Correct‐by‐construction specification to verified code

Abstract

Event‐B is a formal notation and method for the systems development. The key feature of this method is to produce correct‐by‐construction system designs. Once the correct design is established, the remaining work is to generate or implement correct code from the design. Two main problems remain in the process from the correct‐by‐construction design to the correct software. First, the Event‐B design is “quasi‐correct” due to some technical limitations. For instance, it is still difficult to prove the liveness properties by the Rodin platform; it is not possible to construct the Event‐B design with floating‐point arithmetic, and sometimes, the Event‐B model is incomplete and must rely on the third‐party libraries. Therefore, a method is needed to complement these modeling and proof gaps. Secondly, proving the correctness of an automatic code generator is very difficult; therefore, a method is needed to guarantee the correctness of the produced code without proving the code generator. In this article, we address the above 2 problems by introducing an intermediate formal language called High‐Level Language (HLL) between the Event‐B models and the C code. The Event‐B model is translated to HLL with an additional schedule configuration, where Event‐B invariants and system invariants (here, deadlock‐freeness and liveness properties) are proved using a SAT‐based model checker called S3. This proof guarantees the correctness of the HLL model with respect to the Event‐B model. The C code is then automatically generated from the HLL model for most functions and is manually implemented for the third‐party ones according to the function contracts defined in Event‐B. The correctness of the generated C code is guaranteed using the equivalence proof, and the correctness of the implemented C code is guaranteed using the conformance proof. Through the article, we use a traffic light controller to illustrate the proposed method; then, we apply the method to an automatic protection function of a 3‐wheeled robot to evaluate its feasibility.

Simulation-Based Invariant Verification Technique for the OTS/CafeOBJ Method

“…We mention some recent advancements on refinement/simulation. Ge, et al [22] point out that there are two challenges when developing software systems with Even-B: (1) generating/writing executable programs based on the final Even-B models obtained by a series of refinements and (2) the proof gaps in the Event-B method and the tools, such as Rodin. To address the two challenges, they have proposed an intermediate verification language called High-Level Language (HLL ) between Event-B model and C programming language.…”

Formal development process of safety-critical embedded human machine interface systems

“…The design and verification approach presented in this paper has been applied on the Alert Management System (AMS) used by TwIRTee, a small three-wheeled robot studied in the INGEQUIP project to experiment and evaluate methods and tools in the domain of HW/SW co-design [18] and formal verification [16] [17] [19] [20].…”

“…Another direction is to use the Event-B [24] correct by construction method. Once the final refinement of design is obtained, the verification of generated code is handled by tools such as the ones advocated in [19].…”

B-PERFect

“…A predicate expression is evaluated to be true or false in B0 as branching conditions of if substitutions or in while loops. Except for division, the translation of B expressions and B predicates is straightforward because HLL provides the same quantifiers as B [15].…”

“…In Singh et al [14], a tool supported code generator, namely EB2ALL, producing source code in many programming languages from verified Event-B specifications is described. Following similar principles, Ge et al [15] have proposed an approach for translating Event-B models into HLL models. In fact, the main objective of this work is to produce C code from Event-B specification using an intermediate HLL representation.…”