Modeling and proving hybrid programs with Event-B: An approach by generalization and instantiation

Abstract

• A correct-by-construction approach to design and verify Cyber-Physical Systems. • A formal Event-B modeling of the event-time triggered template introduced by Kopetz. • Generic Event-B models for Cyber-Physical Systems. • A set of instantiation rules of the generic models using two different strategies. • Illustration on two frequently used CPS case studies: Stop Sign and Water Tank. Hybrid systems are one of the most common mathematical models for Cyber-Physical Systems (CPSs). They combine discrete dynamics represented by state machines or finite automata with continuous behaviors represented by differential equations. The measurement of continuous behaviors is performed by sensors. When these sensors have a continuous access to these measurements, this kind of model is called an Event-Triggered model. The properties of such models are easier to prove, while their implementation is difficult in practice. Therefore, it is preferable to introduce a more concrete kind of model, called Time-Triggered models, where the sensors take periodic measurements. Contrary to Event-Triggered models, Time-Triggered models are much easier to implement, but much more difficult to verify. Based on the differential refinement logic (dR L ), a dynamic logic for refinement relations on hybrid systems, it is possible to prove that a Time-Triggered model refines an Event-Triggered model. However, being done by hand, this proof is error-prone since no prover is available to support this logic. To overcome this limit, this paper introduces another correct-by-construction approach to prove this refinement, based on Event-B to take advantage of its well-defined refinement process and its support tools. We use the Rodin platform to develop Event-B models and its associated provers (automatic and interactive) to ensure their correctness. The obtained Event-B models are generic and can be then instantiated to model and prove any specific CPS. The proposed approach is illustrated by two frequently used CPS case studies.