Skip to main content
Log in

Rodin: an open toolset for modelling and reasoning in Event-B

  • VSTTE 2008
  • Published:
International Journal on Software Tools for Technology Transfer Aims and scope Submit manuscript


Event-B is a formal method for system-level modelling and analysis. Key features of Event-B are the use of set theory as a modelling notation, the use of refinement to represent systems at different abstraction levels and the use of mathematical proof to verify consistency between refinement levels. In this article we present the Rodin modelling tool that seamlessly integrates modelling and proving. We outline how the Event-B language was designed to facilitate proof and how the tool has been designed to support changes to models while minimising the impact of changes on existing proofs. We outline the important features of the prover architecture and explain how well-definedness is treated. The tool is extensible and configurable so that it can be adapted more easily to different application domains and development methods.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Similar content being viewed by others


  1. Abrial J.-R. (1996) The B-Book: Assigning Programs to Meanings. Cambridge University Press, Cambridge

    Book  MATH  Google Scholar 

  2. Abrial J.-R. (2010) Modelling in Event-B: System and Software Design. Cambridge University Press, Cambridge

    Google Scholar 

  3. Abrial J.-R., Butler M., Hallerstede S., Voisin L. (2006) An open extensible tool environment for Event-B. In: Liu Z., He J. (eds) ICFEM 2006, vol. 4260. Springer, Berlin, pp 588–605

    Google Scholar 

  4. Abrial, J.-R., Cansell, D.: Click’n’Prove: Interactive Proofs within Set Theory. In: Theorem Proving in Higher Order Logics. LNCS, vol. 2758, pp. 1–24 (2003)

  5. Abrial J.-R., Hallerstede S. (2007) Refinement, decomposition, and instantiation of discrete models: application to Event-B. Fundam. Inf. 77(1–2): 1–28

    MATH  MathSciNet  Google Scholar 

  6. Back R.J.R. (1990) Refinement calculus. Part II. Parallel and reactive programs. In: de Bakker J.W., de Roever W.-P., Rozenberg G. (eds) Stepwise Refinement of Distributed Systems. Lecture Notes in Computer Science, vol. 430. Springer, Berlin, pp 67–93

    Google Scholar 

  7. Back R.J.R., von Wright J. (1990) Refinement calculus. Part I. Sequential nondeterministic programs. In: de Bakker J.W., de Roever W.P., Rozenberg G. (eds) Stepwise Refinement of Distributed Systems. Lecture Notes in Computer Science, vol. 430. Springer, Berlin, pp 42–66

    Google Scholar 

  8. Back R.-J. (1989) Refinement Calculus. II. Parallel and Reactive Programs. In: de Bakker J.W., de Roever W.P., Rozenberg G. (eds) Stepwise Refinement of Distributed Systems. Lecture Notes in Computer Science, vol. 430. Springer, Berlin, pp 67–93

    Google Scholar 

  9. Badeau, F., Amelot, A.: Using B as a high level programming language in an industrial project: Roissy VAL. In: Helen, T., Steve, K., Martin, H., Steve, S. (eds.) ZB 2005. LNCS, vol. 3455, pp. 334–354 (2005)

  10. Balser M., Reif W., Schellhorn G., Stenzel K., Thums A. (2000) Formal system development with KIV. In: Maibaum T. (eds) Fundamental Approaches to Software Engineering. LNCS, vol. 1783. Springer, Berlin

    Google Scholar 

  11. Barnett, M., Chang, B.-Y., DeLine, R., Jacobs, B., Rustan, K., Leino, M.: Boogie: A Modular Reusable Verifier for Object- Oriented Programs. In: FMCO 2005, volume LNCS. Springer, Berlin (2005, to appear)

  12. Barrett, C., Ranise, S., Stump, A., Tinelli, C.: The Satisfiability Modulo Theories Library (SMT-LIB). (2008)

  13. Behm P., Burdy L., Meynadier J.-M. (1998) Well defined B. In: B ’98. Springer, London UK, pp 29–45

    Google Scholar 

  14. Bertot Y., Castéran P. (2004) Interactive theorem proving and program development: Coq’Art: the calculus of inductive constructions. Texts in Theoretical Computer Science. Springer, Berlin

    Google Scholar 

  15. Börger E., Stärk R. (2003) Abstract State Machines: A Method for High-Level System Design and Analysis. Springer, Berlin

    MATH  Google Scholar 

  16. Brucker A.D., Rittinger F., Wolff B. (2003) HOL-Z 2.0: A proof environment for Z-specifications. J. Universal Comput. Sci. 9(2): 152–172

    Google Scholar 

  17. Butler M.J. (1996) Stepwise refinement of communicating systems. Sci. Comput. Program. 27(2): 139–173

    Article  MATH  Google Scholar 

  18. Clearsy. Atelier B tool homepage.

  19. Detlefs D., Nelson G., Saxe J.B. (2005) Simplify: a theorem prover for program checking. J. ACM 52(3): 365–473

    Article  MathSciNet  Google Scholar 

  20. Eclipse. Eclipse platform homepage.

  21. Filliâtre J.C. (2003) Verification of non-functional programs using interpretations in type theory. J. Funct. Program. 13(4): 709–745

    Article  MATH  Google Scholar 

  22. Gamma E., Beck K. (2003) Contributing to Eclipse. Addison Wesley, Reading

    Google Scholar 

  23. Hallerstede, S.: The Event-B Proof Obligation Generator. Technical report. ETH Zürich (2005)

  24. Hallerstede S. (2007) Justifications for the Event-B modelling notation. In: Julliand J., Kouchnarenko O. (eds) B 2007. LNCS, vol. 4355. Springer, Berlin, pp 49–63

    Google Scholar 

  25. Hoos H.H., Stützle T. (2000) SATLIB: an online resource for research on SAT. In: Gent I.P., Maaren H.V., Walsh T. (eds) SAT 2000. IOS Press, Amsterdam, pp 283–292

    Google Scholar 

  26. Kaufmann M., Strother Moore J. (1997) An industrial strength theorem prover for a logic based on common lisp. IEEE Trans. Softw. Eng. 23(4): 203–213

    Article  Google Scholar 

  27. King, J.C.: A new approach to program testing. In: Proceedings of the International Conference on Reliable software, pp 228–233. ACM Press, New York (1975)

  28. Lamport L. (2002) Specifying Systems, The TLA+ Language and Tools for Hardware and Software Engineers. Addison-Wesley, Reading

    Google Scholar 

  29. Långbacka, T., von Wright, J.: Refining reactive systems in HOL using action systems. In: Gunter, E.L., Felty, A.P. (eds.) Theorem Proving in Higher Order Logics, 10th International Conference, TPHOLs’97. Lecture Notes in Computer Science, vol. 1275, pp 183–197. Springer, Berlin (1997)

  30. Leuschel, M., Butler, M.: ProB: A Model Checker for B. In: Araki, K., Gnesi, S., Mandrioli, D. (eds.) Proceedings FME 2003, Pisa, Italy, LNCS, vol. 2805, pp. 855–874. Springer, Berlin (2003)

  31. Mehta, F.: Supporting proof in a reactive development environment. In: SEFM, pp. 103–112. IEEE Computer Society, USA (2007)

  32. Mehta F. (2008) A practical approach to partiality—a proof based approach. In: Liu S., Maibaum T.S.E., Araki K. (eds) ICFEM. Lecture Notes in Computer Science, vol. 5256. Springer, Berlin, pp 238–257

    Google Scholar 

  33. Mehta, F.: Proofs for the Working Engineer. PhD thesis, ETH Zurich (2008)

  34. Morgan, C., Hoang, T.S., Abrial, J.-R.: The challenge of probabilistic Event-B—extended abstract. In: Treharne, H., King, S., Henson, M.C., Schneider, S.A. (eds.) ZB 2005: Formal Specification and Development in Z and B, 4th International Conference of B and Z Users. Lecture Notes in Computer Science, vol. 3455, pp. 162–171. Springer, Berlin (2005)

  35. Nipkow T. (2003) Structured Proofs in Isar/HOL. In: Geuvers H., Wiedijk F. (eds) Types for Proofs and Programs (TYPES 2002). LNCS, vol. 2646. Springer, Berlin, pp 259–278

    Chapter  Google Scholar 

  36. Paulson L.C. (1994) Isabelle: A Generic Theorem Prover. Lecture Notes in Computer Science, vol. 828. Springer, Berlin

    Google Scholar 

  37. Saaltink, M.: The Z/EVES system. In: Bowen, J.P., Hinchey, M.G., Till, D. (eds.) ZUM ’97: The Z Formal Specification Notation, 10th International Conference of Z Users. Lecture Notes in Computer Science, vol. 1212, pp. 72–85. Springer, Berlin (1997)

  38. Snook C.F., Butler M.J. (2006) UML-B: Formal modeling and design aided by UML. ACM Trans. Softw. Eng. Methodol 15(1): 92–122

    Article  Google Scholar 

  39. Spivey J.M. (1992) The Z Notation: A Reference Manual, International Series in Computer Science, 2nd edn. Prentice-Hall, New York

    Google Scholar 

  40. Winterstein, D., Aspinall, D., Lüth, C.: Proof general/eclipse: A generic interface for interactive proof. In: IJCAI, pp. 1587–1588 (2005)

Download references

Author information

Authors and Affiliations


Corresponding author

Correspondence to Michael Butler.

Additional information

The continued development of the Rodin toolset is funded by the EU research project ICT 214158 DEPLOY (Industrial deployment of system engineering methods providing high dependability and productivity) The toolset was originally developed as part of the project IST 511599 RODIN (Rigorous Open Development Environment for Complex Systems). The tool may be downloaded from

Rights and permissions

Reprints and permissions

About this article

Cite this article

Abrial, JR., Butler, M., Hallerstede, S. et al. Rodin: an open toolset for modelling and reasoning in Event-B. Int J Softw Tools Technol Transfer 12, 447–466 (2010).

Download citation

  • Published:

  • Issue Date:

  • DOI: