SliceAndMerge: A Rodin Plug-in for Refactoring Refinement Structure - - PowerPoint PPT Presentation

▶
sliceandmerge a rodin plug in for refactoring refinement
SMART_READER_LITE
LIVE PREVIEW

SliceAndMerge: A Rodin Plug-in for Refactoring Refinement Structure - - PowerPoint PPT Presentation

Mar 20, 2024 228 likes •627 views

SliceAndMerge: A Rodin Plug-in for Refactoring Refinement Structure of Event-B Machines Tsutomu Kobayashi (University of Tokyo), Aivar Kripsaar (RWTH Aachen University), Fuyuki Ishikawa (NII, Japan), and Shinichi Honiden (NII, Japan) Rodin

slide-1
SLIDE 1

SliceAndMerge: A Rodin Plug-in for Refactoring Refinement Structure of Event-B Machines

Tsutomu Kobayashi (University of Tokyo), Aivar Kripsaar (RWTH Aachen University), Fuyuki Ishikawa (NII, Japan), and Shinichi Honiden (NII, Japan) Rodin Workshop 2016 May 23, 2016

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 1 / 23

slide-2
SLIDE 2

Modeling in Event-B

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 2 / 23

slide-3
SLIDE 3

Modeling in Event-B

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 2 / 23

slide-4
SLIDE 4

Modeling in Event-B

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 2 / 23

slide-5
SLIDE 5

Modeling in Event-B

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 2 / 23

slide-6
SLIDE 6

Modeling in Event-B

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 2 / 23

slide-7
SLIDE 7

Modeling in Event-B

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 2 / 23

slide-8
SLIDE 8

Motivation

Refinement design and specifications

Designing refinement = designing target system’s aspects of interest e.g., Focus on the outside traffic lights on the mainland ↓ Specify/verify properties of them If traffic light is green, # cars outside ≤ capacity

Our goal

Modify refinement design of existing specification → improve understandability, maintainability, extensibility

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 3 / 23

slide-9
SLIDE 9

Example of Motivation

Problem

Somtimes we make refinements with many additional variables/invariants To specify several aspects in a step

Solution

Refinement decomposition

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 4 / 23

slide-10
SLIDE 10

Refactoring of Refinement – Decomposition

Abstract machine

Abstract variables

Concrete machine

Concrete variables

refines Abstract machine

Abstract variables

Medium machine

Medium variables

Concrete machine

Concrete variables

refines refines Decomposition of refinement

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 5 / 23

slide-11
SLIDE 11

Goal of Refinement Decomposition

MA

VA

MC

VC

refines

VB

Input

◮ Proved machines MA and MC ◮ A set of variables VB (subset of VC, slicing criteria) Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 6 / 23

slide-12
SLIDE 12

Goal of Refinement Decomposition

MA

VA

MC

VC

MB

VB

refines refines

Input

◮ Proved machines MA and MC ◮ A set of variables VB (subset of VC, slicing criteria)

Output: Intermediate machine MB such that

◮ MC refines MB and MB refines MA ◮ MB is specified in VB Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 6 / 23

slide-13
SLIDE 13

Restriction on VB

Variables in the machines:

V A V C

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 7 / 23

slide-14
SLIDE 14

Restriction on VB

Variables in the machines:

V A V C

replaced newly introduced inherited

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 7 / 23

slide-15
SLIDE 15

Restriction on VB

Variables in the machines:

V A V C V B

Arbitrary VB:

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 7 / 23

slide-16
SLIDE 16

Restriction on VB

Variables in the machines:

V A V C V B

Arbitrary VB: Some variables are in VA and VC but not VB !

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 7 / 23

slide-17
SLIDE 17

Restriction on VB

Variables in the machines:

V A V C V B

=> VB should be a superset of VA ∩ VC

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 7 / 23

slide-18
SLIDE 18

Approach to Decomposing Refinement

  • 1. Slicing from original machines MC and MA

by finding specifications that can be expressed by VB

  • 2. Mending for consistency

by providing complementary predicates to fill the gap originated from slicing

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 8 / 23

slide-19
SLIDE 19

Slicing

Find predicates that can be expressed by VB e.g., MC (TLIsland ∈ VC)

Invariants TLMainland = red ∨ TLIsland = red TLMainland = green ⇒ n→ = 0 Event leave_island when TLIsland = green 1 ≤ nIsland then n′

Island = nIsland − 1

n′

→ = n→ + 1

end

slice

− − − → MB (TLIsland ∈ VB)

Invariants TLMainland = green ⇒ n→ = 0 Event leave_island when 1 ≤ nIsland then n′

Island = nIsland − 1

n′

→ = n→ + 1

end

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 9 / 23

slide-20
SLIDE 20

Intermediate Machine is Not Always Consistent

MA MC MB

consistent? consistent? consistent?

Sometimes we need to guarantee these consistencies

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 10 / 23

slide-21
SLIDE 21

Refactoring of Refinement – Composition

Abstract machine

Abstract variables

Medium machine

Medium variables

Concrete machine

Concrete variables

refines refines Abstract machine

Abstract variables

Concrete machine’

Concrete variables Medium variables

refines Composition of refinement

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 11 / 23

slide-22
SLIDE 22

Refactoring of Refinement – Composition V Abst

V Conc V Medium

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 12 / 23

slide-23
SLIDE 23

Refactoring of Refinement – Composition V Abst

V 'Conc

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 12 / 23

slide-24
SLIDE 24

SliceAndMerge: Implementation

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 13 / 23

slide-25
SLIDE 25

Intermediate Machine is Not Always Consistent

MA MC MB

consistent? consistent? consistent?

Sometimes we need to guarantee these consistencies

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 14 / 23

slide-26
SLIDE 26

Variables and Provability of Proof Obligations

Preservation of TLMainland ’s property by “leaving from island”

Invariants TLMainland = red ∨ TLIsland = red Guards TLIsland = green Before-after predicates · · · n′

→ = n→ + 1

⊢ ⊢ Invariant after the event TLMainland = green ⇒ n′

→ = 0

Provability in {concrete, medium} machine

Concrete machine Provable. ∵ TLMainland = green from hypotheses Because of TLIsland-related predicates

◮ either TLMainland or TLIsland is red ◮ TLIsland is green

Medium machine Not provable Because of lack of TLIsland-related predicates

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 15 / 23

slide-27
SLIDE 27

Mending by Adding Complementary Predicates

Idea

Original machines are consistent MB lacks essential predicates for consistencies because of vocabulary limitations ↓ Find essential predicates Express them in vocabulary of VB and mend MB with them

Ways of mending include:

Heuristics such as extracting a predicate P from P ∧ Q Analyzing the proof (as described in previous slide)

1 Trace the proof of original machine’s consistency 2 Infer the complementary predicates from that

Using Craig’s interpolation theorem?

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 16 / 23

slide-28
SLIDE 28

Case Study: Decomposing Refinement

Example

Model of flight formation of satellites

◮ by an experienced modeler ◮ high-quality, but include

large refinement steps

⋆ 72 invariants in one

refinement

Result

Decomposed refinements into multiple steps

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 17 / 23

slide-29
SLIDE 29

Results

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 18 / 23

slide-30
SLIDE 30

Extracting Parts of Machines for Reuse

V Abst V Conc V Medium

Reusable part

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 19 / 23

slide-31
SLIDE 31

Extracting Parts of Machines for Reuse

V Abst V 'Conc

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 19 / 23

slide-32
SLIDE 32

Extracting Parts of Machines for Reuse V Abst

V 'Conc V 'Medium

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 19 / 23

slide-33
SLIDE 33

Case Study: Extracting Authentication Parts of LAC

Original model: location access controller

Persons move between locations connected with turnstiles Persons are authorized to enter certain locations Persons insert their ID card in card readers on turnstiles Turnstiles communicate with a controller via messages

◮ authentication, movement of a person, indicator light, . . .

New model: consoles, servers, and monitors

Location have consoles with card readers and monitors. Authorized persons can login server by inserting ID card to the reader Controller try to find an unoccupied monitor in a room Consoles communicate with a controller via messages

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 20 / 23

slide-34
SLIDE 34

Concluding Remarks

Summary

Aiming at modify refinement structure of existing machines Slicing before mending / merging SliceAndMerge v1.0 coming soon?

Future work

Constructing systematic methods for mending Planning refinement for various use cases Finding other use cases

◮ Planting specifications in other methods (e.g., VDM)? ◮ . . . Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 21 / 23

slide-35
SLIDE 35

Interpolation

Theorem (Craig interpolation)

If a sequent Hyp ⊢ Goal is provable, there exists an interpolant I such that All symbols of I occur in both Hyp and Goal Hyp ⊢ I and I ⊢ Goal are provable

Example of interpolant

TLMainland = red ∨ TLIsland = red TLIsland = green n′

→ = n→ + 1 interpolates

← − − − − − − − TLMainland = green ⊢ TLMainland = green ⇒ n′

→ = 0

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 22 / 23

slide-36
SLIDE 36

Complementary Predicates and Interpolation

Finding complementary predicates using interpolation

1 Original consistency sequent Hyp ⊢ Goal is given 2 Apply inference rules to get another sequent Hyp′ ⊢ Goal′

such that Goal′ can be expressed using VB

3 Obtain an interpolant I′ of Hyp′ ⊢ Goal′ ◮ Hyp′ ⊢ I′, I′ ⊢ Goal′

// I′ is an essence

◮ I′ can be expressed in VB 4 Find complementary predicates from I′ Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 23 / 23

slide-37
SLIDE 37

Complementary Predicates and Interpolation

Finding complementary predicates using interpolation

1 Original consistency sequent Hyp ⊢ Goal is given 2 Apply inference rules to get another sequent Hyp′ ⊢ Goal′

such that Goal′ can be expressed using VB

3 Obtain an interpolant I′ of Hyp′ ⊢ Goal′ ◮ Hyp′ ⊢ I′, I′ ⊢ Goal′

// I′ is an essence

◮ I′ can be expressed in VB 4 Find complementary predicates from I′

TLMainland = red ∨ TLIsland = red TLIsland = green n′

→ = n→ + 1

⊢ TLMainland = green ⇒ n′

→ = 0

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 23 / 23

slide-38
SLIDE 38

Complementary Predicates and Interpolation

Finding complementary predicates using interpolation

1 Original consistency sequent Hyp ⊢ Goal is given 2 Apply inference rules to get another sequent Hyp′ ⊢ Goal′

such that Goal′ can be expressed using VB

3 Obtain an interpolant I′ of Hyp′ ⊢ Goal′ ◮ Hyp′ ⊢ I′, I′ ⊢ Goal′

// I′ is an essence

◮ I′ can be expressed in VB 4 Find complementary predicates from I′

TLMainland = red ∨ TLIsland = red TLIsland = green ⊢ TLMainland = green ⇒ n′

→ = 0

¬n′

→ = n→ + 1

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 23 / 23

slide-39
SLIDE 39

Complementary Predicates and Interpolation

Finding complementary predicates using interpolation

1 Original consistency sequent Hyp ⊢ Goal is given 2 Apply inference rules to get another sequent Hyp′ ⊢ Goal′

such that Goal′ can be expressed using VB

3 Obtain an interpolant I′ of Hyp′ ⊢ Goal′ ◮ Hyp′ ⊢ I′, I′ ⊢ Goal′

// I′ is an essence

◮ I′ can be expressed in VB 4 Find complementary predicates from I′

TLMainland = red ∨ TLIsland = red TLIsland = green ⊢

interpolates

← − − − − − − − TLMainland = green TLMainland = green ⇒ n′

→ = 0

¬n′

→ = n→ + 1

Tsutomu Kobayashi (UTokyo) SliceAndMerge Rodin Workshop 2016 23 / 23