What is the B method ?

The B method is a formal method for specifying and designing correct-by-construction systems and software.
The two main characteristics of the B method are refinement and proof.

refinement is a technique for transforming a specification into a design, by adding progressively implementation details.
mathetical proof enables to demonstrate, in any case, the functionnal correctness of a design regarding its specification.

What is refinement?

A refinement is a transformation of a model into another model. The new model is more concrete than the initial model: data are closer to implementation, algorithms are made more explicit.

data refinement: a variable is given a more concrete type or a variable is replaced by one are several other variables.

Examples:

VARIABLES 
 xx
INVARIANT
 xx : INTEGER

VARIABLES 
 xx
INVARIANT
 xx : 0..9

In this case, the type of the variable xx is made more explicit, refined from INTEGER to the interval 0..9.

VARIABLES 
 xx
INVARIANT
 xx : INTEGER

VARIABLES 
 yy, zz
INVARIANT
 yy : BOOL &
 zz : BOOL &
 zz = bool(xx >= 15) &
 yy = bool((xx mod 2) = 0)

In this case, the two predicates

 zz = bool(xx >= 15) &
 yy = bool((xx mod 2) = 0)

are called "gluing invariant" as they are the glue between the variable xx defined in the abstraction and the variables yy and zz defined in the refinement.

algorithm refinement: transformations (also called subsitutions) are made more deterministic, more explicit.

Examples:

 
op = 
BEGIN
	xx :: INTEGER
END

op =
BEGIN
	xx := 1
END

The substitution xx :: INTEGER (xx is valued with any integer value) is made more explicit with xx := 1 (xx is valued with 1).

 
op = 
BEGIN
	xx :: INTEGER
END

op =
ANY yy, zz WHERE
	yy: INTEGER &
	zz : INTEGER &
	yy : 1..10 &
	zz mod 2 = 0
THEN
	xx := yy * zz
END

xx is valued with the product of one integer, belonging to the interval 1..10, with an even integer.

 
op = 
BEGIN
	xx :: INTEGER
END

op =
IF yy<=zz THEN
	IF (zz-yy) mod 2=0 THEN
	xx := zz-yy
	ELSE 
	xx := 0
	END
ELSE
	xx := yy-zz
END

The algorithmic details of the computation of xx are exposed in the refinement. This computation here depends on two other variables yy and zz.

VARIABLES
 bb
INVARIANT
 bb: BOOL 

INITIALISATION
 bb := TRUE

OPERATIONS

op = 
BEGIN
	bb :: BOOL
END

VARIABLES
 cc, dd, ee
INVARIANT
 cc : BOOL &
 dd: BOOL &
 ee: BOOL &
 bb = bool(cc=TRUE & dd= TRUE 
	& ee=TRUE)

INITIALISATION
 cc:= TRUE ||
 dd := TRUE ||
 ee := TRUE

OPERATIONS

op = 
BEGIN
	cc := FALSE ||
	dd := TRUE ||
	ee :: BOOL
END

In this case, both data refinement and algorithm refinement happen:

the variable bb is refined with cc, dd and ee (with the gluing invariant bb = bool(cc=TRUE & dd=TRUE & ee=TRUE)
the initialisation and the operations are made more precise, depending only on cc, dd and ee.

What is mathematical proof ?

A mathematical proof is a demonstration that some mathematical statement is true. A proof should demonstrate that a statement is true in all cases, without a single exception. Compared to testing, a proof corresponds to having performed all possible test cases. With Atelier B, a mathematical proof is obtained through the use of:

- a theorem prover: this tool transforms a goal into simpler sub-goals and is based on a mathematical transformation rule database and heuristical hardcoded mechanisms (normalisation, simplifcation, etc.).

- a predicate prover: this tools tries to find contradictions by combining hypotheses and the negation of the goal (tableau method).

- interactive proof commands: during interative proof, the user can provide guidance to the Atelier B theorem prover (initiate a do-case proof, make explicit a contradictory hypothesis, etc). These commands (also called demonstration) are saved, enabling the replay of the proof afterwards for verification purpose.

- user-added mathematical rules: Atelier B theorem prover rule database is composed of around 2500 mathematical rules. These rules are general and sometimes (often ?) you need to add your own rules to simplify the proof or to address a specific case. These additional rules have to be validated.

- user-added proof tactics: demonstrations can be defined and parametrized such as to be applied when the goal matches with a given pattern. Such demonstrations are called proof tactics and would lead to save a lot of time when proving similar B projects.

What is the difference between software model and system model ?

A software project aims at producing a software, by modeling software functions. Such a project is composed of several modules, a module being made of a specification (also called an abstract machine) and one or more successive refinements of this specification. The last refinement is the implementation of the module and will be translated into source code. An implementation may import other modules.

A system projectaims at validating a system specification and design against its properties, by modeling events that modify the state of the system. A system is taken with its most general meaning (a system could be physical system like a car, a phone, etc., a process, a document, etc.), and includes its environment. Such a project is composed of one specification and succesive refinements of this specification (also called "refinement column).

Why do I get B0-checker error messages at machine level ?

A software project aims at producing a software, hence machines have to fullfill implentation-related constraints. In particular, operation parameters have to be concrete, as operation signature can't be modified without a refinement column.

However, if you would like to produce a software model that you don't want to implement, you can get rid of these B0-check error messages by modyfing the related project properties. To do that, select a project, then right-click on it, select "properties" menu item, then activate the "resource file" panel and add the following lines:

ATB*BCOMP*Disable_Predicate_Syntax_Check:TRUE
ATB*BCOMP*Disable_Expression_Syntax_Check:TRUE
ATB*BCOMP*Disable_Formal_Params_Type_Check:TRUE
ATB*BCOMP*Disable_Concrete_Constants_Type_Check:TRUE
ATB*BCOMP*Disable_Concrete_Variables_Type_Check:TRUE
ATB*BCOMP*Disable_Operation_Input_Parameters_Type_Check:TRUE
ATB*BCOMP*Disable_Operation_Output_Parameters_Type_Check:TRUE
ATB*BCOMP*Disable_Local_Variables_Type_Check:TRUE
ATB*BCOMP*Disable_Variables_Initialisation_Check:TRUE
ATB*BCOMP*Disable_Array_Compatibility_Check:TRUE
ATB*BCOMP*Disable_Parameter_Instanciation_Check:TRUE
ATB*BCOMP*Disable_Valuation_Check:TRUE

Close the project, reopen it. Error messages should have disappeared.

Frequently Asked Questions

What is the B method ?

What is refinement?

What is mathematical proof ?

What is the difference between software model and system model ?

Why do I get B0-checker error messages at machine level ?