1. Specifications and Morphisms Spec Partial-Order sort E op _le_: E, E  Boolean axiom reflexive x le x axiom transitive x le y  y le z  x le z axiom antisymmetric x le y  y le x  x = y Specifications Represent Domain models Transportation, Resource, Task Software Requirements Crew Scheduling Algorithm Theories Global-Search Abstract Data Types Set(Integer) Software Architecture Scheduling-System Code Modules Network-Flow Morphisms Represent Spec StructuringTask  Scheduling  Resource Parameter Binding Time  Integer Spec Refinement Scheduling  Transportation Scheduling Algorithm Design Global-Search  Scheduling Knowledge Refinement Constraint Satisfaction  Integer Programming Datatype Refinement Set(Integer)  Bit Vector Morphism Partial-Order  Integer E   integer le    axioms   theorems A language translation that preserves provability

2. Taxonomy of Collection Datatypes PROTO-COLLECTION PROTO-SEQ PROTO-BAG PROTO-SET SEQ BAG LIST SEQ SET(TUPLE) SET SET-of-NAT-upto-k BIT-VECTOR ORDERED-SEQ SET-OVER-LINEAR-ORDER INDEXED-PARTITION BOUNDED-SEQ ARRAY

3. Planware Refinements po Transportation Scheduling 0 Resource Transportation Resource Abstract Scheduling Task Transportation Tasks TS 1 po Set(A  B  C) Indexed-Partition map(A, Set(A  B  C)) po TS2 Set-over-linear-order Ordered-Seq TS3 po TS4 po Semilattice Attribute of Task Definite Constraint

4. Planware Refinements po TS4 TS6 DRO Global Search with CP TS5 Global Search program TS7 Definite Constraints Constraint Propagation algorithm TS8 po Expr + Context Context-Dependent Simplification TS9 Sort + n-attributes n-tuple TS10 po

5. Derivation of a k-Queens Algorithm 0. Requirement Spec -- a solution is a sequence of the positions of queens in each column 1. Algorithm Design -- a global search strategy is used to enumerate queens solutions 2. Context-dependent Simplification 3. Finite Differencing -- to derive the components of ok-mask 4. Datatype Refinement -- bounded sets  bit-vectors 5. Recursion  Monadic definitions 6. Monadic  Imperative definitions -- via closure removal 7. Slicing -- to remove unnecessary ops, sorts, and axioms 8. Code Generation -- to imperative CommonLisp, C

6. A Simple Transformation Rule Transformation ruleExpression b=c  if @P then @b else @c=b if empty(S) then 0 else 0 Designware Library Refinement Spec Source is import EXPR op P: Boolean op b: E op c: E def expr = if P then b else c axiom b = c Spec EXPR is sort E op expr : E Spec Target is import Source theorem expr = b

7. A Fusion Law spec FOLDR-FUSION is import Seq-of-A sort E op f: A  E op  : A  A  A axiom associative?(  ) op unit: A op foldr : (A  A  A)  Seq-of-A  A  A def foldr(g,as,u) =... op  : A  E  E axiom associative?(  ) op foldr : (A  E  E)  Seq-of-A  A  E def foldr(g,as,u) =... theorem foldr-fusion-law is x  f(y) = f (x  y)  f(foldr( , xs, unit)) = foldr( , xs, f(unit)) end-spec if f(x  y) = x  f(y) and  and  are associative then f(foldr( , xs, unit)) = foldr( , xs, f(unit))

8. A Fusion Law spec foldr-fusion is import EXPR, Seq-of-A op f: A  E op  : A  A  A op foldr : (A  A  A)  Seq-of-A  A  A op  : A  E  E axiom associativity of ,  axiom expr = f(foldr( , xs, unit)) axiom f (x  y) = x  f(y) end-spec if f(x  y) = x  f(y) and  and  are associative then f(foldr( , xs, unit)) = foldr( , xs, f(unit)) spec fold-fusion-law is import fold-fusion op foldr : (A  E  E)  Seq-of-A  A  E theorem f(foldr( , xs, unit)) = foldr( , xs, f(unit)) end-spec Spec EXPR is sort E op expr : E