Event-B at Work: Some Lessons Learnt from an Application to a Robot Anti-collision Function

Dieumegard, Arnaud; Ge, Ning; Jenn, Éric

doi:10.1007/978-3-319-57288-8_24

Cited by 6 publications

(11 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…TwIRTee's architecture, software, and hardware components are representative of a significant family of aeronautical, spatial, and automotive systems. It has been used to evaluate new methods and tools in the domain of hardware/software codesign, virtual integration, and application of formal methods for the development of equipment . In this paper, we give a brief description of the function and some statistics about the model and the verification effort.…”

Section: The Case Study: Automatic Rover Protectionmentioning

confidence: 99%

“…To take the appropriate action, the ARP exploit the following information: the map, the position of all other rovers transmitted by a centralized supervision station (❺), and its own position. More details about the refinement and design can be found in our work …”

Section: The Case Study: Automatic Rover Protectionmentioning

confidence: 99%

“…It has been used to evaluate new methods and tools in the domain of hardware/software codesign, virtual integration, 14 and application of formal methods for the development of equipment. 13,16,[19][20][21] In this paper, we give a brief description of the function and some statistics about the model and the verification effort.…”

Section: The Case Study: Automatic Rover Protectionmentioning

confidence: 99%

“…More details about the refinement and design can be found in our work. 16 For this paper, in order to evaluate the feasibility of our approach, we rely on a specific model of the ARP function where some elements have been simplified. We thus only consider specification elements such as rover position, speed, deceleration, and others as being discrete values (no use of Real or Floating Point data).…”

Section: The Case Study: Automatic Rover Protectionmentioning

confidence: 99%

See 3 more Smart Citations

Correct‐by‐construction specification to verified code

Dieumegard

Jenn

et al. 2018

J Software Evolu Process

Self Cite

View full text Add to dashboard Cite

Event‐B is a formal notation and method for the systems development. The key feature of this method is to produce correct‐by‐construction system designs. Once the correct design is established, the remaining work is to generate or implement correct code from the design. Two main problems remain in the process from the correct‐by‐construction design to the correct software. First, the Event‐B design is “quasi‐correct” due to some technical limitations. For instance, it is still difficult to prove the liveness properties by the Rodin platform; it is not possible to construct the Event‐B design with floating‐point arithmetic, and sometimes, the Event‐B model is incomplete and must rely on the third‐party libraries. Therefore, a method is needed to complement these modeling and proof gaps. Secondly, proving the correctness of an automatic code generator is very difficult; therefore, a method is needed to guarantee the correctness of the produced code without proving the code generator. In this article, we address the above 2 problems by introducing an intermediate formal language called High‐Level Language (HLL) between the Event‐B models and the C code. The Event‐B model is translated to HLL with an additional schedule configuration, where Event‐B invariants and system invariants (here, deadlock‐freeness and liveness properties) are proved using a SAT‐based model checker called S3. This proof guarantees the correctness of the HLL model with respect to the Event‐B model. The C code is then automatically generated from the HLL model for most functions and is manually implemented for the third‐party ones according to the function contracts defined in Event‐B. The correctness of the generated C code is guaranteed using the equivalence proof, and the correctness of the implemented C code is guaranteed using the conformance proof. Through the article, we use a traffic light controller to illustrate the proposed method; then, we apply the method to an automatic protection function of a 3‐wheeled robot to evaluate its feasibility.

show abstract

Section: The Case Study: Automatic Rover Protectionmentioning

confidence: 99%

Section: The Case Study: Automatic Rover Protectionmentioning

confidence: 99%

Section: The Case Study: Automatic Rover Protectionmentioning

confidence: 99%

Section: The Case Study: Automatic Rover Protectionmentioning

confidence: 99%

See 2 more Smart Citations

Correct‐by‐construction specification to verified code

Dieumegard

Jenn

et al. 2018

J Software Evolu Process

Self Cite

View full text Add to dashboard Cite

show abstract

“…It is used to experiment and evaluate various methods and tools in the domain of hardware/-software co-design, virtual integration of equipments [16], and formal verification [14,26,25,21,24]. TwIRTee's architecture and its software and hardware components are representative of typical aeronautical, spatial and automotive systems [17].…”

Section: The Context Of Use Casementioning

confidence: 99%

Integrated formal verification of safety-critical software

Jenn

Breton³

et al. 2017

Int J Softw Tools Technol Transfer

Self Cite

View full text Add to dashboard Cite

OATAO is an open access repository that collects the work of Toulouse researchers and makes it freely available over the web where possible. Abstract This work presents a formal verification process based on the Systerel Smart Solver (S3) toolset for the development of safety-critical embedded software. In order to guarantee the correctness of the implementation of a set of textual requirements, the process integrates different verification techniques (inductive proof, bounded model checking, test case generation and equivalence proof) to handle different types of properties at their best capacities. It is aimed at the verification of properties at system, design, and code levels. To handle the floating-point arithmetic (FPA) in both the design and the code, an FPA library is designed and implemented in S3. This work is illustrated on an Automatic Rover Protection (ARP) system implemented on-board a robot. Focus is placed on the verification of safety and functional properties and on the equivalence proof between the design model and the generated code.

show abstract