[Paper Review] Lessons Learned/Sharing the Experience of Developing a Metro System Case Study

Renato Silva|arXiv (Cornell University)|Oct 26, 2012

Model-Driven Software Engineering Techniques7 references3 citations

TL;DR

This paper presents a case study on developing a safety-critical metro system using Event-B and the Rodin platform, emphasizing top-down refinement, decomposition, and generic instantiation to manage complexity. The authors demonstrate that these techniques reduce proof effort by reusing formal proofs and improve model maintainability, achieving 74.6% proof discharge rate across 909 proof obligations with minimal manual effort in a large-scale system model.

ABSTRACT

In this document we share the experiences gained throughout the development of a metro system case study. The model is constructed in Event-B using its respective tool set, the Rodin platform. Starting from requirements, adding more details to the model in a stepwise manner through refinement, we identify some keys points and available plugins necessary for modelling large systems (requirement engineering, decomposition, generic instantiation, among others), which ones are lacking plus strengths and weaknesses of the tool.

Motivation & Objective

• To share practical lessons from developing a large-scale, safety-critical metro system model using formal methods.
• To evaluate the effectiveness of decomposition and generic instantiation in reducing proof effort and improving model manageability.
• To assess the current support of the Rodin platform for large formal models, identifying tool limitations and strengths.
• To promote reusable, structured modeling techniques applicable to industrial-scale embedded systems.
• To address challenges in traceability and requirement engineering within formal methods using available tool extensions.

Proposed method

• Modeling the metro system using Event-B in a top-down, refinement-driven approach starting from abstract system behavior.
• Applying decomposition to split monolithic components into manageable sub-components, reducing state and event complexity.
• Using generic instantiation to reuse formal patterns—specifically for carriage doors—across multiple instances (e.g., emergency and service doors).
• Leveraging Rodin’s plug-ins (Model Decomposition, Shared Event Composition) and manual instantiation to support modularity and proof reuse.
• Discharging proof obligations (POs) through automated and interactive tactics, with a focus on minimizing redundant proof effort.
• Integrating informal requirements with formal models, using ProR plug-in (where available) to support traceability and consistency checking.

Experimental results

Research questions

• RQ1 How can decomposition and generic instantiation improve the manageability and scalability of large formal models in Event-B?
• RQ2 What are the key challenges in proving large-scale Event-B models, and how can they be mitigated through structured modeling techniques?
• RQ3 To what extent can existing Rodin platform plug-ins support the development of complex, industrial-strength formal systems?
• RQ4 How effective is proof reuse through generic instantiation in reducing overall proof effort in formal verification?
• RQ5 What are the limitations of current tool support (e.g., Rodin, ProR) in handling real-world requirements and model evolution?

Key findings

• The case study achieved a 74.6% proof discharge rate (678 out of 909 proof obligations) using Rodin v2.1 with manual generic instantiation and decomposition.
• Generic instantiation significantly reduced proof effort by reusing 257 proof obligations from a base pattern (GCDoor), enabling independent refinement of service and emergency doors.
• Decomposition proved essential in managing model complexity, as it reduced the number of variables and events per component, making proofs more tractable.
• Despite tool limitations, interactive proof discharge was feasible once the correct proof tactics were identified, indicating that formal verification remains viable with proper structuring.
• The absence of automated support for generic instantiation and PO tactic reuse increased manual effort, highlighting a need for future tooling enhancements.
• The integration of informal requirements with formal models remains challenging, though ProR plug-in support (when available) improves traceability and inconsistency detection.