We explain the main ingredients of the Abstract State Machines (ASM) method for high-level system design and analysis and survey some of its application highlights in industrial software-based system engineering. We illustrate the method by defining models for three simple control systems (sluice gate, traffic light, package router) and by characterising Event-B machines as a specific class of ASMs.We point to directions for future research and applications of the method in other areas than software engineering.

/pdf/the-abstract-state-machines-method-for-high-level-system-3lbmgz1yfy.pdf

The Abstract State Machines Method for High-Level System Design and Analysis

We present PROB, an animation and model checking tool for the B method PROB's animation facilities allow users to gain confidence in their specifications, and unlike the animator provided by the B-Toolkit, the user does not have to guess the right values for the operation arguments or choice variables PROB contains a model checker and a constraint-based checker, both of which can be used to detect various errors in B specifications We present our first experiences in using PROB on several case studies, highlighting that PROB enables users to uncover errors that are not easily discovered by existing tools

ProB: A model checker for B

Embeddedsystemsareofgrowingimportanceinindustry. Forexample,inatoday'svehicleahugenumberofembeddedandcommunicating systems can be found. Exhaustive testing of such systems is a requirement, because changes after deliveryand use are expensive and sometimes even impossible. In this paper we propose the use of qualitative models, which are anabstraction of quantitative physical models, for test case generation and test execution. In particular, we show how Simulinkmodels from which control programs are automatically extracted can be tested with respect to qualitative models. SinceSimulink models are heavily used in industry, the approach is of practical interest.Keywords: conformance testing, hybrid systems, qualitative reasoning, qrioconf, Garp3 1 Introduction In industry and especially in the automotive industry Simulink is often used to implementcontrol programs for various purposes. One reason is that those models can be directlyconverted into C code, which runs on the vehicle's electronic control units (ECUs). As aconsequence Simulink models have to be tested thoroughly. This holds in particular forsafety critical systems. In order to meet the safety and quality criteria of such modelsautomated test case generation and more specically model-based testing is of specicinterest but has hardly been explored. In order to ll this gap we present an approach thatmakes use of qualitative models for model-based test cases generation.Qualitative models represent basically cause-effect relationships and constraints onmodel variables. They can be seen as an abstraction of the usually implemented quan-titative differential equation models when using Simulink or other modeling languages.Hence, Simulink models are a renement of qualitative models. This is in contrast to theuse of other means for representing models in this domain like hybrid automata, whichshares basically the same abstraction level with Simulink models.Inordertoallowforusingqualitativemodelsformodel-basedtestingwehavetospecifythe equality relation between the specication and the implementation. For this purpose

Electronic Notes in Theoretical Computer Science

We present ProB, a validation toolset for the B method. ProB’s automated animation facilities allow users to gain confidence in their specifications. ProB also contains a model checker and a refinement checker, both of which can be used to detect various errors in B specifications. We describe the underlying methodology of ProB, and present the important aspects of the implementation. We also present empirical evaluations as well as several case studies, highlighting that ProB enables users to uncover errors that are not easily discovered by existing tools.

/pdf/prob-an-automated-analysis-toolset-for-the-b-method-1om3xs7yb5.pdf

ProB : an automated analysis toolset for the B method

The automatic train operating system for METEOR, the first driverless metro in the city of Paris, is designed to manage the traffic of the vehicles controlled automatically or manually. This system, developed by Matra Transport International for the RATP, requires a very high level of dependability and safety for the users and the operator. To achieve this, the safety critical software located in the different control units (ground, line and on-board) was developed using the B formal method together with the Vital Coded Processor. This architecture thus ensures an optimum level of safety agreed with the customer. This experience with the METEOR project has convinced Matra Transport International of the advantages of using this B formal method for large-scale industrial developments.

/pdf/meteor-a-successful-application-of-b-in-a-large-project-4vkyyczhng.pdf

Frank Waters

Papers

The B Book