Formal specification in Event-B

Size: px

Start display at page:

Download "Formal specification in Event-B"

Emma Norman
6 years ago
Views:

1 2IW80 Software specification and architecture Formal specification in Event-B Alexander Serebrenik, Ulyana Tikhonova

2 Outline Introduction into formal specification Mathematical notation of Event-B Event-B UML-B / SET / W&I 2

3 Resources Summary of the Event-B notation: Tutorials Modeling in Event-B: System and Software Engineering by Jean-Raymond Abrial Repository of Event-B examples: mples / SET / W&I 3

4 Formal specification and formal analysis Formal = mathematical Mathematical notation Theory behind the notation Validation Are we cooking the right product? Verification Are we cooking it right? / SET / W&I 4

5 Formal methods as a specification technique? Unambiguous? Realistic? Verifiable? Evolvable? / SET / W&I 6

6 Event-B Z, B method, Event-B Event-B formalism uses set theory and logic has an extensive tool support relatively simple, but not very expressive / SET / W&I 7

7 Outline Introduction into formal specification Mathematical notation of Event-B Event-B UML-B / SET / W&I 8

8 Predicates Logical primitives:, Logical operators:,,, Quantifiers: x 1, x n P(x 1, x n ) x 1, x n P(x 1, x n ) Equality and inequality: =, / SET / W&I 9

9 Sets Predefined sets: N, Z, BOOL Interval: m..n Sets: {expr 1,, expr n } { x P E } { x x x ^ 2 } partition(s, {expr 1 },, {expr n }) partition(course_2iw80, {Tuesday}, {Thursday}) / SET / W&I 11

10 Sets Membership: a1 S, a4 S Subsets: {a1, a2} S, {b1, b2} S Operations on sets: S T, S T, S T Power sets: P(S) P(S) / SET / W&I 12

11 Is it true or false? { 2..2} \ {0} { x, y x Z y Z x y = 12 x } a. b. / SET / W&I 13

12 Relations Cartesian product A B Pair: a1 b2 Relations: A B, Domain and range: dom(r), ran(r) Relational image r[{a1, a3}] is {b1,b2,b4} / SET / W&I 16

13 Functions Functions: A B, A B, / SET / W&I 17

14 Outline Introduction into formal specification Mathematical notation of Event-B Event-B UML-B / SET / W&I 18

15 File system example In the file system, users can create new files, execute, display (on different output devices) and delete existing files. There is a special type of delete, which removes the file permanently from the file system. The file system makes use of an access right system which specifies who the owner of each file is and what operations are allowed by which users. The owner of each file may change the access rights to the file and give or take other people s permissions to access the file. In addition to the person who creates the file, the administrator is considered the owner of all files. Identify sets and relations / SET / W&I 19

16 What are the sets? In the file system, users can create new files, execute, display (on different output devices) and delete existing files. There is a special type of delete, which removes the file permanently from the file system. The file system makes use of an access right system which specifies who the owner of each file is and what operations are allowed by which users. The owner of each file may change the access rights to the file and give or take other people s permissions to access the file. In addition to the person who creates the file, the administrator is considered the owner of all files. User, File, Operation / SET / W&I 20

17 Sets and subsets User, File, Operation existing_files File opened_files existing_files current_user User partition(operation, {Execute}, {Display}, {Delete}, {Delete_permanently}) User current_user File existing_files opened_files / SET / W&I 21

18 What are the relations? In the file system, users can create new files, execute, display (on different output devices) and delete existing files. There is a special type of delete, which removes the file permanently from the file system. The file system makes use of an access right system which specifies who the owner of each file is and what operations are allowed by which users. The owner of each file may change the access rights to the file and give or take other people s permissions to access the file. In addition to the person who creates the file, the administrator is considered the owner of all files. owner existing_files User access User (Operation existing_files) / SET / W&I 22

19 Relations owner existing_files User access User (Operation existing_files) Operation User access Operation existing_files owner existing_files / SET / W&I 23

20 Other possibilities sets User, File existing_files File owner existing_files P(User) access_display existing_files P(User) access_execute existing_files P(User) access_delete existing_files P(User) access_delete_permanently existing_files P(User) / SET / W&I 24

21 Access control invariant existing_files File opened_files existing_files current_user User access User (Operation existing_files) opened { file Display file access[{current_user}] file } / SET / W&I 25

22 File system specified in Event-B / SET / W&I 26

23 File system specified in Event-B deterministic assignment / SET / W&I 27 some User (nondeterministic assignment)

24 File system specified in Event-B: verification inv6: opened { file Display file access[{current_user}] file } / SET / W&I 28

$opened { file Display file access[{current_user}] file } / SET / W&I$

25 File system specified in Event-B: verification New guard: grd2 inv6: opened { file Display file access[{current_user}] file } / SET / W&I 29

26 Specification in Event-B: context component Context Sets data types Constants Axioms MANDATORY: types of constants properties that are assumed to be true / SET / W&I 30

27 Specification in Event-B: machine component Machine sees a context Variables whose values are changed by events Invariants MANDATORY: types of variables properties that need to be checked Events parameters (ANY) guards (WHERE) actions (THEN), executed in parallel / SET / W&I 31

28 Exercise for you: create file and delete file sets File, User, Operation existing_files File opened_files existing_files current_user User owner existing_files User access User (Operation existing_files) / SET / W&I 32

29 Create file / SET / W&I 33

30 Delete file Is it correct? / SET / W&I 34

31 Delete file: verification problems / SET / W&I 35

32 Delete file: improved version Domain and range restrictions / SET / W&I 36

33 Exercise for you: delete file permanently recycle_bin / SET / W&I 37

34 Exercise for you: delete file permanently recycle_bin File recycle_bin existing_files = What events need to be changed? / SET / W&I 38

35 Exercise for you: change access rights Is it correct? Relational override: r1 r2 = {x y x y r1 x dom(r2)} r2 / SET / W&I 39

$inv6: opened { file Display file access[{current_user}] file } / SET /$

36 Change access right: verification problems How would you repair this? inv6: opened { file Display file access[{current_user}] file } / SET / W&I 40

37 Change access right: how to repair? inv6: opened { file Display file access[{current_user}] file } Can the access rights to the file be changed when this file is opened? Or: to change access right to a file, this file should be closed Does an owner have the access to display files that he/she owns? Shall we add this to our invariants and guards? / SET / W&I 41

38 Rodin platform Event-B editor Write your specification Proof obligations Generated automatically for each pair from Invariants Events Discharged by automatic provers Model checking Animation of machines Execute your specification Graphical visualization / SET / W&I 42

39 Outline Introduction into formal specification Mathematical notation of Event-B Event-B UML-B / SET / W&I 44

40 UML-B Draw UML diagrams Class diagrams State machine diagrams Generate Event-B specification iuml-b plug-in / SET / W&I 45

41 State machine diagrams in iuml-b / SET / W&I 46

42 Generated Event-B specification Event-B is generated from the state machine! / SET / W&I 47

43 Generated Event-B specification / SET / W&I 48

44 Nested state machine / SET / W&I 49

45 State invariant Added manually / SET / W&I 50

46 Animate state machine diagram / SET / W&I 51

47 What is behind your state machine animation? / SET / W&I 52

48 UML vs. formal specification Using UML we can: a. Draw pictures b. Analyze the system c. Communicate with developers and customers d. Design the system e. Generate source code / SET / W&I 53

49 UML vs. formal specification Using formal specification we can: a. Draw pictures b. Analyze the system c. Communicate with developers and customers d. Design the system e. Generate source code / SET / W&I 54

50 Formal methods as a specification technique? Unambiguous? Realistic? Verifiable? Evolvable? / SET / W&I 55

51 Formal methods as a specification technique? Unambiguous? yes, formal notation and formal theory Realistic? might require a lot of effort on modeling a correct system Verifiable? yes, formal methods Evolvable? real-life systems: a lot of details huge formal specifications, which are hard to maintain / SET / W&I 56

52 Brief recapitulation / SET / W&I 57

Event-B Course. 11. Formal Development of a Security Protocol (the Needham-Schroeder protocol)

Event-B Course. 11. Formal Development of a Security Protocol (the Needham-Schroeder protocol) Event-B Course 11. Formal Development of a Security Protocol (the Needham-Schroeder protocol) Jean-Raymond Abrial September-October-November 2011 Outline 1 - Requirement Document - Refinement Strategy