Fast and Effective Well-Definedness Checking

Event-B is a formal modelling method which is claimed to be suitable for diverse modelling domains, such as reactive systems and sequential program development. This claim hinges on the fact that any particular model has an appropriate semantics. In Event-B this semantics is provided implicitly by proof obligations associated with a model. There is no fixed semantics though. In this article we argue that this approach is beneficial to modelling because we can use similar proof obligations across a variety of modelling domains. By way of two examples we show how similar proof obligations are linked to different semantics. A small set of proof obligations is thus suitable for a whole range of modelling problems in diverse modelling domains.KeywordsAbstract EventSequential ProgramProof ObligationAbstract MachineConcrete EventThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The ProB disprover uses constraint solving to find counter-examples for B proof obligations. As the ProB kernel is now capable of determining whether a search was exhaustive, one can also use the disprover as a prover. In this paper, we explain how ProB has been embedded as a prover into Rodin and Atelier B. Furthermore, we compare ProB with the standard automatic provers and SMT solvers used in Rodin. We demonstrate that constraint solving in general and ProB in particular are able to deal with classes of proof obligations that are not easily discharged by other provers and solvers. As benchmarks we use medium sized specifications such as landing gear systems, a CAN bus specification and a railway system. We also present a new method to check proof obligations for inconsistencies, which has helped uncover various issues in existing (sometimes fully proven) models.

Combining decision procedures by (model-)equality propagation

The paper describes the CARE toolset for interactive development of verified programs from formal specifications. The software engineer begins by giving a characterization of the application domain in the form of a mathematical theory. CARE tools are then used to progressively design a program by sketching out the program structure and gradually filling in the details. At any stage the correctness of the partial design can be checked by using one of the CARE tools to generate proof obligations. Another tool gives access to pre-proven parameterised design templates which encapsulate useful programming knowledge. When the design is complete, a third CARE tool is used to automatically synthesize a source code program which-if all the proof obligations can be discharged-is guaranteed to meet its formal specification. The knowledge base of CARE can be extended by users in a soundness-preserving manner to include reusable domain theories, library routines, design templates and proof tactics. The CARE toolset includes a fully automatic resolution-based theorem prover which will discharge many of the simpler proof obligations, and a general-purpose interactive theorem prover for the rest.

The B Method is a full spectrum formal software development method that covers the software process from specification to implementation. The method uses state machines, defined using logic and set theory with a notation similar to that of Z, that export operations. The method supports a notion of refinement and implementation, which is based on the notion of refinement in the refinement calculus with the exception that there is no distinction between procedural and data refinement. The B Toolkit is a configuration tool that manages developments under the B Method, generating proof obligations and supporting tools for the discharge of those proof obligations. There is also support for the generation of documentation, and for the browsing of developments.

Formally verifying functional and security properties of a large-scale production operating system is highly desirable. However, it is challenging as such OSes are often written in multiple source languages that have no formal semantics - a prerequisite for formal reasoning. To avoid expensive formalization of the semantics of multiple high-level source languages, we present a lightweight and rigorous verification toolchain that verifies OS code at the binary level, targeting ARM machines. To reason about ARM instructions, we first translate the ARM Specification Language that describes the semantics of the ARMv8 ISA into the PVS7 theorem prover and verify the translation. We leverage the radare2 reverse engineering tool to decode ARM binaries into PVS7 and verify the translation. Our translation verification methodology is a lightweight formal validation technique that generates large-scale instruction emulation test lemmas whose proof obligations are automatically discharged. To demonstrate our verification methodology, we apply the technique on two OSes: Google's Zircon and a subset of Linux. We extract a set of 370 functions from these OSes, translate them into PVS7, and verify the correctness of the translation by automatically discharging hundreds of thousands of proof obligations and tests. This took 27.5 person-months to develop.

Using induction and rewriting to verify and complete parameterized specifications

Distributing the Workload in a Lazy Theorem-Prover

This paper introduces a new technique for the verification of interactive systems. It first presents the use of a model oriented formal method for specifying interactive systems, i.e. the B method. Then, it suggests formally based solutions which allow solving difficulties that are inherent to interactive systems specification, like reachability, observability or reliability. Our claim is that this model-oriented technique that uses proof obligations can be used together with model checking techniques, where automatic proofs of properties can be performed.KeywordsModel oriented notationB methodspecification refinementinteraction properties verificationspecification of interactive system.

Cloud environments are being increasingly used for the deployment and execution of complex applications and particularly component-based ones. They are expected to provide elasticity, among other characteristics, in order to allow a deployed application to rapidly change the amount of its allocated resources in order to meet the variation in demand while ensuring a given Quality of Service (QoS). However, establishing a correct elastic component-based application is not guaranteed in Cloud. Indeed, applying elasticity mechanisms should preserve functional properties and improve non-functional properties related to QoS, performance and resource consumption. In this paper, we propose an approach for the verification and deployment of elastic component-based applications. Our approach is based on the Event-B formal method. In fact, we formally model the component artifacts using Event-B and we define the Event-B events that model the elasticity mechanisms (scaling up and down) for component-based applications. Furthermore, we formally verify that our approach preserves the semantics of the component-based applications by using the proof obligations and the ProB animator. Once the elastic component-based applications are validated, they can be deployed in a Cloud environment using an elastic deployment framework which we have developed.

Object-oriented methods create software artifacts through the application of a large number or rules. Rules are typically formulated in two-valued logic. There are a number of problems on how rules are defined and applied in current methods. First, two-valued logic can capture completely neither method developers' intuition nor software engineers' perception or artifact types. Second, artifacts are generally produced based only on a subset of relevant properties. Third, two-valued logic does not modal explicitly contextual factors, which can affect the validity of methodological rules. Fourth, no means is supplied to deal with multiple design alternatives and to measure the quality of each alternative during the development process. High loss of information, early elimination of artifacts and process iterations are some of possible fastidious effects. To reduce these problems, this paper proposes fuzzy logic-based methodological rules. Thanks to its ability to cope with uncertainty and imprecision, and to compute with real-world linguistic expressions, fuzzy logic appears to be a natural solution for improving current methods.

: This manual describes the use and implementation of a multi-valued Prolog called Mprolog. It is modeled after Prolog which uses horn clauses to store its collection of knowledge. Prolog is restricted by the fact that it is a two-valued logic and therefore can only examine information which is completely true or false. This is reasonable as long as the knowledge you want to represent does not contain uncertainties. If it does then you are not able to use the powerful programming language Prolog. What is needed is a multi-valued logic which allows information to be stored with uncertainties, and that is what Mprolog is all about. Mprolog is used to represent a new type of multi-value logic called minimal bounded fuzzy logic. Mprolog was written in Common Lisp on the Symbolics 3620. This chapter deals with how to run Mprolog and not the actual implementation of Mprolog. The implementation of Mprolog is described in Chapter 2 and the listing of source code is in Chapter 3.

This report documents the program and the outcomes of Dagstuhl Seminar 19062 Bringing CP, SAT and SMT together: Next Challenges in Constraint Solving, whose main goals were to bring together leading researchers in the different subfields of automated reasoning and constraint solving, foster greater communication between these communities and exchange ideas about new research directions. Constraint solving is at the heart of several key technologies, including program analysis, testing, formal methods, compilers, security analysis, optimization, and AI. During the last two decades, constraint solving has been highly successful and transformative: on the one hand, SAT/SMT solvers have seen a significant performance improvement with a concomitant impact on software engineering, formal methods and security; on the other hand, CP solvers have also seen a dramatic performance improvement, with deep impact in AI and optimization. These successes bring new applications together with new challenges, not yet met by any current technology. The seminar brought together researchers from SAT, SMT and CP along with application researchers in order to foster cross-fertilization of ideas, deepen interactions, identify the best ways to serve the application fields and in turn help improve the solvers for specific domains.

Written Numeral Transcoding in Patients with Alzheimer's Disease

State-based formal specifications benefit from data structuring mechanisms, which collate associated properties and efficiently declare complex types. For example, ‘record’ data structures, similar to those used in programming languages, can be built into the concrete syntax of a language as an enhancement over flat data relationships. While this is relatively simple to achieve for a single-level specification, it becomes significantly more involved when the specification language allows for progressive refinement of the data supporting the specification. Individual fields may be added to create sub-records within a refinement and replaced to create refined records during a refinement step. The impact on the ability to verify invariant and refinement proof obligations must be considered. Here we describe a record structuring syntax that includes notions of extension and inheritance that can be used in a refinement-based formal method. We illustrate the approach using extensions to the Event-B formal method.