The Rodin Platform. Jean-Raymond Abrial. 2nd Rodin Industrial Day. September 10th 2007

Transcription

1 The Rodin Platform Jean-Raymond Abrial 2nd Rodin Industrial Day September 10th 2007

2 Prelude 1

3 Prelude 2 - Georges Charpak is a French physicist (Nobel Prize winner in 1992)

4 Prelude 3 - Georges Charpak is a French physicist (Nobel Prize winner in 1992) - Contribution: "The invention and development of particle detectors"

5 Prelude 4 - Georges Charpak is a French physicist (Nobel Prize winner in 1992) - Contribution: "The invention and development of particle detectors" - Question asked to Charpak: "Are you a theoretician?"

6 Prelude 5 - Georges Charpak is a French physicist (Nobel Prize winner in 1992) - Contribution: "The invention and development of particle detectors" - Question asked to Charpak: "Are you a theoretician?" - Answer: "No, I am not. Although I know the theory"

7 Prelude 6 - Georges Charpak is a French physicist (Nobel Prize winner in 1992) - Contribution: "The invention and development of particle detectors" - Question asked to Charpak: "Are you a theoretician?" - Answer: "No, I am not. Although I know the theory" - Answer (cont d):

8 Prelude 7 - Georges Charpak is a French physicist (Nobel Prize winner in 1992) - Contribution: "The invention and development of particle detectors" - Question asked to Charpak: "Are you a theoretician?" - Answer: "No, I am not. Although I know the theory" - Answer (cont d): "AND MY TOOL IS THE MIRROR OF THE THEORY"

9 Which Theory? 8 - The theory of discrete transition systems

10 Which Theory? 9 - The theory of discrete transition systems - As engineers, a theory is used to build a methodology

11 Which Theory? 10 - The theory of discrete transition systems - As engineers, a theory is used to build a methodology - A methodology describes the process allowing to apply a theory

12 Which Theory? 11 - The theory of discrete transition systems - As engineers, a theory is used to build a methodology - A methodology describes the process allowing to apply a theory - The methodology must precede the tool

13 Which Theory? 12 - The theory of discrete transition systems - As engineers, a theory is used to build a methodology - A methodology describes the process allowing to apply a theory - The methodology must precede the tool - But the tool will help us applying the methodology

14 Which Methodology? 13 - That of developing systems which will be correct by construction

15 Which Methodology? 14 - That of developing systems which will be correct by construction - Developing formal models in many different system areas:

16 Which Methodology? 15 - That of developing systems which will be correct by construction - Developing formal models in many different system areas: - distributed

17 Which Methodology? 16 - That of developing systems which will be correct by construction - Developing formal models in many different system areas: - distributed - concurrent

18 Which Methodology? 17 - That of developing systems which will be correct by construction - Developing formal models in many different system areas: - distributed - concurrent - parallel

19 Which Methodology? 18 - That of developing systems which will be correct by construction - Developing formal models in many different system areas: - distributed - concurrent - parallel - sequential

20 Which Methodology? 19 - That of developing systems which will be correct by construction - Developing formal models in many different system areas: - distributed - concurrent - parallel - sequential - including external environment

21 Which Methodology? 20 - That of developing systems which will be correct by construction - Developing formal models in many different system areas: - distributed - concurrent - parallel - sequential - including external environment - The tool must be an aid for doing this, not a burden

22 Formal Models with Event-B (reminder) 21 - Models are made of machines and contexts Machine variables invariants theorems events Context carrier sets constants axioms theorems

23 Relationships Between Machines and Contexts (reminder) 22 Machine sees Context refines Machine sees Context extends refines extends

24 Structure of Machines and Contexts in Event-B (reminder) 23 Each section contains modeling elements machine < machine identifier > refines < machine identifier > sees < context identifier >... variables < variable identifier >... invariants < label >: < predicate >... theorems < label >: < predicate >... variant < variant > events < event >... end context < context identifier > extends < context identifier >... sets < set identifier >... constants < constant identifier >... axioms < label >: < predicate >... theorems < label >: < predicate >... end

25 Initial Quick Demo 24

26 Structure of Events in Event-B (reminder) 25 < event identifier > = status {ordinary, convergent, anticipated} refines < event identifier >... any < parameter identif ier >... where < label >: < predicate >... with < label >: < witness >... then < label >: < action >... end

27 Initial Quick Demo (cont d) 26

28 The "Compiler" of Tomorrow 27 D E S I G N A N D V E R I F I C A T I O N P L U G I N S Static Checker Proof Obligation Generator Provers Model Checker D E S I G N D A T A B A S E Animator UML to B Tool I N T E R F A C E Translator

29 The "Compiler" of Tomorrow 28 D E S I G N A N D V E R I F I C A T I O N P L U G I N S Static Checker Proof Obligation Generator Provers Model Checker D E S I G N D A T A B A S E Animator UML to B Tool I N T E R F A C E Translator

30 Outline of Talk 29 - The team

31 Outline of Talk 30 - The team - Main characteristics of the Rodin Platform

32 Outline of Talk 31 - The team - Main characteristics of the Rodin Platform - A Grand Tour of the Rodin Platform by means of an example

33 Outline of Talk 32 - The team - Main characteristics of the Rodin Platform - A Grand Tour of the Rodin Platform by means of an example - Various demos performed during example presentation

34 The ETH Team (a superb team) 33 - Laurent Voisin: Main Architect

35 The ETH Team (a superb team) 34 - Laurent Voisin: Main Architect - Stefan Hallerstede: Static Checker, Builder, PO Generator

36 The ETH Team (a superb team) 35 - Laurent Voisin: Main Architect - Stefan Hallerstede: Static Checker, Builder, PO Generator - Thai Son Hoang: User Interface, Interactive Prover Rules

37 The ETH Team (a superb team) 36 - Laurent Voisin: Main Architect - Stefan Hallerstede: Static Checker, Builder, PO Generator - Thai Son Hoang: User Interface, Interactive Prover Rules - Farhad Mehta: Proof Manager, Well-definedness

38 The ETH Team (a superb team) 37 - Laurent Voisin: Main Architect - Stefan Hallerstede: Static Checker, Builder, PO Generator - Thai Son Hoang: User Interface, Interactive Prover Rules - Farhad Mehta: Proof Manager, Well-definedness - Francois Terrier: New Prover

39 The ETH Team (a superb team) 38 - Laurent Voisin: Main Architect - Stefan Hallerstede: Static Checker, Builder, PO Generator - Thai Son Hoang: User Interface, Interactive Prover Rules - Farhad Mehta: Proof Manager, Well-definedness - Francois Terrier: New Prover - External participants: Dominique Cansell and Christophe Metayer

40 Main Characteristics of the Rodin Platform 39 - Build on top of Eclipse

41 Main Characteristics of the Rodin Platform 40 - Build on top of Eclipse - Running on Windows, Mac-OS, and Linux

42 Main Characteristics of the Rodin Platform 41 - Build on top of Eclipse - Running on Windows, Mac-OS, and Linux - Development: 3 years

43 Main Characteristics of the Rodin Platform 42 - Build on top of Eclipse - Running on Windows, Mac-OS, and Linux - Development: 3 years - 120,000 lines of Java (after removing blank lines and comment lines)

44 Main Characteristics of the Rodin Platform 43 - Build on top of Eclipse - Running on Windows, Mac-OS, and Linux - Development: 3 years - 120,000 lines of Java (after removing blank lines and comment lines) - Open source

45 Main Characteristics of the Rodin Platform 44 - Build on top of Eclipse - Running on Windows, Mac-OS, and Linux - Development: 3 years - 120,000 lines of Java (after removing blank lines and comment lines) - Open source - Extensible (plug-ins)

46 The Example 45 - A hotel key card system

47 The Example 46 - A hotel key card system - It is not a software system

48 The Example 47 - A hotel key card system - It is not a software system - The model will allow us to analyze this system

49 The Example 48 - A hotel key card system - It is not a software system - The model will allow us to analyze this system - References:

50 The Example 49 - A hotel key card system - It is not a software system - The model will allow us to analyze this system - References: - Daniel Jackson, Software Abstractions. MIT Press, 2006

51 The Example 50 - A hotel key card system - It is not a software system - The model will allow us to analyze this system - References: - Daniel Jackson, Software Abstractions. MIT Press, Tobias Nipkow, Verifying a Hotel Key Card System. ICTAC, 2006

52 The Specification of a Hotel Key Card System 51 - Upon checking-in, you are given a magnetic card.

53 The Specification of a Hotel Key Card System 52 - Upon checking-in, you are given a magnetic card. - Between your check-in and your check-out, the system must:

54 The Specification of a Hotel Key Card System 53 - Upon checking-in, you are given a magnetic card. - Between your check-in and your check-out, the system must: (1) allow you to enter the room you booked,

55 The Specification of a Hotel Key Card System 54 - Upon checking-in, you are given a magnetic card. - Between your check-in and your check-out, the system must: (1) allow you to enter the room you booked, (2) guarantee that no one else can do so.

56 The Specification of a Hotel Key Card System 55 - Upon checking-in, you are given a magnetic card. - Between your check-in and your check-out, the system must: (1) allow you to enter the room you booked, (2) guarantee that no one else can do so. - At check-out, you are not obliged to return the magnetic card

57 The Specification of a Hotel Key Card System 56 - Upon checking-in, you are given a magnetic card. - Between your check-in and your check-out, the system must: (1) allow you to enter the room you booked, (2) guarantee that no one else can do so. - At check-out, you are not obliged to return the magnetic card - In a classical hotel metallic key system, (2) is not guaranteed (a previous user may have "borrowed" the metallic key)

58 A Proposed Implementation of the Key Card System (1) 57 - Each check-in starts a new booking

59 A Proposed Implementation of the Key Card System (1) 58 - Each check-in starts a new booking - Each booking is associated with a key-card

60 A Proposed Implementation of the Key Card System (1) 59 - Each check-in starts a new booking - Each booking is associated with a key-card - Each key-card carries two electronic keys:

61 A Proposed Implementation of the Key Card System (1) 60 - Each check-in starts a new booking - Each booking is associated with a key-card - Each key-card carries two electronic keys: (1) Its own new key: guaranteed to be fresh

62 A Proposed Implementation of the Key Card System (1) 61 - Each check-in starts a new booking - Each booking is associated with a key-card - Each key-card carries two electronic keys: (1) Its own new key: guaranteed to be fresh (2) the "previous" booking key: the "new" key from the previous booking card

63 A Proposed Implementation of the Key Card System (2) 62 - Each door has an independent electronic lock

64 A Proposed Implementation of the Key Card System (2) 63 - Each door has an independent electronic lock - The lock at the door holds one electronic key

65 A Proposed Implementation of the Key Card System (2) 64 - Each door has an independent electronic lock - The lock at the door holds one electronic key - You insert your card in the lock

66 A Proposed Implementation of the Key Card System (2) 65 - Each door has an independent electronic lock - The lock at the door holds one electronic key - You insert your card in the lock - The lock reads your card

67 A Proposed Implementation of the Key Card System (2) 66 - Each door has an independent electronic lock - The lock at the door holds one electronic key - You insert your card in the lock - The lock reads your card - The door opens if the door key is one of the two keys of your card

68 A Proposed Implementation of the Key Card System (2) 67 - Each door has an independent electronic lock - The lock at the door holds one electronic key - You insert your card in the lock - The lock reads your card - The door opens if the door key is one of the two keys of your card - The door key is replaced by your own key (as read on the card)

69 k1 door key

70 k2 k1 new key previous key k1 door key

71 k2 k1 k2 k1 k1 k2

72 k2

73 k2 k1 k2

74 k2 k1 k2 k1 k2 k2

75 k2

76 k3 k2 k2

77 k3 k2 k3 k2 k2 k3

78 k3

79 k3 k2 k3

80 k3 k2 k3 k2 k3 k3

81 k3

82 k2 k1 k3

83 k2 k1 k2 k1 k3 k3

84 Booking Conventions 68 open closed PAST bookings PRESENT booking FUTUR bookings

85 The Main Transitions 69 - check in: performed by hotel management and guest

86 The Main Transitions 70 - check in: performed by hotel management and guest - check out: performed by hotel management (and guest)

87 The Main Transitions 71 - check in: performed by hotel management and guest - check out: performed by hotel management (and guest) - use: performed by guest (this is the first entrance in the room)

88 Initial Situation 72 Booking b1 is a dummy b1

89 Check in 73 Booking b2 checks in b1 b2

90 Use 74 Booking b2 uses the room. b1 b2 Booking b1 becomes a past booking

91 Check out 75 Booking b2 checks out b1 b2

92 Check in 76 Booking b3 checks in b1 b2 b3

93 Use 77 Booking b3 uses the room. b1 b2 b3 Booking b2 becomes a past booking

94 Check in 78 Booking b4 checks in b1 b2 b3 b4 NOT ALLOWED At most one open booking

95 Use 79 Booking b2 uses the room. b1 b2 b3 Booking b3 becomes a past booking NOT ALLOWED A past booking cannot "use" the room for the first time

96 Check out 80 Booking b3 checks out b1 b2 b3

97 Check in 81 Booking b4 checks in b1 b2 b3 b4

98 Check out 82 Booking b4 checks out without using the room b1 b2 b3 b4

99 Check in 83 Booking b5 checks in b1 b2 b3 b4 b5

100 Check out 84 Booking b5 checks out without using the room b1 b2 b3 b4 b5

101 Check in 85 Booking b6 checks in b1 b2 b3 b4 b5 b6

102 Use 86 Booking b6 uses the room. b1 b2 b3 b4 b5 b6 Booking b3 becomes a past booking

103 Use 87 - Booking b5 uses the room. b1 b2 b3 b4 b5 b6 Open booking b6 becomes a past booking. NOT ALLOWED. Before using a room, one must be sure that its user has checked out. This point will be solved "naturally" in the next refinement

104 DEMO 88

105 1st Data-refinement 89 b1 b2 b3 b4 b4 b6 Abstract (set) b1 b2 b3 b4 b4 b Concrete (sequence)

106 b1 1

107 b1 b2 1 2

108 b1 b2 1 2

109 b1 b2 1 2

110 b1 b2 b

111 b1 b2 b

112 b1 b2 b

113 b1 b2 b3 b

114 b1 b2 b3 b

115 b1 b2 b3 b4 b

116 b1 b2 b3 b4 b

117 b1 b2 b3 b4 b5 b

118 b1 b2 b3 b4 b5 b

119 b1 b2 b3 b4 b5 b

120 b1 b2 b3 b4 b5 b

121 DEMO 90

122 2nd Data-refinement 91 b1 b2 b3 b4 b4 b Abstract (sequence) b1 b2 b3 b4 b4 b6 Concrete (chain)

123 b1

124 b1 b2

125 b1 b2

126 b1 b2

127 b1 b2 b3

128 b1 b2 b3

129 b1 b2 b3

130 b1 b2 b3 b4

131 b1 b2 b3 b4

132 b1 b2 b3 b4 b5

133 b1 b2 b3 b4 b5

134 b1 b2 b3 b4 b5 b6

135 b1 b2 b3 b4 b5 b6

136 b1 b2 b3 b4 b5 b6

137 b1 b2 b3 b4 b5 b6

138 DEMO 92

139 3rd Data-refinement 93 b1 b2 b3 b4 b5 b6 Abstract (chain) b1 b2 b3 b4 b5 b6 Concrete (card)

140 b1

141 b1 b2

142 b1 b2

143 b1 b2

144 b1 b2 b3

145 b1 b2 b3

146 b1 b2 b3

147 b1 b2 b3 b4

148 b1 b2 b3 b4

149 b1 b2 b3 b4 b5

150 b1 b2 b3 b4 b5

151 b1 b2 b3 b4 b5 b6

152 b1 b2 b3 b4 b5 b6

153 b1 b2 b3 b4 b5 b6

154 b1 b2 b3 b4 b5 b6

155 DEMO 94

156 4th Data-refinement 95 b1 b2 b3 b4 b5 b6 Abstract (card) b1 b2 b3 b4 b5 b6 Concrete (card and guest) g1 g2 g3 g4 g5

157 b1

158 b1 b2 g1

159 b1 b2 g1

160 b1 b2 b3 g1 g2

161 b1 b2 b3 g1 g2

162 b1 b2 b3 g1 g2

163 b1 b2 b3 b4 g1 g2 g3

164 b1 b2 b3 b4 g1 g2 g3

165 b1 b2 b3 b4 b5 g1 g2 g3 g4

166 b1 b2 b3 b4 b5 g1 g2 g3 g4

167 b1 b2 b3 b4 b5 b6 g1 g2 g3 g4

168 b1 b2 b3 b4 b5 b6 g1 g2 g3 g4 Here, we have a serious problem Guest g3 has got two cards (he never used the old one) He figures out that the new one does not open the room So, he tries the old one, which allows him to enter into the room he booked But he is not safe: guest g4 can enter the room

169 Solution 96 - Never use an old card, event if it opens the room - Go back to the lobby - Ask someone to open the door with a master-card

170 DEMO 97

171 Summary of Data-refinements 98 b1 b2 b3 b4 b5 b6 set b1 b2 b3 b4 b5 b sequence b1 b2 b3 b4 b5 b6 chain b1 b2 b3 b4 b5 b6 card b1 b2 b3 b4 b5 b6 card and guest g1 g2 g3 g4 g5

172 Conclusion 99 - We ve done our best to build a professional tool - Use it, it s fun - We are in the process of constructing a Rodin Platform web-site - Give us any feedback

173 Thanks for listening