BARReL: a modern backend for Atelier B in Lean

Abstract: BARReL is a Lean 4 library bridging Atelier B, an industrial tool for the B method, and the Lean proof assistant by enabling users to conduct their formal B developments -- up to machine refinement and implementation -- interactively inside Lean, while retaining standard B syntax. B partial operators are carefully encoded by generating explicit well-definedness conditions, leveraging Lean's dependent types to enforce a well-definedness discipline by construction. That is, proof obligations and proof steps cannot silently rely on ill-typed or ill-defined instantiations. BARReL also features basic automation to try to discharge such well-definedness conditions automatically. The implementation is written entirely using Lean meta-programming and is designed to be modular: extending the supported B fragment typically requires only adding new syntax and encoding clauses. We illustrate the approach on a small but representative case study, and argue that BARReL can act as a stepping stone towards a strongly reliable Atelier B toolchain grounded in the Lean proof assistant.

• The paper introduces BARREL, a Lean 4 backend for Atelier B that enforces explicit well-definedness for partial operators.
• It presents a modular translation pipeline that parses B artifacts, encodes them into Lean expressions, and automates proof obligations.
• The approach leverages Lean’s dependent type system to eliminate ill-defined instantiations, as demonstrated by successful case study metrics.

BARREL: Integrating Atelier B with Lean for Robust Formal Verification

Motivation and Context

BARREL addresses a critical gap in integrating industrial-strength formal methods, specifically the B method as realized in Atelier B, with modern interactive theorem proving ecosystems such as Lean 4. The B method is predominant in safety-critical and high-assurance domains, leveraging stepwise refinement and an expressive set-theoretic language. Atelier B's workflow relies on automated and interactive discharge of proof obligations (POs), yet it remains isolated from the advances in interactive theorem proving—most notably the dependently-typed kernels and powered automation of Lean and Isabelle. Prior efforts for bridging B with interactive provers either focus on deep mechanization (e.g., PVS or Rocq) or restrict themselves to the Event-B fragment, lacking a drop-in backend for standard Atelier B artifacts.

BARREL fills this gap by providing a Lean 4 library that parses proof obligations generated by Atelier B, translates them into Lean theorems over Mathlib's set-theoretic primitives, and enables interactive proof engineering in Lean—while preserving standard B syntax and semantics.

Technical Contributions

Explicit Handling of Partiality and Well-Definedness

A central technical innovation is the canonical encoding of B's partial operators (e.g., minimum, function application, cardinality) via explicit well-definedness (WD) conditions. In B, partial operators can yield ill-defined terms unless certain side conditions hold, but Atelier B's internal provers sometimes treat these implicitly, leading to proof scripts that may silently rely on unsound instantiations. BARREL enforces a well-definedness discipline by construction: any use of a partial operator in Lean requires supplying WD evidence, which is generated as a theorem or subgoal.

Lean's dependent type system is exploited so that partial operators are total functions parameterized by WD proofs. For instance, the minimum function over a set $S$ is only constructible if boundedness and non-emptiness predicates are discharged. This paradigm eliminates the pitfall observed in Atelier B's interactive prover, where ill-typed instantiations can circumvent soundness.

Modular Translation Pipeline and Automation

BARREL's architectural pipeline comprises:

• Parsing: Conversion from B source files or POG XML into a normalized AST.
• Encoding: Mapping B constructs to Lean expressions, preserving structure and notations.
• WD Generation: Insertion of meta-variables for WD obligations, subsequently resolved as explicit Lean theorems.
• Proof Scheduling: Integration with Lean's tactic layer and Mathlib's libraries, tagging WD lemmas for deterministic automation.

Automation in BARREL is intentionally narrow but highly effective: tagged tactics discharge the vast majority of routine WD side goals, leaving invariant preservation and refinement obligations to the user. For the minimum search refinement chain case study, BARREL automatically discharged 146 out of 190 generated goals, all WD conditions, and 15 further proof obligations.

Set-Theoretic Embedding and Coverage

All standard B constructs—sets, relations, functions, finite sets, arithmetic, and partial operators—are encoded directly in Lean using Mathlib's types. The translation is syntax-directed and preserves B notations, keeping the learning curve minimal. The lemma library accompanying BARREL provides both WD facts and canonical rewrite rules, ensuring goals are Mathlib-friendly and accessible for further automation.

Expanding coverage to advanced data structuring features and further operators is straightforward, requiring incremental addition of definitions, parsing, encoding rules, WD predicates, and supporting lemmas.

Numerical Results and Claims

BARREL produces a larger number of WD side goals compared to Atelier B, owing to granular reification of WD at every occurrence rather than machine-level sharing. All WD obligations in the three-level minimum search refinement chain case study were automatically discharged, demonstrating the effectiveness and reliability of BARREL's tactic layer.

A bold claim established in both implementation and case study is that ill-typed or ill-defined instantiations cannot appear in Lean unless WD evidence is supplied. Contradictory assertions, which can be accepted in Atelier B via unchecked instantiation (e.g., min applied to the empty set), are categorically rejected by Lean under BARREL's encoding.

The core implementation spans 1,331 lines of code, with over 1,200 lines in the lemma library and a suite of examples validating workflow consistency.

Comparative Analysis and Trust Guarantees

By shifting trust to Lean's small, auditable kernel and Mathlib's infrastructure, BARREL minimizes reliance on external components: only the correctness of Atelier B's PO generator and the faithfulness of the set-theoretic embedding remain as trusted elements. The backend is proof-producing, and every successfully discharged obligation yields a Lean kernel-checked theorem.

Unlike Atelier B's GUI-oriented prover, Lean's proof scripting, supported by BARREL, imposes type discipline and prohibits the use of partial operators outside their defined domains. This is a significant improvement from a soundness perspective and leverages the broader proof-engineering capabilities available in Lean.

Implications and Future Directions

Practically, BARREL affords industrial B developers the ability to interactively and rigorously discharge POs using Lean's ecosystem, with robust handling of partiality and explicit well-definedness tracking. Theoretically, this establishes a foundation for integrating B-based workflows into modern proof-producing systems and facilitating long-term auditability.

Future developments include:

• Extending BARREL's supported fragment to richer B language features and more complex data structures.
• Implementing subsumption to reduce WD side goal redundancy.
• Integrating domain-specific automation for routine invariant and simulation obligations.
• Developing a verified PO generator within Lean, eliminating external components from the trusted chain and enabling direct inlining of WD constraints in the B developments.

Furthermore, an embedded B DSL in Lean can be envisioned, allowing fully native formal development and PO checking within the Lean ecosystem.

Conclusion

BARREL represents a robust integration point for the B method and Lean 4, promoting explicit well-definedness, transparent proof automation, and practical usability for industrial formal methods. By encoding partiality as explicit dependent conditions and leveraging Lean's proof-producing infrastructure, BARREL enhances both practical and theoretical reliability in formal B developments and opens new directions for leveraging interactive theorem proving in high-assurance software engineering (2606.20121).