## Composing Specifications (1993)

### Cached

### Download Links

- [www.research.digital.com]
- [www.research.digital.com]
- [ftp.digital.com]
- [ftp.digital.com]
- [apotheca.hpl.hp.com]
- [pa.bell-labs.com]
- [pa.bell-labs.com]
- [www.research.digital.com]
- [gatekeeper.dec.com]
- [apotheca.hpl.hp.com]
- [research.microsoft.com]
- [research.microsoft.com]
- [www.hpl.hp.com]
- [www.hpl.hp.com]
- DBLP

### Other Repositories/Bibliography

Venue: | ACM TRANSACTIONS ON PROGRAMMING LANGUAGES AND SYSTEMS |

Citations: | 536 - 18 self |

### BibTeX

@ARTICLE{Abadi93composingspecifications,

author = {Martín Abadi and Leslie Lamport},

title = {Composing Specifications},

journal = {ACM TRANSACTIONS ON PROGRAMMING LANGUAGES AND SYSTEMS},

year = {1993},

volume = {15},

number = {1},

pages = {73--132}

}

### Years of Citing Articles

### OpenURL

### Abstract

### Citations

3410 | A theory of communicating sequential processes
- BROOKES, HOARE, et al.
- 1984
(Show Context)
Citation Context ...ronment actions. Formalisms based on joint system/environment actions require more subtle distinctions, such as between "internal" and "external" nondeterminism, or between the # a=-=nd operators of CSP [11]-=-. In a state-based formalism, the easiest way to distinguish system actions from environment actions is to partition the state components into input and output components and require that the values o... |

1332 |
A Calculus of Communicating Systems
- Milner
- 1982
(Show Context)
Citation Context ...me logical system. Action-based approaches have tended to use algebra, a specification being an object that is manipulated algebraically. Milner's CCS is the classic example of an algebraic formalism =-=[21]-=-. State-based and action-based approaches also tend to di#er in practice. To specify keyboard input using an action-based approach, the typing of a single character might be represented as a single ac... |

806 | The temporal logic of actions - Lamport - 1994 |

438 | The existence of refinement mappings
- Abadi, Lamport
- 1991
(Show Context)
Citation Context ...ng abstract programs and temporal logic [16]. The method permits a hierarchical approach in which the composition of lower-level specifications is proved to implement a higher-level specification. In =-=[1]-=-, we described how to prove that one specification implements another. Here, we examine how to compose specifications. We work at the semantic level, independent of any particular specification langua... |

414 | Introduction to VLSI systems - Mead, Conway - 1980 |

412 |
Proof of correctness of data representations
- Hoare
- 1972
(Show Context)
Citation Context ...ese mappings can be constructed in practice, because refinement mappings are essentially abstraction functions of the kind that have been used for years to prove that one data type implements another =-=[10]-=-. ACM Transactions on Programming Languages and Systems, Vol 15, No. 1, January 1993. 100 Martn Abadi and Leslie Lamport 5.3 The Main Theorem 5.3.1 A Precise Statement of the Composition Principle. Ha... |

389 |
Defining liveness
- Alpern, Schneider
- 1985
(Show Context)
Citation Context ...finite behavior prefix is a prefix of a behavior in P . With a standard topology on the set of behaviors, a property is a safety property i# it is closed, and it is a liveness property i# it is dense =-=[3]-=-. It follows from elementary results of topology ACM Transactions on Programming Languages and Systems, Vol 15, No. 1, January 1993. 82 Martn Abadi and Leslie Lamport that every property is the conjun... |

366 | Hierarchical correctness proofs for distributed algorithms
- Lynch, Tuttle
- 1987
(Show Context)
Citation Context ...us, our results can be applied to a number of approaches besides the transitionaxiom method---for example, to Lam and Shankar's method of projections [12], and to the I/O automata of Lynch and Tuttle =-=[19]-=-. Composition makes sense only for systems that interact with their environments. Such a system will behave properly only if its environment does. A Pascal program may behave quite improperly if a rea... |

307 |
A.: On the development of reactive systems
- Harel, Pnueli
- 1989
(Show Context)
Citation Context ... 2 out2 out1 Fig. 1. Composing Systems The principle's conclusion, that \Pi satisfies M under environment assumption E, is the conclusion {P}\Pi{Q} of the proof rule. We now consider reactive systems =-=[9]-=-. The interaction of a reactive system with its environment cannot be expressed simply by pre- and postconditions. For example, suppose the environment passes values to the system through a register r... |

247 |
Trace theory for automatic hierarchical verification of speed-independent circuits
- Dill
- 1989
(Show Context)
Citation Context ...o our definition of receptiveness was not considered in the thesis, but did appear in his unpublished thesis proposal. Dill independently developed the notion of receptiveness and introduced its name =-=[8]-=-. In [2], a concept of realizability was defined in which Os(f) included all outcomes, rather than just fair ones. By eliminating unfair outcomes, we are preventing the environment from ending the gam... |

209 | and full completeness for multiplicative linear logic - Abramsky, Jagadeesan - 1994 |

205 | L.: An old-fashioned recipe for real time - Abadi, Lamport - 1994 |

193 |
Specifying concurrent program modules
- Lamport
- 1983
(Show Context)
Citation Context ...em agent and an environment agent, as was done by Barringer, Kuiper, and Pnueli in [5] and by us in [2]. However, for composing specifications, one needs more general sets of agents, as introduced in =-=[13] (where ag-=-ents were called "actions"). It may help the reader to think of the agents as elementary circuit components or individual machine-language instructions. However, the actual identity of the i... |

179 |
What good is temporal logic
- Lamport
(Show Context)
Citation Context ...lso unobservable, internal state components of the various objects that make up the universe. A stuttering step represents a step in which some object changes only its internal state. As explained in =-=[14]-=- and [16], considering stuttering-equivalent behaviors to be equivalent allows the hierarchical decomposition of specifications by refining the grain of atomicity. If # is a finite behavior prefix, th... |

163 | Specification and design of (parallel) programs - Jones - 1983 |

160 |
Proofs of networks of processes
- Misra, Chandy
- 1981
(Show Context)
Citation Context ...tness specifications; the guarantees and assumptions of such specifications are safety properties. The Composition Principle for safety properties is also embodied in a proof rule of Misra and Chandy =-=[22]-=- for processes communicating by means of CSP primitives. Specifications that involve only safety properties are not very satisfying, since any safety property is satisfied by a system that does nothin... |

148 | The temporal semantics of concurrent programs - Pnueli - 1981 |

141 |
Proving liveness properties of concurrent programs
- Owicki, Lamport
- 1982
(Show Context)
Citation Context ...perty f # (L), which is generally a liveness property. Thus, verification of this condition is tantamount to proving that a program satisfies a liveness property, which can be done with the method of =-=[24]-=- when L and L # are expressed as temporal logic formulas. Condition 3 is weaker in two ways than the corresponding condition R3 in the definition of a refinement mapping in [1]. First, condition 3 app... |

137 |
Verifying properties of parallel programs: An axiomatic approach
- Owicki, Gries
- 1976
(Show Context)
Citation Context ...asserting that P is true in the first state of a step, and I is the identity relation. Finding an invariant P and proving its invariance is exactly what one does in a proof by the Owicki-Gries method =-=[18; 23]-=-, so the method for proving this condition generalizes the standard method for proving invariance properties of concurrent programs. (4) f maps behaviors that satisfy I # # TA (N # E ) # TA (N # M ) #... |

119 | Conjunction as Composition - Zave, Jackson |

118 | A simple approach to specifying concurrent systems
- Lamport
- 1989
(Show Context)
Citation Context ...mming, liveness properties, modular specification, safety properties 1. INTRODUCTION In the transition-axiom method, concurrent systems are specified by combining abstract programs and temporal logic =-=[16]-=-. The method permits a hierarchical approach in which the composition of lower-level specifications is proved to implement a higher-level specification. In [1], we described how to prove that one spec... |

77 |
A Really Abstract Concurrent Model and its Temporal Logic
- Barringer, Kuiper, et al.
- 1986
(Show Context)
Citation Context ...stem or the environment. Thus, if we are dealing with a single specification, we could assume just two agents, a system agent and an environment agent, as was done by Barringer, Kuiper, and Pnueli in =-=[5] and by us-=- in [2]. However, for composing specifications, one needs more general sets of agents, as introduced in [13] (where agents were called "actions"). It may help the reader to think of the agen... |

72 | Realizable and unrealizable specifications of reactive systems - Abadi, Lamport, et al. - 1989 |

62 |
Protocol verification via projections
- Lam, Shankar
- 1984
(Show Context)
Citation Context ...any particular specification language or logic. Thus, our results can be applied to a number of approaches besides the transitionaxiom method---for example, to Lam and Shankar's method of projections =-=[12]-=-, and to the I/O automata of Lynch and Tuttle [19]. Composition makes sense only for systems that interact with their environments. Such a system will behave properly only if its environment does. A P... |

61 |
transition from global to modular temporal reasoning about programs
- Pnueli
- 1984
(Show Context)
Citation Context ...lve only safety properties are not very satisfying, since any safety property is satisfied by a system that does nothing. Liveness properties must be added to rule out trivial implementations. Pnueli =-=[25]-=-, considering a di#erent class of programs, gave a more general proof rule than that of Misra and Chandy. Pnueli's rule handles liveness properties, but unlike our Composition Principle, it requires a... |

53 | A proof technique for rely/guarantee properties
- Stark
- 1985
(Show Context)
Citation Context ... programs, gave a more general proof rule than that of Misra and Chandy. Pnueli's rule handles liveness properties, but unlike our Composition Principle, it requires an explicit induction step. Stark =-=[27]-=- proposed another general proof rule. Stark's method handles liveness properties at the cost of requiring the discovery of a set of auxiliary assertions that explicitly break the circularity of the Co... |

51 |
A hierarchy of temporal properties
- Manna, Pnueli
- 1987
(Show Context)
Citation Context ...proposed for programs are machine-closed. A program's progress property is usually called a fairness condition. There have been few attempts to give a general definition of fairness. Manna and Pnueli =-=[20] define a class-=- of "fairness" properties that is independent of any next-state relation, but they provide no justification for their terminology. Apt, Francez, and Katz [4] discuss three "fairness cri... |

43 |
Appraising fairness in languages for distributed programming
- APT, FRANCEZ, et al.
- 1987
(Show Context)
Citation Context ...fairness. Manna and Pnueli [20] define a class of "fairness" properties that is independent of any next-state relation, but they provide no justification for their terminology. Apt, Francez,=-= and Katz [4] discuss three "-=-;fairness criteria"; one of them is machine-closure, which they call "feasibility". Most of the progress properties that have been proposed can be stated as fairness conditions on progr... |

38 | The existence of re nement mappings - Abadi, Lamport - 1991 |

35 | Verification of a multiplier: 64 bits and beyond - Kurshan, Lamport - 1993 |

34 | A logical view of composition - Abadi, Plotkin - 1992 |

33 | A Calculus of Communicating Systems. Volume 92 - Milner - 1980 |

31 |
Solved problems, unsolved problems and non-problems in concurrency
- Lamport
- 1985
(Show Context)
Citation Context ...nce x can be modified by other parts of the program, it is both an input and an output component for this system. In general, we want to allow module boundaries to be orthogonal to process boundaries =-=[15], so modul-=-es need not communicate only by means of simple input and output variables. Instead of partitioning state components, we assume that each state change is performed by some "agent" and partit... |

26 |
Infinite games of perfect information
- Davis
- 1964
(Show Context)
Citation Context ...ps performed by environment agents (possibly zero steps); a system move consists of doing nothing or adding one step performed by a system agent. (A similar class of games was studied by Morton Davis =-=[7]-=-.) The system wins the game i# the resulting behavior prefix satisfies the specification or is finite. (Our informal discussion is simplified by considering the system to win games with finite outcome... |

25 | De ning liveness - Alpern, Schneider - 1985 |

22 | The “Hoare logic” of CSP, and all that
- Lamport, Schneider
- 1984
(Show Context)
Citation Context ...asserting that P is true in the first state of a step, and I is the identity relation. Finding an invariant P and proving its invariance is exactly what one does in a proof by the Owicki-Gries method =-=[18; 23]-=-, so the method for proving this condition generalizes the standard method for proving invariance properties of concurrent programs. (4) f maps behaviors that satisfy I ′ ∩TA¬µ(N ′ E ) ∩TAµ(N ′ M ) ∩ ... |

17 | Nissim Francez, and Shmuel Katz. Appraising fairness in languages for distributed programming - Apt - 1988 |

16 | Application of the composition principle to Unity-like speci cations - Collette - 1993 |

15 | A logical view of composition and refinement - Abadi, Plotkin - 1993 |

14 |
The temporal logic of actions. Research Report 79
- Lamport
- 1991
(Show Context)
Citation Context ...operties with CSP programs, but the traditional failure-set semantics of CSP [11] would have to be revisited. We are now investigating a transition-axiom method based on the temporal logic of actions =-=[17]-=-. Appendix: Proofs This appendix contains the proofs of all propositions and theorems stated above. Also included are lemmas, which are used in the proofs but which are not mentioned in the main text.... |

14 | Introduction to VLSI Systems, chapter 7 - Mead, Conway - 1980 |

13 | Foundations of a theory of specification for distributed systems
- STARK
- 1984
(Show Context)
Citation Context ...P . (A -receptive property includes only behaviors that can be produced by correct implementations.) Stark studied a generalization of receptiveness, which he called local D-consistency in his thesis =-=[26]-=-. The special case corresponding to our definition of receptiveness was not considered in the thesis, but did appear in his unpublished thesis proposal. Dill independently developed the notion of rece... |

10 |
The "Hoare logic" of CSP, and all that
- Lamport, Schneider
- 1984
(Show Context)
Citation Context ...asserting that P is true in the first state of a step, and I is the identity relation. Finding an invariant P and proving its invariance is exactly what one does in a proof by the Owicki-Gries method =-=[18; 23]-=-, so the method for proving this condition generalizes the standard method for proving invariance properties of concurrent programs. (4) f maps behaviors that satisfy I # # TA (N # E ) # TA (N # M ) #... |

8 | Composing speci�cations - Abadi, Lamport - 1993 |

7 | Speci cation and design of (parallel) programs - Jones - 1983 |

6 |
Characterizing the Behaviour of Reactive Systems by Trace Sets. SFB-Bericht 324/2/91, Technische Universität
- Broy, Dederichs, et al.
- 1991
(Show Context)
Citation Context ...definition in [2], the "fairly -realizable" part of P would consist of only those behaviors containing infinitely many nonstutteringssteps. (This example demonstrates that a conjecture of Br=-=oy et al. [6]-=- is false.) System stuttering steps represent ones in which the system changes only its internal state, so allowing a -strategy to depend upon -stuttering steps is equivalent to allowing the strategy ... |

6 | A logical view of composition and re nement - Abadi, Plotkin - 1991 |

6 | De�ning liveness - Alpern, Schneider - 1985 |

5 | P-A logic|a compositional proof system for distributed programs - Pandya, Joseph - 1991 |

4 | Veri cation of a multiplier: 64 bits and beyond - Kurshan, Lamport - 1993 |