{ "id": "epeex79gcc", "slug": "b-method", "title": "B-Method", "updated": "2026-10-21", "topic_path": [ { "id": "technology", "label": "Technology and the built world", "api_url": "https://www.edgepedia.org/api/v1/topics/technology" }, { "id": "technology.computing", "label": "Computing and digital systems", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing" }, { "id": "technology.computing.software", "label": "Software and programming", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.software" }, { "id": "technology.computing.software.software_engineering", "label": "Software engineering and development process", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.software.software_engineering" }, { "id": "technology.computing.software.software_engineering.software-testing-and-quality", "label": "Software testing and quality", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.software.software_engineering.software-testing-and-quality" } ], "geo": [ { "id": "geo.nongeo.t1946.technology.computing.software.software_engineering", "label": "Non-geographic · 1946 to 2000: Software engineering and development process", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t1946.technology.computing.software.software_engineering", "path": [ { "id": "geo.nongeo", "label": "Non-geographic", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo" }, { "id": "geo.nongeo.t1946", "label": "Non-geographic · 1946 to 2000", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t1946" }, { "id": "geo.nongeo.t1946.technology", "label": "Technology and the built world", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t1946.technology" }, { "id": "geo.nongeo.t1946.technology.computing", "label": "Computing and digital systems", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t1946.technology.computing" }, { "id": "geo.nongeo.t1946.technology.computing.software", "label": "Software and programming", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t1946.technology.computing.software" }, { "id": "geo.nongeo.t1946.technology.computing.software.software_engineering", "label": "Software engineering and development process", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.nongeo.t1946.technology.computing.software.software_engineering" } ] } ], "excerpt": "The B-Method is a formal method for specifying, designing, and coding software by mathematical modeling, generating proof obligations that guarantee correctness; it underlies safety-critical systems like Paris Métro Line 14.", "snippet": "The B-Method is a formal method for specifying, designing, and coding software by mathematical modeling, generating proof obligations that guarantee correctness; it underlies safety-critical systems like Paris Métro Line 14.", "node": "technology.computing.software.software_engineering.software-testing-and-quality", "markdown": "# B-Method\n\nThe B-Method is a formal method for specifying, designing, and coding software systems by mathematical modeling,[1](https://www.cambridge.org/core/books/bbook/D0FA939B9F72E49DBA14BA0F68491118) in which a development gives rise to proof obligations that guarantee its correctness.[2](http://www.imm.dtu.dk/~dibj/cai/cai-b.pdf) Its final artifact is a set of proved models whose lowest refinement, written in the implementable B0 subset, is translated into C, C++, or Ada.[3](https://b-method.gitbook.io/training-resources-for-atelier-b/guides-and-tutorials/applying-the-b-method) B is used mainly where proof replaces testing in safety-critical software: it underlies Paris Métro Line 14, the Roissy airport shuttle, and Atelier B is currently used by more than 30% of CBTC-based automatic metros worldwide.[4](https://krin.gs/publication/butler-history-of-b-fmics20/butler-history-of-b-fmics20.pdf)\n\n| Key fact | Value |\n|---|---|\n| Mathematical basis | Zermelo–Fraenkel set theory with the axiom of choice and generalized substitutions[2](http://www.imm.dtu.dk/~dibj/cai/cai-b.pdf) |\n| Final artifact | Proved B models; B0 implementations translated to C, C++, or Ada[3](https://b-method.gitbook.io/training-resources-for-atelier-b/guides-and-tutorials/applying-the-b-method) |\n| Correctness criterion | A B project is correct only when all proof obligations have been proved[3](https://b-method.gitbook.io/training-resources-for-atelier-b/guides-and-tutorials/applying-the-b-method) |\n| Flagship deployment | Paris Métro Line 14: 115,000 lines of B, 27,800 proofs, 8.1% interactive, in service since October 1998[5](https://www.jucs.org/jucs_13_5/formal_methods_theory_becoming/jucs_13_5_0619_0628_abrial.pdf) |\n| Main variants | Classical B (refinement to B0, code generation) and Event-B (guarded events, system modeling)[6](https://stups.hhu-hosting.de/downloads/pdf/history-of-b.pdf) |\n| Principal tools | Atelier B (classical B), Rodin (Event-B), ProB (animation, constraint solving, model checking)[4](https://krin.gs/publication/butler-history-of-b-fmics20/butler-history-of-b-fmics20.pdf) |\n| Known caveat | Generated code is not formally proved; mitigated by dual code generators with a runtime voter[3](https://b-method.gitbook.io/training-resources-for-atelier-b/guides-and-tutorials/applying-the-b-method) |\n\n## How it works\n\nB rests on [Zermelo–Fraenkel set theory](https://www.edgepedia.org/zermelo-fraenkel-set-theory) with the axiom of choice, first-order predicate calculus, and the Generalized Substitution Language (GSL), whose simple form `x := E(x)` resembles an assignment.[2](http://www.imm.dtu.dk/~dibj/cai/cai-b.pdf) GSL extends Dijkstra's guarded-command language and has weakest-precondition semantics: the construct [S]P corresponds to Dijkstra's wp(S, P).[7](https://eprints.soton.ac.uk/250549/1/bbook.html)\n\nA system is modeled as a collection of interdependent Abstract Machines written in Abstract Machine Notation, each comprising a state with an invariant and operations on that state.[8](https://edwardcrichton.github.io/BToolkit/BHELP/BMethod.html) The invariant expresses safety or integrity conditions: the initial state must satisfy it and every operation must preserve it. A precondition is an obligation on the invoker, not a runtime test; operations without non-trivial preconditions are total, or robust.[9](https://cgi.cse.unsw.edu.au/~cs2111/ClassicalB/PDF/intro-b-method-article.pdf) Semantically, a machine is a labeled transition system with an invariant, and soundness corresponds to induction on the set of reachable states.[10](https://inria.hal.science/hal-01305026/file/paper.pdf)\n\nRefinement generates the characteristic proof obligations. Abstract and concrete state variables are linked by a gluing invariant J(x, y); each abstract event must be correctly refined (a simulation), each new event must refine skip, no new event may take control forever, and relative deadlock-freeness must be preserved.[2](http://www.imm.dtu.dk/~dibj/cai/cai-b.pdf) Refinement preserves already proved properties, including safety properties and termination.[2](http://www.imm.dtu.dk/~dibj/cai/cai-b.pdf)\n\n## How it is done\n\nA development has three phases: project management and modeling, proof of the models, and code generation.[3](https://b-method.gitbook.io/training-resources-for-atelier-b/guides-and-tutorials/applying-the-b-method) The practitioner writes an abstract machine, then successive refinements using structuring clauses (includes, imports, promotes, extends for structuring; sees and definitions for sharing; constants, properties, and values for configuration) to handle industrial-size software.[4](https://krin.gs/publication/butler-history-of-b-fmics20/butler-history-of-b-fmics20.pdf) Tools generate the proof obligations automatically; the developer discharges them with an automatic prover first and an interactive prover for the remainder.[10](https://inria.hal.science/hal-01305026/file/paper.pdf)\n\nThe last refinement level, B0, is a subset of the substitution language restricted to implementable constructs, from which tools translate to C, C++, or Ada.[2](http://www.imm.dtu.dk/~dibj/cai/cai-b.pdf) In current Atelier B releases, Ada code generation is an exclusive feature of the Professional Edition, while the Community Edition provides C code generation and, since version 24.04, an experimental Rust translator.[3](https://b-method.gitbook.io/training-resources-for-atelier-b/guides-and-tutorials/applying-the-b-method) Because the code generator itself is not formally developed, the generated source is not formally proved; the documented mitigation is software diversity, running two different code generators with a runtime voter in a 2-out-of-2 architecture.[3](https://b-method.gitbook.io/training-resources-for-atelier-b/guides-and-tutorials/applying-the-b-method) The CLEARSY Safety Platform automates the whole chain, proving a B model and compiling it via the Atelier B C generator and gcc into a binary for dedicated hardware.[11](https://arxiv.org/pdf/2005.10662v1.pdf)\n\n## Origin\n\nThe B-Method is credited to Jean-Raymond Abrial, whose book *Modeling in Event-B: System and Software Engineering* appeared in 2010.[12](https://www.atelierb.eu/wp-content/uploads/2023/07/B_EventB_JRA.pdf) The method was developed mostly by Abrial and was influenced by his earlier work on Z; unlike Z, it covers the whole development cycle from specification to coding.[7](https://eprints.soton.ac.uk/250549/1/bbook.html)\n\nThe industrial line runs through Paris: the SACEM train-protection system on RER Line A, in operation in 1988, used what can be considered a sketch of the B-Method, and in the same year \"The B Tool\" was presented with an unnamed syntax.[4](https://krin.gs/publication/butler-history-of-b-fmics20/butler-history-of-b-fmics20.pdf) In 1989, Alstom, RATP, and SNCF launched a partly government-funded project to industrialize the method; Alstom delivered the B-Toolset internally in 1993, and CLEARSY gathered the property rights in 2001.[4](https://krin.gs/publication/butler-history-of-b-fmics20/butler-history-of-b-fmics20.pdf) The book on B and the Event-B book were published.[12](https://www.atelierb.eu/wp-content/uploads/2023/07/B_EventB_JRA.pdf)\n\n## Variants\n\n**Classical B** targets software: specifications are refined down to B0 and code is generated.[6](https://stups.hhu-hosting.de/downloads/pdf/history-of-b.pdf) **Event-B** targets system-level modeling, using set theory as notation, refinement for abstraction levels, and mathematical proof to verify consistency between levels.[13](https://eprints.soton.ac.uk/271058/) The two differ mechanically: B operations carry pre-conditions, which can be weakened only under refinement and generate two proof rules each (pre-condition and post-condition), while Event-B events carry guards, which can be strengthened only and generate a single rule; Event-B also omits programming constructs such as conditionals, choices, sequencings, and loops, simplifying proof obligations.[12](https://www.atelierb.eu/wp-content/uploads/2023/07/B_EventB_JRA.pdf) Event-B was strongly influenced by action systems.[12](https://www.atelierb.eu/wp-content/uploads/2023/07/B_EventB_JRA.pdf)\n\nTooling splits by variant: Atelier B (ClearSy) for B and Rodin for Event-B, each with a proof obligation generator and provers; Atelier B's prover is also used successfully inside Rodin.[12](https://www.atelierb.eu/wp-content/uploads/2023/07/B_EventB_JRA.pdf) Rodin integrates modeling and proving but includes no prover itself; it maintains sequent-calculus proof trees and takes reasoners and tactics, including Atelier B provers and SMT solvers, as plugins.[13](https://eprints.soton.ac.uk/271058/) • [4](https://krin.gs/publication/butler-history-of-b-fmics20/butler-history-of-b-fmics20.pdf) ProB is an animator, constraint solver, and model checker.[4](https://krin.gs/publication/butler-history-of-b-fmics20/butler-history-of-b-fmics20.pdf)\n\n## Applications\n\nParis Métro Line 14's safety-critical software comprised 115,000 lines of B generating 86,000 lines of Ada, with 27,800 proofs of which 8.1% were interactive, taking 7.1 man-months; it has run since October 1998.[5](https://www.jucs.org/jucs_13_5/formal_methods_theory_becoming/jucs_13_5_0619_0628_abrial.pdf) The Roissy shuttle used 183,000 lines of B, 158,000 lines of Ada, 43,610 proofs, 3.3% interactive, and 4.6 man-months.[5](https://www.jucs.org/jucs_13_5/formal_methods_theory_becoming/jucs_13_5_0619_0628_abrial.pdf) In both projects B covered only the safety-critical third of the software, and no unit testing was performed, being replaced by successful global tests.[5](https://www.jucs.org/jucs_13_5/formal_methods_theory_becoming/jucs_13_5_0619_0628_abrial.pdf)\n\nA platform screen door controller for Paris line 13 used 3,500 lines of B, about 1,000 proof obligations, 90% discharged automatically, and the rest in two days with the interactive prover; a team of four built it, and an 8-month experiment controlling around 96,000 trains observed no fault.[14](https://www.atelierb.eu/wp-content/uploads/2023/02/Formal_Methods_in_Safety-Critical_Railway_Systems.pdf) Similar B-based train control systems have been developed for the New York City, Barcelona, and Prague subways, and Paris Métro Line 1.[5](https://www.jucs.org/jucs_13_5/formal_methods_theory_becoming/jucs_13_5_0619_0628_abrial.pdf)\n\n## Limitations and alternatives\n\nAbrial himself names the main challenge as the poor spread of B in industry: it is essentially used in train systems, and other sectors (energy, automotive, aeronautics, space) report that established engineering approaches are too difficult to modify.[12](https://www.atelierb.eu/wp-content/uploads/2023/07/B_EventB_JRA.pdf) A development generates a large number of proof obligations, so mastering [proof complexity](https://www.edgepedia.org/proof-complexity) is the central practical issue, and the prover's power is bounded by classical results over logical theories.[2](http://www.imm.dtu.dk/~dibj/cai/cai-b.pdf) Concurrency is modeled as interleaving: at any step any enabled transition may be taken, and a stuttering step must be written explicitly with the skip substitution.[15](https://csclub.uwaterloo.ca/~abandali/bandali-mmath-thesis-for-readers.pdf) The toolchain itself is not machine-checked; formalizations of B in Isabelle/HOL (including a verified proof-obligation generator), in Coq and PVS, and a Coq proof system address this gap.[10](https://inria.hal.science/hal-01305026/file/paper.pdf)\n\nCompared with Z, B shares ZF set theory but uses a predicate-transformer semantics closer to programming than Z's before-and-after predicates, and it distinguishes pre-conditions from guards, which Z does not; compared with VDM, B keeps classical two-valued logic where VDM uses three-valued logic for undefinedness.[2](http://www.imm.dtu.dk/~dibj/cai/cai-b.pdf) Event-B's refinement calculus is close to Back's action systems, and TLA+ likewise builds on set theory.[2](http://www.imm.dtu.dk/~dibj/cai/cai-b.pdf) Surveys of the ABZ family note that formal methods overall remain marginal in industrial engineering, partly for lack of selection guidelines.[16](https://link.springer.com/chapter/10.1007/978-3-319-33600-8_13)\n\nB's higher-order data (functions, nested relations over unbounded domains) limits direct SMT support: set comprehensions, relational composition, closure, quantified union and intersection, and cardinality have no native SMT-LIB counterparts.[17](https://link.springer.com/article/10.1007/s10009-022-00682-y) In Rodin, a plug-in translating Event-B proof obligations to SMT-LIB cut unproved obligations from 196 (Atelier B provers alone) to 31 when all reasoners were combined, although each SMT solver is individually less effective than the Atelier B provers.[18](https://people.montefiore.uliege.be/pfontain/Deharbe10.pdf)\n\n## References\n\n1. [The B-Book: Assigning Programs to Meanings (J. R. Abrial, Cambridge University Press)](https://www.cambridge.org/core/books/bbook/D0FA939B9F72E49DBA14BA0F68491118)\n2. [Foundations of the B Method (Cansell & Méry survey)](http://www.imm.dtu.dk/~dibj/cai/cai-b.pdf)\n3. [Applying the B Method (Atelier B training documentation)](https://b-method.gitbook.io/training-resources-for-atelier-b/guides-and-tutorials/applying-the-b-method)\n4. [The First Twenty-Five Years of Industrial Use of the B-Method (Butler, Körner, Krings, Leuschel et al., FMICS 2020)](https://krin.gs/publication/butler-history-of-b-fmics20/butler-history-of-b-fmics20.pdf)\n5. [Formal Methods: Theory Becoming Practice (Abrial, JUCS 13(5), 2007)](https://www.jucs.org/jucs_13_5/formal_methods_theory_becoming/jucs_13_5_0619_0628_abrial.pdf)\n6. [The History and Evolution of B and Event-B (Körner, Krings, Leuschel, Butler, Lecomte, Voison)](https://stups.hhu-hosting.de/downloads/pdf/history-of-b.pdf)\n7. [Review of The B-Book (Southampton eprints copy)](https://eprints.soton.ac.uk/250549/1/bbook.html)\n8. [The B-Method (B-Core B-Toolkit on-line help)](https://edwardcrichton.github.io/BToolkit/BHELP/BMethod.html)\n9. [Introduction to the B Method and B Toolkit (UNSW course notes)](https://cgi.cse.unsw.edu.au/~cs2111/ClassicalB/PDF/intro-b-method-article.pdf)\n10. [Software component design with the B method, a formalization in Isabelle/HOL](https://inria.hal.science/hal-01305026/file/paper.pdf)\n11. [The CLEARSY Safety Platform: 5 Years of Research, Development and Deployment](https://arxiv.org/pdf/2005.10662v1.pdf)\n12. [On B and Event-B: Principles, Success and Challenges (J.-R. Abrial)](https://www.atelierb.eu/wp-content/uploads/2023/07/B_EventB_JRA.pdf)\n13. [Rodin: an open toolset for modelling and reasoning in Event-B (Abrial, Butler, Hallerstede, Hoang, Mehta, Voisin, STTT 2010)](https://eprints.soton.ac.uk/271058/)\n14. [Formal Methods in Safety-Critical Railway Systems (ClearSy industrial experience report)](https://www.atelierb.eu/wp-content/uploads/2023/02/Formal_Methods_in_Safety-Critical_Railway_Systems.pdf)\n15. [A Comprehensive Study of Declarative Modelling Languages (Bandali, MMath thesis, University of Waterloo)](https://csclub.uwaterloo.ca/~abandali/bandali-mmath-thesis-for-readers.pdf)\n16. [How to Select the Suitable Formal Method for an Industrial Application: A Survey (Kossak & Mashkoor, ABZ 2016, LNCS 9675)](https://link.springer.com/chapter/10.1007/978-3-319-33600-8_13)\n17. [SMT solving for the validation of B and Event-B models (STTT)](https://link.springer.com/article/10.1007/s10009-022-00682-y)\n18. [Integrating SMT solvers in Rodin (Deharbe)](https://people.montefiore.uliege.be/pfontain/Deharbe10.pdf)\n\n---\n*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Software and programming › Software engineering and development process › Software testing and quality*\n\n*Initially written Sep 29, 2026 · Reviewed: Sep 30, 2026 · Edited: Sep 30, 2026; Oct 21, 2026 · Last review: Sep 30, 2026*\n\n*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*\n\nLicense: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license\n", "same_as": [], "url": "https://www.edgepedia.org/b-method", "markdown_url": "https://www.edgepedia.org/b-method.md", "license": { "name": "Edgepedia Community License 1.0", "url": "https://www.edgepedia.org/edgepedia/license", "summary": "Free with credit, commercial use included. AI training is open to everyone. For other uses, organizations over USD 100M in revenue or 100M monthly users license separately.", "spdx": "LicenseRef-Edgepedia-Community-1.0" }, "credit": "\"B-Method\", Edgepedia (EdgeChat), https://www.edgepedia.org/b-method. Edgepedia Community License 1.0.", "credit_md": "\"[B-Method](https://www.edgepedia.org/b-method)\", Edgepedia (EdgeChat), [https://www.edgepedia.org/b-method](https://www.edgepedia.org/b-method). [Edgepedia Community License 1.0](https://www.edgepedia.org/edgepedia/license).", "credit_html": "\"B-Method\", Edgepedia (EdgeChat), https://www.edgepedia.org/b-method. Edgepedia Community License 1.0.", "speakable": "The B-Method is a formal method for specifying, designing, and coding software by mathematical modeling, generating proof obligations that guarantee correctness; it underlies safety-critical systems like Paris Métro Line 14." }