2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.1 CSC 4504 : Langages formels et applications (La méthode Event-B) J Paul Gibson, A207 TrafficLights Thanks to Ken Robinson: System Modelling and Design - Traffic Lights 2008
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.2 North South West East Safe State System0: 2-Way Junction No Turns
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.3 North South West East Safe State System0: 2-Way Junction No Turns
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.4 North South West East Safe State System0: 2-Way Junction No Turns
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.5 North South West East Safe State System0: 2-Way Junction No Turns
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.6 North South West East Safe State System0: 2-Way Junction No Turns
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.7 North South West East System0: 2-Way Junction No Turns UnSafe State
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.8 North South West East System0: 2-Way Junction No Turns Inconsistent State: Safe or Unsafe?
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.9 North South West East System0: 2-Way Junction No Turns Inconsistent State: Safe or Unsafe?
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.10 System0: 2-Way Junction, No Turns Representing State of the System: level of abstraction of junction SafeInconsistent Unsafe North South East West R R R A G R A G R R G G A A G A R R G G A A X X X X X X G A R A R G X X X X X X X X X X X X R R G G A A X X X X X X G A R A R G
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.11 System0: 2-Way Junction, No Turns Representing State of the System: level of abstraction of junction SafeUnsafe NorthSouth EastWest R R R A G R A G R R G G A A G A This is a better starting level of abstraction: we can refine the model to add detail later (and additional invariants to ensure consistency)
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.12 System0: 2-Way Junction, No Turns Representing State of the System: level of abstraction of each light Which level is best for representing the state of each light? How do we cope with problems due to inconsistency On Off R On Off A On G Off On ? Off On ? Off ?
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.13 North South West East System0: 2-Way Junction No Turns State Represented in diagrams as RG
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.14 System0: 2-Way Junction No Turns – Safe Systems RR RG 1 Safe System: but not useful RR 2 Safe System: but not fair GR RR 3 Safe System: fair but not correct RG
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.15 System0: 2-Way Junction No Turns – Safe Systems RG RA GR RR 4 Safe System: correct but is it fair? AR
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.16 System0: 2-Way Junction No Turns – Safe Systems RG RA GR RR 5 Safe System: correct and fair (and deterministic) but requires splitting abstract state RR into 2 different concrete RR states AR RR
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.17 System0: 2-Way Junction No Turns – A refinement removes nondeterminism RG RA GR RR AR RR RG RA GR RR AR refinement
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.18 System0: TrafficLights_ctx0 in RODIN
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.19 System0: TrafficLights_ctx0 in RODIN
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.20 System0: TrafficLights_ctx0 in RODIN
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.21 System0: TrafficLights_ctx0 in RODIN Add axioms to define function OppositeDirection Now we can model the system transitions in a machine that sees this context
2009: J Paul GibsonT&MSP-CSC 4504 : Langages formels et applications Event-B/TrafficLights.22 System0: TrafficLights_mch0 in RODIN