Abrial's Generalised Substitution Language (GSL) [4] can be modified to operate on arithmetic expressions, rather than Boolean predicates, which allows it to be applied to probabilistic programs [13]. We add a new operator p ⊕ to GSL, for probabilistic choice, and we get the probabilistic Generalised Substitution Language (pGSL): a smooth extension of GSL that includes random algorithms within its scope. In this paper we begin to examine the effect of pGSL on B 's larger-scale structures: its machines. In particular, we suggest a notion of probabilistic machine invariant. We show how these invariants interact with pGSL, at a fine-grained level; and at the other extreme we investigate how they affect our general understanding "in the large" of probabilistic machines and their behaviour. Overall, we aim to initiate the development of probabilistic B (pB), complete with a suitable probabilistic AMN (pAMN). We discuss the practical extension of the B-Toolkit [5] to support pB , and we give examples to show how pAMN can be used to express and reason about probabilistic properties of a system.

Abstract. In earlier work, we introduced probability to the B-Method (B ) by providing a probabilistic choice substitution and by extending B 's semantics to incorporate its meaning [8]. This, a first step, allowed probabilistic programs to be written and reasoned about within B . This paper extends the previous work into refinement within B . To allow probabilistic specification and development within B , we must add a probabilistic specification substitution; and we must determine the rules and techniques for its rigorous refinement into probabilistic code. Implementation in B frequently contains loops. We generalise the standard proof obligation rules for loops giving a set of rules for reasoning about the correctness of probabilistic loops. We present a small casestudy that uses those rules, the randomised Min-Cut algorithm.