Formal model refinement: from specification to implementation