Verification of Liveness Properties in Distributed Systems

2010 18th IEEE International Requirements Engineering Conference

2010

International audienceWell specified requirements are crucial for good software design and domain engineering helps better understanding and specification of requirements. Safety critical domains, such as transportation, exhibit interesting features, such as high levels of non-determinism, complex interactions, stringent safety properties, multifaceted timing attributes, etc. The formal representation of these features is a challenging task. This paper presents our experience of modeling land transportation domain in the formal framework of Event-B. We explore the possibility of using Event-B as a domain engineering tool. We discuss the problems posed by the introduction of time and how we tackle it. We design a technique based on animation to validate domain models

Section: E Safety and Liveness Propertiesmentioning

confidence: 89%

Domain Engineering with Event-B: Some Lessons We Learned

2010 18th IEEE International Requirements Engineering Conference

2010

“…However, as proposed by [45], in order to prove the liveness of our model, we can prove that our system is non-divergent and enabledness preserving. By non-divergent we mean that newly introduced events do not take control forever and by enabledness preserving we mean that if an event is enabled at abstract level it is enabled at concrete level as well.…”

Section: Livenessmentioning

confidence: 91%

Utilizing Event-B for domain engineering: a critical analysis

2011

Requirements Eng

This paper presents our experience of modeling land transportation domain in the formal framework of Event-B. Well-specified requirements are crucial for good software design; they depend on the understanding of the domain. Thus, domain engineering becomes an essential activity. The possibility to have a formal model of a domain, consistent with the use of formal methods for developing critical software working within it, is an important issue. Safety-critical domains, like transportation, exhibit interesting features, such as high levels of non-determinism, complex interactions, stringent safety properties, multifaceted timing attributes, etc. The formal representation of these features is a challenging task. We explore the possibility of utilizing Event-B as a domain engineering tool. We discuss the problems we faced during this exercise and how we tackled them. Special attention is devoted to the issue of the validation of the model, in particular with a technique based on the animation of specifications. Event-B is mature enough to be an effective tool to model domains except in some areas, temporal properties mainly, where more work is still needed.

“…It is to be noted that the usual techniques to guarantee deadlock-freeness and non-divergence in Event-B specifications [11] are not useful in our case. Introducing the wait event (wait's action is SKIP) is essential for ensuring nocollision.…”

Section: Express Temporal Propertiesmentioning

confidence: 96%

Guidelines for Formal Domain Modeling in Event-B

2011 IEEE 13th International Symposium on High-Assurance Systems Engineering

2011

Abstract-In this paper, we explore the possibility to use Event-B as a formal domain modeling tool. We identify the areas where domain modelers can struggle and present some guidelines to avoid these pitfalls. We mainly address three questions about domain modeling: what to specify, how to refine, and how to verify. We discuss the strategy to express domain assumptions, protocols, time, and temporal properties. We also analyze the refinement and proof system of Event-B in this realm. We advocate small incremental steps and alternative refinement mechanisms, such as "observation levels." We find animation a very helpful activity to complement the verification process.