Systematic program development and proof: Dromey's method versus top-down refinement

Abstract

This paper compares a program development method proposed in a recent paper by R. G. Dromey with the Wirth-Dijkstra top-down refinement method with regard to proof-of-correctness issues. Several new examples are given to illustrate Dromey's method and to demonstrate its advan­ tages over the top-down refine­ ment method with regard to verifiability of the resulting programs. Using Dromey's method, a pro­ gram is developed by 'making a sequence of refinements, each of which can establish the postcon­ dition for a corresponding se­ quence of progressively weaker preconditions until a mechanism has been composed that will es­ tablish the postcondition for the original given precondition for the problem.' A critical el­ ement of the method is a collec­ tion of formal methods for transforming the postcondition of a specification into a form which guides program develop­ ment. The present paper examines Dromey's method in general and these formal methods in particu­ lar, with regard to program ver­ ification via Hoare-type rules. A principle new example of the use of Dromey's method discussed in the paper is the derivation of an algorithm to compute the n-adic representation of a nat­ ural number (where n is any nat­ ural number). The paper compares this algorithm with one obtained by use of a more traditional top-down approach, showing that verification for this problem is much more straightforward for the program obtained using Dromey's method. As a first step toward generalizing this result, the paper compares a number of the methods for transforming postconditions (Dromey's method) with commonly used methods for deriving loop invariants for use with Hoare-type rules. Permission to copy without fee all or part of this material is granted provided that the copies are not made or distributed for direct com­ mercial advantage, the ACM copyright notice and the title of the publication and its date appear, and notice is given that copying is by permission of the Association for Computing Machinery. To copy otherwise, or to republish, requires n fee and/or specific per­