1. Morphism Partial-OrderInteger E integer le  axioms theorems Specifications and Morphisms Spec Partial-Order sort E op _le_: E, EBoolean axiom reflexive x le x axiom transitive x le y  y le z  x le z axiom antisymmetric x le y  y le x  x = y A language translation that preserves provability Specifications Represent Domain models Transportation, Resource, Task Software Requirements Crew Scheduling Algorithm Theories Global-Search Abstract Data Types Set(Integer) Software Architecture Scheduling-System Code Modules Network-Flow Morphisms Represent Spec Structuring TaskSchedulingResource Parameter Binding Time Integer Spec Refinement SchedulingTransportationScheduling Algorithm Design Global-SearchScheduling Knowledge Refinement Constraint SatisfactionInteger Programming Datatype Refinement Set(Integer)Bit Vector

2. Taxonomy of Collection Datatypes PROTO-COLLECTION LIST PROTO-SEQ SEQ SEQ ARRAY PROTO-BAG BOUNDED-SEQ BAG PROTO-SET BAG SET BIT-VECTOR INDEXED-PARTITION SET(TUPLE) SET-of-NAT-upto-k ORDERED-SEQ SET-OVER-LINEAR-ORDER

3. Planware Refinements Abstract Scheduling Resource po Transportation Resource Transportation Scheduling 0 Task po Semilattice Attribute of Task Transportation Tasks TS 1 po Definite Constraint TS2 Set(ABC) po Indexed-Partition map(A, Set(ABC)) TS3 Set-over-linear-order po TS4 Ordered-Seq

4. Planware Refinements TS4 DRO Global Search TS5 Global Search with CP TS6 po Global Search program TS7 Definite Constraints Constraint Propagation algorithm po Expr + Context TS8 po Context-Dependent Simplification TS9 Sort + n-attributes po n-tuple TS10

5. Derivation of a k-Queens Algorithm 0. Requirement Spec -- a solution is a sequence of the positions of queens in each column 1. Algorithm Design -- a global search strategy is used to enumerate queens solutions 2. Context-dependent Simplification 3. Finite Differencing -- to derive the components of ok-mask 4. Datatype Refinement -- bounded sets  bit-vectors 5. Recursion  Monadic definitions 6. Monadic  Imperative definitions -- via closure removal 7. Slicing -- to remove unnecessary ops, sorts, and axioms 8. Code Generation -- to imperative CommonLisp, C

6. A Simple Transformation Rule Transformation rule Expression if empty(S) then 0 else 0 b=c  if @P then @b else @c=b Designware Library Refinement Spec EXPR is sort E op expr : E Spec Source is import EXPR op P: Boolean op b: E op c: E def expr = if P then b else c axiom b = c Spec Target is import Source theorem expr = b

7. A Fusion Law if f(x  y) = x  f(y) and  and  are associative then f(foldr(, xs, unit)) = foldr(, xs, f(unit)) spec FOLDR-FUSION is import Seq-of-A sort E op f: A  E op : A  A  A axiom associative?( ) op unit: A op foldr : (A  A  A)  Seq-of-A  A  A def foldr(g,as,u) = ... op : A  E  E axiom associative?( ) op foldr : (A  E  E)  Seq-of-A  A  E def foldr(g,as,u) = ... theorem foldr-fusion-law is xf(y) = f (x  y)  f(foldr(, xs, unit)) = foldr( , xs, f(unit)) end-spec

8. A Fusion Law if f(x  y) = x  f(y) and  and  are associative then f(foldr(, xs, unit)) = foldr(, xs, f(unit)) Spec EXPR is sort E op expr : E spec foldr-fusion is import EXPR, Seq-of-A op f: A  E op : A  A  A op foldr : (A  A  A)  Seq-of-A  A  A op : A  E  E axiom associativity of ,  axiom expr = f(foldr(, xs, unit)) axiom f (x  y) = xf(y) end-spec spec fold-fusion-law is import fold-fusion op foldr : (A  E  E)  Seq-of-A  A  E theoremf(foldr(, xs, unit)) = foldr( , xs, f(unit)) end-spec