Skip to main content

michael butler

Follower

1

Following

1

Public Views

Interests

Uploads

Papers by michael butler

09381 Extended Abstracts Collection – Refinement Based Methods for the Construction of Dependable Systems

With our growing reliance on computers, the total societal costs of their failures are hard to un... more With our growing reliance on computers, the total societal costs of their failures are hard to underestimate. Nowadays computers control critical systems from various domains such as aerospace, automotive, railway, business etc. Obviously, such systems must have a high degree of dependability – a degree of trust that can be justifiably placed on them. Although the currently operating systems do have an acceptable level of dependability, we believe that they development process is still rather immature and ad-hoc. The constantly growing system complexity poses an increasing challenge on the system developers and requires significant improvement on the existing developing practice. To address this problem, we investigated how to establish a set of refinement-based engineering methods that can provide the designers with a systematic methodology for development of complex systems.

Methods, Models and Tools for Fault Tolerance

Lecture Notes in Computer Science, 2009

Performing Algorithmic Refinement before Data Refinement in B

Lecture Notes in Computer Science, 2000

On an Extensible Rule-Based Prover for Event-B

Lecture Notes in Computer Science, 2010

Femtosecond-UVA-riboflavin (FUR) cross-linking approach to penetrating keratoplasty and anterior lamellar keratoplasty

Saudi Journal of Ophthalmology, 2011

To introduce femtosecond laser wound design combined with riboflavin/ultraviolet light-A (UVA) co... more To introduce femtosecond laser wound design combined with riboflavin/ultraviolet light-A (UVA) collagen cross-linking at the wound for penetrating (PKP) and anterior lamellar keratoplasty (ALK). Primary outcomes were intraocular pressure (IOP in mmHg) at burst point for the PKP group, and tensile strength (kPa) until dehiscence for the ALK group. Methods: Human corneoscleral rims (N = 20) were mounted on artificial anterior chambers. PKP specimens underwent FUR, femtosecond laser-cut without cross-linking, or conventional corneal transplantation. PKP maximum burst IOP with progressive suture removal was assessed by a digital manometer, in triplicate and by three observers. ALK involved whole human globes (N = 10) divided into three groups using a 200-micron, 8 mm diameter donor lenticule, with or without cross-linking. Cross-linked specimens were exposed to UVA light (3 mW/cm 2 irradiance, 3.4 J, 370 nm wavelength) for 30 min with 0.1% riboflavin (20% Dextran) applied every 2-min. ALK tensile strength was determined using a digital tensiometer.

UML-B: A plug-in for the event-B tool set

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2008

UML-B provides a graphical front end for Event-B. It adds support for class-oriented and state ma... more UML-B provides a graphical front end for Event-B. It adds support for class-oriented and state machine modelling. UML-B is similar to UML but has its own meta-model. UML-B provides tool support, including drawing tools and a translator to generate Event-B models. The tools are closely integrated with the Event-B tools. When a drawing is saved the translator automatically generates the corresponding Event-B model. The Event-B verification tools (syntax checker and prover) then run automatically providing an immediate display of problems which are indicated on the relevant UML-B diagram. We introduce the UML-B notation, tool support and integration with Event-B.

Verification of UML models by translation to UML-B

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2011

UML-B is a 'UML like' notation based on the Event-B formalism which allows models to be progressi... more UML-B is a 'UML like' notation based on the Event-B formalism which allows models to be progressively detailed through refinements that are proven to be consistent and to satisfy safety invariants using the Rodin platform and its automatic proof tools. UML, on the other hand, encourages large models to be expressed in a single, detailed level and relies on simulation and model testing techniques for verification. The advantage of proof over model-testing is that the proof is valid for all instantiations of the model whereas a simulation must choose a typical instantiation. In the INESS project we take an extant UML model of a railway interlocking system and explore methodical ways to translate it into UML-B in such a way as to facilitate proof that the model satisfies certain safety properties which are expressed as invariants. We describe the translation attempted so far and insights that we have gained from attempting to prove a safety property. We propose some possible improvements to the translation which we believe will make the proof easier.

Composing event-B specifications - Case-study experience

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2011

Event-B is a formal method, based on set theory and firstorder logic, for specification and verif... more Event-B is a formal method, based on set theory and firstorder logic, for specification and verification of reactive systems supported by the Rodin tool kit. Feature modelling is a well-known technique for managing variability and configuring products within software product lines (SPLs). Our objective is to explore whether we can use existing Event-B composition techniques and tooling for feature-based product line development. If case-study experiments reveal these mechanisms to be inadequate, then they also should suggest further research directions. The main objective is to maximise the amount of reuse. This includes avoiding as far as possible having to reprove a composed specification when the models being composed have already been proven. We have modelled two case-studies in Event-B using both horizontal and vertical refinements. This work contributes by analysing existing tools and techniques in Event-B for feature-based development, exploring composition related issues by modelling example case-studies and suggesting further tooling requirements.

Control systems: Phenomena and structuring functional requirement documents

Proceedings - 2012 IEEE 17th International Conference on Engineering of Complex Computer Systems, ICECCS 2012, 2012

Influenced by the Parnas and Madey's fourvariable model and the concept of phenomena in problem f... more Influenced by the Parnas and Madey's fourvariable model and the concept of phenomena in problem frames, we desire to provide guidelines to facilitate refinement-based formal modelling. These guidelines are based on monitored, controlled, mode and commanded (MCMC) phenomena of a control system. Commanded phenomena reflect the role that an operator plays in system control. The mode phenomenon captures the states of the controller. Requirements of several case studies have been formally modelled using the MCMC phenomena. This helped to identify some of the ambiguities and advantages of the guidelines. In particular, we realised that the concept of commanded phenomena and its difference with monitored phenomena can cause confusion. Also, it was noticed that the mode is a special phenomenon, as it can be modified by operator requests or internally by the control system. In this paper we clarify the concept of commanded phenomena and differentiate between monitored and commanded phenomena clearly. The concept of mode phenomenon is also introduced in details. As practical examples, the phenomena of two case studies, namely a cruise control system and a lane centering controller (LCC), are identified. The MCMC phenomena are also used to structure the requirement document (RD) of a control system. This can help with the transition from an informal RD to a formal model. This approach is used to structure the RD of the LCC case study which is supported by our industrial partner.

Symmetry Reduced Model Checking for B

First Joint IEEE/IFIP Symposium on Theoretical Aspects of Software Engineering (TASE '07), 2007

Symmetry reduction is a technique that can help alleviate the problem of state space explosion in... more Symmetry reduction is a technique that can help alleviate the problem of state space explosion in model checking. The idea is to verify only a subset of states from each class (orbit) of symmetric states. This paper presents a framework for symmetry reduced model checking of B machines, which verifies a unique representative from each orbit. Symmetries are induced by the deferred set; a key component of the B language. This contrasts with strategies that require the introduction of a special data type into a language, to indicate symmetry. An extended version of the graph isomorphism program, nauty, is used to detect symmetries, and the symmetry reduction package has been integrated into the PROB model checker. Relevant algorithms are presented, and experimental results illustrate the effectiveness of the method, where exponential speedups are sometimes possible.

The baromodulatory effect of gamma knife irradiation of the hypothalamus in the obese Zucker rat

Stereotactic and functional neurosurgery, 2005

The aim of this study was to evaluate the effect on body weight set point over time of focused, s... more The aim of this study was to evaluate the effect on body weight set point over time of focused, subnecrotic doses of radiation via gamma knife (GK) to the hypothalamus of the genetically obese Zucker rat. A total of 36 adolescent animals were used in this experiment and placed in 6 groups of 6. The genetically obese homozygous Zucker rat was used in 4 groups (n = 24) and received GK, subcutaneous cobalt protoporphyrin (CoPP), both treatments combined or sham treatment. The heterozygous lean Zucker rat was used in 2 control groups (n = 12) and received either GK or sham treatment. All animals were weighed at the beginning of the experiment and at weekly intervals for 34 weeks. GK irradiation was accomplished using a specially designed stereotactic frame and a total dose of 40 Gy was given to 2 nearby targets in the medial hypothalamus. The drug subgroups received weekly subcutaneous injections. All animals were housed in the same environment with unlimited access to food. There were ...

Tool Support for Visualizing CSP in UML

Lecture Notes in Computer Science, 2002

In this paper, we propose an approach to translating UML to CSP that allows one to utilize both U... more In this paper, we propose an approach to translating UML to CSP that allows one to utilize both UML and CSP in a system design. To do so, we divide the visualization task based on three aspects of CSP:(i) the dynamics behavior,(ii) the static architecture, and (iii) the refinement assertions. In doing so we are able to visualize CSP via UML in a hierarchical manner which enhances understanding in the design process. In a way, we also provide a formal verification for the UML diagrams using CSP, since there are model checkers like ...

Applying Event-B Atomicity Decomposition to a Multi Media Protocol

Lecture Notes in Computer Science, 2010

Atomicity Decomposition is a technique in the Event-B formal method, which augments Event-B refin... more Atomicity Decomposition is a technique in the Event-B formal method, which augments Event-B refinement with additional structuring in a diagrammatic notation to support complex refinement in Event-B. This paper presents an evaluation of Event-B atomicity decomposition technique in modeling a multi media case study with the diagrammatic notation. Firstly the existing technique and the diagrammatic notation are shown. Secondly an evaluation is performed by developing a model of a Media Channel System. A Media Channel is established between two endpoints for transferring multi-media data. Finally some extensions to the existing diagrammatic notation are proposed and applied to the multi-media case study.

Systemic embolization by a thrombus in a apparently normal aorta detected with transesophageal echocardiography

Journal of the American Society of Echocardiography, 1997

Reviews : "Concrete" Poetry from East and West Germany. The Language of Exemplarism and Experimentalism. By Liselotte Gumpel. (Yale Germanic Studies 6.) New Haven and London : Yale University Press, 1976. xvi + 268 pp

Journal of European Studies, 1978

Reflections of Mortality: Max Frisch's Triptychon

German Life and Letters, 1979

For a writer whose international reputation rests largely on his contributions to the theatre, it... more For a writer whose international reputation rests largely on his contributions to the theatre, it is a surprising fact that Max Frisch's new work, Triptychon. Drei szenische Bilder (Frankfurt: Suhrkamp, 1978), is not only his first play for over a decade but only the second he has produced since Andorra in 1961. Such apparent reticence vis-h-vis the theatre, however, has been frequently explained by Frisch himself. For example, he put forward his previous play, Biografie (1967), as an attempt to seek a way out of a dramaturgical impasse first delineated in his 'Schiller-Preisrede' of 1965. There Frisch spoke of his increasing dissatisfaction with his earlier experiments with the 'Parabelstiick' , specifically Biedemann und die Brandstifter (1958) and Andorra, which followed 'eine Dramaturgie der Fiigung, eine Dramaturgie der Peripetie' (V, 366).' What concerned Frisch in the middle 1960s-no doubt under the impact of the radical debate on the nature of literature developing at that time in West Germany-was an uneasiness about the predictable nature of the didactic parable from itself: 'Das Gespielte hat einen Hang zum Sinn, den das Gelebte nicht hat' (V, 368). He was looking for a theaue which could more truly reflect an experience of life in which chance always seemed to play the greatest role, 'eine Dramaturgie, die eben die Zufiilligkeit akzentuiert [.. .] eine Dramatik der Permutation' (V, 368f)-a theaue in other words which would emphasise openness, experiment and the possibility of change. However, what had already proved an effective aesthetic principle in the novel Mezn Name sei Gantenbein (1964) by virtue of the fact that its central character never revealed himself but remained an undefined presence at the centre of a web of shifting inventions, turned out to be untranslatable into the concrete terms of the theatre. The ironically named Kiirmann, the protagonist of Siografie, could not in the event escape the complex interrelationships of his past because his essential self was deeply rooted in the past. The medium of the theatre itself, far from suessing the 'play' character of life and thus the possibility of endless variation, merely had an actor confirm Kurmann's fictive identity and reveal him as effectively chained to his biography. Despite Kiirmann's reiterated attempts to test alternative patterns of behaviour, he succeeded only in demonstrating the power of linearity, the very sense of 'Fate' masquerading as 'Chance' that Frisch was at pains to deny. Bzograje in effect turned against its author's intentions. Some ten years later Triptychon-as its title implies-represents a rejection of this experiment with a 'Dramatik der Permutation' in favour of a more radical break with the uaditional linear movement of dramatic language. Surprisingly, however, Frisch has refused for the time being to allow his new play to be tested in the theaue. The ostensible reason for this unusual decision was given in an interview published simultaneously with the play: 66

format_quoteThe play explores inadequacies of language through three interconnected 'Bilder': mourning, the dead in Hades, and futile attempts at recall.format_quote

‘Ein Hoffnungsloser Moralist’: Some Observations on the Narrative World of Gert Hofmann

German Life and Letters, 1994

... the town authmitia who formally strip him of his citizenship (V&hm~Jd, Darmstadt 1988 =Sa... more

csp2B: A Practical Approach to Combining CSP and B

Formal Aspects of Computing, 2000

This paper describes the tool csp2B, which provides a means of combining CSP-like descriptions wi... more This paper describes the tool csp2B, which provides a means of combining CSP-like descriptions with standard B specifications. The notation of CSP provides a convenient way of describing the order in which the operations of a B machine may occur. The function of the tool is to convert CSP-like specifications into standard machine-readable B specifications, which means that they may be animated and appropriate proof obligations may be generated. Use of csp2B means that abstract specifications and refinements may be specified purely using CSP or using a combination of CSP and B. The translation is justified in terms of an operational semantics.

format_quoteWhile adept at modeling parallel activity, B machines struggle with sequential execution without a 'program counter', differing from process algebras.format_quote

On the Use of Data Refinement in the Development of Secure Communications Systems

Formal Aspects of Computing, 2002

We report on experiences gained from the application of data refinement techniques to the develop... more We report on experiences gained from the application of data refinement techniques to the development of examples of secure communications systems. The aim was to the carry the development from initial abstract specification of security services through to detailed designs. The development approach was based on action systems, with B and CSP being used as concrete notations. The security services in question are a confidential communications service and an authenticated transaction service. Refinements include explicit representations of intruder behaviour. The paper makes several interrelated contributions. It demonstrates the feasibility of applying a refinement approach to this type of problem, including an effective way of combining B and CSP in refinements. It introduces a more systematic approach to the development of abstraction invariants and refinement checking. Finally, it illustrates the limitation, when modelling security protocols, of a formalism that does not deal with probability.

Guest Editorial Editorial for the FAC Special Issue based on derivative papers from “Refine ’05”

Formal Aspects of Computing, 2006

We are proud to present a Special Issue on Refinement, originating from the tenth BCS FACS Refine... more We are proud to present a Special Issue on Refinement, originating from the tenth BCS FACS Refinement Workshop, held in 2005. After the ninth workshop was held in 2002 (with a dedicated special issue in Volume 15(2-3) of this journal), UK researchers in the area have been collaborating through the EPSRC RefineNet network, see www.refinenet.org.uk. The organisation of a regular Refinement Workshop in conjunction with BCS FACS is part of the RefineNet remit, and one was held in April 2005, co-located with the ZB conference at the University of Surrey. The next edition will be held at Macao in October 2006, co-located with ICFEM. Workshop proceedings were published in Electronic Notes in Theoretical Computer Science, Volume 137(2). After the workshop, presenters were invited to submit significantly extended papers for inclusion in this special issue; five of these were accepted and have been included here. We, the editors of this Special Issue, are grateful to 'Formal Aspects of Computing' for allowing us to publish this collection of papers in the journal, and for a very pleasant collaboration; to the joint workshop chair J. Derrick and all others who made the workshop such a success by their participation, and to the reviewers involved in selecting the following papers. In "Verifying data refinements using a model checker", Smith and Derrick harness a model checker (SAL for CTL) for checking simulation-based data refinement between Z specifications. The paper by Cavalcanti, Woodcock and Dunne on "Angelic nondeterminism in the unifying theories of programming" shows how angelic and demonic choice together can be embedded in Hoare and He's unifying theories, using binary multirelations. "Tank monitoring: a pAMN case study" by Schneider, Hoang, Robinson and Treharne shows the application of probabilistic B to a small case study. "An analysis of refinement in an abortive paradigm" by Deutsch and Henson provides a model-theoretic account of refinement in the firing conditions interpretation of relational specifications. "The specification logic νZ" by Henson, Deutsch and Kajtazi builds on work by Henson and Reeves to develop a wide-spectrum specification logic similar to Z. The papers presented here have been fully re-reviewed following the normal procedures of the Formal Aspects of Computing Journal.