"... In PAGE 4: ... As such, I I0, since ((I0 pre $ Ipre) ^ (Ipost ! I0 post)) ) ((I0 pre ! Ipre) ^ (Ipost ! I0 post)): (1) Expression (1) provides a basis for deriving abstractions from a specification by weakening a postcondition Ipost to produce a postcondition I0 post. Several options are avail- able for weakening the postcondition including those listed in Table2 , which includes delete a conjunct, add a disjunct,... ..."

"... In PAGE 8: ... As such, I I0, since ((I0 pre $ Ipre) ^ (Ipost ! I0 post)) ) ((I0 pre ! Ipre) ^ (Ipost ! I0 post)): (1) Expression (1) provides a basis for deriving abstractions from a specification by weakening a postcondition Ipost to produce a postcondition I0 post. Several options are available for weakening the postcondition including those listed in Table2 , which includes delete a conjunct, add a disjunct, ^ to _ transformation, and ^ to ! transformation.... ..."

"... In PAGE 5: ... As such, I I0, since ((I0 pre $ Ipre) ^ (Ipost ! I0 post)) ) ((I0 pre ! Ipre) ^ (Ipost ! I0 post)): (1) Expression (1) provides a basis for deriving abstractions from a specification by weakening a postcondition Ipost to produce a postcondition I0 post. Several options are avail- able for weakening the postcondition including those listed in Table2 , which includes delete a conjunct, add a dis- junct, ^ to _ transformation, and ^ to ! transformation.... ..."

"... In PAGE 4: ... Weak capabilities enforce transitively read-only access. If an invocation on a capability, such as the \fetch quot; operation on a node capability, would return some other capability, and the invoked capability is weak, then returned capabilities are weakened according to the rules in Table2 before being returned. The e ect of the weak attribute is to provide transitive read-only authority, which simpli es... ..."

"... In PAGE 4: ... Weak capabilities enforce transitively read-only access. If an invocation on a capability, such as the fetch operation on a node capability, would return some other capability, and the invoked capability is weak, then returned capabilities are weakened according to the rules in Table2 before being returned. The effect of the weak attribute is to provide transitive read-only authority, which simplifies the construction of confined subsystems.... ..."

"... In PAGE 3: ...B4B4C1BC D4D6CT B0 C1D4D6CTB5 CM B4C1D4D3D7D8 AX C1BC D4D3D7D8B5B5 B5 B4B4C1BC D4D6CT AX C1D4D6CTB5 CM B4C1D4D3D7D8 AX C1BC D4D3D7D8B5B5BM (1) Expression (1) provides a basis for deriving abstractions from a specification by weakening a postcondition C1D4D3D7D8 to produce a postcondition C1BC D4D3D7D8. Several options are avail- able for weakening the postcondition including those listed in Table2 , which includes delete a conjunct, add a disjunct, transform CM to CN, and transform CM to AX. In our previous in- vestigations, we described several strategies for weakening postconditions based on module and specification charac-... ..."

"... In PAGE 9: ... Table4 presents a non-deterministic algorithm which decides whether a con- junction of semi-term weakening problem has a solution. A solution is minimal if for any other solution of x = t, size(t ) size(t ).... ..."