Research Article

A LTS Approach to Control in Event-B

Table 1

System requirements.

Introduced Events System Requirements.

Level0SND_progress,
RCV_progress,
brp
Component Requirements
 Com0.1: The event brp cannot occur unless the sender has completed the event SND_progress.
Com0.2: The event brp cannot occur unless the event RCV_progress has been completed.
Flow Requirements
 Flow0.1: SND_progress, and RCV_progress can occur interleaving in arbitrary.
Flow0.2: The event brp cannot occur unless events SND_progress and RCV_progress have both completed.

Level1SND_success,
SND_failure,
RCV_success,
RCV_failure.
Component Requirements
 Com1.1: After the sender is initialized, it may send successfully or may fail to send, and then the brp event occurs.
Com1.2: After the receiver is initialized, it may be successful to receive or fail to receive, and then the brp event occurs.
Flow Requirements
 Flow1.1: When the system is initialized, only event SND_failure or RCV_success can occur.
Flow1.2: Sender failed event will cause the receiver to fail.
Flow1.3: Receiver succeed event will cause the sender to succeed.

Level2RCV_rcv_current_dataComponent Requirements
 Com2.1: If the received data is not the last data, the event RCV_current_data occurs. If the received data is the last data, the event RCV_success occurs.

Level3SND_snd_data,
SND_timeout,
SND_rcv_curr_ack
Component Requirements
 Com3.1: The event SND_snd_data occurs if the message to be sent is not the last message.
Com3.2: If the message to be sent is the last message, the event SND_success occurs.
Com3.3: The sender may receive an acknowledgement message only after the data has been sent.
Com3.4: After sending the data, the sender may occur a time out event because the acknowledgment message has not been received.
Com3.5: The sender will send the next data after receiving the acknowledgment message.
Com3.6: The sender will send the current data again after a time out event occurs.
Flow Requirements
 Flow3.1: The receiver may accept the current data only after the sender has sent the data.
Flow3.2: After the sender sends the data, the event RCV_success may occur (that is, accept the last data).