No abstract

It is argued that refinement, in which I/O signatures stay the same, preconditions are weakened and postconditions strengthened, is too restrictive to describe all but a fraction of many realistic developments. An alternative notion is proposed called retrenchment, which allows information to migrate between I/O and state aspects of operations at different levels of abstraction, and which allows only a fraction of the high level behaviour to be captured at the low level. This permits more of the informal aspects of design to be formally captured and checked. The details are worked out for the B-Method. Idealised and Realistic Modelling: The Inadequacy of Pure RefinementLike all good examples of terminology, the word "refinement" is far too evocative for its use ever to have been confined to exactly one concept. Even within the formal methods community, the word is used in at least two distinct senses. The first is a strict sense. An operation O C is a refinement of an operation O A iff the precondition of O C is weaker than the precondition of O A and the relation of O C is less nondeterministic than the relation of O A .The well known refinement calculus [Back (1981), Back (1988), von Wright (1989), von Wright (1994), Morris (1987), Morgan (1990)] captures this in a formal system within which one can calculate precisely.However there is a second, much less strict use of the word. In formalisms such as Z or VDM [Spivey (1993), Hayes (1993), , Jones and Shaw (1990)], requirements are frequently captured at a high level of abstraction, often involving for instance divine natural numbers or divine real numbers 1 , and neglecting whole rafts of detail not appropriate to a high level view, in order that the reader of the high level description "can see the wood for the trees". Such descriptions are then "refined" to lower levels of abstraction where the missing details are filled in, typically yielding longer, more tortuous and much less transparent but much more realistic definitions of the system in question. Indeed the complexity of such descriptions can often be comparable to or greater than that of their implementations, a fact cited by detractors of formal methods as undermining the value of formal methods themselves, though this seems to us to be like denigrating stereoscopic vision because the image seen by the left eye is of comparable complexity to that seen by the right.In truth the world is a complex place and developing descriptions of some part of it in two distinct but reconcilable formalisms (the specification and implementation), rather 1. By divine naturals, integers or reals, we mean the natural numbers, integers or real numbers that God made, abstract and infinite, in contrast to the finite discrete approximations that we are able to implement on any real world system. The latter we call mundane natural numbers, integers or real numbers.

Faced with the increasing need for correctly designed hybrid and cyber-physical systems today, the problem of including provision for continuously varying behaviour as well as the usual discrete changes of state is considered in the context of Event-B. An extension of Event-B called Hybrid Event-B is presented, that accommodates continuous behaviours (called pliant events) in between familiar discrete transitions (called mode events in this context). The continuous state change can be specified by a combination of indirect specification via ordinary differential equations, or direct specification via assignment of variables to values that depend on time, or indirect specification by demanding that behaviour obeys a time dependent predicate. The syntactic elements of the extension are discussed, and the semantics is described in terms of the properties of time dependent valuations of variables. Refinement is examined in detail, with reference to the notion of refinement inherited from discrete Event-B. A full suite of proof obligations is presented, covering all aspects of the new framework. A selection of examples and case studies is presented. A particular challenge -bearing in mind the desirability of conforming to existing intuitions about discrete Event-B, and the impact on tool support (as embodied in tools for discrete Event-B like Rodin)-is to design the whole framework so as to disturb as little as possible the existing structures for handling discrete Event-B.

Refinement is reviewed, highlighting in particular the distinction between its use as a specification constructor at a high level, and its use as an implementation mechanism at a low level. Some of its shortcomings as a specification constructor at high levels of abstraction are pointed out, and these are used to motivate the adoption of retrenchment for certain high level development steps. Basic properties of retrenchment are described, including a justification of the operation proof obligation, simple examples, its use in requirements engineering and model evolution, and simulation properties. The interaction of retrenchment with refinement notions of correctness is overviewed, as is a range of other technical issues. Two case study scenarios are presented. One is a simple digital redesign control theory problem, and the other is an overview of the application of retrenchment to the Mondex Purse development.

No abstract

No abstract

Retrenchment is a flexible model evolution formalism that arose as a reaction to the limitations imposed by refinement, and for which the proof obligations feature additional predicates for accommodating design data. Composition mechanisms for retrenchment are studied. Vertical, horizontal, dataflow, parallel and fusion compositions are described. Of particular note are the means by which the additional predicates compose. It is argued that all of the compositions introduced are associative, and that they are mutually coherent. Composition of retrenchment with refinement, so important for the smooth interworking of the two techniques, is discussed. Decomposition, allowing finer grained retrenchments to be extracted from a single large grained retrenchment, is also investigated.

Sharp retrenchment is introduced and briefly justified informally, as a liberalisation of refinement. In sharp retrenchment the relationship between an abstract operation and its concrete counterpart is mediated by extra predicates, allowing most particularly the description of nonrefinement-like properties, and the mixing of I/O and state aspects in the passage between levels of abstraction. Sharp retrenchments are briefly contrasted with unsharp ones. Sharp retrenchments are shown to have a natural law of composition, and the way in which refinements may be viewed as sharp retrenchments is discussed. Modulated refinement is introduced as a version of refinement allowing mixing of I/O and state aspects, in order to facilitate comparison between sharp retrenchment and refinement, and various notions of simulation are considered in this context, specifically: stepwise simulation, the ability of simulator to mimic a sequence of execution steps of the simulatee; strong simulation, in which states and step labels are mapped independently between simulatee and simulator; and the refinement notion itself. Special cases of sharp retrenchment are shown to possess various subsets of these simulation properties, and the extent to which sharp retrenchments contain refinements within them is addressed. The details of the theory are worked out for the B-Method, though the applicability of the underlying ideas is not limited to just that formalism.