Miller, Steven P.O'Brien, DanHeimdahl, MatsJoshi, Anjali2020-09-022020-09-022005-12-14https://hdl.handle.net/11299/215680Partitioning a system consists of dividing it into components that can be physically isolated from each other while preserving the essential behavior of the system. In this report, we describe a methodology for developing and reasoning about such systems. This approach allows a developer to start from an ideal system specification and refine it along two axes. Along one axis, the system can be refined one component at a time toward an implementation. Along the other axis, the behavior of the system can be relaxed to produce a more cost effective but still acceptable solution. We illustrate this process by applying it to the synchronization logic of a Dual Fight Guidance System, evolving the system from an ideal case in which the components do not fail and communicate synchronously to one in which the components can fail and communicate asynchronously. For each step, we show how the system requirements have to change if the system is be implemented and prove that each implementation meets the revised system requirements through model-checking.en-USReport