From Event-B Models to Dafny Code Contracts

Abstract

Abstract. The constructive approach to software correctness aims at formal modelling and verification of the structure and behaviour of a system in different levels of abstraction. In contrast, the analytical approach to software verification focuses on code level correctness and its verification. Therefore it would seem that the constructive and analytical approaches should complement each other well. To demonstrate this idea we present a case for linking two existing verification methods, Event-B (constructive) and Dafny (analytical). This approach combines the power of Event-B abstraction and its stepwise refinement with the verification capabilities of Dafny. We presented a small case study to demonstrate this approach and outline of the rules for transforming Event-B events to Dafny contracts. Finally, a tool for automatic generation of Dafny contracts from Event-B formal models is presented.

Verifiable Code Generation from Scheduled Event-B Models

“…In our previous work [7], we introduced another approach for generating Dafny code contracts from Event-B models. The proposed approach generates Dafny method pre-and post-conditions from a group of atomic Event-B events in a way that any implementation that satisfies the generated pre-and postconditions is considered to be a correct implementation of the Event-B abstract model.…”

Verifying Cross-Layer Interactions Through Formal Model-Based Assertion Generation

“…We have developed a proof-of-concept tool to automate the generation of C++ assertions from Event-B formal models. The tool, illustrated in Figure 2, is an extension of our existing contract generation tool [7] and is implemented as a Rodin plug-in. The assertion generation tool translates an Event-B event to a C++ function where the function implements an assertion.…”

Formalising the Hybrid ERTMS Level 3 specification in iUML-B and Event-B

“…These existential quantifications can be seen as the specification of other procedures, so if there is a procedure that satisfies this existential quantification then the quantification in the branch condition can be replaced by a procedure call to that procedure (which should return a boolean value) in code level. Using an approach similar to [28], it is possible to transform the guards to a set of pre-and post-conditions in a language which is supported by a static verifier and then implement and verify the aforementioned procedures there.…”