D45 General Platform Maintenance

Core Platform Maintenance

Overview

The Rodin platform versions concerned by this deliverable are:

• 2.1(08.02.2011),
• 2.2(01.06.2011),
• 2.2.2(01.08.2011),
• 2.3(04.10.2011),
• 2.4(31.01.2012),
• 2.5(30.04.2012).

This year, the maintenance carried on fixing identified bugs, although an emphasis was put on rectifying usability issues. Indeed, during the annual meeting in Nice, the WP9 members agreed to refocus on addressing some specific bugs and issues reported by DEPLOY partners, and wished resolved by the end of DEPLOY. Thus, no new features were implemented but those mentioned in the description of work. The tasks to be performed by the WP9 members were then scheduled, prioritized and regularly updated during the WP9 bi-weekly teleconferences. The updates allowed to capture and integrate rapidly some minor changes to enhance the usability of the platform which were required by the DEPLOY partners. The following paragraphs will give an overview of the the work that has been performed concerning maintenance on the existing platform components (i.e. core platform and plug-ins).

See the Release Notes and the SourceForge databases (bugs and feature requests) for details about the previous and upcoming releases of the Rodin platform.

Some other which were later added and prioritized are worth to mention:

• Possibility to highlight patterns in the Proving UI,
• A better output providing warnings and errors in case of wrong or missing building configurations,
• The switch to Eclipse 3.7,
• A Handbook to complete and enhance the existing documentation.

Motivations

The tasks to resolve the issues faced by the DEPLOY industrial partners have been listed and have been assigned to groups according to their priority. A high priority means a high need in the outcome of a given task. Group 1 has the highest priority, group 2 has an intermediate priority, and group 3 has the lowest priority. Group 4 concerns topics that could not be resourced during the lifetime of DEPLOY.

The platform maintenance, as it can be deduced from the above tables, mainly concerned stability and performance improvement. These topics will be discussed and detailed in a separate chapter about scalability improvements.

Other improvements of utmost importance were made on the platform. These improvements either came from DEPLOY partners specific needs, or were corresponding to previously identified needs (listed in D32 - Model Construction tools & Analysis III Deliverable). Hence we review below the motivations of some noteworthy implemented features:

• Possibility to highlight patterns in the Prover UI

This feature came from a request of DEPLOY partners, often facing the need to find particular patterns such as expressions in long predicates (e.g. long goals). Since Rodin 2.2, and its new Proving UI interface, a feature has been added, allowing to search and highlight a string pattern into the whole Proving UI views and editors. This function has also been enabled on direct selection of text in this UI.

• A better output providing warnings and errors in case of wrong or missing building configurations

This issue, often being seen as a bug or as a plug-in incompatibility, was raised when a user imports and tries to use a model on a platform with some missing required plug-ins. The user often thought his models corrupted whereas Rodin was not able to build them, and hid this information to the user. This is why, since Rodin 2.3, an output has been provided in such case, taking the form of warnings or errors that any user can understand and review.

• The switch to Eclipse 3.7

Due to the major improvements made every year in Eclipse releases and the continuously growing number of contributing projects, some of them used as basis for Rodin plug-ins, the Rodin platform follows the evolution and is adapted every year quickly to the latest Eclipse version available. This year, Rodin 2.3 originated the switch from Eclipse 3.6 to Eclipse 3.7.

• A Handbook to complete and enhance the existing documentation

At the DEPLOY Plenary Meeting in Zürich in 2010, it has been stated that the current documentation, in its state at that time, would not support an engineer starting using the tools without significant help of an expert. Significant efforts to improve the documentation were performed and coordinated by Düsseldorf, and took form of a handbook. The Rodin handbook has the aim to minimize the access to an expert, by providing the necessary assistance to an engineer in the need to be productive using Event-B and the Rodin toolset. The contents of the handbook, user oriented, were originated by some contents of the Event-B wiki.

Choices / Decisions

Revisited task priority
This year, the process of giving priority to maintenance tasks was revisited according to the refocus mentioned above. The aim was to address all the major scalability issues before the end of DEPLOY. Thus, the requests coming from DEPLOY partners were given high priorities, and they were also prioritized against the already planned tasks coming from both DEPLOY partners and the Description of Work. Keep 32-bit versions of the Rodin platform on Linux and Windows systems
It was asked by end users to make both 32-bit and 64-bit versions of the Rodin platform available for Linux and Windows platforms. Only a 64-bit version of Rodin is available on Mac platforms as 32-bit Mac (early 2006) platforms are no longer maintained. The request to offer 64-bit was motivated by the possibility to increase for them the available Java heap size for some memory greedy platforms (these before Rodin 2.3). After having ensured to get all physical platforms to test the different versions, and despite the drawbacks of assembling and maintaining more platforms (5 platforms instead of 3), Rodin 2.4 has started a new era where Rodin platforms are available on Linux and Windows 64-bit as well as 32-bit.

Available Documentation

The release note pages give useful information about the Rodin platform releases. Two trackers follow and document the platform status in terms of knows bugs and feature requests:

• a sourceforge bug tracker,
• a sourceforge feature requests tracker.

The Rodin handbook is available as a PDF version, a HTML version, and help contents within Rodin.

Status

By the end of DEPLOY, the ultimate version of the Rodin platform is 2.5. One can download it on the sourceforge repository and read the release notes on the wiki.

Plug-in incompatibilities

Overview

Some plug-in incompatibilities occured and were continuously handled throught the lifetime of the project. Most incompatibilities are related to the difficulty to make plug-ins work together and occured directly during the installation or at first launch.

Motivations

By its extensibility nature, the Rodin platform is susceptible to incompatibilities. Indeed, there are many ways in which incompatibilities could occur, and some occurred in the lifetime of DEPLOY. A good example, is the dependency management. Suppose that a bundle x_v1.0 is needed by a plug-in A (i.e. a dependency from A has been defined to x in at most the version 1.0) and installed in Rodin. Furthermore the plug-in x_v1.1 is needed by a plug-in B. Both versions 1.0 and 1.1 of x could not be installed and used at the same time and thus create some usage incompatibility.

Choices / Decisions

It has been decided in cooperation with all the WP9 partners to find better ways to address the plug-in incompatibility issues. First of all, the various partners refined the concept of "plug-in incompatibility". Hence, various aspects could be identified and some specific answers were given to each of them. The user could then defined more clearly the incompatibility faced. Plug-in incompatibilities can be separated in two categories:

• Rodin platform/plug-in incompatibilities, due to some incorrect matches between Rodin included packages and the plug-in dependencies (i.e. required packages). These incompatibilities, when reported, allowed the plug-in developers to contact SYSTEREL in charge of managing the packages shipped with a given version of Rodin. It could also allow traceability of incompatibilities and information to the user through a specific and actualized table on each Rodin release notes page on the Wiki.
• Plug-in/plug-in incompatibilities, due to some incorrect matches between needed/installed packages, or API/resources incompatible usage. A table was created on each release notes wiki page, and a procedure was defined so that identified incompatibilities are listed and corrected by the concerned developers.

It appeared that cases of using a model which references some missing plug-ins were formerly often seen as compatibility issues although they were not.
After the incompatibilities have been identified, the concerned developing counterparts assigned special tasks and coordinated to solve issues as soon as possible. Incompatibilities are often due to little glitches or desynchronisation. As a result, direct coordination of counterparts appeared to be appropriate because of its promptness and effectiveness.

Available Documentation

The process to report plug-in incompatibilities is documented on each release notes page right after the plug-in availability tables.

Status

As the time of writing this deliverable, no plug-in incompatibilities are left or have been reported between the platform and plug-ins or between plug-ins.

Mathematical extensions/ Theory Plug-in

Overview

Mathematical extensions have been co-developed by SYSTEREL (for the core Rodin platform) and Southampton (for the Theory plug-in). The main purpose of this new feature was to provide the Rodin user with a way to extend the standard Event-B mathematical language by supporting user-defined operators, basic predicates and algebraic types. Along with these additional notations, the user can also define new proof rules (prover extensions). The scope of the ongoing work on the Theory plug-in centers around bug fixes, improving usability and performance and exploring other venues for operator definitions. Please note that we will distinguish the "Theory" plug-in from the "theory" component (using this capitilization).

Motivations

The Theory plug-in provides a high-level interface to the Rodin core platform capabilities which enables the definition of mathematical and prover extensions grouped into modules called theories. These mathematical and prover extensions are new algebraic types, new operators/predicates and new proof rules. Theories are developed in the Rodin workspace, and proof obligations are generated to validate prover and mathematical extensions. When a theory is completed and (optionally) validated, the user can make it available for use in models (this action is called the deployment of a theory). Theories are deployed to the current workspace (i.e., workspace scope), and the user can use any defined extensions in any project within the workspace. The Rule-based Prover was originally devised to provide a usable mechanism for user-defined rewrite rules through theories. Theories were, then, deemed a natural choice for defining mathematical extensions as well as proof rules to reason about such extensions. In essence, the Theory plug-in provides a systematic platform for defining and validating extensions through a familiar technique: proof obligations.

Support for using polymorphic theorems in proofs was added in version 1.1.

Choices / Decisions

The Theory plug-in contributes a theory construct to the Rodin database. Theories were used in the Rule-based Prover (before it was discontinued) as a placeholder for rewrite rules. Given the usability advantages of the theory component, it was decided to use it to define mathematical extensions (new operators and new datatypes). Another advantage of using the theory construct is the possibility of using proof obligations to ensure that the soundness of the formalism is not compromised. Proof obligations are generated to validate any properties of new operators (e.g., associativity). With regards to prover extensions, it was decided that the Theory plug-in inherits the capabilities to define and validate rewrite rules from the Rule-based Prover. Furthermore, support for a simple yet powerful subset of inference rules is added, and polymorphic theorems can be defined within the same setting. Proof obligations are, again, used as a filter against potentially unsound proof rules.

Available Documentation

Pre-studies (states of the art, proposals, discussions):

• Proposals for Mathematical Extensions for Event-B
• Mathematical Extension in Event-B through the Rodin Theory Component
• Generic Parser's Design Alternatives
• Theoretical Description of Structured Types

Technical details (specifications):

• Mathematical_Extensions wiki page
• Constrained Dynamic Lexer wiki page
• Constrained Dynamic Parser wiki page
• Theory plug-in wiki page
• Records Extension Documentation on wiki

User's guides:

• Theory Plug-in User Manual

Status

Work on the Theory plug-in includes:

• Bug fixes.
• Usability improvements.
• Exploring other potential ways of defining operators and types (e.g., axiomatic definitions).

Decomposition

Overview

Decomposition can advantageously be used to decrease the complexity and increase the modularity of large systems, especially after several refinements. Main benefits are the distribution of proof obligations over the sub-components which are expected to be easier to be discharged and the further refinement of independent sub-components in parallel introducing team development of a model which is attractive for the industry. Shared variable and shared event decomposition are supported in the same tool: the former seems to be suitable when designing concurrent programs while the latter seems to be particularly suitable for message-passing distributed programs. The tool was initially developed in ETH Zurich. Further development of the tool was a collaboration between ETH Zurich, Southampton and SYSTEREL. After some user feedback, the tool was improved in terms of usability and performance. The ongoing work aims for a more automated tool that can propagate changes in the sub-components and minimise the user intervention as much as possible while maintaining or enhancing the performance.

Motivations

The top-down style is one of the most used in modelling in Event-B. It allows the introduction of new events and data-refinement of variables during refinement steps. A consequence of this development style is an increasing complexity of the refinement process when dealing with many events and state variables. The main purpose of the model decomposition is precisely to address such difficulty by separating a large model into smaller components. Two methods have been identified for the Event-B decomposition: shared variable (proposed by Abrial) and shared event (proposed by Butler). We developed a plug-in in the Rodin platform that supports these two decomposition methods for Event-B. Because decomposition is monotonic, the generated sub-components can be further refined independently. Therefore we can expand the team development options: several developers share parts of the same model and work independently in parallel. Moreover the decomposition also partitions the proof obligations which are expected to be easier to discharge in sub-components.

Choices / Decisions

The tasks performed on the decomposition plug-in were focused on consolidation.

Available Documentation

Two entry pages are available on the wiki:

• The Decomposition Plug-in User Guide,
• The event model decomposition wiki page.

Status

The decomposition plug-in is available in version 1.2.2 and works on Rodin 2.4 and 2.5. It is available from the main Rodin update site.

Team-Based Development

Overview

The Team-Based Development plug-in enables Rodin models to be stored in a version repository such as SVN. During the final year of DEPLOY, the development concerned mostly consolidation and interface enhancement.

Motivations

To achieve the storage of Rodin models in SVN, the Team-Based Development plug-in allows maintaining a synchronised copy of the model resources in an EMF format. EMF comparison tools can then be used to examine differences between versions.

Choices / Decisions

The EMF default XMI format was used to store models in a form that can be accessed independently of the Rodin database. Since an EMF framework for Event-B already existed (but relied on serialisation into the Rodin database), it was easy to provide an option to serialise into the XMI format. The EMF compare was customised to provide a more user friendly comparison.

Available Documentation

See the Team-based Development Documentation on wiki.

Status

The Team-Based Development plug-in is available on the main Rodin update site. Currently 3-way comparison is not supported. (3-way comparison is needed if 2 people check out and change the model so that there are 2 working copies as well as a repository baseline).

Modularisation

Overview

Modularisation offers an intuitive yet rigorous mechanism for structuring large developments. Its main distinguishing feature is the use of interface components - a special form of an abstract machine defining callable operations and external variables. To decompose a design using modularisation a designer needs to identify a self-contained part of a design and captures it in an independent module. A module is an Event-B development starting with an interface as its top-level abstraction. Modules may be included into machines and offer operations that may be used to define actions of an including machine. Variables of an interface may not be modified directly and thus the invariant property of an interface holds at all times. An essential part of a decomposition step is identifying a part of an abstract state that is removed and said to be realised by one of the included modules. Modularisation works well for sequential and concurrent systems.

Motivations

The major motivation for the initial design and the continuing development of the modularisation extension is the desire to deal with large-scale specification using Event-B notation and refinement-based development. Generally, users find the modularisation approach fairly intuitive and flexible.

Choices / Decisions

Modularisation is not a simple extension and it changes both the syntax and semantics (the set of proof obligations) of Event-B. It is possible to encode all of the modularisation concepts directly in the Event-B notation. However, it was deemed very important to offer high-level structuring concepts - interfaces and operations - that engineers may relate to. Although an operation call in modularisation is merely a metaphore, the syntactic resemblances of an procedure call in a programming language significantly improves model readability. A similar idea motivated the introduction of an interface component - sensible syntax and efficient set of proof obligations are paramount.

Available Documentation

See the Modularisation plug-in wiki page.

Status

The modularisation plug-in is available for Platform versions 1.6 - 2.4. Starting from Platform version 2.3, modularisation is compatible with the ProB animator and model checker. The modularisation is not compatible with Camille text editor.

UML-B

Overview

The UML-B plug-in supports modelling in a UML-like diagrammatic notation with conversion to Event-B for verification. UML-B supports class and state machine diagrams as well as a project structure diagram (showing machines and contexts). UML-B continues to be supported but currently is not undergoing new development. Some enhancements were made last year in order to improve the usability of state machines, however, most new development concentrates on the new Event-B diagrammatic extensions to Event-B (such as the Event-B Statemachines plug-in).

The Event-B Statemachines plug-in is a new tool, based on the UML-B state machine diagrams, which allows to integrate state machines into normal Event-B machines. It provides a graphical diagram editor, an Event-B generator and, as an optional plug-in, diagram animator for ProB.

Motivations

The Event-B Statemachines plug-in has been introduced as a result of the necessity to integrate higher level constructs into established Event-B modelling process. From the experience of working with the UML-B tool it became apparent that a tighter integration is required between Event-B models under development and high level extensions such as state machines. In particular, this integration should be flexible enough to make it easy for an user to add new constructs at any point of Event-B development and work with them through refinement, which is a key feature of the Event-B language and Rodin tool.

Choices / Decisions

For the Event-B Statemachines plug-in the following key decisions were made:

• The UML-B state machines example was taken as a concept.
• Well-established Eclipse development frameworks — EMF and GMF — were chosen for implementation of the new plug-in and simplified (from the original UML-B state machines) EMF metamodel and diagram have been implemented.
• The integration idea between Event-B and state machines was based on EMF extension mechanism and serialisation principle: a state machine was designed as an extension to EMF Event-B metamodel that would be serialised as a string to an attribute in Rodin database, thus making the details of it transparent to Rodin.
• For the translation of state machines to Event-B the QVT framework has been selected, considering it as a well-supported framework, used in other Eclipse projects such as GMF, and more declarative nature of it compared to pure Java, which would improve maintainability.

As a result of work on Event-B Statemachines plug-in a set of additional plug-ins has been developed that forms a framework to support developer effort in implementing other similar tools and high level extensions for Event-B. These plug-ins include generic serialised persistence and navigator support for new EMF extensions, generic diagram metamodel and navigator actions, generic refinement and Event-B generator modules for new extensions.

Available Documentation

See the Event-B State-machines Documentation on wiki.

Status

The Event-B State machines plug-in is available on the main Rodin update site.

ProR

Overview

ProR is a replacement of the original requirements plug-in, which got discontinued in 2010. It is based on the OMG ReqIF standard, which provides interoperability with industry tools. It evolved into the Eclipse Foundation project "Requirements Modeling Framework" (RMF), resulting in significant visibility. ProR is independent from Rodin. Integration is achieved with a separate plug-in that provides support for traceability and model integration.

Motivations

While the original requirements plug-in for Rodin was useful as a prototype, a number of shortcomings lead to a new development. In particular, the original plug-in was a traceability tool with externally managed requirements. With ProR, requirements are authored and edited within Eclipse. The original plug-in supported only a limited number of attributes and flat (unstructured) requirements. ProR supports all data structures that the ReqIF standard supports. Further, ReqIF-support for industry tools like Rational DOORS, MKS or IRqA is expected in the near future, while the original plug-in required a custom adaptor for each data format.

ProR is developed independently from Rodin. Dependencies to Rodin exist only in the Rodin integration plug-in. This significantly decreases the maintenance effort for the integration plugin, while increasing the visibility of ProR in the Open Source community. The move of ProR from the University of Düsseldorf to the Eclipse Foundation increases visibility even further. The Rodin integration plug-in is maintained as an independent project at GitHub.

Choices / Decisions

The following key decisions were made when developing ProR:

• New development, rather than continuing the original plug-in - the architecture of ProR differs significantly from that of the original plug-in (as explained earlier). In addition, new technologies like EMF promised a cleaner, more powerful framework for an implementation.

• ReqIF as the underlying data model - the ReqIF standard is gaining traction and promises interoperability with industry tools. In addition, a digital version of the data model was available for free and could serve as the foundation for the model code.

• The Eclipse Modeling Framework (EMF) was identified as a technology that would allow a quick and clean foundation for an implementation. Further, the Rodin EMF-plug-in represents a convenient interface for integrating ProR and ProB. Last, the digital data model from the OMG could be imported directly into EMF and used for generating the model code.

• Keeping ProR independent from Rodin - There is significant interest in ReqIF right now, but this interest is unrelated to formal methods. By providing an implementation that is independent from Rodin, we have a much larger target group of potential users and developers. By carefully designing extension points, we can still provide a powerful Rodin integration.

• Eclipse Foundation Project - we were actively establishing an open source community around ProR. By recruiting engaged partners early on, development progressed faster than anticipated. By becoming an Eclipse Foundation project , we exceeded our goals in this respect.

Available Documentation

There are two major sources of information about ProR on the internet:

• ProR at the Eclipse Foundation
• ProR Documentation for end users and plugin developers

Status

ProR took on a life on its own as part of the Requirements Modeling Framework. It is currently in the incubation stage of an Eclipse project. There are currently five committers in total, with two from the Rodin project, namely Michael Jastram (Project Lead) and Lukas Ladenberger.

The Rodin integration supports:

• Creating traces between model elements and requirements,
• Highlighting of model elements in the requirements text,
• Marking of invalidated traces, where either the requirement or model element had changed.

The Rodin integration is hosted at the University of Düsseldorf.

BMotion Studio

Overview

BMotion Studio is a visual editor which enables the developer of a formal model to set-up easily a domain specific visualisation for discussing it with the domain expert. BMotion Studio comes with a graphical editor that allows to create a visualisation within the modeling environment. Also, it does not require to use a different notation for gluing the state and its visualisation. BMotion Studio is based on the ProB animator and is integrated into Rodin. However, BMotion Studio is independent from Rodin. Integration is achieved with a separate plug-in.

• BMotion Studio has been quite successful, and besides a number of bug fixes and some performance profiling and tuning, the useability of the tool was improved.
• One of our students made experiments towards visualizing industry standards with BMotion Studio. The first experiments were quite successful.
• First experiments towards visualizing mathematical assertions found in formal specifications using Venn Diagrams/Euler Diagrams/Constraint Diagrams were made.

Motivations

The communication between a developer and a domain expert (or manager) is very important for successful deployment of formal methods. On the one hand it is crucial for the developer to get feedback from the domain expert for further development. On the other hand the domain expert needs to check whether his expectations are met. To avoid this problem, it is useful to create domain specific visualisations. However, creating the code that defines the mapping between a state and its graphical representation is a rather time consuming task. It can take several weeks to develop a custom visualisation. To overcome this problem, BMotion Studio comes with a graphical editor that allows to create a visualisation with static images and drag and drop within the modelling environment, not requiring additional skills.

An often stated limitation in using formal methods is the difficulty in understanding the formal notation. To overcome this problem and to support the user we made first experiments towards visualizing mathematical assertions found in formal specifications using Venn Diagrams/Euler Diagrams/Constraint Diagrams.

Choices / Status

The following key decisions were made when developing BMotion Studio:

• Keeping BMotion Studio user-friendly - The user should be able to create a visualization not requiring additional skills in programming languages.
• ProB as animator for providing state information - With the ProB animator, we have a powerful tool for interacting with the model.
• Provide extensibility for specific domains - By carefully designing extension points, we can provide a powerful integration for specific domains.
• Keeping BMotion Studio independent from Rodin - By providing an implementation that is independent from Rodin, we have a much larger target group of potential users and developers.

Available Documentation

• BMotion Studio Documentation for end users and plugin developers.
• Context sensitive help is under work.

Status

The tool is available as a part of the ProB animator and is ready for use for visualizing Event-B models within the Rodin tool. Of course, we are working on new features.

Mode/FT Views

Overview

The Mode/FT Views plug-in is a modelling environment for constructing modal and fault tolerance features in a diagrammatic form and formally linking them to Event-B models. The consistency conditions between the modal/FT views and Event-B models are ensured by additional proof obligations. The views form a refinement chain of system modal and fault tolerant behaviour which contribute to the main Event-B development. The views reserve a place for tracing modal and FT requirements.

Motivations

There are two major motivations for creating the Mode/FT Views plug-in:

• An overview of the requirements documents within DEPLOY indicated that systems are often described in terms of operational modes and configurations. This led to a work on formal definition of modal systems.
• Fault-tolerance is the crucial part of the behaviour of dependable critical systems that needs to benefit from formal modelling as functionality does. The requirements documents for the pilot studies in DEPLOY contain a high number of requirements related to fault handling and fault tolerant behaviour. A significant part of them are also described by using recoveries and degraded modes.

The plug-in provides an environment for specifying modal and fault tolerant behaviours which are often interrelated. By having a refinement chain of system-level modal diagrams, the development benefits from additional modelling constraints and improved requirements traceability.

Choices / Decisions

The following key decisions were made when developing Mode/FT Views:

• The Eclipse Graphical Modelling Framework (GMF) was used as a platform for building a user-friendly modelling environment.
• Proof obligations for the views are injected into the standard PO repository of the models - This ensures that all the tools related to theorem proving can be used in the same way as they are used for Event-B proof obligations.

Available Documentation

A Mode/FT Views documentation is available for users.
Papers have been published:

• Structuring Specifications with Modes.
• Modal Systems: Specification, Refinement and Realisation.
• On Fault Tolerance Reuse during Refinement.

Status

The Mode/FT Views is a plug-in for the Rodin platform. The tool is available from its update site