We present PROB, an animation and model checking tool for the B method PROB's animation facilities allow users to gain confidence in their specifications, and unlike the animator provided by the B-Toolkit, the user does not have to guess the right values for the operation arguments or choice variables PROB contains a model checker and a constraint-based checker, both of which can be used to detect various errors in B specifications We present our first experiences in using PROB on several case studies, highlighting that PROB enables users to uncover errors that are not easily discovered by existing tools

ProB: A model checker for B

The GRACE International Meeting on Bidirectional Transformations was held in December 2008 near Tokyo, Japan. The meeting brought together researchers and practitioners from a variety of sub-disciplines of computer science to share research efforts and help create a new community. In this report, we survey the state of the art and summarize the technical presentations delivered at the meeting. We also describe some insights gathered from our discussions and introduce a new effort to establish a benchmark for bidirectional transformations.

Bidirectional Transformations: A Cross-Discipline Perspective

Boolean Satisfiability (SAT) has seen many successful applications in various fields such as Electronic Design Automation and Artificial Intelligence. However, in some cases, it may be required/preferable to use variations of the general SAT problem. In this paper, we consider one important variation, the Partial MAX-SAT problem. Unlike SAT, Partial MAX-SAT has certain constraints (clauses) that are marked as relaxable and the rest are hard, i.e. non-relaxable. The objective is to find a variable assignment that satisfies all non-relaxable clauses together with the maximum number of relaxable ones. We have implemented two solvers for the Partial MAX-SAT problem using a contemporary SAT solver, zChaff. The first approach is a novel diagnosis based algorithm; it iteratively analyzes the UNSAT core of the current SAT instance and eliminates the core through a modification of the problem instance by adding relaxation variables. The second approach is encoding based; it constructs an efficient auxiliary counter that constrains the number of relaxed clauses and supports binary search or linear scan for the optimal solution. Both solvers are complete as they guarantee the optimality of the solution. We discuss the relative strengths and thus applicability of the two solvers for different solution scenarios. Further, we show how both techniques benefit from the persistent learning techniques of incremental SAT. Experiments using practical instances of this problem show significant improvements over the best known solvers.

On solving the partial MAX-SAT problem

Invited Talk.- The Embedded Systems Design Challenge.- Interactive Verification.- The Mondex Challenge: Machine Checked Proofs for an Electronic Purse.- Interactive Verification of Medical Guidelines.- Certifying Airport Security Regulations Using the Focal Environment.- Proving Safety Properties of an Aircraft Landing Protocol Using I/O Automata and the PVS Theorem Prover: A Case Study.- Invited Talk.- Validating the Microsoft Hypervisor.- Formal Modelling of Systems.- Interface Input/Output Automata.- Properties of Behavioural Model Merging.- Automatic Translation from Circus to Java.- Quantitative Refinement and Model Checking for the Analysis of Probabilistic Systems.- Real Time.- Modeling and Validating Distributed Embedded Real-Time Systems with VDM++.- Towards Modularized Verification of Distributed Time-Triggered Systems.- Industrial Experience.- A Story About Formal Methods Adoption by a Railway Signaling Manufacturer.- Partially Introducing Formal Methods into Object-Oriented Development: Case Studies Using a Metrics-Driven Approach.- Specification Refinement.- Compositional Class Refinement in Object-Z.- A Proposal for Records in Event-B.- Pointfree Factorization of Operation Refinement.- A Formal Template Language Enabling Metaproof.- Progrmming Languages.- Dynamic Frames: Support for Framing, Dependencies and Sharing Without Restrictions.- Type-Safe Two-Level Data Transformation.- Algebra.- Feature Algebra.- Education.- Using Domain-Independent Problems for Introducing Formal Methods.- Formal Modelling of Systems.- Compositional Binding in Network Domains.- Formal Modeling of Communication Protocols by Graph Transformation.- Feature Specification and Static Analysis for Interaction Resolution.- A Fully General Operational Semantics for UML 2.0 Sequence Diagrams with Potential and Mandatory Choice.- Formal Aspects of Java.- Towards Automatic Exception Safety Verification.- Enforcer - Efficient Failure Injection.- Automated Boundary Test Generation from JML Specifications.- Formal Reasoning About Non-atomic Java Card Methods in Dynamic Logic.- Programming Languages.- Formal Verification of a C Compiler Front-End.- A Memory Model Sensitive Checker for C#.- Changing Programs Correctly: Refactoring with Specifications.- Mechanical Verification of Recursive Procedures Manipulating Pointers Using Separation Logic.- Model Checking.- Model-Based Variable and Transition Orderings for Efficient Symbolic Model Checking.- Exact and Approximate Strategies for Symmetry Reduction in Model Checking.- Monitoring Distributed Controllers: When an Efficient LTL Algorithm on Sequences Is Needed to Model-Check Traces.- PSL Model Checking and Run-Time Verification Via Testers.- Industry Day: Abstracts of Invited Talks.- Formal Methods for Security: Lightweight Plug-In or New Engineering Discipline.- Formal Methods in the Security Business: Exotic Flowers Thriving in an Expanding Niche.- Connector-Based Software Development: Deriving Secure Protocols.- Model-Based Security Engineering for Real.- Cost Effective Software Engineering for Security.- Formal Methods and Cryptography.- Verified Software Grand Challenge.

FM 2006 : Formal Methods : 14th International Symposium on Formal Methods Hamilton, Canada, August 21-27, 2006 : proceedings

Bidirectional transformations (bx) support principled consistency maintenance between data sources. Each data source corresponds to one perspective on a composite system, manifested by operations to ‘get’ and ‘set’ a view of the whole from that particular perspective. Bx are important in a wide range of settings, including databases, interactive applications, and model-driven development. We show that bx are naturally modelled in terms of mutable state; in particular, the ‘set’ operations are stateful functions. This leads naturally to considering bx that exploit other computational effects too, such as I/O, nondeterminism, and failure, all largely ignored in the bx literature to date. We present a semantic foundation for symmetric bidirectional transformations with effects. We build on the mature theory of monadic encapsulation of effects in functional programming, develop the equational theory and important combinators for effectful bx, and provide a prototype implementation in Haskell along with several illustrative examples.

/pdf/notions-of-bidirectional-computation-and-entangled-state-453r5miwwl.pdf

Notions of Bidirectional Computation and Entangled State Monads

QVT Relations (QVT-R) is the standard language proposed by the OMG to specify bidirectional model transformations. Unfortunately, in part due to ambiguities and omissions in the original semantics, acceptance and development of effective tool support has been slow. Recently, the checking semantics of QVT-R has been clarified and formalized. In this paper we propose a QVT-R tool that complies to such semantics. Unlike any other existing tool, it also supports meta-models enriched with OCL constraints (thus avoiding returning ill-formed models), and proposes an alternative enforcement semantics that works according to the simple and predictable "principle of least change". The implementation is based on an embedding of both QVT-R transformations and UML class diagrams (annotated with OCL) in Alloy, a lightweight formal specification language with support for automatic model finding via SAT solving.

/pdf/implementing-qvt-r-bidirectional-model-transformations-using-3oo7xc8eaw.pdf

Implementing QVT-R bidirectional model transformations using alloy

Consistency management, the ability to detect, diagnose and handle inconsistencies, is crucial during the development process in Model-driven Engineering (MDE). As the popularity and application scenarios of MDE expanded, a variety of different techniques were proposed to address these tasks in specific contexts. Of the various stages of consistency management, this work focuses on inconsistency handling in MDE, particularly in model repair techniques. This paper proposes a feature-based classification system for model repair techniques, based on an systematic literature review of the area. We expect this work to assist developers and researchers from different disciplines in comparing their work under a unifying framework, and aid MDE practitioners in selecting suitable model repair approaches.

/pdf/a-feature-based-classification-of-model-repair-approaches-51po5hxlp8.pdf

A Feature-Based Classification of Model Repair Approaches

Model-driven engineering (MDE) is a software engineering approach based on model transformations at different abstraction levels It prescribes the development of software by successively transforming the models from abstract (specifications) to more concrete ones (code) Alloy is an increasingly popular lightweight formal specification language that supports automatic verification Unfortunately, its widespread industrial adoption is hampered by the lack of an ecosystem of MDE tools, namely code generators This paper presents a model transformation from Alloy to UML class diagrams annotated with OCL (UML+OCL) and shows how an existing transformation from UML+OCL to Alloy can be improved to handle dynamic issues The proposed bidirectional transformation enables a smooth integration of Alloy in the current MDE contexts, by allowing UML+OCL specifications to be transformed to Alloy for validation and verification, to correct and possibly refine them inside Alloy, and to translate them back to UML+OCL for sharing with stakeholders or to reuse current model-driven architecture tools to refine them toward code

/pdf/translating-between-alloy-specifications-and-uml-class-2zqi2toaoz.pdf

Translating between Alloy specifications and UML class diagrams annotated with OCL

QVT Relations (QVT-R) is the standard language proposed by the OMG to specify bidirectional model transformations. Unfortunately, in part due to ambiguities and omissions in the original semantics, acceptance and development of effective tool support have been slow. Recently, the checking semantics of QVT-R has been clarified and formalized. In this article, we propose a QVT-R tool that complies to such semantics. Unlike any other existing tool, it also supports meta-models enriched with OCL constraints (thus avoiding returning ill-formed models) and proposes an alternative enforcement semantics that works according to the simple and predictable "principle of least change." The implementation is based on an embedding of both QVT-R transformations and UML class diagrams (annotated with OCL) in Alloy, a lightweight formal specification language with support for automatic model finding via SAT solving. We also show how this technique can be applied to bidirectionalize ATL, a popular (but unidirectional) model transformation language.

/pdf/least-change-bidirectional-model-transformation-with-qvt-r-321jq299tw.pdf

Least-change bidirectional model transformation with QVT-R and ATL

Model-checking is increasingly popular in the early phases of the software development process. To establish the correctness of a software design one must usually verify both structural and behavioral (or temporal) properties. Unfortunately, most specification languages, and accompanying model-checkers, excel only in analyzing either one or the other kind. This limits their ability to verify dynamic systems with rich configurations: systems whose state space is characterized by rich structural properties, but whose evolution is also expected to satisfy certain temporal properties. To address this problem, we first propose Electrum, an extension of the Alloy specification language with temporal logic operators, where both rich configurations and expressive temporal properties can easily be defined. Two alternative model-checking techniques are then proposed, one bounded and the other unbounded, to verify systems expressed in this language, namely to verify that every desirable temporal property holds for every possible configuration.

/pdf/lightweight-specification-and-analysis-of-dynamic-systems-2m3xsoqeh7.pdf

Alcino Cunha

Papers

Implementing QVT-R bidirectional model transformations using alloy

A Feature-Based Classification of Model Repair Approaches

Translating between Alloy specifications and UML class diagrams annotated with OCL

Least-change bidirectional model transformation with QVT-R and ATL

Lightweight specification and analysis of dynamic systems with rich configurations