1. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.1 CSC 4504 : Langages formels et applications (La méthode Event-B) J Paul Gibson, A207 paul.gibson@it-sudparis.eu http://www-public.it-sudparis.eu/~gibson/Teaching/Event-B/ Purse http://www-public.it-sudparis.eu/~gibson/Teaching/Event-B/Purse.pdf

2. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.2 Purse: Informal Specification of an interactive system 1.A purse contains coins 2.Coins are positive integers, but not all integers have a corresponding coin 3.We wish to start with an empty purse 4.We allow 2 operations: Add a coin Pay a certain (integer) sum (by removing the correct number of coins from the purse, i.e by removing coins whose total is equal to the sum requested Specify in an Event-B context Specify in an Event-B machine

3. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.3 Purse context and simple test for two coins Try to prove the theorem yourselves

4. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.4 Purse machine: Proof Obligations Generated Automatically by Tool

5. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.5 Interactive proof that add_coin respects the invariant

6. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.6 Interactive proof that add_coin respects the invariant

7. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.7 Interactive proof that add_coin respects the invariant Add hypothesis (lemma)

8. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.8 Interactive proof that add_coin respects the invariant Expand and autoprove

9. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.9 Interactive proof that add_coin respects the invariant Add hypothesis from context?

10. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.10 Interactive proof that add_coin respects the invariant Found a problem in specification Should have written: PURSES = COINS → ℕ

11. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.11 Interactive proof that add_coin respects the invariant Fix specification and proof obligations are discharged auotmatically

12. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.12 TASK TO ATTEMPT: Try to specify the event pay_sum In order to help you, first consider the event remove_coin We will first attempt to develop a new machine as a refinement of the first machine We see why this causes a problem – and get a better understanding of refinement We then specify remove_coin without refinement

13. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.13 Add remove_coin event by extending/refining Purse_mch0 State which variables of extended machine you which to use (As well as any new variables) Taken from mch0 A new event that does not take into account any variant in mch0

14. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.14 Add remove_coin event by extending/refining Purse_mch0 New proof obligation to discharge

15. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.15 Add remove_coin event by extending/refining Purse_mch0 Problem: the refinement requires us to show that the new event does not change the state of the refined machine

16. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.16 Add remove_coin event to Purse_mch0 Proof obligation (PO) discharged automatically

17. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.17 Formal Methods Pedagogic Experiment (For next week?) Class has to split into 2 groups 1) First build Java machine for Purse and add pay-sum method. Then, when you are sure the Java is correct specify the corresponding Event-B machine 2) First try to build Event-B machine of Purse including the pay-sum event. Then, implement the machine in Java. Teams in each group (1 or more people) must record time spent on each part (Java and Event-B)

18. 2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.18 PaySum 1 5 5 10 Purse Pay_sum(10) 2 is nondeterministic = 10 or 5+5 Pay_sum(4) is not possible = « event not allowed » Pay_sum(2) is deterministic = 2