2026-04-14·9 min read·sota.io team

Deploy B-Method to Europe — Jean-Raymond Abrial 🇫🇷 (1989), the Formal Method Behind Paris Metro Line 14, on EU Infrastructure in 2026

On 15 October 1998, the first passengers boarded Paris Metro Line 14 — the METEOR line — at Bibliothèque François Mitterrand station. Line 14 was the first fully automated metro line in the world: no drivers, no manual intervention, 86,000 lines of formally verified software. Every function of the train control system had been mathematically specified and proven correct before a single train ran. The method used to achieve this was B-Method.

B-Method — also known as the B formal method or simply B — is a formal software development method created by Jean-Raymond Abrial 🇫🇷, a French computer scientist who spent his career at research institutions across France and Europe. B is built around the concept of abstract machines: mathematical objects that encapsulate state (invariants, variables) and operations (pre/post-conditions), composable through refinement and inclusion. A system is developed by writing an abstract machine, refining it through increasingly concrete layers, and finally generating executable code — with a proof obligation discharged at every step. When all proofs pass, the implementation is guaranteed to preserve the specification's invariants by construction.

Jean-Raymond Abrial and the Origins of B

Jean-Raymond Abrial 🇫🇷 began developing the ideas behind B in the 1970s and 1980s, drawing on the Z notation (which he had also contributed to at Oxford University) and on the concept of refinement calculus developed by Edsger Dijkstra and Tony Hoare. Abrial formalised B-Method in a 1989 technical report and fully presented it in his 1996 book The B-Book: Assigning Programs to Meanings (Cambridge University Press) — the canonical reference for B practitioners.

Abrial's trajectory illustrates B's fundamentally European academic ecosystem:

Oxford University 🇬🇧 — contributed to Z notation (alongside Ib Holm Sørensen and others)
Grenoble (France) 🇫🇷 — developed B core methodology
ETH Zurich 🇨🇭 — developed Event-B, the concurrent/distributed extension
University of Newcastle 🇬🇧 — collaborated on Rodin platform development

Z Notation (Oxford 🇬🇧, 1970s) — set-theory specification language
Jean-Raymond Abrial 🇫🇷 — contributor to Z + creator of B
      ↓
B-Method (Abrial, 1989 report, 1996 book)
    Abstract Machine Notation (AMN)
    State machines with invariants + proof obligations
      ↓
Industrial Tools
    B-Toolkit (Formal Systems Europe 🇬🇧, Bristol)
    Atelier B (ClearSy 🇫🇷, Aix-en-Provence, 1994–present)
      ↓
Paris Metro Line 14 / METEOR (1998)
    RATP 🇫🇷 + Alstom 🇫🇷 + GEC Alsthom
    86,000 lines formally verified · 111,000 proof obligations
      ↓
Event-B (Abrial at ETH Zurich 🇨🇭 + Newcastle 🇬🇧, 2000s)
    Rodin Platform (Eclipse, EU FP6 project, 2004–2007)
    Concurrent + distributed systems
      ↓
ProB (Michael Leuschel 🇩🇪, University of Düsseldorf, 2003–present)
    Model checker + constraint solver for B/Event-B

Abstract Machine Notation

B's formal language is the Abstract Machine Notation (AMN). An abstract machine in B is a self-contained component with:

SETS — carrier sets (types at the abstract level)
CONSTANTS and PROPERTIES — axioms and constraints
VARIABLES — the state
INVARIANT — predicates that must hold in every reachable state
INITIALISATION — establishes the invariant from the start
OPERATIONS — state transformations with preconditions and postconditions

MACHINE BankAccount
SETS
  ACCOUNT_ID

VARIABLES
  balance

INVARIANT
  balance ∈ ACCOUNT_ID → ℕ  -- each account has a non-negative integer balance

INITIALISATION
  balance := ∅

OPERATIONS
  Deposit(acc, amount) ≙
    PRE acc ∈ dom(balance) ∧ amount ∈ ℕ ∧ amount > 0
    THEN balance(acc) := balance(acc) + amount
    END;

  Withdraw(acc, amount) ≙
    PRE acc ∈ dom(balance) ∧ amount ∈ ℕ ∧ balance(acc) ≥ amount
    THEN balance(acc) := balance(acc) - amount
    END
END

From this abstract machine, the developer writes a refinement — a more concrete implementation — and B generates proof obligations: mathematical statements that, when proven, guarantee the refinement correctly implements the abstraction. Obligations include:

Invariant Preservation: every operation leaves the invariant true
Refinement Correctness: every concrete operation correctly simulates the abstract one
Feasibility: every operation has at least one valid result when its precondition holds

Proof obligations are either discharged automatically (by Atelier B's internal provers or ProB's constraint solver) or manually by the engineer using a proof assistant. In METEOR's case, 94% of 111,000 proof obligations were discharged automatically — the remainder required human-guided proof.

Paris Metro Line 14: 86,000 Lines, Zero Runtime Errors

The METEOR project (Métro Est-Ouest Rapide — the name came first, the acronym second) was contracted to Alstom 🇫🇷 and GEC Alsthom in the early 1990s. The client, RATP (Régie Autonome des Transports Parisiens), required a fully driverless metro with Safety Integrity Level 4 (SIL 4) certification — the highest level under IEC 61508, applicable when a single failure can cause catastrophic consequences.

The onboard train control software — the Automatic Train Operation (ATO) and Automatic Train Protection (ATP) systems — was developed in B-Method using Atelier B, the industrial tool from ClearSy 🇫🇷 (then called Digilog). The numbers from the project remain striking:

Metric	Value
Lines of B specification	~86,000
Proof obligations generated	~111,000
Automatically discharged	~94%
Manually proved	~6%
Generated Ada code	~87,000 lines
Runtime errors in production	0

The B specifications were refined into concrete implementations and then translated automatically to Ada code by Atelier B's code generator — a validated translation that preserves all proved properties. No hand-written Ada was used for safety-critical components. The formal proof guarantee propagated directly from specification to executable binary.

Line 14 has been operating continuously since 1998, carrying more than 200,000 passengers per day by 2024. It has never experienced a safety-critical software failure attributable to the formally verified components.

Brussels Metro and European Expansion

Following METEOR's success, B-Method was adopted for other European rail projects:

Brussels Metro Line 1 🇧🇪 — STIB/MIVB extended its existing metro with B-verified software for automatic train operation on portions of the network. The Brussels deployment used similar Alstom/Atelier B toolchain.

SNCF TGV-related signalling 🇫🇷 — French rail safety systems increasingly incorporate B-verified components as EN 50128 SIL 3/4 certification requirements align naturally with B's proof obligations.

Siemens Mobility 🇩🇪 — uses formal methods including B for railway signalling systems deployed across Europe under EN 50128.

The pattern is consistent: B-Method is the preferred formal method in European railway safety, where EN 50128 SIL 4 requirements effectively mandate formal verification for the most critical components.

Atelier B and ClearSy

ClearSy 🇫🇷 (Aix-en-Provence, Provence-Alpes-Côte d'Azur) is the primary industrial custodian of B-Method. Founded in 1998 as a spin-off from the METEOR project, ClearSy develops and maintains Atelier B — the industrial-grade B toolset used in all major B deployments.

Atelier B provides:

Type checker for AMN specifications
Proof obligation generator (PO generator)
Automated provers: Force-0 (syntactic), Force-1, Force-2, Force-3 (increasingly powerful)
B0 code generator: translates refined B0 specifications to C, Ada, or C++
Project manager: tracks proof status across large specification sets

Atelier B is available under a licence that allows academic use and offers a commercial industrial edition. ClearSy also provides consulting and training across Europe.

Event-B and the Rodin Platform

In the 2000s, Jean-Raymond Abrial developed Event-B — an evolution of B designed for modelling concurrent and distributed systems. Where classical B focuses on sequential program development, Event-B uses events (guarded state transitions) as the primary modelling primitive, making it suitable for:

Distributed protocols (consensus, fault-tolerant replication)
Hardware/software co-design
Security policies and access control
Critical infrastructure control systems

The Rodin Platform — developed through the EU FP6 project (2004–2007) with partners including ETH Zurich 🇨🇭, University of Southampton 🇬🇧, University of Newcastle 🇬🇧, Systerel 🇫🇷, and Siemens CT 🇩🇪 — provides Eclipse-based tooling for Event-B. Rodin is open source and actively maintained.

ProB (University of Düsseldorf 🇩🇪, Michael Leuschel, 2003–present) provides model checking and constraint-based validation for both classical B and Event-B. ProB can:

Animate B/Event-B specifications interactively
Find counterexamples to invariants automatically
Solve constraint satisfaction problems over B's mathematical types
Integrate with Atelier B and Rodin as plugins

EU Regulatory Alignment

B-Method's proof-obligation model maps directly onto European regulatory requirements for safety-critical and AI systems:

EN 50128 (Railway Software): SIL 3 and SIL 4 explicitly recommend formal methods including "model-oriented specification languages" with proof obligations. B-Method with Atelier B is a widely accepted evidence of compliance.

IEC 61508 (Functional Safety): SIL 3/4 requires formal verification. B proof obligations constitute direct evidence of invariant preservation.

EU AI Act (2024) Art. 9: High-risk AI systems require risk management systems with evidence of correct behaviour. Formally verified B specifications provide machine-checked evidence that the system meets its specification — directly applicable to autonomous transport (Article 6, Annex II).

GDPR Art. 25 (Data Protection by Design): B invariants can encode data minimisation and access control policies as formally proved properties, not policy documents.

EU Cyber Resilience Act (2024): Exploitability requires reachable unsafe states. B proof obligations eliminate entire classes of reachable unsafe states by construction — before the system ships.

NIS2 Directive: Critical infrastructure operators (transport, energy) must demonstrate systematic risk management. Formally proved software components reduce residual risk to provably bounded levels.

Deploying B-Method Tooling on EU Infrastructure

Running Atelier B, Rodin, and ProB on EU-sovereign infrastructure serves several concrete purposes:

Compliance-as-infrastructure: SIL 3/4 certification evidence (proof obligation logs, prover outputs) must be retained and accessible. EU-resident storage satisfies data residency requirements for regulated industries without cross-border transfer agreements.

Air-gapped analysis environments: Defence and nuclear B deployments require isolated networks. EU data centres offer private network configurations that US hyperscalers complicate with shared control planes.

CI/CD integration for formal verification: ProB and Atelier B can be containerised and run in CI pipelines — each commit triggers a proof obligation re-check, catching invariant violations before code review.

Deploy Atelier B CLI in Docker on sota.io

FROM debian:bookworm-slim

# Install Java (Atelier B GUI requires Java; CLI can run headless)
RUN apt-get update && apt-get install -y \
    openjdk-17-jre-headless \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Install Atelier B (academic/community version)
# ClearSy provides academic licences at https://www.atelierb.eu
WORKDIR /opt/atelierb
COPY AtelierB-community-linux-x86_64.tar.gz .
RUN tar xzf AtelierB-community-linux-x86_64.tar.gz && rm *.tar.gz

ENV PATH="/opt/atelierb/bin:$PATH"

WORKDIR /workspace

# docker-compose.yml — B proof server
services:
  atelier-b:
    build: .
    volumes:
      - ./specs:/workspace/specs
      - ./proofs:/workspace/proofs
    command: ["bpmo", "--check-all", "/workspace/specs"]
    environment:
      - ATELIERB_LICENSE_SERVER=your-license-server

  prob:
    image: ghcr.io/hhu-stups/prob2-ui:latest
    volumes:
      - ./specs:/workspace/specs
    ports:
      - "3000:3000"

Deploy ProB Model Checker

ProB is open source (Eclipse Public License) and installable via pip or direct download:

# ProB CLI (probcli) — model check a B specification
docker run --rm -v $(pwd)/specs:/specs \
  ghcr.io/hhu-stups/probcli:latest \
  /specs/bank_account.mch -model-check -df

# Expected output: No counterexample found (invariant preserved in all reachable states)

sota.io Deployment

# sota.toml
[app]
name = "b-method-proof-server"
region = "eu-central" # Frankfurt — GDPR-compliant, EN 50128 documentation retention

[build]
dockerfile = "Dockerfile"

[service]
port = 8080
memory = "2GB"  # ProB model checking is memory-intensive for large specifications

[volume]
name = "proof-archive"
mount = "/workspace/proofs"
size = "50GB"  # Long-term retention of proof obligations for certification audits

sota deploy
# → Deploying b-method-proof-server to eu-central (Frankfurt)
# → Build: 2m 14s
# → Live: https://b-method-proof-server.sota.app
# → GDPR-compliant · PostgreSQL managed · EN 50128 documentation retained in EU