Derivation of concurrent programs by stepwise scheduling of Event-B models

Abstract

Concurrent programs are often complex and they are not straightforward to develop and prove correct. Formal development methods based on refinement make it possible not only to derive programs gradually, but also to prove their correctness in a stepwise fashion. Event-B is a formal framework that has been shown useful for developing concurrent and distributed programs. In order to scale to large systems, models can be decomposed into sub-models that can be refined semi-independently and executed in parallel. In this paper, we show how to introduce explicit control flow for the concurrent sub-models in the form of event schedules. The purpose of these schedules is both to provide process-oriented specifications of the programs to complement the state-based approach in Event-B, as well as to facilitate more efficient implementation of the models. The schedules are introduced in a stepwise manner and should be designed to result in a correctness-preserving refinement step. In order to reduce the verification burden on the developers, we provide patterns for schedule introduction, together with their associated proof obligations. We demonstrate our method by applying it on the dining philosophers problem.

Correct‐by‐construction specification to verified code

“…Other deterministic orderings are also supported by our approach, but their verification cost differs. Other works that dedicated the scheduling issues in Event‐B are provided in Boström and Boström et al Regarding the generation of the scheduler, in our context, we work on safety critical systems where some choices are preferable (in the sense of safety) to others as they lead to a safe state. The description of the safe states of the system may be provided by the modeler at the Event‐B level and is then used during the generation of the scheduler to direct the generator to the safe states‐oriented scheduler rather than other schedulers.…”

“…Existing works have proposed partial solutions for the above challenges. Some works provided code generators for various programming languages but did not yet discuss the correctness of the generated code .…”

“…Some works provided code generators for various programming languages but did not yet discuss the correctness of the generated code . The correctness issue of the generated code has been partially addressed in the works, but none can completely guarantee the correctness of the generated code due to the above challenges. Detailed discussions about the related works are given in Section 2.…”

“…(3) Current Event-B method depends on the integer arithmetic. If the target system depends on the floating-point arithmetic (FPA), a verification method for the FPA design is needed to complement the Rodin platform.Existing works 10,11,17,18,24,25,30,34 have proposed partial solutions for the above challenges. Some works provided code generators for various programming languages but did not yet discuss the correctness of the generated code.…”

Kaisa Sere: In Memoriam

“…In this research, she also promoted different scheduling mechanisms for Action Systems. During her last years, she was involved in further developing the ideas of introducing explicit control flow also in the Event-B framework [BDSW12].…”