1. IST Rodin Project Towards Formal Development of Mobile Location-based Systems REFT 2005 Alexei Iliasov 1, Linas Laibinis 2, Alexander Romanovsky 1, Elena Troubitsyna 2 1 University of Newcastle upon Tyne, UK 2 Åbo Akademi University, Finland

2. IST Rodin Project Motivation Solving problems of interoperability of agent software in open systems Distributed and open agent system with guaranteed conformance to a formal model Run-time structuring and isolation of agents Advanced FT methods, including exception handling

3. IST Rodin Project CAMA Architecture Agent – global structuring unit of the system Scope – structuring unit of coordination space and agent activity Role – structuring unit of agent functionality and also the basis for formal specification of functionality Location – structuring unit of agent context

4. IST Rodin Project CAMA Operations Location operations: Engage@l Disengage@l Scope Operations CreateScope(n, s)@l.s DeleteScope@l.s JoinScope(r)@l.s LeaveScope@l.s GetScopes(d)@l.s Linda operations: in, rd, inp, rdp, ina, rd, inpa, rdpa

5. IST Rodin Project 1. Scope is a run-time structuring unit 2. Each scope originates from corresponding abstract scenario model 3. Run-time scopes are instantiations of abstract models B model scope agent, role X agent, role Y Scopes

6. IST Rodin Project Complex models can be split into several sub-models Scopes can be nested to reproduce design-time hierarchy of models Sub-scopes are created dynamically by a request of a scope participant B model scope Sub-model sub scope `Includes` relation Scope Nesting

7. IST Rodin Project Start with a high-level abstraction Decompose into a required number of subscopes Refine each sub-scope to the level where individual roles can be identified Attribute each B operation to one of the roles Decompose specification into role specifications Formal Scope Development

8. IST Rodin Project Modelling Coordination Space Access to global variables must be substituted with coordination space (Linda) operation A simplified Linda model (singleton model) is used Permits to discover deadlocks and do basic type-checking for CS-style communication

9. IST Rodin Project Agent Development Scope Model S 1 Scope Model S 2 Scope Model S 3 R 11 R 12 R 13 R 21 R 31 R 32 Agent A 1 Model Agent A 2 Model R’ 12 R’ 13 R’ 21 Default role Custom part R’’ 13 R’’ 31 Default role Custom part R R E EEE E D D D A1A1 A2A2 D - Decomposes E - Extends R -Refines

10. IST Rodin Project Scope Instantiation R’ 12 R’ 13 R’ 21 A1A1 R’’ 13 R’’ 31 A2A2 R 12 R 13 Instantiation of S 1

11. IST Rodin Project Each role has its own local state Agent may define shared variables accessible by the refined role specifications Shared data can be implemented as agent local memory or mapped into private scope in a location ssd Role A state Role D state Role C state Role B state Shared data Agent State

12. IST Rodin Project Exception Handling Mobile agent exception –Inter-agent exception propagation –Extended semantics of Linda operations –Formal specification of exceptions and recovery actions –Scope-attached recovery policies

13. IST Rodin Project PutMessage(msg) = PRE msg:MESSAGE THEN rLoc := rLoc <- msg; /* Store it in the local buffer */ TupleOut(BufferOut, msg) /* and pass it over the tuple space */ END; /* Read in from TS as soon as something appears there */ Recieve = SELECT BufferIn:dom(tuples) THEN VAR rr IN /* Read all new tuples from the tuple space (with remove) */ rr <-- TupleArrayIn(BufferIn); rLoc := rLoc ^ rr END END; PutMessage(msg) = PRE msg:MESSAGE THEN Loc := Loc <- msg || OutBuf := Outbuf <- msg END; Recieve = SELECT size(InBuf) > 0 THEN Loc := Loc ^ InBuf || InBuf := [] END;

14. IST Rodin Project Discussion Background of the methodology for the formal development of mobile location- based systems Focus on the B specification of the location middleware Future work: formal agent design process from an abstract specification to running software