Chunks: Component Verification in CSPB

1
Chunks Component Verification in CSPB

• Steve Schneider, Helen Treharne, Neil Evans
• University of Surrey AWE
• http//www.csp-b.org

2
CSP Controlled B machines

• (Classical) B machines as concurrent components
  (good for data-rich aspects)
• CSP processes as controllers (good for patterns
  of communication)
• Combination underpinned by CSP semantics for B
• Tap into tools for CSP and for B

CSP process
B operations
B machine
3
CSP fragment

• Various semantic models

4
CSPB Example
Classical B machine
CSP controller
MACHINE Switch VARIABLES switch INITIALISATION
switch off OPERATIONS light PRE switch
off THEN switch on END
dark PRE switch on THEN switch
off END END
5
Consistency

• Operations must be called within their
  preconditions
• Established, and developing, techniques available
  (based on wp semantics) for establishing
  consistency between a single controller and a
  controlled machine
• Consistency expressed as divergence-freedom
• Divergence-freedom means operations called within
  their preconditions

6
Combine componentsthe basic architecture
CSP
CSP
CSP
B
B
B

• System divergence-free if each pair is

• System deadlock-free if CSP part is.

• System meets particular specs if CSP part does

7
Finished? Not quite.Odd-Even example
oepass.8
eopass.9
odd_get.7
odd_set.9
even_get.8
even_set.8
MACHINE Even VARIABLES mm INVARIANT
even(mm) OPERATIONS even_set(ii) PRE
even(ii) THEN mm ii END jj lt--
even_get jj mm END
MACHINE Odd VARIABLES nn INVARIANT
odd(nn) OPERATIONS odd_set(ii) PRE
odd(ii) THEN nn ii END jj lt-- odd_get
jj nn END
8
Component Consistency
Guarantees m even
oepass.m1
even(m)
eopass?n
ltodd(n)gt
diverging assertion
odd_get.m
odd_set.n
Introduce blocking assertion
Consistency relies on n being odd
MACHINE Odd odd_set(ii) PRE odd(ii)
THEN nn ii END END
Consistency of ODD_CTRL and Odd guarantees m
even under assumption of n odd
9
Lifting state

• Sometimes we need to relate assertions to the B
  state
• To do this, we lift relevant state to the CSP
  level

transfer.tim
but T not in CSP part
add.tim
10
Interaction
transfer.tim
add.tim
take.tim
11
Decomposing requirements
12
Chunks discharging proof obligations (chunks
theorem)

• Split the network into chunks subsets of the
  CSP controllers and B machines. Each assertion
  needs to be diverging in at least one chunk.
• Chunks need to be divergence-free this can be
  checked by FDR (for pure CSP parts) or by wp
  techniques (CSPB technique). ProB is also
  applicable here.
• Then the system is divergence-free

13
Chunks
P
ltPgt
P
Every predicate must have a chunk where it
diverges (verify) In other chunks it can block
(assumption)
14
Summary

• An ability to compose CSP and B, and their
  combinations
• Supports a combination of control flow and data
  manipulation/handling
• Current directions more flexible architectures
  richer interactions between CSP and B
  relationship with s/w development methods
• 
  see next talk