Handling Refinement of Continuous Behaviors: A Proof Based Approach with Event-B

Abstract

Cyber-physical systems (CPS) are taking a crucial role in various areas of our society and industry. Yet, because of their hybrid nature (i.e. the integration of both continuous and discrete features), their design and verification are not easy to handle, in particular when they are part of a critical system. Their certification requires to exhibit a formal argumentation that formal methods should be able to provide.This paper addresses the formal development of CPS using correct-by-construction refinement and proof based approaches. It relies on the Event-B formal method. In addition to modeling both the discrete and continuous parts of a CPS, this paper presents a novel approach in two steps.First it shows that the generic formal model we have defined, integrating both discrete and continuous behaviors, can be instantiated by various kinds of CPS. Fundamentally, continuous behaviors modeled by differential equations mingle with discrete transition systems (mode automaton), which model discrete behaviors. Here, refinement is used as a decomposition mechanism.Second, it expands the refinement operation, well mastered in the discrete world, to cover continuous behaviors. We show that different levels of abstraction of continuous aspects can be glued in a refinement chain. The proposed approach has been completely formalized using Event-B on the Rodin platform and a case study based on water tanks is used to illustrate it.

An Event-B Based Generic Framework for Hybrid Systems Formal Modelling

“…The generic framework for formal modelling and verification of hybrid systems relies on the various developments we have conducted to model and verify different types of hybrid systems [10][11][12][13]. These developments revealed several reusable building blocks seen as formal development patterns formalised in Event-B.…”

“…These specific patterns introduce either centralised or distributed control and one or many controlled plants. Three Event-B models refining the generic model define three architecture patterns as Single-ToSingle [12], SingleToMany [11] and ManyToMany [13].…”

“…We thus need to access specific mathematical objects and properties, which are not natively available in Event-B. These concepts such as differential equations and their associated properties have been modelled through an intensive use of Event-B theories and have been used to model various case studies found in [10][11][12]. This section describes the generic resources used by the defined framework.…”

“…The most common methods use hybrid automata [3] to model such systems and hybrid model checking [4,14,15,18] to verify their properties. In addition, some other approaches such as hybrid CSP [9,19], hybrid programs [20,21], continuous action systems [5], refinement and proof based methods with Event-B [11][12][13]22] and Hybrid Event-B [6], have been developed as well.…”

“…In previous work, we extended Event-B modelling language via the development of various theories to design hybrid systems using a correct-by-construction approach [11][12][13]22]. Theories for continuous mathematics, an approximate refinement relation for approximation following the retrenchment principle [7] and different hybrid systems architectures have been formally modelled.…”