What is the B-method? Welcome to Provably Correct Software - PDF document

What is the B-method? Welcome to Provably Correct Software http://www.it.uu.se/ edu/course/homepage/bkp/vt09 Instructor Lars-Henrik Eriksson lhe@it.uu.se, http://www.it.uu.se/katalog/lhe?lang=en Provably Correct Software Page 1 Updated 2008-03-18 Provably Correct Software Page 2 Updated 2008-03-18 What is the B-method (really)? The software development process • Requirements capture The B-method is a formal method used for • Specification • Formal specification of software (using the Abstract Machine Traditionally done using plain language, diagrams, tables ... Notation – AMN ) • Validation (are we building the right system?) • Writing executable programs (using the B0 subset of AMN) Traditionally done by inspection, prototyping ... • Proving consistency of specifications and correctness of programs • Design Characteristics: Specify the architecture and data structures of the software • Model-based specification • Implementation • Refinement Programs written in a programming language • Verification (are we building the system right?) The B-method is supported by software tools such as Traditionally done by testing • Atelier B • Debugging • B-Toolkit Try to find out where the program goes wrong • ProB Provably Correct Software Page 3 Updated 2008-03-18 Provably Correct Software Page 4 Updated 2008-03-18 The role of B in software development Model-based specification • Requirements capture The specification gives a mathematical model of the data the • Specification program uses and describes the function of the program in terms of Wholly or in part written in AMN. mathematical operations on that data. • Validation (are we building the right system?) Consider a stack : Proving correctness theorems, animating the specification... • A stack can be modelled as a sequence of objects . • Design • Assume that the top element is always the last element of the Design specifications wholly or in part written in AMN. sequence. • Implementation • Pushing an item onto the stack means the same as adding it to the Programs written in the B0 subset of the AMN. end of the sequence. • Verification (are we building the system right?) • Popping an object off the stack means removing the last element Refinement proof. Testing should not be needed. from the sequence. • Debugging You don � t need this (at least not in the traditional sense) Provably Correct Software Page 5 Updated 2008-03-18 Provably Correct Software Page 6 Updated 2008-03-18

A stack in B (simplified) B ensures error-free execution • There must be a size limit for the stack (as computer memory is A stack can be formally specified by the following B specification finite) machine (or abstract machine) written in AMN. • There must be preconditions on the operators to make sure that MACHINE Stack SETS ELEMENTS they are well-defined. (What happens if you pop an empty stack?) VARIABLES stack INVARIANT stack:seq(ELEMENTS) INITIALISATION stack := <> OPERATIONS xx <-- get = xx := last(stack); push(xx) = stack := stack<-xx; pop = stack := front(stack) END Actually, you would not be able to develop a program conforming to this specification because some important things are missing. Can you see what? (Think about the Prog. Methodology 1 course...) Provably Correct Software Page 7 Updated 2008-03-18 Provably Correct Software Page 8 Updated 2008-03-18 A better specification Implementing Stacks – refinement MACHINE Stack The stack specification does not concern itself with implementation CONSTANTS maxsize SETS ELEMENTS details. Stacks are actually implemented by a B implementation PROPERTIES maxsize:NAT VARIABLES stack machine . This machine must be a refinement of the specification. INVARIANT stack:seq(ELEMENTS) & size(stack)<=maxsize INITIALISATION stack := <> Intuitively, a refinement is something which is the same but more OPERATIONS xx <-- get = PRE stack /= <> concrete . For example: THEN xx := last(stack) END; • undetermined things (e.g. maximum stack size) are decided push(xx) = PRE xx:ELEMENTS & size(stack)<maxsize THEN stack := stack<-xx • algorithms are provided for abstract operations (e.g. a quantified END; pop = PRE stack /= <> expression can be refined by a loop). THEN stack := front(stack) • an operation can be implemented in terms of other simpler END END operations (stepwise refinement). NAT is the set of implementable natural numbers (has upper limit). • mathematical objects like sequences are replaced by B guarantees that preconditions are satisfied when operations are implementable objects like arrays. used ( design by contract ). Provably Correct Software Page 9 Updated 2008-03-18 Provably Correct Software Page 10 Updated 2008-03-18 A stack implementation Sequence of refinements IMPLEMENTATION StackI Sometimes the step from specification to implementation is too REFINES Stack VALUES ELEMENTS = INT; maxsize = 100 large. The refinement can then be done as a series of smaller CONCRETE_VARIABLES array, currentsize INVARIANT array:(1..maxsize)-->ELEMENTS & refinements. The intermediate stages are represented by B currentsize:0..maxsize & !ii.(ii:1..currentsize => refinement machines . stack(ii) = array(ii)) & currentsize = size(stack) In the sequence of refinements, the machines get successively INITIALISATION array := (1..maxsize)*{0}; currentsize := 0 OPERATIONS more concrete, until the implementation machine is reached. xx <-- get = xx := array(currentsize); push(xx) = BEGIN currentsize := currentsize+1; array(currentsize) := xx END; pop = currentsize := currentsize-1 END The stack is stored as an array. When items are pushed on the stack, they are stored in successive array elements. (If you are curious – identifiers must have at least 2 characters.) Provably Correct Software Page 11 Updated 2008-03-18 Provably Correct Software Page 12 Updated 2008-03-18

Algebraic specification Atelier B A different specification technique is to give equations that describe We will use the Atelier B tool. It can: what properties the operations should have. A stack could be • Do syntax and type checking of B machines specified by the following (in)equations: (assuming s ranges over • Generate proof obligations for the consistency of machines stacks, e over elements and empty represents the empty stack). • Generate proof obligations for refinements get(push(s,e)) = e • Prove most proof obligations pop(push(s,e)) = s • Translate implementation machines into C (or C++ or ADA) push(s,e) � empty • Generate basic documentation of machines get(empty) � e • Manage projects with many developers pop(empty) � s See the course web site for instructions on how to run Atelier B! B is not intended for algebraic specifications, but you can with Atelier B is a commercial product used in industrial software difficulty abuse the notation to write such specifications. development. (Unfortunatelty the graphical user interface is somewhat primitive.) Provably Correct Software Page 13 Updated 2008-03-18 Provably Correct Software Page 14 Updated 2008-03-18 ProB About the B-method We will also use the ProB tool to validate specifications. The B method was developed with practical software development Some things it can do: in mind. It brings together ideas from various areas of computer science (and mathematics). Some of them are: • Animate B specification machines • Check internal consistency of a machine by automatic testing • Axiomatic set theory (Zermelo-Fraenkel) • Model-based specifications (Z, VDM-SL) ProB is research software under development. • Pre- and postconditions • It does not implement the full AMN, so not all B specifications • Design by contract can be animated. • Invariants • It requires limites ranges of numbers and sizes of sets to work. • Guarded commands • It does give a very clear view of what the B machine is doing. • Weakest precondition semantics See the course web site for instructions on how to run ProB! • Hoare logic (axiomatic semantics) • Refinement calculus • Stepwise refinement Provably Correct Software Page 15 Updated 2008-03-18 Provably Correct Software Page 16 Updated 2008-03-18 The course The projects • Suggest a small programming task. Get the instructor � s approval. • Lectures outline the material and point out important issues. • Write a B specification machine (or machines) • Students study the details from the textbook and other sources • Validate it, prove its consistency (web resources, research papers…) • Write a B implementation machine (or machines) • Weekly seminars with presentations by students and discussions. • Prove that it is a refinement (possibly using intermediate refinement • During the course groups of 2 (or 3) students carry out a program machines) development project including specification, implementation and • Generate an executable program and run it. Is it bug-free? proof. • Write a project report! • No proper exam. The seminars can be seen as an ongoing oral exam. Provably Correct Software Page 17 Updated 2008-03-18 Provably Correct Software Page 18 Updated 2008-03-18