In this paper we study the fragile base class problem. This problem occurs in open object-oriented systems employing code inheritance as an implementation reuse mechanism. System developers unaware of extensions to the system developed by its users may produce a seemingly acceptable revision of a base class which may damage its extensions. The fragile base class problem becomes apparent during maintenance of open object-oriented systems, but requires consideration during design. We express the fragile base class problem in terms of a exibility property. By means of ve orthogonal examples, violating the exibility property, we demonstrate di erent aspects of the problem. We formulate requirements for disciplining inheritance, and extend the re nement calculus to accommodate for classes, objects, class-based inheritance, and class re nement. We formulate and formally prove a exibility theorem demonstrating that the restrictions we impose on inheritance are sufcient to permit safe substitu...