Failure divergence refinement for Event-B

2025-05-25

AI Summary

Event-B natively supports safety verification across refinement chains but lacks built-in support for liveness properties, requiring external techniques (e.g., animation) whose verification results are non-transferable—necessitating redundant per-layer validation. This work introduces Failure-Divergence Refinement semantics into Event-B for the first time, proving that it preserves trace properties—including diverse liveness properties—under natural conditions, particularly ensuring no loss of abstract behavior during data refinement. Based on behavioral semantics, we develop a refinement theory that unifies trace property verification with automated refinement checking algorithms, and implement a supporting tool. Evaluated on multiple large-scale case studies, our approach significantly reduces verification effort and, for the first time, enables cross-level transferability of liveness verification results across refinement chains.

Technology Category

• Knowledge Representation and Reasoning: Diagnosis and Abductive Reasoning
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty

Application Category

• Security and Privacy: Data transparency and provenance
• Responsible Web: Social and technical mechanisms of refusal for web technologies and applications
• Semantics and Knowledge: Provenance, trust, security and privacy, and ethical issues in managing semantic data

Abstract

When validating formal models, sizable effort goes into ensuring two types of properties: safety properties (nothing bad happens) and liveness properties (something good occurs eventually. Event-B supports checking safety properties all through the refinement chain. The same is not valid for liveness properties. Liveness properties are commonly validated with additional techniques like animation, and results do not transfer quickly, leading to re-doing the validation process at every refinement stage. This paper promotes early validation by providing failure divergence refinement semantics for Event-B. We show that failure divergence refinement preserves trace properties, which comprise many liveness properties, under certain natural conditions. Consequently, re-validation of those properties becomes unnecessary. Our result benefits data refinements, where no abstract behavior should be removed during refinement. Furthermore, we lay out an algorithm and provide a tool for automatic failure divergence refinement checking, significantly decreasing the modeler's workload. The tool is compared and evaluated in the context of sizable case studies.

Problem

• Ensuring liveness properties in Event-B refinement chains
• Avoiding re-validation of trace properties during refinement
• Automating failure divergence refinement checking in Event-B

Innovation

• Failure divergence refinement semantics for Event-B
• Algorithm for automatic refinement checking
• Tool to reduce modeler's workload