Understanding, Explaining, and Deriving Refinement

Abstract

Much of what drove us in over twenty years of research in refinement, starting with Z in particular, was the desire to understand where refinement rules came from. The relational model of refinement provided a solid starting point which allowed the derivation of Z refinement rules. Not only did this explain and verify the existing rules-more importantly, it also allowed alternative derivations for different and generalised notions of refinement. In this chapter, we briefly describe the context of our early efforts in this area and Susan Stepney's role in this, before moving on to the motivation and exploration of a recently developed primitive model of refinement: concrete state machines with anonymous transitions. 1 Introduction: Z Refinement Theories of the Late 1990s At the Formal Methods Europe conference at Oxford in 1996 [20], there was a reception to celebrate the launch of Jim and Jim's (Woodcock and Davies) book on Understanding Z [30]. This was a fascinatingly different book on Z for those with a firm interest in Z refinement like ourselves, one as aspirational and inspirational as the slightly earlier "Z in Practice" [5]. It contained a full derivation of the downward simulation rules for states-and-operations specifications, with inputs and outputs, all the way from Hoare, He and Sanders' relational refinement rules [22], with the punny "relaxing" and "unwinding" important steps of the derivation process. In addition, unlike most Z textbooks, it also included upward simulation rules to achieve completeness-we were told that these had turned out to be necessary in an exciting but mostly confidential industry project called "Mondex" [29]. There was