Requirements for a Program Refinement Engine