Results 1  10
of
20
Engineering and Theoretical Underpinnings of Retrenchment
, 2001
"... Refinement is reviewed in a partial correctness framework, highlighting in particular the distinction between its use as a specification constructor at a high level, and its use as an implementation mechanism at a low level. Some of its shortcomings as specification constructor at high levels of ..."
Abstract

Cited by 18 (13 self)
 Add to MetaCart
Refinement is reviewed in a partial correctness framework, highlighting in particular the distinction between its use as a specification constructor at a high level, and its use as an implementation mechanism at a low level. Some of its shortcomings as specification constructor at high levels of abstraction are pointed out, and these are used to motivate the adoption of retrenchment for certain high level development steps. Basic properties of retrenchment are described, including a justification of the operation PO, simple examples, simulation properties, and compositionality for both the basic retrenchment notion and enriched versions. The issue of framing retrenchment in the wide variety of correctness notions for refinement calculi that exist in the literature is tackled, culminating in guidelines on how to `brew your own retrenchment theory'. Two short case studies are presented. One is a simple digital redesign control theory problem, the other is a radiotherapy dos...
Maximally Abstract Retrenchments
 IN PROC. IEEE ICFEM00
, 2000
"... The drawbacks of using refinement alone in the construction of specifications from simple abstract models is used as the spur for the introduction of retrenchment — a method based on the main ideas of refinement but one which is more liberal in character. The basics of the retrenchment mechanism ar ..."
Abstract

Cited by 17 (14 self)
 Add to MetaCart
The drawbacks of using refinement alone in the construction of specifications from simple abstract models is used as the spur for the introduction of retrenchment — a method based on the main ideas of refinement but one which is more liberal in character. The basics of the retrenchment mechanism are reviewed in preparation for exploring its integration with refinement. The particular aspect of integration investigated in this paper is the factorisation of a retrenchment step from an abstract to a concrete model into a refinement followed by a retrenchment. The objective is to engineer a system which is at the level of abstraction of the concrete model, but is refinable from the abstract one. The construction given here solves the problem in a universal manner, there being a canonical factorisation of the original retrenchment into an I/Ofiltered refinement to the universal system followed by a retrenchment. The universal property arises from the fact that the refinement component of any similar factorisation is refinable to the universal system. An idempotence property supports the claim that the construction is at the correct level of abstraction. A synopsis of an earlier result which factorised a retrenchment step into a canonical retrenchment to a universal system followed by a refinement is presented. A refinement relationship is then shown to exist between the two universal systems. Finally, the consequences of including termination criteria are briefly explored.
Controlling Control Systems: An Application of Evolving Retrenchment
"... We review retrenchment as a liberalisation of refinement, for the description of applications too rich (e.g. using continuous and infinite types) for refinement. A specialisation of the notion, evolving retrenchment is introduced, motivated by the need for an approximate, evolving notion of simu ..."
Abstract

Cited by 16 (12 self)
 Add to MetaCart
We review retrenchment as a liberalisation of refinement, for the description of applications too rich (e.g. using continuous and infinite types) for refinement. A specialisation of the notion, evolving retrenchment is introduced, motivated by the need for an approximate, evolving notion of simulation. The focus of the paper is the case study, a substantial secondorder linear control system. The design step from continuous to zeroorder hold discrete system is expressible as an evolving retrenchment. Thus we demonstrate that the retrenchment approach can formalise the development of useful applications, which are outside the scope of refinement. The work is presented in a data typeenriched language containing the B language of J.R. Abrial. 1
Retrenchment: Extending Refinement for Continuous and Control Systems
, 2000
"... Discussion of a radiation dose calculation example demonstrates various expressive limitations of the refinement calculus, particularly for systems with continuous variables. A liberalization of refinement, called retrenchment, is proposed, which will support an analogous formal development calculus ..."
Abstract

Cited by 11 (11 self)
 Add to MetaCart
Discussion of a radiation dose calculation example demonstrates various expressive limitations of the refinement calculus, particularly for systems with continuous variables. A liberalization of refinement, called retrenchment, is proposed, which will support an analogous formal development calculus. Useful concrete system behaviour can be specified outside the domain of pure refinement, in particular behaviour under controlled precision decay. A syntax and a formal definition are presented for retrenchment in the B notation of J.R. Abrial. Necessary transitivity and monotonicity properties for a formal development calculus are stated. A generalisation, evolving retrenchment, is proposed, and a simple example demonstrates its utility, by analogy, in control systems applications. Evolution in retrenchment is demonstrated to offer the expressive power to describe useful simulationlike behaviour, with evolving precision, in software for control systems. Finally, the dosimetry ...
Formal program development with approximations
 Proc. ZB 2005: Formal Specification and Development in B, volume 3455 of LNCS
, 2005
"... Abstract. We describe a method for combining formal program development with a disciplined and documented way of introducing realistic compromises, for example necessitated by resource bounds. Idealistic specifications are identified with the limits of sequences of more “realistic” specifications, a ..."
Abstract

Cited by 8 (3 self)
 Add to MetaCart
Abstract. We describe a method for combining formal program development with a disciplined and documented way of introducing realistic compromises, for example necessitated by resource bounds. Idealistic specifications are identified with the limits of sequences of more “realistic” specifications, and such sequences can then be refined in their entirety. Compromises amount to focusing the attention on a particular element of the sequence instead of the sequence as a whole. This method addresses the problem that initial formal specifications can be abstract or complete but rarely both. Various potential application areas are sketched, some illustrated with examples. Key research issues are found in identifying metric spaces and properties that make them usable for refinement using approximations.
Structuring retrenchments in B by decomposition
 PROC. FME2003: FORMAL METHODS, VOLUME 2805 OF LNCS
, 2003
"... Simple retrenchment is briefly reviewed in the B language of J.R. Abrial [1] as a liberalization of classical refinement, for the formal description of application developments too demanding for refinement. This work initiates the study of the structuring of retrenchmentbased developments in B b ..."
Abstract

Cited by 7 (6 self)
 Add to MetaCart
Simple retrenchment is briefly reviewed in the B language of J.R. Abrial [1] as a liberalization of classical refinement, for the formal description of application developments too demanding for refinement. This work initiates the study of the structuring of retrenchmentbased developments in B by decomposition. A given coarsegrained retrenchment relation between specifications is decomposed into a family of more finegrained retrenchments. The resulting family may distinguish more incisively between refining, approximately refining, and nonrefining behaviours. Two decomposition results are given, each sharpening a coarsegrained retrenchment within a particular syntactic structure for operations at concrete and abstract levels. A third result decomposes a retrenchment exploiting structure latent in both levels. The theory is illustrated by a simple example based on an abstract model of distributed computing, and methodological aspects are considered.
Fragmented Retrenchment, Concurrency and Fairness
"... Retrenchment is presented in a simple relational framework as a more flexible development concept than refinement for capturing the early preformal stages of development, and briefly justified. Fragmented retrenchment permits the granularity of actions to decrease across a development step, many con ..."
Abstract

Cited by 6 (5 self)
 Add to MetaCart
Retrenchment is presented in a simple relational framework as a more flexible development concept than refinement for capturing the early preformal stages of development, and briefly justified. Fragmented retrenchment permits the granularity of actions to decrease across a development step, many concrete steps retrenching a single abstract one. This generates the usual proliferation of interleavings of events at the concrete level. Event structures, particularly flow event structures, help to control these within the retrenchments of a single abstract step, while the concurrent reading of the fragmented retrenchment proof obligation permits acceptable interleavings of retrenchments of different steps. It is observed that retrenchment allows the convenient description of unfair behaviours when fairness is not guaranteed.
Model Based Engineering of Specifications by Retrenching Partial Requirements
"... In conventional modeloriented formal refinement, the abstract model is supposed to capture all the properties of interest in the system, in an asclutterfreeaspossible manner. Subsequently, the refinement process guides development inexorably towards a faithful implementation. However refinement ..."
Abstract

Cited by 2 (1 self)
 Add to MetaCart
In conventional modeloriented formal refinement, the abstract model is supposed to capture all the properties of interest in the system, in an asclutterfreeaspossible manner. Subsequently, the refinement process guides development inexorably towards a faithful implementation. However refinement says nothing about how to obtain the abstract model in the first place. In reality developers experiment with prototype models and their refinements until a workable arrangement is discovered. Retrenchment is a formal technique intended to capture model in a formal manner that will integrate with refinement. This is in order that the benefits of a formal approach can migrate further up the development hierarchy. After a presentation of the basic ideas of retrenchment, a simple telephone system feature interaction case study is given to illustrate how retrenchment can relate incompatible partial models to a more definitive consolidated model during the development of the contracted specification.
Commitment: A Challenge for Formal Methods
"... Abstract. As an exploratory case study for the use of formal methods in cryptography, this paper considers the commitment primitive. Its reconstruction from an abstract informal characterisation explains most aspects of the usual commitment specifications, and demonstrates succinctly the inadequacy ..."
Abstract

Cited by 1 (1 self)
 Add to MetaCart
Abstract. As an exploratory case study for the use of formal methods in cryptography, this paper considers the commitment primitive. Its reconstruction from an abstract informal characterisation explains most aspects of the usual commitment specifications, and demonstrates succinctly the inadequacy of the traditional formal methods “toolbox ” in the context of modern cryptography. Additions to this toolbox are explored.
On the formal development of safetycritical software
 in VSTTE, 2005
"... Abstract. We reflect on the formal development models applicable to embedded control systems in light of our experience with safetycritical applications from the aerospace domain. This leads us to propose two complementary enhancements to Parnas ' fourvariable model, one elaborating the str ..."
Abstract

Cited by 1 (0 self)
 Add to MetaCart
Abstract. We reflect on the formal development models applicable to embedded control systems in light of our experience with safetycritical applications from the aerospace domain. This leads us to propose two complementary enhancements to Parnas ' fourvariable model, one elaborating the structure outside the control computer, and the other elaborating the structure inside the control computer. We then identify several challenges which illustrate why formal development in this domain is difficult, and report our own progress in meeting these challenges. Finally, we outline the residual issues, which form the agenda for our future work. 1