Specification
Abstract Spec
Concrete (ML)
Implementation
Properties
(English)
refinement
proof
(I/O Automata)
Abstract Spec: behavioral, global state
Refinement:
design choices (e.g., token or sequencer)
