Mapping Event-B Machines into Eiffel Programming Language

Critical systems are present in our daily life and affect many aspects providing essential support to several human activities; they are employed in several application domains, providing support to economic activities, transportation, communication, health-care. Such systems must meet strict non-functional requirements, including dependability requirements, and should be able to cope with competitive market needs. Their criticality implies the necessity to meet several requirements, often dictated by international standards, whose fulfillment must be demonstrated in order to achieve necessary certifications. Quantitative evaluations are hence needed to assess and demonstrate compliance with target requirements, since design phases of the lifecycle. For this purpose modeling approaches have been investigated during the years; their aim is to have a of the overall system which allows to assess and demonstrate these properties. It is commonly known that the adoption of formal models in industry, although if strongly recommended when not mandatory, is slowed down by difficulties dictated both by the complexity of the models (which reflects the complexity of the systems) and by the need to have skilled staff in the usage of formal languages. For this reason, also if the academic research trends have focused on complex modeling approaches and techniques, formal models are not so used in industries: in particular only combinatorial models are widely adopted, thanks to their intuitive representation. The great simplifications introduced by combinatorial models lead to approximated results, hence system designers do not trust in them. In the last years the need of a model engineering is noticed: there is the necessity to define appropriate methodologies and processes to support development activities of complex models, aiming at improving the quality/cost ratio. In this way three main research trends have been introduced: formal models generation, multiformalism, and compositional approaches. This thesis aims at defining a methodology for quantitative analysis of critical system that can integrate Model-Based evaluations, conducted by using formal models, with Model-Driven Engineering (MDE) paradigms, taking advantage of the actual research trends. More in detail, according to such approach, critical systems properties can be assessed starting from high level models expressed in proper languages (usually called Domain Specific Modeling Languages - DSMLs), and defining automatic transformation chains, able to generate formal models. The methodology is implementable into cost-effective processes in order to reduce time-to-market specifically during verification stages of critical system development lifecycles. Such objective will be achieved by both improving usability and re-usability of typical Model-Driven artifacts. The adoption of this methodology for railway system dependability analysis may lead to an estimated costs reduction of approximately 30%. The usage of a high-level central language significantly decreases also the training time of new analysts, as they only need to learn the DSML usage (properly developed for the application domain). This thesis defines also two high-level modeling languages: the first, CIP_VAM, has been defined to vulnerability aspects of physical infrastructures, while the second, DAM-Rail, allows the dependability modeling in railway domain. Another important contribution of this thesis is given in the definition of new methods and formal operators: in detail a reference architecture for performability and Quality of Service evaluation is defined, as well as the formal concept of Model Template is introduced (to enable reuse). At last two techniques which deals with scalability are addressed: stub and reduced models. Even if the focus is on quantitative evaluation, the proposed methodology is useful also for the complete design (based on centralized informations), hence it is possible to extend it for automatic generation of documents and, more generally, of all those artifacts which support system development. The proposed approach has been applied with different goals to case studies coming from three different domains: railway systems, conferencing systems, and sensor network. These systems have different and complementary properties in terms of number of involved components, scalability, etc. Produced models are described, and obtained results are shown and commented.

The chapter presents a description of a novel modelling language called Alvis defined for the design of concurrent especially real-time systems. Alvis combines the advantages of formal methods and practical modelling languages. Based on CCS and XCCS process algebras, Alvis utilizes flexible graphical modelling of interconnections among agents and a high level programming language used for the description of agents behaviour. Each agent in a model can use rule-based systems to support its decisions. A small set of language statements and graphical concepts make Alvis easy to learn and use. The possibility of a formal model verification, makes Alvis a formal modelling language. Alvis modelling environment creates in parallel a model of the considered system and a labelled transition system (LTS graph) that is its formal representation. The LTS graph can be formally verified with the CADP toolbox. A survey of main Alvis features from practical point of view, is given in the chapter.

The variety and complexity of processes required to be controlled in modern manufacturing places heavy demands on PLCs. To meet these demands PLC manufacturers are producing increasingly more powerful PLCs which require more complex programming languages. These complex programming languages result in longer specialised training and familiarisation times. To overcome these problems, the PLC programming language standard IEC 1131-3 was created. The standard details the workings of languages which provide PLC users with a set of programming languages based around familiar PLC concepts, but with language constructs similar to those of current generation PC programming languages. This paper describes the work done in a TCS partnership between Elite Control Systems Ltd. and Napier University to examine the viability of using structured methods for developing PLC software. Object oriented methods have established themselves as the future of software development for high level language users. We discuss how the object modelling technique of Rumbaugh et al. (1991) [one of the principal object oriented methods used in the UK] can be adapted for the creation of PLC software, and how the resulting practices differ from traditional PLC software development. We then describe the improvements in terms of software quality, development time, development costs, and maintainability that we have observed by adopting these techniques.

The objective of this comprehensive review study was to compile a state-of-the-art understanding of the resilience of the transportation system due to natural and man-made disasters. This study identified resilience measurement parameters that can be used to formulate resilience quantification and improvement strategies of a transportation system. Reviewed articles were classified and summarized from two perspectives: (i) modeling based on the mode of transportation; and (ii) modeling based on the mathematical technique used to quantify resilience. One of the unique contributions of this review article is that it compiled the key resilience indices that were analyzed to quantify resilience. This review revealed that the majority of the scholarly articles on the topic of transportation system resilience published since 2006, were focused on the resilience of the roadway-based transportation system, and vulnerability was one of the most explored resilience indices in evaluating transportation system resilience. Several future research directions were identified considering the implications of emerging transportation technologies (e.g., connected and automated vehicle technology). The complex interdependency among critical infrastructure systems such as power, transportation, and communication system, as well as the cybersecurity issues in the advanced intelligent transportation system, will be vital in the resilience analysis of future transportation systems.

Reusability is an important software engineering concept actively advocated for the last forty years. While reusability has been addressed for systems implemented using the same programming language, it does not usually handle interoperability with different programming languages. This paper presents a solution for the reuse of Java code within Eiffel programs based on a source-to-source translation from Java to Eiffel. The paper focuses on the critical aspects of the translation and illustrates them by formal means. The translation is implemented in the freely available tool J2Eif; it provides Eiffel replacements for the components of the Java runtime environment, including Java Native Interface services and reflection mechanisms. Our experiments demonstrate the practical usability of the translation scheme and its implementation, and record the performance slow-down compared to custom-made Eiffel applications: automatic translations of java.util data structures, java.io services, and SWT applications can be re-used as Eiffel programs, with the same functionalities as their original Java implementations.

Proceedings of the 13th international conference on Modularity

In this paper, we identify a set of factors that may be used to forecast software productivity and software development time. Software productivity was measured in function points per person hours, and software development time was measured in number of elapsed days. Using field data on over 130 field software projects from various industries, we empirically test the impact of team size, integrated computer aided software engineering (ICASE) tools, software development type, software development platform, and programming language type on the software development productivity and development time. Our results indicate that team size, software development type, software development platform, and programming language type significantly impact software development productivity. However, only team size significantly impacts software development time. Our results indicate that effective management of software development teams, and using different management strategies for different software development type environments may improve software development productivity.

CSP# is a formal modeling language that emphasizes the design of communication in concurrent systems. PAT framework provides a model checking environment for the simulation and verification of CSP# models. Although the desired properties can be formally verified at the design level, it is not always straightforward to ensure the correctness of the system's implementation conforms to the behaviors of the formal design model. To avoid human error and enhance productivity, it would be beneficial to have a tool support to automatically generate the executable programs from their corresponding formal models. In this paper, we propose such a solution for translating verified CSP# models into C# programs in the PAT framework. We encoded the CSP# operators in a C# library-PAT.Runtime, where the event synchronization is based on the Monitor class in C#. The precondition and choice layers are built on top of the CSP event synchronization to support language-specific features. We further developed a code generation tool to automatically transform CSP# models into multi-threaded C# programs. We proved that the generated C# program and original CSP# model are equivalent on the trace semantics. This equivalence guarantees that the verified properties of the CSP# models are preserved in the generated C# programs. Furthermore, based on the existing implementation of choice operator, we improved the synchronization mechanism by pruning the unnecessary communications among the choice operators. The experiment results showed that the improved mechanism notably outperforms the standard JCSP library.

Often the most effective diagrams are those which are very simple. However there is a strong tendency, particularly prevalent in visual formal modelling and specification languages, to take a diagrammatic language which at core is very simple, and then add many extensions and features to make it more expressive - often making it so expressive that the diagrams produced in the language are no longer readable; or at least, the diagrams are no longer obviously a more effective form of representation than a text-based one. Both the design of effective visual formal modelling and specification languages, and the effective formalisation of (the semantics of) such visual languages requires the unification of results from visual language theory, cognitive science, empirical psychology and graphic design. Integrating results from such diverse fields is a non-trivial task, which may be approached through a decomposition of the study of issues of effectiveness in diagrammatic languages according to analogous understandings of (written and spoken) natural languages.

The situation of telecommunications systems is rapidly evolving towards a state characterized by the presence of a multitude of services integrated in a single network structure. In order to ease their integration, it is important to provide an unambiguous description of the organization, of the functionality, and of the relationships existing among services. Since it is not possible to completely foresee the situation of services in the future, the description should be modular, so that the task of adding new services to an existing environment is simplified. Formal description techniques are languages designed to handle such descriptions. Their goal is to produce correct and unambiguous specifications, understanding and modeling the system and the domain within which it operates. Their input is a set of required statements and a conceptual overview of the system. Their output is a formal representation that captures the functional behavior. On the other hand, the throughput of physical networks is constantly growing, reaching the order of Gbit/s. In the meantime, services needing high throughput, like multimedia conferencing systems are being designed, creating a need for flexible, high performance communication systems. An important feature of new high speed services is their increased need for guarantees. Therefore, the use of powerful performance modeling techniques becomes of prime importance. Their goal is to obtain some notion of how the system will perform under a given set of conditions. Performance evaluation theorists have long been using system specifications to make a heuristic model of the system and then an analysis of the model. When system specifications exist, the question arises whether a more direct path to performance analysis can be found. Our scope is to provide a methodology that fully and consistently integrates formal specification and performance evaluation. A problem is that many of the bottlenecks and impediments to smooth data flow have to do with implementation issues not directly dealt within the system specification itself. Therefore, prior to generating a performance model, the formal specification should be enhanced with the relevant non-functional information. It is essential to assure a smooth specification of the non-functional information. Thus, it is necessary to consistently add this information to the formal specification. Besides, the extended formal method should focus on conserving the semantics of the original one, and on providing a coherent extension of the semantics and syntax for the new concepts. Since all relevant required information is integrated within the formal extended representation, we provide a mapping technique that translates the extended formal representation into a performance modeling conserving the properties of the formal model. In parallel to the development of a performance model, the formal model can be validated and verified, and their implementation can be tested for conformance towards the original formal model. Finally, the performance modelling is implemented in a programming language, and then simulated. The results from simulation can be reused as inputs for the optimization of the formal specification (functional optimization) or the extended formal model (design optimization). To sum up, the goal of this work is to: Define extensions to current formal methods that allow to enhance the formal specification with performance modeling related information. Develop a method to translate the extended formal specification into a performance modeling. Develop rules and guidelines to automatically implement the performance modeling for the purpose of a performance evaluation (we use the commercial tool Opnet). Develop a consistent and coherent methodology for the integration of performance modeling and formal specification.

Distributed algorithms are present in our daily life and we depend on the correct functioning of complex distributed computing systems as, for instance, communication protocols for establishing sessions between a smartphone and a bank account or synchronisation and management of shared resources among competing processes. Generally, the design and the implementation of distributed algorithms are still error prone and it is mainly due to the relationship between the theory of distributed computing and practical techniques for designing and verifying the correctness of reliable distributed systems. Formal proofs of distributed algorithms are long, hard and tedious and the gap between the real algorithm and its formal proof is very important. In this talk, we consider the correct-by-construction approach based on the refinement of state-based models, which are progressively transformed, in order to obtain a state-based model that is translated into a distributed algorithm.The stepwise development of algorithms has been first initiated in the seminal works of Dijkstra [15], Back [7] or Morgan [23]. Next, UNITY [14] has proposed a rich framework for designing distributed algorithms combining a simple temporal logic for expressing required properties and a simple language for expressing actions modifying state variables under fairness assumption. TLA/TLA + [18] proposes a general modelling language based on a temporal ogic of actions combined with a set-theoretical modelling language for data and is extended by a specific algorithmic language namely PlusCAL, which is translated into TLA + and which is closer to the classical way to express a distributed algorithm. Finally, Event-B [2,12] is a modelling language which can describe state-based models and required safety properties. The main objective is to provide a technique for incremental and proof-based development of reactive systems. It integrates set-theoretical notations and a first-order predicate calculus, models called machines; it includes the concept of refinement expressing the simulation of machine by another one. An Event-B machine models a reactive system i.e. a system driven by its environment and reacting to its stimuli. An important property of these machines is that its events preserve the invariant properties defining a set of reachable states. The Event-B method has been developed from the classical B method [1] and it offers a general framework for developing the correct-by-construction systems by using an incremental approach for designing the models by refinement. Refinement [7,15] is a relationship relating two models such that one model is refining or simulating the other one. When an abstract model is refined by a concrete model, it means that the concrete model simulates the abstract model and that any safety property of the abstract model is also a safety property of the concrete model. In particular, the concrete model preserves the invariant properties of the abstract model. Event-B aims to express models of systems characterized by its invariant and by a list of safety properties. However, we can consider liveness properties as in UNITY [14] or TLA + [18,17] but in a restricted way.In our talk, we will summarize results related to proof-based patterns in Event-B (see for instance http://rimel.loria.fr) and ongoing works on translations of Event-B models into (distributed) algorithms. Proof-based patterns help for using refinement and for developing models from a very abstract one. The strategy for refining is a very crucial activity, when using Event-B, and the problem is to choose the abstract models that will be refined into implementable state-based models (see http://eb2all.loria.fr). We focus on the design of dustributed algorithms. For instance, the leader election protocol [3] is the kick-off case study which has led to questions on the use of Event-B for developing correct distributed algorithms: introduction of time constraints [13], probabilistic Event-B [16]. Moreover, the local computation model [25] (see http://visidia.labri.fr) has been integrated to the refinement-based approach. More recently, our joint work [21] leads to a general plugin for producing sequential algorithms from Event-B models and implement the call-as-event paradigm [19]. More recently, we extend the call-as-event paradigm by the service-as-event paradigm [22,6,4,5] and we take into account the design of distributed algorithms. Finally, we will compare the classical method [24] for verifying distributed programs and the refinement-based method that we have used in many case studies [11]. These results are used for lectures in school of cmputing engineering and master programmes and we will give some feedbacks from these experiences. Case studies [9,8,20] play a fundamental role for helping us to discover new strategies, namely proof-based patterns, for developing distributed algorithms.

One of the key factors for automation systems in the domains smart grids, digital factories and modern process systems are the permanently shift of their requirements. Thus, software has to be evolve over time. This issue has been addressed by different solutions for evolving automation software. Though, they have their specific benefits, but lacks on deficiencies like a specific (non-standard) programming model, specific programming languages and a very narrow focus of a specific automation domain. In contrast to this a novel approach will be discussed to provide a more flexible and quite general solution, a common middleware, to reconfigure automation software dynamically with minimal downtime. A middleware to integrate different programming languages, container systems, frameworks, libraries, control applications and drivers as well.

We describe ongoing work on building an environment to support reasoning in proof assistants that represent formal systems using higher-order abstract syntax (HOAS). We use a simple and general specification language whose syntax supports HOAS. Using this language, we can encode the syntax and inference rules of a variety of formal systems, such as programming languages and logics. We describe our tool, implemented in OCaml, which parses this syntax, and translates it to a Coq library that includes definitions and hints for aiding automated proof in the Hybrid system. Hybrid itself is implemented in Coq, and designed specifically to reason about such formal systems. Given an input specification, the library that is automatically generated by our tool imports the general Hybrid library and adds definitions and hints for aiding automated proof in Hybrid about the specific programming language or logic defined in the specification. This work is part of a larger project to compare reasoning in systems supporting HOAS. Our current work focuses on Hybrid, Abella, Twelf, and Beluga, and the specification language is designed to be general enough to allow the automatic generation of libraries for all of these systems from a single specification.

This paper presents a formal development approach for designing interactive applications using a correct-by-construction approach. In this work, we propose a refinement strategy using model-view-controller (MVC) to structure and design Event-B formal models of the interactive application. The proposed MVC-based refinement strategy facilitates the development of an abstract model and a series of refined models by introducing the possible modes, controller’s behaviour and visual components of the interactive application while preserving the required interaction-related safety properties. To demonstrate the effectiveness, scalability, reliability and feasibility of our approach, we use a small example (from automotive domain) and real-life industrial case studies (from aviation). The entire development is realized in Event-B and the associated Rodin tool is used to analyse and verify the correctness of the formalized model. Finally, the developed Event-B models are used to generate source code using EB2ALL tool for going from the specification to the implementation of the interactive application.

Checking of models built using a graphically based formal modelling language