Creating Sequential Programs from Event-B Models

Boström, Pontus

doi:10.1007/978-3-642-16265-7_7

Cited by 11 publications

(22 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other deterministic orderings are also supported by our approach, but their verification cost differs. Other works that dedicated the scheduling issues in Event‐B are provided in Boström and Boström et al Regarding the generation of the scheduler, in our context, we work on safety critical systems where some choices are preferable (in the sense of safety) to others as they lead to a safe state. The description of the safe states of the system may be provided by the modeler at the Event‐B level and is then used during the generation of the scheduler to direct the generator to the safe states‐oriented scheduler rather than other schedulers.…”

Section: Translation From Event‐b To Hllmentioning

confidence: 99%

“…Existing works have proposed partial solutions for the above challenges. Some works provided code generators for various programming languages but did not yet discuss the correctness of the generated code .…”

Section: Introductionmentioning

confidence: 99%

“…Some works provided code generators for various programming languages but did not yet discuss the correctness of the generated code . The correctness issue of the generated code has been partially addressed in the works, but none can completely guarantee the correctness of the generated code due to the above challenges. Detailed discussions about the related works are given in Section 2.…”

Section: Introductionmentioning

confidence: 99%

“…(3) Current Event-B method depends on the integer arithmetic. If the target system depends on the floating-point arithmetic (FPA), a verification method for the FPA design is needed to complement the Rodin platform.Existing works 10,11,17,18,24,25,30,34 have proposed partial solutions for the above challenges. Some works provided code generators for various programming languages but did not yet discuss the correctness of the generated code.…”

mentioning

confidence: 99%

See 3 more Smart Citations

Correct‐by‐construction specification to verified code

Dieumegard

Jenn

et al. 2018

J Software Evolu Process

View full text Add to dashboard Cite

Event‐B is a formal notation and method for the systems development. The key feature of this method is to produce correct‐by‐construction system designs. Once the correct design is established, the remaining work is to generate or implement correct code from the design. Two main problems remain in the process from the correct‐by‐construction design to the correct software. First, the Event‐B design is “quasi‐correct” due to some technical limitations. For instance, it is still difficult to prove the liveness properties by the Rodin platform; it is not possible to construct the Event‐B design with floating‐point arithmetic, and sometimes, the Event‐B model is incomplete and must rely on the third‐party libraries. Therefore, a method is needed to complement these modeling and proof gaps. Secondly, proving the correctness of an automatic code generator is very difficult; therefore, a method is needed to guarantee the correctness of the produced code without proving the code generator. In this article, we address the above 2 problems by introducing an intermediate formal language called High‐Level Language (HLL) between the Event‐B models and the C code. The Event‐B model is translated to HLL with an additional schedule configuration, where Event‐B invariants and system invariants (here, deadlock‐freeness and liveness properties) are proved using a SAT‐based model checker called S3. This proof guarantees the correctness of the HLL model with respect to the Event‐B model. The C code is then automatically generated from the HLL model for most functions and is manually implemented for the third‐party ones according to the function contracts defined in Event‐B. The correctness of the generated C code is guaranteed using the equivalence proof, and the correctness of the implemented C code is guaranteed using the conformance proof. Through the article, we use a traffic light controller to illustrate the proposed method; then, we apply the method to an automatic protection function of a 3‐wheeled robot to evaluate its feasibility.

show abstract

Section: Translation From Event‐b To Hllmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

Correct‐by‐construction specification to verified code

Dieumegard

Jenn

et al. 2018

J Software Evolu Process

View full text Add to dashboard Cite

show abstract

“…In addition, the OS design may contain sequential actions, which are straightforwardly described in Promela but not in Event-B because actions in Event-B are performed in parallel. In this case, one usually has to introduce more elaborate control structures to derive efficient sequential behaviors from event-based specifications in Event-B [1], [5]. Consequently, deriving the highly optimized behaviors of the design from the highly abstracted specification in Event-B results a lot of proof obligations.…”

Section: Introductionmentioning

confidence: 99%

A Framework for Verifying the Conformance of Design to Its Formal Specifications

Chiba

Yatake

et al. 2015

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYVerification of a design with respect to its requirement specification is important to prevent errors before constructing an actual implementation. The existing works focus on verifications where the specifications are described using temporal logics or using the same languages as that used to describe the designs. Our work considers cases where the specifications and the designs are described using different languages. To verify such cases, we propose a framework to check if a design conforms to its specification based on their simulation relation. Specifically, we define the semantics of the specifications and the designs commonly as labelled transition systems (LTSs). We appreciate LTSs since they could interpret information about the system and actions that the system may perform as well as the effect of these actions. Then, we check whether a design conforms to its specification based on the simulation relation of their LTS. In this paper, we present our framework for the verification of reactive systems, and we present the case where the specifications and the designs are described in Event-B and Promela/Spin, respectively. We also present two case studies with the results of several experiments to illustrate the applicability of our framework on practical systems.

show abstract