impl'' rather than ''Temp_Ctrl_Task1''; and ''SharedObject1Impl'', rather than ''SharedObject1''. After correcting any errors, invoke the translator again.
  
−
The Proof Control view contains the buttons which you can use to perform an interactive proof.
+
* To create the Event-B model of the implementation,
 +
** Return to the Rodin Modelling Perspective.
 +
** Right-Click on the Main node, select ''Epsilon Translation/Translate Task Mch 2 Event-B EMF''.
 +
** The ''Heating_Controller5AGen'' project is generated, it can be opened and inspected.
  
−
[[Image:PControl.png|center]]
+
There may be errors in the generated machines (the issue will disappear in a future release); these can be fixed in the following way.
 +
* Open a Machine in the Event-B Machine Editor.
 +
* Select the Edit tab.
 +
* Open the REFINES section, the error lies here.
 +
* The correct machine is refined, but choose a different machine to refine (any one, it doesn't matter).
 +
* Select the original refined machine again.
 +
* Save and clean the project, and the error should disappear.
 +
* Repeat for the same errors in the other machines; save and clean again.
 +
* The machines can viewed as normal using the Rodin editors.
  
−
The Proof Control view offers a number of buttons whose effects we briefly describe next; moving from left to right on the toolbar:
+
== Optional Annotations for Addressed Variables ==
 +
To use memory mapped IO (Addressed Variables) in our generated code we can specify which addresses to use in our [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview#Implementing_Events sensing and actuating events]. The addresses are added to the event parameters of  a Tasking Machine's sensing and actuating events. The addresses may also be added to the Environ machine's machine variables, for use in simulation. It should be noted that the use of addressed variables, in simulation, has to be done cautiously to prevent memory errors. In the current release the translator generates code for all of these situations, and the environment task should be discarded if simulation is not required.
  
−
* ('''nPP''') invokes the new predicate prover, a drop-down list indicates alternative strategies.
+
We now add addressed variable to the ''TCSense_Temperatures'' event in ''Temp_Ctrl_Task1Impl'', a PrettyPrint view is available [http://wiki.event-b.org/images/AddressedVarsTask.pdf here].
−
* ('''R''') indicates that a node has been reviewed: in an attempt by the user to carry out proofs in a stepwise fashion, they might decide to postpone the task of discharging some proofs until a later stage. To do this the proofs can be marked as reviewed by choosing the proof node and clicking on this button. This indicates that by visually checking the proof the user is convinced that they can discharge it later, but they do not want to do it right now.
 
−
* ('''p0''') the PP and ML provers can be invoked from the drop-down list using different forces.
 
−
* ('''dc''') do proof by cases: the proof is split into two branches. In the first branch:- the predicate supplied by the user is added to the Selected Hypotheses, and the user attempts to discharge this branch. In the second branch :- the predicate supplied by the user is negated and added to the Selected Hypotheses; the user then attempts to discharge this branch.
 
  
−
* ('''ah''') add a new lemma: the predicate in the editing area should be proved by the user. It is then added as a new selected hypothesis.
+
* '''Add Address Information to Event Parameters'''.
−
* ('''ae''') abstract expression: the expression in the editing area is given a fresh name.
+
** Right-click on the parameter node.
−
* '''the robot''': invokes the auto-prover which attempts to discharge the goal. The auto-prover is applied automatically on all proof obligations after a "save" without any intervention of the user. Using this button, you can invoke the auto-prover within an interactive proof.
+
** Select ''New Child/Addressed Variable''.
−
* the '''post-tactic''' is executed ,
+
** Go to the ''Addressed Variable'' properties view and set the ''Address'' and ''Base'' properties to appropriate values.
−
* '''lasoo''': load into the Selected Hypotheses window those hidden hypotheses that contain identifiers in common with the goal, and with the selected hypotheses.
 
−
* '''backtrack''' form the current node (i.e., prune its parent),
 
−
* '''scissors''': prune the proof tree from the node selected in the proof tree,
 
−
* '''Search Hypotheses''': find hypotheses containing the character string in the editing area, and display in the Search Hypothesis view.
 
−
* '''Cache Hypotheses''': press this to display the ''"Cache Hypotheses"'' view. This view displays all hypotheses that are related to the current goal.
 
−
* load the '''previous''' undischarged proof obligation,
 
−
* load the '''next''' undischarged proof obligation,
 
−
* '''(i)''' show information corresponding to the current proof obligation in the corresponding window. This information correspond to the elements that directly took part in the proof obligation generation (events, invariant, etc.),
 
−
* goto the next '''pending''' node of the current proof tree,
 
−
* load the next '''reviewed''' node of the current proof tree.
 
−
* '''Disable/Enable Post-tactics''': allows the user to choose whether post-tactics run after each interactive proof step.
 
−
=== The Smiley ===
 
−
The smiley can be one of three different colors: (1) red, indicates that the proof tree contains one or more undischarged sequents, (2) blue, indicates that all undischarged sequents of the proof tree have been reviewed, (3) green, indicates that all sequents of the proof tree are discharged.
 
  
−
=== The Editing Area ===
+
Reads of the monitored variables of the sensing event can therefore be made directly from the address specified. Their is also a ''base'' property which can be set to indicate the base of the property value. The default value is 16. The environment simulation may also make use of addressed variables, but in this case the extension is made to the Environ Machine machine variables and used as shown [http://wiki.event-b.org/images/AddressedVarsEnvir.pdf here].
−
The editing area allows the user to supply parameters for proof commands. For example, when the user attempts to add a new hypothesis (by clicking on the lemma '''ah''' button), the new hypothesis should have been written by the user in the editing area.
 
  
−
=== ML/PP and Hypotheses ===
+
Invocation of the translators proceeds as detailed above.
  
−
==== ML ====
+
== Generated Code ==  
−
ML (mono-lemma) prover appears in the drop-down list under the button ('''pp''') as M0, M1, M2, M3, ML.
+
The Ada Code generated by the translator is available at the following links:
−
The different configuration (e.g., M0) refer to the proof force of the ML prover. '''All hypotheses''' are passed to ML.
 
  
−
==== PP ====
+
for simulation of environment without addressed variables, [http://wiki.event-b.org/images/Code_Heating_ControllerTutorial_Completed.pdf Heating_ControllerTutorial_Completed]
−
PP (predicate prover) appears in the drop-down list under the button ('''pp''') as P0, P1, PP.  
 
−
* P0 uses '''all selected hypotheses''' (the ones in '''Selected Hypotheses''' window).
 
−
* P1 employs a '''lasoo''' operation to the selected hypotheses and the goal, and uses the resulting hypotheses.
 
−
* PP uses '''all hypotheses'''.
 
  
−
== The Search Hypotheses View==
+
for simulation of environment with addressed variables, [http://wiki.event-b.org/images/Code_Heating_Controller5AddressedSim_Completed.pdf Heating_Controller5AddressedSim_Completed]
−
By typing a string in the '''Proof Control''' window and pressing the '''Search Hypotheses''' button a window is provided which contains the hypotheses having a character string in common with the one entered by the user in the editing area. For example, if we search for hypotheses involving the character string "cr", then after pressing the '''Search Hypothesis''' button on the proof control window, we obtain the following:
 
  
−
[[Image:um-0102.png|center]]
+
Removal of the environment task from the ''Heating_Controller5AddressedSim_Completed'' should be deployable.
  
−
This view also integrates a "quick search" area (A), that allows us to search quickly hypothesis involving short character strings such as "cr". A '''search hypothesis button (B)''' that behaves the same as the button of the proving window, a '''refresh button (C)''' that updates the window manually for more control, and a '''drop down menu (D)''' to set the preferences of the view up.
+
[[Category:User documentation]]
−
 
 
−
By pressing '''return''' key or the button (B) (once a short string has been given in the input area (A)), hypotheses can be searched quickly as if we used the '''Proof Control''' as described before.
 
−
 
 
−
The drop down menu (D) is accessible to set some preferences over the searched hypotheses :
 
−
 
 
−
[[Image:SearchHyp_view_menu.png|center]]
 
−
 
 
−
If we change preferences for the search, we might need to "update" manually the view with the button (C).
 
−
By selecting "Consider hidden hypotheses in search" option, we can review all hypotheses that have been unselected in the selected hypotheses window(more info about[[Rodin_Proving_Perspective#Goal and Selected Hypotheses| selected/hidden hypotheses]]...).
 
−
 
 
−
[[Image:SearchHyp.png|center]]
 
−
 
 
−
To move any of these hypotheses to the '''Selected Hypotheses''' window, select those required (using the check boxes) and press the [[Image:Add.gif]] button. Adding these hypotheses to the selected hypotheses means that they will be visible to the prover. They can then be used during the next interactive proof phase.
 
−
 
 
−
To remove hypotheses from the '''Search Hypotheses''' window use the [[Image:Remove.gif]] button. This button also appears above the selected hypotheses, and allows the user to remove any hypothesis from the '''Selected Hypotheses''' window.
 
−
 
 
−
The other button, situated to the left each hypotheses, is the [[Image:falsify_prover.gif]] button. clicking on this will attempt a proof by contradiction. The effect is the same as if the hypothesis were in the '''Selected Hypotheses'''.
 
−
 
 
−
== The Cache Hypotheses Window ==
 
−
 
 
−
This window allows the user to keep track of recently manipulated (e.g., used, removed, selected) hypotheses for any PO. For example, when the user applies a rewrite to an hypothesis, a new hypothesis (after the rewriting) is selected, and the original hypothesis is deselected and put in the '''Cache Hypotheses''' window.
 
−
 
 
−
Similar operations (to that of the '''Selected Hypotheses''' and '''Search Hypotheses''' windows) such as removing, selecting and proof by contradiction ('''ct''') are also available for the cached hypotheses. Interactive proof steps (e.g., rewriting) can also be carried out from the '''Cache Hypotheses''' window as well as the '''Search Hypotheses''' window.
 
−
 
 
−
== Proof Information View ==
 
−
 
 
−
This view displays information so that the user can relate a proof obligation to the model. For example, typical information for an event invariant preservation PO includes the event; as well as the invariant in question. In the following example, the hyperlinks 'CreateToken' and 'inv2' can be used to navigate to the containing machine.
 
−
 
 
−
[[Image:PInfo.png|center]]
 
−
 
 
−
== Rule Details View ==
 
−
 
 
−
This view displays the information relative to a given proof tree node, on which a rule was applied.<br>
 
−
A command is available when right-clicking on a proof tree node, in order to reveal the Rule Details View (See picture below).
 
−
 
 
−
[[Image:ShowRuleDetailsView.png|center]]
 
−
 
 
−
By default, this view is a fast view. A button (identified by the view's icon) is then available at the bottom left of the workbench, to show up this view.
 
−
 
 
−
Here is an overview of the Rule details view :
 
−
 
 
−
[[Image:RuleDetailsView.png|center]]
 
−
 
 
−
A quick view on the applied rule contents is provided. On the picture above, we display the contents of the rule named "∀ hyp mp" where an input has been used to instantiate an hypothesis.<br> One can see quickly which was the input used by the instanciation (following '''instantiated with'''), and which was the hypothesis considered by this rule (this is given by the hypothesis of '''Input Sequent''').<br>
 
−
Furthermore, it is possible to view the antecedents created by this rule in details (i.e. child proof tree nodes) and the actions performed on hypotheses : selection, deselection, etc.
 
−
 
 
−
== Auto-tactic and Post-tactic ==
 
−
 
 
−
The auto-tactic applies a combination of ''rewrite'', ''inference'' and ''external provers'' to newly generated proof obligations. However, they can also be invoked by the user by clicking on the [[Image:auto_prover.png]] button in the '''Proof Control''' view.
 
−
 
 
−
Post-tactic is also a combination of ''rewrite'', ''inference'' and ''external provers'', and is applied automatically after each interactive proof step. However, it can also be invoked manually by clicking on the [[Image:Broom_prover.gif]] button in the '''Proof Control''' view. Note that the post-tactic can be disabled by clicking on the [[Image:disable_xp_prover.gif]] button, situated on the right of the '''Proof Control''' view.
 
−
 
 
−
=== Preferences for the Auto-tactic ===
 
−
 
 
−
The auto-tactic can be configured by means of a preference page which can be found as follows: Click on "Window" in the top toolbar; in the drop-down menu select "Preferences". Expand the "Event-B" option from the list; then "Sequent Prover", and finally select "Auto-Tactic". The following window is displayed:
 
−
 
 
−
[[Image:AutoTac.png|center]]
 
−
 
 
−
A list of available tactics appear in the left-hand box. A list of tactics selected for inclusion by the auto-tactic appears in the right-hand box. By selecting a tactic, in either list, it can be moved from one list to another. By clicking on a tactic in the right-hand list  it may be moved up or down, since the order of tactic application is determined by the order of this list.
 
−
 
 
−
=== Preferences for the Post-tactic ===
 
−
 
 
−
The post-tactic can be configured by navigating to the same menu that includes the auto-tactic preferences and then selecting "Post-Tactic". The preferences are selected in the same way as the auto-tactic. The following window is displayed:
 
−
 
 
−
[[Image:PostTac.png|center]]
 
−
 
 
−
[[Category:User documentation|The Proving Perspective]]
 
−
[[Category:Rodin Platform|The Proving Perspective]]
 
−
[[Category:User manual|The Proving Perspective]]
 

Revision as of 09:14, 29 November 2011

For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk

Tasking Event-B Tutorial Overview

This tutorial follows on from the abstract development described here.

This code generation tutorial extends the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces implementable Ada code, and also an Event-B model. It is a model of the implementation, and contains flow control variables that model the flow of execution through the task body. The Ada code is produced from an intermediate model that is not visible to the user. The Common Language model (CLM), is generated from the Tasking Event-B by a translation tool. Ada (and other implementations) may be generated from the CLM. An overview of Tasking Event-B can be found here.

In the example so far, the Heating Controller has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines modelling tasks, shared objects and the environment are identified, and extended with the appropriate implementation details.

The example/tutorial projects are are available in the e-prints archive, or on SVN.

Heating_ControllerTutorial_Completed An example project generating an environment simulation. Generates code, where environment variables are monitored and controlled using subroutine calls. Contains a completed Tasking Development with generated Event-B and Ada code.
Heating_ControllerTutorial_Step1 A bare project for step 1 of the tutorial.
Heating_ControllerTutorial_Step2 A partially completed tasking development for steps 2, and 4 of the tutorial (step 3 not required here).
Retrieved from ‘https://wiki.event-b.org/index.php?title=Rodin_Proving_Perspective&oldid=9947’