Under consideration for publication in Formal Aspects of Computing The ASM Reﬁnement Method Egon B¨ orger (Universit`a di Pisa, Italy, boerger@di.unipi.it) Abstract. In this paper the Abstract State Machine reﬁnement method is presented. Its characteristics compared to other reﬁnement approaches in the literature are explained. Some frequently occurring forms of ASM reﬁnements are identiﬁed and illustrated by examples from the design and veriﬁcation of architectures and protocols, from the semantics and the implementation of programming languages and from requirements engineering. 1. Introduction Reﬁnement is a general methodological principle which is present wherever a complex system or problem is described piecemeal, decomposing it into constituent parts which are detailed in steps to become manage- able. Reﬁnement goes together with the inverse process of abstraction which characterizes mathematics since ancient times. In software engineering stepwise reﬁnement in one way or the other underlies all top-down approaches. Not surprisingly it also played a central role for incremental program development and veriﬁca- tion in the structural programming endeavor (see [82, 48, 45]) and since then has been studied intensively for speciﬁcation and veriﬁcation approaches which are based on algebraic, set-theoretic or logical methods, as is well documented in numerous books, e.g. [83, 74, 46, 53, 47]. Exploiting the generality of abstraction oﬀered by the notion of Abstract State Machines (ASMs) [57] and guided by problems of practical system design, the ASM ground model method has been developed in [10, 11, 12, 13] together with a rather general reﬁnement scheme for ASMs. Through further development in [36, 26, 7, 6, 22, 28, 29, 40, 79], ASM ground model construction and stepwise reﬁnement became together with the deﬁnition of ASM s in [58] the three constituents of the ASM method for practical system design and analysis (see the AsmBook [42] for a sys- tematic introduction and [16] for historical details). In the ASM method, stepwise reﬁnement appears as a practical method for crossing levels of abstraction to link ASM models through well-documented incremental development steps, starting from ground models and turning them piecemeal into executable code. In this paper we explain the ASM reﬁnement method and characterize it with respect to other reﬁnement approaches in the literature. We show that the ASM reﬁnement method provides a kind of meta-framework which integrates well-known more speciﬁc notions of reﬁnement (see [73, 64, 67, 74, 46, 47]), similarly to the way the notion of ASMs covers well-known models of computation and approaches to system design [17]. For the readers who are not familiar with ASMs we provide in Section 2 a summary of the few basic deﬁnitions which are needed for a technical understanding. In Section 3 we deﬁne the general notion of ASM reﬁnement. In Section 4 we illustrate the ASM reﬁnement concept by some practically useful specializations, namely conservative extension, procedural (submachine) reﬁnement, pure data reﬁnement, and instantiation. In Section 5 we present a general scheme for proving the correctness of reﬁnements which can be used to establish complex system properties by proving them in an abstract model which is correctly reﬁned to the considered system. In the Conclusion we brieﬂy review some main usages of ASM reﬁnements in practical Correspondence and oﬀprint requests to: EgonB¨orger (Universit` a di Pisa, Italy, boerger@di.unipi.it)