ADVANCE D3.2 Model Composition and Decomposition

Overview

Composition is the process by which it is possible to combine different sub-systems into a larger system. Known and studied in several areas, this has the advantage of reusability and combination of systems especially when it comes to distributed systems.
One of the most important feature of the Event-B approach is the possibility to introduce new events during refinement steps, but a consequence is an increasing complexity of the refinement process when having to deal with many events and many state variables.

Model decomposition is a powerful technique to scale the design of large and complex systems. It enables first developers to separate components development from the concerns of their integration and orchestration. Moreover, it tackles the complexity problem mentioned above, since decomposition allows the partitioning the complexity of the original model into separated components. This allows a decomposed part of the model to be treated as an independent artefact so that the modeller can concentrate on this part and does not have to worry about the other parts.
Composition and decomposition can be seen as inverse operations: while composition starts with different components that can be assembled together, decomposition starts with a single components that can be partitioned into different components.

Motivations / Decisions

Composition
While applying composition, properties must be maintained and proofs obligations need to be discharged in order for the final result to be considered valid. Since the composition maintains the monotonicity property of the systems, the sub-systems can be refined independently on a further stage, preserving composition properties.
In the latest version released (v1.5), several features were added to the shared event composition tool:

• Proof obligation were added: Well-Definedness (WD) and Invariant preservation (INV) for (composition) invariants and applicable to all composed machines; Gluing Invariant Preservation (INV), Simulation (SIM) and Guard Strengthening (GRD) for refinement; other POs are expected to be proved in directly in the included machines.
• Stronger static checks were added: no shared variable is allowed; all abstract events must be refined; common parameters must have the same type; check that a composed event must have at least one combined event;
• The user interface was improved: using the form-based editor, if the symbol corresponding to a composed event is hovered, a preview of the composed event is displayed

Decomposition
The main goal of Decomposition is to "cut" a model $M$ into sub-models $M_1, ..., M_n$, which can be refined separately and more comfortably than the whole. The constraint that shall be satisfied by the decomposition is that these refined models might be recomposed into a whole model $MR$ in a way that guarantees that $MR$ refines $M$. Note that this particular recomposition will never be performed in practice.

In an shared variable decomposition, the events of a model are partitioned to form the events of the sub-models. In parallel, the variables on which these events act are distributed among the sub-models.
In an shared event decomposition, the variables of a model are partitioned among the sub-models. Consequently, the events are partitioned accordingly to each sub-model.

In the latest version released (v1.2.3), the user's inputs and request were taken into account. In particular in terms of better usability of the tool. It is worth citing the following modifications:

• Typing guards (automatically generated) are now marked as theorems.
• Static checks were added to the decomposition file according to the decomposition style chosen.
• Improved UI interface: dialog requesting confirmation to delete possible existing sub-components were removed (as generated sub-components are marked as read-only).
• The suffix of decomposition files was changed to "_DCMP".
• Small bugs were fixed.

Available Documentation

Documentation for composition is available in:

• A user guide and release history on the Event-B wiki.
• A paper: Towards the Composition of Specifications in Event-B.

Documentation for decomposition is available in:

• The decomposition user guide.
• The decomposition description.
• A paper on the decomposition Tool for Event-B.
• A Survey on Event-B Decomposition.

Planning

Composition
Support for animation directly over a composed machine is planned. This will allow multiple machine to interact with each other. Improvements in usability of the tool will be made.

Decomposition
Although the actual decomposition operation is mature enough, the feeling is that the steps leading to that stage require some additional support. The preparation steps preceding the decomposition usually require some adjustments to the model in order to the decomposition to be beneficial in the following refinements of each generated sub-component. Therefore we aim to:

• Receive more feedback from the users to improve tool usability.
• Auto fixing of problems before executing decomposition: building a set of problem templates and respective solutions to be suggested to the modeller before executing decomposition.
• Build a list of architectures templates to be used for decomposition according to the number of sub-components to be generated/kind of architecture to be followed/etc.