Two methods have been identified for Event-B model decomposition: shared variable and shared event. The purpose of this paper is to introduce the two approaches and the respective tool support in the Rodin platform. Besides alleviating the complexity for large systems and respective proofs, decomposition allows team development in parallel over the same model which is very attractive in the industrial environment

Butler, Michael

Hoang, T. Son

Pascal, Carine

Silva, Renato

English

Southampton (e-Prints Soton)

Decomposition Tool for Event-B?Renato Silva1, Carine Pascal2, T.S. Hoang3, and Michael Butler11 University of Southampton2 Systerel3 ETH Zurich{ras07r,mjb}@ecs.soton.ac.ukcarine.pascal@systerel.frhtson@inf.ethz.chAbstract. Two methods have been identied for Event-B model de-composition: shared variable and shared event. The purpose of this pa-per is to introduce the two approaches and the respective tool supportin the Rodin platform. Besides alleviating the complexity for large sys-tems and respective proofs, decomposition allows team development inparallel over the same model which is very attractive in the industrialenvironment.Key words: Formal Methods, Event-B, Decomposition, Shared Event,Shared Variable, Team Development, Rodin1 IntroductionThe \top-down" style of development used in Event-B [1] allows the introductionof new events and data-renement of variables during renement steps. A con-sequence of this development style is an increasing complexity of the renementprocess when dealing with many events and state variables. The main purposeof the model decomposition is precisely to address such diculty by cuttinga large model into smaller components. Two methods have been identied forthe Event-B decomposition: shared variable [2,3] and shared event [4,5]. Wepropose a plug-in developed in the Rodin platform [6] that supports these twodecomposition methods for Event-B. Because decomposition is monotonic [4],the generated sub-components can be further rened independently. Thereforewe can introduce team developments: several developers share parts of the samemodel and work independently in parallel. Moreover the decomposition also par-tition the proof obligations which are expected to be easier to be discharged inthe sub-components.This document is structured as follows: Sect. 2 denes the two styles of Event-B decomposition. Section 3 introduces in more details the tool support. Finallyin Sect. 4 we draw conclusions about this work.? Part of this research was carried out within the European Commission ICT project214158 DEPLOY (http://www.deploy-project.eu)2 Decomposition Tool for Event-B2 Decomposition StylesConsider Fig. 1 where machine M has events e1 to e4 and variables v1 to v3.The solid lines connect variables used by the events. In Fig. 1(a), machine Mis decomposed using the shared variable approach where events are partitionedinto sub-components: events e1 and e2 are allocated to machine M1 and e3and e4 are allocated to machine M2. Consequently, variable v1 belongs to M1and v3 belongs to M2 (private variables). Variable v2 is shared between e2 ande3 so it is shared by both sub-components (shared variable). Besides the initialevent allocation we introduce additional external events simulating how sharedvariables are handled in the other sub-component (e3 ext is added to M1 ande2 ext to M2). Sub-components can be rened independently but the sharedvariable must be present and cannot be data-rened.Figure 1(b) depicts machine M again decomposed but using the shared eventapproach where variables are partitioned to sub-components: v1 is placed in M1and v2, v3 are placed in M2. Events using variables allocated to dierent sub-components (e2 shares v1 and v2) must be split. The part corresponding to eachvariable (e2 1 and e2 2) is used to create partial versions of the non-decomposedevent. The sub-components can be rened independently without constraints.(a) (b)Fig.1. Shared Variable decomposition on the left and shared event decomposition onthe rightShared event approach is suitable for message-passing distributed systemswhile shared variable approach is suitable for design of parallel algorithms [7].3 Decomposition ToolThe decomposition tool is implemented as a plug-in in the Rodin platform. Thedecomposition style used depends on the inputted system and on the end-user'sDecomposition Tool for Event-B 3preference. The decomposition originates sub-components according to the con-guration (events/variables partition). That conguration is stored persistentlyin a composed machine [8] for future reuse or editing as seen in Fig. 2. "Replay-ing" the decomposition might require additional storing mechanisms. We intendto address this issue in the future.(a)COMPOSED MACHINE CMTYPE SHARED EVENTREFINES MnINCLUDESNPQEVENTSevt 1 REFINES Mn.evt 1Combines Events N.evt 1 k P.evt 1...evt n REFINES Mn.evt nCombines Events P.evt n k Q.evt nEND(b)Fig.2. Decomposition tool diagram for a machine Mn and composed machine CMusing the shared event approachThe input for the decomposition is a machine of a given Rodin project se-lected by the end-user. After the selection of the style and decomposition con-guration, the tool generates the sub-components automatically. Summarisingthese are the steps to be followed in order to decompose (we decompose Mn inFig. 2(a)):1. End-user selects a machine Mn to decompose.2. End-user denes sub-components to be generated: N, P, Q ....3. End-user selects the decomposition style to use:Shared Variable: end-user selects the events to be allocated to sub-components.The tool automatically decomposes the rest of the model according tothe event partition (shared/private variables, external events).Shared Event: the end-user selects the variables to be allocated for eachsub-component. The rest is done automatically.4. The end-user can opt to decompose the seen contexts into the sub-componentssimilarly to the machine decomposition.5. Sub-components are fullled according to the decomposition conguration.6. The decomposition conguration is stored as a composed machine.7. Sub-components N, P, Q ...can be further rened.The conguration is performed through the Rodin's Graphical User Interfaceas it seems more suitable for the end-user.4 Decomposition Tool for Event-B3.1 LimitationsFor the shared variable decomposition the partition of events is always possiblesince the possible restriction (variables) can be shared between sub-components.On the other hand, that decomposition might be less signicant despite beingpossible: a further renement may be more complex and not benet the develop-ment. The decomposition should have a nal goal: a misleading decompositionmay harm a system instead of helping. For the shared event decomposition, thepartition of variables is not always possible for all developments. Predicates usingvariables allocated to dierent sub-components need user's interaction in orderto simplify the separation since such operation cannot be done automatically.The tool automatically ags situations requiring user's intervention.4 ConclusionThis paper presents the decomposition of Event-B models and tool support inthe Rodin platform. Decomposition can advantageously be used to decrease thecomplexity and increase the modularity of large systems, especially after severalrenements. Main benets are the distribution of proof obligations over the sub-components which are expected to be easier to be discharged and the furtherrenement of independent sub-components in parallel introducing team develop-ment of a model which is attractive for the industry. Shared variable and sharedevent decomposition are supported in the same tool: the former seems suitablewhen designing concurrent programs while the latter seems particularly suitablefor message-passing distributed programs. However the end-user chooses a de-composition style depending on specic systems and on its modelling preferences.The decomposition conguration is stored persistently for replaying/editing al-though further study is still required for this matter. A visualisation view fordecomposition seems intuitive and we intend to explore it using GMF [9].References1. M etayer, C., Abrial, J.R., Voisin, L.: Event-B Language. Technical report, Deliver-able 3.2, EU Project IST-511599 - RODIN (May 2005)2. Abrial, J.R., Hallerstede, S.: Renement, Decomposition, and Instantiation of Dis-crete Models: Application to Event-B. Fundam. Inf. 77(1-2) (2007) 1{283. Abrial, J.R.: Event Model Decomposition. Technical report, ETH Zurich (2009(Unpublished))4. Butler, M.: Synchronisation-based Decomposition for Event-B. In: RODIN Deliv-erable D19 Intermediate report on methodology. (2006)5. Butler, M.: Decomposition Structures for Event-B. Integrated Formal MethodsiFM2009 (February 2009)6. Rodin: RODIN project Homepage. http://rodin.cs.ncl.ac.uk (September 2008)7. Butler, M.: An Approach to the Design of Distributed Systems with B AMN. In:Proc. 10th Int. Conf. of Z Users: The Z Formal Specication Notation (ZUM), LNCS1212. (1997) 221{2418. Silva, R., Butler, M.: Parallel Composition Using Event-B. http://wiki.event-b.org/index.php/Parallel_Composition_using_Event-B (July 2009)9. GMF: Graphical Modeling Framework. http://www.eclipse.org/modeling/gmf/(September 2008)

Decomposition Tool for Event-B

Abstract

Similar works

Full text

Available Versions

Southampton (e-Prints Soton)