Computer Science

Event-B is a formal method that allows one to develop various kinds of systems including discrete control systems. However, it is lacking a systematic approach for developing this type of systems and it hinders the applicability of Event-B. Our contribution is such an approach and it is presented in this paper. Our proposed method focuses on a set of elements that should be captured by the formal model and prescribes an order in which they should be introduced. The key aspect of our approach is to first model the required behaviour of the environment, and then to introduce the controller to appropriately influence the environment. It has the advantage that every step of such a development is dictated by the information available so far, including the requirements. We argue that having a clear development strategy early in the design process will assist the developers in producing high-quality models of the future software systems.

Designing correct parallel programs is a difficult challenge, because of the interleaving nature of the execution of processes. Event-B has improved on the situation by applying the techniques of refinement to the design of parallel algorithms in such a way that safety properties can be integrated into the design one gradually. Unfortunately, it does not cover the notion of progress, that is to say that nothing prevents a refinement in Event-B from introducing individual starvation.

In UNITY, temporal properties (both safety and liveness) are part of a comprehensive program logic. However, the distinction that UNITY makes regarding specifications (sets of temporal properties), and programs (action systems), rules out the possibility of developing programs in a stepwise fashion.

In this thesis, we provide a model for the UNITY logic and use it to define a refinement order and a set of refinement laws which will enable the symbols of our specifications to do the work in the process of refinement. By taking progress properties as a guideline for the development, the addition of new actions to an existing specification is motivated by a direct mapping to the requirement of progress rather than a vague understanding of what it might achieve. The result of our work is a formal development method called Unit-B, combining refinement and the reasoning about progress properties.

We present Unit-B, a formal method inspired by Event-B and UNITY, for designing systems via step-wise refinement preserving both safety and liveness properties. In particular, we introduce the notion of coarse- and fine- schedules for events, a generalisation of weak- and strong-fairness assumptions. We propose proof rules for reasoning about progress properties related to the schedules. Furthermore, we develop techniques for refining systems by adapting event schedules such that liveness properties are preserved. We illustrate our approach by an example to show that Unit-B developments can be guided by both safety and liveness requirements.

A broad class of data types, including arbitrary nestings of inductive types, coinductive types, and quotients, can be represented as quotients of polynomial functors. This provides perspicuous ways of constructing them and reasoning about them in an interactive theorem prover. 2012 ACM Subject Classification Theory of computation → Logic and verification; Theory of computation → Type theory; Theory of computation → Data structures design and analysis

Timed Transition Models (TTMs) are event based descriptions for specifying and verifying real-time systems in a discrete setting. While the verification of TTMs has been supported in tools such as Uppaal and SAL, the manual encoding requires substantial effort before a TTM can be checked. We propose a convenient and expressive textual syntax for TTMs and a corresponding one-step operational semantics. Modules allow for compositional reasoning and include an interface in which monitored and controlled variables are declared. Events in a module can be specified, individually, as spontaneous, fair or real-time. An event action specifies a before-after predicate by a set of (possibly non-deterministic) assignments and (possibly nested) conditionals. The TTM assertion language, LTL, allows references to event occurrences, including clock ticks (thus allowing for a check that the behaviour is non-zeno). We describe a tool that includes an editor with static type checking, a graphical simu...

We propose a format for precise documentation of requirements to drive the development of dependable software products and to provide evidence for their certification. Requirements are elicited from customers and expressed informally as atomic English descriptions. To analyze the consistency of the requirements, we translate them into a software specification consisting of model contracts and tabular expressions. Model contracts describe queries as pre/post-conditions using mathematical constructs (e.g. quantifiers, sets, relations, sequences) which make them more expressive than classical implementation contracts. Tabular expressions use these queries to provide complete black-box descriptions of the system input-output relation. We validate the requirements via proofs of (a) the completeness, disjointness, and well-definedness of the specification and (b) the consistency between the specification and the atomic requirements. The model contracts are translated into an executable sp...

Abstract. Event-B is a formal method that allows one to model various kinds of systems including control systems working within some fragile environment. However, it is lacking a systematic approach for developing this type of systems and it hinders the applicability of Event-B. Our contribution is such an approach and it is presented in this paper. Our proposed method focuses on a set of elements that should be captured by the formal model and prescribes an order in which they should be introduced. The key aspect of our approach is to first model the required behaviour of the environment, and then to introduce the controller to appropriately influence the environment. It has the advantage that every step of the such a development is dictated by the information available so far, including the requirements. We argue that having a clear development strategy early in the design process will assist the developers in producing high-quality models of the future software systems.

We present Unit-B, a formal method inspired by Event-B and UNITY. Unit-B aims at the stepwise design of software systems satisfying safety and liveness properties. The method features the novel notion of coarse and fine schedules, a generalisation of weak and strong fairness for specifying events' scheduling assumptions. Based on events schedules, we propose proof rules to reason about progress properties and a refinement order preserving both liveness and safety properties. We illustrate our approach by an example to show that systems development can be driven by not only safety but also liveness requirements. Keywords progress properties • refinement • fairness • scheduling • Unit-B • proof-based formal methods • verification of cyber-physical systems.

We present Unit-B, a formal method inspired by Event-B and UNITY, for designing systems via step-wise refinement preserving both safety and liveness properties. In particular, we introduce the notion of coarse-and fine-schedules for events, a generalisation of weak-and strong-fairness assumptions. We propose proof rules for reasoning about progress properties related to the schedules. Furthermore, we develop techniques for refining systems by adapting event schedules such that liveness properties are preserved. We illustrate our approach by an example to show that Unit-B developments can be guided by both safety and liveness requirements.

Designing correct parallel programs is a difficult challenge, because of the interleaving nature of the execution of processes. Event-B has improved on the situation by applying the techniques of refinement to the design of parallel algorithms in such a way that safety properties can be integrated into the design one gradually. Unfortunately, it does not cover the notion of progress, that is to say that nothing prevents a refinement in Event-B from introducing individual starvation. In UNITY, temporal properties (both safety and liveness) are part of a com- prehensive program logic. However, the distinction that UNITY makes re- garding specifications – sets of temporal properties –, and programs – action systems –, rules out the possibility of developing programs in a stepwise fashion. In this thesis, we provide a model for the UNITY logic and use it to define a refinement order and a set of refinement laws which will enable the sym- bols of our specifications to do the work in the ...

Functional programming languages are particularly well-suited for building automated reasoning systems, since (among other reasons) a logical term is well modeled by an inductive type, traversing a term can be implemented generically as a higher-order combinator, and backtracking search is dramatically simplified by persistent datastructures. However, existing pure functional programming languages all suffer a major limitation in these domains: traversing a term requires time proportional to the tree size of the term as opposed to its graph size. This limitation would be particularly devastating when building automation for interactive theorem provers such as Lean and Coq, for which the exponential blowup of term-tree sizes has proved to be both common and difficult to prevent. All that is needed to recover the optimal scaling is the ability to perform simple operations on the memory addresses of terms, and yet allowing these operations to be used freely would clearly violate the ba...

We introduce a challenging real-world planning problem where actions must be taken at each location in a spatial area at each point in time. We use forestry planning as the motivating application. In Large Scale Spatial-Temporal (LSST) planning problems, the state and action spaces are defined as the cross-products of many local state and action spaces spread over a large spatial area such as a city or forest. These problems possess state uncertainty, have complex utility functions involving spatial constraints and we generally must rely on simulations rather than an explicit transition model. We define LSST problems as reinforcement learning problems and present a solution using policy gradients. We compare two different policy formulations: an explicit policy that identifies each location in space and the action to take there; and an abstract policy that defines the proportion of actions to take across all locations in space. We show that the abstract policy is more robust and achieves higher rewards with far fewer parameters than the elementary policy. This abstract policy is also a better fit to the properties that practitioners in LSST problem domains require for such methods to be widely useful.

In environmental and natural resource planning domains actions are taken at a large number of locations over multiple time periods. These problems have enormous state and action spaces, spatial correlation between actions, uncertainty and complex utility models. We present an approach for modeling these planning problems as factored Markov decision processes. The reward model can contain local and global components as well as spatial constraints between locations. The transition dynamics can be provided by existing simulators developed by domain experts. We propose a landscape policy defined as the equilibrium distribution of a Markov chain built from many locally-parameterized policies. This policy is optimized using a policy gradient algorithm. Experiments using a forestry simulator demonstrate the algorithm's ability to devise policies for sustainable harvest planning of a forest.

When using Bayesian networks, practitioners often express constraints among variables by conditioning a common child node to induce the desired distribution. For example, an ‘or’ constraint can be easily expressed by a node modelling a logical ‘or’ of its parents’ values being conditioned to true. This has the desired effect that at least one parent must be true. However, conditioning also alters the distributions of further ancestors in the network. In this paper we argue that these side effects are undesirable when constraints are added during model design. We describe a method called shielding to remove these side effects while remaining within the directed language of Bayesian networks. This method is then compared to chain graphs which allow undirected and directed edges and which model equivalent distributions. Thus, in addition to solving this common modelling problem, shielded Bayesian networks provide a novel method for implementing chain graphs with existing Bayesian network tools.

In this paper we will survey the history of Influence Diagrams from their origin in Decision Theory to modern AI uses. We will compare the various methods that have been used to find an optimal strategy for a given influence diagram. These methods have various advantages under different assumptions and there is a progression to the present of richer, more general solutions. We also look at an abstract algorithm used as an informal tool and determine whether it is equivalent to other formal methods in the literature.

When modelling uncertain beliefs with graphical models we are often presented with "natural" distributions that are hard to specify. An example is a distribution of which instructor is teaching a course when we know that someone must teach it. Such distributions over a set of nodes can be easily described if we condition on a child of these nodes as part of the specification. This conditioning is not an observation of a variable in the real world but by fixing the value of the node, existing inference algorithms perform the calculations needed to achieve the desired distribution automatically. Unfortunately, although it achieves this goal it has side effects that we claim are undesirable. These side effects create dependencies between other variables in the model. This can lead to different beliefs throughout the model, including the constrained variables, than would otherwise be expected if the constraint is meant to be local in its effect. We describe the use of conditioning for these types of distributions and illuminate the problem of side effects, which have received little attention in the literature. We then present a method that still allows specification of these distributions easily using conditioning but counterbalancing side effects by adding other nodes to the network.

Multi-Agent Influence Diagrams (MAIDs) are a compact modelling language for representing game theoretic settings. We show various examples of games where this representation shows clear advantages in every area, as well as types of games where MAIDs do not have an advantage over extensive form trees. We also propose modifications that will close this gap and maintain the strengths of this representation.