Rodin User's Handbook Covers Rodin v.2.8 Michael Jastram (Editor) Foreword by Prof. Michael Butler This work is sponsored by the Deploy Project Contents Contents 1 Preface 7 Foreword 9 1 Introduction 11 1.1 Overview...................................... 11 1.1.1 Formats of this Handbook........................ 12 1.1.2 Rodin Wiki................................ 12 1.1.3 Contributing............................... 12 1.2 Further Reading.................................. 12 1.2.1 Modeling in Event-B: System and Software Engineering, J.-R. Abrial (2010)................................... 12 1.2.2 Rodin: An Open Toolset for Modelling and Reasoning in Event-B (2009) 13 1.2.3 The B-Method, an Introduction (Steve Schneider)........... 13 1.2.4 Event-B Cookbook............................ 13 1.2.5 Proofs for the Working Engineer (2008)................. 13 1.2.6 The Proof Obligation Generator (2005)................. 14 1.3 Conventions.................................... 14 1.4 Acknowledgements................................ 14 1.5 DEPLOY..................................... 15 1.6 Creative Commons Legal Code......................... 15 2 Tutorial 17 2.1 Outline....................................... 17 2.2 Before Getting Started.............................. 18 2.2.1 Systems Development........................... 19 2.2.2 Formal Modelling............................. 19 2.2.3 Predicate Logic.............................. 19 2.2.4 Event-B.................................. 20 2.2.5 Rodin................................... 20 2.2.6 Eclipse................................... 20 1 2.3 Installation.................................... 20 2.3.1 Install Rodin for the first time...................... 21 2.3.2 Install new plugins............................ 23 2.4 The First Machine: A Traffic Light Controller................. 23 2.4.1 Excursus: The specification process................... 25 2.4.2 Project Setup............................... 26 2.4.3 Camille, a text-based editor....................... 28 2.4.4 Building the Model............................ 28 2.4.5 The Final Traffic Light Model...................... 33 2.5 Mathematical notation.............................. 36 2.5.1 Predicates................................. 36 2.5.2 Data types................................. 37 2.5.3 Operations on Sets............................ 38 2.5.4 Introducing user-defined types...................... 38 2.5.5 Relations................................. 39 2.5.6 Arithmetic................................. 39 2.6 Introducing Contexts............................... 40 2.6.1 Create a Context............................. 40 2.6.2 Populate the Context........................... 40 2.6.3 The Final Context............................ 45 2.7 Event-B Concepts................................. 45 2.7.1 Contexts.................................. 46 2.7.2 Machines................................. 47 2.7.3 Events................................... 47 2.7.4 Refinement................................ 48 2.8 Contexts and Refinement............................. 50 2.8.1 Data Refinement............................. 50 2.8.2 A Context with Colours......................... 51 2.8.3 The Actual Data Refinement...................... 52 2.8.4 The refined machine with data refinement for peds go......... 54 2.8.5 Witnesses................................. 55 2.8.6 Discussion................................. 57 2.8.7 The Refined Machine with All Data Refinement............ 57 2.8.8 One more Refinement: The Push Button................ 58 2.8.9 Discussion................................. 60 2.9 Proving...................................... 60 2.9.1 The Celebrity Problem.......................... 60 2.9.2 Importing a project............................ 61 2.9.3 Fixing Problems............................. 61 2.9.4 The Final Second Refinement...................... 63 2.9.5 The Celebrity algorithm......................... 64 2.9.6 The First Proof.............................. 66 2.9.7 Proving | an Art or a Science?..................... 70 2.10 Proving Deadlock Freeness............................ 72 2.10.1 Deadlock Freeness of initial model.................... 72 2.10.2 Deadlock Freeness of First Refinement................. 79 2.11 Outlook...................................... 82 3 Reference 85 3.1 The Rodin Platform............................... 85 3.1.1 Eclipse in General............................. 85 3.1.2 The Event-B Perspective......................... 87 3.1.3 Customizing a perspective suitable for RODIN............. 89 3.1.4 The Event-B Editor............................ 92 3.1.5 The Structural Event-B Editor..................... 92 3.1.6 Wizards.................................. 98 3.1.7 The Proving Perspective......................... 102 3.1.8 Preferences................................ 115 3.2 Event-B's modelling notation.......................... 125 3.2.1 About the notation that we use..................... 125 3.2.2 Substitutions............................... 126 3.2.3 Contexts.................................. 126 3.2.4 Machines................................. 127 3.2.5 Well-definedness proof obligations.................... 135 3.2.6 Theorems................................. 136 3.2.7 Generated proof obligations....................... 137 3.2.8 Visibility of identifiers.......................... 137 3.3 Mathematical Notation.............................. 139 3.3.1 Introduction................................ 139 3.3.2 Predicates................................. 142 3.3.3 Booleans.................................. 144 3.3.4 Sets.................................... 144 3.3.5 Relations................................. 149 3.3.6 Arithmetic................................. 155 3.3.7 Typing................................... 156 3.3.8 Assignments................................ 157 3.4 Proving...................................... 159 3.4.1 Sequents.................................. 159 3.4.2 Proof Rules................................ 159 3.4.3 Proof Tactics............................... 161 3.4.4 Provers.................................. 162 3.4.5 How to Use the Provers Effectively................... 164 3.4.6 Reasoners................................. 165 3.4.7 Purging Proofs.............................. 166 3.4.8 Simplifying Proofs............................ 167 4 Frequently Asked Questions 169 4.1 General Questions................................. 169 4.1.1 Where can I get help?.......................... 169 4.1.2 What is Event-B?............................. 169 4.1.3 What is the difference between Event-B and the B method?..... 169 4.1.4 What is Rodin?.............................. 169 4.1.5 Where does the Rodin name come from?................ 170 4.1.6 Where I can download Rodin?...................... 170 4.1.7 How to contribute and develop?..................... 170 4.1.8 My operating system is not supported! How can I install Rodin on my platform?................................. 170 4.2 General Tool Usage................................ 170 4.2.1 Do I lose my proofs when I clean a project?.............. 170 4.2.2 How do I install external plugins without using the Eclipse Update Manager?................................. 171 4.2.3 The builder takes too long........................ 171 4.2.4 What are the ASCII shortcuts for mathematical operators?...... 172 4.2.5 Pretty Print does not work on Linux.................. 172 4.2.6 Some mathematical characters are wrong................ 172 4.2.7 No More Handles............................. 172 4.2.8 Software installation fails......................... 172 4.2.9 How do I send a bug report?....................... 173 4.2.10 Where did the GUI window go?..................... 173 4.2.11 Where vs. When: What's going on?................... 173 4.3 Modelling..................................... 174 4.3.1 Witness for Xyz missing. Default witness generated.......... 174 4.3.2 Identifier Xyz should not occur free in a witness............ 174 4.3.3 Witness Xyz must be a disappearing abstract variable or parameter in the INITIALISATION event........................ 174 4.3.4 I've added a witness for Xyz but it keeps saying \Identifier Xyz has not been defined”............................... 174 4.3.5 How can I create a new Event-B Project?............... 174 4.3.6 How can I remove a Event-B Project?.................. 175 4.3.7 How can I export an Event-B Project?................. 175 4.3.8 How can I import a Event-B Project?.................. 175 4.3.9 How can I change the name of a Event-B Project?........... 176 4.3.10 How can I create a Event-B Component?................ 176 4.3.11 How can I remove a Event-B Component?............... 176 4.3.12 In the new Rodin Editor, how can I add an element to machine?... 176 4.3.13 How can I use multiple lines for a comment, predicate or expression (using the new editor)?.......................... 177 4.3.14 How can I save a Context or a Machine?................ 177 4.4 Proving...................................... 178 4.4.1 Help! Proving is difficult!......................... 178 4.4.2 How can I do a Proof by Induction?................... 178 4.4.3 What do the labels on the proof tree mean?.............. 178 Index 179 Preface Nobody likes to write documentation, yet everybody agrees that documentation is crucially important. For a tool platform as complex as Rodin, documentation is necessary if it is supposed to succeed in reaching a wider audience. The executive team of the DEPLOY project recognized this. In a meeting at ETH in 2010, the team established, amongst other things, that \it is clear that the current