“…In data refinement [13], some variables in the more abstract machine are replaced by other variables in the refined machine; in this case, we need to add a gluing invariant in the refined machine, which formally defines the relation between the previous, abstract variables and the newly introduced, concrete ones. Refinement in Event-B has been used to model numerous protocols and systems, see [2,7,23,12,18,28,26,15,19,29]. Event-B benefits from the tool support of the Eclipse-based Rodin platform [3].…”