PhD Salvatore Lecca
email: salvatore.lecca@unil.ch.

Vijay Mk Namboodiri

Leonardo Restivo

Nicolas Gervasi

Giuliano Pillolla

Garret D Stuber

PhD Manuel Mameli
email: manuel.mameli@unil.ch

Heterogeneous habenular neuronal ensembles during selection of defensive behaviors

Keywords: Lateral habenula, defensive behaviors, single cell calcium imaging in vivo, aversion

Optimal selection of threat-driven defensive behaviors is paramount to an animal's survival. The lateral habenula (LHb) is a key neuronal hub coordinating behavioral responses to aversive stimuli. Yet, how individual LHb neurons represent defensive behaviors in response to threats remains unknown. Here we show that, in mice, a visual threat promotes distinct defensive behaviors, namely runaway (escape) and action-locking (immobilelike). Fiber photometry of bulk LHb neuronal activity in behaving animals revealed an increase and decrease of calcium signal time-locked with runaway and action-locking, respectively. Imaging single-cell calcium dynamics across distinct threat-driven behaviors identified independently active LHb neuronal clusters. These clusters participate during specific time epochs of defensive behaviors. Decoding analysis of this neuronal activity unveiled that some LHb clusters either predict the upcoming selection of the defensive action or represent the selected action. Thus, heterogeneous neuronal clusters in LHb predict or reflect the selection of distinct threat-driven defensive behaviors.

Introduction

When facing an external threat, animals select from a repertoire of innate behavioral responses ranging from escape (runaway) to immobile-like (actionlocking) strategies [START_REF] Evans | Cognitive Control of Escape Behaviour[END_REF]. These behaviors ultimately increase individual survival, rely on the external environment, and can be adopted by the same animal [START_REF] De Franceschi | Vision Guides Selection of Freeze or Flight Defense Strategies in Mice[END_REF][START_REF] Eilam | Die hard: a blend of freezing and fleeing as a dynamic defense--implications for the control of defensive behavior[END_REF]. The detection of a threat and the optimal selection of such threat-driven actions (i.e. runaway or action-locking) require the coordination of complex brain networks. The recent analysis of threat-driven escape behaviors unraveled the essential contribution of neuronal circuits including the amygdala, the superior colliculus, the periaqueductal grey, the hypothalamus or the midbrain. All of these are pivotal neuronal nodes for aversive processing [START_REF] Evans | A synaptic threshold mechanism for computing escape decisions[END_REF][START_REF] Headley | Embracing Complexity in Defensive Networks[END_REF][START_REF] Silva | The ventromedial hypothalamus mediates predator fear memory[END_REF][START_REF] Tovote | Midbrain circuits for defensive behaviour[END_REF][START_REF] Wang | A VTA GABAergic Neural Circuit Mediates Visually Evoked Innate Defensive Responses[END_REF].

Neurons located in the epithalamic lateral habenula (LHb) signal the negative valence of a stimulus contributing to aversive behaviors [START_REF] Lecca | Aversive stimuli drive hypothalamus-to-habenula excitation to promote escape behavior[END_REF]. Accordingly, habenular neurons in fish, rodents and nonhuman primates, as opposed to midbrain dopamine neurons, respond mainly with an excitation to a variety of aversive stimuli, and reduce their activity after reward presentation [START_REF] Andalman | Neuronal Dynamics Regulating Brain and Behavioral State Transitions[END_REF][START_REF] Lecca | Aversive stimuli drive hypothalamus-to-habenula excitation to promote escape behavior[END_REF][START_REF] Lecca | Aversive stimuli drive hypothalamus-to-habenula excitation to promote escape behavior[END_REF][START_REF] Wang | A VTA GABAergic Neural Circuit Mediates Visually Evoked Innate Defensive Responses[END_REF]. Specifically, aversion-driven LHb neuronal excitation requires hypothalamic glutamate release to shape behavioral responses upon unexpected and predicted aversive events [START_REF] Lazaridis | A hypothalamus-habenula circuit controls aversion[END_REF][START_REF] Lecca | Aversive stimuli drive hypothalamus-to-habenula excitation to promote escape behavior[END_REF][START_REF] Trusel | Punishment-Predictive Cues Guide Avoidance through Potentiation of Hypothalamus-to-Habenula Synapses[END_REF]. Indeed, reducing the efficacy of hypothalamus-to-LHb projections impairs behavioral escape driven by foot shocks, shock-predicting cues and predator-like looming stimulus [START_REF] Lecca | Aversive stimuli drive hypothalamus-to-habenula excitation to promote escape behavior[END_REF][START_REF] Trusel | Punishment-Predictive Cues Guide Avoidance through Potentiation of Hypothalamus-to-Habenula Synapses[END_REF]. The latter evidence indicates a relevant contribution of LHb in encoding environmental threats.

Yet, whether specific neuronal representations in the LHb participate in the selection of threat-driven defensive behaviors (runaway or action-locking), remains unknown.

To examine this question, we performed deep-brain Ca 2+ -imaging of large LHb neuronal populations using a head-mounted miniaturized microscope in mice engaging visual threat-driven defensive responses [START_REF] Resendez | Visualization of cortical, subcortical and deep brain neural circuit dynamics during naturalistic mammalian behavior with head-mounted microscopes and chronically implanted lenses[END_REF]. We combined such large-scale recordings with unsupervised classification of response patterns. This led to the identification of functionally distinct LHb neuronal subpopulations during threat-driven runaway and action-locking. Analysis of responses indicates that multiple neuronal clusters emerge during behavioral strategies holding independent information (i.e. prediction vs action) related to the temporal expression of the behaviors.

Altogether, these data support the participation of LHb neuronal populations in the selection of defensive behaviors when facing an external threat.

Results

Opposing behavioral strategies in response to a visual threat

Ethological studies posit a relationship between the animal-nest distance and the strategy adopted to react to a threat. The closer to a nest, the more likely it is for animals to rapidly runaway to hide. Action-locking responses, instead, occur with higher frequency when the animal is located far from the shelter [START_REF] Yilmaz | Rapid innate defensive responses of mice to looming visual stimuli[END_REF].

Here we investigated these independent threat-driven behavioral strategies in mice using an innately aversive overhead expanding spot (Looming) [START_REF] Yilmaz | Rapid innate defensive responses of mice to looming visual stimuli[END_REF], while mice explore an experimental arena provided with a nest. We randomly triggered the looming stimulus when the mouse explored different zones of the arena with variable distance with respect to the nest (Figure 1A and B). Mice predominantly adopted threat-driven high-speed runaway responses (Figure 1A-D). In a smaller fraction of trials, however, the same animals engaged in a looming-driven action-locking, a behavior outlined by significant speed reduction (Figure 1A-D). Such opposite threat-driven behavioral strategies related to the distance from the nest (Figure 1D).

Multiple looming presentations (maximum of 12) revealed comparable average onset time between runaway and action-locking responses, yet different offset timing, with action-locking events lasting up to tens of seconds (Figure 1E). Altogether, mice can display divergent defensive behaviors to the same visual threat stimulus in a context-dependent fashion.

Threat encoding in the lateral habenula

We next employed fiber photometry to measure fluorescent calcium transients (Ca 2+ ; [START_REF] Cui | Deep brain optical measurements of cell typespecific neural activity in behaving mice[END_REF]) and examined the population dynamics of LHb neurons in freely behaving mice (Figure 2A). We injected rAAV2.5-hSyn1-GCaMP6f into the LHb and implanted an optical fiber above the injection site (Figure 2A 1C). However, speed changes outside the looming presentation did not coincide with fluorescence transients, supporting that spontaneous locomotion does not engage LHb activity (Figure 2-figure supplement 3A, B; [START_REF] Lecca | Aversive stimuli drive hypothalamus-to-habenula excitation to promote escape behavior[END_REF]). Altogether, these data suggest that a threat recruits differential LHb neuronal responses throughout the expression of diverse behavioral strategies (i.e. from stimulus detection to action completion).

Heterogeneity of habenular neuronal activity emerges during defensive behaviors

Analysis of neuronal function with fiber photometry (Figure 2A,B) lacks cellular-level resolution, and provides only aggregated activity from large neuronal populations [START_REF] Resendez | Visualization of cortical, subcortical and deep brain neural circuit dynamics during naturalistic mammalian behavior with head-mounted microscopes and chronically implanted lenses[END_REF]. Such limitation can be circumvented through the use of gradient-refractive-index (GRIN) lenses, which enable visualization of deep-brain neuronal activity with single-cell resolution. We next examined how individual LHb neurons represent threats via their activity patterns. We used a miniature fluorescence microscope to track the relative changes in Ca 2+ fluorescence in LHb neurons in freely moving mice during threat-driven behaviors (Figure 3A; 62 ± 14.6 neurons per animal; n mice = 4). LHb neurons exhibited diverse activity patterns, with sharp elevations in Ca 2+ fluorescence during runaway. The response was in the opposite direction during action-locking trials (Figure 3B and Figure 3-figure supplement 1A). The average Ca 2+ signal across all neurons recorded from a single animal recapitulated the response profiles observed with photometric analysis, supporting the validity of these experimental approaches (Figure 3B, We thereby used an unsupervised clustering algorithm to group the trialaveraged time-locked response of each cell after runaway and action-locking onset (n = 248 from n = 4 mice; Figure 3C and Figure S4A). This analysis revealed eight clusters of neurons based on their responses surrounding the behavioral onset (Figure 3C, Figure 3-figure supplement 2A,B). Clusters were represented in each animal, supporting the strength of independent neuronal representations (Figure 3-figure supplement 2C). The responses of clusters 1 to 5, qualitatively recapitulated fiber photometry Ca 2+ dynamics time-locked to runaway and action-locking onset (Figure 3C). Cluster 7 and 8, instead, were weakly modulated during looming-triggered defensive responses. Interestingly, Clusters 3 and 6 stood out as their pre-action Ca 2+ dynamics discriminated the upcoming behavior (Figure 3C). Altogether, this supports the existence of distinct clusters of individual neurons participating throughout threat-driven behavioral responses.

Decoding the contribution of habenular clusters to threat-driven behaviors

The existence of clusters with neuronal activity that distinguishes the defensive behaviors prior to the onset of the action (especially 3 and 6) raised the intriguing possibility that LHb neurons may predict the upcoming selection of runaway or action-locking. To test this idea, we examined the neuronal coding of LHb ensembles by testing whether the defensive strategy on a given trial was identifiable from individual neuron activity patterns (Figure 4A). We defined three time epochs as "prediction of action" (-3 to 0 s from action), "immediate action" (0 to 3 s from action), and "delayed action" (3 to 6 s from action) (Figure 4B). Using leave-one-out cross-validation of a Naïve Bayes classifier [START_REF] Namboodiri | Single-cell activity tracking reveals that orbitofrontal neurons acquire and maintain a long-term memory to guide behavioral adaptation[END_REF], we calculated the decoding accuracy per neuron above the chance decoding obtained when shuffling trial identity. We then averaged these accuracies across all recorded neurons (Figure 4C) or across all neurons within a cluster (Figure 4D). The null hypothesis was that the average decoding accuracy (above chance) per timeframe and (sub)population is zero. We found that the average decoding accuracy across all recorded neurons was significant for each time epoch (Figure 4C). Interestingly, decoding accuracies showed cluster-specific patterns. Most notably, we found that clusters 3 and 6 showed significant decoding (after correcting for multiple comparison) during the "prediction of action" epoch, whereas other clusters (also including cluster 3) showed significant decoding after the action (Figure 4D). Matching the cluster identity with the topographical neuronal localization during the recordings, revealed that the clusters related to prediction, (clusters 3 and 6), were located caudally with respect to the rest of the clusters (Figure 3-figure supplement 2D).

Overall, these results demonstrate that distinct neuronal subpopulations within the LHb either predict or reflect defensive behavioral selection in response to a threat.

Discussion

Dissecting specific contribution of LHb activity for aversion

The past decade witnessed exponentially growing interest in the essential role the LHb has in regulating negatively motivated behaviors. It is of a general consensus within the field that LHb neurons are a homogenous population of glutamatergic cells mostly controlling the function of neuromodulatory systems [START_REF] Meye | Synaptic and cellular profile of neurons in the lateral habenula[END_REF]. It is also largely accepted that LHb neurons are uniformly excited by aversive external stimuli [START_REF] Lecca | Aversive stimuli drive hypothalamus-to-habenula excitation to promote escape behavior[END_REF][START_REF] Lecca | Aversive stimuli drive hypothalamus-to-habenula excitation to promote escape behavior[END_REF][START_REF] Wang | A VTA GABAergic Neural Circuit Mediates Visually Evoked Innate Defensive Responses[END_REF]. Here, we challenge this vision of homogeneity showing that in response to an identical aversive stimulus (the looming), LHb cells dynamics follow opposite logic in a behavior-dependent manner: an escape reaction (runaway) recruits mainly an activation of LHb cells. In contrast, action-locking responses occur along with a decrease in calcium activity, potentially reflecting neuronal inhibition [START_REF] Namboodiri | Single-cell activity tracking reveals that orbitofrontal neurons acquire and maintain a long-term memory to guide behavioral adaptation[END_REF][START_REF] Shabel | Stress transforms lateral habenula reward responses into punishment signals[END_REF][START_REF] Wang | A VTA GABAergic Neural Circuit Mediates Visually Evoked Innate Defensive Responses[END_REF]. Accordingly, aversive footshock inhibited neuronal activity of a small and territorially distinct subset of LHb cells [START_REF] Congiu | Opposite responses to aversive stimuli in lateral habenula neurons[END_REF]. Based on this, future work should avoid generalizing that LHb contribution to aversion encoding solely relates to its excitation. Notably, the opposite responses emerging after the looming can occur within the same neuron. It is therefore plausible that a given external stimulus drives dissimilar responses in single cells. The substrate (i.e. connectivity or gene) enabling such neuronal population to encode both behavioral aspects remains however an open question.

Functional heterogeneity in LHb for threat-driven behaviors

On the basis of recordings and analysis of around 250 LHb cells while animals experience a threat, here we show how ensembles of neurons represent threat-driven behavioral defensive strategies. An unsupervised clustering reveals that independent sets of active neurons form during the expression of threat-mediated behavioral responses [START_REF] Gründemann | Amygdala ensembles encode behavioral states[END_REF][START_REF] Namboodiri | Single-cell activity tracking reveals that orbitofrontal neurons acquire and maintain a long-term memory to guide behavioral adaptation[END_REF]. Such discrete neuronal clusters are stable and define timeframes of threat detection and behavioral action (Gründemann et al., 2019). It remains unclear however which neurobiological substrate defines LHb clusters. Within the amygdala and the cortex, genetically distinct neuronal subtypes contribute to different phases of adaptive behaviors [START_REF] Abs | Learning-Related Plasticity in Dendrite-Targeting Layer 1 Interneurons[END_REF][START_REF] Douglass | Central amygdala circuits modulate food consumption through a positive-valence mechanism[END_REF][START_REF] Krabbe | Adaptive disinhibitory gating by VIP interneurons permits associative learning[END_REF]. Recent studies identified molecular-level neuronal diversity within the LHb (Wallace et al., 2019;Hashikawa et al., 2019). Exploiting this genetic knowledge may provide an entry point to specifically probe the functional and behavioral relevance of individual LHb neuronal clusters identified in this study. Alternative to a genetic basis, clusters may emerge according to topographical organization, input-specific connectivity or discrete projection targets [START_REF] Cerniauskas | Chronic Stress Induces Activity, Synaptic, and Transcriptional Remodeling of the Lateral Habenula Associated with Deficits in Motivated Behaviors[END_REF][START_REF] Lecca | Aversive stimuli drive hypothalamus-to-habenula excitation to promote escape behavior[END_REF][START_REF] Meye | Shifted pallidal co-release of GABA and glutamate in habenula drives cocaine withdrawal and relapse[END_REF][START_REF] Shabel | Input to the lateral habenula from the basal ganglia is excitatory, aversive, and suppressed by serotonin[END_REF][START_REF] Valentinova | Morphine withdrawal recruits lateral habenula cytokine signaling to reduce synaptic excitation and sociability[END_REF]. Our analysis indicates that some LHb neuronal clusters are topographically distinct. This heightens the need of future studies to address this unresolved questions. Notably, the multilevel heterogeneity (functional, anatomical, molecular) emerging lately replaces the initial uniform connotation attributed to the LHb. Further studies will need to determine the relationship across these multiple levels of heterogeneity and establish their behavioral relevance.

Complex neuronal networks for defensive behaviors

The initial observation that limiting excitation onto LHb impairs escape behaviors implicated this structure in the encoding of innate escape [START_REF] Lecca | Aversive stimuli drive hypothalamus-to-habenula excitation to promote escape behavior[END_REF]. An original aspect of the present work lies on the demonstration that LHb activity changes when animals escape or action-lock after looming presentation. In contrast, recent studies support the contribution of several midbrain nuclei mostly for threat-driven escape [START_REF] Evans | A synaptic threshold mechanism for computing escape decisions[END_REF][START_REF] Seo | Intense threat switches dorsal raphe serotonin neurons to a paradoxical operational mode[END_REF]. Indeed, Ca 2+ imaging and brain circuit manipulation approaches demonstrate that glutamatergic neurons of the dorsal periaqueductal grey encode decision making and escape [START_REF] Evans | A synaptic threshold mechanism for computing escape decisions[END_REF]. In addition, a visual pathway engaging superior colliculus and amygdala also contributes to defensive strategies [START_REF] Shang | Divergent midbrain circuits orchestrate escape and freezing responses to looming stimuli in mice[END_REF]. Finally, GABAergic neurons in the ventral tegmental area (VTA) projecting to the central amygdala (CeA) seem to be similarly instrumental for threat-driven escape responses [START_REF] Wang | A VTA GABAergic Neural Circuit Mediates Visually Evoked Innate Defensive Responses[END_REF]. Intriguingly, LHb axons innervate these VTA-GABA cells projecting to CeA. Future studies should test how diverse defensive strategies engage wide interconnected networks activity to ultimately build an integrated framework for threat-driven behavioral responses. Defensive strategies are a combination of behavioral sets relying on unique features including trajectories, or stereotyped movements [START_REF] Evans | Cognitive Control of Escape Behaviour[END_REF]. The use of deep neural network analysis tracking facets of animal behaviors [START_REF] Nath | Using DeepLabCut for 3D markerless pose estimation across species and behaviors[END_REF][START_REF] Wiltschko | Mapping Sub-Second Structure in Mouse Behavior[END_REF] may pave the way to differentiate precise aspects of defensive behaviors. This will allow a refined alignment with the neuronal dynamics in defined neuronal circuits [START_REF] Klaus | The Spatiotemporal Organization of the Striatum Encodes Action Space[END_REF].

The relationship between LHb function and optimal selection of defensive strategies remains correlative after the analysis of the photometric signal. Yet, the unsupervised clustering and decoding analysis support: i. that LHb activity codes for distinct behavioral strategies, ii. that the dynamics of discrete LHb neuronal clusters reflect precise time epochs of defensive behaviors and iii. that these clusters can predict upcoming selection of the action or represent an action itself [START_REF] Grewe | Neural ensemble dynamics underlying a long-term associative memory[END_REF][START_REF] Namboodiri | Single-cell activity tracking reveals that orbitofrontal neurons acquire and maintain a long-term memory to guide behavioral adaptation[END_REF]. Opto or chemogenetic interrogation of LHb neuronal population offers a mean to probe causality between neuronal activity and behaviors [START_REF] Saunders | Contemporary approaches to neural circuit manipulation and mapping: focus on reward and addiction[END_REF]. However, this intervention is challenging in the present context, as it is limited by the lack of population-specific viral targeting within LHb (i.e. lack of genetic tools for LHb diversity). The manipulation of LHb function in a non cell-specific fashion remains a poor approach to test for causality. This would not fulfill the requirement of precise neuronal cluster targeting, a feature highlighted in the functional and topographical analysis provided in this work.

The latest insights of genetic profiling may soon provide the tools to assess these outstanding questions.

In summary, our results identify the evolution of individual neuronal responses in a deep structure like the LHb during threat-driven behavioral strategies, an objective so far proven challenging due to technical difficulties. We demonstrated that LHb neuronal clusters participate to the optimal selection of defensive strategies. Future studies can provide a link between this functional heterogeneity with genetic and anatomical aspects to establish a comprehensive knowledge of LHb contribution to threat encoding. Altogether, these findings advance our understanding of the neuronal basis of ethologically-relevant innate behaviors. 0.6: 10 vs 2; 0.7: 11 vs 0; 0.8: 9 vs 6; 0.9: 3 vs 3; 1.0: 4 vs 12; X (0.44, 0.12, 2.54, 1.20, 0.35, 2.58, 0.78, 1.94) for the 8 clusters for -3 to 0 s, t 247 = (6.62, 5.03, 4.16, 4.20, 2.07, -0.19, 2.25, 4.33) for the 8 clusters for 0 to 3 s, t 247 = (3.13, 8.66, 2.99, 4.43, 3.27, -2.44, 2.42, 1.67) for the 8 clusters for 3 to 6 s; p values for the three epochs per cluster = (7.55x10 -1 , 9.07x10 -1 , 2.99x10 -2 , 2.96x10 -1 , 7.97x10 -1 , 2.63x10 -2 , 5.28x10 -1 , 7.91x10 -2 ) for -3 to 0 s, (2.87x10 -7 , 4.07x10 -5 , 5.35x10 -4 , 3.39x10 -4 , 6.54x10 -2 , 4.43x10 -1 , 4.54x10 -2 , 1.89x10 -4 ) for 0 to 3 s, and (7.78x10 -3 , 1.18x10 -10 , 1.12x10 -2 , 1.89x10 -4 , 5.67x10 -3 , 9.84x10 -1 , 3.22x10 -2 , 1.31x10 For this comparison, we selected the first runaway and action locking response for each mouse. Then we looked for a single episode outside looming presentation with a comparable change in speed for the same mouse. Note that one mouse did not display any action locking response throughout the recording session.

Data are presented with boxplots (median and 10-90 quartile) or mean ± S.E.M. : 26, 30, 22, 33, 28, 35, 29, 45) and single-mouse contribution per cluster (Cluster 1 to 8, number of cells per cluster. Mouse 1: 16,10,0,7,3,6,7,3. Mouse 2: 4,4,12,8,9,22,5,10. Mouse 3: 4,9,0,8,1,1,0,4. Mouse 4: 2,7,10,10,15,6,17,28).

Material and methods

Experimental subjects

The experiments were performed on C57Bl/6J mice wild-type males of 10-18 weeks. Mice were housed at groups of five per cage with water and food ad libitum on a 12:12 h light cycle (lights on at 7 a.m.). All procedures aimed to fulfill the 3R criterion and were approved by the Veterinary Offices of Vaud (Switzerland; License VD3171).

Behavioral paradigm

Mice were tested for behavior in a looming visual stimulus test, as described elsewhere [START_REF] Yilmaz | Rapid innate defensive responses of mice to looming visual stimuli[END_REF] Automated classification of action-locking behavior. An observer blind to the experimental condition of the animals manually scored the action locking behavior, defined as a sudden blockade of all -except respiratorymovements. In contrast to freezing, action locking was not associated with a particular body posture (i.e. crouching). The sudden immobility had to last at least two seconds in order to score the animal as actively producing an action-locking behavior. Data obtained from the manually labeled frames were then merged with the data (speed and size) obtained from the automatic detection of the mouse position to train a random forest classifier to predict in each frame whether the animal was in action-locking. Both speed and size were convolved with a Max function (window = 60 frames) and a total of four features were used: speed (v), size (s), es, and ev. A 5-fold cross-validation yielded an overall accuracy of 98%. The accuracy achieved on the test set was 97.5% with a false positive rate of 2.6%.

Surgical procedures

Viral injections. All mice were anaesthetized with ketamine (150 mg/kg)/xylazine (10 mg/kg) (Sigma-Aldrich, France). We unilaterally injected in the LHb (-1.4 mm AP, 0.45 ML, 3.1 mm DV) rAAV2.1-hSyn-GCaMP6f-eGFP or rAAV/DJ-hSyn--GCaMP6f-eGFP or rAAV2.5-hSyn-eGFP (University of North Carolina, US) using a glass pipette on a stereotactic frame (Kopf, France). Volumes ranged between 200 and 300 nl, at a rate of approximately 100-150 nl/min. The injection pipette was withdrawn from the brain 10 minutes after the infusion. Animals were allowed to recover for a minimum of two weeks before fiber or GRIN lenses implantation.

Chronic implants. For fiber photometry experiments, a single fiber probe was placed and fixed (C and B Metabond, Parkell) 150 m above the injection site in isoflurane anesthetized (induction: 4%, maintenance: 1.8-2%) mice.

For endoscope experiments, mice were anaesthetized (as described above)

and implanted with a GRIN (Graded-Index) lens (6.1mm length, 0.5mm diameter; Inscopix, #100-000588). The lens was targeted to be ~ 150-200 μm above the injection site using the following coordinates: -1.40 mm posterior to bregma, 0.45 mm lateral from midline, and -2.85 to -2.9 mm ventral to skull surface (lowered at a speed of 1µm/s). To increase stability of the implants the lenses were implanted into the dorsal portion of the region allowing imaging ventral LHb neurons. Two week after lens implantation, mice were again anaesthetized (isoflurane, as above) and a baseplate (Inscopix, #100-000279) was secured above the lens. A baseplate cover (Inscopix, #100-000241) was attached to prevent damage to the microendoscope lens. Out of 23 mice that were injected with GCaMP6f virus, 4 had successful lens implantation/viral expression and were used for this study.

Fiber photometry recordings

Fiber photometry measurements were carried out by the ChiSquare X2-200 system (ChiSquare Biomaging, Brookline, MA). Briefly, blue light from a 473nm picosecond-pulsed laser (at 50 MHz; pulse width ~ 80 ps FWHM) was delivered to the sample through a single mode fiber. Fluorescence emission from the tissue was collected by a multimode fiber with a sample frequency of 100Hz. The single mode and multimode fibers were arranged side by side in a ferrule that is connected to a detachable multimode fiber implant. The emitted photons collected through the multimode fiber pass through a bandpass filter (FF01-550/88, Semrock) to a single-photon detector. Photons were recorded by the time-correlated single photon counting (TCSPC) module (SPC-130EM, Becker and Hickl, GmbH, Berlin, Germany) in the ChiSquare X2-200 system.

Endoscope recordings

All calcium imaging was recorded at 20 frames per second, 200-ms exposure time, and 10-40% LED power (0.4-0.9mW at the objective, 475nm) using a miniature microscope from Inscopix (nVista). Calcium recording files were down-sampled (spatial binning factor of 4) to reduce processing time and file size, filtered, corrected for rigid brain movement and the ΔF/F0 was calculated using as F0 the average fluorescence for all the video (Inscopix, IDP). Individual component analysis and principle component analysis (ICA/PCA) applications were used to identify individual cells and to extract their respective calcium traces.

In addition, to compare ROI detections and relative traces obtained with the PCA/ICA we also performed constrained non-negative matrix factorization for endoscopic data (CNMF-E) for a subset of data. Briefly, we denoised, deconvolved, and demixed calcium-imaging dynamics (http://www.github.com/zhoupc/cnmf_e). This method allows accurate single neurons fluorescence traces extraction (Zhou et al. 2018). Calcium imaging frames were initially pre-processed in Mosaic (Inscopix) for motion correction.

We use a Gaussian kernel width 4 μm, maximum soma diameter 16 μm, minimum local correlation 0.8, minimum peak-to-noise ratio 8 and merging threshold was set to 0.65 for optimal discrimination of temporal and spatial overlap.

Analysis

Photometric signal as well as ICA/PCA derived traces were smoothed (constant time factor, 0.1 s) and further processed according to the trials using Spike2 software (Cambridge Electronic Design). We obtained an average peri-stimulus time histogram (PSTH) trace aligned to the stimulus or behavioral onset/offset (3 s prior and 7 sec after a given event). For the photometric recordings we calculate the photon change normalizing for the 3 sec prior each trial. For the endoscope recordings we z-scored each trials in reference to their baseline (3 s prior to behavior onset).

We identified functional sub-classes of neurons by comparing the fluorescence Ca2+ signals of individual cells before and after a given event, using 2s time span. For runaway trials we consider a cell excited if the signal 2 s post runaway onset was higher than the baseline plus 2 SD. Vice versa a cell was inhibited if its signal in the 2s post runaway resulted 2 SD lower than their baseline. For action-locking responses we considered 3 epochs (2s each epoch) of analysis post event according with the average duration of this behavior (6s). If the signal in at least one epoch resulted higher or lower than 2 SD of the baseline the cell was considered action-locking excited or inhibited respectively.

For the analysis of the single trials we follow the same logic above-mentioned except that the epochs considered for the action locking were updated each time according with the duration of the response.

Clustering and decoding

For clustering neurons based on their average responses around action onset for both action-locking and runaway trials, we followed a similar general procedure as in [START_REF] Namboodiri | Single-cell activity tracking reveals that orbitofrontal neurons acquire and maintain a long-term memory to guide behavioral adaptation[END_REF]. Briefly, we first calculated the average peri-event time histogram (PETH) for each neuron around each action by averaging all trials. Due to the variability in reaction times from looming stimulus onset until the action, we calculated the PETHs around a time window from -0.5 s to +7s surrounding the action. This ensured that only activity after the looming stimulus onset was included in all trials. The PETH surrounding both action-locking and runaway trials were treated as features of the response of a neuron. This feature space was then reduced in dimensionality using principal components analysis (Fig S5). The number of principal components to keep was decided based on the bend in the scree plot [START_REF] Namboodiri | Single-cell activity tracking reveals that orbitofrontal neurons acquire and maintain a long-term memory to guide behavioral adaptation[END_REF]. A spectral clustering algorithm along with optimal selection of number of clusters using silhouette scores [START_REF] Namboodiri | Single-cell activity tracking reveals that orbitofrontal neurons acquire and maintain a long-term memory to guide behavioral adaptation[END_REF]) was used on the principal component scores to test for presence of clusters. The number of clusters was chosen by maximizing the silhouette score. Once cluster identities were assigned, all PETHs were recalculated using the activity from -3 s to +7 s surrounding the actions. Only activity following looming stimulus onset was included. If the looming stimulus onset was less than 3 s prior to action on a trial, these data were treated as "not a number (nan)" in our analysis pipeline.

We then tested for significant decoding by analyzing whether the activity of a single neuron could be used to decode the chosen behavioral action on a trial.

To calculate a decoding accuracy, we trained a Naïve Bayes classifier on all but one trial (leave-one-out cross-validation) and tested the decoding accuracy on the remaining trial for each time epoch (Figure 4B). Within each epoch, three "response features" were used for decoding analysis: slope of the linear fit to fluorescence within the epoch, y-intercept of this fit, and lastly, the standard deviation of fluorescence within the epoch (Figure 4B). Only three features were used to avoid overfitting and maximize generalizability of decoding on test trials. This procedure was repeated with each trial as the test trial, to obtain an overall decoding accuracy above chance accuracy obtained by shuffling trial identity. For the shuffled null, we calculated the mean chance accuracy per neuron as the mean accuracy across ten different shuffles. We applied this procedure to one neuron at a time to obtain a decoding accuracy per neuron, which was then averaged across all neurons recorded, or all neurons within a cluster. The decoding accuracy above chance was simply calculated as the difference in population mean between the true accuracies and the shuffled accuracies. Significance was tested based on a two-sample t-test between the true accuracies and the shuffled accuracies.

Statistical analysis.

Offline analyses were performed using Prism 8 (Graphpad, US

  and Figure 2-figure supplement 1A ). The onset of threat-driven runaway occurred along with a robust increase in Ca 2+ fluorescence from LHb neurons (Figure 2A, B and movie 1). In contrast, looming-driven action-locking developed together with a significant reduction in LHb fluorescence (Figure 2A, B and movie 2). Notably, a significant shift in fluorescence emerged timelocked with the visual looming stimulus and prior the behavior (Figure 2-figure supplement 1B, C). The magnitude of this fluorescence rise was comparable between runaway and action-locking trials (Figure 2-figure supplement 1B, C). The observation that no fluorescence transients occurred in animals injected only with a rAAV2.5-hSyn1-GFP, supports the specificity of signal detection (Figure 2-figure supplement 2A, B). Both runaway and actionlocking expressed along with an abrupt change in speed at the behavioral onset (Figure

Figure 3 -

 3 Figure 3-figure supplement 1A and Figure 2B). Thus, single cell analysis of Ca 2+ signal indicates that opposite neuronal responses in the LHb reflect

  ContributionsS.L. and M.M. conceptualized the project. S.L. performed and analyzed behaviors and in vivo calcium imaging. L.R. provided support for behavioral analysis and experiments. N.G. performed independent calcium imaging analysis. G.P. provided analytical support for the photometric detection.V.M.K.N. and G.D.S. provided support, and analysis for calcium imaging analysis and help in editing the manuscript. M.M. and S.L. wrote the manuscript with the help of all authors.

Figure legends Figure 1 .

 legends1 Figure legends

Figure 2 .

 2 Figure 2. Opposite habenular neuronal dynamics during divergent

Figure 3 .

 3 Figure 3. Distinct LHb neuronal ensembles during defensive behaviors

Figure 4 .

 4 Figure 4. Identified LHb neuronal clusters code for behavioral

Figure 3 -

 3 Figure 3-figure supplement 1. Opposite threat-driven responses occur

Figure 3 -

 3 Figure 3-figure supplement 2. Cluster detection and topography during

(

  D) Topographical distribution of the clusters in LHb (action-predictive vs action-decoding clusters; rostral vs caudal cell distribution; Action-predictive: 57 cells, 9 rostral vs 48 caudal. Action-decoding: 191 cells, 83 rostral vs 108 caudal. X 2 1= 14.4; z=3.79; ***p=0.0001, Chi-Square test).

  photometric and endoscopic recordings using hardware-time signals

  photons

figure supplement 3. LHb neuronal Ca 2+ transients are independent of locomotion.

	(B) Left: Normalized photons time-course graph showing averaged traces of
	Runaway (R, n trials = 21, F 1400 =2.46, p=0.065, RM One way ANOVA) and
	Action-locking (AL, n trials = 12, F 770 =0.946, p=0.401 RM One way ANOVA)
	trials time-locked with the behavioral onset. Right: area under curve (AUC) for
	-1 ) for 3 to 6 s the same data set (R vs AL, 2.662 ± 1.96 vs -0.6096 ± 2.18; t 31 =1.063,
	after Benjamini-Hochberg multiple comparisons correction across all clusters p=0.295, Unpaired t-test).
	and epochs. (C) Same as (B) but trials are locked with the offset of the behavior (R:
	F 1400 =0.83, p=0.394; AL: F 770 =0.906, p=0.452; RM One way ANOVA. AUC
	analysis: (R vs AL, 1.051±1.58 vs 0.3684±2.24; t 31 =0.253, p=0.801 Unpaired
	t-test).
	Data are presented with boxplots (median and 10-90 quartile) or mean ±
	S.E.M.
	Figure 2-(A) Representative traces and boxplots reporting increase in speed (Looming
	on vs Looming off; 11 vs 11; 4.1 ± 0.56 vs 3.3 ± 0.28 pixel/frame; t 20 =1.28,
	p=0.21 Unpaired t-test) and the relative LHb activity (Looming on vs Looming
	off; 11 vs 11, 1.19±0.02 vs 1.00 ± 0.012 normalized photon; t 20 = 7.35,
	***p<0.0001 Unpaired t-test) in presence or absence of the looming stimulus.
	(B) Same as (A) but for decrease in speed (Looming on vs Looming off; 10 vs
	10; -0.7558 ± 0.10 vs -0.9987 ± 0.176 pixel/frame; t 18 =1.190, p=0.249
	Unpaired t-test) and relative LHb photon change (Looming on vs Looming off;
	10 vs 10, 0.9204±0.014 vs 0.9807±0.007 normalized photons; t 18 =3.61,

**p=0.002 Unpaired t-test).

  ). Single data points are always plotted. Sample size was pre-estimated from previously published research and from pilot experiments performed in the laboratory.

	Each mouse represents an analytical unit, for each experiment we stated the
	replication factor. Compiled data are expressed as boxplots (median and
	quartiles) or mean ± S.E.M. Significance was set at p < 0.05 using two-sided
	unpaired t-test, one or two-way ANOVA. Correlational analysis was performed
	with Pearson test. Frequency distribution was analyzed with  2 test. The use
	of the paired t-test and two way ANOVA for repeated measured were stated in
	the legend figure text.

Acknowledgements

We thank all the members of the Mameli laboratory for comments on the manuscript. We thank C. Lüscher, R. Van Zessen, A. Adamantidis, L. Oesch, J. Zapata, and K. Tan for technical assistance. This work was supported by the ERC StG SalienSy 335333, the Swiss National Funds 31003A and Vaud Canton to M.M., the NARSAD Young Investigator to S.L. and V.M.K.N, and K99MH118422 from US National Institute of Mental Health to V.M.K.N.

Competing financial interests

The authors declare no competing financial interests. Single cell sample Lecca et al.,Figure 4 Trials

Supplementary figures legends


P Rivière

N K Singh
email: nsingh@enseeiht.fr

Y Aït-Ameur

G Dupont

Formalising Liveness Properties in Event-B with the Reflexive EB4EB Framework

Keywords: Proof and state-based methods, Event-B and Theories, Metatheory, Reflexive EB4EB framework, Temporal logic, Liveness properties, Traces and soundness

 allowing for manipulation of the core concepts of Event-B, we propose to formalise and operationalise the automatic generation of proof obligations associated to liveness properties expressed in LTL. Furthermore, relying on trace-based semantics, we demonstrate the soundness of this formalisation, and provide a set of intermediate and generic theorems to increase the rate of proof automation for these properties. Finally, a case study is proposed to demonstrate the use of the defined operators for expressing and proving liveness properties.

Introduction

Event-B is a formal method based on explicit state expression, refinement and formal proof. It enables the design of complex systems using correct by construction. This method has been used successfully in the design of many complex systems in various engineering areas such as aeronautics [START_REF] Su | Aircraft landing gear system: approaches with Event-B to the modeling of an industrial system[END_REF], railway systems [START_REF] Butler | Formal modelling techniques for efficient development of railway control products[END_REF][START_REF] Butler | The first twenty-five years of industrial use of the b-method[END_REF], health and medicine [START_REF] Singh | Using Event-B for Critical Device Software Systems[END_REF], etc. In particular, it has shown its effectiveness in establishing properties related to system functionalities, safety, security, reachability and compliance with some temporal requirements, and so on.

Event-B models are machines that express state-transition systems using set theory and first-order logic (FOL). A mechanism of proof by induction enables the demonstration of inductive properties based on the preservation of properties at initialization and by each transition (event). Refinement, on the other hand, is defined by a weak simulation relation in which proof obligations guarantee the preservation of behaviours between levels of abstraction. The Rodin platform supports the development of Event-B models. It offers an environment for model editing, automatic and interactive proofs, animation, model checking, etc. However, Event-B, like all formal methods, lacks some capabilities. Event-B supports the verification of a fragment of temporal logic properties: □ using invariants and theorem clauses and ♢ using variants and convergence proof obligations. There is a lack of composition of temporal logic operators, as well as the ability to express and reason about liveness properties. To remedy this absence, two solutions are possible in general. The first solution consists in embedding an Event-B model in another formal method offering the possibility of expressing and reasoning about liveness properties such as TLA + [START_REF] Lamport | Specifying Systems: The TLA+ Language and Tools for Hardware and Software Engineers[END_REF], NuSMV [START_REF] Cimatti | NuSMV 2: An OpenSource tool for symbolic model checking[END_REF], PRISM [START_REF] Kwiatkowska | PRISM 4.0: Verification of probabilistic real-time systems[END_REF], PAT [START_REF] Sun | Pat: Towards flexible verification under fairness[END_REF], Spin [START_REF] Holzmann | Spin Model Checker, the: Primer and Reference Manual[END_REF], Uppaal [START_REF] Behrmann | A Tutorial on Uppaal[END_REF], ProB [START_REF] Leuschel | ProB: an automated analysis toolset for the B method[END_REF] etc. However, tracing the verification results on the source Event-B models is difficult and care must be taken to guarantee the correctness of this embedding. This approach is very popular and is followed by many authors who use other formal methods allowing to express and verify this type of property without worrying about the correctness of the transformation. However, there exist several approaches to ensuring the transformation's correctness [START_REF] Leroy | Com-pCert -A formally verified optimizing compiler[END_REF][START_REF] Halchin | Handling B models in the PERF integrated verification framework: Formalised and certified embedding[END_REF][START_REF] Pnueli | Translation validation[END_REF][START_REF] Bodeveix | Towards a verified transformation from AADL to the formal component-based language FIACRE[END_REF]. The second solution consists in extending the Event-B method to allow expressing and reasoning about liveness properties. This second approach requires the expression of the semantics and the proof system of the temporal logic in Event-B, as well as establishing the soundness of this extension.

Based on the second approach, JR. Abrial and TS. Hoang [START_REF] Hoang | Reasoning about liveness properties in event-b[END_REF] proposed an axiomatisation of LTL temporal logic for Event-B in their article entitled "Reasoning about liveness properties in Event-B". This work has defined a set of proof obligations allowing to establish temporal properties such as reachability, progress, persistence or until. However, these proof obligations are mathematically formalised in that paper but are neither implemented nor generated automatically. They must be explicitly described in Event-B by the developer for each model, thus leading to formalization errors. Moreover, their proofs are cumbersome and require too much manual effort to proving them.

Relying on the reflexive EB4EB framework [START_REF] Riviere | EB4EB: A Framework for Reflexive Event-B[END_REF][START_REF] Riviere | Reflexive Event-B: Semantics and Correctness the EB4EB Framework[END_REF][START_REF] Riviere | Standalone Event-B models analysis relying on the EB4EB meta-theory[END_REF] defined in Event-B, we propose to formalise and operationalise the automatic generation of proof obligations associated with liveness properties expressed in LTL temporal logic. We define an extension of EB4EB including a set of operators expressing these properties on traces. In addition, we demonstrate the soundness of these properties on model traces. Finally, a set of intermediate and generic theorems are also proposed to increase the rate of proof automation. Note that our proposed approach is non-intrusive (self-contained) and does not require the use of any other formal techniques or tools; it is fully formalised in Event-B and mechanised on the Rodin platform.

This paper is organised as follows. Section 2 describes the Event-B modelling language and its Theory plugin extension. Section 3 recalls linear temporal logic, and the EB4EB framework is described in Section 4. Section 5 presents the tracebased semantics of Event-B, and its soundness properties. Section 6 describes a case study that will be used as a running example to show how to use defined LTL operators. Section 7 presents the temporal logic proof rules encoded as EB4EB proof obligations. Their correctness is discussed in Section 8. Section 9 summarises related work, and Section 10 concludes the paper.

Event-B

Event-B [START_REF] Abrial | Modeling in Event-B: System and software engineering[END_REF] is a state-based, correct-by-construction formal method, where systems are modelled with a set of events representing state changes, using firstorder logic (FOL) and set theory. Contexts and machines (Tables 1.a and 1.b). Contexts (Table 1.a) encompass the model's static part: carrier sets s and constants c, as well as their properties, through axioms A and theorems T ctx . Machines (Table 1.b) describe the model's behaviour, using a set of events evt, each of which may be guarded G and/or parameterized by α. An event models the evolution of a set of variables x using a Before-After Predicate (BAP ) that links the before (x) and after (x ′ ) value of the variables. Safety properties are encoded using invariants I(x) and theorems T mch (x), and variants V (x) may be defined to demonstrate the machine's convergence. Model consistency is established by discharging a number of automatically generated POs (Table 2).

Refinements. One strength of Event-B is its refinement operation, which is used to transform an abstract model into a more concrete one, adding information (refined states) and behavioural (refined events) details gradually, while This extension is central for embedding, as data types, concepts that are unavailable in core Event-B, similar to Coq [START_REF] Bertot | Interactive Theorem Proving and Program Development -Coq'Art: The Calculus of Inductive Constructions[END_REF], Isabelle/HOL [START_REF] Nipkow | Isabelle/HOL -A Proof Assistant for Higher-Order Logic[END_REF] or PVS [START_REF] Owre | PVS: A prototype verification system[END_REF]. Many theories have been defined, for supporting real numbers, lists, differential equations and so on. Well-definedness (WD). Beyond machine-related POs, one key aspect of model consistency is the well-definedness (WD) of the expressions involved in it. This notion supplements the one of syntactical correctness with the idea of a formula being "meaningful", i.e. it can always be safely evaluated (e.g., dividing by a constant that is provably non 0). Each formula of a model is associated to a WD PO, usually consisting in checking that operators are correctly used and combined. Once proven, WDs are added to set of hypotheses of other POs.

(1) Ctx Theorems (ThmCtx) A(s, c) ⇒ Tctx (For contexts) (2) Mch Theorems (ThmMch) A(s, c) ∧ I(x) ⇒ T mch (x) (For machines) (3) Initialisation (Init) A(s, c) ∧ BAP(x ′ )⇒ I(x ′ ) (4) Invariant preservation (Inv) A(s, c) ∧ I(x) ∧ G(x, α)∧ BAP(x, α, x ′ ) ⇒ I(x ′ ) (5) Event feasibility (Fis) A(s, c) ∧ I(x) ∧ G(x, α)⇒ ∃x ′ • BAP(x, α, x ′ ) (6) Variant progress (Var) A(s, c) ∧ I(x) ∧ G(x, α)∧ BAP(x, α, x ′ ) ⇒ V (x ′ ) < V (x)
Note that theories allow designers to provide custom WD conditions for partially defined operators in order to precisely characterise their proper use. The Rodin Platform. Rodin is an open source integrated development platform for designing, editing and proving Event-B models. It also supports model checking and animation with ProB, as well as code generation. Being based on Eclipse, it also allows the definition of plug-ins, including theory extensions. Many provers for first-order logic as well as SMT solvers are plugged to Rodin for helping the proof process.

Linear Temporal Logic

This section recalls the principles of linear temporal logic (LTL) following the definition of Manna and Pnueli [START_REF] Manna | Adequate proof principles for invariance and liveness properties of concurrent programs[END_REF]. Linear temporal logic is defined syntactically as an extension of propositional logic. A valid LTL formula consists in literals (usually, predicates on the state of the system), the usual logical connectors (∧, ∨, ¬ and ⇒) as well as modal operators □, ♢ and U. The semantics of LTL is expressed in terms of traces of a system. Given a trace tr = s 0 → s 1 → . . ., then tr i (i ∈ N) denotes the suffix trace of tr, starting from s i , tr i = s i → s i+1 → . . .

A state that satisfies a predicate P is called a P -state. LTL semantics are given with the following rules:

1. For any state predicate P , tr ⊨ P iff s 0 is a P-state.

2. tr ⊨ ϕ 1 ∧ ϕ 2 iff tr ⊨ ϕ 1 and tr ⊨ ϕ 2 3. tr ⊨ ϕ 1 ∨ ϕ 2 iff tr ⊨ ϕ 1 or tr ⊨ ϕ 2 4. tr ⊨ ¬ϕ iff not tr ⊨ ϕ 5. tr ⊨ ϕ 1 ⇒ ϕ 2 iff not tr ⊨ ϕ 1 or tr ⊨ ϕ 2 6
. tr ⊨ □ϕ iff for all k, tr k ⊨ ϕ 7. tr ⊨ ♢ϕ iff there exists a i such that tr i ⊨ ϕ 8. tr ⊨ ϕ 1 Uϕ 2 iff there exists a i such that tr i ⊨ ϕ 2 , and for all j < i, tr j ⊨ ϕ 1 A machine M satisfies a property ϕ, denoted M ⊨ ϕ if and only if for all traces tr of M , that trace satisfies ϕ (tr ⊨ ϕ).

The EB4EB Framework

The EB4EB framework [START_REF] Riviere | EB4EB: A Framework for Reflexive Event-B[END_REF][START_REF] Riviere | Reflexive Event-B: Semantics and Correctness the EB4EB Framework[END_REF] proposes to extend the reasoning capabilities of Event-B by enabling the access of Event-B components as first-class citizens within Event-B models (reflection), thereby making it possible to express new reasoning mechanism at the meta-level. Machine structure. Event-B is formalised in an Event-B theory. A machine is represented using the data-type Machine (see Listing 1) parameterised by generic types with event labels (Ev) and states (St). Constructor Cons machine gathers the components of a machine, such as Event, State, Grd, Inv, BAP, etc.

Well-Construction. A machine built using Cons machine may not be consistent, despite being syntactically correct. Thus, additional operators are defined to encode the well-construction of a machine, i.e. the consistency of its components with regard to each others (Listing 2). For instance, Event WellCons ensures that events are partitioned between initialisation and progress events.

Machine Proof Obligations. For any machine expressed in the framework, its associated proof obligations are provided under the form of operators (see Listing 3). Such operators are predicates that rely on the set-theoretical definition of the machine and guarded transition system semantics.

In a particular, for a given machine m the predicate Mch INV(m) holds if and only if the invariants of m hold with regard to m's behaviour, corresponding to PO INV (see Table 2). Following similar principles, every machine-related POs of the Event-B method is formalised in the theory. Listing 4: Operator for Event-B machine consistency Remark. The EB4EB framework makes accessible all the features of Event-B machines, and thus enables the formalisation and verification of the fragment of temporal logic properties already supported by classical Event-B machines: □ using invariants and theorem clauses and ♢ using variants and convergence proof obligations. However, it does not support the composition of these operators nor any of the other temporal logic properties.

Instantiation of the meta-theory is used to define specific Event-B machines (instantiation) using the Cons machine constructor. An Event-B context where values for the type parameters St and Ev are provided.

Trace-Based Semantics of Event-B

Establishing the correctness of the POs provided in the EB4EB framework requires modelling of Event-B trace-based semantics. We express traces in an Event-B theory and relate them to an EB4EB machine. It becomes possible to prove that a PO defined in EB4EB encodes correctly the property it formalises.

Semantics: traces of Event-B machines in EB4EB

A machine m consists of state variables and events describing their evolution. A trace tr of m is a sequence of states tr = s 0 → s 1 → . . . → s n → . . . such that:

1. the initial state s 0 satisfies the after predicate (AP) of the initialisation event 2. each pair of consecutive states s i , s i+1 corresponds to the activation of an event e of m, i.e.: 1) s i verifies the guard, and 2) s i → s i+1 verifies the BAP 3. if tr is finite, its final state deadlocks (i.e., system cannot progress any more)

In EB4EB, traces are encoded in a theory (Listing 5) extending EvtBTheo. They are linked to machines. A trace is a partial function tr ∈ N → St such that, for any n in the domain, tr(n) = s n is the n-th state of the trace.

P(N × St) ) d i r e c t d e f i n i t i o n (tr ∈ N → St ∨ (∃n • n ∈ N ∧ tr ∈ 0..n → St ∧ tr (n) / ∈ Grd(m)[Progress(m)]))∧ tr (0) ∈ AP(m)∧ (∀i, j • i ∈ dom(tr ) ∧ j ∈ dom(tr ) ∧ j = i + 1 ⇒ IsANextState(m, tr (i), tr (j))) . . . END

Listing 5: Theory of Event-B Traces

The operator IsATrace captures the relation between machines and traces. A transition associated to an event in a trace is defined by the IsANextState operator. Considering a machine m and two states s and sp, the operator checks that there exists an event e such that: 1) s verifies the guard of e (s ∈ Grd(m)[{e}]), and 2) the pair s → sp verifies the BAP of e (s → sp ∈ BAP (m)[{e}]).

Correctness Principle

Soundness properties can be expressed with the formalisation of the semantics using traces, in particular the correctness of the newly defined POs [START_REF] Riviere | Reflexive Event-B: Semantics and Correctness the EB4EB Framework[END_REF]. A generic principle can be stated as follows.

In It has been proved, by induction on the indexes of the traces, using the Rodin platform provers. This principle is applied for all the newly introduced POs, in particular for the temporal logic properties POs introduced in this paper. In the original paper [START_REF] Hoang | Reasoning about liveness properties in event-b[END_REF], the authors used the read-write case study to illustrate their approach. For comparison purposes, we use the same case study. The system requirements are: Req1 -The reader process reads data from the buffer; Req2 -The writer process writes data to the buffer; Req3 -The reader and the writer share the same buffer; Req4 -The shared buffer has a fixed size of 3; Req5 -The system does not stop when data is written and not read; and Req6 -The reader eventually reads L, L ∈ N, pieces of data.

MACHINE RdW rM ch VARIABLES r , w INVARIANTS inv1-2 : r ∈ N , w ∈ N inv3-4 : 0 ≤ w -r , w -r ≤ 3 EVENTS INITIALISATION THEN a c
) = Z × Z axm6 : Init(rdwr ) = init axm7 : Inv (rdwr ) = {r → w | r ∈ N ∧ w ∈ N∧ 0 ≤ w -r ∧ w -r ≤ 3} axm8 : AP(rdwr ) = {0 → 0} axm9 : BAP(rdwr ) = {e → ( (r → w) → (rp → wp)) | (e = read ∧ rp = r + 1 ∧ wp = w) ∨(e =
Listing 8.a proposes the RdWrMch Event-B machine fulfilling the above requirements. The reader (resp. writer) is modelled by variable r (resp. w) corresponding to its position in the buffer and by event read (resp. write) that represents the associated input/output operation and increments the pointer (Req1 and Req2). The shared buffer is captured by interval r + 1..w (Req3). The correct formalisation of the events, i.e. data that has not been written yet is not read and the amount of data in the buffer does not exceed 3 (Req4), is guaranteed by invariants inv3-4. Listing 8.b shows the context obtained when instantiating the EvtBTheo theory (Listing 1) of the EB4EB framework. The thm1 theorem guarantees the consistency of the RdWrMch Event-B machine.

Missing requirements. Req5 and Req6 are not safety properties in the usual sense and are not present in the current model. Event-B does not natively provide explicit constructs for handling them. Additional modelling effort is necessary, like introducing variants and new theorems and altering events.

7 Temporal logic proof rules as EB4EB POs THEORY T heo4Liveness IMPORT EvtBT heo TYPE PARAMETERS Ev , St . . .

Listing 9: Liveness operators Theory

To support temporal logic properties and handle the missing requirements, we propose an Event-B extension relying on the EB4EB framework. This section presents the formalisation of the liveness properties, introduced in [START_REF] Hoang | Reasoning about liveness properties in event-b[END_REF], that are missing in core Event-B. For this purpose, we extend the EB4EB framework to introduce the corresponding PO definitions. All the definitions are formalised in the Theo4Liveness theory (see Listings 9) extending the EvtBTheo theory of EB4EB using a set of operators, defined for each proof rule defined in [START_REF] Hoang | Reasoning about liveness properties in event-b[END_REF]. Each of these definitions is introduced below. Note that each of the following tables contain two parts, where (a) is from [START_REF] Hoang | Reasoning about liveness properties in event-b[END_REF] and (b) our corresponding formalization.

Notations. For a predicate P on states of St, we define the subset P of states satisfying the property P as P = {x ∈ St | P (x)}.

Liveness properties

This section presents core definitions for expressing formal definition of liveness properties. We first describe the basic building operators.

Machine M Leads From P 1 to P 2 , P 1 ↷ P 2 (TLLeads From P1 To P2 operator). For a machine M , given two state formulas P 1 and P 2 , we state that M leads from P 1 to P 2 if for every trace of M with two successor states such that s i ∈ P1 then s i+1 ∈ P2 . The given property of Table 3(a) is formally defined by the operator TLLeads From P1 To P2 with a machine m and two set of states P1 and P2 as parameters. Its direct definition is a predicate BAP (m)[{e}][ P1 ∩ Grd(m)[{e}] ∩ Inv(m)] ⊆ P2 stating that for all progress events of machine m that preserve invariant, states of P1 lead to P2 .

The Sequent Rule for ↷ Associated Operator in EB4EB TLLeads From P1 To P2 <predicate> (m : M achine(St, Ev), P1 : P(St), P2 : 4(a) by the predicate operator TLConvergent In P on machine m, set of states P and variant v. The operator's WD condition ensures that the variant is associated to each state. The operator states that, for all progress events e, when its before-after-states s and s ′ satisfy P , variant v decreases (v(s ′ ) < v(s)).

P(St)) P1 ↷ P2 ≡ ∀v, v ′ , x• direct definition P1(v) ∧ G(x, v) ∧ A(x, v, v ′ ) ⇒ P2(v ′ ) ∀e • e ∈ P rogress(m) ⇒ BAP (m)[{e}][ P1 ∩ Grd(m)[{e}] ∩ Inv(m)] ⊆ P2 (a) (b)
The Sequent Rule of ↓ Associated Operator in EB4EB TLConvergent In P <predicate> (m : M achine(St, Ev), P :

P(St), v : P(St × Z)) well-definedness v ∈ St → Z ↓ P ≡ ∀x, v, v ′ • direct definition (P (v) ∧ G(x, v) ⇒ V (v) ∈ N N)∧ ∀e • e ∈ P rogress(m) ⇒ ( (P (v) ∧ G(x, v) ∧ A(x, v, v ′ ) ⇒ V (v ′ ) < V (v)) v[ P ∩ Grd(m)[{e}] ∩ Inv(m)] ⊆ N N∧ (∀s, s ′ • s ∈ Inv(m) ∧ s ∈ P ∧ s ∈ Grd(m)[{e}] ∧ s ′ ∈ BAP (m)[{e}][{s}] ⇒ v(s ′ ) < v(s))) (a) (b)
P(St), v : P(St × Z)) (¬P (v) ∧ G(x, v) ⇒ V (v) ∈ N N) ∧ well-definedness v ∈ St → Z (¬P (v) ∧ G(x, v) ∧ A(x, v, v ′ ) ⇒ direct definition V (v ′ ) < V (v)) ∧ T LConvergent In P (m, St \ P , v)∧ (P (v) ∧ G(x, v) ∧ A(x, v, v ′ ) ∧ V (v ′ ) ∈ N N ⇒ ∀e • e ∈ P rogress(m) ⇒ ( V (v ′ ) ≤ V (v)) (∀s, s ′ • s ∈ Inv(m) ∧ s ∈ P ∧ s ∈ Grd(m)[{e}] ∧ s ′ ∈ BAP (m)[{e}][{s}] ∧ v(s ′ ) ∈ N N ⇒ v(s ′ ) ≤ v(s))) (a) (b)
⟲ P ≡ ∀v • P (v) ⇒ i (∃x • Gi(x, v))
TLDeadlock Free In P <predicate> (m : M achine(St, Ev), P : We illustrate how the operators defined above work in the extended EB4EB framework on the read write case study, with the case of the deadlock-freeness property ensuring requirement Req5.

P(St)) direct definition P ∩ Inv(m) ⊆ Grd(m)[P rogress(m)] (a) (b)
A context RdWrDeadlockFree, extending the context RdWr of Listing 8 is defined with a theorem, thmDeadlockFree-InP. This theorem uses the predicate operator Deadlock Free In P, previously formalised. Here, the P parameter is composed of the pair of state variables r → w and the property P defined by w ∈ Z ∧ r ∈ Z ∧ r < w. Indeed, the machine does not deadlock if it reads less data than it writes. Remember that when a theorem is stated, a PO is automatically generated requiring to prove it.

Temporal operator proof rules

Section 7.1 presents a formalisation of the basic temporal operators allowing to define liveness properties. This section is devoted to the formalisation of more complex temporal properties, relying on the operators previously defined, like TLGlobally, TLExistence TLUntil, TLProgress, and TLPersistence. Each of them is defined in the same manner as the previous ones.

Invariance, □I (TLGlobally operator). In Event-B, safety properties are commonly described as invariants. Although this property is already available in core Event-B, it can be formalised in EB4EB as well.

Table 7(a) expresses this property using two sequents. The first one is the inductive invariant proof rule and the second one defines, as theorems, all of the entailed stronger invariants. The TLGlobally operator of Table 7(b) defines this property as Inv(m) ⊆ Î; it reuses the native invariant PO of EB4EB.

The Sequent Rule of □ Associated Operator in EB4EB ⊢ init ⇒ I M ⊢ I ↷ I M ⊢ □I TLGlobally <predicate> (m : M achine(St, Ev), Î : P(St)) ⊢ J ⇒ I M ⊢ □J M ⊢ □I direct definition Inv(m) ⊆ Î (a) (b)
Table 7: Invariance encoded in EB4EB

Existence, □♢P (TLExistence operator). The existence temporal property states that a property P always eventually holds for machine M . To express existence □♢P in a machine M , we rely on convergence and deadlock-freeness. Indeed, the machine shall be convergent on ¬P -states, i.e., sometimes ¬P does not hold and ¬P -states are not deadlocks. The defined TLExistence predicate operator is defined as the conjunction of the two corresponding previously defined operators on a set P and a variant v.

The Sequent Rule of □♢ Associated Operator in EB4EB

M ⊢ ↓ ¬P M ⊢ ⟲ ¬P M ⊢ □♢P
TLExistence <predicate> (m : M achine(St, Ev), P :

P(St), v : P(St × Z) well-definedness v ∈ St → Z direct definition T LConvergent In P (m, St \ P , v)∧ T LDeadlock F ree In P (m, St \ P ) (a) (b)
The Sequent Rule of □(P1 ⇒ (P1U P2) Associated Operator in EB4EB TLUntil<predicate> (m : M achine(St, Ev), A ≡ (P1 ∧ ¬P2) ↷ (P1 ∨ P2) P1 : P(St), P2 : P(St), v : P(St × Z) B ≡ □♢(¬P1 ∨ P2) well-definedness v ∈ St → Z M ⊢ A M ⊢ B M ⊢ □(P1 ⇒ (P1U P2)) direct definition Leads F rom P 1 T o P 2( m, P1 ∩ (St \ P2), P1 ∪ P2) ∧ T LExistence(m, (St \ P1) ∪ P2, v) (a) (b)
P(St × Z) B ≡ □(P3 ⇒ (P3U P2)) well-definedness v ∈ St → Z M ⊢ A M ⊢ B M ⊢ □(P1 ⇒ (♢P2)) direct definition T LGlobally(m, P3 ∪ P2 ∪ (St \ P1))∧ T LU ntil(m, variant, P3, P2) (a) (b)
Table 10: Progress encoded in EB4EB

The P rogress proof rule of Table 10(a) has two antecedents. One states that always P 1 ∧ ¬P 2 ⇒ P 3 and the second uses the previously defined U ntil property as □(P 3 ⇒ (P 3 UP 2 )). The TLProgress predicate operator is the conjunction of the application of the two predicate operators, Leads From P1 To P2 and TLUntil on the P1 , P2 and P3 sets and the variant v, encoding the antecedents.

Persistence, ♢□P (TLPersistence operator). Persistence is the last property we formalise. It states that a predicate P must eventually hold forever (♢□P ). The two antecedents of the associated proof rule, presented in Table 11(a), state that P -states are divergent ¬P -states are deadlock-free. The TLPersistence predicate operator is defined as a conjunctive expression of TLDivergent In P and TLDeadlock Free In P operators with the P for the property P and the variant v as input parameters.

| w ∈ Z ∧ r ≥ L}, {(r → w) → v | v = ((L -r) + (L + 3 -w))}) END

Listing 11: Generation of Proof Obligation of Existence

The temporal operators defined in [START_REF] Hoang | Reasoning about liveness properties in event-b[END_REF] have been successfully formalised in the EB4EB as predicate operators used as theorems to be proved for any Event-B machine.

Here, we show how Req6 (the reader eventually reads L, L ∈ N, pieces of data) expressed for the read write case study is fulfilled thanks to the TLExistence operator. Like for deadlock freeness in section 7.

Listing 12: Theory of correctness

The last step establishes the correctness of our formalisation with respect to the semantics of trace, i.e. the defined proof rules actually hold on the traces of the Event-B machines. The verification principle of Section 5.2 is set up for this purpose. A theory Theo4LivenessCorrectness (Listing 12) provides a list of correctness theorems for each of the defined operators. It imports the previously developed theories related to liveness properties Theo4Liveness and Event-B traces EvtBTraces.

Below, we present the correctness theorem for the TLExistence property. All the other theorems are formalised1 and proved using the Rodin Platform.

Existence in P correctness theorem □♢P (TLExistence). The correctness of the existence property follows the principle of Section 5.2. It is supported by the proved thm of correctness of Existence theorem stating that a property P always eventually holds in traces of a machine m. It states that for any well constructed (M achine W ellCons(m)) and consistent (check M achine Consistency(m)) machine, and for any trace tr of this machine satisfying the existence property T LExistence(m, P , variant), then for all i there exists j with j ≥ i where tr(j) satisfies the property P .

Related Work

Reflexive modelling is present under various forms in formal methods. For instance, the ASM-Metamodel API (AsmM) for Abstract State Machines (ASM) has been developed to be able to handle ASM-related concepts. This leads to several extensions, analyses and tools for ASMs [START_REF] Riccobene | Towards an interchange language for ASMs[END_REF]. This is also the case when using Mural to modify a VDM specification [START_REF] Bicarregui | Reasoning about VDM developments using the VDM support tool in MURAL[END_REF]. Furthermore, the reflexive modelling is also addressed with proof assistants like Coq with MetaCoq [START_REF] Sozeau | The MetaCoq project[END_REF], Agda [START_REF] Van Der | Reflection in Agda[END_REF], PVS [START_REF] Mitra | PVS strategies for proving abstraction properties of automata[END_REF], HOL [START_REF] Fallenstein | Proof-producing reflection for HOL -With an application to model polymorphism[END_REF] and Lean [START_REF] Ebner | A metaprogramming framework for formal verification[END_REF] and Event-B with EB4EB [START_REF] Riviere | EB4EB: A Framework for Reflexive Event-B[END_REF][START_REF] Riviere | Reflexive Event-B: Semantics and Correctness the EB4EB Framework[END_REF].

Correctness of the Event-B method and its modelling components has been tackled in various previous work. A meta-level study of Event-B context structure is proposed in particular to validate the expected properties of theorem instantiation [START_REF] Bodeveix | Event-B Formalization of Event-B Contexts[END_REF]. Event-B has also been formalised as an institution in category theory [START_REF] Farrell | Building specifications in the Event-B institution[END_REF][START_REF] Farrell | An institution for Event-B[END_REF], with the aim to facilitate and enable composition of heterogeneous semantics and of different model specifications. Similarly, Event-B has been embedded in Coq [START_REF] Castéran | An Explicit Semantics for Event-B Refinements[END_REF] in order to establish the correctness of refinement, i.e. that the refinement POs entail the validity of refinement in the trace-based semantics. Last, a form of shallow embedding of Event-B in itself has been proposed and serves as the basis of a methodology for proving the correctness of decomposition and re-composition of Event-B machines [START_REF] Hallerstede | Refinement of decomposed models by interface instantiation[END_REF].

Event-B's methodology is mainly aimed at defining and proving safety properties (that must always hold), or possible convergence. Expressing liveness properties (that must hold at some point [START_REF] Lamport | Proving the correctness of multiprocess programs[END_REF]) is not as trivial, and many authors address this issue. For Event-B, the ProB model-checker [START_REF] Leuschel | ProB: an automated analysis toolset for the B method[END_REF] handles Event-B models and enables the expression and verification of liveness properties. Some liveness operators have been formalised to be used in Event-B, together with their related hypotheses [START_REF] Hoang | Reasoning about liveness properties in event-b[END_REF], making it possible to express some liveness properties. However, it is to be noted that liveness properties are not generally preserved by refinement. To address this latter issue, additional conditions on the refinement must be posed, leading to the definition of particular refinement strategies [START_REF] Hoang | Foundations for using linear temporal logic in Event-B refinement[END_REF], which are proven to preserve liveness properties through to the concrete model. In addition, the problem of fairness has also been studied. For instance, the work of [START_REF] Méry | Towards an integrated formal method for verification of liveness properties in distributed systems: with application to population protocols[END_REF] proposes to check fairness of Event-B machines in TLA (on a per-machine basis). Refinement strategies have been defined as well to ensure that fairness and liveness properties are preserved [START_REF] Zhu | A fairness-based refinement strategy to transform liveness properties in Event-B models[END_REF].

Our proposed approach is based on the reflexive modelling of Event-B on itself, which is fully integrated into Rodin development environment using the Theory Plugin [START_REF] Butler | Practical theory extension in Event-B. In: Theories of Programming and Formal Methods -Essays Dedicated to Jifeng He on the Occasion of His 70th Birthday[END_REF]. Our framework is fully formalised in Event-B and relies solely on FOL and set theory, similar to other approach like MetaCoq [START_REF] Sozeau | The MetaCoq project[END_REF] with dependent type. Such characteristic makes it possible to export models expressed using the framework to any other formalism based on FOL and set theory while preserving the state-transition semantics of the model. Therefore, the issue of the translation of the universe and the semantics' preservation are not related to our work due to the reflexive modelling.

Conclusion

This paper has presented a formalisation of liveness properties for Event-B models by encoding LTL temporal logic expressions on the Rodin platform using the reflexive EB4EB framework. LTL logic expressions of properties are formalised within the defined framework. Automatic generation of proof obligations related to the expressed properties and the soundness of the defined proof rules using a trace based semantics have been addressed as well. The proposed approach relies on the definition of algebraic theories offering the capability to define new operators. The read write machine case study was borrowed from [START_REF] Hoang | Reasoning about liveness properties in event-b[END_REF] to illustrate our approach. Other case studies have been developed as well (Peterson algorithm [START_REF] Riviere | Standalone Event-B models analysis relying on the EB4EB meta-theory[END_REF] and behavioural analyses in human computer interaction [START_REF] Mendil | Nonintrusive annotation-based domain-specific analysis to certify event-b models behaviours[END_REF]).

The proposed framework supports non-intrusive analysis for Event-B models, allowing liveness properties to be expressed and verified on any size Event-B formal model and at any refinement level without resorting to any other formal methods. Since our framework allows checking temporal properties at any refinement level, it avoids dealing with the preservation of temporal properties by refinement. Furthermore, the proof process has been enhanced with relevant and proven rewrite rules, which have been incorporated into Rodin tactics, resulting in a high level of proof automation. All the developments illustrated in this paper have been fully formalised and proved using the Rodin platform. They can be accessed on https://www.irit.fr/ ~Peter.Riviere/models/ This work leads to several perspectives. First, we plan to study the capability to allow compositional definitions of LTL properties relying on the defined basic operators. In addition, the proposed approach makes it possible to define other Event-B model analyses or domain specific theories shared by many Event-B models. Last, we believe that our approach can be scaled up to other state based methods provided that a reflexive meta-model is available.

THEORYListing 1 :

 1 EvtBT heo TYPE PARAMETERS St, Ev DATATYPES Machine ( St , Ev ) CONSTRUCTORS Cons machine( Event : P(Ev), State : P(St), Init : Ev,P rogress : P(Ev) V ariant : P(St × Z), AP : P(St), BAP : P(Ev × (St × St)), Grd : P(Ev × St), Inv : P(St) , . . . ) Machine Data type Event WellCons <p r e d i c a t e > (m : M achine(St, Ev)) d i r e c t d e f i n i t i o n partition(Event(m), {Init(m)}, P rogress(m)) . . . Machine WellCons <p r e d i c a t e > (m : M achine(St, Ev)) d i r e c t d e f i n i t i o n Event W ellCons(m) ∧ . . .

Listing 2 :

 2 Operators to check well-defined data type (static semantics)

  Mch INV Init <p r e d i c a t e > (m : M achine(St, Ev)) d i r e c t d e f i n i t i o n AP (m) ⊆ Inv(m) Mch INV One Ev <p r e d i c a t e > (m : M achine(St, Ev), e : Ev) well-definedness e ∈ P rogress(m) d i r e c t d e f i n i t i o n BAP (m)[{e}][Inv(m) ∩ Grd(m)[{e}]] ⊆ Inv(m) Mch INV <p r e d i c a t e > (m : M achine(St, Ev)) d i r e c t d e f i n i t i o n M ch IN V Init(m) ∧ (∀e • e ∈ P rogress(m) ⇒ M ch IN V One Ev(m, e)) . . . Listing 3: Well-defined data type operators (behavioural semantics) Finally, the PO operators are all gathered in a conjunctive expression within the check Machine Consistency operator (Listing 4), which thus encode the correctness condition for the machine. It uses Machine WellCons as WD condition. At instantiation, it is used as a theorem to ensure machine correctness. check Machine Consistency <p r e d i c a t e > (m : M achine(St, Ev)) well-definedness M achine W ellCons(m) d i r e c t d e f i n i t i o n M ch IN V (m) ∧ . . .

Listing 6 :

 6 Listing 6, each PO [PO] is associated with a thm of Correctness of [PO] soundness theorem in the Theo4[PO]Correctness theory. It states that the [PO] predicate definition (see Section 7) implies the PO predicate definition expressed on traces using the PO Spec On Traces expression. Such theorems have been proved for each PO introduced in the EB4EB framework. THEORY Theo4 [PO] C o r r e c t n e s s IMPORT EvtBTraces , Theo4 [PO] TYPE PARAMETERS St, Ev THEOREMS t h m o f C o r r e c t n e s s o f [PO] : ∀m, tr • m ∈ Machine(St, Ev ) ∧ Machine WellCons(m)∧ IsATrace(tr , m) ∧ . . . ∧ [PO](m, args) ⇒ P O Spec On T races(. . .) Liveness Analyses Correctness Example: Soundness of the Invariant PO (INV). The theorem of Listing 7 states that for any well-constructed machine m, if the invariant PO holds (Mch INV (m)) then for any trace tr associated to this machine (IsATrace(tr , m)), each state of that trace is in the invariant of the machine (tr(i) ∈ Inv (m)).

THEORY

  E v t B C o r r e c t n e s s IMPORT EvtBTraces , EvtBPO TYPE PARAMETERS St, Ev THEOREMS t h m o f C o r r e c t n e s s o f I n v a r i a n t P O : ∀m, tr • m ∈ Machine(St, Ev )∧ Machine WellCons(m) ∧ IsATrace(tr , m) ∧ Mch INV (m) ⇒ (∀i • i ∈ dom(tr) ⇒ tr(i) ∈ Inv(m)) END Listing 7: Theorem of correction of the proof obligation 6 A Case Study: A read write machine

t 1 :

 1 r, w := 0, 0 END read WHERE g r d 1 : r < w THEN a c t 1 : r := r + 1 END write WHERE g r d 1 : w < r + 3 THEN a c t 1 : w := w + 1 END END (a) CONTEXT RdW r SETS Ev CONSTANTS rdwr , init , read , write AXIOMS axm1 : partition(Ev , {init}, {read}, {write}) axm2 : rdwr ∈ Machine(Z × Z, Ev ) axm3 : Event(rdwr ) = Ev axm5 : State(rdwr

  write ∧ rp = r ∧ wp = w + 1)} axm10 : Grd(rdwr ) = {e → (r → w) | (e = read ∧ r < w)∨ (e = write ∧ w < r + 3)} axm11 : Progress(rdwr ) = {read, write} . . . thm1 : check Machine Consistency(rdwr ) END (b) Listing 8: Read write machine in Event-B (a) and instantiation with EB4EB (b)

  2, we introduce a new Event-B context RdWrExistence (see Listing 11), extending the RdWr context of Listing 8, with a theorem stating the existence property. The existence operator is used with a set of states {r → w | w ∈ Z ∧ r ≥ L} and a variant v = ((L -r) + (L + 3 -w))}). 8 Correctness of the temporal logic properties proof rules THEORY T h e o 4 L i v e n e s s C o r r e c t n e s s IMPORT T heo4Liveness , EvtBT races TYPE PARAMETERS St, Ev . . .

THEOREMS t h m

  o f C o r r e c t n e s s o f E x i s t e n c e : ∀m, tr , v ,P • v ∈ STATE → Z∧ m ∈ Machine(STATE , EVENT ) ∧ Machine WellCons(m)∧ check Machine Consistency(m) ∧ IsATrace(m, tr ) ∧ TLExistence(m, P , v ) ⇒ (∀i • i ∈ dom(tr ) ⇒ (∃j • j ≥ i ∧ j ∈ dom(tr ) ∧ tr (j) ∈ P )) . . .Listing 13: Theorem of correctness of the operators Existence

Table 1 :

 1 Global structure of Event-B Contexts, Machines and Theories

Table 2

 2

	: Relevant Proof Obligations for Event-B contexts and machines
	retaining a similar observational behaviour (simulation relationship). Refinement
	correctness is established with the help of a gluing invariant, and ensures prop-
	erties are preserved from the abstract to the concrete model.
	Extension with theories. Being based on set theory and FOL, the Event-
	B formalism is mathematically low-level and thus very expressive. However, it
	lacks features to build up more complex structures. The theory extension has
	been proposed to address this issue [9]. A theory is a type of component that
	makes it possible to define new type-generic datatypes together with constructive
	and axiomatic operators, specific theorems and axioms and even proof rules (see
	Table 1.c). The resulting theories consistency can be established by providing
	witnesses for axioms and definitions, ensuring conservative extensions of Event-
	B. Once defined, elements of a theory become seamlessly available in an Event-B
	model and its proofs.

  THEORY EvtBT races IMPORT EvtBT heo TYPE PARAMETERS St , Ev OPERATORS IsANextState p r e d i c a t e ( m : Machine(St, Ev ) , s : St , sp : St ) d i r e c t d e f i n i t i o n ∃e • e ∈ Progress(m) ∧ s ∈ Grd(m)[{e}] ∧ s → sp ∈ BAP(m)[{e}] IsATrace p r e d i c a t e ( m : Machine(St, Ev ) , tr :

Table 3 :

 3 Leads from P1 to P2 encoded in EB4EBMachine M is Convergent in P , ↓ P (TLConvergent In P operator). For a given property P , a machine M is convergent in P if it does not allow for an infinite sequence of P -states (i.e. states satisfying the property P ). It is formalised in Table

Table 4 :

 4 Convergence in P encoded in EB4EB

Machine M is Divergent in P , ↗ P (TLDivergent In P operator). Divergence property guarantees that any infinite trace of a machine M ends with an infinite sequence of P -states. The operator TLDivergent In P of Table

5

(a) is identical to the previous convergent operator, except that the variant does not decrease strictly (v(s ′ ) ≤ v(s)) allowing divergent sequences of P -states.

The Sequent Rule of ↗ Associated Operator in EB4EB TLDivergent In P <predicate> ↗ P ≡ ∀x, v, v ′ • (m : M achine(St, Ev), P :

Table 5 :

 5 This property is defined in Table6(a) and is formalised by the operator TLDeadlock Free In P in Table6(b).The expression P ∩ Inv(m) ⊆ Grd(m)[ P rogress(m)] ensures that at least one progress event of the P rogress(m) set is enabled in a P -state satisfying the invariant.

	The Sequent Rule of ⟲	Associated Operator in EB4EB

Divergence in P encoded in EB4EB

Machine M is Deadlock-free in P , ⟲ P (TLDeadlock Free In P operator). The deadlock-freeness states that a trace of a machine M never reaches a P -state where no event is enabled. It requires that, in a P -state, at least one event of M is enabled.

Table 6 :

 6 Deadlock-freeness in P encoded in EB4EB7.2Deadlock freeness ⟲ P applied to the Read-Write machine

	CONTEXT RdWrDeadlockFree
	EXTENDS RdWr
	THEOREMS
	thmDeadlockFreeInP :
	TLDeadlock Free In P(rdwr ,
	{r → w | w ∈ Z ∧ r ∈ Z ∧ r < w})
	END
	Listing 10: Generation of Proof
	Obligation of Deadlock Free In P

Table 8 :

 8 Existence encoded in EB4EBUntil, □(P 1 ⇒ (P 1 UP 2 )) (TLUntil operator). The Until property states that a P 1 -state is always followed eventually by a P 2 -state. Its definition relies on the leads-to and existence properties we have introduced. The U ntil property requires two antecedents, a leads to from P 1 ∧¬P 2 to P 1 ∨P 2 in the next state and the second is the existence of ¬P 1 ∨P 2 (see Table9(a)). This proof rule is directly formalises using the TLUntil operator (see Table9(b)). It requires two properties P 1 ( P1 set) and P 2 ( P2 set) and a variant v. It is defined as the conjunction of the TLLeads From P1 To P2 and TLExistence predicate operators.

Table 9 :

 9 Until encoded in EB4EBProgress, □(P 1 ⇒ (♢P 2 )) (TLProgress operator). Close to the U ntil property, a more general property, namely P rogress can be defined. It states that always P 1 -states reaches P 2-states. This property does not require P 1 to always hold before reaching P 2 -states. To describe this property, an intermediate property P 3 holding before P 2 holds is introduced. It acts as a local invariant between P 1 -states and P 2 -states.

	The Sequent Rule of □(P1 ⇒ ♢P2)	Associated Operator in EB4EB
		TLProgress<predicate> (m : M achine(St, Ev),
	A ≡ □(P1 ∧ ¬P2 ⇒ P3)	P1 : P(St), P2 : P(St), P3 : P(St), v :

Table 11 :

 11 Persistence encoded in EB4EB 7.4 Existence □♢P applied to the read write machine

	CONTEXT RdWrExistence
	EXTENDS RdWrDeadlockFree
	CONSTANTS L
	AXIOMS
	axm1 : L ∈ N
	t h m E x i s t e n c e : TLExistence(
	rdwr , {r → w

https://www.irit.fr/ ~Peter.Riviere/models/