> Systems Formal Development by using Discrete Mathematics, Graduate Level Course, May 2, 2009< 1

Fig. 1. A Laminar Flow Cabin

Abstract In this example, its used the design patterns
(proposed by J-R. Abrial), for modeling of the context, the
abstract machine and a first refinement, using an Event-B
approach, for a laminar flow cabin.

Index Terms Event-B, Design Patterns, Laminar Flow Cabin.

I. REQUIREMENTS

DESCRIBING EQUIPMENT:

The system (A laminar flow cabin) has got the following
pieces of equipment: an extractor, an UV-light lamp (UvLp)
and a door (EQP_1).
Four buttons are used to turning and turn off the UV-light
lamp and top and close the door (EQP_2).
A controller is supposed to manage this equipment
(EQP_3).














CONECCTION CONSTRAINTS:

Buttons and controller are weakly synchronized (FUN_1).
Controller and equipment are strongly synchronized (FUN_2).

SECURE ACTION FUNCTIONS:

Let now to describe the relationship between UV-light lamp
and the door.
When the UV-light is turning, the door must be closed


(SAF_1).
When the UV-light lamp is turning, the extractor must work
(SAF_2).

THE SYSTEM WORKS FOR:

Cell biology, for all the steps required conditions for the
protection of the product.
Preparation of sterile, non-toxic or harmful, drugs.
Molecular biology, for all required manipulation conditions
for the protection of the sample and the operator.
II. INITIAL MODEL
Connecting the controller to the UV-light lamp. Controller
and equipment are strongly synchronized (FUN_2).









The Context:





Using Design Patterns in Formal Methods: A
Laminar Flow Cabin Example
Diana Hermith, BSc. Molecular Biology, Pontificia Universidad Javeriana, Cali-Colombia
Controller

UvLp
Strong Reaction
> Systems Formal Development by using Discrete Mathematics, Graduate Level Course, May 2, 2009< 2
The State:



Actuator: One that activates, especially a device responsible
for actuating a mechanical device, such as one connected to a
computer by a sensor.

The Synchronization:














To model the synchronization process (the events) of this
real physical system, its needed use of the strong action and
reaction pattern with these following final events:


Initializing a:=0 and r:=0.
The pattern can be instantiate as follows:
a UVlp_actuator a_on Controller_turning_Uvlp
r UVlp_sensor a_off Controller_turn_off_UVlp
0 turn_off r_on UVlp_turning
1 turning r_off UVlp_turn_off

Controller Event (1):
a _on Controller_turning_UVlp
when when
a= 0 UVlp_actuator = turn_off
r = 0 UVlp_sensor = turn_off
then then
a:= 1 UVlp_actuator := turning
end end

UV_light_lamp Event (1):
r _on UVlp_turning
when when
r = 0 UVlp_sensor = turn_off
a = 1 UVlp_actuator = turning
then then
r:= 1 UVlp_sensor := turning
end end

Controller Event (2):
a _off controller_turn_off_UVlp
when when
a = 1 UVlp_actuator = turning
r = 1 UVlp_sensor = turning
then then
a:= 0 UVlp_actuator := turn_off
end end

UV_light_lamp Event (2):
r _off UVlp_turn_off
when when
r = 1 UVlp_sensor = turning
a = 0 UVlp_actuator = turn_off
then then
r:= 0 UVlp_sensor := turn_off
end End















Controller

UvLp
Strong Reaction
Uvlp_sensor
Uvlp_actuator
action
> Systems Formal Development by using Discrete Mathematics, Graduate Level Course, May 2, 2009< 3
Event-B Model (Rodin):

Now, we want to give more details to the initial model:
connecting the UV light lamp buttons to the controller.
Buttons and controller are weakly synchronized (FUN_1).

To model the synchronization, the events, its needed use of
the weakly action and reaction pattern with these following
final events:



Initializing a:=0 and r:=0.

The pattern can be instantiate as follows (to be applied to
the turning_button action):

a
UVlp_turning_button
a_on Push_UVlp_turning_button
r
UVlp_turning_intensity
a_off Release_UVlp_turning_button
0 FALSO r_on
Controller_push_turning_UVlp_button
1 VERDADERO r_off
Controller_release_turning_UVlp_button

First Refinement: New Environment Events (1):
a _on Push_UVlp_turning_button
when when
a= 0 UVlp_turning_button = FALSO
then then
a:= 1 UVlp_turning_button := VERDADERO
end end

a _off Release_UVlp_turning_button
when when
a = 1 UVlp_turning_button = VERDADERO
then then
a:= 0 UVlp_turning_button := FALSO
end end

r _off Controller_release_turning_UVlp_button
when when
r = 1
UVlp_turning_intensity = VERDADERO
a = 0 UVlp_turning_button = FALSO
then then
r:= 0
UVlp_turning_intensity = FALSO
end End

Refining Controller Events (1):
r _on Controller_push_turning_UVlp_button
Refines
Controller_turning_UVlp
when when
r = 0 UVlp_turning_intensity = FALSO
a = 1 UVlp_turning_button = VERDADERO
UVlp_actuator = turn_off
UVlp_sensor = turn_off
then then
r:= 1 UVlp_turning_intensity = VERDADERO
UVlp_actuator := turning
end end

We can see how patterns can be superposed r_on
(refinement controller events (1)) || a_on (controller event (1)).
The system now have a little more detail, we have the
event/action to turning the UV lamp and the same time, the
intensity of the light increases, its trying to modeling, the
event turning the UV lamp. This refinement refines the initial
model and refines the instantiated pattern. The same
reasoning applies when we are trying to modeling the
action/event "turn_off_button".

> Systems Formal Development by using Discrete Mathematics, Graduate Level Course, May 2, 2009< 4
The pattern can be instantiate as follows (to be applied to
the turn_off_button action):
a
UVlp_turn_off_button
a_on Release_UVlp_turn_off_button
r
UVlp_turn_off intensity
a_off Push_UVlp_turn_off_button
0 FALSO r_on
Controller_release_turn_off_UVlp_button
1 VERDADERO r_off
Controller_pusg_turn_off_UVlp_button

First Refinement: New Environment Events (1):
a _on Release_UVlp_turn_off_button
when when
a= 0 UVlp_turn_off_button = FALSO
then then
a:= 1 UVlp_turn_off_button := VERDADERO
end end

a _off Push_UVlp_turn_off_button
when when
a = 1
UVlp_turn_off_button = VERDADERO
then then
a:= 0 UVlp_turn_off_button:= FALSO
end end

r _on Controller_release_turning_UVlp_button
when when
r = 0 UVlp_turn_off intensity = FALSO
a = 1 UVlp_turn_off_button = VERDADERO
then then
r:= 1 UVlp_turn_off_intensity = VERDADERO
end End

Refining Controller Events (2):
r _off Controller_push_turn_off_UVlp_button
Refines
Controller_turn_off_UVlp
when when
r = 1 UVlp_turn_off_intensity = VERDADERO
a = 0 UVlp_turn_off_button = FALSO
UVlp_actuator = turning
UVlp_sensor = turning
then then
r:= 0 UVlp_turn_off_intensity = FALSE
UVlp_actuator := turn_off
end end













The Context (extends the initial):



The State (refines the initial): Event-B Model (Rodin):


> Systems Formal Development by using Discrete Mathematics, Graduate Level Course, May 2, 2009< 5