Domain-specific scenarios for refinement-based methods

Formal methods use abstraction and rigorously verified refinement to manage the design of complex systems, ensuring that they satisfy important invariant properties. However, formal verification is not sufficient: models must also be tested ensure behave according informal requirements validated by domain experts who may expert in modelling. This can satisfied scenarios complement specification. The model animated check whether scenario feasible reaches states expected scenario. there are two problems with this approach. 1) natural language used describe often verbose, ambiguous therefore difficult understand; especially if modeller a expert. 2) Provided typically at most concrete level corresponding full cannot until all refinements have been completed model. We show example how precise concise specific for writing these abstract style easily understood (for validation purposes) as well behavioural verification) persistence automated tool support. propose alternative approaches using during modelling: A method refining before refined so guide modelling, abstracting from provided ones test early illustrate on ‘Tokeneer’ secure enclave ERTMS/ETCS Hybrid Level 3 specification railway controls. base our approach Cucumber framework Event-B modelling set. developed new ‘Scenario Checker’ plugin animation scenarios.1