Qualitative Reasoning. Probability is used in many distributed systems for breaking the symmetry between different components/processes, e.g. IEEE 1394 Firewire protocol [2] , Xxxxx Choice Coordination algorithm [3] . For such systems, termination cannot be guaranteed for certain. Instead, a slightly weaker property is mostly appropriate: termination with probability one. As an example for this type of systems is to consider tossing a coin until it comes up tail. Provided that the coin is fair (in that sense that no face is ignored forever), eventually, the coin will eventually come up head. Qualitative probabilistic reasoning has been integrated into Event-B [4] : a new kind of actions is added, namely probabilistic actions with an assumption that the probability for each possible alternative is bounded away from 0 or 1. Most of the time, probabilistic actions behave the same as (standard) non-deterministic actions (e.g. invariant preservation). The difference between probabilistic and non-deterministic actions is with convergence proof obligation: probabilistic actions are interpreted angelically, whereas non-deterministic actions are interpreted demonically. The result is a practical method for handling qualitative reasoning that generates proof obligations in the standard first-order logic of Event-B. The plug-in allows developers to declare an event to be probabilistic convergent and generate appropriate proof obligations. Since the obligations are in standard first-order logic supported by the Rodin platform, we do not need to make any extension for the provers to handle the new proof obligations.
Qualitative Reasoning. Ideally, we would like to have a new value for the convergence attribute of Event-B events. However, this is not currently supported by the Rodin platform. Instead, a new probabilistic attribute is defined for events, with the value is either standard or probabilistic. • Since standard refinement does not maintain probabilistic convergent property, we put a restriction on the development method for almost-certain termination systems in two steps as follows.
Qualitative Reasoning. Master thesis of Xxxx Xxxxxx on developing tool support for qualitative reasoning in Event-B [14] . • The development of Xxxxx'x Choice Coordination Algorithm is available at the DEPLOY Repository [15] . • A paper describing the development of Xxxxx Choice Coordination algorithm and tool support in the Proceedings of AVoCS'10 [8] .
Qualitative Reasoning. In DEPLOY's fourth year, we plan to implement the missing proof obligations. More importantly, we will investigate the interaction between refinement and almost certain termination. This allows us to prove convergence properties early in the development and guarantee that refinement will maintain these convergent properties. References [1] X. Xxxxxxx. Augmenting Event-B Specifications with Control Flow Information. Nodes 2010. Copenhagen June 3-4 2010, Technical University of Denmark [2] J.-X. Xxxxxx, X. Xxxxxxx, X. Xxxx. A Mechanically Proved and Incremental Development of IEEE 1394 Tree Identify Protocol. Formal Asp. of Comput. 14(3):215-227, 2003 [3] X. Xxxxx. The Choice Coordination Problem. Acta Informatica, 17:121-134, 1982. [4] X. Xxxxxxxxxxx, X.X. Xxxxx. Qualitative Probabilistic Modelling in Event-B. iFM 2007: Integrated Formal Methods, Oxford, U.K. July 2007 [5] J. R. Abrial. The B-Book: Assigning Programs to Meanings [6] R.J.R. Back and X.Xxxxx-Xxxxxx, Decentralization of process nets with centralized control. 2nd annual symposium on principles of distributed computing, Montreal 1983 [7] R.J.R. Back. Atomicity Refinement in a Refinement Calculus Framework (Back92:atomicity)
Qualitative Reasoning. Probabilistic Action evt any x where G(x, v) then end v ⊕| S(x, v, vr) ⊕| In our earlier work [4], we extend the Event-B with probabilistic action v S(v, vj), and the notion of probabilistic (eventually) termination of events. This extension re- quires a slightly modification to the variant proof obligation: event might decrease the variant V . Invariants and axioms G(x, v) € ∃vr ·S(x, v, vr)∧ V (vr) ⊂ V (v) Given an event ones has to prove A great advantage of this approach is that the proof obligations still within first- order predicate logic hence we do not need to extend our proof system.
Qualitative Reasoning. Probabilistic Action evt any x where G(x, v) then end v ⊕| S(x, v, v') ⊕| In our earlier work [4], we extend the Event-B with probabilistic action v S(v, v′), and the notion of probabilistic (eventually) termination of events. This extension re- quires a slightly modification to the variant proof obligation: event might decrease the variant V . Invariants and axioms G(x, v) ▶
