Retrenching the Purse: The Balance Enquiry Quandary, and Generalised and (1,1) Forward Refinements

  • Authors:

  • Richard Banach;Czeslaw Jeske;Michael Poppleton;Susan Stepney

  • Affiliations:

  • School of Computer Science, University of Manchester, Manchester M13 9PL, UK. E-mail: {banach,cj}@cs.man.ac.uk;School of Computer Science, University of Manchester, Manchester M13 9PL, UK. E-mail: {banach,cj}@cs.man.ac.uk;School of Electronics and Computer Science, University of Southampton, Southampton SO17 1BJ, UK. E-mail: mrp@ecs.soton.ac.uk;Department of Computer Science, University of York, York YO10 5DD, UK. E-mail: susan.stepney@cs.york.ac.uk

  • Venue:
  • Fundamenta Informaticae - This is a SPECIAL ISSUE ON ASM'05
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Some of the success stories of model based refinement are recalled, as well as some of the annoyances that arise when refinement is deployed in the engineering of large systems. The way that retrenchment attempts to alleviate such inconveniences is briefly reviewed. The Mondex Electronic Purse formal development provides a highly credible testbed for examining how real world refinement difficulties can be treated via retrenchment. The contributions of retrenchment to integrating the real implementation with the formal development are surveyed, and the extraction of commonly occurring 'retrenchment patterns' is recalled. One of the Mondex difficulties, the 'Balance Enquiry Quandary' is treated in detail, and the way that retrenchment is able to account for the system behaviour is explained. The problem is reconsidered using generalised forward refinement, and the simplicity of the resolution of the quandary, both by retrenchment, and by generalised forward refinement, inspires the creation of a genuine (1,1) forward refinement forMondex, something long thought impossible. The forward treatment exhibits a similar balance enquiry quandary to the backward refinement, as it must, given that both are refinements of an atomic action to a non-atomic protocol, and the forward quandary is dealt with as easily by retrenchment as is the backward case. The simplicity of the retrenchment treatment foreshadows a general purpose retrenchment Atomicity Pattern for dealing with atomic-versus-finegrained situations.