The University of Southampton
University of Southampton Institutional Repository

Retrenching the Purse: Finite Sequence Numbers, and the Tower Pattern

Banach, Richard, Poppleton, Michael, Jeske, Czeslaw and Stepney, Susan, (2005) Retrenching the Purse: Finite Sequence Numbers, and the Tower Pattern Fitzgerald, John, Hayes, Ian and Tarlecki, Andrzej (eds.) At FM 2005: International Symposium of Formal Methods Europe, United Kingdom. 18 - 22 Jul 2005. , pp. 382-398.

Record type: Conference or Workshop Item (Paper)


The Mondex Electronic Purse system is an outstanding example of formal refinement techniques applied to a genuine industrial scale application, and notably, was the first verification to achieve ITSEC level E6 certification. A formal abstract model including security properties, and a formal concrete model of the system design were developed, and a formal refinement was hand-proved between them in Z. Despite this success, certain requirements issues were set beyond the scope of the formal development, or handled in an unnatural manner. Retrenchment is reviewed in a form suitable for integration with Z refinement, and is used to address one such issue in detail: the finiteness of the transaction sequence number in the purse funds transfer protocol. A retrenchment is constructed from the lowest level model of the purse system to a model in which sequence numbers are finite, using a suitable elaboration of the Z promotion technique. We overview the lifting of that retrenchment to the abstraction level of the higher models of the purse system. The concessions of the various retrenchments generated, formally capture the dissonance between the unbounded sequence number idealisation and the bounded reality. Reasoning about when the concession can become valid influences the actual choice of sequence number bound. The retrenchment-enhanced formal development is proposed as an example of a widely applicable methodological pattern for formal developments of this kind: the Tower Pattern.

PDF Retrench.Mondex.Seq.FM05.pdf - Other
Download (127kB)

More information

Published date: 2005
Additional Information: Event Dates: 18-22 July 2005
Venue - Dates: FM 2005: International Symposium of Formal Methods Europe, United Kingdom, 2005-07-18 - 2005-07-22
Keywords: retrenchment, refinement, electronic purse, Z, promotion
Organisations: Electronic & Software Systems


Local EPrints ID: 260805
ISBN: ISBN 3-540-27882-6
PURE UUID: 17a2b6dc-5575-468b-b0bc-e8dbb7b75a72

Catalogue record

Date deposited: 29 Apr 2005
Last modified: 18 Jul 2017 09:09

Export record


Author: Richard Banach
Author: Michael Poppleton
Author: Czeslaw Jeske
Author: Susan Stepney
Editor: John Fitzgerald
Editor: Ian Hayes
Editor: Andrzej Tarlecki

University divisions

Download statistics

Downloads from ePrints over the past year. Other digital versions may also be available to download e.g. from the publisher's website.

View more statistics

Atom RSS 1.0 RSS 2.0

Contact ePrints Soton:

ePrints Soton supports OAI 2.0 with a base URL of

This repository has been built using EPrints software, developed at the University of Southampton, but available to everyone to use.

We use cookies to ensure that we give you the best experience on our website. If you continue without changing your settings, we will assume that you are happy to receive cookies on the University of Southampton website.