The ProB Animator and Model Checker for B


 Alannah Knight
 1 years ago
 Views:
Transcription
1 The ProB Animator and Model Checker for B A Tool Description Michael Leuschel and Michael Butler Department of Electronics and Computer Science University of Southampton Highfield, Southampton, SO17 1BJ, UK Abstract. We present ProB, an animation and model checking tool for the B method. ProB s animation facilities allow users to gain confidence in their specifications, and unlike the animator provided by the BToolkit, the user does not have to guess the right values for the operation arguments or choice variables. ProB contains a temporal and a statebased model checker, both of which can be used to detect various errors in B specifications. ProB enables users to uncover errors that are not easily discovered by existing tools. 1 Introduction The Bmethod, originally devised by J.R. Abrial [1], is a theory and methodology for formal development of computer systems. It is used by industries in a range of critical domains, most notably railway control. B is based on the notion of abstract machine and the notion of refinement. The variables of an abstract machine are typed using set theoretic constructs such as sets, relations and functions. Typically these are constructed from basic types such as integers and given types from the problem domain. The invariant of a machine is specified using predicate logic. Operations of a machine are specified as generalised substitutions, which allow deterministic and nondeterministic assignments to be specified. In B refinement, a machine may be refined by another machine in which the state is represented by data structures that are more concrete and/or in which operations are more deterministic and imperative. There are two main proof activities in B: consistency checking, which is used to show that the operations of a machine preserve the invariant, and refinement checking, which is used to show that one machine is a valid refinement of another. These activities are supported by industrial strength tools, such as AtelierB [8] and the Btoolkit [2]. A Btool generates a list of predicate logic proof obligations (POs). If each of these POs is proved, then the machine is consistent (or a correct refinement in the case of refinement checking). The Btools have an automatic prover and an interactive prover. Typically the more complex POs are not proved automatically and need to be proved interactively. The tools also provide automatic translation of low level B into executable code. The ProB tool presented here currently supports automated consistency checking of B machines via model checking [4] and constraintbased checking
2 [5]. For exhaustive model checking, the given sets must be restricted to small finite sets, and integer variables must be restricted to small numeric ranges. This allows the checking to traverse all the reachable states of the machine. ProB can also be used nonexhaustively to explore the state space and find potential problems. The user can set an upper bound on the number of states to be traversed or can interrupt the checking at any stage. ProB will generate and graphically display counterexamples when it discovers a violation of the invariant. ProB detects attempts to evaluate undefined expressions, such as the application of a partial function to an argument outside its domain. ProB can also be used as an animator of a B specification. So, the model checking facilities are still useful for infinite state machines, not as a verification tool, but as a sophisticated debugging and testing tool. 2 Brief Overview of the system The ProB system has been developed mainly in SICStus Prolog, with a graphical user interface implemented in Tcl/Tk. ProB uses the JBTools package developed by Tatibouet [9] and the Pillow package [3] to that effect. The JBTools package permits translation of abstract machine notation (AMN) [1] specifications into XML, while the Pillow package allows the conversion of XML files into a Prolog term representation. The ProB front end then postprocesses the general Prolog term tree representation of the Pillow library output into a more structured representation which will serve as the input to the interpreter. The ProB interpreter recurses through this structured representation of B machines and makes call to the ProB kernel, which implements support for the basic datatypes and operations of the Blanguage. The ProB kernel itself is written in SICStus Prolog with coroutining and constraints. The ProB animator and the two model checkers all make use of the ProB interpreter in various ways, as will be explained below. 3 ProB in Action The ProB animator was developed using the Tcl/Tk library of SICStus Prolog 3.10 and builds upon our earlier animator for CSP [7]. Our animator supports (backtrackable) stepbystep animation of the Bmachines. As can be seen in Figure 1 it presents the user with a description of the current state of the machine, the history that has led the user to reach the current state, and a list of the enabled operations, along with proper argument instantiations. Thus, unlike the animator provided by the BToolkit, the user does not have to guess the right values for the operation arguments. The same holds for choice variables in Any statements, the user does not have to find values which satisfy the Any condition. If the number of enabled operations becomes larger, one could envisage a better interface were not all options are immediately displayed to the user. The ProB animator also provides visualization of the state space that has been explored so far, and provides visual feedback on which states have been
3 Fig. 1. Animation of the ETravel Agency Case Study fully explored and which ones are still open. One can also find the shortest trace (given the state space explored so far) to the current state. ProB provides two ways of model checking: 1. a temporal model checking which tries to find a sequence of operations that, starting from an initial state, leads to a state which violates the invariant (or exhibits some other error, such as deadlocking or abort conditions); and 2. a statebased model checking, which finds a state of the machine that satisfies the invariant, but where we can apply a single operation to reach a state that violates the invariant (or again exhibits some other error). A counter example found by the temporal model checker thus consists of a sequence of operations (with properly instantiated operation arguments), as shown in Fig. 2. Volvo Vehicle Function We have tried our tool on a case study performed at Volvo on a typical vehicle function. The largest B machine had 15 variables, 550 lines of B specification, and 26 operations. This B specification was developed by Volvo as part of the European Commission IST Project PUSSEE (IST2000
4 session={},r_user={},c_user={}, initialise_machine u_state(u1,s0),u_hotel(u1,nohotel),u_rental(u1,nocarrent), u_request(u1,none) login(u1) u_state(u1,s1),u_hotel(u1,nohotel),u_rental(u1,nocarrent), u_request(u1,none) bookcar(u1) u_state(u1,s5),u_hotel(u1,nohotel),u_rental(u1,nocarrent), u_request(u1,bc) entercard(u1) c_rent(c1a,c1),c_rent(c2a,c2),u_card(u1,valid), u_state(u1,s6),u_hotel(u1,nohotel),u_rental(u1,nocarrent), u_request(u1,bc) response(u1) r_user={},session(sess1,u1),respons(u1,done), c_rent(c2a,c2),u_card(u1,valid),u_state(u1,s7), again(u1) c_rent(c2a,c2),u_card(u1,unknown),u_state(u1,s1), u_hotel(u1,nohotel),u_rental(u1,nocarrent),u_request(u1,none), bookcar(u1) c_rent(c2a,c2),u_card(u1,unknown),u_state(u1,s5), entercard(u1) c_rent(c2a,c2),u_card(u1,valid),u_state(u1,s6), response(u1) r_user={},session(sess1,u1),respons(u1,done), c_rent(c2a,c2),u_card(u1,valid),u_state(u1,s7),,c_user(c2a,u1) Fig. 2. Counter example for the ETravel Agency Example 30103). Animation using ProB worked very well and we have then used ProB to verify the Bmachine using the temporal model checker. ProB managed to explore the entire state space of the Bmachine in a few minutes, thereby proving the absence of invariant violations and deadlocks. However, ProB managed to identify a slight anomaly in the B machines behaviour: a crucial operation was only enabled very rarely. This shows that ProB might be used to identify problems that would otherwise only emerge at implementation time. ETravelAgency Within our ABCD 1 project we have developed various B models for a distributed online travel agency, through which users can make hotel and car rental bookings. The models were developed jointly with a Java/JSP 1 Automated validation of Business Critical systems using Componentbased Design, EPSRC grant GR/M91013.
5 implementation. The B model contains about 6 pages of B and, as can be seen in Fig. 1, has 11 variables of complicated type. ProB was very useful in the development of the specification, and was able to properly animate all of our models (see Fig. 1), and discover several problems with various versions of our system. 4 Uses of ProB Animation The animator is very easy to drive, and provides immediate visual feedback about one s specification. On the one hand, this is going to be very useful for people learning B and provides them a good feel for the B language. We plan to use ProB next academic year in our Critical Systems course. On the other hand, it also allows experienced users to more easily find problems with their specifications. Indeed, large specifications are very likely to contain errors, some of which can be identified early by animation. Model Checking The interactive proof process with AtelierB or the BToolkit can be quite time consuming. A typical development involves going through several levels of refinement to code generation before attempting any interactive proof [6]. This is to avoid the expense of reproving POs as the specification and refinements change in order to arrive at a satisfactory implementation. We see the use of ProB as a complement to interactive proof in that errors that result in counterexamples should be eliminated before attempting interactive proof. Further Information More information about the ProB tool can be obtained in the paper to appear in the main conference proceedings of FME 03 and at the web site: mal/systems/prob.html. References 1. J.R. Abrial. The BBook. Cambridge University Press, BCore (UK) Limited, Oxon, UK. BToolkit, Online manual., Available at 3. D. Cabeza and M. Hermenegildo. The PiLLoW Web Programming Library. The CLIP Group, School of Computer Science, Technical University of Madrid, Available at 4. E. M. Clarke, O. Grumberg, and D. Peled. Model Checking. MIT Press, D. Jackson. Alloy: A lightweight object modelling notation. ACM Transactions on Software Engineering and Methodology (TOSEM), 11: , J.L. Lanet. The use of B for Smart Card. In Forum on Design Languages (FDL02), September M. Leuschel. Design and implementation of the highlevel specification language CSP(LP) in Prolog. In I. V. Ramakrishnan, editor, Proceedings of PADL 01, LNCS 1990, pages SpringerVerlag, March Steria, AixenProvence, France. Atelier B, User and Reference Manuals, Available at uk.html. 9. Tatibouet, Bruno. The JBTools Package, Available at en.html.
Modelbased Testing of Automotive Systems
Modelbased Testing of Automotive Systems Eckard Bringmann, Andreas Krämer PikeTec GmbH, Germany Eckard.Bringmann@PikeTec.com, Andreas.Kraemer@PikeTec.com Abstract In recent years the development of automotive
More informationOn the Criteria To Be Used in Decomposing Systems into Modules
Programming Techniques R. Morris Editor On the Criteria To Be Used in Decomposing Systems into Modules D.L. Parnas CarnegieMellon University This paper discusses modularization as a mechanism for improving
More informationHYBRID systems involve a combination of discrete and continuous
UNPUBLISHED REPORT Formal Semantics and Analysis Methods for Simulink Stateflow Models A. Tiwari Abstract Embedded control systems typically comprise continuous control laws combined with discrete mode
More informationA RelationshipBased Approach to Model Integration
A RelationshipBased Approach to Model Integration Marsha Chechik Shiva Nejati Mehrdad Sabetzadeh Department of Computer Science University of Toronto, Toronto, ON, Canada chechik@cs.toronto.edu Simula
More informationWhat are requirements?
2004 Steve Easterbrook. DRAFT PLEASE DO NOT CIRCULATE page 1 C H A P T E R 2 What are requirements? The simple question what are requirements? turns out not to have a simple answer. In this chapter we
More informationData Abstraction and Hierarchy
Data Abstraction and Hierarchy * This research was supported by the NEC Professorship of Software Science and Engineering. Barbara Liskov Affiliation: MIT Laboratory for Computer Science Cambridge, MA,
More informationUse of Formal Methods at Amazon Web Services. Chris Newcombe, Tim Rath, Fan Zhang, Bogdan Munteanu, Marc Brooker, Michael Deardeuff Amazon.
Use of Formal Methods at Amazon Web Services Chris Newcombe, Tim Rath, Fan Zhang, Bogdan Munteanu, Marc Brooker, Michael Deardeuff Amazon.com 29 th September, 2014 Since 2011, engineers at Amazon Web Services
More informationThe Oracle Problem in Software Testing: A Survey
1 The Oracle Problem in Software Testing: A Survey Earl T. Barr, Mark Harman, Phil McMinn, Muzammil Shahbaz and Shin Yoo Abstract Testing involves examining the behaviour of a system in order to discover
More informationCompositional MayMust Program Analysis: Unleashing the Power of Alternation
Compositional MayMust Program Analysis: Unleashing the Power of Alternation Patrice Godefroid Microsoft Research Redmond pg@microsoft.com Aditya V. Nori Microsoft Research India adityan@microsoft.com
More informationHow to Make Ad Hoc Proof Automation Less Ad Hoc
How to Make Ad Hoc Proof Automation Less Ad Hoc Georges Gonthier Microsoft Research gonthier@microsoft.com Beta Ziliani MPISWS beta@mpisws.org Aleksandar Nanevski IMDEA Software Institute aleks.nanevski@imdea.org
More informationDoes Automated WhiteBox Test Generation Really Help Software Testers?
Does Automated WhiteBox Test Generation Really Help Software Testers? Gordon Fraser 1 Matt Staats 2 Phil McMinn 1 Andrea Arcuri 3 Frank Padberg 4 1 Department of 2 Division of Web Science 3 Simula Research
More informationGeneral Principles of Software Validation; Final Guidance for Industry and FDA Staff
General Principles of Software Validation; Final Guidance for Industry and FDA Staff Document issued on: January 11, 2002 This document supersedes the draft document, "General Principles of Software Validation,
More informationDirect Manipulation Interfaces
I b HUMANCOMPUTER INTERACTION, 1985, Volume 1, pp. 311338 4,T. Copyright 0 1985, Lawrence Erlbaum Associates, Inc. Direct Manipulation Interfaces Edwin L. Hutchins, James D. Hollan, and Donald A. Norman
More informationA brief overview of developing a conceptual data model as the first step in creating a relational database.
Data Modeling Windows Enterprise Support Database Services provides the following documentation about relational database design, the relational database model, and relational database software. Introduction
More informationA FEATURE COMPUTATION TREE MODEL TO SPECIFY REQUIREMENTS AND REUSE
A FEATURE COMPUTATION TREE MODEL TO SPECIFY REQUIREMENTS AND REUSE E.E.Roubtsova Open University of the Netherlands Postbus 2960, 6401DL, Heerlen, the Netherlands Ella.Roubtsova@ou.nl S.A.Roubtsov Technical
More informationThe Gödel Phenomena in Mathematics: A Modern View
Chapter 1 The Gödel Phenomena in Mathematics: A Modern View Avi Wigderson Herbert Maass Professor School of Mathematics Institute for Advanced Study Princeton, New Jersey, USA 1.1 Introduction What are
More informationA Compositional Approach to Performance Modelling. Jane Hillston
A Compositional Approach to Performance Modelling Jane Hillston i Preface This book is, in essence, the dissertation I submitted to the University of Edinburgh in early January 1994. My examiners, Peter
More informationA Formalization of Digital Forensics 1
Abstract A Formalization of Digital Forensics 1 Ryan Leigland University of Idaho Axel W. Krings 2 IDIMAG, France Forensic investigative procedures are used in the case of an intrusion into a networked
More informationMonads for functional programming
Monads for functional programming Philip Wadler, University of Glasgow Department of Computing Science, University of Glasgow, G12 8QQ, Scotland (wadler@dcs.glasgow.ac.uk) Abstract. The use of monads to
More informationLSCs: Breathing Life into Message Sequence Charts
Formal Methods in System Design, 19, 45 80, 2001 c 2001 Kluwer Academic Publishers. Manufactured in The Netherlands. LSCs: Breathing Life into Message Sequence Charts WERNER DAMM OFFIS, Oldenburg, Germany
More informationA Framework for Integrating NonFunctional Requirements into Conceptual Models
Requirements Eng (2001) 6:97 115 ß 2001 SpringerVerlag London Limited Requirements Engineering A Framework for Integrating NonFunctional Requirements into Conceptual Models Luiz Marcio Cysneiros, Julio
More informationCRISPDM 1.0. Stepbystep data mining guide
CRISPDM 1.0 Stepbystep data mining guide Pete Chapman (NCR), Julian Clinton (SPSS), Randy Kerber (NCR), Thomas Khabaza (SPSS), Thomas Reinartz (DaimlerChrysler), Colin Shearer (SPSS) and Rüdiger Wirth
More informationHighlevel Data Races
Highlevel Data Races Cyrille Artho, Klaus Havelund, and Armin Biere Computer Systems Institute, ETH Zurich, Switzerland Kestrel Technology, NASA Ames Research Center, Moffett Field, California USA Keywords:
More informationThe basic CAP CPU consists of a microprogramming control unit, 4K 16bit words of microcontrol storage, and an 79
5 The Cambridge CAP Computer 5. I Introduction In 1970, Roger Needham and Maurice Wilkes at Cambridge University began a research project to construct a capabilitybased machine. In contrast to the Chicago
More informationMirrors: Design Principles for Metalevel Facilities of ObjectOriented Programming Languages
Mirrors: Design Principles for Metalevel Facilities of ObjectOriented Programming Languages Gilad Bracha Sun Microsystems 4140 Network Circle Santa Clara, CA 95054 (408) 2767025 gilad.bracha@sun.com
More informationIntroduction to Recommender Systems Handbook
Chapter 1 Introduction to Recommender Systems Handbook Francesco Ricci, Lior Rokach and Bracha Shapira Abstract Recommender Systems (RSs) are software tools and techniques providing suggestions for items
More informationFreeze After Writing
Freeze After Writing QuasiDeterministic Parallel Programming with LVars Lindsey Kuper Indiana University lkuper@cs.indiana.edu Aaron Turon MPISWS turon@mpisws.org Neelakantan R. Krishnaswami University
More informationPLANNING ANALYSIS PLANNING ANALYSIS DESIGN
PLANNING ANALYSIS Apply Requirements Analysis Technique (Business Process Automation, Business Process Improvement, or Business Process Reengineering) Use RequirementsGathering Techniques (Interview,
More informationJCR or RDBMS why, when, how?
JCR or RDBMS why, when, how? Bertil Chapuis 12/31/2008 Creative Commons Attribution 2.5 Switzerland License This paper compares java content repositories (JCR) and relational database management systems
More informationA Comparison of Bug Finding Tools for Java
A Comparison of Bug Finding Tools for Java Nick Rutar Christian B. Almazan University of Maryland, College Park {rutar, almazan, jfoster}@cs.umd.edu Jeffrey S. Foster Abstract Bugs in software are costly
More information