Abstract. In this paper we describe the successful application of the ProB tool for data validation in several industrial applications. The initial case study centred on the San Juan metro system installed by Siemens. The control software was developed and formally proven with B. However, the development contains certain assumptions about the actual rail network topology which have to be validated separately in order to ensure safe operation. For this task, Siemens has developed custom proof rules for Atelier B. Atelier B, however, was unable to deal with about 80 properties of the deployment (running out of memory). These properties thus had to be validated by hand at great expense, and they need to be revalidated whenever the rail network infrastructure changes. In this paper we show how we were able to use ProB to validate all of the about 300 properties of the San Juan deployment, detecting exactly the same faults automatically in a few minutes that were manually uncovered in about one man-month. We have repeated this task for three ongoing projects at Siemens, notably the ongoing automatisation of the line 1 of the Paris Métro. Here again, about a man month of effort has been replaced by a few minutes of computation. This achievement required the extension of the ProB kernel for large sets as well as an improved constraint propagation algorithm. We also outline some of the effort and features that were required in moving from a tool capable of dealing with medium-sized examples towards a tool able to deal with actual industrial specifications. We also describe the issue of validating ProB, so that it can be integrated into the SIL4 development chain at Siemens. • This article describes the use of our technique in three active deployments, namely the upgrading of the Paris Metro Line 1 for driverless trains, line 4 of the São Paulo metro and line 9 of the Barcelona metro. We also briefly report on experiments on the models of the CDGVAL shuttle. The paper [LFFP09] only contained the initial San Juan case study, which was used to evaluate the potential of our approach.Correspondence and offprint requests to: M. Leuschel, E-mail: leuschel@cs.uni-duesseldorf.de • In this article we describe the previous method adopted by Siemens in much more detail, as well as explaining the performance issues with Atelier B.• More comparisons and empirical evaluations with other potential approaches and alternate tools (Brama, AnimB, BZ-TT and TLC) have been conducted.• We provide more details about the ongoing validation process of ProB, which is required by Siemens for it to use ProB to replace the existing method. The validation also lead to the discovery of errors in the English version of the Atelier B reference manual.Also, since [LFFP09], ProB itself has been further improved inspired by the application, resulting in new optimisations in the kernel (cf. Sect. 3.2).

No abstract

Initially, the Rodin platform for Event‐B did away with a textual representation for models. In this paper, we explain why a textual representation was required after all and we present the semantic‐aware text editor Camille for Rodin. We explain the design choices of Camille, such as splitting the syntax into two‐levels for machine and formula syntax. We also describe the challenges, such as synchronizing the textual representation with the Rodin database, and how they were overcome using an EMF abstraction layer. Copyright © 2011 John Wiley & Sons, Ltd.

No abstract