Skip to content
Snippets Groups Projects
Commit 915e98c8 authored by dgelessus's avatar dgelessus
Browse files

Remove appendix pages that can also be found on wiki

parent 8848c592
Branches
No related tags found
No related merge requests found
Showing with 0 additions and 1377 deletions
[[team]]
= Team
ProB is based on research and implemention effort by our https://www.cs.hhu.de/lehrstuehle-und-arbeitsgruppen/softwaretechnik-und-programmiersprachen/unser-team.html[team]:
* Michael Leuschel,
* Michael Butler,
* Jens Bendisposto,
* Ivaylo Dobrikov,
* Dominik Hansen,
* Philipp Körner,
* Sebastian Krings,
* Lukas Ladenberger,
* David Schneider,
* Joshua Schmidt
* Daniel Plagge,
* Marc Fontaine,
* Fabian Fritz,
* Corina Spermann,
* Michael Jastram,
* Joy Clark,
* David Geleßus,
* Antonia Pütz,
* Fabian Vu,
* Yumiko Takahashi,
* Michelle Werth,
* Philip Hoefges,
* Edward Turner,
* Dennis Winter,
* Sonja Holl,
* Jens Krüger,
* Michael Birkhoff,
* Carla Ferreira,
* Stéphane Lo Presti,
* Leonid Mikhailov,
* Laksono Adhianto
* ...
Part of the research and development was conducted within various
research projects, such as the http://www.epsrc.ac.uk/default.htm[EPSRC]
funded projects http://users.ecs.soton.ac.uk/phh/abcd/[ABCD] and
http://users.ecs.soton.ac.uk/mal/ISM.html[iMoc], the EU funded projects
http://rodin.cs.ncl.ac.uk/[Rodin], http://www.deploy-project.eu/[Deploy]
and http://www.advance-ict.eu/[Advance] as well as the
http://www.dfg.de/[DFG] project http://www.gepavas.de/[Gepavas].
[[faq]]
= FAQ : Frequently asked Questions
== Can I use transitive closure for Event-B models?
Yes, you need to use a theory of the transitive closure which contains a
special mapping file. See <<event-b-theories,the section about Event-B theories>> along with the links to theories that can be used
efficiently with ProB.
== How can I reduce the memory consumption for model-checking?
There are several options:
1. Try to reduce the amount of memory ProB uses per state: For probcli
you can set the COMPRESSION preference to true, e.g., in the following
way:
`probcli MyMachine.mch --model-check -p COMPRESSION TRUE`
You could also add a DEFINITION
`SET_PREF_COMPRESSION == TRUE`
to your B machine to set the preference. There is also the possibility
to forget the state space of already visited states by setting the
preferences FORGET_STATE_SPACE and IGNORE_HASH_COLLISIONS to TRUE.
2. You can try to reduce the state space, e.g., via <<symmetry-reduction, symmetry reduction>>. Hash
symmetry typically works best. Another possibility is in the paragraph partial order reduction of the section
<<tutorial-various-optimizations, Tutorial Various Optimizations>>.
3. Sometimes <<bounded-model-checking, bounded model checking>> works much better than explicit state model
checking, especially when the branching factor is very high.
4. You could try and use our <<tlc, TLC backend>>. It
will not work for refinements and only has limited support for machine
inclusion, but it can be very fast and the state space is kept on disk.
== How do I perform a self-check of ProB?
If you suspect something is wrong with your ProB Tcl/Tk installation,
run the "Perform Self Check" command in the "Debug Menu". Note: run
this command immediately after startup before opening new machines
(otherwise you may get some errors because the machine will override
some default definitions used for the tests). Normally, the console
window should look like this (you may get some multiple solutions
warnings; but you should not get errors):
....
---------------------
Performing Self-Check
..........................................................
..........................................................
..........................................................
..........................................................
Self-Check Finished
-------------------
....
== ProB seems stuck when loading a machine
After parsing a machine, ProB is attempting to find valid initial states
of your machine (or in case your machine has constants, valid values of
the constants which satisfy the PROPERTIES clause). In the animation
preferences you can specify how many valid initial states (or valid
values for the constants) ProB will look for. Try decreasing that number
(default value: 4). You can also try and simplify the INITIALISATION (or
PROPERTIES) clause, or reduce the cardinality of the base sets and
decrease MAXINT. ProB is could also be stuck in the parsing process. The
jbtools parser sometimes behaves badly when syntax errors are present
and can take a very long time to return the syntax error. [This has been
fixed in the release 1.2.0]
== Which features of B are covered?
ProB covers a large part of B, and we are striving towards full
coverage. ProB supports B features such as non-deterministic operations,
ANY statements, operations with complex arguments, sets, sequences,
functions, lambda abstractions, set comprehensions, constants and
properties, and many more. It has limited support for multiple machines
and refinements (see the <<Current_Limitations.adoc, Current_Limitations>>
section and the FAQ entry about refinements below).
== Is there support for refinement?
For the moment, you have to give types to operation arguments in
refinements; the types are not always extracted from the ancestor
specification. Furthermore, the precondition of the operations again are
not extracted from ancestor machines and are not propagated down. This
is an important difference with classical B: it means that ProB may find
an invariant violation in the refinement machine even though the
Refinement can be proven correct with B4Free or AtelierB. This is
because in those tools you only need to prove consistency within the
precondition of all ancestor machines ! ProB checks the refinement
machine on its own. Anyway, we believe that it is probably bad style to
rely on preconditions from ancestor machines for correctness (as they
may be expressed in terms of abstract variables no longer present,...).
Finally, as ProB treats top-level PRE conditions as SELECTS, this also
affects refinement checking. [ProB's refinement checker is more suited
for EventB than classical B, but we are working to fully support both
styles of refinement.]
== The constraint based checker is very slow and does not always work
The constraint based checker is the least stable part of the system.
First try it on simple machines to get a feel of how it works.
Currently, it may still attempt infinite enumerations even for finite
state machines. We are working on an improved version for the next
release. Also, there is a bug in Sicstus Prolog 3.10, which means that
suspended goals may sometimes be discarded (this only seems to happen in
the constraint based checker, not in the temporal model checker or the
animator). Running ProB on Sicstus Prolog 3.9 seems to get rid of this
problem (at least partially).
== I can animate your machine files but I am not able to open my own machine files
Be sure to have Java installed and set up the CLASSPATH as stipulated
above.
== ProB complains that some variables are not given a proper type
All variables should be given a type even though ProB may still work
without them (but you are living dangerously). In the latest release,
typing has become more flexible and previously defined variables are
also recognized as a type. aa: POW(myset) & bb: POW(aa) is now ok
(previously it was required to type aa: POW(myset) & bb: POW(aa) & bb:
POW(POW(myset)) ). One can now also use subset for typing: bb <:
COLOURS.
== I cannot visualize the state space
Be sure to set up the viewer preferences and use / (even on Windows!) Be
sure to have dot installed and either dotty or a Postscript viewer.
Also, on Windows the path to the machine files should not contain
spaces. A good example directory would be C:/Machines/
== Some of my machines do not behave as expected
Maybe you are using a feature of B not yet supported by ProB. Have a
look at the console window and see whether ProB displays any warning
messages (something like uncovered expression encountered:). If
possible, send me an email with the Machine and the message. If there is
no message, you may have encountered a genuine bug: please send the
Machine and a description of the problem to me. You can also use the
Save State Command in the File Menu and then send me the *.saved.P file
(this way you do not have to tell me how to reach the buggy state).
== How does ProB treat INT and NAT as opposed to INTEGER and NATURAL?
As of version 1.2 ProB treats INT differently from INTEGER (the same is
true for NAT and NAT1). A variable x:INT is now required to lie between
MININT..MAXINT (which can be changed in the preferences; you can also
change the setting on a per machine basis by adding DEFINITIONS
likeSET_PREF_MININT == -10; SET_PREF_MAXINT == 100; to your machine.)
== Problem with libtk.so on Linux
When launching ProB on Linux I get: ./prob: error while loading shared
libraries: /usr/lib/libtk.so : invalid ELF header
Solution:
----
Replace libtk.so with a symbolic link to the actual library,
e.g., do something like that: # ln -s /usr/lib/libtk8.4.s
/usr/lib/libtk.so
(Probably best to make a backup of libtk.so before that.)
----
== Finding Multiple Assertion Violations
I want to generate multiple assertion violations in ProB in order to
generate the customized test cases for a particular B specfication
according to various test coverage criteria. But ProB can only produce a
single assertion violation at one time. Is there any option in ProB that
can help in producing multiple assertion violations at one goal/command?
For the moment the solution would be to put the assertions into the
invariant and then model check the entire state space by disabling
"Find Invariant Violations" in the dialog box for the Temporal Model
Check command. Afterwards, you can use "Compute Coverage" in the
"Analyse" menu to see how many states have violated the invariant.
Another solution is to write a "dummy" operation for every assertion:
my_assertion_N = SELECT not(Assertion_N) THEN skip END After model
checking, you can again use "Compute Coverage" to see how often every
assertion has been violated.
== Checking Multiple LTL Formulas
Can multiple LTL formulas be verified at a time?
You can write multiple LTL assertions in the DEFINITIONS clause, e.g.,
----
ASSERT_LTL0 == "G (e(SetCruiseSpeed) -> e(CruiseBecomesNotAllowed))";
ASSERT_LTL1 == "G (e(CruiseBecomesNotAllowed) -> e(SetCruiseSpeed))";
ASSERT_LTL2 == "G (e(CruiseBecomesNotAllowed) -> e(ObstacleDisappears))"
----
They can then all be checked using the `Check LTL Assertions` command.
[[downloads]]
= Download
If you click https://www3.hhu.de/stups/prob/index.php/Download[here] you will be redirected to our online Download page.
[[prior-versions-of-prob]]
= Prior Versions of ProB
If you click https://www3.hhu.de/stups/prob/index.php/DownloadPriorVersions[here] you will be redirected to the Download Prior Versions of ProB page.
[[links]]
= Links
[[books]]
== Books
* http://www.jpbowen.com/publications/thes-b.html[The B-Book: Assigning
programs to meanings, by Jean-Raymond Abrial] (link is to a review by
Jonathan Bowen)
* http://www.palgrave.com/science/computing/schneider/[The B-Method: An
Introduction, by Steve Schneider]
* http://www.event-b.org/abook.html[Modeling in Event-B: System and
Software Engineering, by Jean-Raymond Abrial] (the Bee book)
[[papers]]
== Papers
* https://www3.hhu.de/stups/downloads/pdf/[ProB Publications]
* http://en.wikipedia.org/wiki/B-Method[B-Method in Wikipedia]
* http://www.bmethod.com/[B-Method Site] from ClearSy
* http://www.fm4industry.org/index.php/Can_FM_tools_manage_large_industrial_problems%3F[Can
FM tools manage large scale industrial problems ?]
* http://www.data-validation.fr[Data Validation]
[[prob]]
== ProB
* <<modelling-examples,Examples for ProB>> (along with screenshots and
explanations)
* http://www.ecs.soton.ac.uk/~mal/systems/prob.html[Old web page of
ProB] (in Southampton; use for releases prior to 1.2)
* http://www.fm4industry.org/index.php/Productivity_Improvement_of_Data_Consistency_in_Transportation_Models[Link
to Success Story (written by Cetic)]
* https://groups.google.com/d/forum/prob-users[prob-users group]
[[tools-using-prob]]
== Tools using ProB
* https://www.clearsy.com/en/our-tools/clearsy-data-solver/[ClearSy Data Solver]
* http://www.data-validation.fr/data-validation-in-the-railways/[DTVT -
Data Table Validation Tool] for Alstom by ClearSy
* OLAF data validation tool by ClearSy for Alstom and SNCF
* Dave data validation tool by ClearSy for General Electric Transportation
* https://github.com/plues/plues[PLUES] tool for university course
validation
* http://safecap.cs.ncl.ac.uk/index.php/Safecap_Project_Wiki[SafeCap]
* http://wiki.event-b.org/index.php/IUML-B[iUML Statemachines]
* http://users.ecs.soton.ac.uk/vs2/ac.soton.multisim.updatesite/[MultiSimulation
Plug-In for Rodin]
* http://www.beta-tool.info/user_guide.html[Beta]
* http://www.macs.hw.ac.uk/~mtl4/Publications.html[HRemo (see PhD
thesis)]
* http://dx.doi.org/10.14279/depositonce-2502[Message Choreography Model
Animation and Test Case Generation (see PhD thesis; Chapters 5 and 6)]
http://link.springer.com/article/10.1007%2Fs10270-012-0272-x[SSM article
(2014)]
* http://b4msecure.forge.imag.fr[B4MSecure]
* http://genisis.forge.imag.fr[GenISIS]
* http://blog.aymericksavary.fr/?page_id=209[VTG] (Vulnerability Test
Generator, see
http://blog.aymericksavary.fr/wp-content/uploads/2011/10/presentation.pdf[Rodin
Workshop 2012 presentation] and
http://blog.aymericksavary.fr/wp-content/uploads/2014/06/Présentation.pdf[2014
presentation])
* CODA https://arxiv.org/abs/1305.6112v1[arXiv article]
* There is also some intitial effort to
http://pure.au.dk/portal/en/publications/interpreting-implicit-vdm-specifications-using-prob(19de7f9f-1d9a-483c-b2e7-285c0d0edc63).html[use
ProB for implicit VDM specifications] presented at
http://wiki.overturetool.org/index.php/12th_Overture_Workshop[the 12th
Ouverture Workshop].
* https://github.com/ValerioMedeiros/BEval[BEval]
* https://github.com/ValerioMedeiros/BTestBox[BTestBox]
* http://wiki.event-b.org/index.php/MBT_plugin[MBT plugin] for
model-based testing within Rodin
* https://rajivmurali.github.io/UsecasePro/[UseCasePro], see article in
the
http://eprints.ncl.ac.uk/file_store/production/229541/A4269E59-6B4A-485E-8E63-E164802DFADD.pdf[proceedings
of the 2016 Workshop on Formal and Model-Driven Techniques for
Developing Trustworthy Systems]
* http://bibbase.org/network/publication/lausdahl-ishikawa-larsen-interpretingimplicitvdmspecificationsusingprob-2015[Animating
implicit VDM specifications inside Ouverture]
* http://www.ovado.net[Ovado] (as second tool chain)
* https://github.com/tofische/cucumber-event-b/[Cucumber-Event-B] tool to run high-level tests
[[related-tools]]
== Related Tools
* http://www.atelierb.eu/[Atelier B]
* http://www.event-b.org/[Event-B and Rodin Wiki]
(http://wiki.event-b.org/index.php/Rodin_Platform_Releases[Platform
Releases], http://wiki.event-b.org/index.php/Main_Page[Documentation]),
http://sourceforge.net/projects/rodin-b-sharp/[Rodin Sourceforge Site]
* https://github.com/utwente-fmt/ltsmin/releases[LTSmin releases
(including versions for prob)]
* http://lifc.univ-fcomte.fr/~btatibouet/PERSO/JBTOOLS/InstallPlugIn/InstallPlugIn.html[jbtools]
* http://www.b4free.com/[B4Free] tools for the development of B models
* http://www.loria.fr/~cansell/cnp.html[Click n Prove]
* https://github.com/edwardcrichton/BToolkit[B Toolkit]
* http://www.ecs.soton.ac.uk/~cfs/umlb.html[U2B] UML to B translation
tool
* http://research.microsoft.com/en-us/um/people/lamport/tla/tla.html[TLA+]
(http://research.microsoft.com/en-us/um/people/lamport/tla/tools.html[tools
for TLA+])
* https://spivey.oriel.ox.ac.uk/mike/fuzz/[The fuzz type-checker for Z]
* https://www.cs.ox.ac.uk/projects/fdr/[The FDR3 CSP refinement checker]
* https://github.com/leuschel/bbedit-prob[BBedit Language modules for B,
TLA+, CSP and Prolog]
* https://en.wikipedia.org/wiki/List_of_model_checking_tools[Model
checking tools]
[[testimonials]]
== Testimonials
* http://www.deploy-project.eu/pdf/D41-Siemens-final-full.pdf[Data
validation at Siemens, Jérôme Falampin]: "The work done with ProB is a
great success. Thanks to the automatization and ProB, the wayside data
validation is quicker, easier and complete." More details and academic
papers can be found on our page
<siemens-data-validation-with-prob,Siemens Data Validation with
ProB>>.
* http://dl.acm.org/citation.cfm?doid=2406336.2406351[Pacemaker model by
Mery and Singh]: "ProB was very useful in the development of the
pacemaker specification, and was able to animate all of our models and
able to prove the absence of error (no counterexample exist). The ProB
model checker also discovered several invariant violations, e.g.,
related to incorrect responses or unordered pacing and sensing
activities. It was also able to discover a deadlock in two of the
models, which was due to the fact that “clock counter” were not properly
recycled, meaning that after a while no pacing or sensing activities
occur into the system. Such kind of errors would have been more
difficult to uncover with the prover of RODIN tool.""
* http://www.data-validation.fr/data-validation-reverse-engineering/[Reverse
engineering using ProB at ClearSy]: "Data validation principles have
been applied recently to a railways reverse-engineering project with
great success. B and ProB have demonstrated again how efficient they are
when used in combination."..."This problem was solved elegantly by
using data validation principles: a B model representing the two graphs
and their properties were elaborated, and ProB used for finding a
solution."
* http://www.ncl.ac.uk/computing/research/publication/197269[Safecap
tool paper by Iliasov, Lopatkin and Romanovsky]: "One of the larger
examples we have tackled is the Carlisle Citadel station with the North,
South, and Caldew junctions. The modelled fragment is 2.6km long and
comprises 70 train detection circuits, 63 points, 79 routes and 161
valid paths. The translation from a scanned PDF drawing and printed
control tables took 45 man-hours. The verification of the topology
theory constraints using ProB took just over 6 minutes on a PC with i7
3730 CPU and utilized just under 2GB of RAM. The Why3 verification of
the same theory takes approximately 70 minutes. The control table theory
is verified under 20 seconds by ProB and not verified completely, with
the current translation of conditions, using Why3."
* http://www.erts2014.org/Site/0R4UXE94/Fichier/erts2014_1B2.pdf[Innovative
Approach for Requirements Verification of Closed Systems by Reis,
Bicknell, Butler, Colley]: "The Event-B model can be animated within
Rodin using the BMotion Studio tool, which is part of ProB. Using the
tool, it is possible to generate an animated front-end to the simulation
of the model in the form of a user-friendly graphical interface, which
corresponds to the system’s GUI (see Figure 4). The user can interact
directly with this animated front-end, while the tool continues to run
the formal analysis in the background, reacting to user choices and
checking the model and invariants at each step. This was utilised during
the case study, to produce a representation of the GIU provided as part
of the end-user system. As this graphical representation is tied to the
underlying Event-B model, it can not only be used to run through the
model and confirm that the model is the correct representation of the
system, but can also be used to explore further scenarios. This
graphical representation of the system can be used without necessarily
requiring any experience with the Event-B language or the toolset."
* http://dl.acm.org/citation.cfm?id=2480314[ProZ for Modelling Safety
Properties of Interactive Medical Systems by Bowen and Reeves]: "In
this paper we have shown how temporal logic and invariants describing
safety properties of interactive medical devices can be investigated
within the ProZ tool. We have given examples of checking for such
properties against a model of the T34 syringe pump and discussed some of
the results and challenges we have encountered using this approach. We
believe that using techniques such as these, and other model-checking
functionalities, contributes to supporting safer use of interactive
medical devices. That is we can use such techniques not just to help
develop better and safer systems (where such techniques are most
typically used) but also, as we have shown here, to investigate existing
devices to ensure they can be safely used within the clinical setting."
* ProB has been used “out-of-the-box” for Rodin theories by Thales for
railway interlocking models, building ProB BMotionStudio visualizations
on top. According to the
http://www.advance-ict.eu/sites/www.advance-ict.eu/files/Thales-Duesseldorf.pdf[Thales
slides of the Advance Industry Day 2014] ProB has a high technology
readiness level (TRL).
* ProB
http://smtcomp.sourceforge.net/2016/results-NIA.shtml?v=1467112059[wins
the NIA (non-linear integer arithmetic) division of the 2016 SMT
competition] (this is ProB out-of-the-box, without tuning and where SMT
formulas are translated to B)
[[other-links]]
== Other Links
* https://github.com/klar42/railground/[Railground Event-B Model]
[[translating-to-logic]]
== Translating to Logic
* http://legacy.earlham.edu/~peters/courses/log/transtip.htm[Translation
Tips]
* http://pages.cs.wisc.edu/~dyer/cs540/notes/fopc.html[Lecture Notes on
Translating to First-Order Logic]
* http://cs.nyu.edu/faculty/davise/guide.html[Guide to Axiomatizing in
First-Order Logic]
This diff is collapsed.
[[bugs]]
= Bugs
If you want to submit a bug report, please use our https://probjira.atlassian.net/projects/PROBCORE/issues/[bug tracker]. You may
also want to ask questions within our https://groups.google.com/forum/#!forum/prob-users[prob-users group].
We use a free http://www.atlassian.com/software/views/open-source-license-request/[Open Source license] from Atlassian!
[[troubleshooting]]
= Troubleshooting
* On macOS Catalina the Tcl/Tk menu bar is sometimes not working. Switching to another application and then back to ProB seems to solve the problem.
* Avoid installing ProB in a path with spaces or other special
characters in them. The same holds for B machines you wish to analyze
with ProB.
* You need Tcl/Tk (preferably 8.5 or newer) installed on your machine.
On Linux you will get the error message: ./prob: error while loading
shared libraries: libtk.so: cannot open shared object file: No such file
or directory if Tcl/Tk is not proberly installed. You can get Tcl/Tk at
http://www.tcl.tk/software/tcltk/.
* For the very latest version of ProB (1.2.0 or newer), you need a Java
1.5 Runtime environment or newer (you will get a message "Could not
execute parser." with "Error: java.lang.UnsupportedClassVersionError"
when opening a machine). You can obtain Java at
http://java.sun.com/j2se/index.jsp[http://java.sun.com/j2se/index.jsp].
* On Mac OS X, if you have trouble opening larger B machines this may be
due to Mac OS X giving too little memory to ProB. Use 'limit data
unlimited' (in tcsh) or 'ulimit -d unlimited' (in bash) before launching
ProB from the command line.
* ProB prior to version 1.3.0 may require more typing information than
AtelierB, B4Free or the BToolkit. It is usually good style to explicitly
type all variables and parameters. Hint: avoid using the same variable
name for different variables (e.g., in two different set
comprehensions). This way you will know which variable ProB is referring
to in error messages. As of version 1.3.0, ProB performs full type
inference and checking, using a unification based algorithm which is
more powerful than the type inference in the other B tools.
[[prob-licence]]
= ProB Licence
The ProB source code is distributed under the
http://www.eclipse.org/org/documents/epl-v10.html[EPL v1.0 license].
\(C) 2000-2018 Michael Leuschel and many others.
ProB comes with ABSOLUTELY NO WARRANTY OF ANY KIND ! This software is
distributed in the hope that it will be useful but WITHOUT ANY WARRANTY.
The author(s) do not accept responsibility to anyone for the
consequences of using it or for whether it serves any particular purpose
or works at all. No warranty is made about the software or its
performance.
The ProB binary and source distributions contain the nauty library. You
cannot use nauty symmetry reduction for applications with nontrivial
military significance, see http://cs.anu.edu.au/~bdm/nauty/.
For availability of commercial support, please contact
http://stups.hhu.de/w/Prof._Dr._Michael_Leuschel[Michael Leuschel] or
http://www.formalmind.com/[Formal Mind].
= ProB Preferences
A list of the current preferences available in ProB is available <<preferences-for-command-line,here>>.
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment