An Exercise in Conditional Refinement

This paper is an attempt to demonstrate the potential of conditional reenement in step-wise system development. In particular, we emphasise the ease with which conditional reenement allows bounded-ness constraints to be introduced in a speciication based on unbounded resources. For example, a speciication based on purely asynchronous communication can be conditionally reened into a speciication using time-synchronous communication. The presentation is built around a small case-study: A step-wise design of a timed FIFO queue that is partly to be implemented in hardware and partly to be implemented in software. We rst specify the external behaviour of the queue ignoring timing and synchronisation. This overall speciication is then restated in a time-synchronous setting and thereafter reened into a composite speciication consisting of three sub-speciications: A speciication of a time-synchronous hardware queue, a speciication of an asynchronous software queue, and a speciication of an interface component managing the communication between the rst two. We argue that the three overall speciications can be related by conditional reenement. By further steps of conditional reenement additional boundedness constraints are introduced. We explain how e a c h step of conditional reenement can be formally veriied in a compositional manner.