We describe a set of rules for the systematic structural modification of Object-Z specifications to derive designs that are appropriate for implementation in an object-oriented programming language. Such a methodology is important for systems that are sufficiently large to warrant the object-oriented programming approach, but additionally require development under strict verification conditions. We demonstrate that these rules are complete in the sense that from any specification that does not contain unbounded recursive constructs, any design may be derived which represents a refinement of the original and also does not contain unbounded recursive constructs
