The B method and the B toolkit

This research work explores the trends in formal and agile software development methods. Software development has evolved, from the era of “code and fix” to methods categorized as “heavyweight” and “lightweight”. The heavyweight methods are championed by the waterfall method, while agile methods are considered the lead in lightweight methods of software development. Both methods have proven records of successes and failures. Bridging the divide between them and harmonizing their symbiotic properties has the synergy of creating beneficial and more robust methodology with complementary advantage which is termed ambidexterity. Ambidexterity allows for a high level approach of selecting a methodology on the basis of the problem requirements, and coordinates their independent processes complementarily without conflict. Keywords: Global Software Development, Agile Software Development, off Shoring, Near-shoring, Distribution

This paper presents a proof technique for proving refinements for general state-based models of concurrent systems that reduces proving forward simulations to thread-local, step-local proof obligations. The approach has been implemented in our theorem prover KIV, which translates imperative programs to a set of transition rules and generates proof obligations accordingly. Instances of this proof technique should also be applicable to systems specified with ASM rules, B events, or Z operations. To exemplify the proof methodology, we demonstrate it with two case studies. The first verifies linearizability of a lock-free implementation of concurrent hash sets by showing that it refines an abstract concurrent system with atomic operations. The second applies the proof technique to the verification of opacity of Transactional Mutex Locks (TML), a Software Transactional Memory algorithm. Compared to the standard approach of proving a forward simulation directly, both case studies show a significant reduction in proof effort.

The refinement calculus for logic programs is a framework for deriving logic programs from specifications. It is based on a wide-spectrum language that can express both specifications and code, and a refinement relation that models the notion of correct implementation. This thesis investigates extensions to the logic programming refinement calculus in the area of contextual refinement, with an emphasis on data refinement. To introduce contextual refinement we examine in detail the semantics of the wide-spectrum language. Refinement laws are developed that simplify the refinement process by handling context implicitly, rather than requiring the context to be explicitly propagated through the program. We use the contextual refinement framework to develop data refinement, where the type representation of a variable is replaced with another. This may be to replace a specification type with an implementation type, or to use a more efficient type. Such refinements take place on a procedure-by-procedure basis, in the context of a coupling invariant, which relates the two types. We then extend data refinement to module refinement, by considering groups of related procedures that share a common data type. By considering the context provided by programs that use a module, we may develop efficient implementations by changing the module's data type.

Algebraic proofs of consistency and completeness

Recently the action systems formalism for parallel and distributed systems has been extended with the procedure mechanism. This gives us a very general framework for describing different communication paradigms for action systems, e.g. remote procedure calls. Action systems come with a design methodology based on the refinement calculus. Data refinement is a powerful technique for refining action systems. In this paper we will develop a theory and proof rules for the refinement of action systems that communicate via remote procedures based on the data refinement approach. The proof rules we develop are compositional so that modular refinement of action systems is supported. As an .example we will especially study the atomicity refinement of actions. This is an important refinement strategy, as it potentially increases the degree of parallelism in an action system.

TLA + is a formal specification language that is based on ZF set theory and the Temporal Logic of Actions TLA. The TLA + proof system tlaps assists users in deductively verifying safety properties of TLA + specifications. tlaps is built around a proof manager, which interprets the TLA + proof language, generates corresponding proof obligations, and passes them to backend verifiers. In this paper we present a new backend for use with SMT solvers that supports elementary set theory, functions, arithmetic, tuples, and records. Type information required by the solvers is provided by a typing discipline for TLA + proof obligations, which helps us disambiguate the translation of expressions of (untyped) TLA + , while ensuring its soundness. Preliminary results show that the backend can help to significantly increase the degree of automation of certain interactive proofs.KeywordsFunction SymbolProof ObligationType InferenceInput LanguageType AssignmentThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This paper focuses on extensions of Abstract State Machines (ASMs) for the benefit of a refinement calculus in the area of data-intensive applications, in particular data warehouses and on-line analytical processing. The extensions lead to a typed version of ASMs and a more specific notion of strong data refinement, which incorporates the preservation of information content by means of schema dominance. Each typed ASM can be effectively translated into an equivalent ordinary one. Providing typed ASMs helps to exploit the existing logical formalisms used in data-intensive applications to define a ground model. Furthermore, strong data refinement helps to set up a refinement-based development method that uses provably correct standard refinement rules.

Formal methods for software development receive much attention in research centres, but are rarely used in industry for the development of (large) software systems. One of the reasons is that little is known about the integration of formal methods in the software process, and the exact role of formal methods in the software life-cycle is still unclear. In this paper, a detailed examination is made of the application of, and the benefits resulting from, a generally applicable formal method (VDM) in a standard model for software development (DoD-STD-2167A). Currently, there is no general agreement on how formal methods should be used, but in order to analyse the use of formal methods in the software process, a clear view of such use is essential. Therefore, we show what is meant by ‘using a formal method’. The different activities of DoD-STD-2167A are analysed with regard to their suitability for applying VDM and the benefits that may result from applying VDM for that activity. Based on this analysis, an overall view on the usage of formal methods in the software process is formulated.

Well-Definedness is important for many formal methods. In B and Event-B it ensures that certain kinds of errors (e.g., division by 0) cannot appear and that proof rules based on two-valued logic are sound. For validation tools such as ProB, well-definedness is important for constraint solving. B and Event-B establish well-definedness by generating dedicated proof obligations (POs). Unfortunately, the standard provers are not always very good at discharging them. In this paper, we present a new integrated technique to simultaneously generate and discharge well-definedness POs. The implementation contains a dedicated rule-based prover written in Prolog supporting B, Event-B and extensions thereof for data validation. We show that the generation and discharging is significantly faster than existing implementations in rodin and Atelier-B and that a large number of POs are automatically discharged. The POs are fine-grained enough to provide precise source code feedback, and allow inspection of problematic POs within various editors.

This paper introduces a new approach of using automata to model behaviour of objects. Automata allow to design a software model on the abstract level of states and transitions. We make precise the meaning of states and transitions in the context of objects and types. This formal semantics serves as a link between informal and formal software development methods. Second, we give a formal, but nevertheless intuitive definition of automata specialization which not only provides a way for reuse of type definitions in subtypes, but also shows how to incrementally design types through refinement. Third we define the notion of a role an object takes when viewed from the environment. Then we can give a formal, but short proof that our definitions satisfy the subtype requirement, that means that an object of the subtype plays the roles of its Supertypes.

Clean room software engineering is a formal software development method that can strictly engineer software development and eliminate defects before they can cause serious harm. The clean room software engineering model has its own advantages and disadvantages in use. To use it in traditional software engineering, it is necessary to clarify the relationship between it and traditional software engineering methods and practices. Based on the technology and principles of the clean room software process, this paper gets the advantages and disadvantages of the clean room. Corresponding the traditional method-based software process to the key technology of the clean room, making the traditional management-based software engineering method and the tailored clean room compatible, and the software engineering practice of the clean room software process is compared with the traditional software engineering practice. To discuss the clean room and traditional software engineering, in order to expand the use of clean room methods, improve the clean room software process, and improve the quality of software.

This paper defines a new denotational semantics for the language of Communicating Sequential Processes (CSP). The semantics lies between the existing traces and failures models of CSP, providing a treatment of non-determinism in terms of singleton failures . Although the semantics does not represent a congruence upon the full language, it is adequate for sequential tests of non-deterministic processes. This semantics corresponds exactly to a commonly used notion of data refinement in Z and Object-Z: an abstract data type is refined when the corresponding process is refined in terms of singleton failures. The semantics is used to explore the relationship between data refinement and process refinement, and to derive a rule for data refinement that is both sound and complete.

Dynamic mixins are a modular means of developing features or roles that can be composed with objects at run-time. However, naive use of this construct can cause unexpected behaviour due to interference caused by the presence of an object's previously bound mixins. This work proposes a method for developing mixins that can be bound to base objects such that the mixins do not interfere with each other; the method achieves compositionally through a coupling invariant and by syntactically restricting mixins. The refinement calculus is used for formalization, as it treats implementations and specifications uniformly. The formalization relies on a new notion of mixin refinement.

The benefits of formal methods in software development are well recognised and well documented. Design recovery involves analysing the source code and recovers the desired design elements based on design recovery specification. One way to ensure the correctness of the recovered design is to use formal methods in the process. This paper describes an approach to apply formal methods to design recovery. We present the Concept Mapping Language (CML), which is largely based on an adapted form of first-order languages with an object-oriented syntactical extension, to specify the recovery specification that guides the design recovery process. CML enforces consistency in the specification through formal notations and syntax, and the formal specification ensures correctness in the recovered design through formally correct specification. The result is a simple and reliable approach to apply formal methods to design recovery that will ensure correctness in the specification and therefore the recovered design.

An integration of traditional verification techniques and formal specifications in software engineering is presented. Advocates of such techniques claim that mathematical formalisms allow them to produce quality, verifiably correct, or at least highly dependable software and that the testing and maintenance phases are shortened. Critics on the other hand maintain that software formalisms are hard to master, tedious to use and not well suited for the fast turnaround times demanded by industry. In this paper some popular formalisms and the advantages of using these during the early phases of the software development life cycle are presented. Employing the Floyd-Hoare verification principles during the formal specification phase facilitates reasoning about the properties of a specification. Some observations that may help to alleviate the formal-methods controversy are established and a number of formal methods successes is presented. Possible conditions for an increased acceptance of formalisms in oftware development are discussed.