Tool Support for the CircusRefinement Calculus

Circus [1] specifications combine both data and behavioural aspects of concurrent systems using a combination of CSP [3], Z [9], and Dijkstra’s command language. Its associated refinement theory and calculus [5] distinguishes itself from other such combinations. Using the Circus refinement calculus, we can correctly construct programs in a stepwise fashion [4]. Each step is justified by the application of a refinement law, possibly with the discharge of proof obligations (hereafter called POs). Hence, using Circus we are able to calculate concrete (usually distributed) specifications from abstract (usually centralised) specifications. The manual application of the refinement calculus, however, is an error-prone and hard task. We present CRefine, a tool that supports the use of the Circus refinement calculus. Its interface is similar to Refine’s [8], a tool that supports Morgan’s refinement calculus [4]; it is based on an early prototype that was presented in [10]. We have, however, considerably changed and extended CRefine’s prototype. First, we updated the Circus parser used which fixes a couple of bugs of its earlier version. We have also added facilities to manage developments: undoing and redoing refinement steps, saving and opening developments is now available. Furthermore, some GUI facilities like pretty-printing, filtering applicable laws according to the selected program, classification of laws, adding comments to the development, and printing the development were also included. Finally, the discharge of some proof obligations is now automatically done by CRefine. CRefine provides support to apply the refinement laws and to manage the overall development. Its interface is composed by a menu and three main frames: refinement, proof obligations, and code. The refinement frame shows all the steps of the refinement process. This includes law applications and retrieving the current status of an action or process (collection). The proof obligations frame lists the POs that were generated by the law applications, indicates their current state (i.e. checked valid or invalid, or unchecked), and associates each one of them to the law application that originated it in the refinement frame. Currently, some proof obligations are automatically checked valid or invalid. In our experience, these amount to over 60% of the proof obligations. The remaining proof obligations need to be verified by the user. Finally, the code frame exhibits the overall Circus specification that has been calculate so far. CRefine provides two display formats for formulas: LTEX and Unicode (prettyprinting). We intend to use this tool in teaching the Circus refinement calculus to under-graduates. Unfortunately, most of them are not familiar with LTEX; in order to make CRefine accessible to them, we have also provided a pretty-printing.