Tasking Event-B Tutorial: Difference between revisions

From Event-B
Jump to navigationJump to search
← Older edit
imported>Andy
imported>Andy
 
(29 intermediate revisions by the same user not shown)
Line 1: Line 1:
For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk
For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk
<< I AM UPDATING THIS PAGE >>
=== Tasking Event-B Tutorial Overview ===
=== Tasking Event-B Tutorial Overview ===


This tutorial follows on from the abstract development described [http://wiki.event-b.org/index.php/Development_of_a_Heating_Controller_System here].
This tutorial follows on from the abstract development described [http://wiki.event-b.org/index.php/Development_of_a_Heating_Controller_System here].


This code generation tutorial extends the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces implementable Ada code, and also an Event-B model. It is a model of the implementation, and contains flow control variables that model the flow of execution through the task body. The Ada code is produced from an intermediate model that is not visible to the user. The Common Language model (CLM), is generated from the Tasking Event-B by a translation tool. Ada (and other implementations) may be generated from the CLM. An overview of Tasking Event-B can be found [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview here].
This code generation tutorial extends the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces Java code, and also an Event-B model. It is a model of the implementation, and contains flow control variables that model the flow of execution through the task body. The Java code is produced from an intermediate model that is not visible to the user. The Common Language model (CLM), is generated from the Tasking Event-B by a translation tool. Java (and other implementations) may be generated from the CLM. An overview of Tasking Event-B can be found [http://wiki.event-b.org/index.php/Tasking_Event-B_Overview here].


In the example so far, the Heating Controller has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines modelling tasks, shared objects and the environment are identified, and  extended with the appropriate implementation details.
In the example so far, the Heating Controller has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines modelling tasks, shared objects and the environment are identified, and  extended with the appropriate implementation details.


The example/tutorial projects are are available in the [http://deploy-eprints.ecs.soton.ac.uk/304/ e-prints archive], or on [https://codegenerationd.svn.sourceforge.net/svnroot/codegenerationd/Examples/Heating_ControllerTutorial_v0.2.0/ SVN].
The example/tutorial projects are are available from [https://github.com/andyed2003/codeGenExamples Git] or clone [https://github.com/andyed2003/codeGenExamples.git this].


{| border="1"
{| border="1"
|Heating_ControllerTutorial2_Completed  
|Heating_ControllerTutorial2_Completed  
|An example project with an environment simulation. The environment variables are monitored and controlled using subroutine calls. The project contains a complete Tasking Development with generated Event-B and Ada code.
|An example project with an environment simulation. The environment variables are monitored and controlled using subroutine calls. The project contains a complete Tasking Development with generated Event-B and Java code.
|-
|-
|Heating_ControllerTutorial2_Partial1  
|Heating_ControllerTutorial2_Partial1  
Line 31: Line 34:
* Step 4 - [[Tasking Event-B_Tutorial#Invoking the Translation|Invoke translators]].
* Step 4 - [[Tasking Event-B_Tutorial#Invoking the Translation|Invoke translators]].
=== Download and Copy the Theories ===
=== Download and Copy the Theories ===
The translations of the Event-B mathematical language to the target language constructs are specified as rules in the theory plug-in. Three rule files are included for the example, and are available in the [https://codegenerationd.svn.sourceforge.net/svnroot/codegenerationd/Examples/TheoriesForCG SVN]. The files can be downloaded and copied into an Event-B project called ''MathExtensions''. The theory must then be deployed. Right-Click on the theory file and select deploy to do this. The non-Event-B project, the original download may now be deleted.
The translations of the Event-B mathematical language to the target language constructs are specified as rules in the theory plug-in. Example rule files are included for the example, and are available in MathExtension from the [https://github.com/andyed2003/codeGenTheoryRepo Git] repository, or clone [https://github.com/andyed2003/codeGenTheoryRepo.git this]. After checking out the theories, they must be un-deployed, then re-deployed, ensuring that the builder creates all of the appropriate files. Right-Click on the theory file and select deploy to do this. If you already have a MathExtensions folder then it should be renamed else the import will be prevented. Files from this folder can be copied and deployed in the new folder if necessary.


=== Adding the Implementation Level Refinement ===
=== Adding the Implementation Level Refinement ===
Line 38: Line 41:
=== Pre-processing ===
=== Pre-processing ===


The pre-processing steps, described here, should be a temporary solution. The steps can be performed automatically, if appropriate changes are made to facilitate refinement of composed machines, and flattening of files.  
The pre-processing step, described here, is done automatically by the tool. The description is provided to assist with understanding the changes that occur to a model, during the code generation phase.


* The Code Generator requires a flattened version of each machine; all of the Event-B elements should be available in the implementation level machine.
* The Code Generator requires a flattened, and annotated, version of each machine; all of the Event-B elements are made available in the implementation level machine.  
* Composed machines are not currently able to be refined, so anything that requires synchronization of events requires some manual updates.


===== 'Flattening' the Implementation Machines =====
===== 'Flattening' the Implementation Machines =====


The temporary solution for flattening:
* Events are changed to be ''not extended''.
* Make events ''not extended''.
* Abstract invariants are copied to the implementation level machine.
* Copy missing invariants.
 
===== Annotations are provided automatically =====


I found the Event-B Machine Editor's synthesis view useful for this. Invariants can be copy-pasted into the implementation machine from the abstraction. (A dummy invariant can be added and selected for pasting)
* Typing annotations are added to typing invariants and axioms where they type variables and constants.
* Parameter directions (in or out) are inferred from the events.


===== Providing the correct Composed Machine =====
=== Manually correcting the Composed Machine ===


The composed machine problem is sub-divided into two sub-problems. Firstly composed machines cannot be refined, and secondly when a machine is further decomposed there is no link between the first composed machine and the newly generated composed machine. So one or both of these problems may occur, depending on the number of decompositions.
The hierarchy created by successive machine decompositions gives rise to a tree of refined events. Only the leaf event nodes are used during code generation. In the current code generator there is no algorithm to navigate this tree automatically. Therefore the composed machine points to the incorrect machines and events.


We must manually add the information to the composed machines to address these two problems.
We must manually change the composed machine to address this problem.


The temporary solution for composed machines:
* Modify the lowest level decomposed machine, HCtrl_M1_cmp, to ''include'' the implementation level machines (task names ending in *Impl). To do this,
* Modify the lowest level decomposed machine, HCtrl_M1_cmp, to ''include'' the implementation level machines (task names ending in *Impl). To do this,
* open the composed machine editor. Open the INCLUDES edit feature.
* open the composed machine editor. Open the INCLUDES edit feature.
Line 75: Line 78:
  Alter_Heater_Status in Envir1Impl: action becomes hss := FALSE
  Alter_Heater_Status in Envir1Impl: action becomes hss := FALSE
  INITIALISATION in Heater_Monitor_TaskImpl: becomes shs := FALSE
  INITIALISATION in Heater_Monitor_TaskImpl: becomes shs := FALSE
We also need to add a typing flag to an invariant. We need to add it in only one place, and this is where an invariant is used type a variable, in the Heating Controller machine. The flag is used to guide the translator to the typing invariant. This is because there may be more than one invariant involving that particular variable. They may also be added to guards where parameters are typed in guards, and the parameters are referred to in more than one guard.
* Go to the ''Heater_Monitor_TaskImpl typing_shs'' invariant.
* Add the typing flag, by right-clicking on the invariant and selecting typing from the menu.


=== Adding Tasking Event-B ===
=== Adding Tasking Event-B ===
We will now work with the last of the tutorial projects, ''Heating_ControllerTutorial2_Partial2''.


*Setting Context attributes.
*Setting Context attributes.
**Open the project ''Heating_ControllerTutorial2_Partial2''.  
**Using the project ''Heating_ControllerTutorial2_Partial1''.  
**Open the context, select the Tasking Context drop-down box, and select Tasking, as the type for the context.  
**Open the context, select the Tasking Context drop-down box, and select Tasking, as the type for the context.  
This will ensure that code generation related static checks are performed. Select the 'Typing' option for Axioms ''axm3'' and ''axm4'', i.e. ''Min'' and ''Max'' are Typing axioms. The other axioms should be set to non-typing.


Each Machine should be completed as follows.
Each Machine should be completed as follows.
==== The Temp_Ctrl_TaskImpl Machine ====
==== The Temp_Ctrl_TaskImpl Machine ====
During this part of the tutorial we will cut and paste from ''Heating_ControllerTutorial2_Completed'' model when, specifying the task bodies, to save typing.
During this part of the tutorial we will cut and paste from ''Heating_ControllerTutorial2_Completed'' model when, specifying the task bodies, to save typing. We use the 'Event-B Machine Editor' to edit the Tasking Event-B.
 
*Set the Task Type to ''Auto Task''
**Open The Tasking section of the Event-B editor.
**Click on + to add a new Machine Type.
**Ensure Auto Task is selected in the Drop-down box.
 
''Auto Tasks'' are tasks that will be declared and defined in the ''Main'' procedure of the implementation. The effect of this is that the ''Auto Tasks'' are created when the program first loads, and then activated (made ready to run) before the ''Main'' procedure body runs.  


*In the Tasking section of the Event-B editor, click on + to add a new Machine Type construct.
**The machine type defaults to ''Auto Task''.
**Click on the right-arrow symbol by ''Machine Type''.
**Add a new Task Type section by clicking on its green + symbol.
**A Machine Type element is added. The task type defaults to ''Periodic''
**Set a period of 250 milliseconds.
*'''Add a new TaskBody'''.
*'''Add a new TaskBody'''.
**Open Task Type (click on |> right arrow) in the Machine Type element
**Add a new Task Body section by clicking on its green + symbol.
**Set the task type to ''Periodic'',
**Set a period of 250 milliseconds.
**Add a new Task Body section.
**Copy and paste the task body from ''Heating_ControllerTutorial2_Completed/Temp_Ctrl_TaskImpl''
**Copy and paste the task body from ''Heating_ControllerTutorial2_Completed/Temp_Ctrl_TaskImpl''
**Save the model and rectify any problems highlighted.
**Save the model. Ignore the highlighted typing errors, since these annotations will be added by the code generator during pre-processing.
<!-- We now look at the sensing event ''Sense_Temperatures'' event in ''Temp_Ctrl_TaskImpl''. In order to assist with the translation we add the following annotation:
 
*'''Add a Sensed Event Annotation'''.
** Right-click on the ''Sense_Temperatures'' Event node.
** Select ''New Child/Implementation'' from the menu.
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Sensing''.
 
We now look at the actuating event ''Display_Current_Temperatures'' event in ''Temp_Ctrl_TaskImpl''. In order to assist with the translation we add the following annotation:


*'''Add an Actuating Event Annotation'''.
''Auto Tasks'' are tasks that will be declared and defined in the ''Main'' procedure of the implementation. The effect of this is that the ''Auto Tasks'' are created when the program first loads, and then activated (made ready to run) before the ''Main'' procedure body runs.
** Right-click on the ''Display_Current_Temperatures'' Event node.
** Select ''New Child/Implementation'' from the menu.
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Actuating''.
-->


==== The Shared Machine ====
==== The Shared Machine ====
Line 131: Line 110:


==== The Environ Machine ====
==== The Environ Machine ====
In the prepared machine we identify the ''Envir1Impl'' as an ''Environ Machine'',
We identify the ''Envir1Impl'' as an ''Environ Machine'',


*Open the Tasking Section in the Machine Editor
*Click on +,  in the Machine Editor, to add a to add a Tasking Section.
* Click on + to add a machine type.
*A Machine Type element is created.
*Select ''Environ Machine'' in the drop down box.  
*Select ''Environ Machine'' in the drop down box.  


In the implementation, ''Environ Tasks'' are declared and defined in the ''Main'' procedure . The ''Envir1Impl'' machine models a task that simulates the environment, and can be used to generate simulation code. For deployment in a non-simulated environment the environ machine's generated code can be ignored. To specify the Environment task's behaviour we add edit the task body.
*In the Tasking section of the Event-B editor, click on + to add a new Machine Type construct.
 
**The machine type defaults to ''Auto Task'', change it to ''Environ''.
*'''Add the Task Details'''.
**Click on the right-arrow symbol by ''Machine Type''.
**Open the Task Type section.
**Add a new Task Type section by clicking on its green + symbol.
**Set the task type to ''Periodic'',
**A Machine Type element is added. The task type defaults to ''Periodic''
**Set a period of 100 milliseconds.  
**Set a period of 100 milliseconds.  
**Add a new Task Body by clicking + in the Task Body section
*'''Add a new TaskBody'''.
**Add a new Task Body section by clicking on its green + symbol.
**Copy and paste the task body from ''Heating_ControllerTutorial2_Completed/Envir1Impl''
**Copy and paste the task body from ''Heating_ControllerTutorial2_Completed/Envir1Impl''
**Save the model.
**Save the model.
**Resolve any problems that are highlighted.
 
In the implementation, ''Environ Tasks'' are declared and defined in the ''Main'' procedure . The ''Envir1Impl'' machine models a task that simulates the environment, and can be used to generate simulation code. For deployment in a non-simulated environment the environ machine's generated code can be ignored. To specify the Environment task's behaviour we add edit the task body.


When saving, the task body text is sent to the parser. If parsing is successful then a builder adds the structure to the underlying EMF tree. If parsing fails then an error panel displays the source of the error.
When saving, the task body text is sent to the parser. If parsing is successful then a builder adds the structure to the underlying EMF tree. If parsing fails then an error panel displays the source of the error.
<!-- The final step is to complete the ''Sense_Temperatures'' event. The event, being a kind of synchronization, synchronizes with the ''Sense_Temperatures'' event in the ''Temp_Ctrl_Task'' tasking machine. We annotate the model with sensing and actuating implementation types.
*'''Add a Sensed Event Annotation'''.
** Right-click on the ''Sense_Temperatures'' Event node.
** Select ''New Child/Implementation'' from the menu.
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Sensing''.
*'''Add an Actuating Event Annotation'''.
** Right-click on the ''Display_Current_Temperatures'' Event node.
** Select ''New Child/Implementation'' from the menu.
** Go to the Implementation properties view and set the ''Implementation Type'' property to ''Actuating''.
-->
=== A Summary of Steps ===
For a Tasking Machine definition:
# Select the Tasking Machine type (Auto etc).
# Set the task type (Periodic etc.).
# Set the task priority.
# Specify the task body.
<!-- # For sensing/actuating events, add the Event Type. -->
For a Shared Machine definition:
# Add the ''SharedMachine'' Machine type.
For an Environ Machine definition:
# Make the type an Environ Machine type.
# Set the task type Periodic; a shorter period than the shortest task period is best for simulation.
# Set the task priority.
# Specify the task body, it will contain a simulation of changes in the environment.
# For each sensing/actuating event, add the Event Type.


== Invoking the Translators ==
== Invoking the Translators ==


* To generate Ada code,
* To generate code,
** Right-Click on the composed machine, or any tasking machine in the development, select ''Code Generation/Translate Event-B to Ada''.
** Right-Click on the composed machine, or any tasking machine in the development, select ''Code Generation/Translate Event-B to xx'' where ''xx'' is the chosen language.
** Open the generated ''code'' directory in the project to view the source files. A refresh will be necessary to make the code visible. The .gpr file has been provided for AdaCore GPS users.
** Open the generated ''code'' directory in the project to view the source files.  


* To create the Event-B model of the implementation,
* To create the Event-B model of the implementation,

Latest revision as of 12:41, 2 September 2013

For more information contact Andy Edmunds - University of Southampton - mailto:ae2@ecs.soton.ac.uk

<< I AM UPDATING THIS PAGE >>

Tasking Event-B Tutorial Overview

This tutorial follows on from the abstract development described here.

This code generation tutorial extends the Heating Controller tutorial example, and makes use of example projects from the download site. The code generation stage produces Java code, and also an Event-B model. It is a model of the implementation, and contains flow control variables that model the flow of execution through the task body. The Java code is produced from an intermediate model that is not visible to the user. The Common Language model (CLM), is generated from the Tasking Event-B by a translation tool. Java (and other implementations) may be generated from the CLM. An overview of Tasking Event-B can be found here.

In the example so far, the Heating Controller has been refined to the point where we wish to add implementation constructs. The Event-B language is not expressive enough to fully describe the implementation. Tasking Event-B facilitates this final step to implementation, by extending Event-B with the necessary constructs. Event-B machines modelling tasks, shared objects and the environment are identified, and extended with the appropriate implementation details.

The example/tutorial projects are are available from Git or clone this.

Heating_ControllerTutorial2_Completed An example project with an environment simulation. The environment variables are monitored and controlled using subroutine calls. The project contains a complete Tasking Development with generated Event-B and Java code.
Heating_ControllerTutorial2_Partial1 A project with the final decomposition completed, ready to begin Tasking Event-B Development.
Heating_ControllerTutorial2_Partial2 A partially completed tasking specification for the continuation of the tutorial.
TheoriesForCG Contains the mathematical language translations; encoded as rules in a theory plug-in rule-base.

Using the Tasking Extension

The steps needed to generate code from an Event-B model, in this tutorial, are as follows,

Download and Copy the Theories

The translations of the Event-B mathematical language to the target language constructs are specified as rules in the theory plug-in. Example rule files are included for the example, and are available in MathExtension from the Git repository, or clone this. After checking out the theories, they must be un-deployed, then re-deployed, ensuring that the builder creates all of the appropriate files. Right-Click on the theory file and select deploy to do this. If you already have a MathExtensions folder then it should be renamed else the import will be prevented. Files from this folder can be copied and deployed in the new folder if necessary.

Adding the Implementation Level Refinement

The final decomposition generates the machines that are required for code generation. However, it is not possible to edit the machines since they are machine generated, and therefore this is prohibited. In order to be able to modify the models we will refine the generated machines. This is where we begin with the Heating_ControllerTutorial2_Partial1 project (Where the pre-processing steps, described below, have been performed already). To refine the machines we can use the automatic refinement feature, but this presents us with two problems that are dealt with in the pre-processing steps.

Pre-processing

The pre-processing step, described here, is done automatically by the tool. The description is provided to assist with understanding the changes that occur to a model, during the code generation phase.

  • The Code Generator requires a flattened, and annotated, version of each machine; all of the Event-B elements are made available in the implementation level machine.
'Flattening' the Implementation Machines
  • Events are changed to be not extended.
  • Abstract invariants are copied to the implementation level machine.
Annotations are provided automatically
  • Typing annotations are added to typing invariants and axioms where they type variables and constants.
  • Parameter directions (in or out) are inferred from the events.

Manually correcting the Composed Machine

The hierarchy created by successive machine decompositions gives rise to a tree of refined events. Only the leaf event nodes are used during code generation. In the current code generator there is no algorithm to navigate this tree automatically. Therefore the composed machine points to the incorrect machines and events.

We must manually change the composed machine to address this problem.

  • Modify the lowest level decomposed machine, HCtrl_M1_cmp, to include the implementation level machines (task names ending in *Impl). To do this,
  • open the composed machine editor. Open the INCLUDES edit feature.
  • Select the second drop-down box and find the *Impl version of each machine.
  • Save the composed machine.
  • Now add missing synchronizations to the composed machine. Add the Envir1Impl to the includes of HCtrl_M1_cmp.
  • Each composed event in the task, that synchronizes with the Environ machine, must have the remote event synchronization added manually. This can only be done by inspection of each composed event. We need to update Sense_Temperatures, Display_Current_Temperature, Actuate_OverHeat_Alram, Actuate_Heat_Source, Sense_Heater_Status, Actuate_NoHeat_Alarm, Sense_PressIncrease_Target_Temperature, Sense_PressDecrease_Target_Temperature, Display_Target_Temperature. One by one, expand the events in the composed events section of the composed machine editor; add a new event in the combines events section, select Envir1Impl and add the synchronizing event from the list-box to the right.

Removing Non-deterministic Constructs

It is also at this stage that any remaining non-deterministic constructs should be removed by replacing them with deterministic constructs.

TIP: Non-deterministic constructs cause strange characters to appear in the source code. If you see strange characters in the generated code, check for non-deterministic constructs in the implementation level machines. 

Alter_Temperature_Sensor1 in Envir1Impl: action becomes ts1 := ts1 + 1
Alter_Temperature_Sensor2 in Envir1Impl: action becomes ts1 := ts1 + 1
Alter_Heater_Status in Envir1Impl: action becomes hss := FALSE
INITIALISATION in Heater_Monitor_TaskImpl: becomes shs := FALSE

Adding Tasking Event-B

  • Setting Context attributes.
    • Using the project Heating_ControllerTutorial2_Partial1.
    • Open the context, select the Tasking Context drop-down box, and select Tasking, as the type for the context.

Each Machine should be completed as follows.

The Temp_Ctrl_TaskImpl Machine

During this part of the tutorial we will cut and paste from Heating_ControllerTutorial2_Completed model when, specifying the task bodies, to save typing. We use the 'Event-B Machine Editor' to edit the Tasking Event-B.

  • In the Tasking section of the Event-B editor, click on + to add a new Machine Type construct.
    • The machine type defaults to Auto Task.
    • Click on the right-arrow symbol by Machine Type.
    • Add a new Task Type section by clicking on its green + symbol.
    • A Machine Type element is added. The task type defaults to Periodic
    • Set a period of 250 milliseconds.
  • Add a new TaskBody.
    • Add a new Task Body section by clicking on its green + symbol.
    • Copy and paste the task body from Heating_ControllerTutorial2_Completed/Temp_Ctrl_TaskImpl
    • Save the model. Ignore the highlighted typing errors, since these annotations will be added by the code generator during pre-processing.

Auto Tasks are tasks that will be declared and defined in the Main procedure of the implementation. The effect of this is that the Auto Tasks are created when the program first loads, and then activated (made ready to run) before the Main procedure body runs.

The Shared Machine

The next step is to identify the Shared_ObjectImpl machine as a Shared Machine.

  • Open the Tasking Section.
  • Add a Machine Type by clicking +.
  • Select Shared in the Machine Type drop Down box.

The Environ Machine

We identify the Envir1Impl as an Environ Machine,

  • Click on +, in the Machine Editor, to add a to add a Tasking Section.
  • A Machine Type element is created.
  • Select Environ Machine in the drop down box.
  • In the Tasking section of the Event-B editor, click on + to add a new Machine Type construct.
    • The machine type defaults to Auto Task, change it to Environ.
    • Click on the right-arrow symbol by Machine Type.
    • Add a new Task Type section by clicking on its green + symbol.
    • A Machine Type element is added. The task type defaults to Periodic
    • Set a period of 100 milliseconds.
  • Add a new TaskBody.
    • Add a new Task Body section by clicking on its green + symbol.
    • Copy and paste the task body from Heating_ControllerTutorial2_Completed/Envir1Impl
    • Save the model.

In the implementation, Environ Tasks are declared and defined in the Main procedure . The Envir1Impl machine models a task that simulates the environment, and can be used to generate simulation code. For deployment in a non-simulated environment the environ machine's generated code can be ignored. To specify the Environment task's behaviour we add edit the task body.

When saving, the task body text is sent to the parser. If parsing is successful then a builder adds the structure to the underlying EMF tree. If parsing fails then an error panel displays the source of the error.

Invoking the Translators

  • To generate code,
    • Right-Click on the composed machine, or any tasking machine in the development, select Code Generation/Translate Event-B to xx where xx is the chosen language.
    • Open the generated code directory in the project to view the source files.
  • To create the Event-B model of the implementation,
    • Right-Click on the composed machine, or any tasking machine in the development, select Code Generation/Translate Tasking Event-B to Event-B.
    • The Event-B model should be updated with the flow control variables. Users are not able to manually edit the generated elements. The additions can be removed using the menu option Code Generation/Remove Generated Event-B

Generated Code

Generated code will be visible in the code directory, in the Event-B project. However a refresh of the workspace is required. The directory is visible in the resource view; or alternatively, click on the view menu in the Event-B perspective, select customize view, and uncheck the all file and folders filter.

Retrieved from ‘https://wiki.event-b.org/index.php?title=Tasking_Event-B_Tutorial&oldid=10103’