This paper investigates model checking Object-Z classes via their translation to the input notation of the CSP model checker FDR. Such a translation must not only be concerned with preserving the semantics of the original specification, but also with how efficiently the resulting specification can be model checked. Hence, the paper investigates alternative translation schemes and compares how efficiently the resulting specifications can be checked.

Abstract. Timed CSP extends CSP by introducing a capability to quantify temporal aspects of sequencing and synchronization. It is a powerful language to model real time reactive systems. However, there is no verification tool support for proving critical properties over systems modelled using Timed CSP. In this work, we construct a reasoning method using Constraint Logic Programming (CLP) as an underlying reasoning mechanism for Timed CSP. We start with encoding the semantics of Timed CSP in CLP, which allows a systematic translation of Timed CSP to CLP. Powerful constraint solver like CLP(R) is then used to prove traditional safety properties and beyond, e.g., reachability, deadlock-freeness, timewise refinement relationship, lower or upper bound of a time interval, etc. Counter-examples are generated when properties are not satisfied. Moreover, our method also handles useful extensions to Timed CSP. Finally, we demonstrate the effectiveness of our approach through case study of standard real time systems. 1

Abstract. Event-B has emerged as one of the dominant state-based formal techniques used for modelling control-intensive applications. Due to the blocking semantics of events, their ordering is controlled by their guards. In this paper we explore how process algebra descriptions can be defined alongside an Event-B model. We will use CSP to provide explicit control flow for an Event-B model and alternatively to provide a way of separating out requirements which are dependent on control flow information. We propose and verify new conditions on combined specifications which establish deadlock freedom. We discuss how combined specifications can be refined and the challenges arising from this. The paper uses Abrial’s Bridge example as the basis of a running example to illustrate the framework. Keywords: Event-B, CSP, control flow, integration, consistency, deadlockfreedom 1

Model of Integration) .............. 39 8 6.2 Specifying Models (Concrete Model of Integration) ............... 45 Specification Units 53 7.1 Concrete Specification Units ........................... 54 7.2 Abstract Specification Units ............................ 61 Structuring Mechanisms 65 8.1 Aggregation ..................................... 66 8.1.1 Example ................................... 66 8.1.2 Global Invariants .............................. 68 8.1.3 Syntax .................................... 71 8.1.4 Simple Aggregation ............................ 72 8.1.5 Indexed Aggregation ............................ 78 8.2 Extension ...................................... 83 8.3 Renaming ...................................... 94 8.4 Hiding ........................................ 94 8.5 Parametrisation ................................... 94 8.6 Example: Alternating Bit Protocol ......................... 95 III Formal Foundation 101 Denotational Semantics 103 9.1 Basics ........................................ 103 9.2 Concrete Specification Units (Open System View) ............... 105 9.2.1 Concurrency on Common Data State .................. 105 9.2.2 Semantic Integration: Overview ...................... 109 9.2.3 History Model ................................ 111 9.2.4 Extended Timed Failures Model (ETFM) ................. 122 9.2.5 Timed Failures/States Model (TFSM) .................. 141 9.2.6 Semantic Integration: Definition ...................... 144 9.3 Abstract Specification Units (Open System View) ................ 146 9.4 Closed System View ................................ 147 9.4.1 Concrete Specification Units ....................... 147 9.4.2 Abstract Specification Units ........................ 147 9.5 Definedness of Recursive Process Equations ..............