Ten years ago the Mondex electronic purse was certified to ITSEC Level E6, the highest
level of assurance for secure systems. This involved building formal models in the Z …

Refinement is reviewed, highlighting in particular the distinction between its use as a
specification constructor at a high level, and its use as an implementation mechanism at a …

Retrenchment is a flexible model evolution formalism that compensates for the limitations
imposed by specific formulations of refinement. Its refinement-like proof obligations feature …

Retrenchment is a flexible model evolution formalism that arose as a reaction to the
limitations imposed by refinement, and for which the proof obligations feature additional …

Some of the success stories of model based refinement are recalled, as well as some of the
annoyances that arise when refinement is deployed in the engineering of large systems. The …

Refinement of formal system models towards implementation has been a mainstay of system
development since the inception of formal and Correct by Construction approaches to …

The Mondex Electronic Purse is an outstanding example of industrial scale formal
refinement, and was the first verification to achieve ITSEC level E6 certification. A formal …

Abstract UseCase-wise Development, an 'Agile Method'which introduces functionality into
an application stage by stage, with each stage being carried through (ideally) to …

The manual construction of fault trees for complex systems is an error-prone and time-
consuming activity, encouraging automated techniques. In this paper we show how the …

The ingredients of typical methodologies for model based development via refinement are re-
examined, and some well-known frameworks are reviewed, drawing out commonalities and …