Download presentation

Presentation is loading. Please wait.

Published byAlysha Shirrell Modified over 4 years ago

1
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.1 CSC 4504 : Langages formels et applications (La méthode Event-B) J Paul Gibson, A207 paul.gibson@it-sudparis.eu http://www-public.it-sudparis.eu/~gibson/Teaching/Event-B/ Purse http://www-public.it-sudparis.eu/~gibson/Teaching/Event-B/Purse.pdf

2
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.2 Purse: Informal Specification of an interactive system 1.A purse contains coins 2.Coins are positive integers, but not all integers have a corresponding coin 3.We wish to start with an empty purse 4.We allow 2 operations: Add a coin Pay a certain (integer) sum (by removing the correct number of coins from the purse, i.e by removing coins whose total is equal to the sum requested Specify in an Event-B context Specify in an Event-B machine

3
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.3 Purse context and simple test for two coins Try to prove the theorem yourselves

4
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.4 Purse machine: Proof Obligations Generated Automatically by Tool

5
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.5 Interactive proof that add_coin respects the invariant

6
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.6 Interactive proof that add_coin respects the invariant

7
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.7 Interactive proof that add_coin respects the invariant Add hypothesis (lemma)

8
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.8 Interactive proof that add_coin respects the invariant Expand and autoprove

9
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.9 Interactive proof that add_coin respects the invariant Add hypothesis from context?

10
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.10 Interactive proof that add_coin respects the invariant Found a problem in specification Should have written: PURSES = COINS → ℕ

11
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.11 Interactive proof that add_coin respects the invariant Fix specification and proof obligations are discharged auotmatically

12
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.12 TASK TO ATTEMPT: Try to specify the event pay_sum In order to help you, first consider the event remove_coin We will first attempt to develop a new machine as a refinement of the first machine We see why this causes a problem – and get a better understanding of refinement We then specify remove_coin without refinement

13
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.13 Add remove_coin event by extending/refining Purse_mch0 State which variables of extended machine you which to use (As well as any new variables) Taken from mch0 A new event that does not take into account any variant in mch0

14
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.14 Add remove_coin event by extending/refining Purse_mch0 New proof obligation to discharge

15
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.15 Add remove_coin event by extending/refining Purse_mch0 Problem: the refinement requires us to show that the new event does not change the state of the refined machine

16
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.16 Add remove_coin event to Purse_mch0 Proof obligation (PO) discharged automatically

17
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.17 Formal Methods Pedagogic Experiment (For next week?) Class has to split into 2 groups 1) First build Java machine for Purse and add pay-sum method. Then, when you are sure the Java is correct specify the corresponding Event-B machine 2) First try to build Event-B machine of Purse including the pay-sum event. Then, implement the machine in Java. Teams in each group (1 or more people) must record time spent on each part (Java and Event-B)

18
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/Purse.18 PaySum 1 5 5 10 Purse Pay_sum(10) 2 is nondeterministic = 10 or 5+5 Pay_sum(4) is not possible = « event not allowed » Pay_sum(2) is deterministic = 2

Similar presentations

OK

1 First EMRAS II Technical Meeting IAEA Headquarters, Vienna, 19–23 January 2009.

1 First EMRAS II Technical Meeting IAEA Headquarters, Vienna, 19–23 January 2009.

© 2018 SlidePlayer.com Inc.

All rights reserved.

To make this website work, we log user data and share it with processors. To use this website, you must agree to our Privacy Policy, including cookie policy.

Ads by Google