\documentstyle[makeidx]{acmtrans}
%\documentstyle[pf-acm,makeidx]{acmtrans}

\makeatletter
%% file pf-acm.sty
% pf-acm.sty  (same as pf.sty except assumes \proof and \qed already defined)
%
% last modified on Thu Jan 18 16:28:51 PST 1996 by lamport


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                       THE pf STYLE                          %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%  CONTENTS
%    1. Introduction
%    2. The Basic Commands
%    3. Different Styles of Numbering 
%    4. Indentation
%    5. Assumptions
%    6. Portions of a Proof
%    7. Conjunctions and Disjunctions
%    8. Miscellany
%    9. List of all Commands and Environments
%
%  1. INTRODUCTION
%
%    The pf style provides commands and environments for typesetting
%    hierarchically structured proofs.  Below is an example of what 
%    such a proof looks like, and the commands that generate it.
%    The commands are explained individually below.  Then
%
%    THE OUTPUT                         THE INPUT
%    ~~~~~~~~~~                         ~~~~~~~~~
%    Any text...                        Any text
%                                       \begin{proof}
%    1. Text of step 1.                   \step{label-1}{Text of step 1.}
%                                         \begin{proof}
%       1.1. Text of step.                  \step{label-1.1}{Text of step}
%                                            \begin{proof}
%            Proof: Paragraph                  \pf\ Paragraph proof.~\qed
%            proof. []                       \end{proof}
%                                      
%       1.2. Text of step.                   \step{label-1.2}{Text of step.}
%                                            \begin{proof}
%            Proof: Paragraph                  \pf\ Paragraph proof.~\qed
%            proof. []                       \end{proof}
%
%       1.3. QED                             \qedstep
%                                            \begin{proof}
%            1.3.1. Text of step               \step{label-1.3.1}{Text...}
%                   Proof: ... []              \begin{proof} ... \end{proof}
%                                            
%            1.3.2. QED                        \qedstep
%                   Proof: ...                 \begin{proof}...\end{proof}
%                                            \end{proof}
%                                         \end{proof}
%
%    2. Text of step 2.                   \step{label-2}{Text of step 2.}
%        Proof: ...                        \begin{proof} \pf\ ... \end{proof}
%
%    3. QED                               \qedstep
%       Proof: ...                        \begin{proof} \pf\ ... \end{proof}
%     
%
%   The best way to read such proofs is hierarchically.  To find out
%   how, search below for the \pfhidelevel command and the \hideqedproof
%   command.
%
%
% 2. THE BASIC COMMANDS
%
% The proof Environment:
%   Increments the proof depth, and indents the enclosed text the
%   appropriate amount.  For example, if the proof environment follows a
%   \step command that produces step number 2.6.7, then the first \step
%   command inside the environment will produce step number 2.6.7.1.
%
% \step{LABEL}{TEXT}
%    This command produces a proof step such as
%        2.6.7.1. TEXT
%    The step number 2.6.7.1 is determined by the position of the \step
%    command in the proof.  The LABEL is a symbol label used to refer to the
%    step number.  A subsequent \stepref{LABEL} command will generate the
%    step number 2.6.7.1.  The same LABEL may be re-used, but
%    not in a context where it is legal to refer to a previous step with the
%    same label.  (See the discussion of step numbering below.)
%    
%    This command is equivalent to
%           \begin{step+}{LABEL}
%              TEXT
%           \end{step+}
%    The step+ environment form is more convenient if TEXT is long or
%    complicated.
%
% \qedstep
%    This command produces something like
%    
%       2.6.7.5. QED
%    
%    If the proof of step 2.6.7 is a sequence of steps (rather than a
%    paragraph proof), then the last step in its proof is normally of this
%    form.  The "QED" in the statement simply denotes the current
%    goal---what must be proved to prove step 2.6.7.  The proof of this QED
%    step will be followed immediately by the
%    \end{proof} command that ends the proof of step 2.6.7.
%    
%    The pf style does not enforce this method of structuring proofs;
%    the proof of statement 2.6.7 could end with an ordinary \step
%    command.
%
% \pf, \qed
%    These are simple text-producing commands that normally begin and end a
%    paragraph-style proof.  However, they are not required.  Remember to
%    put a "\ " after the \pf command, and to tie the \qed command to the
%    last word of the proof with a "~".
%
% \pfsketch
%    
%    An intuitive prook sketch often introduces a multi-step proof, as in
%    
%         1.3. All odd numbers are prime.
%              Proof sketch:  The proof is by induction, with the
%              base case proved in step 1 and the induction step in
%              step 2.
%              1.3.1. The number 1 is a prime.
%                     Proof: ...
%              1.3.2. If n is an odd prime, then n+2 is prime.
%                     Proof: ...
%              1.3.3. QED
%                     Proof: 1.3.1, 1.3.2, and mathematical induction.
%    
%    This is entered as 
%    
%      \step{label-1.3}{All odd numbers  are prime}
%      \begin{proof}
%      \pfsketch\ The proof is by induction...
%       \step{label-1.3.2}{The number 1 is a prime}
%       ...
%      \end{proof}
%    
%    The \pfsketch command is, like \pf, just produces the text.  It isn't
%    required by the pf style.
%    
%
%  3. DIFFERENT STYLES OF NUMBERING 
%
%    In the long style of proof numbering, a step number is something like
%    2.6.7.5, meaning that it is the fifth step in the proof of statement
%    2.6.7, which is the seventh step in the proof of statement 2.6, which
%    is...  Statement 2.6.7.5 has the short name <4>5, meaning it is the
%    fifth statement in the current level-4 proof.  Numbering style is
%    controlled by the commands
%    
%      \pfshortnumbers{N} : Use short step numbers for all levels
%                           >= N (Default is N = 1, using only short
%                           numbers.
%    
%    These are local declarations that obey the usual scoping rules.  Thus,
%    putting a \pfshortnumbers declarations right after a \begin{proof}
%    command causes all steps in that proof to have short numbers.
%
%    Steps 2.6.7.5, 2.6.6.5, and 4.9.1.5 all have the same short numbers
%    <4>5.  However, no ambiguity arises from the use of short numbers
%    because at most one of these steps can be mentioned at any point in a
%    proof.  Let the ANCESTORS of step 2.6.7.5 be steps 2.6.7, 2.6, and 2.
%    Let the ELDER SIBLINGS of step 2.6.7.5 be steps 2.6.7.1, 2.6.7.2,
%    2.6.7.3, and 2.6.7.4.  The proof statement 2.6.7.5 may refer only
%    to steps in the following two sets:
%       (i) The elder siblings of itself and of its ancestors.
%      (ii) Itself and its ancestors.
%    The steps in (i) are the previously-proved assertions that can be used
%    in the proof of 2.6.7.5.  The assumptions of the steps in (ii) are the
%    ones that are being assumed in the proof.  (Assumptions are discussed
%    below.)
%    
%    The command \stepref{LABEL} anywhere in the proof of step 2.6.7.5 (or in
%    the step itself) produces the step number of a step lying in sets (i)
%    or (ii) having LABEL as its label (the first argument of its \step
%    command).  An error message is generated if the \step command has a
%    label that is the label of a step in set (i) or (ii).
%    
%    Note that the last step of a proof is never an elder sibling, so it
%    can't be in the set (i) for any statement.  A QED-step has no
%    assumptions, so it can't be in the set (ii) for any statement.  That is
%    why the \qedstep command does not specify a label.  Actually, \qedstep
%    is defined to equal \label{qedstepN}{...}, where N is the current
%.   level number. Thus, an error will be generated if two \qedstep commands 
%    occur in the same proof, since they will have the same labels.

%
%    Short step numbers are really nice.  They take up less space and are
%    easier to read.  They are the preferred form for long proofs.  However,
%    long step numbers are better for referring to a proof step from outside
%    the proof.  The pf style allows you to print the long numbers of steps as
%    marginal notes, something like
%    
%       Theorem:  ...
%       ...
%     2.4.5.6.         <4>6. All odd numbers greater than 2 are prime.
%     2.4.5.6.1.             <5>1. The number 3 is prime.
%       ...
%    
%    (The long numbers are printed in a smaller font, so it looks
%    better than you'd guess from this.)  The relevant commands are:
%    
%    \pfsidenumbers{N}{D} 
%       Print side numbers for proof steps of all levels \geq N, left-aligned 
%       a distance D to the left of the left margin of the text.
%    
%    \pfnosidenumbers  
%       Do not print side numbers (the default)
%
%
%  4. INDENTATION
%
%    There are two styles of indentation:
%    
%       Long Style 
%          1. XXXXX
%             1.1. XXXXX
%                  1.1.1. XXXXX
%                         1.1.1.1. XXXX
%                                  Proof: ...
%    
%       Short Style 
%          1. XXXXX
%            1.1. XXXXX
%              1.1.1. XXXXX
%                1.1.1.1. XXXX
%                  Proof: ...
%    
%    In the long style, the proof of a statement lines up with the text of
%    the statement.  In the short form, each level is indented the same
%    distance from the next higher level.  The relevant declarations
%    are
%    
%    \pflongindent 
%       Indent proofs to full width of item label
%    
%    \pfshortindent 
%       Indent proofs by the length parameter \pfindent (the default)
%
%
%  5. ASSUMPTIONS
%
%    A common form of a step is 
%        
%          <4>5. Assume: 1. n is an odd number
%                        2. n > 2
%                Prove:  n is prime 
%    
%    This asserts that the Prove clause follows from the Assume clause.  The
%    "QED" at the end of the proof of this step refers to the Prove clause.
%    The input to produce this is
%    
%        \step{label-4.5}{
%          \assume{\begin{enumerate}
%                    \item $n$ is an odd number
%                    \item $n>2$
%                  \end{enumumerate}}
%          \prove{$n$ is prime}}
%    
%    The relevant command syntax is
%    
%       \assume{TEXT}
%       \prove{TEXT}
%    
%    The formatting of the enumerate environment is changed to work
%    propertly inside a proof environment.  (It is actually redefined
%    to be the pfenum environment, described far below.)  Note that
%    \label and \ref command for subitem b of item 3 produces the label
%    "3b".  Note: there is an enumerate* environment that is like
%    enumerate, except it indents the items.
%     
%    
%    Another form of assumption is a Case assumption.  The statement
%    
%          <5>1. Case: n is of the form 4n+1
%    
%    means
%    
%          <5>1. Assume: n is of the form 4n+1
%                Prove:  QED
%    
%    where QED is the current goal.  A proof by cases is structured
%    as follows
%    
%          <4>5. Assume: 1. n is an odd number
%                        2. n > 2
%                Prove:  n is prime 
%    
%               <5>1. Assume: n equals 4m+1 for some m
%                     Prove:  QED
%                     Proof:  ... []
%    
%               <5>2. Assume: n equals 4m+3 for some m
%                     Prove:  QED
%                     Proof: ... []
%    
%               <5>3. QED
%                     Proof: By <5>1, <5>2, and assumption <4>.2 (which 
%                     states that n is odd), since any odd number has
%                     the form 4m+1 or 4m+3. []
%    
%    A case assumption is produced with a \case command, which works like
%    \assume and \prove.  It has the syntax
%    
%        \case{TEXT}
%    
%    Corresponding to the \assume, \prove, and \case commands are
%    the assume+, prove+, and case+ environments.  For example, \prove{TEXT}
%    is equivalent to \begin{prove+} TEXT \end{prove+}
%    
%    Note the reference, in the proof of <5>3, to the second conjunct of the
%    Assume clause in statement <4>5 as "assumption <4>.2".  Since a proof
%    of a step can only use assumptions in that step or its ancestors, a
%    level number suffices to identify an assumption.  The Assume clause of
%    statement <4>5 is called "assumption <4>".  The ".2" refers to the
%    second item in that clause.  As mentioned below, this use of ".2" to
%    refer to the second component of a conjunction can be used 
%    in other circumstances as well.
%    
%    When long numbering is used, assumptions must be referred to by the
%    name of the statement containing the assumption.  Thus, "assumption
%    2.6.7.5.2" could potentially mean either the Assume clause of statement
%    2.6.7.5.2, or the second item in the Assume clause of 2.6.7.5.  One way
%    to remove the ambiguity is to use something other than "." in long step
%    numbers.  The possibilities 2:6:7:5 and 2-6-7-5 don't look too good;
%    the best alternative to "." seems to be a raised period ($\cdot$).  The
%    "." is changed by redefining \pfdot, as described below.  Assumptions
%    are referred to with the following commands:
%    
%       \levelref{LABEL}
%         If \stepref{LABEL} produces <4>5, then \levelref{label} 
%         produces <4>.
%         If \stepref{LABEL} produces 2.6.7.5, then \levelref{label} also 
%         produces 2.6.7.5.
%
%       \toplevel
%         If \stepref{LABEL} produces <4>5, then \toplevel
%         produces "<0>".
%         If \stepref{LABEL} produces 2.6.7.5, then \toplevel
%         produces "0".
%
%
%  6. PORTIONS OF A PROOF
%
%    You may want to format only part of a proof--for example, you might
%    want to write the proof of statement 2.1.3 as a separate proof.  You'd
%    want something like
%    
%    2.1.3. All odd numbers are prime.
%           2.1.3.1. ...
%    
%    To do this, first imagine the shortest proof you can that has a
%    statement numbered 2.1.3: 
%    
%        1. X
%        2. X
%           2.1. X
%                2.1.1. X
%                2.1.2. X
%                2.1.3. All odd numbers are prime.
%                       2.1.3.1. ...
%    
%    Write this using the \step command and prove environment.  Now, change
%    every \step{LABEL}{X} command to \nostep{LABEL}, and change the proof
%    environments surrounding the proofs of steps 2 and 2.1 by noproof
%    environments.  This yields
%    
%        \begin{proof}
%          \nostep{label-1}
%          \nostep{label-2}
%          \begin{noproof}
%            \nostep{label-2.1}
%            \begin{noproof}
%              \nostep{label-2.1.1}
%              \nostep{label-2.1.2}
%        
%               \step{label-2.1.3} All oddnumbers are prime
%               \begin{proof}
%                  \step{label-2.1.3.1} ...
%               \end{proof}
%              \end{noproof}
%            \end{noproof}
%        \end{proof}
%    
%    which produces the desired result.  Note that the labels of the \nostep
%    commands can be used to refer to the corresponding step numbers.
%
%  7. CONJUNCTIONS AND DISJUNCTIONS
%
%    It is very convenient to write conjunctions as lists bulleted by \land.
%    This is done with the conj environment, where
%    
%     $X =  \begin{conj}    PRODUCES    X =  /\ A
%             A \\ B \\ C                    /\ B
%           \end{conj}$                      /\ C
%
%    The conj* environment is similar, except it numbers the conjuncts.
%    
%     $X = \begin{conj*}    PRODUCES    X = 1./\ A
%            A \\ B \\ C                    2./\ B
%          \end{conj*}$                     3./\ C
%
%    If X is defined in this way, then X.2 denotes the formula B.
%
%    The disj and disj* environments are similar. Disjuncts
%    are numbered a, b, c 
%
%    These environments are implemented with the array environment.
%    They should nest properly.  They can be used only in math mode.
%
%
%  8. MISCELLANY
%
%    \pfhidelevel{N} : A counter that controls what levels of proof
%        are shown.  The command \setcounter{pfhidelevel}{2} causes
%        only level-1 and level-2 steps to be printed, and the proofs
%        of level-2 steps (including all level-3 and higher steps)
%        to be omitted.  The default value of the counter is very large.
%        The value of the counter should always be positive.
%
%   \unhideqedproof 
%   \hideqedproof   : Used in conjunction with the pfhidelevel counter.
%        The \unhideqedproof command causes one extra level of proof 
%        to be displayed for the lowest level \qedstep.  The \hideqedproof
%        returns to the default of not showing this extra level.
%       
%    \pflet  : like \prove and \assume, but with keyword "Let"
%
%    \kwfont : Selects the font for the keywords "Proof", "Assume",
%              "Prove", and "Case".  Default is \sc; you can 
%              change it by something like \renewcommand{\kwfont}{\em}
%
%    \pfdot : Defines the "." in long step numbers.  Try
%             \renewcommand{\pfdot}{\mbox{$\cdot$}} for variety.
%
%    \pfindent : The amount by which proof levels are indented in
%                the short indent option.  Changed with \setlength.
%                This is a local declaration.
%
%    \pfstepnumber{LEVEL}{NUMBER}{LONGNUMBER} :
%        Generates either <LEVEL>NUMBER or LONGNUMBER, depending
%        on the numbering style in effect.
%
%    \pflevelnumber{LEVEL}{LONGNUMBER} :
%        Generates either <LEVEL> or LONGNUMBER, depending
%        on the numbering style in effect.
%
%    The following parameters control vertical spacing.  
%    
%      \pftopsep  : space above first proof environment
%      \pfbotsep  : space below first proof environment
%      \pfsep     : space above and below inner proof environment
%      \stepsep   : space above and below proof step
%    
%    The last two are set to zero, and probably should remain there.  It
%    might be desirable to have vertical spacing depend more finely on the
%    level number.  This can be done using the \makefcn command (see far
%    below), and will be if there seems to be a need.  However,
%    zero extra vertical spacing seems to be fine.
%
%    \pf, \qed, \pfsketch  :  Described above.  Can be changed with 
%                             \renewcommand
%
%
%  9. LIST OF ALL COMMANDS AND ENVIRONMENTS
%
%    Text-Producting Commands            Environments
%      \pf, \pfsketch                      proof
%      \qed                                noproof
%      \step                               step+   [version of \step]        
%      \nostep                             assume+ [version of \assume]
%      \qedstep                            prove+  [version of \prove]        
%      \assume                             case+   [version of \case]        
%      \prove                              conj, conj*
%      \pflet                              disj, disj*
%      \case                               pfenum, enumerate*
%      \pfdot ["." in long names]          
%      \stepref, \levelref, \toplevel
%      \pfstepnumber, \pflevelnumber
%      
%    Declarations
%      \kwfont [keyword font]
%      \pfshortnumbers
%      \pfsidenumbers, \pfnosidenumbers
%      \pflongindent, \pfshortindent
%      \pfindent
%      \pftopsep, \pfbotsep  
%      \pfsep, \stepsep   


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                       SPACING                               %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% COMMANDS
%   \pflongindent == Indent proofs to full width of item label
%   \pfshortindent == Indent proofs by \pfindent [the default]

\newif\if@pfLongIndent %  true if indent proof to width of label.
\@pfLongIndentfalse
\newcommand{\pflongindent}{\@pfLongIndenttrue}
\newcommand{\pfshortindent}{\@pfLongIndentfalse}

% PARAMETERS
%  \pfindent   == indentation at beginning of a proof
%  \pftopsep   == space above first proof environment
%  \pfbotsep   == space below first proof environment
%  \pfsep      == space above and below inner proof environment
%  \stepsep    == space above and below proof step
%  pfhidelevel == counter, specifying level at which proofs are hidden

\newlength{\pfindent}      
\newlength{\pftopsep}  
\newlength{\pfbotsep}  
\newlength{\pfsep}  
\newlength{\stepsep}        
\newbox{\pfbox}
\newcounter{pfhidelevel}
\setcounter{pfhidelevel}{9999}
\newcommand{\pfhidelevel}[1]{\setcounter{pfhidelevel}{#1}}

\setlength{\pfindent}{1em} 
\setlength{\pftopsep}{1ex}     % space above first proof environment
\setlength{\pfbotsep}{1ex}     % space below first proof environment
\setlength{\pfsep}{0pt}        % space above and below inner proof environment
\setlength{\stepsep}{0pt}      % space above and below proof step

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                   STEP NUMBERING                            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% COMMANDS
%   \pfshortnumbers{N} == Use short step numbers for all levels >= N
%
%   \pfsidenumbers{N}{D} == print side numbers for proof steps of all
%                           levels >= N, left-aligned length D 
%                           to left of left margin
%   \pfnosidenumbers     == do not print side numbers (the default)

%\newcommand{\pflongnumbers}{\@pfLongNumberstrue}
\newcommand{\pfshortnumbers}[1]{\pfshortNumberLevel=#1\relax}

\newcount\pfshortNumberLevel \pfshortNumberLevel=0

% \@pfLongNumbersfalse}
% \newif\if@pfLongNumbers %  true if indent proof to width of label.
%\@pfLongNumbersfalse

\newcommand{\pfstepnumber}[3]{%
   \ifnum \pfLevelCount < \pfshortNumberLevel
       #3%
     \else $\langle#1\rangle#2$%
   \fi}

\newcommand{\pflevelnumber}[2]{%
   \ifnum \pfLevelCount < \pfshortNumberLevel
       #2%
     \else $\langle#1\rangle$%
   \fi}

\newif\if@pfSideNumbers %  true if putting long numbers at margin
\@pfSideNumbersfalse
\newcounter{pf@sidenumberdepth}
\newlength{\pf@sidenumberoutdent}
\newcommand{\pfsidenumbers}[2]{\@pfSideNumberstrue
     \setcounter{pf@sidenumberdepth}{#1}%
     \addtocounter{pf@sidenumberdepth}{-1}%
     \setlength{\pf@sidenumberoutdent}{#2}}
\newcommand{\pfnosidenumbers}{\@pfSideNumbersfalse}


\newcount\pfLevelCount  \pfLevelCount=0 % current level number
\newcount\pfStepCount   \pfStepCount=0  % current step number
\newcommand{\pfLongLevel}{} % The long version of current level--e.g., 2.7.5
\newcommand{\pfLongStep}{}  % The long version of current step--e.g., 2.7.5.2
\newcommand{\pfStepName}{}  % {current level name}{current step name} 

% \pfSetName ==  LongStep := current long step name
%                StepName := current step name
\newcommand{\pfSetName}{%
  \edef\pfLongStep{%
    \ifnum\pfLevelCount>\@ne
      \pfLongLevel\pfdot\the\pfStepCount
     \else\the\pfStepCount\fi}%
  \edef\pfStepName{%
   \ifnum \pfLevelCount < \pfshortNumberLevel
    {\pfLongStep}{\pfLongStep}%
    \else
     {$\langle\the\pfLevelCount\rangle$}%
     {$\langle\the\pfLevelCount\rangle\the\pfStepCount$}%
   \fi}}

% \pfSetRef{foo} ==  IF \pf@foo UNDEFINED
%                       THEN \pf@foo := StepName 
%                       ELSE WARNING
\newcommand{\pfSetRef}[1]{%
  \@ifundefined{pf@#1}%
    {\expandafter
      \edef\csname pf@#1\endcsname{\pfStepName}}%
    {\typeout{WARNING:
         proof step "#1" (<\the\pfLevelCount>\the\pfStepCount) 
        already defined}}%
    }


\newcommand{\pfPrintStepNumber}[2]{#2}
\newcommand{\pfPrintLevelNumber}[2]{#1}

% \stepref{FOO} == Print \pf@FOO as a step number
\newcommand{\stepref}[1]{\@ifundefined{pf@#1}{{\bf ??}\typeout{WARNING:
 proof step "#1" undefined}}{\expandafter\expandafter\expandafter
 \pfPrintStepNumber\csname pf@#1\endcsname}}

\newcommand{\levelref}[1]{\@ifundefined{pf@#1}{{\bf ??}\typeout{WARNING:
 proof step #1 undefined}}%
  {\expandafter\expandafter\expandafter
 \pfPrintLevelNumber\csname pf@#1\endcsname}}

\newcommand{\toplevel}{\pflevelnumber{0}{0}}

\newlength{\pf@outdent}
\newcommand{\pfSideNumber}{%
  \if@pfSideNumbers 
   \ifnum\pfLevelCount>\value{pf@sidenumberdepth}%
    \hspace*{-\pf@outdent}%
    \makebox[0pt][l]{\footnotesize\pfLongStep}%
    \hspace*{\pf@outdent}%
    \else\fi
   \else\fi}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                   THE pflist ENVIRONMENT                    %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%% The pflist environment is the same as list environment except 
%% it can be nested deeper.

\def\pflist#1#2{\ifnum \@listdepth >15\relax \@toodeep 
     \else \global\advance\@listdepth\@ne \fi
  \rightmargin \z@ \listparindent\z@ \itemindent\z@
  \csname @list\romannumeral\the\@listdepth\endcsname 
  \def\@itemlabel{#1}\let\makelabel\@mklab \@nmbrlistfalse #2\relax
  \@trivlist
  \parskip\parsep \parindent\listparindent
  \advance\linewidth -\rightmargin \advance\linewidth -\leftmargin
  \advance\@totalleftmargin \leftmargin
  \parshape \@ne \@totalleftmargin \linewidth 
  \ignorespaces}

\def\endpflist{\global\advance\@listdepth\m@ne
    \endtrivlist}

\let\@listvii=\@listv
\let\@listviii=\@listv
\let\@listix=\@listv
\let\@listx=\@listv
\let\@listxi=\@listv
\let\@listxii=\@listv
\let\@listxiii=\@listv
\let\@listxiv=\@listv
\let\@listxv=\@listv
\let\@listxvi=\@listv

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                   THE proof ENVIRONMENT                     %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%

\renewenvironment{proof}{%       BEGIN:
  \edef\pfLongLevel          % LongLevel := 
   {\ifnum\pfLevelCount>\z@  %    IF LevelCount > 0
     \ifnum\pfLevelCount>\@ne%     THEN IF LevelCount > 1
      \pfLongLevel\pfdot\else\fi  %            THEN LongLevel * "." FI
      \the\pfStepCount       %          * StepCount
     \else\fi}%              %     ELSE FI
  \advance\pfLevelCount\@ne  %   LevelCount := LevelCount + 1
  \@tempcnta=\value{pfhidelevel}%
  \ifnum\@tempcnta<\@ne
    \setcounter{pfhidelevel}{1}%
    \typeout{WARNING: pfhidelevel < 1, setting to 1}%
    \@tempcnta=\@ne\fi
  \advance\@tempcnta\@ne
  \if@qedstep
    \advance\@tempcnta\@ne
    \ifnum\pfLevelCount 
        = \@tempcnta 
     \sbox{\pfbox}\bgroup\begin{minipage}{\textwidth}\fi
  \else     
   \ifnum\pfLevelCount 
        = \@tempcnta 
     \sbox{\pfbox}\bgroup\begin{minipage}{\textwidth}\fi\fi
  \pfStepCount=\z@           %   StepCount  := 0
  \ifnum\pfLevelCount>\@ne   %   IF LevelCount > 1
   \begin{pflist}{}{%          %     THEN Begin List with
    \topsep=\pfsep\relax     %           \topsep     := \pfsep
    \itemsep=\z@             %           \itemsep    := 0
    \parsep=\z@              %           \parsep     := 0
    \partopsep=\z@           %           \partopsep  := 0
    \if@pfLongIndent         %          IF LongIndent
     \settowidth{\leftmargin}%%           THEN
      {\expandafter          %              \leftmargin := width of step name
       \pfPrintStepNumber    %                             + \labelsep
       \pfStepName.}%
     \advance\leftmargin
     \labelsep 
    \else                    %           ELSE
    \leftmargin=\pfindent    %            \leftmargin := \pfindent
    \fi\relax        
   }   \item[]
   \else \par                %     ELSE \par
    \addvspace{\pftopsep}%   %          addvspace of \pftopsep
    \parindent=\z@           %          \parindent := 0
    \parskip = \z@           %          \parskip := 0
    \@ifundefined{mathindent}{%
      \abovedisplayskip=\z@ plus .2ex       % set display skips
      \abovedisplayshortskip=\z@ plus .2ex
      \belowdisplayskip=\z@ plus .2ex
      \belowdisplayshortskip=\z@ plus .2ex}{%
      \mathindent=1em}%
    \let\enumerate\pfenum       %   enumerate environment <- pfenum
    \let\endenumerate\endpfenum %
 \fi
\@qedstepfalse
    }%                       % END:
  {\ifnum\pfLevelCount>\@ne  %   IF LevelCount > 1
    \end{pflist}%              %     THEN End List
   \else \par                %     ELSE \par
     \addvspace{\pfbotsep}%  %          addvspace of \pfbotsep
   \fi
  \@tempcnta=\value{pfhidelevel}%
  \advance\@tempcnta\@ne
  \if@qedstep
    \advance\@tempcnta\@ne
    \ifnum\pfLevelCount 
        = \@tempcnta 
     \end{minipage}\egroup\sbox{\pfbox}{}\@qedstepfalse\fi
  \else 
      \ifnum\pfLevelCount 
        =\@tempcnta 
        \end{minipage} 
        \egroup\sbox{\pfbox}{}\fi
 \fi}


\newenvironment{noproof}{%   % BEGIN:
  \edef\pfLongLevel          % LongLevel := 
   {\ifnum\pfLevelCount>\z@  %    IF LevelCount > 0
     \ifnum\pfLevelCount>\@ne%     THEN IF LevelCount > 1
      \pfLongLevel.\else\fi  %            THEN LongLevel * "." FI
      \the\pfStepCount       %          * StepCount
     \else\fi}%              %     ELSE FI
  \advance\pfLevelCount\@ne  %   LevelCount := LevelCount + 1
  \pfStepCount=\z@           %   StepCount  := 0
  \par                       %   \par
  \parindent=\z@             %          \parindent := 0
  \parskip = \z@             %          \parskip := 0
  \@ifundefined{mathindent}{%
      \abovedisplayskip=\z@ plus .2ex       % set display skips
      \abovedisplayshortskip=\z@ plus .2ex
      \belowdisplayskip=\z@ plus .2ex
      \belowdisplayshortskip=\z@ plus .2ex}{%
      \mathindent=1em}%
  \let\enumerate\pfenum       %   enumerate environment <- pfenum
  \let\endenumerate\endpfenum %
  }%                         % END:
  {\par}                     %  \par

%% step 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                     \step, \assume, ETC.                    %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
\newcommand{\step}[2]{\begin{step+}{#1}#2\end{step+}}
\newif\if@qedstep %  true right after a \qedstep if in the scope of an 
                  %  \unhideqedproof declaration
\@qedstepfalse

\newif\if@unhideqedstep % set true by \unhideqproof, false by \hideqproof. 

\@unhideqedstepfalse
\newcommand{\unhideqedproof}{\@unhideqedsteptrue}
\newcommand{\hideqedproof}{\@unhideqedstepfalse}

\newcommand{\qedstep}{\step{qedstep\the\pfLevelCount}{Q.E.D.}
\if@unhideqedstep\@qedsteptrue\fi}

\newcommand{\nostep}[1]{% 
  \advance\pfStepCount\@ne       % StepCount := StepCount + 1
  \pfSetName                     % SetName
  \pfSetRef{#1}%                 % SetRef
  }

\newenvironment{step+}[1]%
 {\endgroup                      % Move Outside environment scope
  \advance\pfStepCount\@ne       % StepCount := StepCount + 1
  \pfSetName                     % SetName
  \pfSetRef{#1}%                 % SetRef
 \begingroup\@endpefalse         % Move inside environment scope
   \def\@currenvir{step+}%       %   by simulating \begin{step+}
 \begin{pflist}{}{%                % Begin list environment with
   \setlength
     {\pf@outdent}{\textwidth}%  %   \pf@outdent = outdent
   \addtolength                  %                 for side numbers
    {\pf@outdent}{-\linewidth}%  
   \addtolength
    {\pf@outdent}%
    {\pf@sidenumberoutdent}%
   \topsep=\stepsep\relax        %   \topsep     := \stepsep
   \itemsep=\z@                  %   \itemsep    := 0
   \parsep=\z@                   %   \parsep     := 0
   \partopsep=\z@                %   \partopsep  := 0
   \settowidth{\labelwidth}%     %   \labelwidth := width of step name.
     {\expandafter
      \pfPrintStepNumber
      \pfStepName.}%
   \leftmargin=\labelwidth\relax %   \leftmargin := \labelwidth
   \advance\leftmargin\labelsep %                   + \labelsep
   \relax}%
 \item[\pfSideNumber%               % \item[ \pfSideNumber
  \expandafter                       %        StepNumber]
  \pfPrintStepNumber\pfStepName.]}%
 {\end{pflist}}

%%%%% \assume, \prove, and \case commands

\newenvironment{assume+}{%
 \begin{pflist}{}{%                % Begin list environment with
   \topsep=\z@                   %   \topsep     := 0
   \itemsep=\z@                  %   \itemsep    := 0
   \parsep=\z@                   %   \parsep     := 0
   \partopsep=\z@                %   \partopsep  := 0
   \settowidth{\labelwidth}%     %   \labelwidth := width "Assume:"
     {{\kwfont Assume\/}:}%
   \leftmargin=\labelwidth\relax %   \leftmargin := \labelwidth
   \advance\leftmargin\labelsep  %                   + \labelsep
   \relax}%
 \item[{\kwfont Assume\/}:]}%    % \item[Assume:]]
 {\end{pflist}}

\newcommand{\assume}[1]{\begin{assume+}#1\end{assume+}}

\newcommand{\prove}[1]{\begin{prove+}#1\end{prove+}}
\newenvironment{prove+}{%
 \begin{pflist}{}{%                % Begin list environment with
   \topsep=\z@                   %   \topsep     := 0
   \itemsep=\z@                  %   \itemsep    := 0
   \parsep=\z@                   %   \parsep     := 0
   \partopsep=\z@                %   \partopsep  := 0
   \settowidth{\labelwidth}%     %   \labelwidth := width "Assume:"
     {{\kwfont Assume\/}:}%
   \leftmargin=\labelwidth\relax %   \leftmargin := \labelwidth
   \advance\leftmargin\labelsep  %                   + \labelsep
   \relax}%
 \item[{\kwfont 
          Prove\/}:\hfill]}%     % \item[Prove:]]
 {\end{pflist}}

\newcommand{\pflet}[1]{\begin{pflet+}#1\end{pflet+}}
\newenvironment{pflet+}{%
 \begin{pflist}{}{%                % Begin list environment with
   \topsep=\z@                   %   \topsep     := 0
   \itemsep=\z@                  %   \itemsep    := 0
   \parsep=\z@                   %   \parsep     := 0
   \partopsep=\z@                %   \partopsep  := 0
   \settowidth{\labelwidth}%     %   \labelwidth := width "Assume:"
     {{\kwfont Let\/}:}%
   \leftmargin=\labelwidth\relax %   \leftmargin := \labelwidth
   \advance\leftmargin\labelsep  %                   + \labelsep
   \relax}%
 \item[{\kwfont 
          Let\/}:\hfill]}%     % \item[Let:]]
 {\end{pflist}}

%\newcommand{\prove}[1]{%
% \begin{pflist}{}{%                % Begin list environment with
%   \topsep=\z@                   %   \topsep     := 0
%   \itemsep=\z@                  %   \itemsep    := 0
%   \parsep=\z@                   %   \parsep     := 0
%   \partopsep=\z@                %   \partopsep  := 0
%   \settowidth{\labelwidth}%     %   \labelwidth := width "Assume:"
%     {{\kwfont Assume\/}:}%
%   \leftmargin=\labelwidth\relax %   \leftmargin := \labelwidth
%   \advance\leftmargin\labelsep  %                   + \labelsep
%   \relax}%
% \item[{\kwfont Prove\/}:\hfill]     % \item[Prove:]]
% #1
% \end{pflist}}

\newcommand{\case}[1]{%
 \begin{pflist}{}{%                % Begin list environment with
   \topsep=\z@                   %   \topsep     := 0
   \itemsep=\z@                  %   \itemsep    := 0
   \parsep=\z@                   %   \parsep     := 0
   \partopsep=\z@                %   \partopsep  := 0
   \settowidth{\labelwidth}%     %   \labelwidth := width "Case:"
     {{\kwfont Case\/}:}%
   \leftmargin=\labelwidth\relax %   \leftmargin := \labelwidth
   \advance\leftmargin\labelsep  %                   + \labelsep
   \relax}%
 \item[{\kwfont
           Case\/}:]             % \item[Case:]]
 #1
 \end{pflist}}



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                       MISCELLANY                            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
\newcommand{\pf}{{\kwfont Proof\/}:}
\newcommand{\pfsketch}{{\kwfont Proof sketch\/}:}
%\newcommand{\qed}{\rule{.4em}{1.75ex}}
\renewcommand{\qed}{{\fboxsep=\z@\fbox{\rule{.5em}{0pt}\rule{0pt}{2ex}}}}
\let\kwfont=\sc
\def\pfdot{.}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                        STACKS                               %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% \@push{\stack}{element}  == \stack := <<element>> :o: \stack
% \@pop{\stack}{\cmd}  == \cmd := head(\stack)
%                            \stack := tail(\stack)
% \newstack{\stack}  == \stack := emptystack
%
% \@head{\stack}{\var}  ==  \var := head(\stack)
%   Note: to push a counter value, use \the\value{ctr}
%         to push a length \foo, use \the\foo

%
\def\@push#1#2{{\let\@nil\relax\let\@elt\relax\xdef#1{#2\@elt#1}}}
\def\@pop#1#2{{\let\@nil\relax\let\@elt\relax
              \xdef#2{\expandafter\@innerhead#1}
              \xdef#1{\expandafter\@innerpop#1}}}
\def\@innerpop#1\@elt#2\@nil{#2\@nil}
\def\@head#1#2{{\let\@elt\relax\xdef#2{\expandafter\@innerhead#1}}}
\def\@innerhead#1\@elt#2\@nil{#1}
\def\newstack#1{\gdef#1{\@nil}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%           LISTS OF CONJUNCTIONS AND DISJUNCTIONS            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%    \begin{conj}       ->   /\ A
%      A \\ B \\ C           /\ B
%    \end{conj}              /\ C
%
%    \begin{conj*}      ->   1./\ A
%      A \\ B \\ C           2./\ B
%    \end{conj*}             3./\ C
%
%    The disj and disj* environments are similar. Disjuncts
%    are numbered a, b, c 
%
%    These environments are arrays; they must be used in math mode.

\newcounter{pf@conjCounter}   % counter for conj* and disj*
\newstack\pf@conj             % stack of counters

\newenvironment{conj}{%
 \begin{array}[t]{@{\land\;}l@{}}%
 }{%
 \end{array}}

\newenvironment{disj}{%
 \begin{array}[t]{@{\lor\;}l@{}}%
 }{%
 \end{array}}

\newenvironment{conj*}{%
 \@push\pf@conj{\the\value{pf@conjCounter}}%
 \setcounter{pf@conjCounter}{0}%
 \begin{array}[t]{@{\addtocounter{pf@conjCounter}{1}%
   \mbox{\protect\small\protect\arabic{pf@conjCounter}.}
   \land\;}l@{}}%
 }{%
 \end{array}%
 \@pop\pf@conj\pf@temp
  \setcounter{pf@conjCounter}{\pf@temp}}

\newenvironment{disj*}{%
 \@push\pf@conj{\the\value{pf@conjCounter}}%
 \setcounter{pf@conjCounter}{0}%
 \begin{array}[t]{@{\addtocounter{pf@conjCounter}{1}%
   \mbox{\protect\small\protect\alph{pf@conjCounter}.}
   \lor\;}l@{}}%
 }{%
 \end{array}%
 \@pop\pf@conj\pf@temp
  \setcounter{pf@conjCounter}{\pf@temp}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                      ENUMERATED LISTS                       %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% pfenum environment : In proofs, the enumerate environment 
%                      is redefined to be the pfenum environment
%
% enumerate* environment : Like pfenum, except with additional
%                          indentation.
%
% \enumindent :  The indentation for enumerate*
% pfenumdepth  : Depth of current pfenum list
% pfenum       : pfenum list counter
%
% Uses counters pfenumi, ... , pfenumiii just like the
% ordinary enumerate environment uses counters enumi, ... , enumiv.
% \pf@setEnumWidth{\cmd} : Sets \cmd to the width of the label of the
%                          item number 2 for the current enumeration level.
%
% \pf@enumLabel : prints the current pfenum label, using the
%                 pfenumi... counter.

\newcounter{pfenum}
\newcounter{pfenumdepth}
\newlength{\enumindent}
\setlength{\enumindent}{1em}

\@definecounter{pfenumi}
\@definecounter{pfenumii}
\@definecounter{pfenumiii}
%\@definecounter{pfenumiv}

\def\labelpfenumi{\thepfenumi.}    
\def\thepfenumi{\arabic{pfenumi}}     
 
\def\labelpfenumii{(\thepfenumii)}
\def\thepfenumii{\alph{pfenumii}}
\def\p@pfenumii{\thepfenumi}

\def\labelpfenumiii{\thepfenumiii.}
\def\thepfenumiii{\roman{pfenumiii}}
\def\p@pfenumiii{\thepfenumi\thepfenumii}

%\def\labelpfenumiv{\thepfenumiv.}
%\def\thepfenumiv{\Alph{pfenumiv}}     
%\def\p@pfenumiv{\p@pfenumiii\thepfenumiii}


\newcommand{\pf@setEnumWidth}[1]{%
  \settowidth{#1}{\setcounter{\@pfenumctr}{2}%
  \csname the\@pfenumctr\endcsname.%
  \setcounter{\@pfenumctr}{0}}}



\newcommand{\pf@enumLabel}{%
  \hfill\makebox[0pt][r]{\csname the\@pfenumctr\endcsname.}}

\newenvironment{pfenum}{%        % BEGIN
  \ifnum \value{pfenumdepth}>2%  %  IF pfenumdepth > 2
    \relax\@toodeep \else        %    THEN error
  \addtocounter{pfenumdepth}{1}% %    ELSE  pfenumdepth := pfenumdepth + 1
  \edef\@pfenumctr{pfenum%           %          @pfenumctr  := pfenumN
    \romannumeral\the            %            where N = Roman(pfenumdepth)
    \value{pfenumdepth}}%        %
   \fi                           %  FI
  \begin{pflist}%                  %   Begin list environment with
  {\pf@enumLabel}{%              %    Default label = pf@enumlabel
   \labelsep=                    %   \labelsep =
    \ifcase\value{pfenumdepth}   %     CASE OF pfenumdepth
      \labelsep                  %        
     \or .67\labelsep            %       1 -> .67\labelsep
     \or .67\labelsep            %       2 -> .67\labelsep
     \else \labelsep             %      >2 -> \labelsep
     \fi                         %
   \topsep=\z@                   %    \topsep     := 0
   \itemsep=\z@                  %    \itemsep    := 0
   \parsep=\z@                   %    \parsep     := 0
   \partopsep=\z@                %    \partopsep  := 0
   \pf@setEnumWidth\labelwidth   %    set \labelwidth with setEnumWidth
   \leftmargin=\labelwidth\relax %    \leftmargin := \labelwidth
   \advance\leftmargin\labelsep  %                   + \labelsep
   \relax
   \usecounter{\@pfenumctr}%       %    counter @pfenumctr
 }%
 }{%                             % END
   \end{pflist}%                   %   End list
   \addtocounter{pfenumdepth}{-1}%   pfenumdepth := pfenumdepth - 1
 }

\newenvironment{enumerate*}{%    % BEGIN
  \ifnum \value{pfenumdepth}>2%  %  IF pfenumdepth > 2
    \relax\@toodeep \else        %    THEN error
  \addtocounter{pfenumdepth}{1}% %    ELSE  pfenumdepth := pfenumdepth + 1
  \edef\@pfenumctr{pfenum%           %          @pfenumctr  := pfenumN
    \romannumeral\the            %            where N = Roman(pfenumdepth)
    \value{pfenumdepth}}%        %
   \fi                           %  FI
  \begin{pflist}%                  %   Begin list environment with
  {\pf@enumLabel}{%              %    Default label = pf@enumlabel
   \labelsep=                    %   \labelsep =
    \ifcase\value{pfenumdepth}   %     CASE OF pfenumdepth
      \labelsep                  %        
     \or .67\labelsep            %       1 -> .67\labelsep
     \or .67\labelsep            %       2 -> .67\labelsep
     \else \labelsep             %      >2 -> \labelsep
     \fi                         %
   \topsep=\z@                   %    \topsep     := 0
   \itemsep=\z@                  %    \itemsep    := 0
   \parsep=\z@                   %    \parsep     := 0
   \partopsep=\z@                %    \partopsep  := 0
   \pf@setEnumWidth\labelwidth   %    set \labelwidth with setEnumWidth
   \leftmargin=\labelwidth\relax %    \leftmargin := \labelwidth
   \advance\leftmargin\labelsep  %                   + \labelsep
   \advance\leftmargin\enumindent%                   + \enumindent
   \relax
   \usecounter{\@pfenumctr}%       %    counter @pfenumctr
 }%
 }{%                             % END
   \end{pflist}%                   %   End list
   \addtocounter{pfenumdepth}{-1}%   pfenumdepth := pfenumdepth - 1
 }

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                        FUNCTIONS                            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% \makefcn{\FOO}{V0}{{V1}...{Vk}} :
%      Defines \FOO{n}  ==  CASE  n = 0    -> V0
%                                 n = 1    -> V1
%                                 ...
%                                 n \geq k -> Vk
%
%      Useful when Vi is a dimension applying to a depth-i environment

\def\makefcn#1#2#3{{\let\or\relax
     \gdef\fcn@temp{}%
     \gdef\fcn@tempb{#2}%
     \@tfor\foo:=#3\do{\xdef\fcn@temp{\fcn@temp\or\foo}\xdef\fcn@tempb{\foo}}%
     \let\ifcase\relax\let\else\relax\let\fi\relax
     \xdef#1##1{\ifcase ##1 #2\fcn@temp\else\fcn@tempb\fi}}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                        FUNCTIONS                            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% \pfif{A}{B}{C} :  if A then B    \pfIF{A}{B}{C} :  if A
%                        else C                        THEN B
%                                                      ELSE C

\newcommand{\pfmathdef}[1]{\relax\ifmmode #1\else $#1$\fi}
\newcommand{\pfif}[3]{{\pfmathdef{%
 \begin{array}[t]{@{}l@{\;\;}l@{\;\;}l@{}}
   {\bf if}\;\;#1&{\bf then}&#2\\
                 &{\bf else}&#3
   \end{array}}}}

\newcommand{\pfIF}[3]{{\pfmathdef{%
 \begin{array}[t]{@{}l@{\;\;}l@{}}
   {\bf if}\;\;#1\\ 
  \begin{array}[t]{@{\hspace{1em}}l@{\;\;}l@{}}
     {\bf then}&#2\\
     {\bf else}&#3
   \end{array}
  \end{array}}}}


\makeatother

% \ifseparateappendix{this text if appendix appears separately}{this
%                       text for a normal version}

\newcommand{\ifseparateappendix}[2]{#1}

%%%%%%%%%%% FIXES TO acmtrans.sty
\makeatletter

%%% remove the dumb "." after labels in a description environment.
%\def\description{\list{}{\listparindent\parindent\labelwidth\z@
% \leftmargin\z@ \itemindent\parindent\advance\itemindent\labelsep
% \def\makelabel##1{\it ##1}}}

%%% remove the dumb "." after labels in a description environment.
%%% remove item indent and put --- before label
\def\description{\list{}{\listparindent\parindent\labelwidth\z@
 \leftmargin\z@ \itemindent\z@\advance\itemindent\labelsep
 \def\makelabel##1{---\it ##1}}}

%%% Make named theorems have a number.
%\def\@opargbegintheorem#1#2#3{\it \trivlist
% \item[\hskip 10pt \hskip \labelsep{\sc #1\hskip 5pt\relax#2.%
%    \savebox\@tempboxa{#3}\ifdim 
%    \wd\@tempboxa>\z@ \hskip 5pt\relax (\box\@tempboxa)\hspace{.3em}\fi}]}

\def\@opargbegintheorem#1#2#3{\it \trivlist
 \item[\hskip 10pt \hskip \labelsep{\sc #1\hskip 5pt\relax#2%
    \savebox\@tempboxa{#3}\ifdim 
    \wd\@tempboxa>\z@ \hskip 5pt\relax (\box\@tempboxa).\hspace{.3em}\else.\fi}]}

%%%% need a \normalsize to work inside places where the style
%%%% doesn't want it to.
\let\realnormalsize\@normalsize


% THE FOLLOWING FIXES AN APPARENT BUG IN THE enumerate ENVIRONMENT.
% Here is the history: The current version of enumerate in acmtrans.sty
% differs slightly from the standard one defined in latex.tex.  This
% difference causes an enumeration to behave badly inside a trivlist--
% for example, in a theorem environment.  Presumably, the modification
% was made for some reason, but I have no idea for what reason.  The
% following redefines the enumerate environment to its original definition.
% HOWEVER, THIS MAY CAUSE OTHER PROBLEMS.
\makeatletter
  \def\enumerate{\ifnum \@enumdepth >3 \@toodeep\else
      \advance\@enumdepth \@ne 
      \edef\@enumctr{enum\romannumeral\the\@enumdepth}\list
      {\csname label\@enumctr\endcsname}{\usecounter
        {\@enumctr}\def\makelabel##1{\hss\llap{##1}}}\fi}

%%%% Fixed definition of \appendixhead to make a decent-sized title
%%%% on the first page of the appendix.
\long\def\appendixhead#1#2#3#4{
\section*{APPENDIX}
An appendix to this article is available in electronic form 
(PostScript$^{\mbox{\tiny TM}}$).  Any of the following methods may be
used to obtain it; or see the inside back cover of a current
issue for up-to-date instructions.

\begin{itemize}
\item By anonymous ftp from {\apbf acm.org}, file 
{\apbf [pubs.journals.#1.append]p#2.ps}
\item Send electronic mail to {\apbf mailserve@acm.org} containing
the line\\ {\apbf send~[anonymous.pubs.journals.#1.append]p#2.ps}
\item By {\it Gopher} from {\apbf acm.org}
\item By anonymous ftp from {\apbf ftp.cs.princeton.edu},
file {\apbf pub/#1/append/p#2.ps}
\item Hardcopy from {\it Article Express}, for a fee: phone 800-238-3458, fax
201-216-8526, or write P.O.~Box~1801, Hoboken NJ 07030; and request
{\sc acm-#1-appendix-{\small #2}}.
\end{itemize}
\clearpage
\makeatletter
\pagenumbering{withappendix}
\makeatother
\appendix
\par\noindent{\sc this document is the appendix to the following paper:}\hfill \vskip 1em
\vbox{\LARGE\sf \parindent0pt\@title{}}\vskip 13.5pt
\vbox{\sf \parindent0pt\begingroup \addtolength{\baselineskip}{2pt}
 \@author{}\par \vskip -2pt
 \endgroup}\vskip .5em\noindent
\vskip 10pt\noindent
#4
\vskip 11pt\noindent
\hrule height .2pt
\par
\vskip 23pt
\bottomstuff
Permission to copy without fee all or part of
this material is granted provided that the copies are not made or distributed
for direct commercial advantage, the ACM copyright notice and the title of
the publication and its date appear, and notice is given that copying is
by permission of the Association for Computing Machinery.
To copy otherwise, or to republish, requires a fee and/or specific permission.
\par
\copyright #3 ACM
\par
\endbottomstuff
}

\makeatother

%%% Remove \qed boxes
\renewcommand{\qed}{\unskip}

%\documentstyle[11pt,titlepage,pf,makeidx,twoside]{article}
%%* "Open Systems" by Martin Abadi and Leslie Lamport.
%%*  Companian to SRC79 dealing with decomposing closed systems,
%%*  assumption/guarantee specs, and interface refinement.
%% Cleared by Sam 21 July 93

% FOR SRC Report--
%    \oddsidemargin   .47in     %   Left margin on odd-numbered pages.
%    \evensidemargin 1.06in     %   Left margin on even-numbered pages.
%
%
%   \topmargin       .47in    %    Nominal distance from top of page to top of
%   \headheight        0pt    %    Height of box containing running head.
%   \headsep           0pt    %    Space between running head and text.
%%  \topskip = 10pt           %    '\baselineskip' for first line of page.
%% Bottom of page:
%   \footheight       12pt  %    Height of box containing running foot.
%   \footskip        1.5cm    %    Distance from baseline of box containing 
%                             %    foot to baseline of last line of text.


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                        INDEXING                              %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% Symbol indexing convention
%  \circ   == +2o
%  '       == +2p
%  []      == +2box
%  <>      == +2bzdiamond
%  \EE     == +2e
%    +     == +2n
%   _|_    == +2p
%  \vseqv  == +3esub
%  \sequalv == +3dsub
%  implies = +3implies
%  --|>    = +3iwp
%  -+-|>   = +3ixp
%  |=      = +3valid
%  |_      = +4prefix
%  < >     = +5angle
%  | |     = +5abs
%  [...]_... = +5me
%  <...>_... = +5mea
%  [[ ]]   = +5mean
%  /\      = +7and
%  \/      = +7or
%  \closureopt = C
%%% add rules to show where index entries occur
%%\makeatletter
%%\def\@index#1{\@showidx{#1}%
%%        \makebox[0pt][r]{\rule[-.3\baselineskip]{1.5pt}{\baselineskip}}%
%%             \endgroup\@esphack}
%%\def\@wrindex#1#2{\let\thepage\relax
%%   \xdef\@gtempa{\write#1{\string
%%      \indexentry{#2}{\thepage}}}\endgroup\@gtempa
%%   \@showidx{#2}\if@nobreak \ifvmode\nobreak\fi\fi
%%    \makebox[0pt][r]{\rule[-.3\baselineskip]{1.5pt}{\baselineskip}}\@esphack}
%%\makeatother
%

\makeindex


%&v&\vbl{#}&
%&r&\rvbl{#}&
%&1&^{[1]}#&
%&2&^{[2]}#&
%&3&^{[12]}#&
%&p&\begin{proof}
%  \pf\ #
%  \qed
%\end{proof}&
%&s&\step{#}&
%&f&\stepref{#}&
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                 MODIFICATION DATE                            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                                                              %
% Defines \moddate to expand to the modification date like     %
%                                                              %
%    Mon  5 Aug 1991  [10:34]                                  %
%                                                              %
% and \prdate to print it in a large box.  Assumes editor      %
% updates modification date in standard SRC style.             %
% (Should work for any user name).                             %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\def\ypmd{%                                                    %
%                                                              %
%                                                              %
       modified on Mon Jul 18 21:38:01 PDT 1994 by ma          %
  endypmd}                                                     %
%                                                              %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%\newcommand{\moddate}{\expandafter\xpmd\ypmd}                  %
%\def\xpmd Last modified                                        %
%on #1 #2 #3 #4:#5:#6 #7 #8 by #9 endypmd{#1 \ #3 #2 #8} %
%\newcommand{\prdate}{\noindent\fbox{\Large\moddate}}           %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%% Superdiagonal
\newcommand{\sd}{superdiagonal}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                   MARGINAL NOTES                       %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%\newif\iffirstmarginal \firstmarginaltrue
%\newcommand{\marginalnote}[1]{\marginpar{\raggedright\small\it #1%
%   \iffirstmarginal\typeout{****************************************}%
%                   \typeout{******** MARGINAL NOTES IN TEXT ********}%
%                   \typeout{****************************************}%
%       \global\firstmarginalfalse\fi}}

\newcommand{\oo}{\mathdef{\infty}}
\newcommand{\mathdef}[1]{\relax\ifmmode #1\else $#1$\fi}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                       LOGIC                            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% 
%  \true, \false == booleans
%  \deq          == equals by definition
%  \implies      == =>
%  \valid{F}     == |= F  (validity)
%  \provable{F}  == |- F  (provability)
%  \M{F}         == semantic meaning of F
%                                      hyp1
%                                      hyp2
%  \proofrule{hyp1\\hyp2}{concl}  ==  ------
%                                      concl
%
% \act{exp} : Formats exp in math mode, with the first
%                character in \cal style.  Thus,
%                \act{A_1} -> ${\cal A}_1$
%
% \sqact{A}{v}  == [A]_v   (formatted like \act)
%%% \anact{A}{v}  == <A>_v   (formatted like \act)
% \unchanged{f} == Unchanged f
%%% \enabled{A} == enabled predicate of A
% \WF{f}{A}  == WF_f(A)
% \SF{f}{A}  == SF_f(A)
% \WFop  == WF
% \SFop == SF
% \while{P}{Q}  == P --|> Q
% \whileop      == --|> 
%                     +
% \whilep{P}{Q} == P --|> Q
%                   +
% \whilepop     == --|> 
%                   +
% \plus{x}{P}   == P+x
% \plusop       == +
% \initial{P}   == (P)_0  (The initial condition of P)
% \closure{P}   == The closure of P.
% \closureop    == The closure operator.
% \orthogonal{P}{Q}    : P _|_ Q
% \disjoint{e, m}    : Means [][e'=e]_m
% \BIGWEDGE  : Like \bigwedge, except it always puts sub- and superscripts
%              above and below it.
%
%  \tuple{x}     == <x>
\newcommand{\Real}{{\bf R}}

%%% \BOX : Big \Box
% FOR APPENDIX
%
%  \seqv : ~ (stuttering equivalence)
%  \vseqv{x} : ~_x
%  \prefix{sigma}{n} = sigma|_n
% \vbl{foo} = foo formatted as a variable
% \init == \Vbl{init}
% \sequalv{x} :  =_x
% \validop : |= 
% \M{x} : [[x]]
% \last{x}

\newcommand{\sequalv}[1]{\mathdef{=_{#1}}}
\newcommand{\validop}{\mathdef{\models}}
\newcommand{\last}[1]{\mathdef{{\it last\/}(#1)}}
%\newcommand{\BOX}{\mbox{$\Box$}}
\newcommand{\vbl}[1]{{\it #1\/}}
\newcommand{\init}{\vbl{Init}}



\newtheorem{lemma}{Lemma}
\newtheorem{corollary}{Corollary}
%\newtheorem{factoid}{Factoid}
\newtheorem{proposition}{Proposition}
\newtheorem{theorem}{Theorem}


\newcommand{\true}{{\sf true}}
\newcommand{\false}{{\sf false}}
\newcommand{\deq}{\mathrel{\stackrel{\scriptscriptstyle\Delta}{=}}}
\newcommand{\implies}{\Rightarrow}
\newcommand{\valid}[1]{\mathdef{\models #1}}

\newcommand{\M}[1]{\mathdef{[\![#1]\!]}}
\newcommand{\act}[1]{\mathdef{\makecal#1}}
\newcommand{\makecal}[1]{{\cal #1}}
\newcommand{\sqact}[2]{\mathdef{[\act{#1}]_{#2}}}
\newcommand{\anact}[2]{\mathdef{\langle\act{#1}\rangle_{#2}}}
\newcommand{\enabled}[1]{\mathdef{{\it Enabled}~#1}}

\newcommand{\WF}[2]{\mathdef{{\rm WF}_{#1}(#2)}}
\newcommand{\SF}[2]{\mathdef{{\rm SF}_{#1}(#2)}}
\newcommand{\WFop}{{\rm WF}}
\newcommand{\SFop}{{\rm SF}}
\newcommand{\while}[2]{\relax
 \ifmmode #1\mathrel{-\hspace{-.2em}\triangleright}#2
   \else $#1\mathrel{-\hspace{-.2em}\triangleright}#2$\fi}
\newcommand{\whileop}{\relax
 \ifmmode -\hspace{-.2em}\triangleright
   \else $-\hspace{-.2em}\triangleright$\fi}
%\newcommand{\whilepop}{\mathdef{\stackrel{\scriptscriptstyle+\;}{\whileop}}}
\newcommand{\whilepop}{\mathdef{\stackrel
  {\mbox{\raisebox{-.3em}[0pt][0pt]{$\scriptscriptstyle+\;\,$}}}{\whileop}}}
\newcommand{\whilep}[2]{\mathdef{#1\whilepop#2}}
\newcommand{\plus}[2]{\mathdef{#2_{+#1}}}
\newcommand{\plusop}{\mathdef{+}}

\newcommand{\orthogonal}[2]{\mathdef{#1\perp#2}}
\newcommand{\disjoint}[1]{\mathdef{\vbl{Disjoint}(#1)}}
\newcommand{\tuple}[1]{\mathdef{\langle#1\rangle}}
\def\BIGWEDGE_#1^#2{{\displaystyle\bigwedge_{#1}^{#2}}}

\newcommand{\closure}[1]{\mathdef{{\cal C}(#1)}}
\newcommand{\closureop}{\mathdef{{\cal C}}}

\newcommand{\vseqv}[1]{\mathdef{\simeq_{#1}}}
\newcommand{\prefix}[2]{\mathdef{#1|_{#2}}}
\newcommand{\length}[1]{\relax      \ifmmode |#1|\else $|#1|$\fi }

\newcommand{\EE}{\makebox{$\raisebox{.05em}{\makebox
   [0pt][l]{$\exists\s{-.517}\exists\s{-.517}\exists$}}\exists\s{-.517}\exists
            \s{-.517}\exists$}}
%\newcommand{\EE}{\makebox{$\raisebox{.05em}{\makebox
%   [0pt][l]{$\exists\!\!\!\exists\!\!\!\exists$}}\exists\!\!\!\exists
%            \!\!\!\exists$}}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%          NOTATION FOR THE QUEUE EXAMPLE             %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%  \rvbl{name}  == the rigid variable "name"
% \rdy == ``rdy''
% \out, \inp == out, inp
%  
% \ack{wire}  ==  Rcv(wire)
% \send{val}{wire} ==  Send(val,wire)
% \winit{wire}     ==  WInit(wire)
% \val             ==  Val   (set of values)
% \nat             ==  Nat (set of values)
% \Max, \Min       ==  max and min capacity
% \dbl{F}          == F^[dbl]
%  \seqof{V}    == V^*  (The set of sequences of elements of V)
%  \seq{...}    == The sequence << ... >>
%  \head{q}, \tail{q} == head and tail operators
%  \lseq, \rseq == The sequence delimiters.
%
% \env{X}  == X_E
% \sys{X}  == X_S
% \Q       == Q (next-state relation for queue)
% \InfQM    == QM^\infty  (the component spec for the infinite queue)
% \DigQE  == QM^d     (the spec for an environment that sends Digits)
% \NI{X}  ==  X^ni

\newcommand{\env}[1]{\mathdef{#1_{E}}}
\newcommand{\sys}[1]{\mathdef{#1_{M}}}
\newcommand{\NI}[1]{\mathdef{#1^{\it ni}}}
\newcommand{\Q}{\act{Q}}
\newcommand{\InfQM}{\mathdef{\vbl{QM}^{\infty}}}
\newcommand{\DigQE}{\mathdef{\vbl{QE}^{\vbl{dig}}}}
\newcommand{\seq}[1]{\mathdef{\lseq#1\rseq}}
\newcommand{\seqof}[1]{\mathdef{V^*}}
\newcommand{\head}[1]{\mathdef{\vbl{Head}(#1)}}
\newcommand{\tail}[1]{\mathdef{\vbl{Tail}(#1)}}
\newcommand{\lseq}{\langle}
\newcommand{\rseq}{\rangle}
\newcommand{\rvbl}[1]{{\sf #1}}
\newcommand{\rdy}{\makebox{\sf ``rdy''}}
\newcommand{\inp}{\vbl{inp}}
\newcommand{\out}{\vbl{out}}
\newcommand{\ack}[1]{\mathdef{\vbl{Ack}(#1)}}
\newcommand{\ackf}{\mathdef{\vbl{Ack}}}
\newcommand{\send}[2]{\mathdef{\vbl{Send}(#1,#2)}}
\newcommand{\sendf}{\mathdef{\vbl{Send}}}
\newcommand{\winit}[1]{\mathdef{\vbl{CInit}(#1)}}
\newcommand{\winitf}{\mathdef{\vbl{CInit}}}
\newcommand{\val}{\rvbl{Val}}
\newcommand{\nat}{\rvbl{Nat}}
\newcommand{\Max}{\rvbl{max}}
\newcommand{\Min}{\rvbl{min}}
\newcommand{\dbl}[1]{\mathdef{#1^{[{\rm dbl}]}}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%              NOTATION FOR APPENDIX                     %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%

\newcommand{\newsigma}{\widehat{\sigma}}
\newcommand{\newtau}{\widehat{\tau}}
\newcommand{\newrho}{\widehat{\rho}}
\newcommand{\neweta}{\widehat{\eta}}

\newcommand{\Goal}{\mathdef{H}}              %% \Goal is some random symbol 
                                             %%  for a formula.
\newcommand{\GoalNext}{\mathdef{\act{N}_H}}  %% \GoalNext is next-state
                                             %%  relation for \Goal
\newcommand{\Unq}{\mathdef{U}}  %% \Unq is some random symbol for 
                                %%  an unquantified formula
\newcommand{\UNext}{\mathdef{\act{N}_U}}  %% \UNext is the next-state
                                          %% relation for \Unq
\newcommand{\Unqp}{\mathdef{V}}  %% \Unqp is some random symbol for an 
                                 %% unquantified formula
\newcommand{\UNextp}{\mathdef{\act{N}_V}}  %% \UNextp is the next-state
                                           %% relation for \Unqp


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                      RANDOM NOTATION                   %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%

% \hi{M}, \lo{M} : hi- and low-level specs
% \newcommand{\hi}[1]{\mathdef{#1^{h}}}
\newcommand{\hi}[1]{\mathdef{#1}}
\newcommand{\lo}[1]{\mathdef{#1^{l}}}

%% \pgmname{NAME OF PROGRAM} for examples.
\newcommand{\pgmname}[1]{{\sc #1}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                  BIG ANGLE BRACKETS                    %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%

% \bigla{N} makes a big left angle bracket N-lines high, starting on
%           the current line.
% \bigra[M]{N} analog, except it is put M lines down from the top line.
%           (Default is M=0.)
% \bigf[M]{N}{text} puts text down the right amount of space to fit next 
%           to a \bigra[M]{N}
\def\bigla#1{{\unitlength=#1\baselineskip
\raisebox{.75\baselineskip}[0pt][0pt]{\begin{picture}(.2,0)
\put(0,-.5){\line(1,3){.1667}}
\put(0,-.5){\line(1,-3){.1667}}
\end{picture}}\kern.1em}}

\makeatletter
\def\bigra{\@ifnextchar[{\@bigra}{\@bigra[0]}}

\def\@bigra[#1]#2{\kern.2em{\unitlength=#2\baselineskip
\raisebox
 {#1\baselineskip}[0pt][0pt]{\raisebox{.75\baselineskip}{\begin{picture}(.2,0)
\put(.2,-.5){\line(-1,3){.1667}}
\put(.2,-.5){\line(-1,-3){.1667}}
\end{picture}}}\kern.2em}}

\def\bigf{\@ifnextchar[{\@bigf}{\@bigf[0]}}
    
\def\@bigf[#1]#2#3{{\unitlength=#2\baselineskip
\unitlength=.5\unitlength \advance\unitlength -.5\baselineskip
\raisebox{-#1\baselineskip}[0pt][0pt]{\raisebox{\unitlength}[0pt][0pt]{#3}}}}

\makeatother


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                        FORMATTING                      %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% \s{n}  - an n-em horiontal space.
% \vs{n} - an n-em vertical space.
\newcommand{\s}[1]{\hspace*{#1em}}
\newcommand{\vs}[1]{\raisebox{-#1em}{\rule{0pt}{.1pt}}}


%% Make numbering of enumerated lists be \rm, even inside
%% italicized text.
%% 
\renewcommand{\thepfenumi}{{\rm \arabic{pfenumi}}}
\renewcommand{\theenumi}{{\rm \arabic{enumi}}}

%% Indented 1-line comment
\newcommand{\pfcomment}[1]{\hspace*{1em}\mbox{#1}}
\renewcommand{\o}{\circ}


\title{Conjoining Specifications}
\author{MART\'{I}N ABADI and LESLIE LAMPORT\\
        Digital Equipment Corporation}
%\date{\moddate}

\runningfoot{ACM Transactions on Programming Languages and Systems, Vol.\
17, No.\ 3, May 1995.}

\firstfoot{ACM Transactions on Programming Languages and Systems, Vol.\
17, No.\ 3, May 1995, Pages \pages.}

\markboth{Mart\'{\i}n Abadi and Leslie Lamport}%
         {Conjoining Specifications}

%%%\def\baselinestretch{2.5} %%%% for dumb copy-editing version

\begin{document}
%try
%\maketitle
\begin{titlepage}
\vspace*{150pt}
\centering
{\Large\bf Conjoining Specifications}

\vspace{20pt}
{\large Mart\'{\i}n Abadi and Leslie Lamport}

\vspace{20pt}
3 November 1995

\vspace{20pt}


\begin{minipage}{.8\textwidth}
This is a revised version of SRC Research Report 118.  It will appear
in {\em ACM Transactions on Programming Languages and Systems}.
\end{minipage}
\end{titlepage}

\cleardoublepage
\thispagestyle{empty}
\setcounter{tocdepth}{100}
\tableofcontents
\thispagestyle{empty}

\cleardoublepage
\pagenumbering{arabic}

\setcounter{page}{507}

\begin{abstract}
We show how to specify components of concurrent systems.  The
specification of a system is the conjunction of its components'
specifications.  Properties of the system are proved by reasoning
about its components.  
We consider both the decomposition of a given system into parts, and
the composition of given parts to form a system.
\end{abstract}

\category{D.2.4}{Software Engineering}{Program 
                  Verification}[correctness proofs]

\category{F.3.1}{Logics and Meanings of Programs}{Specifying and 
                  Verifying and Reasoning about Programs}[specification
                   techniques]

\terms{Theory, Verification}

\keywords{Composition, concurrent programming, decomposition,
          liveness properties, modular specification, safety properties, 
          temporal logic}
          
\maketitle

\begin{bottomstuff}
Authors' address: Systems Research Center, Digital Equipment Corporation,
130 Lytton Avenue, Palo Alto, CA 94301.
\permission
\copyright\ 1995 ACM 0000-0000/95/0000-0000 \$00.00
\end{bottomstuff}


%try
\section{Introduction}

Large systems are built from smaller parts.  We present a method
for deducing properties of a system by reasoning about its components.
We show how to represent an individual component $\Pi_{i}$ by a
formula $S_{i}$ so that the parallel composition usually denoted
  \( \,{\bf cobegin} \; \Pi_{1} \, \| \, \ldots \, \| \, \Pi_{n} \; 
     {\bf coend}\,
  \)
is represented by the formula $S_{1}\land\ldots\land S_{n}$.
Composition 
is conjunction.

We reduce composition to conjunction not for the sake of elegance, but
because it is the best way we know to prove properties of composite
systems.  Rigorous reasoning requires logic, and hence a language of
logical formulas.  It does not require a conventional programming
language for describing systems.  We find it most convenient to regard
  \index{program as low-level specification}%
programs and 
  \index{circuit description as low-level specification}%
circuit descriptions as low-level
  \index{specification!low-level}%
specifications, and to
represent them in the same logic used for 
  \index{specification!higher-level}%
higher-level specifications.
The logic we use is 
  \index{TLA}%
TLA, the Temporal 
 \index{Temporal Logic of Actions}%
Logic of
Actions~\cite{lamport:newtla}.  We do not discuss here the important
problem of translating from a low-level TLA specification to an
implementation in a conventional language.

The idea of representing concurrent programs and their specifications
as formulas in a temporal logic was first proposed by
 \index{Pnueli, Amir}%
\citeN{pnueli:temporal-semantics}.  It was later observed that,
if specifications allow 
  \index{stuttering step}%
  \index{step!stuttering}%
``stuttering'' steps that leave the state
unchanged, then
 $S_{l}\implies S_{h}$ 
asserts that $S_{l}$ 
  \index{implementation}%
implements $S_{h}$~\cite{lamport:what-good}.
Hence, proving that a lower-level specification implements a
higher-level one was reduced to proving a formula in the logic.
Still later, it was noticed that the formula
 $\EE x : S$ 
specifies the same system as $S$ except with the variable $x$
hidden~\cite{abadi:existence,lamport:simple}, and variable 
  \index{hiding}%
   \index{variable!hiding of}%
hiding
became logical quantification.  The idea of composition as
conjunction has also been
 suggested~\cite{abadi:logical-view,%
                 abramsky:games,%
                 zave:conjunction}, 
but our method for reducing composition to conjunction is new.


To deduce useful properties of a component, we must specify its
environment.  No component will exhibit its intended behavior in the
presence of a sufficiently hostile environment.  For example, a
combinational circuit will not produce an output in the intended range
if some input line, instead of having a 0 or a 1, has an improper
voltage level of 1/2.  The specification of the circuit's
environment must rule out such improper inputs.

How we reason about a composite system depends on how it was formed.
Composite specifications arise in two ways: by {\em 
  \index{decomposition}%
  \index{complete system!decomposition of}%
decomposing\/} a
given system into smaller parts and by {\em 
  \index{composition}%
composing\/} given parts
to form a larger system.  These two situations call for two methods of
writing component specifications that differ in their treatment of the
environment.  This difference leads in turn to different proof rules.

When decomposing a specification, the environment of each component is
assumed to be the other components, and is usually left implicit.  To
reason about a component, we must state what we are assuming about its
  \index{environment assumption}\index{assumption, environment}%
environment, and then prove that this assumption is satisfied by the
other components.  The Decomposition Theorem of
Section~\ref{sec:decomposing} provides the needed proof rule.  It
reduces the verification of a complex, low-level system to proving
properties of a higher-level specification and properties of one
low-level component at a time.  Decomposing proofs in this way allows
us to apply decision procedures to verifications that hitherto
required completely hand-guided proofs~\cite{kurshan:multiplier}.

When specifying a reusable component, without knowing precisely where
it will be used, we must make explicit what it assumes of its
environment.  We therefore assert that the component satisfies a
 \index{guarantee}\index{component guarantee}%
guarantee $M$ only as long as its environment 
 \index{environment assumption}\index{assumption, environment}%
satisfies an assumption
$E$.  This assumption/guarantee property~\cite{jones:specification} 
is
denoted 
 \index{+3ixp@\whilepop}%
\whilep{E}{M}.  To show that a composition of reusable
components satisfies a specification $S$, we must prove a formula of
the form
  $(\whilep{E_{1}}{M_{1}})\land\ldots\land(\whilep{E_{n}}{M_{n}})
    \implies S$,
where $S$ may again be an assumption/guarantee property.  We prove
such a formula with the Composition Theorem of
Section~\ref{sec:composition}.  This theorem allows us to reason about
assumption/guarantee specifications using well-established, effective
methods for reasoning about specifications of complete systems.

In the following section, we examine the issues that arise in
decomposition and composition.  Our discussion is informal, because we
wish to show that these issues are fundamental, not artifacts of a
particular formalism.  We treat these topics formally in Sections
\ref{sec:decomposing} and \ref{sec:composition}.
Section~\ref{sec:preliminaries} covers the formal preliminaries.  A
comparison with related work appears in the conclusion.  Proofs are
relegated to the appendix.


\section{An Informal Overview}

%try
\subsection{Decomposing Complete Systems} \label{sec:intro-decomposing}
 \index{decomposition|(}%
 \index{complete system!decomposition of|(}%
A complete 
   \index{complete system}%
   \index{system, complete}%
system is one that is self-contained; it may be observed,
but it does not interact with the observer.  A program is a complete
system, provided we model inputs as being generated
nondeterministically by the program itself.

  \index{GCD program|(}%
As a tiny example of a complete system, we consider a program for
computing a GCD (greatest common divisor), 
for which we have devised an informal
programming-language notation.  Statements within angle
  \index{angle brackets!enclosing atomic operation}%
  \index{brackets, angle!enclosing atomic operation}%
  \index{+5angle@$\langle\ldots\rangle$!enclosing atomic operation}%
brackets are executed atomically; {\bf loop}-{\bf endloop} keywords
enclose an infinite loop; {\bf cobegin}-{\bf coend} keywords enclose
parallel statements, separated by $\|$; and semicolon has its usual
meaning.  When writing processes, we will also mark variables as
output, input, or internal; a process cannot change its input
variables or access the internal variables of another process.
\begin{small}
\begin{tabbing}
\hspace*{\parindent}\=\+\pgmname{Program {\rm GCD}}\\
\s{1}\= {\bf var} \ $a$ {\bf initially} 233344, 
                  \ $b$ {\bf initially} 233577899\,;\\
     \>{\bf cobegin} \ \= {\bf loop} $\langle$ {\bf if} $a > b$ 
                               {\bf then} $a := a - b$ $\rangle$ {\bf endloop}\\
     \> \> \s{2}$\|$\\
     \> \>  {\bf loop} $\langle$ {\bf if} $b > a$ {\bf then} $b := b - a$
                     $\rangle$ {\bf endloop} \ {\bf coend}
\end{tabbing}       
\end{small}
Program GCD satisfies the correctness property that eventually $a$ and
$b$ become and remain equal to the gcd of 233344 and 233577899.  We
make no distinction between programs and properties, writing them all
as TLA formulas.  If formula $M_{\vbl{gcd}}$ represents program GCD,
and formula $P_{\vbl{gcd}}$ represents the correctness property, then
the program implements the property 
 \index{iff}%
iff (if and only if)
$M_{\vbl{gcd}}$ implies $P_{\vbl{gcd}}$.  Thus, correctness of
program GCD is verified by proving $M_{\vbl{gcd}}\implies
P_{\vbl{gcd}}$.

%try
In hierarchical development, one decomposes the specification of a
system into specifications of its parts. As explained in
Section~\ref{sec:decomposing},
the specification $M_{\vbl{gcd}}$ of program GCD can be
written as $M_{a} \land M_{b}$, where $M_{a}$ asserts that $a$
initially equals 233344 and is repeatedly decremented by the value of
$b$ whenever $a>b$, and where $M_{b}$ is analogous.  The formulas $M_{a}$
and $M_{b}$ are the specifications of two processes $\Pi_{a}$ and
$\Pi_{b}$.  We can write $\Pi_{a}$ and $\Pi_{b}$ as
\begin{small}
\begin{tabbing}
\hspace*{\parindent}\=\+
\s{1}\= \hspace*{.5\textwidth}\= \s{1}\= \kill
\pgmname{Process $\Pi_a$}                 \> \> \pgmname{Process $\Pi_b$}\\
\>  {\bf output var} \ $a$ {\bf initially} 233344\,;      
     \> \> {\bf output var} \ $b$ {\bf initially} 233577899\,;\\
\> {\bf input var} \ $b$\,;                        
   \> \> {\bf input var} \ $a$\,;\\                        
\> {\bf loop} $\langle$ {\bf if} $a > b$ {\bf then} $a := a - b$ $\rangle$ 
    \> \> {\bf loop} $\langle$ {\bf if} $b > a$ 
                          {\bf then} $b := b - a$ $\rangle$\\
 \> {\bf endloop}                         \>  \>    {\bf endloop}
\end{tabbing}
\end{small}
%try
One decomposes a specification in order to refine the components
separately.  We can refine the GCD program, to remove simultaneous
atomic accesses to both $a$ and $b$, by refining
process $\Pi_{a}$ to
%
\begin{small}
\begin{tabbing}
\hspace*{\parindent}\=\+\pgmname{Process \lo{\Pi_a}}\\
\s{1}\=\+{\bf output var}  \ $a$ {\bf initially} 233344\,;\\
{\bf internal var} \ \vbl{ai}\,;\\
{\bf input var} \ $b$\,;\\
{\bf loop} $\langle\,\vbl{ai} := b\,\rangle$\,; \ 
     {\bf if} $\langle\,a > \vbl{ai}\,\rangle$ {\bf then} 
            $\langle\,a := a - \vbl{ai}\,\rangle$ {\bf endloop}
\end{tabbing}
\end{small}
and refining $\Pi_{b}$ to the analogous process $\lo{\Pi_{b}}$.

The composition of processes $\lo{\Pi_{a}}$ and $\lo{\Pi_{b}}$
correctly implements program GCD. This is expressed in TLA by the
assertion that $\lo{M_{a}}\land\lo{M_{b}}$ implies $M_{a}\land M_{b}$,
where $\lo{M_{a}}$ and $\lo{M_{b}}$ are the formulas representing
$\lo{\Pi_{a}}$ and $\lo{\Pi_{b}}$.  

We would like to decompose the proof of 
 $\lo{M_{a}}\land\lo{M_{b}}\implies M_{a}\land M_{b}$ 
into proofs of
 $\lo{M_{a}}\implies M_{a}$ and $\lo{M_{b}}\implies M_{b}$.  
These proofs would show that \lo{\Pi_{a}} implements $\Pi_{a}$ and
that \lo{\Pi_{b}} implements $\Pi_{b}$.  

Unfortunately, \lo{\Pi_{a}} does not
implement $\Pi_{a}$ because, in the absence of assumptions
about when its input $b$ can change,
\lo{\Pi_{a}} can behave in ways that process
$\Pi_{a}$ cannot.  Process $\Pi_{a}$ can
decrement $a$ only by the current value of $b$, but \lo{\Pi_{a}} can
decrement $a$ by a previous value of $b$ if $b$ changes between the
assignment to \vbl{ai} and the assignment to $a$.  Similarly,
\lo{\Pi_{b}} does not implement~$\Pi_{b}$.

Process \lo{\Pi_{a}} does correctly implement process $\Pi_{a}$ in a
context in which $b$ does not change when $a>b$.  This is expressed in
TLA by the formula $E_{a}\land\lo{M_{a}} \implies M_{a}$, where
$E_{a}$ asserts that $b$ does not change when $a>b$.  Similarly,
$E_{b}\land \lo{M_{b}}\implies M_{b}$ holds, for the
analogous $E_{b}$.  The Decomposition Theorem of
Section~\ref{sec:decomposition-theorem} allows us to deduce
$\lo{M_{a}}\land \lo{M_{b}}\implies M_{a}\land M_{b}$ from
approximately the following hypotheses:
%try
\begin{equation} \label{eq:decomposition-example}
\begin{array}{@{}l@{\;\implies\;}l@{}}
        E_{a} \land\lo{M_{a}} & M_{a}\\[\jot]
        E_{b}\land \lo{M_{b}}  & M_{b}\\[\jot]
        M_{a}\land M_{b} & E_{a}\land E_{b}
    \end{array}
%\begin{array}{@{}l@{}}
%        E_{a}\land \lo{M_{a}}\implies M_{a}\\[\jot]
%        E_{b}\land \lo{M_{b}} \implies M_{b}\\[\jot]
%        M_{a}\land M_{b}\implies E_{a}\land E_{b}
%    \end{array}
\end{equation} 
%try
The third hypothesis holds because the composition of processes
$\Pi_{a}$ and $\Pi_{b}$ does not allow $a$ to change when $b>a$ or $b$
to change when $a>b$.

Observe that $E_{a}$ asserts only the property of $\lo{\Pi_{b}}$
needed to guarantee that \lo{\Pi_{a}} implements $\Pi_{a}$.  In a more
complicated example, $E_{a}$ will be significantly
simpler than \lo{M_{b}}, the full specification of \lo{\Pi_{b}}.
Verifying these hypotheses will therefore be easier than
proving $\lo{M_{a}}\land \lo{M_{b}}\implies M_{a}\land M_{b}$
directly, since this proof requires reasoning about the specification
$\lo{M_{a}}\land \lo{M_{b}}$ of the complete low-level program.

One cannot really deduce $\lo{M_{a}}\land \lo{M_{b}}\implies
M_{a}\land M_{b}$ from the hypotheses
(\ref{eq:decomposition-example}).  For example,
(\ref{eq:decomposition-example}) is trivially satisfied if $E_{a}$,
$E_{b}$, $M_{a}$, and $M_{b}$ all equal \false; but we cannot deduce
$\lo{M_{a}}\land \lo{M_{b}}\implies\false$ for arbitrary
\lo{M_{a}} and \lo{M_{b}}.  The precise hypotheses of the
Decomposition Theorem are more complicated, and we must develop a
number of formal concepts in order to state them.  We also develop
results that allow us to discharge these more complicated hypotheses
by proving conditions essentially as 
simple as
(\ref{eq:decomposition-example}).%
  \index{decomposition|)}%
  \index{complete system!decomposition of|)}%
\index{GCD program|)}

%try

\subsection{Composing Open Systems} \label{sec:intro-composing}

  \index{composition|(}%
An open 
  \index{open system}%
  \index{system!open}%
system is one that interacts with an environment it
does not control.  In our examples, we consider systems that
communicate by using a standard two-phase handshake
protocol~\cite{seitz:system-timing} to send values over 
  \index{channel}%
channels.  The
state of a channel $c$ is described by three components: the value
\vbl{c.val} that is being sent, and two bits \vbl{c.sig} and
\vbl{c.ack} used for synchronization.  We let
$\vbl{c.snd}$ denote the pair \tuple{\vbl{c.sig},\,\vbl{c.val}}.
Figure~\ref{fig:channel-protocol} shows the sequence of states assumed
in sending the sequence of values $37$, $4$, $19$, \ldots\,.
%
\begin{figure}
\newlength{\templengthx}
\settowidth{\templengthx}{\it initial}
\newcommand{\foo}[1]{\makebox[\templengthx][r]{#1}}
\centering
\begin{tabular}{@{}lrrrrrrr}
  &  \begin{tabular}[b]{@{}r@{}}
       \it initial\\[-.2em] \it state \\[-.1em] \hline
     \end{tabular} &
  \begin{tabular}[b]{@{}r@{}}
       37 \\[-.2em] \it sent \\[-.1em] \hline
     \end{tabular} &
  \begin{tabular}[b]{@{}r@{}}
       37 \\[-.2em] \it acked \\[-.1em] \hline
     \end{tabular} &
  \begin{tabular}[b]{@{}r@{}}
       4 \\[-.2em] \it sent \\[-.1em] \hline
     \end{tabular} &
  \begin{tabular}[b]{@{}r@{}}
       4 \\[-.2em] \it acked \\[-.1em] \hline
     \end{tabular} &
  \begin{tabular}[b]{@{}r@{}}
       19 \\[-.2em] \it sent \\[-.1em] \hline
     \end{tabular}\\[.1em]
%
\vbl{c.ack}: & \foo{0} & \foo{0} & \foo{1} & \foo{1} & \foo{0} & 
        \foo{0} & \foo{\ldots}\\
\vbl{c.sig}: & 0   & 1  & 1  & 0 & 0 & 1  & \ldots\\
\vbl{c.val}: & $-$ & 37 & 37 & 4 & 4 & 19 &\ldots
\end{tabular}
\vspace{-4pt}
\caption{The two-phase handshake 
protocol for a channel $c$.}
\label{fig:channel-protocol}
%  \index{channel, handshake protocol for}%
\end{figure}
%
The channel is ready to send when $\vbl{c.sig}=\vbl{c.ack}$.  A value
\rvbl{v} is sent by setting \vbl{c.val} to \rvbl{v} and complementing
\vbl{c.sig}.  Receipt of the value is acknowledged by complementing
\vbl{c.ack}.  

We consider an $N$-element 
  \index{queue|(}%
queue with input
channel $i$ and output channel $o$.  It is depicted in
Figure~\ref{fig:the-queue}.
%%%% fig:the-queue
\begin{narrowfig}{.35\textwidth}
\setlength{\unitlength}{.5pt}
\centering
\begin{picture}(0,104)(-100,0)
%\makegrid(-200,0)(400,200)
\thicklines
\put(-150,70){\vector(1,0){75}}
\put(-75,25){\vector(-1,0){75}}
\put(-112.5,75){\makebox(0,0)[b]{\vbl{i.snd}}}
\put(-112.5,30){\makebox(0,0)[b]{\vbl{i.ack}}}
\put(75,70){\vector(1,0){75}}
\put(150,25){\vector(-1,0){75}}
\put(112.5,75){\makebox(0,0)[b]{\vbl{o.snd}}}
\put(112.5,30){\makebox(0,0)[b]{\vbl{o.ack}}}
 %
\put(-75,0){\framebox(150,100){{\it Queue\/}}}
%\put(-75,0){\framebox(150,100){$Q(\Min,\Max)$}}
%
\end{picture}
\caption{A queue.\hspace*{50pt}}
\label{fig:the-queue}
\end{narrowfig}
To describe the queue, we use the programming-language constructs
introduced in Section~\ref{sec:intro-decomposing}; in particular, we
write large atomic actions within angle brackets.  We also introduce
the following notation for finite
  \index{sequences, notation for}%
sequences:
  \index{+5abs@$\length{\ldots}$}%
$|\rho|$ denotes the length of sequence $\rho$, which equals $0$ if
$\rho$ is empty; 
 \index{Head@\vbl{Head}}%
\head{\rho} and 
  \index{Tail@\vbl{Tail}}%
\tail{\rho} as usual denote the head
(first element) and the 
tail of sequence $\rho$, if $\rho$ is nonempty;
and 
  \index{+2o@$\circ$}%
$\rho\circ\tau$ denotes the concatenation of sequences $\rho$
and $\tau$.  Moreover, angle 
  \index{angle brackets!sequence notation}%
  \index{brackets, angle!sequence notation}%
  \index{+5angle@$\langle\ldots\rangle$!sequence notation}%
brackets are used to form sequences; so \seq{\;}
denotes the empty sequence, and \seq{e} denotes the sequence with $e$
as its only element.  
With this notation, the queue can be 
written 
as in Figure~\ref{fig:qprocess}.
%as follows.
\begin{narrowfig}{.7\textwidth}
\begin{tabbing}
\pgmname{Process Queue}\\
\s{1}\=\+{\bf output var} \ \=\vbl{i.ack}, \vbl{o.sig} {\bf initially} 0,\\
                   \> \vbl{o.val};\\
{\bf internal var} \ $q$ {\bf initially} \tuple{\,};\\
{\bf input var} \  \vbl{i.sig}, \vbl{i.val}, \vbl{o.ack};\\[.2\baselineskip]
{\bf cobegin} \= 
\bigf[2]{3}{\bf loop} \s{.2}\= \bigla{3}%
      \= \s{.1}{\bf if} \ $(\vbl{i.ack} \neq \vbl{i.sig}) \,\land\, (|q| < N)$% 
                           \bigra{3}\s{.2}
\=\= \bigf[2]{3}{\bf endloop} \\
\>         \> \>  \s{1}{\bf then} \ \= $q := q \circ \tuple{\vbl{i.val}}$;\\  
\>         \> \>                  \> $\vbl{i.ack} := 1 - \vbl{i.ack}$ \\
\> \s{1}$\|$\\
\> \bigf[3]{4}{\bf loop} \> \bigla{4}%
         \> {\bf if} \ $(\vbl{o.ack} = \vbl{o.sig}) \,\land\, (|q| > 0)$% 
      \bigra{4} \> \> \bigf[3]{4}{\bf endloop} \\
\> \>       \> \s{1}{\bf then} \ \= $\vbl{o.val} := \vbl{head}(q)$;\\ 
\> \>       \>                 \> $q := \vbl{tail}(q)$; \\
\> \>       \>                 \> $\vbl{o.sig} := 1 - \vbl{o.sig}$
\\[-.2\baselineskip]
{\bf coend} 
\end{tabbing}
\caption{A queue process.}
\label{fig:qprocess}
\end{narrowfig}

Let \vbl{QM} be the TLA formula that represents this queue
process.  It might seem natural to take \vbl{QM} as the
specification of the queue.  
However, this specification
would be difficult or impossible to implement because it states that
the queue behaves properly even if the environment does not obey the
communication protocol.  For example, in a lower-level implementation,
reading the input \vbl{o.ack} and setting the outputs \vbl{o.sig} and
\vbl{o.val} would be separate actions.  If the environment changed
\vbl{o.ack} between these actions, the implementation could violate
the requirement that it change \vbl{o.val} only when
$\vbl{o.ack}=\vbl{o.sig}$.  This problem is not an artifact of our
particular representation of the queue; actual hardware
implementations of a queue can enter metastable states, consequently
producing bizarre, unpredictable behavior, if their inputs are changed
when they are not supposed to be~\cite{seitz:system-timing}.

A specification of the queue should allow executions in which the
queue performs correctly; it should not rule out bad behavior of the
queue caused by the environment performing incorrectly.  Such a
specification can be written in the 
assumption/guarantee style, a
generalization of the traditional pre/postcondition style for
sequential programs.  An 
  \index{assumption/guarantee specification}%
  \index{specification!assumption/guarantee}%
assumption/guarantee specification asserts
that the system provides a 
  \index{guarantee}\index{system guarantee}%
guarantee $M$ if its environment 
 \index{environment assumption}\index{assumption, environment}%
satisfies
an assumption $E$.  For the queue, $M$ is the formula \vbl{QM}, and $E$
asserts that the environment obeys the communication protocol.%
 \index{queue|)}

It is not obvious how to
reason  about the composition of systems described by
assumption/guarantee specifications. The basic
problem is illustrated by the simple case of two systems, one 
guaranteeing $M_{c}$ assuming $M_{d}$, and the other guaranteeing $M_{d}$
assuming $M_{c}$.  Since each system guarantees to satisfy the other's
environment assumption, we would like to conclude that their
composition implements the specification $M_{c}\land M_{d}$
unconditionally, with no environment assumption.  
Can we?  We attempt to answer this question by
considering two simple examples, based on
Figure~\ref{fig:simple-example}.  

\begin{narrowfig}{.6\textwidth}
\centering
\begin{picture}(0,70)
\thicklines
\put(0,55){\makebox(0,0)[b]{$c$}}
\put(-30,50){\vector(1,0){60}}
\put(-80,0){\framebox(50,70){\shortstack{System\\$C$}}}
\put(0,25){\makebox(0,0)[b]{$d$}}
\put(30,0){\framebox(50,70){\shortstack{System\\$D$}}}
\put(30,20){\vector(-1,0){60}}
\end{picture}
\caption{A simple example.} \label{fig:simple-example}
\end{narrowfig}

In the first example:
\begin{itemize}
  \item $M^{0}_{c}$ asserts that $c$ always equals 0.
  \item $M^{0}_{d}$ asserts that $d$ always equals 0.
\end{itemize}
We can implement these specifications with the following two processes.
\begin{small}
\begin{tabbing}
\hspace*{\parindent}\=\+
\s{1}\= \hspace*{.5\textwidth}\= \s{1}\= \kill
\pgmname{Process $\Pi_{c}$}             \> \> \pgmname{Process $\Pi_{d}$}\\
\>  {\bf output var} \ $c$ {\bf initially} 0\,;      
     \>\> {\bf output var} \ $d$ {\bf initially} 0\,;\\
\> {\bf input var} \ $d$\,;                        
   \>\> {\bf input var} \ $c$\,;\\                        
\> {\bf loop} $\langle\,c := d\,\rangle$ {\bf endloop}
    \>\> {\bf loop} $\langle\,d :=  c\,\rangle$ {\bf endloop}
\end{tabbing}
\end{small}
Process 
$\Pi_{c}$ guarantees $M^{0}_{c}$ assuming $M^{0}_{d}$, and process 
$\Pi_{d}$
guarantees $M^{0}_{d}$ assuming $M^{0}_{c}$.  Clearly, their
composition leaves $c$ and $d$ unchanged, so it implements
$M^{0}_{c}\land M^{0}_{d}$.

In the second example:
\begin{itemize}
  \item $M^{1}_{c}$ asserts that $c$ eventually equals 1.
  \item $M^{1}_{d}$ asserts that $d$ eventually equals 1.
\end{itemize}
The same processes $\Pi_{c}$ and $\Pi_{d}$ implement the specifications in
this case too; process $\Pi_{c}$ guarantees 
$M^{1}_{c}$ assuming $M^{1}_{d}$, and process
$\Pi_{d}$ guarantees $M^{1}_{d}$ assuming $M^{1}_{c}$.  However, since their
composition leaves $c$ and $d$ unchanged, it does not
implement $M^{1}_{c}\land M^{1}_{d}$.

Our conclusion in the first example does not depend on the particular
choice of processes $\Pi_{c}$ and $\Pi_{d}$.  We can deduce directly
from the assumption/guarantee specifications that the composition must
implement $M^{0}_{c}\land M^{0}_{d}$, because the first process to
change its output variable would violate its guarantee before its
assumption had been violated.  This argument does not apply to the
second example, because violating $M^{1}_{c}$ and $M^{1}_{d}$ are sins
of omission that do not occur at any particular instant.  A property
that can be made false only by being violated at some instant is
called a safety 
  \index{safety property}%
property~\cite{alpern:defining}.  As the examples
suggest, reasoning about the composition of assumption/guarantee
specifications is easiest when assumptions are safety properties.

The argument that the composition should implement $M^{0}_{c}\land
M^{0}_{d}$ in the first example rests on the requirement that a
process maintains its guarantee until after the environment violates
its assumption.  In other words, we interpret the assumption/guarantee
specification as an assertion that the guarantee $M$ can become false
only after the assumption $E$ becomes false.  We write this assertion
as the formula \whilep{E}{M}.  Section~\ref{sec:composition} discusses 
this form of specification.

Our rules for reasoning about the composition of assumption/guarantee
specifications are embodied in the Composition Theorem of
Section~\ref{sec:composition-theorem}.  
With the Composition Theorem, we can prove that the conjunction of the
assumption/guar\-an\-tee specifications \whilep{M^{0}_{c}}{M^{0}_{d}} and
\whilep{M^{0}_{d}}{M^{0}_{c}} implies $M^{0}_{c}\land M^{0}_{d}$.  We
can also prove more substantial results---for example, that the
composition of queues implements a larger queue.  Verifying the
hypotheses of the theorem requires reasoning only about complete
systems, so the theorem allows us to handle assumption/guarantee
specifications as easily as complete-system specifications.
  \index{composition|)}%


%try
\section{Preliminaries} \label{sec:preliminaries}


\subsection{TLA}  \label{sec:TLA}
\subsubsection{Review of the Syntax and Semantics}
  \index{TLA|(}%
  \index{semantics of TLA|(}%
  \index{syntax of TLA|(}%
A 
  \index{state}%
state is an assignment of values to variables.  (Technically, our
variables are the 
  \index{flexible variable}%
  \index{variable!flexible}%
``flexible'' variables of temporal logic that
correspond to the variables of programming languages; they are
distinct from the variables of first-order logic.)  A 
 \index{behavior}%
behavior is an
infinite sequence of states.  Semantically, a TLA formula $F$ is true
or false of a behavior;  we say that $F$ is {\em
 \index{valid}%
valid}, and write 
  \index{+3valid@\validop}
\valid{F}, iff it is true of every behavior.
Syntactically, TLA 
  \index{formula, TLA}%
formulas are built up from
state functions using Boolean 
  \index{Boolean operator}\index{operator!Boolean}%
operators 
($\lnot$, $\land$, $\lor$, $\implies$ [implication], and
$=$ [equivalence])
and the operators $'$,
$\Box$, and $\EE$, as described below.  


A {\em state 
  \index{state function}%
  \index{function, state}%
function\/} is like an expression in a programming
language.  Semantically, it assigns a value to each state---for
example $3+x$ assigns to state $s$ three plus the value of the
variable $x$ in $s$.  A {\em state 
  \index{state predicate}%
  \index{predicate, state}%
predicate\/} is a Boolean-valued
state function.  An {\em 
 \index{action}%
action\/} is a Boolean-valued expression
containing 
    \index{variable!primed}%
primed and unprimed variables.  Semantically, an action is
true or false of a pair of states, with primed variables referring to
the second state---for example, $x+1>y'$ is true for \tuple{s,\,t} iff
the value of $x+1$ in $s$ is greater than the value of $y$ in $t$.  A
pair of states satisfying action \act{A} is called an \act{A} {\em 
  \index{step}%
step}.  We say that \act{A} is {\em enabled\/} in state $s$ iff there
exists a state $t$ such that \tuple{s,\,t} is an \act{A} step---for
example, $(x > 0) \land (x+1>y')$ is \index{enabled}enabled only in
states where $x > 0$.  The state predicate 
  \index{enabledX@$\enabled{\ldots}$}%
$\enabled{\act{A}}$ is true
for state $s$ iff \act{A} is enabled in $s$.
%% did not add Enabled to the index
We write 
 \index{+2p@$'$ (prime)}%
$v'$
for the expression obtained by priming all the variables of the
state function $v$, and 
  \index{+5me@\sqact{\ldots}{\ldots}}%
  \index{+5mea@\anact{\ldots}{\ldots}}%
\sqact{A}{v} for 
$\act{A}\lor(v'=v)$, so an \sqact{A}{v} step is either an \act{A} step
or a step that leaves $v$ unchanged.

As usual in temporal logic, if $F$ is a formula then 
  \index{+2box@$\Box$}%
  \index{+2bzdiamond@$\Diamond$}%
$\Box F$ is a
formula that means that $F$ is always true, and $\Diamond F$, an abbreviation
for $\lnot \Box \lnot F$, means that $F$ is eventually true.
In addition, if $\act{A}$ is an action and $v$ is a state function then
$\Box\sqact{A}{v}$ is a formula; $\Diamond\anact{A}{v}$ is an abbreviation
for $\lnot\Box\sqact{\lnot A}{v}$.
Using $\Box$ and
``enabled'' predicates, we can define fairness 
operators WF and SF\@.
The {\em weak-% 
        \index{fairness!weak}%
        \index{weak fairness}%
        \index{WF}%
fairness\/} formula \WF{v}{\act{A}} asserts of a
behavior that either 
there are infinitely many \act{A} steps that
change $v$, 
or there are infinitely many states in which such steps
are not enabled. This can be written 
$(\Box\Diamond\anact{A}{v}) \lor (\Box\Diamond\lnot\enabled{\anact{A}{v}})$.
The {\em strong-% 
        \index{fairness!strong}%
        \index{strong fairness}%
        \index{SF}%
fairness\/} formula \SF{v}{\act{A}}
asserts that either there are infinitely many \act{A} steps that
change $v$, 
or there are only finitely many states in which such steps
are enabled. This can be written 
$(\Box\Diamond\anact{A}{v}) \lor (\Diamond\Box\lnot\enabled{\anact{A}{v}})$.



The formula 
  \index{+2e@$\EE$}%
$\EE x:F$ means essentially that there is some way of
choosing a sequence of values for $x$ such that the temporal formula
$F$ holds.  We think of $\EE x:F$ as ``$F$ with $x$ hidden'' and
call $x$ an internal 
  \index{internal variable}%
  \index{variable!internal}%
variable of $\EE x:F$.  
Both $x$ and $x'$ are bound by $\EE x$ in $\EE x:F$.
If $x$
is a tuple of variables \tuple{x_{1},\,\ldots,\,x_{k}}, we write 
$\EE x : F$ for $\EE x_{1}:\ldots\EE x_{k} : F$.

%try
The standard way of specifying a system in TLA is with a formula in
the ``canonical 
  \index{canonical form}\index{form, canonical}%
form'' 
 $\EE x : \vbl{Init} \land\Box\sqact{N}{v}\land L$, 
where 
 \index{Init@\vbl{Init}}%
\vbl{Init} is a predicate and $L$ a conjunction of fairness
conditions.  This formula asserts that there exists a sequence of
values for $x$ such that (1)~\vbl{Init} is true for the initial state,
(2)~every step of the behavior is an \act{N} step or leaves the state
function $v$ unchanged, and (3)~$L$ holds.  For example, the 
specification $M_{\vbl{gcd}}$ of the
complete
high-level GCD 
 \index{GCD program}%
program is written in canonical form by
taking\footnote{We let a list of formulas bulleted with $\land$ or
$\lor$ denote the 
 \index{+7and@$\land$, list of}%
 \index{+7or@$\lor$, list of}%
 \index{conjunction, list notation for}%
 \index{disjunction, list notation for}%
conjunction or disjunction of the formulas, using
indentation 
  \index{indentation, eliminating parentheses with}%
to eliminate parentheses.  We also let $\implies$ have
  \index{operator!precedence of}%
  \index{+3implies@$\implies$, precedence of}%
lower precedence than the other Boolean operators.}
\begin{equation}  \label{eq:M-GCD}
  \begin{array}{@{}l@{\s{.75}\deq\s{1}}l@{}}
      \vbl{Init}   & (a=233344) \land (b=233577899)\\
      \act{N}      & \begin{array}[t]{@{\lor\;}l@{}}
                        (a > b) \;\land\; (a' = a-b) \;\land\; (b'=b)\\
                        (b > a) \;\land\; (b' = b-a) \;\land\; (a'=a)\\
                      \end{array}\\
      v            & \tuple{a,\,b}\\
      L            & \WF{v}{\act{N}}
   \end{array}
\end{equation}
%try

Intuitively, a 
  \index{variable!intuitive interpretation of}%
variable represents some part of the 
  \index{universe}%
universe, and a
  \index{behavior!intuitive interpretation of}%
behavior represents a possible complete history of the universe.  A
system $\Pi$ is represented by a TLA formula $M$ that is true for
precisely those behaviors that represent histories in which $\Pi$ is
running.  We make no formal distinction between systems,
specifications, and properties;  they are all represented by TLA
formulas, which we usually call specifications.%
  \index{TLA|)}%
  \index{semantics of TLA|)}%
  \index{syntax of TLA|)}%

\subsubsection{Interleaving and Noninterleaving Representations}

  \index{interleaving representation|(}
  \index{noninterleaving representation|(}
Let $\xi$ and $\psi$ be two objects, represented by the variables $x$ and $y$,
respectively.
When representing a history of the universe as a behavior, we can
describe concurrent changes to $\xi$ and $\psi$ either by
a single simultaneous change to $x$ and
$y$, or by separate changes to $x$ and $y$ in some order.
If the changes to $\xi$ and $\psi$ are directly linked, then it is
usually most convenient to describe their concurrent change by a
single change to both $x$ and $y$.  However, if the changes are
independent, then we are free to choose whether or not to allow
simultaneous changes to $x$ and $y$.  An {\em interleaving\/}
representation is one in which such simultaneous changes are
disallowed.

When changes to $\xi$ and $\psi$ are directly linked, we often think
of $x$ and $y$ as output variables of a single component.  An
interleaving representation is then one in which simultaneous changes
to output variables of different processes are disallowed.  The
absence of such simultaneous changes can be expressed as a TLA
formula.  For a system with $n$ components in which $v_{i}$ is the
tuple of output variables of component~$i$, interleaving is expressed
by the 
  \index{Disjoint@\vbl{Disjoint}}%
formula
 \[  \disjoint{v_{1},\,\ldots\,,v_{n}} \;\deq\;
   \bigwedge_{i\neq j} 
     \Box\sqact{(v_{i}'=v_{i})\lor(v_{j}'=v_{j})}{\tuple{v_{i},\,v_{j}}}
 \]

We have found that, in TLA, interleaving representations
are usually easier to write and to reason about.  Moreover, an
interleaving representation is adequate for reasoning about a system
if the system is modeled at a sufficiently fine grain of atomicity.
However, as discussed below, TLA also works for noninterleaving representations.
    \index{interleaving representation|)}
  \index{noninterleaving representation|)}
TLA does not mandate
any particular method for representing systems.  Indeed, one can write
specifications that are intermediate between interleaving and
noninterleaving representations.

\subsubsection{The Queue Example}

  \index{queue|(}%
We now give a TLA specification of the queue of natural numbers of length $N$,
which was described informally in Section~\ref{sec:intro-composing} and
illustrated in Figure~\ref{fig:the-queue}.  As in Section~\ref{sec:intro-composing},
we write $\vbl{c.snd}$ 
for the pair $\tuple{\vbl{c.sig},\,\vbl{c.val}}$ for a channel $c$;
we also write $c$ for the triple
$\tuple{\vbl{c.sig},\,\vbl{c.ack},\,\vbl{c.val}}$.

A channel is initially ready for sending, so the initial condition on
wire $c$ is the predicate \winit{c} defined by
 \[ \winit{c} \;\;\deq\;\; (\vbl{c.sig}=\vbl{c.ack}=0) \]
The operations of sending a value \rvbl{v} and acknowledging receipt
of a value on channel $c$ are represented by the following
\send{\rvbl{v}}{c} and \ack{c} actions.
 \[ \send{\rvbl{v}}{c} 
    \;\;\deq\;\; \begin{conj}
               \vbl{c.sig}=\vbl{c.ack} \\
                \vbl{c.snd}'= \tuple{1-\vbl{c.sig},\,  \rvbl{v}}\\
                \vbl{c.ack}'=\vbl{c.ack}
              \end{conj}
   \s{1}
%
    \ack{c}  \;\;\deq\;\; \begin{conj}
                              \vbl{c.sig}\neq\vbl{c.ack}\\
                               \vbl{c.ack}'=1-\vbl{c.ack} \\
                               \vbl{c.snd}'=\vbl{c.snd}
                           \end{conj}
 \]
To represent the queue as a complete system, we add an environment
that sends arbitrary natural numbers over channel $i$ and acknowledges
receipt of values on channel $o$.  The resulting complete system is shown in
Figure~\ref{fig:closed-queue}.

%%% fig:closed-queue
\begin{narrowfig}{.6\textwidth}
\setlength{\unitlength}{.5pt}
\centering
\begin{picture}(0,160)(0,-30)
%\makegrid(-200,0)(400,200)
\thicklines
\put(-150,70){\vector(1,0){75}}
\put(-75,25){\vector(-1,0){75}}
\put(-112.5,75){\makebox(0,0)[b]{\vbl{i.snd}}}
\put(-112.5,30){\makebox(0,0)[b]{\vbl{i.ack}}}
\put(75,70){\vector(1,0){75}}
\put(150,25){\vector(-1,0){75}}
\put(112.5,75){\makebox(0,0)[b]{\vbl{o.snd}}}
\put(112.5,30){\makebox(0,0)[b]{\vbl{o.ack}}}
 %
\put(-75,0){\framebox(150,100){{\it Queue\/}}}
%
\put(-175,50){\makebox(0,0){\small\shortstack
  {S\\[.15em]e\\[.15em]n\\[.15em]d\\[.15em]e\\[.15em]r}}}
\put(175,50){\makebox(0,0){\small\shortstack
  {R\\[.15em]e\\[.15em]c\\[.15em]e\\[.15em]i\\[.15em]v\\[.15em]e\\[.15em]r}}}
\put(-200,-30){\dashbox{10}(50,160){}}
\put(150,-30){\dashbox{10}(50,160){}}
%\put(135,140){\vector(1,0){15}}
%\put(-135,140){\vector(-1,0){15}}
%\multiput(-125,140)(20,0){13}{\line(1,0){10}}
%\put(0,145){\makebox(0,0)[b]{\ext}}
\end{picture}
\caption{The complete system of queue plus  environment.}
\label{fig:closed-queue}
\end{narrowfig}

% and $\seqof{V}$ denotes the set of finite sequences with
% elements in the set $V$.

The TLA formula \vbl{CQ} specifying the queue is defined in
Figure~\ref{fig:CQ}.  
%
\begin{figure}
\centering
\(\begin{array}{@{}l@{\s{.75}\deq\s{1}}l@{}l}   
    \env{\vbl{Init}} & \winit{i}  &
        \raisebox{0pt}[0pt][0pt]{\small
          \begin{tabular}[t]{@{}l@{}}
             Environment\\ Actions
          \end{tabular}}
\\[.3em]
%
      \vbl{Put} & (\exists v\in\nat : 
             \send{v}{i})\;\land\; (o'=o) \vs{.5}  \\

      \vbl{Get} &
              \ack{o} \;\land\;
              (i'= i) \vs{.5}\\
      \env{\Q} & \vbl{Get} \;\lor\;\vbl{Put}
   \\[.3em]
%
\cline{1-2}
    \sys{\vbl{Init}} & \winit{o} \;\land\; (q = \seq{\;}) &
        \vs{-1.2}\raisebox{0pt}[0pt][0pt]{\small
          \begin{tabular}[t]{@{}l@{}}
             Component \\ Actions
          \end{tabular}}
\\[.3em]
%
     \vbl{Enq}   &
        \begin{array}[t]{@{\land\s{.5}}l}
              |q| < N
            \\ \ack{i}
                  \s{.5}\land\s{.5}  (q' = q\circ\seq{i.val})
            \\ o'=o  \vs{.5}
        \end{array}\\
%
    \vbl{Deq} &
        \begin{array}[t]{@{\land\s{.5}}l}
              |q| > 0
            \\                     \send{\head{q}}{o} 
               \s{.5}\land\s{.5}  (q' = \tail{q})
            \\ i'=i  \vs{.5}
        \end{array}\\
%
    \sys{\Q} & 
       \vbl{Enq} \;\lor\; \vbl{Deq} \\[.3em]
%
\cline{1-2}
%
    \vbl{ICL} & \WF{\tuple{i,\,o,\,q}}{\sys{\Q}}%
            \vs{.5}   &  
   \vs{-1.2}\raisebox{0pt}[0pt][0pt]{\small
          \begin{tabular}[t]{@{}l@{}}
             Complete-System \\ Specification
%             Complete \\ System \\ Specification
          \end{tabular}}\\
    \vbl{ICQ} & 
   \begin{array}[t]{@{\land\s{.5}}l}
       \env{\vbl{Init}} \;\land\; \sys{\vbl{Init}} \\[.3em]
%
       \Box\,\left[\,\begin{array}{@{}l@{}}
                    \lor\; \env{\Q} \;\land\;(q'=q)\\
                    \lor\; \sys{\Q} 
                \end{array} 
             \right]_{\tuple{i,\,o,\,q}}\\
       \vs{.5}\vbl{ICL}
    \end{array}\\
%
 \vbl{CQ} & \EE \, q : \; \vbl{ICQ}
   \end{array}
\)

\caption{The specification \vbl{CQ} of the complete queue.
(Formulas $\winitf$, $\sendf$, and $\ackf$ are defined in the text.)}
\label{fig:CQ} 
\end{figure}%
%try
It has the canonical form 
$\EE x:\init\land\Box\sqact{N}{v}\land L$, where:
\begin{itemize}
\item $x$ is the internal variable $q$, which represents the sequence of
values received on the input channel $i$ but not yet sent on the
output channel $o$.

\item \init\ is written as the conjunction
$\init_{E}\land\init_{M}$ of initial predicates for the environment
and component.  (We arbitrarily consider the initial conditions on a
channel to be part of the sender's initial predicate.)

\item \act{N} is the disjunction of two actions: $\sys{\Q}$,
describing the steps taken by the component, and
$\env{\Q}\land(q'=q)$, describing steps taken by the environment
(which leave $q$ unchanged).  Action \sys{\Q} is the disjunction of
actions \vbl{Enq} and \vbl{Deq}.  An \vbl{Enq} step acknowledges
receipt of a value on $i$ and appends the value to $q$; it is enabled
only when $q$ has fewer than $N$ elements.  A \vbl{Deq} step removes
the first element of $q$ and sends it on $o$.  Action \env{\Q} is the
disjunction of \vbl{Put}, which sends an arbitrary number on channel
$i$, and \vbl{Get}, which acknowledges receipt of a number on
channel~$o$.

\item $v$ is the tuple \tuple{i,\,o,\,q} of all relevant
variables.\footnote{Informally, we write $\tuple{i,\,o,\,q}$ 
for the concatenation of the tuples $i$, $o$, and $\tuple{q}$.}



\item $L$ is the weak-fairness condition \vbl{ICL}, which is defined to be
\WF{\tuple{i,\,o,\,q}}{\sys{\Q}}, and asserts that a component step
cannot remain forever possible without occurring.  It can be shown
that a logically equivalent specification is obtained if this
condition is replaced with
 $\WF{\tuple{i,\,o,\,q}}{\vbl{Enq}}\,\land\,
   \WF{\tuple{i,\,o,\,q}}{\vbl{Deq}}$.
\end{itemize}
Formula \vbl{CQ} gives an interleaving representation of a queue;
simultaneous steps by the queue and its environment are not allowed.
Moreover, simultaneous changes to the two inputs \vbl{i.snd} and
\vbl{o.ack} are disallowed, as are simultaneous changes to the two
outputs \vbl{i.ack} and \vbl{o.snd}.  In
Section~\ref{sec:decomposing}, we describe a noninterleaving
representation of the queue.%
  \index{queue|)}%




%try
\subsection{Implementation} \label{sec:implementation}


A specification \lo{M} implies a specification \hi{M} iff every
behavior that satisfies \lo{M} also satisfies \hi{M}; hence proving
$\lo{M}\implies\hi{M}$ shows that the system \lo{\Pi} represented by
\lo{M} implements the system or property \hi{\Pi} represented by
\hi{M}.  Note that if \lo{M} is inconsistent (equivalent to \false),
then $\lo{M}\implies\hi{M}$ holds vacuously, but an inconsistent
\lo{M} does not represent any system \lo{\Pi}.

The formula $\lo{M}\implies \hi{M}$ is proved by applying a
handful of simple rules~\cite{lamport:newtla}.  When \hi{M} has the
form $\EE\,x:\widehat{M}$, a key step in the proof is finding a {\em
refinement 
  \index{refinement mapping}%
  \index{mapping, refinement}%
mapping\/}---a tuple of state functions $\overline{x}$ such
that \lo{M} implies $\overline{\widehat{M}}$, where
$\overline{\widehat{M}}$ is the formula obtained by substituting
$\overline{x}$ for $x$ (and therefore
$(\overline{x})'$ for $x'$) in $\widehat{M}$.  Under reasonable
assumptions, such a refinement mapping exists when $\lo{M}\implies
\EE\,x:\widehat{M}$ is valid~\cite{abadi:existence}.

As an example, we show that the system composed of two 
  \index{queue!implemented by two queues|(}%
queues in
series, shown in Figure~\ref{fig:closed-queue-comp}, implements a
single larger queue.  We first specify the composite queue.
Let $F[e_{1}/v_{1},\,\ldots,\,e_{n}/v_{n}]$
denote the result of (simultaneously) substituting each expression
$e_{i}$ for $v_{i}$ in a formula $F$.  For example, if \vbl{Get} is
defined as in Figure~\ref{fig:CQ}, then $\vbl{Get}[z/i]$ equals
$\ack{o}\land(z'=z)$.  For any formula $F$, let
 \[ F^{[1]}\;\;\deq\;\; F[z/o,\,q_{1}/q] \s{3}
    F^{[2]}\;\;\deq\;\; F[z/i,\,q_{2}/q] 
 \]
In Figure~\ref{fig:CQ12}, the specification $\vbl{CDQ}$ of the
complete system, consisting of the double queue and its environment,
is defined in terms of the formulas from Figure~\ref{fig:CQ}.  We
think of the complete system as containing three components: the
environment and the two queues.  The initial condition is the
conjunction of the initial conditions of each component.  The
next-state 
  \index{next-state action}%
  \index{action!next-state}%
action consists of three disjuncts, representing actions of
each of the three components that leave other components'
variables unchanged.  Finally, we take as the liveness condition the
conjunction of the fairness conditions of the two queues.

\begin{figure}
\setlength{\unitlength}{.5pt}
\centering
\begin{picture}(0,230)
\put(-112.5,0){\begin{picture}(0,200)(0,-30)
%\makegrid(-200,0)(400,200)
\thicklines
\put(-150,70){\vector(1,0){75}}
\put(-75,25){\vector(-1,0){75}}
\put(-112.5,75){\makebox(0,0)[b]{\vbl{i.snd}}}
\put(-112.5,30){\makebox(0,0)[b]{\vbl{i.ack}}}
% dashed arrows for z
% \multiput(150,25)(-10,0){7}{\line(-1,0){5}}
% \multiput(75,70)(10,0){7}{\line(1,0){5}}
% \put(150,70){\vector(1,0){0}}
% \put(75,25){\vector(-1,0){0}}
\put(150,25){\vector(-1,0){75}}
\put(75,70){\vector(1,0){75}}
\put(112.5,75){\makebox(0,0)[b]{\vbl{z.snd}}}
\put(112.5,30){\makebox(0,0)[b]{\vbl{z.ack}}}
 %
\put(-75,0){\framebox(150,100){{\it Queue1\/}}}
%
\put(-175,50){\makebox(0,0){\small\shortstack
  {S\\[.15em]e\\[.15em]n\\[.15em]d\\[.15em]e\\[.15em]r}}}
%\put(175,50){\makebox(0,0){\small\shortstack
%  {R\\[.15em]e\\[.15em]c\\[.15em]e\\[.15em]i\\[.15em]v\\[.15em]e\\[.15em]r}}}
\put(-200,-30){\dashbox{10}(50,160){}}
%\put(150,-30){\dashbox{10}(50,160){}}
%\put(135,140){\vector(1,0){15}}
%\put(-135,140){\vector(-1,0){15}}
%\multiput(-125,140)(20,0){13}{\line(1,0){10}}
%\put(0,145){\makebox(0,0)[b]{\ext}}
\end{picture}}
\put(112.5,0){\begin{picture}(0,200)(0,-30)
%\makegrid(-200,0)(400,200)
\thicklines
%\put(-150,70){\vector(1,0){75}}
%\put(-75,25){\vector(-1,0){75}}
%\put(-112.5,75){\makebox(0,0)[b]{\vbl{i.snd}}}
%\put(-112.5,30){\makebox(0,0)[b]{\vbl{i.ack}}}
\put(75,70){\vector(1,0){75}}
\put(150,25){\vector(-1,0){75}}
\put(112.5,75){\makebox(0,0)[b]{\vbl{o.snd}}}
\put(112.5,30){\makebox(0,0)[b]{\vbl{o.ack}}}
 %
\put(-75,0){\framebox(150,100){{\it Queue2\/}}}
%
%\put(-175,50){\makebox(0,0){\small\shortstack
%  {S\\[.15em]e\\[.15em]n\\[.15em]d\\[.15em]e\\[.15em]r}}}
\put(175,50){\makebox(0,0){\small\shortstack
  {R\\[.15em]e\\[.15em]c\\[.15em]e\\[.15em]i\\[.15em]v\\[.15em]e\\[.15em]r}}}
%\put(-200,-30){\dashbox{10}(50,160){}}
\put(150,-30){\dashbox{10}(50,160){}}
%\put(135,140){\vector(1,0){15}}
%\put(-135,140){\vector(-1,0){15}}
%\multiput(-125,140)(20,0){13}{\line(1,0){10}}
%\put(0,145){\makebox(0,0)[b]{\ext}}
\end{picture}}
\end{picture}
\caption{A complete system containing two queues in series.}
\label{fig:closed-queue-comp}
\end{figure}



\begin{figure}
\centering
\( \begin{array}{@{}l@{\s{.75}\deq\s{1}}l@{}}
     \vbl{ICDQ} & 
        \begin{conj}
           \env{\vbl{Init}} \;\land\; \sys{\vbl{Init}}^{[1]} 
                            \;\land\;  \sys{\vbl{Init}}^{[2]}\\[.3em]
           \Box\left[\,
%        \begin{array}{@{}l@{}}
            \begin{array}{@{\lor\;}l@{\;\land\;}l@{}}
              \env{\Q}       & \tuple{q_{1},\,q_{2},\,z}'= 
                                   \tuple{q_{1},\,q_{2},\,z}\\[.3em]
              \sys{\Q}^{[1]} & \tuple{q_{2},\,o}'=\tuple{q_{2},\,o}\\[.3em]
              \sys{\Q}^{[2]} & \tuple{q_{1},\,i}'=\tuple{q_{1},\,i}\\[.3em]
        \end{array}
            \,\right]_{\tuple{i,\,o,\,z,\,q_{1},\,q_{2}}}\\[.3em]
            \vbl{ICL}^{[1]}\;\land\;\vbl{ICL}^{[2]}\vs{.5}
         \end{conj}\\
\vbl{CDQ} & \EE\,q_{1},\,q_{2}
   % For hidden z
   % ,\,z 
: \vbl{ICDQ}
\end{array}
\)
\caption{Specification of the complete double-queue system
    of Figure~\protect\ref{fig:closed-queue-comp}.}
\label{fig:CQ12}
\end{figure}

%try
We now show that the composite queue implements a $(2N+1)$-element
queue.  (The ``$+1$'' arises because the internal channel $z$ acts as
a buffer element.)  The correctness condition is
$\vbl{CDQ}\implies\dbl{CQ}$, where \dbl{F} denotes
\mbox{$F[(2N+1)/N]$}, for any formula $F$.  This is proved by showing
%suboptimal break
$\vbl{ICDQ} \implies\overline{\dbl{ICQ}}$, with the refinement
mapping defined by
 \[ \overline{q} \s{1}\deq\s{1}
       \begin{tabular}[t]{@{}l@{\s{.75}}l@{\s{.75}}l@{}}
         {\bf if}\s{.75}$\vbl{z.sig}=\vbl{z.ack}$ 
              & {\bf then} & $q_{1}\circ q_{2}$\\
              & {\bf else} & $q_{1}\circ \seq{\vbl{z.val}} \circ q_{2}$
       \end{tabular} \]
The formula $\vbl{ICDQ} \implies\overline{\dbl{ICQ}}$ can be proved by
standard TLA reasoning of the kind described by~\citeN{lamport:newtla}.%
    \index{queue!implemented by two queues|)}%
%try

\subsection{Conditional Implementation} 
 \label{sec:generalized-implementation}
 \index{conditional implementation|(}%
 \index{implementation!conditional|(}%
  
%try
Instead of proving that a specification $\lo{M}$ implements a
specification $\hi{M}$, we sometimes want to prove the weaker
condition that $\lo{M}$ implements $\hi{M}$ assuming a formula $G$.  In
other words, we want to prove
  $G\implies(\lo{M}\implies \hi{M})$, which is equivalent
to 
 $G\land \lo{M}\implies \hi{M}$.
The formula $G$ may express one or more of the following:
\begin{itemize}
\item A law of nature.  For example, in a real-time 
  \index{specification!real-time}%
  \index{real-time specification}%
specification,
$G$ might assert that time increases monotonically.
If the current time is represented by the variable \vbl{now},
this assumption is expressed by the formula
 \( (\vbl{now}\in\Real)\,\land\,
   \Box\sqact{{}\vbl{now}'\in (\vbl{now},\infty)}{\vbl{now}}
\),
where \Real\ is the set of real numbers.

\item An interface 
  \index{interface refinement}%
  \index{refinement, interface}%
refinement, where $G$ expresses the relation
between a low-level tuple $l$ of variables and its high-level
representation as a tuple $h$ of variables.  For example, $l$ might be a
low-level interface representing the transmission of sequences of bits
over a wire, and $h$ could be the high-level interface in which the
sending of seven successive bits is interpreted as the transmission of
a single ASCII character.

\item An assumption about how reality is translated into the formalism
of behaviors.  In particular, $G$ may assert an interleaving
assumption---for example, an assumption of the form
\disjoint{v_{1},\,\ldots\,,v_{n}}.

%
%
% we find it convenient not to let outputs
% of different components change simultaneously.  Atomic actions are an
% idealized abstraction of continuous changes in nature---the
% continuous change of the voltage on a wire from $-1$ volt to $+3$
% volts is represented in our model by the value of a variable changing
% atomically from 0 to 1.  Since the change of physically different
% components' outputs are independent, we are free to model the
% concurrent change of their outputs as two separate actions.  
%
\end{itemize}
Conditional implementation, with an explicit formula $G$, is needed
only for open systems.  For a complete system, the properties
expressed by $G$ can easily be made part of the system specification.
For example, the system can include a component that advances time.
In contrast, it can be difficult to include $G$ in the specification
of an open system.%
   \index{conditional implementation|)}%
   \index{implementation!conditional|)}%

%try


\subsection{Safety and Closure} \label{sec:safety-and-closure}

\subsubsection{Definition of Closure}


A finite sequence of states is called a finite behavior.  For any
formula $F$ and finite behavior $\rho$, we say that $\rho$ satisfies
$F$ iff $\rho$ can be extended to an infinite behavior that satisfies
$F$.  For convenience, we say that the empty sequence \tuple{\,}
satisfies every formula (even $\false$).

A {\em safety 
  \index{safety property}%
property\/} is a formula that is satisfied by an infinite
behavior $\sigma$ iff it is satisfied by every prefix of
$\sigma$~\cite{alpern:defining}.  For any predicate \init, action
\act{N}, and state function $v$, the formula
$\init\land\Box\sqact{N}{v}$ is a safety property.
It can be shown that, for any TLA formula $F$, there is a 
%   \pagebreak %%%%%%%%%%%%%%%  REMOVED 27 Feb 95
TLA formula
\closure{F}, called the {\em closure 
 \index{closure}%
  \index{C@$\closureop$}
of $F$}, such that a behavior
$\sigma$ satisfies \closure{F} 
%%  \pagebreak %%%%%%%%%%%%%%%
iff every prefix of $\sigma$ satisfies
$F$.  Formula \closure{F} is the strongest safety property such
that \valid{F\implies\closure{F}}.   
Proposition~\ref{prop:fairness-is-machine-closed} below
implies that $\closure{\init\land\Box\sqact{N}{v}\land L}$
equals $\init\land\Box\sqact{N}{v}$ when $L$ is the conjunction
of suitable fairness properties.


\subsubsection{Machine Closure} 

  \index{closure, machine|(}%
  \index{machine closure|(}%
When writing a specification in the form
 $\init\land\Box\sqact{N}{v}\land L$,
we expect $L$ to constrain infinite behaviors, not finite ones.
Formally, this means that the closure of
$\init\land\Box\sqact{N}{v}\land L$ should be
$\init\land\Box\sqact{N}{v}$.  A pair of properties $(P,\,L)$ is called
{\em machine 
closed\/} iff \closure{P\land L} equals
$P$~\cite{abadi:existence}.  (We often say informally that $P\land L$
is machine closed.)

%try
Proposition~\ref{prop:fairness-is-machine-closed} below, which we
have already proved~\cite{abadi:old-fashioned}, shows that we can use fairness
properties to write machine-closed specifications.  The proposition
relies on the following definition: an action \act{A} is a {\em
  \index{subaction}%
subaction\/} of a safety property $P$ iff for every finite behavior
$\rho=\tuple{r_{0},\ldots,r_{n}}$, if $\rho$ satisfies $P$ and \act{A}
is enabled in state $r_{n}$, then there exists a state $r_{n+1}$ such
that $\tuple{r_{0},\ldots,r_{n+1}}$ satisfies $P$ and 
\tuple{r_{n},\,r_{n+1}} is an \act{A} step.  It follows
from this definition of subaction that, if \act{A} implies \act{N}, then
\act{A} is a subaction of $\init\land\Box\sqact{N}{v}$.
%try

\begin{proposition} \label{prop:fairness-is-machine-closed}
If\/ $P$ is a safety property and $L$ is the conjunction of a 
countable number of formulas\/ of the form\/
\WF{w}{\act{A}} and/or\/ \SF{w}{\act{A}} such that\/
$\act{A}\land(w'\neq w)$ is a subaction of\/ $P$, then\/ $(P,L)$ is machine
closed.%
  \index{closure, machine|)}%
  \index{machine closure|)}%
\end{proposition}


\subsubsection{Closure and Hiding} 
  \index{hiding}
  \index{variable!hiding of}

%try
Several of our results have hypotheses of the form
%suboptimal break
$\closure{M_{1}}\land\ldots\land
\closure{M_{n}}\implies\closure{M}$.  The obvious first step in
proving such a formula is to compute the closures 
 \closure{M_{1}}, \ldots\,, \closure{M_{n}}, and \closure{M}.  
We can use Proposition~\ref{prop:fairness-is-machine-closed} to
compute the closure of a formula with no internal variables.  
When there are internal variables, the following proposition allows us
to reduce the proof of
 $\closure{M_{1}}\land\ldots\land\closure{M_{n}}\implies\closure{M}$
to the proof of a formula in which the closures can be
computed with Proposition~\ref{prop:fairness-is-machine-closed}.
\begin{proposition} \label{prop:proving-closure}
Let 
$x$, $x_{1}$, \ldots, $x_{n}$ be tuples of variables such that
for each $i$, no variable in $x_{i}$ occurs in $M$ or in
any $M_{j}$ with $i\neq j$.\\  
\mbox{}\hfill
If\/
  \valid{\displaystyle
      \bigwedge_{i=1}^{n}\closure{M_{i}}
     \;\implies\;\EE\,x:\closure{M}},
then
   \( \valid{\displaystyle\bigwedge_{i=1}^{n} \closure{\EE\, x_{i} : M_{i}}
        \;\implies\;\closure{\EE x : M}} \).\hfill\mbox{}
\end{proposition}
Proofs are in the appendix.

Some of our results also have hypotheses of the form 
 $\closure{M_{1}}\land\ldots\land \closure{M_{n}}\implies E$,
where we expect $E$ to be a safety property.  If we can verify that
$E$ is a safety property, so $\valid{E=\closure{E}}$, then we can
apply Proposition~\ref{prop:proving-closure}.  When $E$ has internal
variables, we can often use Proposition~2 of \cite{abadi:existence} to
verify that $E$ is a safety property.



%%%%%%%%%%%%%% CHECK THAT THE PAPER ISN'T TOO LONG %%%%%%%%%%%%%%%%%%%
\newcount\test                                                       %
\test=\thepage                                                       %
\advance\test 20\relax                                               %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%try
\subsection{Additional Temporal Operators}

We now define some additional temporal operators.  Although they can
be expressed in terms of the primitive 
TLA operations 
$'$, $\Box$, and
$\EE$, we define them semantically.  


\subsubsection{The \protect\plusop\ Operator} \label{sec:plusop}

 \index{+2n@\plusop|(}%
The formula \plus{v}{E} asserts that,
if the temporal formula $E$ ever becomes false, then the state
function $v$ stops changing.  More precisely, a behavior $\sigma$
satisfies \plus{v}{E} iff either $\sigma$ satisfies $E$, or there is
some $n$ such that (1)~$E$ holds for the first $n$ states 
of $\sigma$ and (2)~$v$ never
changes from the $(n+1)$st state on.  When
$E$ is a safety property in canonical form, it is
easy to write \plus{v}{E} explicitly:
% \pagebreak
\begin{proposition} \label{prop:prop-plus}
If $x$ is a tuple of variables none of which occurs in $v$,
and
$s$ is a variable that does not occur in \init, \act{N}, $w$, $v$, or
$x$, and 
 \[ 
\begin{array}{@{}l@{\;\;\deq\;\;}l@{}}
\widehat{\init} & (\init\land(s=0) )\,\lor\,(\lnot\init\land(s=1))\\[\jot]
\widehat{\act{N}} & 
  \begin{array}[t]{@{\lor\;}l@{}}
       (s=0)\,\land\,
     \begin{array}[t]{@{\lor\;}l@{}}
          (s'=0) \land(\act{N}\lor(w'=w))\\
         (s'=1)\land\lnot(\act{N}\lor(w'=w))
     \end{array}
   \\
       (s=1) \,\land\, (s'=1)\land (v'=v)
   \end{array}
\end{array} 
\]
then  \ \valid{\plus{v}{(\EE\, x: \init\land\Box\sqact{N}{w})}
   \;=\; \EE\, x, s : \widehat{\init}
      \land\Box\sqact{{}\widehat{\act{N}}}{\tuple{w,\,v,\,s}}}.
\end{proposition}
We need to reason about \plusop{} only to verify hypotheses of the
form 
%suboptimal break
\valid{\nolinebreak\plus{v}{\closure{E}}\land\closure{\lo{M}}\implies 
    \closure{M}} 
in our Decomposition and Composition Theorems.  
We can verify such a hypothesis by
first applying the observation that \plus{v}{\closure{E}} equals
\closure{\plus{v}{E}} and using Proposition~\ref{prop:prop-plus} to
calculate \plus{v}{E}.  However, this approach is necessary only for
noninterleaving specifications.  Proposition~\ref{prop:perp-plus} below provides a way of proving these
hypotheses for interleaving specifications without having to
calculate~\plus{v}{E}.%
 \index{+2n@\plusop|)}%



\subsubsection{The \protect\whileop\ Operator}

 \index{+3iwp@\whileop|(}%
For temporal formulas $E$ and $M$, the formula \while{E}{M} asserts
that $M$ holds at least as long as $E$ does~\cite{abadi:logical-view}.
More precisely \while{E}{M} is true of a behavior $\sigma$ iff
$E\implies M$ is true of $\sigma$ and, for every finite prefix $\rho$ of
$\sigma$, if $E$ is true of $\rho$ then $M$ is true of $\rho$.  
It follows from this definition of $\whileop$ that
\while{E}{M} equals
 $(\while{\closure{E}}{\closure{M}})\land(E\implies M)$.
The operator \whileop\ acts much like ordinary implication.  In fact,
%very suboptimal break
\valid{\while{E}{M}} is equivalent to \valid{E\implies M}.  Of
course, it is not in general true that
\valid{(\while{E}{M})\,=\,(E\implies M)}.%
 \index{+3iwp@\whileop|)}%

\subsubsection{The \protect\whilepop\ Operator}

 \index{+3ixp@\whilepop|(}%
As we observed in the introduction, we interpret the specification
that $M$ is guaranteed under assumption $E$ as the formula
\whilep{E}{M}, which means that $M$ holds at least one step longer
than $E$ does.  More precisely, \whilep{E}{M} is true of a behavior
$\sigma$ iff $E\implies M$ is true of $\sigma$ and, for every $n\geq
0$, if $E$ holds for the first $n$ states of $\sigma$, then $M$ holds
for the first $n\!+\!1$ states of $\sigma$.  
It follows from this definition of $\whilepop$ that \whilep{E}{M} equals
$(\whilep{\closure{E}}{\closure{M}})\land(E\implies M)$.  

The formula \whilep{E}{M} is stronger than \while{E}{M}, which asserts
that $M$ holds as long as $E$ does.  It can be
shown that, if $E$ is a safety property, then
\whilep{E}{M} equals \while{(\while{M}{E})}{M}.  We prove
in the appendix that, if $E$ and $M$ are
both safety properties and $v$ is a tuple of variables containing all
free variables of $M$, then \whilep{E}{M} equals
\while{\plus{v}{E}}{M}.
 \index{+3ixp@\whilepop|)}%


\subsubsection{The $\perp$ Operator} \label{sec:perp}
  \index{+2p@$\perp$|(}%
The specification $M$ of a component can be made false only by a step
that changes the component's output variables.  In an interleaving
representation, we do not allow a single step to change output
variables of two different components.  Hence, if $E$ and $M$ are
specifications of separate components, we expect that no step will
make both $E$ and $M$ false.  More precisely, we expect $E$ and $M$ to
be orthogonal ($\perp$), where \orthogonal{E}{M} is true of a behavior
$\sigma$ iff there is no $n\geq 0$ such that $E$ and $M$ are both true
for the first $n$ states of $\sigma$ and both false for the first
$n\!+\!1$ states of $\sigma$.  It can be shown that 
\orthogonal{E}{M} equals \orthogonal{\closure{E}}{\closure{M}}, and that, if
$E$ and $M$ are safety properties, then \orthogonal{E}{M} equals
\whilep{(E\land M)}{(E\lor M)}.


If no step falsifies both $E$ and $M$, and $M$ remains true as long as
$E$ does, then $M$ must remain true at least one step longer than $E$
does.  Hence, \orthogonal{E}{M} implies the equivalence of
\while{E}{M} and \whilep{E}{M}.  In fact, 
we prove in the appendix that
$(\whilep{E}{M}) \,=\,
(\while{E}{M})\land(\orthogonal{E}{M})$ is valid.  From this and the
relation between \whilepop\ and \plusop, we can derive:
\begin{proposition} \label{prop:perp-plus}
If $E$, $M$, and $R$ are safety properties, and $v$ is a tuple of
variables containing all variables that occur free in $M$, then
\valid{E\land R\implies M} and \valid{R\implies\orthogonal{E}{M}}
imply \valid{\plus{v}{E}\land R\implies M}.
\end{proposition}
This proposition enables us to use orthogonality to remove 
\plusop\ from proof obligations.  To apply the proposition, we must prove the
orthogonality of component specifications.  We do this for
interleaving specifications with the following result.
\begin{proposition}%[Orthogonality] 
\label{prop:orthogonality}
If \\
\mbox{}\hfill \(\begin{array}[t]{l@{\;\;=\;\;}l}
    \valid{}\closure{E} & \init_{E} \;\land\; \Box  \sqact{N_{E}}{\tuple{x,\,e}}
   \\[\jot]
    \valid{}\closure{M} & \init_{M} \;\land\; \Box \sqact{N_{M}}{\tuple{y,\,m}}
  \end{array}
\)\hfill\mbox{}\\
then\\
\mbox{}\hfill\(\valid{(\exists x:\init_{E}\lor\exists y: \init_{M})
         \,\land\,\disjoint{e,\,m}\;\implies\;
             \orthogonal{\closure{\EE x : E}}{\closure{\EE y : M}}}\)%
\hfill\mbox{}%
%If & 
%\(\begin{array}[t]{l@{\;\;=\;\;}l}
%    \valid{}\closure{E} & \init_{E} \;\land\; \Box  \sqact{N_{E}}{\tuple{x,\,e}}
%   \\[\jot]
%    \valid{}\closure{M} & \init_{M} \;\land\; \Box \sqact{N_{M}}{\tuple{y,\,m}}
%  \end{array}
%\)\\
%then
%\end{tabular}\\
%\mbox{}\hfill\(\valid{(\exists x:\init_{E}\lor\exists y: \init_{M})
%         \,\land\,\disjoint{e,\,m}\;\implies\;
%             \orthogonal{\closure{\EE x : E}}{\closure{\EE y : M}}}\)%
%\hfill\mbox{}%
  \index{+2p@$\perp$|)}
\end{proposition}


%try
\section{Decomposing a Complete Specification} \label{sec:decomposing}

  \index{complete system!decomposition of|(}%
  \index{decomposition|(}%

\subsection{Specifying a Component} \label{sec:spec-a-component}

Let us consider how to write the specification $M$ of one component of
a larger system.  We assume that the free variables of the
specification can be partitioned into tuples $m$ of output 
 \index{variable!output}%
 \index{output variable}%
variables
and $e$ of input 
 \index{variable!input}%
 \index{input variable}%
variables; the component changes the values of
the variables of $m$ only.  (A more general situation is discussed
below.)  The specification of a component has the same form
 \( \EE x : \init \land \Box\sqact{N}{v} \land L \)
as that of a complete system. For a component specification:%
 \vspace{-4pt} %%%%%%%%%%% \pagebreak
%try
\begin{itemize}
\item $v$ is the tuple $\tuple{x,\,m,\,e}$.

\item \init\ describes the initial values of
the component's output variables $m$ and internal variables $x$.

\item \act{N} should allow two kinds of steps---ones that the
component performs and ones that its environment performs.  Steps
performed by the component, which change its output variables $m$, are
described by an action $\act{N}_{m}$.  In an interleaving
representation, the component's inputs and outputs cannot change
simultaneously, so $\act{N}_{m}$ implies $e'=e$.  In a noninterleaving
representation, $\act{N}_{m}$ does not constrain the value of $e'$,
so the variables of $e$ do not 
appear primed in $\act{N}_{m}$.
In either
case, we are specifying the component but not its environment, so we
let the environment do anything except change the component's output
variables or internal variables.  In other words, the environment is
allowed to perform any step in which $\tuple{m,\,x}'$ equals
$\tuple{m,\,x}$.  (Below, we describe more general specifications in
which an environment action can change~$x$.) Therefore, \act{N} should
equal
 \(\act{N}_{m} \,\lor\, (\tuple{m,\,x}'=\tuple{m,\,x})\).

\item $L$ is the conjunction of fairness conditions, each of
the form \WF{\tuple{m,\,x}}{\act{A}} or \SF{\tuple{m,\,x}}{\act{A}}.
For an interleaving representation, which by definition does not allow
steps that change both $e$ and $m$, the subscripts \tuple{m,\,x} and
\tuple{e,\,m,\,x} yield equivalent fairness conditions.
\end{itemize}
%try
 \pagebreak %%%%%%%%% REMOVED 27 Feb 95
This leads us to write $M$ in the form
\begin{equation} \label{eq:equiv-def-of-M}
 M\;\;\deq\;\; \EE x\, : \init
    \;\land\; \Box\sqact{{}\act{N}_{m} 
            \,\lor\,(\tuple{m,\,x}'=\tuple{m,\,x})}{\tuple{e,\,m,\,x}} 
       \;\land\; L
\end{equation}
By simple logic, (\ref{eq:equiv-def-of-M}) is equivalent to
\begin{equation}  \label{eq:def-of-M}
      M \;\;\deq\;\; \EE\, x : 
              \init \;\land\; 
             \Box\sqact{N_{m}}{\tuple{m,\,x}} \;\land\; L
\end{equation}

For the specification $M_{a}$ of process \hi{\Pi_{a}} in the GCD
  \index{GCD program}%
example, $x$ is the empty tuple (there is no internal variable), the
input variable $e$ is $b$, the output variable $m$ is $a$, and
\begin{equation} \label{eq:def-of-MsubA}
\begin{array}{@{}l@{\s{.75}\deq\s{1}}l@{}}
      \vbl{Init}_{a}   & a = 233344\\
      \act{N}_{a}      & (a > b) \;\land\; (a' = a-b) \;\land\; (b'=b)\\
       M_{a} & \vbl{Init}_{a}\;\land\;\Box\sqact{N_{a}}{a}
                        \;\land\;\WF{a}{\act{N}_{a}}
\end{array}
\end{equation}
For the specification \lo{M_{a}} of the low-level process
\lo{\Pi_{a}}, the tuple $x$ is \tuple{\vbl{ai},\,\vbl{pca}},
where \vbl{pca} is an internal variable that tells
whether control is at the beginning of the loop or after
the assignment to \vbl{ai}.  The specification has the form
\begin{equation}
\lo{M_{a}} \;\;\deq\;\;
  \EE \, \vbl{ai},\,\vbl{pca} :
               \lo{\vbl{Init}_{a}} 
    \;\land\;  \Box\sqact{{}\lo{\act{N}_{a}}}{\tuple{a,\,\vbl{ai},\,\vbl{pca}}}
    \;\land\;  \WF{\tuple{a,\,\vbl{ai},\,\vbl{pca}}}{\lo{\act{N}_{a}}}
\end{equation}
for appropriate initial condition \lo{\vbl{Init}_{a}} and next-state
action \lo{\act{N}_{a}}.
The specifications $M_{b}$ and \lo{M_{b}} are similar.

In our queue 
  \index{queue|(}%
example, we can write the specifications of both the
queue and its environment as separate components in the form
(\ref{eq:def-of-M}).  For the queue component, the tuple $m$ of output
variables is \tuple{\vbl{i.ack},\,\vbl{o.snd}}, the tuple $e$ of
input variables is \tuple{\vbl{i.snd},\,\vbl{o.ack}}, and the 
specification is
\begin{equation} \label{eq:QM-def}
\begin{array}{@{}l@{\s{.75}\deq\s{1}}l@{}}

\vbl{IQM} & \sys{\vbl{Init}} 
              \;\land\; \Box[ \sys{\Q} 
                            ]_{\tuple{\vbl{i.ack},\,\vbl{o.snd},\,q}}
              \;\land\; \vbl{ICL}
\\[.3em]
\vbl{QM} & \EE\,q:\vbl{IQM}  
\end{array}
\end{equation}
The specification of the environment as a separate component
is
\begin{equation} \label{eq:QE-def}
\vbl{QE} \;\;\deq\;\;
            \env{\vbl{Init}} 
  \;\land\; \Box\,[\env{\Q}]_{\tuple{\vbl{i.snd},\,\vbl{o.ack}}}
\end{equation}
We have provided specifications of the queue and its environment in an
interleaving representation.  A noninterleaving representation of the
queue can be obtained by modifying its specification as follows.
% \pagebreak
\begin{itemize}
\item Change the \vbl{Enq} and \vbl{Deq} actions so they do not
constrain the values of $\vbl{i.snd}'$ or $\vbl{o.ack}'$.  

\item Define an action \vbl{DeqEnq} that simultaneously enqueues an
input value and dequeues an output value, and change the definition of
$\act{Q}_{M}$ to have \vbl{DeqEnq} as an additional disjunct.
\end{itemize}
The resulting specification \NI{\vbl{QM}} is given in
Figure~\ref{fig:nonInterleaving-Q}.  It is a  noninterleaving 
specification because it allows a step that changes $\vbl{i}$ and $\vbl{o}$ 
simultaneously.
A noninterleaving representation
of the queue's environment can be obtained in a similar fashion.%
  \index{queue|)}

\begin{figure}
\centering
\(\begin{array}{@{}l@{\s{.75}\deq\s{1}}l@{}l}   
    \sys{\vbl{Init}} & \winit{o} \;\land\; (q = \seq{\;}) &
        \vs{-1.2}\raisebox{0pt}[0pt][0pt]{\small
          \begin{tabular}[t]{@{}l@{}}
             \\ 
          \end{tabular}}
\\[.3em]
%
     \NI{\vbl{Enq}}   &
        \begin{array}[t]{@{\land\s{.5}}l}
              |q| < N
            \\ \ack{i}
                  \s{.5}\land\s{.5}  (q' = q\circ\seq{i.val})
            \\ \vbl{o.snd}'=\vbl{o.snd}  \vs{.5}
        \end{array}\\
%
    \NI{\vbl{Deq}} &
        \begin{array}[t]{@{\land\s{.5}}l}
              |q| > 0
            \\                     \send{\head{q}}{o} 
               \s{.5}\land\s{.5}  (q' = \tail{q})
            \\ \vbl{i.ack}'= \vbl{i.ack}\vs{.5}
        \end{array}\\
%
    \NI{\vbl{DeqEnq}} & 
        \begin{array}[t]{@{\land\s{.5}}l}
              (|q| > 0) \s{.5}\land\s{.5} \send{\head{q}}{o}
            \\ \ack{i}\\
            q' = \tail{q}\circ\seq{i.val}\vs{.5}
        \end{array}\\
    \NI{\sys{\Q}} & 
       \NI{\vbl{Enq}} \;\lor\; \NI{\vbl{Deq}} \;\lor\; \NI{\vbl{DeqEnq}}\\[.3em]
%
%
    \NI{\vbl{IQM}} & \sys{\vbl{Init}}  \;\land\; 
       \Box\sqact{{}\NI{\sys{\Q}}}{\tuple{\vbl{i.ack},\,\vbl{o.snd},\,q}}
           \;\land\; 
            \WF{\tuple{\vbl{i.ack},\,\vbl{o.snd},\,q}}{\NI{\sys{\Q}}}%
            \vs{.5}  \\
   \NI{\vbl{QM}} & \EE\, q : \NI{\vbl{IQM}}
   \end{array}
\) % 
\caption{A noninterleaving
representation of the queue component.}
\label{fig:nonInterleaving-Q} 
\end{figure}

%try
%  \pagebreak %%%%%%%%%% REMOVED 27 Feb 95
In describing the component's next-state action \act{N}, we required
 \looseness=1\relax
that an environment action not change the component's internal
variables.  
 \pagebreak   %%%%% 10 Mar 95
One can also write a 
specification in which the
component records environment actions by changing its own internal
variables.  In this case, \act{N} will not equal
 \(\act{N}_{m} \lor (\tuple{m,\,x}'=\tuple{m,\,x})\),\linebreak
but may just imply 
$(e'=e)\lor(m'=m)$.  The resulting formula will not
be a pure interleaving specification because environment actions can
change the component's variables, but no action can change both the
component's and the environment's output variables.  We have not
explored this style of specification.
%try

We have been assuming that the visible variables of the component's
 \looseness=1\relax
specification can be partitioned into tuples $m$ of output 
 \index{variable!output}%
 \index{output variable}%
variables
and $e$ of input 
 \index{variable!input}%
 \index{input variable}%
variables.  To see how to handle a more general case,
let $\mu_{M}$ be the action $m'\neq m$, let $v$ equal \tuple{e,\,m},
%suboptimal break
and observe that \sqact{N_{M}}{\tuple{m,\,x}} equals \sqact{N_{M}\lor
(\lnot\mu_{M}\land (x'=x))}{\tuple{v,\,x}}.  A $\mu_{M}$ step is one
that is attributed to the component, since it changes the component's
output variables.  When the tuple $v$ of variables is not partitioned
into input and output variables, we define an action $\mu_{M}$ 
that specifies what steps are attributed to the component, and
we write the component's next-state action in the form
$\act{N}_{M}\lor(\lnot\mu_{M}\land (x'=x))$.  All our results for
separate input and output variables can be generalized by writing the
next-state action in this form.  However, for simplicity, we
consider only the special case.

%try
\subsection{Conjoining Components to Form a Complete System}
 \label{sec:conjoining}
 \index{conjunction of components|(}

In Section~\ref{sec:TLA}, we describe how to specify a complete
system.  In Section~\ref{sec:spec-a-component}, we describe how to
specify an individual component of a system.  A complete system is the
composition of its components.  Composing two systems means
constructing a universe in which they are both running.  If formulas
$M_{1}$ and $M_{2}$ represent the two systems, then $M_{1}\land M_{2}$
represents their composition, since a behavior represents a possible
history of a universe containing both systems iff it satisfies both
$M_{1}$ and $M_{2}$.  Thus, in principle, composition is conjunction.
We now show that composition is conjunction in practice as well.

For composition to be conjunction, the conjunction of the
specifications of all components should be equivalent to the
specification of the complete system.  For example, the conjunction of
the specifications \vbl{QM} of the 
 \index{queue}%
queue and \vbl{QE} of its
environment should be equivalent to the specification \vbl{CQ} of the
complete system shown in Figure~\ref{fig:closed-queue}.  Recall that
 \[ \begin{array}{@{}lll@{}}
    \vbl{QE} & = & \env{\vbl{Init}} 
  \;\land\; \Box\,[\env{\Q}]_{\tuple{\vbl{i.snd},\,\vbl{o.ack}}}\\[.3em]
%
\vbl{QM} & = & 
    \EE\,q:\sys{\vbl{Init}} 
              \;\land\; \Box[ \sys{\Q} 
                            ]_{\tuple{\vbl{i.ack},\,\vbl{o.snd},\,q}}
              \;\land\; \vbl{ICL}\\[.3em]
%
\vbl{CQ} & = & \EE \, q : \begin{array}[t]{@{\land\s{.5}}l}
       \env{\vbl{Init}} \;\land\; \sys{\vbl{Init}} \\[.1em]
%
       \Box\,\left[\,\begin{array}{@{}l@{}}
                    \lor\; \env{\Q} \;\land\;(q'=q)\\
                    \lor\; \sys{\Q} 
                \end{array} 
             \right]_{\tuple{i,\,o,\,q}}\\
       \vbl{ICL}
    \end{array}
 \end{array}
 \] 
We deduce the equivalence of $\vbl{QE}\land\vbl{QM}$ and \vbl{CQ} from the
following result, by substituting \vbl{QE} for $M_{1}$ and \vbl{QM}
for $M_{2}$.  (In this case, $x_{1}$ is the empty tuple \tuple{\,},
so $\widehat{x}_{2}$ equals $\tuple{\,}$ and
$\widehat{x}_{2}'=\widehat{x}_{2}$ equals \true.)
%try
\begin{proposition} \label{prop:conj-to-canonical}
Let $m_{1},\ldots\,,m_{n},\,x_{1},\ldots\,,x_{n}$ be
tuples of variables, and let
\[\begin{array}{@{}c@{}}
    m \;\;\deq\;\; \tuple{m_{1},\ldots\,,m_{n}}\s{3}
    x \;\;\deq\;\; \tuple{x_{1},\ldots\,,x_{n}}\\[\jot]
    \widehat{x}_{i} \;\;\deq\;\; 
        \tuple{x_{1},\ldots\,,x_{i-1},\,x_{i+1},\,\ldots\,,x_{n}}\\[\jot]
 M_{i} \;\;\deq\;\; \EE\,x_{i} : \vbl{Init}_{i} 
      \;\land\; \Box\sqact{N_{i}}{\tuple{m_{i},\,x_{i}}} 
      \;\land\; L_{i}
   \end{array}
\]
If, for all $i,\,j=1,\ldots\,,\,n$ with $i\neq j$:
\begin{enumerate}
\item no variable of $x_{j}$ occurs free in $x_{i}$ or $M_{i}$,
\item $m$ includes all free variables of $M_{i}$, and
\item \valid{\act{N}_{i}\implies(m_{j}'=m_{j})}
\end{enumerate}
then
\[ \valid{\;\bigwedge_{i=1}^{n}M_{i} \;\;=\;\;
    \EE\, x : 
                \bigwedge_{i=1}^{n}\vbl{Init}_{i} 
      \;\land\; \Box\sqact{{}\bigvee_{i=1}^{n}
               \act{N}_{i}\land
                  (\widehat{x}_{i}'=\widehat{x}_{i})}{\tuple{m,\,x}}
    \;\land\; \bigwedge_{i=1}^{n}L_{i}}
\]
\end{proposition} 
In this proposition, the third hypothesis asserts that component $i$
leaves the variables of other components unchanged,
so $M_{i}$ is an interleaving representation of component~$i$.
Hence, $M_{i}$ implies \disjoint{m_{i},m_{j}}, for each $j\neq i$,
and $\bigwedge_{i=1}^{n}M_{i}$ implies
\disjoint{m_{1},\,\ldots\,,m_{n}}, as expected for an interleaving
representation of the complete system.
%try

In the   
   \index{GCD program}%
GCD example, we apply this proposition to the formula $M_{a}$ of
(\ref{eq:def-of-MsubA}) and the analogous formula $M_{b}$.  We
immediately get that $M_{a}\land M_{b}$ is equivalent to a formula
that is the same as $M_{\vbl{gcd}}$, defined by (\ref{eq:M-GCD}),
except with
 $\WF{\tuple{a,\,b}}{\act{N}_{a}}\land\WF{\tuple{a,\,b}}{\act{N}_{b}}$
instead of \WF{\tuple{a,\,b}}{\act{N}}.  It can be shown that these
two fairness conditions are equivalent; hence $M_{a}\land M_{b}$ is
equivalent to $M_{gcd}$.


For another example of decomposition, we consider the system of
Figure~\ref{fig:closed-queue-comp}, which consists of two 
  \index{queue}%
queues in series
together with an environment.  This system can be decomposed into three
components with the following specifications.
 \[ \begin{array}{@{}ll@{}}
  \mbox{1st queue:} & \EE\,q_{1}: \sys{\vbl{Init}}^{[1]} 
                \;\land\; \Box\sqact{{}\sys{\Q}^{[1]}\land(o'=o)}{
                            \tuple{\vbl{i.ack},\,\vbl{z.snd},\,q_{1}}}
                \;\land\; \vbl{ICL}^{[1]}\\[\jot]
  \mbox{2nd queue:} & \EE\,q_{2}: \sys{\vbl{Init}}^{[2]} 
                \;\land\; \Box\sqact{{}\sys{\Q}^{[2]}\land(i'=i)}{
                            \tuple{\vbl{z.ack},\,\vbl{o.snd},\,q_{2}}}
                \;\land\; \vbl{ICL}^{[2]}\\[1.5\jot]
  \mbox{environment:} 
      & \env{\vbl{Init}} \;\land\; \Box\sqact{{}\env{\Q}\land(z'=z)}{
                            \tuple{\vbl{i.snd},\,\vbl{o.ack}}}

 \end{array} \] 
To obtain an interleaving representation, 
 \vspace{-2pt}% this is not a \linebreak, but it's almost as bad
we have conjoined $o'=o$ to
$\sys{\Q}^{[1]}$ in the first queue's next-state action, because
$\sys{\Q}^{[1]}$ does not mention $o$.  Similarly, we have conjoined $i'=i$
to the second queue's next-state action, and $z'=z$ to the
environment's.  It follows from
Proposition~\ref{prop:conj-to-canonical} that the conjunction of these
three specifications equals the specification \vbl{CDQ} of the
complete system, defined in Figure~\ref{fig:CQ12}.

%try
The third hypothesis of Proposition~\ref{prop:conj-to-canonical} is satisfied
only by interleaving representations.  For arbitrary representations,
a straightforward calculation shows 
\begin{equation} \label{eq:noninterleaving-conjunction}
\valid{}\bigwedge_{i=1}^{n}M_{i} \;=\; 
\EE\, x : \begin{array}[t]{@{\land\;}l@{}}
                \bigwedge_{i=1}^{n}\vbl{Init}_{i} \\
               \Box\sqact{{}\bigwedge_{i=1}^{n}
                (\act{N}_{i}\lor
                \tuple{m_{i},\,x_{i}}'=\tuple{m_{i},\,x_{i}})}{\tuple{m,\,x}}\\
              \bigwedge_{i=1}^{n}L_{i}
           \end{array}
\end{equation}
%try
assuming only the first hypothesis of the proposition.  The right-hand
side has the expected form for a noninterleaving specification, since
it allows $\act{N}_{i}\land\act{N}_{j}$ steps for $i\neq j$.  Hence,
composition is conjunction for noninterleaving representations too.%
   \index{conjunction of components|)}


%try 
\subsection{The Decomposition Theorem} \label{sec:decomposition-theorem}
\subsubsection{The Basic Theorem}

Consider a complete system decomposed into components $\hi{\Pi_{i}}$.  We
would like to prove that this system is implemented by a lower-level
one, consisting of components $\lo{\Pi_{i}}$, by proving that each
$\lo{\Pi_{i}}$ implements $\hi{\Pi_{i}}$.  Let \hi{M_{i}} be the
specification of $\hi{\Pi_{i}}$ and $\lo{M_{i}}$ be the specification of
$\lo{\Pi_{i}}$.  We must prove that $\bigwedge_{i=1}^{n}\lo{M_{i}}$
implies $\bigwedge_{i=1}^{n}\hi{M_{i}}$.  This implication is
trivially true if $\lo{M_{i}}$ implies $\hi{M_{i}}$, for all $i$.
However, as we saw in the GCD example, $\lo{M_{i}}$ need not imply
$\hi{M_{i}}$.  

Even when $\lo{M_{i}}\implies\hi{M_{i}}$ does not hold, we need not
reason about all the lower-level
components together.  Instead, we prove $E_{i}\land \lo{M_{i}}\implies
\hi{M_{i}}$, where $E_{i}$ includes just the properties of the
other components assumed by component $i$, and is usually much
simpler than $\bigwedge_{k\neq i}\lo{M_{k}}$.  Proving
$E_{i}\land\lo{M_{i}}\implies\hi{M_{i}}$ involves reasoning only about
component $i$, not about the entire lower-level system.

In propositional logic, to deduce that $\bigwedge_{i=1}^{n}\lo{M_{i}}$
implies $\bigwedge_{i=1}^{n}\hi{M_{i}}$ from
$\bigwedge_{i=1}^{n}(E_{i}\land \lo{M_{i}}\implies \hi{M_{i}})$, we
may prove that $\bigwedge_{k=1}^{n}\lo{M_{k}}$ implies $E_{i}$ for
each $i$.  However, proving this still requires reasoning about
$\bigwedge_{k=1}^{n}\lo{M_{k}}$, the specification of the entire
lower-level system.  The following theorem shows that we need only
prove that $E_{i}$ is implied by $\bigwedge_{k=1}^{n}\hi{M_{k}}$, the
specification of the higher-level system---a formula usually much
simpler than $\bigwedge_{k=1}^{n}\lo{M_{k}}$.


\typeout{OK overfull hbox (1.15828pt too wide).}

Proving $E_{i}\land\lo{M_{i}}\implies\hi{M_{i}}$ and
$(\bigwedge_{k=1}^{n}\hi{M_{k}})\implies E_{i}$ for each $i$ and
deducing
$(\bigwedge_{i=1}^{n}\lo{M_{i}})\implies(\bigwedge_{i=1}^{n}\hi{M_{i}})$
is circular 
 \index{circular reasoning}%
reasoning, and is not sound in general.  Such reasoning
would allow us to deduce
 $(\bigwedge_{i=1}^{n}\lo{M_{i}})\implies(\bigwedge_{i=1}^{n}\hi{M_{i}})$
for any $\lo{M_{i}}$ and $\hi{M_{i}}$---simply let $E_{i}$ equal
$\hi{M_{i}}$.  To break the circularity, we need to add some
\closureop's and
one 
hypothesis: if $E_{i}$ is ever violated then, for at least one
additional step, \lo{M_{i}} implies \hi{M_{i}}.  
This hypothesis
is expressed formally as 
 \valid{\plus{v}{\closure{E_{i}}}\land \closure{\lo{M_{i}}} 
           \;\implies\; \closure{\hi{M_{i}}}}, for
some $v$; the hypothesis is weakest when $v$ is taken to be the tuple
of all relevant variables.  Our proof rule is:

\begin{theorem}[Decomposition Theorem] \label{thm:decomposition}
 \index{Decomposition Theorem}
If, for $i=1,\ldots\,, n$, 
\begin{enumerate}
\item \valid{\BIGWEDGE_{j=1}^{n}\closure{\hi{M_{j}}}
      \;\implies\;E_{i}}
\item \begin{enumerate}
  \item \valid{\plus{v}{\closure{E_{i}}}\land \closure{\lo{M_{i}}} 
           \;\implies\; \closure{\hi{M_{i}}}}
  \item \valid{E_{i}\land \lo{M_{i}} \;\implies\; \hi{M_{i}}}
   \end{enumerate}
\end{enumerate}
then 
\valid{\BIGWEDGE_{i=1}^{n}\lo{M_{i}}\;\implies\;
         \BIGWEDGE_{i=1}^{n}\hi{M_{i}}}.
\end{theorem}
This theorem is a corollary of the Composition Theorem of
Section~\ref{sec:composition-theorem} below.  

In the GCD 
  \index{GCD program}%
example, we want to use the theorem to prove
%suboptimal break
$\lo{M_{a}}\land\lo{M_{b}}\implies M_{a}\land M_{b}$.  (The component
specifications are described in Section~\ref{sec:spec-a-component}.)
The abstract environment specification $E_{a}$ asserts that $b$ can
change only when $a<b$, and that $a$ is not changed by steps that
change $b$.  Thus,
 \[ E_{a} \;\;\deq\;\; \Box\sqact{{}(a<b)\,\land\,(a'=a)}{b}
 \]
The definition of $E_{b}$ is analogous.  We let $v$ be \tuple{a,\,b}.

%try
In general, the environment and component specifications can have
internal variables.  The theorem also allows them to contain fairness
conditions.  However, the first hypothesis asserts that the $E_{i}$ are
implied by safety properties.  In practice, this means that the
theorem can be applied only when the $E_{i}$ are safety properties.
The examples of Section~\ref{sec:intro-composing} lead us to expect
such a restriction.
%
Moreover, if the $E_{i}$ have internal variables, we expect them to
be simple history-determined variables~\cite{abadi:old-fashioned}, so
Proposition~2 of \cite{abadi:existence} can be used to prove that the
$E_{i}$ are safety properties.
%try

\subsubsection{Verifying the Hypotheses} 
%try
We now discuss how one verifies the hypotheses of the Decomposition
Theorem, illustrating the method with the GCD 
  \index{GCD program}%
example.

To prove the first hypothesis, one first eliminates the closure
operators and existential quantifiers by using Propositions
\ref{prop:fairness-is-machine-closed} and \ref{prop:proving-closure}
and Proposition~2 of \cite{abadi:existence}.
%if $E_{i}$ has internal variables).  
This reduces the hypothesis to a condition of the form
\begin{equation}\label{eq:recondition}
\valid{\bigwedge_{i=1}^{n}(\init_{i}\land\Box\sqact{N_{i}}{v_{i}}) 
\implies E_{i}}
\end{equation}
% it should be 1, not 2, in any case
For interleaving representations, we can then use
Proposition~\ref{prop:conj-to-canonical} to write
$\bigwedge_{i=1}^{n}(\init_{i}\land\Box\sqact{N_{i}}{v_{i}})$ in
canonical form.  
For noninterleaving representations, we apply
(\ref{eq:noninterleaving-conjunction}).  In either case,
the proof of (\ref{eq:recondition})
% $\bigwedge_{i=1}^{n}(\init_{i}\land\Box\sqact{N_{i}}{v_{i}}) 
% \implies E_{i}}$ 
% $M\implies E_{i}$ 
is an implementation proof of the kind discussed in
Section~\ref{sec:implementation}.

%try

For the GCD example, the first hypothesis asserts that
$\closure{M_{a}}\land\closure{M_{b}}$ implies $E_{a}$ and $E_{b}$.
This differs from the third hypothesis of
(\ref{eq:decomposition-example}) in
Section~\ref{sec:intro-decomposing} because of the \closureop's.  To
verify the hypothesis, we can apply
Proposition~\ref{prop:fairness-is-machine-closed} to show that
\closure{M_{a}} and \closure{M_{b}} are obtained by simply deleting
the fairness conditions from $M_{a}$ and $M_{b}$.  Since $\act{N}_{b}$
implies $(a<b)\,\land\,(a'=a)$, it is easy to see that \closure{M_{b}}
implies $E_{a}$.  It is equally easy to see that \closure{M_{a}}
implies~$E_{b}$.  (In more complicated examples, $E_{i}$ will not
follow from \closure{M_{j}} for any single~$j$.)



To prove part (a) of the second hypothesis, we first eliminate
the \plusop.  For noninterleaving representations, this must be done
with Proposition~\ref{prop:prop-plus}, as described in
Section~\ref{sec:plusop}.  For interleaving representations, we can
apply Propositions \ref{prop:perp-plus} and \ref{prop:orthogonality},
as described in Section~\ref{sec:perp}.  In either case, we
can prove the resulting
formula by first using
Proposition~\ref{prop:proving-closure} to eliminate quantifiers, using
Proposition~\ref{prop:fairness-is-machine-closed} to compute closures,
and then performing a standard implementation proof with a refinement
mapping.

Part (b) of the hypothesis also calls for a standard implementation
proof, for which we use the same refinement mapping as in the proof of
(a).  Since $E_{i}$ implies \plus{v}{\closure{E_{i}}} and \lo{M_{i}}
implies \closure{\lo{M_{i}}}, we can infer from part (a) that
$E_{i}\land \lo{M_{i}}$ implies \closure{\hi{M_{i}}}.  Thus proving
part (b) requires verifying only the liveness part of \hi{M_{i}}.

For the GCD example, we verify the two parts of the second hypothesis
by
proving 
$\plus{\tuple{a,\,b}}{\closure{E_{a}}}\land \closure{\lo{M_{a}}} 
           \implies \closure{M_{a}}$ and
$E_{a}\land \lo{M_{a}} \implies M_{a}$; the proofs of the
corresponding conditions for $M_{b}$ are similar.  We first observe
that the initial condition of $E_{a}$ is \true, and that, since
\lo{M_{a}} is an interleaving representation, its next-state action
\lo{\act{N}_{a}} implies that no step changes both $a$ and $b$, so
\closure{\lo{M_{a}}} implies \disjoint{a,\,b}.  Hence, applying
Propositions \ref{prop:perp-plus} and \ref{prop:orthogonality}, we
reduce our task to proving
%suboptimal break
 $\closure{E_{a}}\land \closure{\lo{M_{a}}}
   \implies\closure{M_{a}}$ and $E_{a}\land \lo{M_{a}}\implies M_{a}$.
Applying  Proposition~\ref{prop:proving-closure} to remove the
quantifier from \closure{\lo{M_{a}}} and
Proposition~\ref{prop:fairness-is-machine-closed} to remove the
\closureop's, we reduce proving
 $\closure{E_{a}}\land \closure{\lo{M_{a}}}\implies\closure{M_{a}}$ 
to proving
\begin{equation} \label{eq:middle-of-somewhere}
E_{a} \land \lo{\vbl{Init}_{a}} 
    \land  \Box\sqact{{}\lo{\act{N}_{a}}}{\tuple{a,\,\vbl{ai},\,\vbl{pca}}}
   \implies \vbl{Init}_{a} \land \Box\sqact{N_{a}}{a}
\end{equation}
Using simple logic and (\ref{eq:middle-of-somewhere}),
we reduce proving $E_{a}\land \lo{M_{a}} \;\implies\; M_{a}$
to proving
\begin{equation}\label{eq:middle-of-somewhere-else}
 E_{a} \;\land\; \lo{\vbl{Init}_{a}} 
    \land  \Box\sqact{{}\lo{\act{N}_{a}}}{\tuple{a,\,\vbl{ai},\,\vbl{pca}}}
    \land \WF{\tuple{a,\,\vbl{ai},\,\vbl{pca}}}{\lo{\act{N}_{a}}}
   \;\implies\; \WF{a}{\act{N}_{a}}
\end{equation}
We can use Proposition~\ref{prop:conj-to-canonical} to rewrite the
left-hand sides of (\ref{eq:middle-of-somewhere}) and
(\ref{eq:middle-of-somewhere-else}) in canonical form.  The resulting
conditions are in the usual form for a TLA implementation proof.

%try
In summary, by applying our propositions in a standard sequence, we
can use the Decomposition Theorem to reduce decompositional reasoning
to ordinary TLA reasoning.  This reduction may seem complicated for so
trivial an example as the GCD program.  However, it will be
insignificant compared to the complexity of the complete proof in any
realistic example, such as the one by~\citeN{kurshan:multiplier},
discussed below.
%try

\subsubsection{The General Theorem}
We sometimes need to prove the correctness of systems defined
  \index{inductively defined system}%
  \index{system!defined inductively}%
inductively.  At induction stage $N\!+\!1$, the low- and high-level
specifications are defined as the conjunctions of $k$ copies of 
low- and high-level specifications of stage $N$, respectively.  
For example, a $2^{N+1}$-bit 
  \index{multiplier!recursive definition}%
multiplier is sometimes
implemented by combining four $2^{N}$-bit multipliers.
We
want to prove by induction on $N$ that the stage $N$ low-level
specification implements the stage $N$ high-level specification.  For
such a proof, we need a more general decomposition theorem whose
conclusion at stage $N$
can be used in proving the hypotheses 
at stage $N\!+\!1$. The appropriate theorem is:
% \pagebreak
%try
\begin{theorem}[General Decomposition Theorem] 
\label{thm:general-decomposition}
 \index{Decomposition Theorem, General}%
 \index{General Decomposition Theorem}%

If, for $i=1,\ldots\,, n$,
\begin{enumerate}
\item \valid{\closure{E}\land\BIGWEDGE_{j=1}^{n}\closure{\hi{M_{j}}}
      \;\implies\;E_{i}}
\item \begin{enumerate}
  \item \valid{\plus{v}{\closure{E_{i}}}\land \closure{\lo{M_{i}}} 
           \;\implies\; \closure{\hi{M_{i}}}}
  \item \valid{E_{i}\land \lo{M_{i}} \;\implies\; \hi{M_{i}}}
   \end{enumerate}
\item $v$ is a tuple of variables including all the free variables
      of \hi{M_{i}}
\end{enumerate}
then \\
\begin{tabular}[t]{@{}l@{ \,}l}
(a) &  \valid{\plus{v}{\closure{E}}\land 
           \BIGWEDGE_{j=1}^{n}\closure{\lo{M_{j}}} 
        \;\implies\;
  \BIGWEDGE_{j=1}^{n}\closure{\hi{M_{j}}}} \ and\\
(b) & \valid{E\land\BIGWEDGE_{j=1}^{n}\lo{M_{j}}\;\implies\;
         \BIGWEDGE_{j=1}^{n}\hi{M_{j}}}.
\end{tabular}
\end{theorem}
%try
Conclusion (b) of this theorem has the same form as hypothesis~2(b),
with \lo{M_{i}} and \hi{M_{i}} replaced with conjunctions.  To make the
corresponding hypothesis~2(a) follow from conclusion (a), it suffices
to prove 
%suboptimal break
$\bigwedge_{j=1}^{n}\closure{\hi{M_{j}}} \implies 
        \closure{\bigwedge_{j=1}^{n}\hi{M_{j}}}$,
since
  $\closure{\bigwedge_{j=1}^{n}\lo{M_{j}}} \implies 
    \bigwedge_{j=1}^{n}\closure{\lo{M_{j}}}$ 
is always true.  


The General Decomposition Theorem has been applied to the
verification of an inductively defined multiplier
circuit~\cite{kurshan:multiplier}.

It can be shown that both versions of our decomposition theorem
provide complete rules for verifying that one composition implies
another.  However, this result is of no significance.  Decomposition
can simplify a proof only if the proof can be decomposed, in the sense
that each \lo{M_{i}} implements the corresponding $M_{i}$ under a
simple environment assumption $E_{i}$.  Our theorems are designed to
handle those proofs that can be decomposed.%
  \index{complete system!decomposition of|)}%
  \index{decomposition|)}%


%try



\section{Composing Assumption/Guarantee %\protect\\  %%%% linebreak
         Specifications} \label{sec:composition}

  \index{composition|(}%

\subsection{The Form of an Assumption/Guarantee Specification}

 \index{assumption/guarantee specification|(}%
An 
assumption/guarantee specification asserts that a system 
  \index{guarantee}\index{system guarantee}%
guarantees
$M$ under the assumption 
  \index{environment assumption}\index{assumption, environment}%
that its environment satisfies $E$.  As we
saw in Section~\ref{sec:intro-composing}, this specification is
expressed by the formula \whilep{E}{M}, which means that, for any $n$,
if the environment satisfies $E$ through ``time'' $n$, then the system
must satisfy $M$ through ``time'' $n\!+\!1$.  

Perhaps the most obvious form for an assumption/guarantee
specification is $E\implies M$.  The formula $E\implies M$ is weaker
than \whilep{E}{M}, since it allows behaviors in which $M$ is violated
before $E$.  However, an implementation could exploit this extra
freedom only by predicting in advance that the environment will
violate $E$.  A system does not control its environment, so it cannot
predict what the environment will do.  The specifications $E\implies
M$ and \whilep{E}{M} therefore allow the same implementations.  We
take \whilep{E}{M} to be the form of assumption/guarantee
specifications because this form leads to the simpler rules for
composition.

%try
As discussed in Section~\ref{sec:intro-composing},
composition works best when environment assumptions are
safety properties.  It can be shown that \whilep{E}{M} is equivalent to
\whilep{\closure{E}}{(\closure{M}\land(E\implies M))}, so we can in
principle convert any assumption/guarantee specification to one whose
assumption is a safety property.  (A similar observation appears 
in our earlier work~\cite[Theorem~1]{abadi:composing}.)
%as
%Theorem~1 in~\cite{abadi:composing}.)  
%
However, this equivalence is of
intellectual interest only.  In practice, we write the environment
assumption as a safety property and the system's fairness guarantee as
the conjunction of properties $E_{L}\implies\WF{v}{\act{A}}$ and
$E_{L}\implies\SF{v}{\act{A}}$, where $E_{L}$ is an environment
fairness assumption.  We can apply
Proposition~\ref{prop:fairness-is-machine-closed} to show that the
resulting specification is machine closed because, if $(P,\,L)$ is
machine closed and $L$ implies $R$, then $(P,\, R)$ is also machine
closed~\cite[Proposition~3]{abadi:old-fashioned}.
 \index{assumption/guarantee specification|)}%


%try
\subsection{The Composition Theorem} \label{sec:composition-theorem}

Suppose we are given $n$ devices, each with an
assumption/guarantee specification \whilep{E_{j}}{M_{j}}.  To verify
that the composition of these devices implements a higher-level
assumption/guarantee specification \whilep{E}{M}, we must prove
$\bigwedge_{j=1}^{n}(\whilep{E_{j}}{M_{j}})\implies(\whilep{E}{M})$.
We use the following theorem:
%  \pagebreak %%%%%%%%%  REMOVED 27 Feb 95
\begin{theorem}[Composition Theorem]
\label{thm:composition} 
   \index{Composition Theorem}%
If,  for $i=1,\ldots,n$,
\begin{enumerate}
\item \valid{\closure{E} \land \BIGWEDGE_{j=1}^{n}\closure{M_{j}} 
            \;\implies\; E_{i}}
\item 
 \begin{enumerate}
   \item \valid{\plus{v}{\closure{E}}\land\BIGWEDGE_{j=1}^{n}\closure{M_{j}}
                    \;\implies\; \closure{M}}
   \item \valid{E\land\BIGWEDGE_{j=1}^{n}M_{j}
                    \;\implies\; M}
\end{enumerate}
\end{enumerate}
then 
\valid{\BIGWEDGE_{j=1}^{n}
    (\whilep{E_{j}}{M_{j}})
   \;\implies\; (\whilep{E}{M})}.
\end{theorem}
This theorem also allows us to prove conditional implementation
results of the form
$G\land\bigwedge_{j=1}^{n}(\whilep{E_{j}}{M_{j}})\implies(\whilep{E}{M})$;
we just let $M_{1}$ equal $G$ and $E_{1}$
equal \true, since \whilep{\true}{G} equals $G$.  For interleaving
specifications, we can in general prove only conditional
implementation, where $G$ includes disjointness
conditions asserting that the outputs of different components do
not change simultaneously.

The hypotheses of the Composition Theorem are similar to those
of the Decomposition Theorem, and they are proved in much the same
way.  The major difference is that, for interleaving specifications,
the orthogonality condition \orthogonal{\closure{E}}{\closure{M}} does
not follow from the form of the component specifications, but requires
explicit disjointness assumptions.

Observe that the hypotheses have the form
\valid{P\,\land\,\bigwedge_{j=1}^{n}Q_{j}\,\implies\, R}.  Each
formula $P\,\land\,\bigwedge_{j=1}^{n}Q_{j}$ has the form of the
specification of a complete system, with component specifications $P$,
$Q_{1}$, \ldots, $Q_{n}$.  Thus, each hypothesis asserts that a
complete system satisfies a property $R$.  In other words, the theorem
reduces reasoning about assumption/guarantee specifications to the
kind of reasoning used for complete-system specifications.

Among the corollaries of the Composition Theorem are ones that allow
us to prove that a lower-level specification implies a higher-level one.
The simplest such result has, as its conclusion,
\valid{(\whilep{E}{\lo{M}})\implies(\whilep{E}{\hi{M}})}.  This
condition expresses the correctness of the refinement of a component
with a fixed environment assumption.
\begin{corollary}
If $E$ is a safety property and
\begin{enumerate}
\item[(a)] \valid{\plus{v}{E}\land\closure{\lo{M}}\implies\closure{\hi{M}}}
\item[(b)] \valid{E\land\lo{M}\implies\hi{M}}
\end{enumerate}
then \valid{(\whilep{E}{\lo{M}})\implies(\whilep{E}{\hi{M}})}.
\end{corollary}



%try }}}}}}


%try
\subsection{The Queue Example}
 \index{queue|(}
The assumption/guarantee specification of the queue of
%suboptimal break
Figure~\ref{fig:the-queue} is \whilep{\vbl{QE}}{\vbl{QM}}, where
\vbl{QM} and \vbl{QE} are defined in (\ref{eq:QM-def}) and
(\ref{eq:QE-def}) of Section~\ref{sec:spec-a-component}.  We now
compose two queues, as shown in Figure~\ref{fig:closed-queue-comp}.
The specifications of these queues are obtained from
\whilep{\vbl{QE}}{\vbl{QM}} by substitution; they are
\whilep{\vbl{QE}^{[1]}}{\vbl{QM}^{[1]}} and
\whilep{\vbl{QE}^{[2]}}{\vbl{QM}^{[2]}}.  We want to show that their
composition implements the $(2N\!+\!1)$-element queue specified by
\whilep{\dbl{\vbl{QE}}}{\dbl{\vbl{QM}}}.  The obvious thing to try to
prove is
\begin{equation} \label{eq:almost-queue-correctness}
 (\whilep{\vbl{QE}^{[1]}}{\vbl{QM}^{[1]}})
   \;\land\;
    (\whilep{\vbl{QE}^{[2]}}{\vbl{QM}^{[2]}})
   \;\;\implies\;\;
  (\whilep{\dbl{\vbl{QE}}}{\dbl{\vbl{QM}}})
\end{equation}
We could prove this had we used a noninterleaving representation of
the queue.  However, (\ref{eq:almost-queue-correctness}) is not valid
for an interleaving representation, for the following reason.  The
specification of the first queue does not mention $o$, and that of the
second queue does not mention $i$.  The conjunction of the two
specifications allows an enqueue action of the first queue and a
dequeue action of the second queue to happen simultaneously, a step
that changes \vbl{i.ack} and \vbl{o.snd} simultaneously.  But, in an
interleaving representation, the $(2N\!+\!1)$-element queue's guarantee
does not allow such a step, so (\ref{eq:almost-queue-correctness})
must be invalid.  Another problem with
(\ref{eq:almost-queue-correctness}) is that the conjunction of the
component queues' specifications allows a step that changes
\vbl{z.snd} and \vbl{o.ack} simultaneously.  Such a step satisfies the
$(2N\!+\!1)$-element queue's environment assumption \dbl{\vbl{QE}}, which
does not mention \vbl{z}, so (\ref{eq:almost-queue-correctness})
asserts that the next step must satisfy its guarantee
\dbl{\vbl{QM}}.  However, a step that changes both \vbl{z.snd} and
\vbl{o.ack} violates the second component queue's environment
assumption $\vbl{QE}^{[2]}$, permitting the component queue to make
arbitrary changes to \vbl{o.snd} in the next step.  A similar
problem is caused by simultaneous changes to \vbl{i.snd} and
\vbl{z.ack}.

We already faced the problem of disallowing simultaneous changes to
different components' outputs in Section~\ref{sec:conjoining}, where
we decomposed an interleaving specification of a $(2N\!+\!1)$-element
queue.  There, the solution was to strengthen the next-state actions
of the component queues and of the environment.  This solution cannot
be used if we want to compose preexisting specifications without
modifying them.  In this case, we prove that the composition
implements the larger queue under the assumption that the outputs of
two different components do not change simultaneously.  Thus, we prove
\begin{equation} \label{eq:queue-correctness}
 G \;\land\; (\whilep{\vbl{QE}^{[1]}}{\vbl{QM}^{[1]}})
   \;\land\;
    (\whilep{\vbl{QE}^{[2]}}{\vbl{QM}^{[2]}})
   \;\;\implies\;\;
(\whilep{\dbl{\vbl{QE}}}{\dbl{\vbl{QM}}})
\end{equation}
where $G$ is the formula \[ G \;\deq\;
\disjoint{\tuple{\vbl{i.snd},\,\vbl{o.ack}},\,
                 \tuple{\vbl{z.snd},\,\vbl{i.ack}},\,
                 \tuple{\vbl{o.snd},\,\vbl{z.ack}}}
 \]
The proof is outlined in
Figure~\ref{fig:queue-proof}.%
 \index{composition|)}%
  \index{queue|)}%

%try
\begin{figure}
\pfshortnumbers{99}
%\large
\realnormalsize
\begin{proof}
%
\setlength{\pftopsep}{13pt}
\setlength{\pfbotsep}{13pt}
\step{<1>1}{$\closure{\dbl{\vbl{QE}}}\land \closure{G}\land\closure{\vbl{QM}^{[1]}}
            \land\closure{\vbl{QM}^{[2]}}
             \;\implies\; \vbl{QE}^{[1]}\land\vbl{QE}^{[2]}$}
\begin{proof}
\pf\ We use Propositions \ref{prop:proving-closure} and
\ref{prop:fairness-is-machine-closed} to remove the quantifiers and
closure operators from the left-hand side of the implication.  The
resulting formula then asserts that a complete system, consisting of
the safety parts of the two queues (with their internal state visible)
together with the environment, implements $\vbl{QE}^{[1]}$ and
$\vbl{QE}^{[2]}$.  The proof of this formula is straightforward.
\end{proof}

\vspace{5pt}
% 
\step{<1>2}{$\plus{\tuple{i,\,o,\,z}}{\closure{\dbl{\vbl{QE}}}}
        \land\closure{\vbl{QM}^{[1]}}\land \closure{G} \land
                \closure{\vbl{QM}^{[2]}}
      \;\implies\; \closure{\dbl{\vbl{QM}}}$}
\begin{proof}
\step{<2>1}{$ \closure{G} \land 
        \closure{\vbl{QM}^{[1]}}\land \closure{\vbl{QM}^{[2]}}
            \;\implies\;
          \orthogonal{\closure{\dbl{\vbl{QE}}}}{\closure{\dbl{\vbl{QM}}}}$}
\begin{proof}
\step{<3>1}{$\closure{\vbl{IQM}^{[1]}}\land\closure{\vbl{IQM}^{[2]}}
              \;\implies\; 
              \exists\,q_{1},\,q_{2}:
                 \sys{\vbl{Init}}^{[1]}\land\sys{\vbl{Init}}^{[2]}$}
\begin{proof}
\pf\ Follows easily from
Proposition~\ref{prop:fairness-is-machine-closed} and the definitions.
\end{proof}
\step{<3>2}{$\closure{\vbl{QM}^{[1]}}\land\closure{\vbl{QM}^{[2]}}
              \;\implies\; 
             \exists\,q_{1},\,q_{2}: 
                \sys{\vbl{Init}}^{[1]}\land\sys{\vbl{Init}}^{[2]}$}
\begin{proof}
\pf\ \stepref{<3>1} and Proposition~\ref{prop:proving-closure} (since
any predicate is a safety property).
\end{proof}
\qedstep
\begin{proof}
\pf\ \stepref{<3>2}, the definition of $G$, and
Proposition~\ref{prop:orthogonality} (since disjointness is a safety
property).
\end{proof}
\end{proof}

\step{<2>2}{$ \closure{\dbl{\vbl{QE}}}\land\closure{G}\land 
        \closure{\vbl{QM}^{[1]}}\land 
            \closure{\vbl{QM}^{[2]}}
      \;\implies\; \closure{\dbl{\vbl{QM}}}$}
\begin{proof}
\pf\ We use Propositions \ref{prop:proving-closure} and
\ref{prop:fairness-is-machine-closed} to remove the quantifiers and
closures from the formula.  The resulting formula is proved
when proving the safety part of step \pfstepnumber{1}{3}{3}.
\end{proof}

\qedstep
\begin{proof}
\pf\ \stepref{<2>1}, \stepref{<2>2}, and Proposition~\ref{prop:perp-plus}.
\end{proof}
\end{proof}

\vspace{5pt}
\step{<1>3}{$\dbl{\vbl{QE}}\land G\land \vbl{QM}^{[1]}\land \vbl{QM}^{[2]}
      \;\implies\; \dbl{\vbl{QM}}$}
\begin{proof}
\pf\ A direct calculation shows that the left-hand side of the
implication implies \vbl{CDQ}, the complete-system specification of
the double queue.  We already observed in
Section~\ref{sec:implementation} that \vbl{CDQ} implements
\dbl{\vbl{CQ}}, which equals $\dbl{\vbl{QE}}\land\dbl{\vbl{QM}}$.
\end{proof}

\vspace{5pt}
\qedstep
\begin{proof}
\pf\ \stepref{<1>1}--\stepref{<1>3} and the Composition Theorem,
substituting
\[ \begin{array}{@{}l@{\;\leftarrow\;}l@{\s{2}}l@{\;\leftarrow\;}l@{\s{2}}l@{\;\leftarrow\;}l@{\s{2}}l@{\;\leftarrow\;}l@{}}
     M_{1} & G   & M_{2} & \vbl{QM}^{[1]} &  M_{3} & \vbl{QM}^{[2]} 
          & M & \dbl{\vbl{QM}} \\
     E_{1} &  \true & E_{2} & \vbl{QE}^{[1]} & E_{3} & \vbl{QE}^{[2]}
         & E & \dbl{\vbl{QE}} 
\end{array}
\]
\end{proof}
\end{proof}
\vspace{-5pt}
\caption{Proof sketch of (\protect\ref{eq:queue-correctness}).}
\label{fig:queue-proof}
\end{figure}


%try
%%%%%%%%%%%%%%%%%%%%%%%%%% CHECK LENGTH %%%%%%%%%%%%%%%%%%%%%%%%%%%
\ifnum \thepage > \test                                           %
   \marginpar{\raggedright \bf THIS PAPER IS TOO LONG!}           %
   \typeout{***** TOO LONG *****} \fi                             %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%try
\section{Conclusion} \label{sec:conclusion} 

We have developed a method for describing components of concurrent
systems as TLA formulas.  We have shown how to describe a complete
system as the conjunction of component specifications and how to
describe an open system as a formula \whilep{E}{M}, where $E$ and $M$
are specifications of an environment component and a system component,
respectively.  Although the idea of reducing programming concepts to
logic is old, our approach is new.  Our style of writing
specifications is direct and, we believe, practical.


We have also provided rules for proving properties of large systems by
reasoning about their components.  The Composition and Decomposition
Theorems are rather simple, yet they allow fairness properties and
hiding.  They were preceded by results in a long list of publications,
described next.  

Like ours, most previous  composition theorems were strong, in the sense that
they could handle circularities for safety
properties.  Our approach differs from earlier ones in its general
treatment of fairness and hiding.  
The first strong composition theorem we know is that of 
 \index{Misra, Jayadev}%
 \index{Chandy, K. Mani}%
\citeN{misra:proofs}, who considered safety properties of
processes communicating by means of 
 \index{CSP}%
CSP primitives.  They wrote
assumption/guarantee specifications as Hoare 
  \index{Hoare triple}%
triples containing
assertions about history 
  \index{variable!history}%
variables.  
 \index{Pandya, Paritosh K.}%
  \index{Joseph, Mathai}%
\citeN{pandya:p-a-logic} extended this approach to handle some liveness
properties.  
  \index{Pnueli, Amir}%
\citeN{pnueli:transition} was the first to use
temporal logic to write assumption/guarantee specifications.  He had a
strong composition theorem for safety properties with no hiding.  To
handle liveness, he wrote assumption/guarantee specifications with
implication instead of \whilepop, so he did not obtain a strong
composition theorem.  
 \index{Stark, Eugene W.}%
\citeN{stark:technique} also wrote
assumption/guarantee specifications as implications of temporal
formulas and required that circularity be avoided.  
Our earlier
work~\cite{abadi:composing} was semantic, in a more complicated model
with agents.  It lacked practical proof rules for handling fairness
and hiding.  
 \index{Collette, Pierre}%
\citeN{collette:application} adapted this work to
 \index{Unity}%
Unity.  
  \index{Plotkin,Gordon}%
\citeN{abadi:logical-view} used a
propositional logic with agents, and considered only safety
properties.

Most previous papers were 
concerned only with composition of assumption/guar\-an\-tee
specifications, and lacked an analog of our Decomposition Theorem.
An exception is the work of 
  \index{Berthet, Christian}%
  \index{Cerny, Eduard}%
\citeN{berthet:algebraic-model}, who used decomposition in proving
safety properties for finite-state automata. 



%More recently, he has suggested an
%extension of the approach in \cite{abadi:logical-view} to handle
%liveness.


So far, we have applied our Composition Theorem only to toy examples.
Formal reasoning about systems is still rare, and it generally occurs
on a case-by-case basis.  When the specification of a component is
used only to verify a specific system, there is no need for a general
assumption/guarantee specification.  For most practical applications,
decomposition suffices.  When decomposition does not suffice, the
Composition Theorem makes reasoning about open systems almost as easy as
reasoning about complete ones.

We have used our Decomposition Theorem with no difficulty on
a few toy examples.  However, we believe that its biggest payoff
will be for systems that are too complex to verify easily by hand.
The theorem makes it possible for decision procedures to do most of
the work in verifying a system, even when these procedures cannot be
applied to the whole system because its state space is very large or
unbounded.  This approach is currently being pursued in one
substantial example: the mechanical verification 
  \index{multiplier!verification}
of a multiplier
circuit using a combination of TLA reasoning and mechanical
verification with 
  \index{COSPAN}%
COSPAN~\cite{kurshan:multiplier}.  Because it
eliminates reasoning about the complete low-level system, the
Decomposition Theorem is the key to this division of labor.

\section*{Acknowledgments}
\addcontentsline{toc}{section}{Acknowledgements} 

Karlis 
 \index{Cerans, Karlis}%
Cerans, Stephan 
  \index{Merz, Stephan}%
Merz, Yuan 
 \index{Yu, Yuan}%
Yu,  and anonymous referees 
provided helpful comments on an earlier version.

\ifseparateappendix{%
\addcontentsline{toc}{section}{References}
\bibliographystyle{acmtrans}
%\bibliography{acmabbrevs,mybib}
\begin{thebibliography}{}

\bibitem[\protect\citeauthoryear{Abadi and Lamport}{Abadi and
  Lamport}{1994}]{abadi:old-fashioned}
{\sc Abadi, M.} {\sc and} {\sc Lamport, L.} 1994.
\newblock An old-fashioned recipe for real time.
\newblock {\em ACM Trans.\ Program.\ Lang.\ Syst.\/}~{\em 16,\/}~5 (Sept.),
  1543--1571.

\bibitem[\protect\citeauthoryear{Abadi and Lamport}{Abadi and
  Lamport}{1993}]{abadi:composing}
{\sc Abadi, M.} {\sc and} {\sc Lamport, L.} 1993.
\newblock Composing specifications.
\newblock {\em ACM Trans.\ Program.\ Lang.\ Syst.\/}~{\em 15,\/}~1 (Jan.),
  73--132.

\bibitem[\protect\citeauthoryear{Abadi and Lamport}{Abadi and
  Lamport}{1991}]{abadi:existence}
{\sc Abadi, M.} {\sc and} {\sc Lamport, L.} 1991.
\newblock The existence of refinement mappings.
\newblock {\em Theor.\ Comput.\ Sci.\/}~{\em 82,\/}~2 (May), 253--284.

\bibitem[\protect\citeauthoryear{Abadi and Plotkin}{Abadi and
  Plotkin}{1993}]{abadi:logical-view}
{\sc Abadi, M.} {\sc and} {\sc Plotkin, G.} 1993.
\newblock A logical view of composition.
\newblock {\em Theor.\ Comput.\ Sci.\/}~{\em 114,\/}~1 (June), 3--30.

\bibitem[\protect\citeauthoryear{Abramsky and Jagadeesan}{Abramsky and
  Jagadeesan}{1994}]{abramsky:games}
{\sc Abramsky, S.} {\sc and} {\sc Jagadeesan, R.} 1994.
\newblock Games and full completeness for multiplicative linear logic.
\newblock {\em J.\ Symb.\ Logic\/}~{\em 59,\/}~2 (June), 543--574.

\bibitem[\protect\citeauthoryear{Alpern and Schneider}{Alpern and
  Schneider}{1985}]{alpern:defining}
{\sc Alpern, B.} {\sc and} {\sc Schneider, F.~B.} 1985.
\newblock Defining liveness.
\newblock {\em Inf. Process. Lett.\/}~{\em 21,\/}~4 (Oct.), 181--185.

\bibitem[\protect\citeauthoryear{Berthet and Cerny}{Berthet and
  Cerny}{1988}]{berthet:algebraic-model}
{\sc Berthet, C.} {\sc and} {\sc Cerny, E.} 1988.
\newblock An algebraic model for asynchronous circuits verification.
\newblock {\em IEEE Trans.\ Comput.\/}~{\em 37,\/}~7 (July),
  835--847.

\bibitem[\protect\citeauthoryear{Collette}{Collette}{1993}]{collette:applicati%
on}
{\sc Collette, P.} 1993.
\newblock Application of the composition principle to {U}nity-like
  specifications.
\newblock In {\em
  TAPSOFT'93: Theory and Practice of Software Development}, 
  {\rm M.-C. Gaudel} {\rm and} {\rm J.-P. Jouannaud}, Eds.
  {\rm Lecture Notes in Computer Science}, 
  vol.\ 668. Springer-Verlag, Berlin, 230--242. 

\bibitem[\protect\citeauthoryear{Jones}{Jones}{1983}]{jones:specification}
{\sc Jones, C.~B.} 1983.
\newblock Specification and design of (parallel) programs.
\newblock In {\em Information Processing 83:
  Proceedings of the IFIP 9th World Congress},
  {\rm R.~E.~A. Mason}, Ed. North-Holland, Amsterdam, 321--332. 
  

\bibitem[\protect\citeauthoryear{Kurshan and Lamport}{Kurshan and
  Lamport}{1993}]{kurshan:multiplier}
{\sc Kurshan, R.~P.} {\sc and} {\sc Lamport, L.} 1993.
\newblock Verification of a multiplier: 64 bits and beyond.
\newblock In  {\em Computer-Aided Verification},
   {\rm C.~Courcoubetis}, Ed.
  {\rm Lecture Notes in Computer Science}, vol.\ 697.
  Springer-Verlag, Berlin, 
  166--179. 
\newblock Proceedings of the 5th International Conference, CAV'93.

\bibitem[\protect\citeauthoryear{Lamport}{Lamport}{1994}]{lamport:newtla}
{\sc Lamport, L.} 1994.
\newblock The temporal logic of actions.
\newblock {\em ACM Trans.\ Program.\ Lang.\ Syst.\/}~{\em 16,\/}~3 (May),
  872--923.

\bibitem[\protect\citeauthoryear{Lamport}{Lamport}{1989}]{lamport:simple}
{\sc Lamport, L.} 1989.
\newblock A simple approach to specifying concurrent systems.
\newblock {\em Commun. ACM\/}~{\em 32,\/}~1 (Jan.), 32--45.

\bibitem[\protect\citeauthoryear{Lamport}{Lamport}{1983}]{lamport:what-good}
{\sc Lamport, L.} 1983.
\newblock What good is temporal logic?
\newblock In {\em Information Processing 83:
  Proceedings of the IFIP 9th World Congress},
  {\rm R.~E.~A. Mason}, Ed. 
  North-Holland, Amsterdam, 657--668. 
  

\bibitem[\protect\citeauthoryear{Mead and Conway}{Mead and
  Conway}{1980}]{seitz:system-timing}
{\sc Mead, C.} {\sc and} {\sc Conway, L.} 1980.
\newblock {\em Introduction to VLSI Systems}. 
\newblock Addison-Wesley, Reading, Mass., chap.~7.

\bibitem[\protect\citeauthoryear{Misra and Chandy}{Misra and
  Chandy}{1981}]{misra:proofs}
{\sc Misra, J.} {\sc and} {\sc Chandy, K.~M.} 1981.
\newblock Proofs of networks of processes.
\newblock {\em IEEE Trans.\ Softw.\ Eng.}~{\em SE-7,\/}~4
  (July), 417--426.

\bibitem[\protect\citeauthoryear{Pandya and Joseph}{Pandya and
  Joseph}{1991}]{pandya:p-a-logic}
{\sc Pandya, P.~K.} {\sc and} {\sc Joseph, M.} 1991.
\newblock {P-A} logic---a compositional proof system for distributed programs.
\newblock {\em Distrib.\ Comput.}~{\em 5,\/}~1, 37--54.

\bibitem[\protect\citeauthoryear{Pnueli}{Pnueli}{1984}]{pnueli:transition}
{\sc Pnueli, A.} 1984.
\newblock In transition from global to modular temporal reasoning about
  programs.
\newblock In {\em Logics and Models of Concurrent Systems},
  {\rm K.~R. Apt}, Ed. 
    NATO ASI Series, Springer-Verlag, Berlin, 123--144. 

\bibitem[\protect\citeauthoryear{Pnueli}{Pnueli}{1981}]{pnueli:temporal-semant%
ics}
{\sc Pnueli, A.} 1981.
\newblock The temporal semantics of concurrent programs.
\newblock {\em Theor.\ Comput.\ Sci.\/}~{\em 13}, 45--60.

\bibitem[\protect\citeauthoryear{Stark}{Stark}{1985}]{stark:technique}
{\sc Stark, E.~W.} 1985.
\newblock A proof technique for rely/guarantee properties.
\newblock In {\em Foundations of Software
  Technology and Theoretical Computer Science},
  {\rm S.~N. Maheshwari}, Ed. 
  {\rm Lecture  Notes in Computer Science}, vol.\ 206.
  Springer-Verlag, Berlin, 369--391. 

\bibitem[\protect\citeauthoryear{Zave and Jackson}{Zave and
  Jackson}{1993}]{zave:conjunction}
{\sc Zave, P.} {\sc and} {\sc Jackson, M.} 1993.
\newblock Conjunction as composition.
\newblock {\em ACM Trans.\ Softw.\ Eng.\ Method.}~{\em
  2,\/}~4 (Oct.), 379--411.

\end{thebibliography}


\begin{received}
           Received December 1993; revised July 1994 and January 1995; 
           accepted January 1995
           \end{received}
\appendixhead{toplas}{1532}{1995}{{\it ACM Transactions on Programming Languages
and Systems 17}, 3 (May,~1995)}}{}
%\cleardoublepage

%%%% the ACM style of typesetting of theorems just doesn't make it
%%%% for this appendix, so we're reverting to a more standard style.
\makeatletter
\def\@begintheorem#1#2{\it \trivlist \item[\hskip \labelsep{\sc #1\ #2.}]}
\def\@opargbegintheorem#1#2#3{\it \trivlist
      \item[\hskip \labelsep{\sc #1\ #2.\ (#3)}]}
\makeatother

\ifseparateappendix{}{\appendix\part*{APPENDIX}}

\setlength{\pftopsep}{1ex plus .5ex}     % space above first proof environment
\setlength{\pfbotsep}{1ex plus .5ex}     % space below first proof environment
\setlength{\pfsep}{0pt plus .1ex}        % space above and below inner proof environment
\setlength{\stepsep}{0pt plus .1ex}      % space above and below proof step

%\appendix
%try
%\section{Appendix}

\ifseparateappendix{\vspace{-10pt}}{}

We now prove our propositions and theorems.
Section~\ref{sec:app-definitions} introduces some definitions and
notation required for the proofs, and explains our structured proof
notation.  The proofs are in Section~\ref{sec:app-proofs}.

\section{Definitions} \label{sec:app-definitions}

\subsection{Additional Semantic Notions}

As before, $\circ$ denotes concatenation of sequences, and angle
brackets \tuple{\,} are used to form sequences.  We write
  \index{+4prefix@$\ldots\prefix{}{\ldots}$}%
\prefix{\sigma}{n} for the finite behavior consisting of the first $n$
states of a behavior $\sigma$.  In particular, \prefix{\sigma}{0} is
the empty sequence \tuple{\,}, which satisfies every formula.  We
write $\sigma_{n}$ for the $n$th state of behavior $\sigma$, so
$\sigma$ equals \tuple{\sigma_{1},\,\sigma_{2},\,\ldots\,}.  When $\sigma$ is
finite, we write 
  \index{last@\vbl{last}}%
$\last{\sigma}$ for its last state, and
$\length{\sigma}$ for its length.

We let 
  \index{+5mean@\M{\ldots}}%
$\M{e}$ denote the meaning of an expression $e$.  When $e$ is a
state function, $\M{e}$ is a mapping from states to values; in the
special case when $e$ is a state predicate, $\M{e}$ is a mapping from
states to truth values.  When $e$ is an action, $\M{e}$ is a mapping
from pairs of states to truth values.  When $e$ is a temporal formula,
$\M{e}$ is a mapping from behaviors to truth values.  We extended this
mapping to finite behaviors by letting $\M{e}(\rho) = \true$ iff
$\M{e}(\sigma) = \true $ for some $\sigma$ that extends $\rho$.  In all cases,
we let $u 
  \index{+3valid@\validop}%
\validop e$ mean $\M{e}(u) = \true$.
  \index{C@$\closureop$}%
If  $F$ is a temporal formula and $\sigma$ a behavior,
then 
$\sigma \validop \closure{F}$ iff $\prefix{\sigma}{n} \validop F$
for all $n$.  Hence, $\M{\closure{F}}(\rho)=\M{F}(\rho)$ for any
finite behavior~$\rho$.

If $s$ and $t$ are states and $x$ is a tuple of variables, we write $s
  \index{+3dsub@\sequalv{\ldots}}%
\sequalv{x} t$ when $s$ and $t$ are identical except possibly for the
value they assign to the tuple $x$.  In other words, $s \sequalv{x} t$
iff $\M{y}(s) = \M{y}(t)$ for every variable $y$ not in the tuple $x$.
We extend this notion to behaviors, and write $\sigma \sequalv{x}
\tau$ iff $\sigma_n \sequalv{x} \tau_n$ for all $n > 0$.

The {\em stutter-free 
  \index{stutter-free version of a behavior}%
version\/} of a behavior is the behavior
obtained by removing from it all finite repetitions of states; thus,
the stutter-free version of $\sigma \circ \seq{s,\, s} \circ \tau$
equals the stutter-free version of $\sigma \circ \seq{s} \circ \tau$.
Two behaviors are {\em stuttering 
  \index{stuttering equivalent}%
equivalent\/} iff they have the same
stutter-free version.  
Every TLA formula $F$ is {\em invariant 
  \index{invariant under stuttering}%
  \index{stuttering, invariant under}%
under stuttering}, in the sense that
$\M{F}(\sigma)=\M{F}(\tau)$ for any two stuttering-equivalent behaviors $\sigma$ and $\tau$.
More generally, $\M{F}(\sigma)=\M{F}(\tau)$ if there is a behavior
$\newtau$ stuttering equivalent to $\sigma$ 
such that $\M{y}(\newtau_{n})=\M{y}(\tau_{n})$ for all $n>0$
and all variables $y$ occurring free in $F$.

We write 
  \index{+3esub@$\vseqv{\ldots}$}%
$\sigma \vseqv{x} \tau$ when $\newsigma
\sequalv{x} \newtau$ for some $\newsigma$ and $\newtau$ 
stuttering equivalent to $\sigma$ and
$\tau$, respectively.  If $F$ is a TLA formula and $\sigma$ a behavior, we let
$\M{\EE\,x:F}(\sigma)=\true$ iff
there exists a behavior $\tau$ such that
$\sigma\vseqv{x}\tau$  and $\M{F}(\tau) = \true$.
Equivalently, since $F$ is invariant under stuttering,
$\M{\EE\,x:F}(\sigma)=\true$ iff
there exist behaviors $\newsigma$ and $\newtau$
such that $\newsigma$ is stuttering equivalent
to $\sigma$, 
$\newsigma\sequalv{x}\newtau$,  and $\M{F}(\newtau) = \true$.

An operator $H$ on formulas is {\it 
 \index{superdiagonal@\sd}%
\sd\/} iff $\valid{A \implies
H(A)}$ for all $A$ in its domain.  For example, $\closureop$ is \sd.
As usual, an operator $H$ is {\em 
 \index{monotonic}%
monotonic\/} iff 
\valid{A\implies B} implies \valid{H(A)\implies H(B)} for all $A$ and $B$.
 \index{antimonotonic}%
Antimonotonicity is defined similarly, with the second implication
reversed.

%, and $\sigma^{+n}$ for the suffix of
%$\sigma$ starting in the $(n\!+\!1)$st state.  
%We also let \prefix{\sigma}{\infty} equal $\sigma$ and
%$\sigma^{+\infty}$ equal \tuple{\,}.


\subsection{Proof Notation}

Reliable reasoning about specifications depends on the correctness of
the underlying logical proofs.  Even a minor error, such as the omission
of a hypothesis in a proposition, could allow one to ``prove'' the
correctness of an incorrect implementation.  To avoid such errors, we
 \index{proof style, explanation}%%% 
provide detailed, hierarchically structured proofs.  

In our proof
notation, the theorem to be
proved is 
  \index{statement number (in proof)}%
  \index{number, statement (in proof)}%
statement \pfstepnumber{0}{1}{?}.  The proof of statement
\pfstepnumber{i}{j}{?} is either an ordinary paragraph-style proof or
the sequence of statements \pfstepnumber{i+1}{1}{?},
\pfstepnumber{i+1}{2}{?}, \ldots\ and their proofs.  (The absence of a
proof means that the statement follows easily from definitions,
previous statements, and assumptions.)
 %A proof may be preceded by a proof sketch, which informally describes
 %the proof.
Within a proof, \pfstepnumber{k}{l}{?} denotes the most recent
statement with that number.
 % That number is meaningful only if it lies within the proof of
 % statement number \pfstepnumber{k}{l'}{?}, for some $l'>l$.
A statement has the form\\ 
 \mbox{\hspace{\leftmargini}{\sc Assume:} {\em Assump\/} 
   \ \ {\sc Prove:} {\em Goal}}\\ 
which is abbreviated to {\em Goal\/} if there is no assumption.  The
assertion Q.E.D. in statement number \pfstepnumber{i+1}{k}{?} of the
proof of statement \pfstepnumber{i}{j}{?} denotes the goal of statement
\pfstepnumber{i}{j}{?}.  The statement\\
 \mbox{\hspace{\leftmargini}{\sc Case:} {\em Assump\/}}\\
is an abbreviation for\\
 \mbox{\hspace{\leftmargini}{\sc Assume:} {\em Assump\/} 
     \ \ {\sc Prove:} Q.E.D.}\\
Within the proof of statement \pfstepnumber{i}{j}{?}, assumption
\pflevelnumber{i}{?} denotes that statement's assumption, and
\pflevelnumber{i}{?}:$k$ denotes the assumption's $k^{\rm th}$ item.

We recommend that proofs be read hierarchically, from the top level
down.  To read the proof of a long level-$k$ step: (i)~read the
level-\mbox{$(k\!+\!1)$} statements that comprise its proof, together with the
proof of the final Q.E.D. step (which is usually a short paragraph),
and (ii)~read the proof of each level-\mbox{$(k\!+\!1)$} step, in any
desired order.

%try 
\section{Proofs} \label{sec:app-proofs}


Results are
organized in groups that roughly correspond to their subject and to
the position of the corresponding discussion in the text.

Our proofs employ many lemmas. We omit the proofs of some of the simpler ones.
We also omit the proof of Proposition~\ref{prop:fairness-is-machine-closed},
which is given in~\cite{abadi:old-fashioned}.

\subsection{Properties of \protect\whileop\ and \protect\whilepop}

The proofs of most of these properties are straightforward and are
omitted.  Some of the basic arguments about $\whileop$ can be found
in~\cite{abadi:logical-view}.

\begin{lemma}%[facts about \whileop]
\label{lemma:2-of-appendix}
If $P$, $Q$, and $R$ are safety properties, then
\begin{enumerate*}           

\item $\while{P}{Q}$ and \whilep{P}{Q} are safety properties.

\item \valid{P\implies (\while{Q}{R})} if and only if  
       \valid{P\land Q\implies R}.
\end{enumerate*}
\end{lemma}



\begin{lemma}\label{lemma:ArrowClosedImpl}
For any properties $P$ and $Q$,
\begin{enumerate*}
\item \valid{(\while{P}{Q}) = 
        (\while{\closure{P}}{\closure{Q}}) \land (P \implies Q)}
\item \valid{(\whilep{P}{Q}) = 
        (\whilep{\closure{P}}{\closure{Q}}) \land (P \implies Q)}
\end{enumerate*}
\end{lemma}


\begin{lemma}
\label{lemma:2p-of-appendix}
For any properties $P$ and $Q$,
\begin{enumerate*}           
\item \valid{P \land (\while{P}{Q}) \implies Q}
\item \valid{P \land (\whilep{P}{Q}) \implies Q}
\end{enumerate*}
\end{lemma}

\begin{lemma}
\label{lemma:ArrowNew}
If $P$ and $Q$ are safety properties, then
\vspace{-.5\baselineskip}
\[ \valid{(\while{P}{Q}) \land (\while{Q}{P}) 
    \,\implies\, (\while{(P\lor Q)}{(P \land Q)})}\]
\end{lemma}
% if this proof is restaured, one ref should be repointed
% \begin{proof}
% \step{<1>1}{\valid{((\while{P}{Q}) \land (\while{Q}{P}) \land P) 
%                  \implies (P \land Q)}}
% 	\begin{proof}
% 	\step{<2>1}{\valid{((\while{P}{Q}) \land 
%                     (\while{Q}{P}) \land P) \implies P}}
% 	\step{<2>2}{\valid{((\while{P}{Q}) \land 
%                     (\while{Q}{P}) \land P) \implies Q}}
% 		\begin{proof}
% 		\pf\ Lemma~\ref{lemma:2-of-appendix}(2).
% 		\qed
% 		\end{proof}
% 	\qedstep
% 	\end{proof}
% 
% \step{<1>2}{\valid{((\while{P}{Q}) \land (\while{Q}{P}) \land Q) 
%                     \implies (P \land Q)}}
% 	\begin{proof}
% 	\pf\ Exactly analogous to \stepref{<1>1}.
% 	\qed
% 	\end{proof}
% \step{<1>3}{\valid{((\while{P}{Q}) \land (\while{Q}{P}) 
%                  \land (P \lor Q)) \implies (P \land Q)}}
% \qedstep
% 	\begin{proof}
% 	\pf\ \stepref{<1>3} and Lemma~\ref{lemma:2-of-appendix}(2).
% 	\end{proof}
% \end{proof}


\begin{lemma} \label{lemma:QRS}
If $P_{i}$ and $Q_{i}$ are safety properties, for $i=1,\ldots,n$, then
  \vspace{-.5\baselineskip}
 \[ \valid{\BIGWEDGE_{i=1}^{n} (\whilep{P_{i}}{Q_{i}})  \,\implies\,
      (\whilep{(\BIGWEDGE_{i=1}^{n} P_{i})}{(\BIGWEDGE_{i=1}^{n} Q_{i})})}
\]
\end{lemma}

\begin{lemma}\label{lemma:RedArrow+}
If $P$ is a safety property and $Q$ is any property, then 
 \vspace{-.2\baselineskip}
\[ \valid{(\whilep{P}{Q}) = (\while{(\while{Q}{P})}{Q})} \]
\end{lemma}
% \begin{proof}
% \step{<1>1}{\valid{\whilep{P}{Q} \implies \while{(\while{Q}{P})}{Q}}}
%      \begin{proof}
%   \step{<2>1}{\valid{\whilep{P}{Q} \implies \while{(\while{Q}{P})}{Q}}}
% 
%   \step{<2>2}{\valid{\whilep{P}{Q} \implies \while{(\while{Q}{P})}{Q}}}
% 
%   \step{<2>3}{\valid{(\whilep{P}{\closure{Q}}) \land (P \implies Q) 
%    \land (\while{\closure{Q}}{P})\land (Q \implies P)  \implies Q}}
% 
%   \step{<2>4}{\valid{(\whilep{P}{Q}) \land (\while{Q}{P}) \implies Q}}
%     \pf\ By \stepref{<2>3}, Lemma~\ref{lemma:ArrowClosedImpl}, and assumption 
%     \toplevel (that $P$ is a safety property).
% 
%   \qedstep
%     \pf\ By \stepref{<2>4>} and Lemma....
%     \qed
% 
%      \end{proof}
% 
% \step{<1>2}{\valid{\while{(\while{Q}{P})}{Q}}\implies \whilep{P}{Q}}
% 
% 
% \end{proof}

%try
 \ifseparateappendix{}{\pagebreak}  %%%%%%%
\begin{lemma} \label{lemma:QRT}
\mbox{}
\assume{%
\begin{pfenum}
 \item $P$, $Q$, and $R$ are safety properties.
 \item \valid{Q \land R \implies P}
\end{pfenum}}
\prove{\valid{(\whilep{P}{Q}) \implies (\whilep{R}{Q})}}
\end{lemma}
\begin{proof}
  \step{<1>1}{\valid{(\while{Q}{R}) \implies (\while{Q}{P})}}
  \begin{proof}
    \step{<2>1}{\valid{Q \land (\while{Q}{R}) \implies R}}
      \begin{proof}
      \pf\ Lemma~\ref{lemma:2p-of-appendix}(1).
      \qed
      \end{proof}
    \step{<2>2}{\valid{Q \land (\while{Q}{R}) \implies (Q \land R)}}
      \begin{proof}
      \pf\ \stepref{<2>1} and propositional logic.
      \qed
      \end{proof}
    \step{<2>3}{\valid{Q \land (\while{Q}{R}) \implies P}}
      \begin{proof}
      \pf\ \stepref{<2>2} and assumption \toplevel:2.
      \qed
      \end{proof}
    \qedstep
      \begin{proof}
      \pf\ \stepref{<2>3}, assumption \toplevel:1,
   and Lemma~\ref{lemma:2-of-appendix}(2).
      \qed
      \end{proof}
  \end{proof}

   \step{<1>2}{\valid{(\whilep{P}{Q}) \land  ( \while{Q}{P})  \implies Q}}
    \begin{proof}
      \pf\ Assumption \toplevel:1, Lemma~\ref{lemma:RedArrow+}, and 
           Lemma~\ref{lemma:2p-of-appendix}(1).
      \qed
    \end{proof}

   \step{<1>3}{\valid{(\whilep{P}{Q}) \land (\while{Q}{R})  \implies Q}}
   \begin{proof}
    \pf\ \stepref{<1>2} and \stepref{<1>1}.
    \qed
   \end{proof}

   \step{<1>4}{\valid{(\whilep{P}{Q}) \implies (\while{(\while{Q}{R})}{Q})}}
   \begin{proof}
    \pf\ \stepref{<1>3}, assumption \toplevel:1, 
      and Lemma~\ref{lemma:2-of-appendix}.
    \qed
  \end{proof}

   \qedstep
   \begin{proof}
    \pf\ \stepref{<1>4}, assumption \toplevel:1, and Lemma~\ref{lemma:RedArrow+}.
    \qed
  \end{proof}
\end{proof}

%try
\subsection{Closure and Existential Quantification}

These results are useful for reasoning about the closure of a
quantified formula.  This reasoning can be difficult because \closureop\
and $\EE$ do not commute.

\begin{lemma}\label{lemma:1-of-appendix}
For any property $M$ and tuple of variables $x$,
 \vspace{-.2\baselineskip}
  \[\valid{\closure{\EE\,x:\closure{M}} = \closure{\EE\,x:M}}\]
\end{lemma}
\begin{proof}
\step{<1>1}{\valid{\closure{\EE\,x:M}\implies\closure{\EE\,x:\closure{M}}}}
\begin{proof}
\pf\ \closureop\ is \sd\ and both \closureop\ and $\EE x$ are monotonic.
  \qed
\end{proof} %%%{1}

\step{<1>2}{\valid{\closure{\EE\,x:\closure{M}}\implies\closure{\EE\,x:M}}}
\begin{proof}
  \step{<2>1}{\valid{M\implies\EE\,x:M}}
    \begin{proof}
      \pf\ $\EE$ is \sd.
      \qed
  \end{proof}
  \step{<2>2}{\valid{\closure{M}\implies \closure{\EE\,x:M}}}
  \begin{proof}
    \pf\ \stepref{<2>1} and the monotonicity of \closureop. \qed
  \end{proof}
  \step{<2>3}{\valid{(\EE\,x:\closure{M})\implies \closure{\EE\,x:M}}}
  \begin{proof}
    \pf\ \stepref{<2>2}, since $x$ does not occur free in \closure{\EE\,x:M}.
  \end{proof}
  \qedstep
  \begin{proof}
    \pf \stepref{<2>3} and the monotonicity and idempotence of \closureop. \qed
  \end{proof}
\end{proof}%%%{2}

\qedstep
\end{proof}

%\newpage %%%%%%%%
%try
%\marginalnote{Used only in proof of Proposition \ref{prop:proving-closure}.}
\begin{lemma} \mbox{}
 \label{lemma:existential-conjunction}
 %% Existential Conjunction Theorem of appendix.txt
\assume{$x_{i}$ is a tuple of variables, and no variable in $x_i$ occurs free in $M_{j}$, 
         for all $i,\,j\in\{1,\ldots,n\}$ with $i\neq j$.}
\prove{\valid{\bigwedge_{i} \closure{\EE\,x_{i}:M_{i}}
 \implies\closure{\EE\,x_{1},\ldots,x_{n}:\bigwedge_{i}\closure{M_{i}}}}}
\end{lemma}
\begin{proof}
The proof is by induction on $n$, setting apart the cases for $n=1$ and $n=2$.
\step{<1>1}{\case{$n=1$}}
\begin{proof}
  \pf\ Immediate from Lemma~\ref{lemma:1-of-appendix}. \qed
\end{proof}

\step{<1>2}{\case{n=2}}
\begin{proof}
  \pflet{$A$ $\deq$ \closure{\EE\,x_{1},\,x_{2}:\closure{M_{1}}\land 
         \closure{M_{2}}}}
  \step{<2>1}{\valid{\closure{M_{1}}\land \closure{M_{2}}\implies A}}
  \begin{proof}
    \pf\ Predicate logic, since \closureop\ is \sd. \qed
  \end{proof}
  \step{<2>2}{\valid{\closure{M_{1}}\implies(\while{\closure{M_{2}}}{A})}}
  \begin{proof}
    \pf\ \stepref{<2>1} and Lemma~\ref{lemma:2-of-appendix}(2). \qed
  \end{proof}
  \step{<2>3}{\valid{M_{1}\implies(\while{\closure{M_{2}}}{A})}}
   \begin{proof}
      \pf\ \stepref{<2>2}, since \closureop\ is \sd. \qed
   \end{proof}
  \step{<2>4}{\valid{(\EE\,x_{1}:M_{1})\implies(\while{\closure{M_{2}}}{A})}}
   \begin{proof}
     \pf\ \stepref{<2>3} and the hypothesis that no variable of $x_{1}$
      occurs free in $M_{2}$. \qed
   \end{proof}

   \step{<2>5}{\valid{\closure{\EE\,x_{1}:M_{1}}
                \implies(\while{\closure{M_{2}}}{A})}}
   \begin{proof}
      \pf\ \stepref{<2>4} and the monotonicity and idempotence of
      \closureop, since $A$ is closed by definition and 
      \while{\closure{M_{2}}}{A} is
      closed by Lemma~\ref{lemma:2-of-appendix}(1).  \qed
   \end{proof}

   \step{<2>6}{\valid{\closure{M_{2}} \implies 
                (\while{\closure{\EE\,x_{1}:M_{1}}}{A})}}
   \begin{proof}
      \pf\ \stepref{<2>5} and two applications of
      Lemma~\ref{lemma:2-of-appendix}(2)
   \end{proof}

   \step{<2>7}{\valid{M_{2} \implies 
                   (\while{\closure{\EE\,x_{1}:M_{1}}}{A})}}
   \begin{proof}
      \pf\ \stepref{<2>6}, since \closureop\ is \sd.
   \end{proof}
   \step{<2>8}{\valid{(\EE\,x_{2}:M_{2}) \implies 
                      (\while{\closure{\EE\,x_{1}:M_{1}}}{A})}}
   \begin{proof}
    \pf\ \stepref{<2>7} and predicate logic. \qed
   \end{proof}
   \step{<2>9}{\valid{\closure{\EE\,x_{2}:M_{2}} \implies 
                      (\while{\closure{\EE\,x_{1}:M_{1}}}{A})}}
   \begin{proof}
      \pf\ \stepref{<2>8}, Lemma~\ref{lemma:2-of-appendix}(1),
       and the monotonicity and idempotence of \closureop. \qed
   \end{proof}

   \qedstep
   \begin{proof}
      \pf\ \stepref{<2>9} and Lemma~\ref{lemma:2-of-appendix}(2).
   \end{proof}
\end{proof} %%%2

\step{<1>3}{\case{$n>2$}}
\begin{proof}
\assume{\valid{\bigwedge_{i=1}^{n-1}\closure{\EE\, x_{i} : M_{i}} \implies 
   \closure{\EE\, x_{1} \ldots x_{n-1} : \bigwedge_{i=1}^{n-1}
 \closure{M_{i}}}}}
 \vspace{\jot}
\prove{\valid{\bigwedge_{i=1}^{n}\closure{\EE\, x_{i} : M_{i}} \implies 
   \closure{\EE\, x_{1} \ldots x_{n} : \bigwedge_{i=1}^{n}
 \closure{M_{i}}}}}
\begin{proof}
\begin{tabbing}
\pf\ 
\makebox[0pt][l]{$\bigwedge_{i=1}^{n}\closure{\EE\, x_{i} : M_{i}}$}$\;\;$\=\+
   \\*
$\implies \;\;$\=
   $\closure{\EE\, x_{1} \ldots x_{n-1} : 
      \bigwedge_{i=1}^{n-1} \closure{M_{i}}} \land
    \closure{\EE\, x_{n} :  M_{n}}$\\*
  \> $\;\;$\hspace{1em}\= \mbox{by assumption \levelref{<1>3}}\\
$=$ \>
   $\closure{\EE\, x_{1} \ldots x_{n-1} : 
      \closure{\bigwedge_{i=1}^{n-1} \closure{M_{i}}}} \land
    \closure{\EE\, x_{n} :  M_{n}} $\\*
   \> \> \mbox{a conjunction of safety properties  is a safety
                         property}\\
 $\implies$ \>
$\closure{\EE\, x_{1} \ldots x_{n} : 
      \closure{\bigwedge_{i=1}^{n-1} \closure{M_{i}}} \land
      \closure{M_{n}}}$\\*
   \> \> \mbox{by \stepref{<1>2}}\\
$=$ \> $\closure{\EE\, x_{1} \ldots x_{n} : \bigwedge_{i=1}^{n}
 \closure{M_{i}}}$\\*
  \>\> \mbox{a conjunction of safety properties  is a safety property}
\end{tabbing}
%\pf\ 
%$\begin{array}[t]{@{}l@{\;\;}l@{}}
%\makebox[0pt][l]{$\bigwedge_{i=1}^{n}\closure{\EE\, x_{i} : M_{i}}$}\\
%\;\;\implies & 
%   \closure{\EE\, x_{1} \ldots x_{n-1} : 
%      \bigwedge_{i=1}^{n-1} \closure{M_{i}}} \land
%    \closure{\EE\, x_{n} :  M_{n}}\\
%  & \hspace{1em}\mbox{by assumption \levelref{<1>3}}\\
%\;\;= &
%   \closure{\EE\, x_{1} \ldots x_{n-1} : 
%      \closure{\bigwedge_{i=1}^{n-1} \closure{M_{i}}}} \land
%    \closure{\EE\, x_{n} :  M_{n}} \\
%   & \hspace{1em}\mbox{a conjunction of safety properties  is a safety
%                         property}\\
% \;\;\implies & 
%\closure{\EE\, x_{1} \ldots x_{n} : 
%      \closure{\bigwedge_{i=1}^{n-1} \closure{M_{i}}} \land
%      \closure{M_{n}}}\\
%   & \hspace{1em}\mbox{by \stepref{<1>2}}\\
%\;\;= & \closure{\EE\, x_{1} \ldots x_{n} : \bigwedge_{i=1}^{n}
% \closure{M_{i}}}\\
% & \hspace{1em}\mbox{a conjunction of safety properties  is a safety property}
%\end{array}$
\end{proof}
\end{proof}
\qedstep
\end{proof} % of lemma
%try

\noindent{\sc Proposition \ref{prop:proving-closure}.}
\begin{it}
\assume{\begin{pfenum}
\item $x_{i}$ is a tuple of variables, and no variable in $x_i$ occurs free in $M$ or $M_{j}$,
   for all $i,\,j\in\{1,\ldots,n\}$ with $i\neq j$
\item \valid{\bigwedge_{i=1}^{n}\closure{M_{i}}
          \implies \EE\,x : \closure{M}}
\end{pfenum}}
\prove{\valid{\bigwedge_{i=1}^{n}\closure{\EE\,x_{i} : M_{i}}
        \implies \closure{\EE\,x : M}}}
\end{it}
\begin{proof}
\pf\ $\begin{array}[t]{@{}l@{\;\;}l@{}}
\makebox[0pt][l]{$\bigwedge_{i=1}^{n}\closure{\EE\, x_{i} : M_{i}}$}\\
\;\;\implies & \closure{\EE\,x_{1}\ldots x_{n}:  
             \bigwedge_{i=1}^{n}\closure{M_{i}}}\\
 & \pfcomment{by Lemma~\ref{lemma:existential-conjunction} and 
                   assumption~\toplevel:1}\\
\;\;\implies &\closure{\EE\,x_{1}\ldots x_{n}: 
           \EE\,x : \closure{M}}\\
& \pfcomment{by assumption \toplevel:2 and 
                     the monotonicity of $\EE$ and \closureop}\\
\;\;=& \closure{\EE\,x : \closure{M}}\\
& \pfcomment{by assumption \toplevel:1}\\
\;\;=& \closure{\EE\,x : M}\\
& \pfcomment{by Lemma~\ref{lemma:1-of-appendix}.~~~\qed}
\end{array}$
\end{proof}

%try
\subsection{Properties of \protect\plusop}

%\marginalnote{Used only in proof of Lemma \ref{lemma:ABX}.}
\begin{lemma} \label{lemma:+Closes}
For any state function $f$,
if $P$ is a safety property, then $\plus{f}{P}$ is a safety property.
\end{lemma}
\begin{proof}
\pf\ By the definition of safety properties, it suffices to:
\assume{\begin{pfenum}
          \item $P$ a safety property.
          \item $\forall  n : \prefix{\sigma}{n} \validop \plus{f}{P}$
        \end{pfenum}}
\prove{$\sigma \validop \plus{f}{P}$}
\step{<1>1}{\case{$\forall  n : \prefix{\sigma}{n} \validop P$}}
  \begin{proof}
   \pf\ Assumption \toplevel:1.
   \qed
  \end{proof}
\step{<1>2}{\case{$\EE  n : \lnot (\prefix{\sigma}{n} \validop P)$}}
  \begin{proof}
     \step{<2>1}{Choose the largest $m$ such that
                 $\prefix{\sigma}{m} \validop P$.}
     \begin{proof}
      \pf\ $m$ exists since $\prefix{\sigma}{0} \validop P$ is
      true for any $\sigma$ and $P$.
      \qed
    \end{proof}

     \step{<2>2}{$\forall  n > m : \M{f}(\sigma_n) = \M{f}(\sigma_{m+1})$}
     \begin{proof}
      \pf\ \stepref{<2>1}, assumption \toplevel:2, and the
       definition of \plus{f}{P}.
      \qed
    \end{proof}

    \qedstep
    \begin{proof}
      \pf\ \stepref{<2>1}, \stepref{<2>2}, and the definition of
       \plus{f}{P}.
      \qed
    \end{proof}
  \end{proof}%%%{2}
\qedstep
\end{proof}

%try
 \ifseparateappendix{\pagebreak}{}
\begin{lemma} \label{lemma:factoid-F+1} \mbox{}
\assume{\begin{pfenum}
  \item $P$ and $Q$ are safety properties.
  \item the tuple $x$ includes all the free variables of $Q$.
\end{pfenum}}
\prove{\valid{(\while{\plus{x}{P}}{Q}) \;=\; (\whilep{P}{Q})}}
\end{lemma}
\begin{proof}
\step{<1>1}{\valid{(\while{\plus{x}{P}}{Q}) \;\implies\; (\whilep{P}{Q})}}
\begin{proof}
  By assumption \toplevel:1, Lemma~\ref{lemma:2-of-appendix}(1),
  and the definition of \whilepop, it suffices to:
  \assume{\begin{pfenum}
            \item For all $n$, 
                   $\prefix{\sigma}{n} \validop (\while{\plus{x}{P}}{Q})$
            \item $\prefix{\sigma}{n-1} \validop P$
          \end{pfenum}}
  \prove{$\prefix{\sigma}{n} \validop Q$}
  \step{<2>1}{$\prefix{\sigma}{n} \validop \plus{x}{P}$}
  \begin{proof}
    \pf\ By assumption \levelref{<1>1}:2 and the definition of $\plus{x}{P}$.
    \qed
  \end{proof}
  \qedstep
  \begin{proof}
    \pf\ \stepref{<2>1} 
  and assumption \levelref{<1>1}:1.
    \qed
  \end{proof}
\end{proof}%%%{<1>1}
\step{<1>2}{\valid{(\whilep{P}{Q})\;\implies\;(\while{\plus{x}{P}}{Q})}}
\begin{proof}
  By assumption \toplevel:1, Lemmas~\ref{lemma:+Closes} and
  \ref{lemma:2-of-appendix}(1), and the definition of \whileop,
it suffices to:
  \assume{\begin{pfenum}
           \item For all $n$, $\prefix{\sigma}{n} \validop (\whilep{P}{Q})$
           \item $\prefix{\sigma}{n} \validop \plus{x}{P}$
          \end{pfenum}}
  \prove{$\prefix{\sigma}{n} \validop Q$} 
  \step{<2>1}{Choose $m \leq n$ such that
              \begin{pfenum}
                \item $\prefix{\sigma}{m} \validop P$ 
                \item $\forall  p : m < p \leq n 
                            \implies \M{x}(\sigma_p) = \M{x}(\sigma_{m+1})$
               \end{pfenum}}
   \begin{proof}
    \pf\ Assumption \levelref{<1>2}:2.
    \qed
  \end{proof}
  \step{<2>2}{$\prefix{\sigma}{m+1} \validop Q$}
  \begin{proof}
    \pf\ \stepref{<2>1}.1 and assumption \levelref{<1>2}:1.
    \qed
  \end{proof}
  \qedstep
  \begin{proof}
    \pf\ \stepref{<2>2}, \stepref{<2>1}.2,  and assumption~\toplevel:2,
    since $Q$ is invariant under stuttering.
    \qed
  \end{proof}
\end{proof}%%%{<1>2}
\qedstep
\end{proof}



%try
%\marginalnote{Used only in proof of Theorem \ref{thm:composition}.}
\begin{lemma} \label{lemma:ABX}
 \mbox{}
\assume{\begin{pfenum}
    \item $P$, $Q$, and $R$ are safety properties.
    \item \valid{\plus{f}{R} \land P \implies Q}
   \end{pfenum}}
\prove{\valid{(\whilep{R}{P}) \implies (\whilep{R}{Q})}}
\end{lemma}
\begin{proof}
   \step{<1>1}{\valid{\whilep{R}{\plus{f}{R}}}}
    \begin{proof}
      By assumption \toplevel:1 and Lemmas \ref{lemma:+Closes}
      and \ref{lemma:2-of-appendix}, it suffices to:      
      \assume{$\prefix{\sigma}{n}   \validop R$}
      \prove{$\prefix{\sigma}{n+1} \validop \plus{f}{R}$}
      \step{<2>1}{$\prefix{\sigma}{n+1} \circ 
    \tuple{\sigma_{n+1},\, \sigma_{n+1},\ldots }
                   \validop \plus{f}{R}$}
        \begin{proof}
          \pf\  The definition of \plus{f}{R}.
          \qed
        \end{proof}
      \qedstep
    \end{proof}%%%{1}
\qedstep
\begin{proof}
\pf\ $(\whilep{R}{P})\;\;\begin{array}[t]{@{}l@{\;\;}l@{}}
\implies & (\whilep{R}{P}) \land (\whilep{R}{\plus{f}{R}})\\
   & \pfcomment{by \stepref{<1>1}}\\
\implies & (\whilep{R}{(P \land \plus{f}{R})})\\
   & \pfcomment{by  assumption \toplevel:1 and Lemmas \ref{lemma:QRS}
        and \ref{lemma:+Closes}}\\
\implies & (\whilep{R}{Q})\\
   & \pfcomment{by assumption~\toplevel:2 and monotonicity of \whilepop\ in}\\ 
   & \pfcomment{its second argument. \ \ \qed}
\end{array}$
\end{proof} 
\end{proof}

%try
%\marginalnote{Used only in proof of Proposition \ref{prop:prop-plus}.}
\begin{lemma}
\label{lemma:plusone}
\mbox{}
\assume{No variable of the tuple $x$ occurs free in $v$.}
\prove{$\valid{(\EE  x : \plus{v}{P}) = \plus{v}{(\EE x : P)}}$}
\end{lemma}
\begin{proof}
\step{<1>1}{$\valid{(\EE  x : \plus{v}{P}) \implies \plus{v}{(\EE x : P)}}$}
  \begin{proof}
  \assume{$\sigma \validop (\EE  x : \plus{v}{P})$}
  \prove{$\sigma \validop \plus{v}{(\EE x : P)}$}
  \step{<2>1}{Choose $\newsigma$ such that $\newsigma \vseqv{x} \sigma$ and
                    $\newsigma \validop \plus{v}{P}$.}
    \begin{proof}
    \pf\ Assumption \levelref{<1>1} and the definition of $\EE$.
    \qed
    \end{proof}
  \step{<2>2}{\case{$\newsigma \validop P$}}
    \begin{proof}
    \step{<3>1}{$\sigma \validop (\EE  x : P)$}
      \begin{proof}
      \pf\ \stepref{<2>1} and case assumption \levelref{<2>2}.
      \qed
      \end{proof}      
    \qedstep
      \begin{proof}
      \pf\ \stepref{<3>1} and the definition of \plus{v}{(\ldots)}.
      \qed
      \end{proof}      
    \end{proof}
  \step{<2>3}{\case{There exists $\newrho$ and $\newtau$ such that
      $\newsigma = \newrho \circ \newtau$, $\newrho \validop P$, and
      $\newtau \validop \Box\,\sqact{\false}{v}$.}}
    \begin{proof}
    \step{<3>1}{Choose $\rho$ and $\tau$ such that $\sigma = \rho \circ \tau$,
                 $\rho \vseqv{x} \newrho$, and $\tau \vseqv{x} \newtau$.}
      \begin{proof}
      \pf\ \stepref{<2>1} and case assumption \levelref{<2>3}.
      \qed
      \end{proof}    
    \step{<3>2}{$\rho \validop \EE  x : P$}
      \begin{proof}
      \pf\ \stepref{<3>1} 
      (which asserts $\rho \vseqv{x} \newrho$)
      and case assumption \levelref{<2>3}
      (which asserts $\newrho \validop P$).
      \qed
      \end{proof}      
    \step{<3>3}{$\tau \validop \Box\,\sqact{\false}{v}$}
      \begin{proof}
      \pf\ \stepref{<3>1} (which asserts $\tau \vseqv{x} \newtau$), 
      case assumption \levelref{<2>3} 
      (which asserts $\newtau \validop \Box\,\sqact{\false}{v}$), 
      and assumption \toplevel.
      \qed
      \end{proof}
    \qedstep
      \begin{proof}
      \pf\ \stepref{<3>1} (which asserts $\sigma = \rho \circ \tau$),
           \stepref{<3>2}, \stepref{<3>3}, and the definition of 
        \plus{v}{(\ldots)}.
      \qed
      \end{proof}      
    \end{proof}      
  \qedstep
    \begin{proof}
    \pf\ \stepref{<2>1}, \stepref{<2>2}, 
         \stepref{<2>3}, and the definition of \plus{v}{(\ldots)}.
    \qed
    \end{proof}      
  \end{proof}        
\step{<1>2}{$\valid{\plus{v}{(\EE x : P)}\implies (\EE  x : \plus{v}{P})}$}
  \assume{$\sigma \validop \plus{v}{(\EE x : P)}$}
  \prove{$\sigma \validop (\EE  x : \plus{v}{P})$}
    \begin{proof}
    \step{<2>1}{\case{$\sigma \validop (\EE  x : P)$}}
      \begin{proof}
      \pf\ Immediate, since $\valid{P \implies \plus{v}{P}}$ and $\EE$ is 
        monotonic.
      \qed
      \end{proof}      
    \step{<2>2}{\case{There exist $\rho$ and $\tau$ such that
      $\sigma = \rho \circ \tau$, $\rho \validop \EE  x: P$, and 
      $\tau \validop \Box\,\sqact{\false}{v}$.}}
      \begin{proof}
      \step{<3>1}{Choose $\newrho$ such that $\newrho \vseqv{x} \rho$
                                    and $\newrho \validop P$.}
        \begin{proof}
        \pf\ Case assumption \levelref{<2>2} and the definition of $\EE$.
        \qed
        \end{proof}      
      \step{<3>2}{$\newrho \circ \tau \validop \plus{v}{P}$}
        \begin{proof}
        \pf\ \stepref{<3>1}, case assumption \levelref{<2>2}
        (which asserts $\tau \validop \Box\,\sqact{\false}{v}$), 
        and the definition of \plus{v}{(\ldots)}.
        \qed
        \end{proof}      
      \qedstep
        \begin{proof}
        \pf\ \stepref{<3>1}, \stepref{<3>2}, and case assumption 
           \levelref{<2>2}, 
          which imply $\newrho \circ \tau \vseqv{x} \sigma$.~\qed
        \end{proof}      
      \end{proof}
    \qedstep
      \begin{proof}
      \pf\ \stepref{<2>1}, \stepref{<2>2}, and the definition of 
           \plus{v}{(\ldots)}.
      \qed
      \end{proof}      
  \end{proof}
\qedstep
\end{proof}

%try



% define \newsig to be similar to \sigma, like sig~ to sig, etc. for rho, tau

%\marginalnote{Used only in proof of Proposition \ref{prop:prop-plus}.}
\begin{lemma}
\label{lemma:plustwo}
If $s$ is a variable that does not occur in \init, \act{N}, $w$, or $v$, 
and 
 \[ 
\begin{array}{@{}l@{\;\;\deq\;\;}l@{}}
\widehat{\init} & (\init\land(s=0) )\,\lor\,(\lnot\init\land(s=1))\\[\jot]
\widehat{\act{N}} & 
  \begin{array}[t]{@{\lor\;}l@{}}
       (s=0)\,\land\,
     \begin{array}[t]{@{\lor\;}l@{}}
          (s'=0) \land(\act{N}\lor(w'=w))\\
         (s'=1)\land\lnot(\act{N}\lor(w'=w))
     \end{array}
   \\
       (s=1) \,\land\, (s'=1)\land (v'=v)
   \end{array}
\end{array} 
\]
then  \ \valid{\plus{v}{(\init\land\Box\sqact{N}{w})}
   \;=\; \EE s : \widehat{\init}
      \land\Box\sqact{{}\widehat{\act{N}}}{\tuple{w,\,v,\,s}}}.
\end{lemma}
\begin{proof}
\step{<1>1}{\valid{\plus{v}{(\init\land\Box\sqact{N}{w})}
         \implies \EE s : \widehat{\init}
         \land\Box\sqact{{}\widehat{\act{N}}}{\tuple{w,\,v,\,s}}}}
  \assume{$\sigma \validop \plus{v}{(\init\land\Box\sqact{N}{w})}$}
  \prove{$\sigma \validop \EE s : \widehat{\init}
          \land\Box\sqact{{}\widehat{\act{N}}}{\tuple{w,\,v,\,s}}$}
  \begin{proof}

  \pflet{$\newsigma$ be the behavior such that 
          $\newsigma \sequalv{s} \sigma$ and, for all $n>0$:
   \[ \M{s}(\newsigma_n) \;\;\deq\;\;
    {\bf if}\;\;
    \prefix{\sigma}{n} \validop (\init\land\Box\sqact{N}{w})\;\;
     {\bf then}\;\;0\;\; {\bf else}\;\;1\]}

   \vspace{\jot}
  \step{<2>1}{$\newsigma \validop \widehat{\init}
                \land\Box\sqact{{}\widehat{\act{N}}}{\tuple{w,\,v,\,s}}$}
    \begin{proof}
    \step{<3>1}{$\newsigma \validop \widehat{\init}$}
      \begin{proof}
      \pf\ The definitions of $\newsigma$ and $\widehat{\init}$, assumption
        \levelref{<1>1}, and the hypothesis that $s$ does not occur in $\init$.
      \end{proof}
    \step{<3>2}{$\newsigma \validop 
         \Box\sqact{{}\widehat{\act{N}}}{\tuple{w,\,v,\,s}}$}
      \begin{proof}
      \step{<4>1}{\case{$\sigma \validop \init\land\Box\sqact{N}{w}$}}
        \begin{proof}
        \step{<5>1}{$\newsigma \validop 
          \Box\sqact{{}(s=0) \land (s'=0) 
          \land (\act{N} \lor (w'=w))}{\tuple{w,\,v,\,s}}$}
          \begin{proof}
          \pf\ The definition of $\newsigma$, case assumption \levelref{<4>1},
          and the hypothesis that $s$ does not occur in $\act{N}$ or~$w$.
          \qed
          \end{proof}
        \qedstep
          \begin{proof}
          \pf\ \stepref{<5>1} and the definition of $\widehat{\act{N}}$.
          \qed
          \end{proof}
        \end{proof}
      \step{<4>2}{\case{$\sigma \not\validop \init$}}
        
        \begin{proof}
        \step{<5>1}{$\sigma \validop \Box\,\sqact{\false}{v}$}
          \begin{proof}
           \pf\ Case assumption \levelref{<4>2}, assumption \levelref{<1>1},
           and the definition of \plus{v}{(\ldots)}.
           \qed
          \end{proof}
        \step{<5>2}{$\newsigma \validop \Box\,(s=1) \land 
          \Box\,\sqact{\false}{v}$.}
          \begin{proof}
          \pf\ \stepref{<5>1} and the definition of $\newsigma$.
          \qed
          \end{proof}
        \qedstep
          \begin{proof}
          \pf\ \stepref{<5>2} and the definition of $\widehat{\act{N}}$.
          \qed
          \end{proof}
        \end{proof}
      \step{<4>3}{\case{$\sigma \validop \init$ and
                  $\sigma \not\validop \init\land\Box\sqact{N}{w}$.}}
        \begin{proof}
         \step{<5>1}{Choose $\rho$ and $\tau$ with $\length{\rho}>0$ such 
                    that
         \begin{pfenum}
           \item $\sigma = \rho \circ \tau$, 
           \item $\rho \validop \init\land\Box\sqact{N}{w}$
           \item $\rho\circ\tuple{\tau_{1}}\not\validop\Box\sqact{N}{w}$
           \item $\tau \validop \Box\,\sqact{\false}{v}$
          \end{pfenum}}
            \begin{proof}
               \pf\  Case assumption \levelref{<4>3}, assumption
               \levelref{<1>1}, and the definition of
                \plus{v}{(\ldots)}. \qed
            \end{proof}
        \step{<5>2}{Choose $\newrho$ and $\newtau$ such that
        $\newsigma = \newrho \circ \newtau$, $\newrho \sequalv{s} \rho$, and
        $\newtau \sequalv{s} \tau$.}
          \begin{proof}
          \pf\ The definition of $\newsigma$ and 
                 \stepref{<5>1}.1.
          \end{proof}
        \step{<5>3}{$\newrho \validop \Box\sqact{{}(s=0) \land (s'=0) 
          \land (\act{N} \lor (w'=w))}{\tuple{w,\,v,\,s}}$}
          \begin{proof}
          \pf\ The definition of $\newsigma$, \stepref{<5>1}.2, 
          \stepref{<5>2}, and the hypothesis that $s$ does not occur 
           in $\act{N}$ or~$w$.
          \qed
          \end{proof}
        \step{<5>4}{$\tuple{\last{\newrho},\, \newtau_1} \validop 
          (s=0) \land (s'=1) \land \lnot\act{N} \land (w' \neq w)$}
          \begin{proof}
          \pf\ The definition of $\newsigma$, \stepref{<5>1}.3, 
             \stepref{<5>2},  and
              the hypothesis that $s$ does not occur in $\act{N}$ or~$w$.
          \qed
          \end{proof}
        \step{<5>5}{$\newtau \validop \Box\,(s=1) \land 
          \Box\,\sqact{\false}{v}$}
          \begin{proof}
          \pf\ The definition of $\newsigma$,, \stepref{<5>1}.4, 
            \stepref{<5>2},
          and the hypothesis that $s$ does not occur in~$v$.
          \qed
          \end{proof}
        \qedstep
          \begin{proof}
          \pf\ \stepref{<5>2}, \stepref{<5>3}, \stepref{<5>4}, and 
          \stepref{<5>5}, and
          the definition of $\widehat{\act{N}}$.
          \qed
          \end{proof}
        \end{proof}
      \qedstep
        \begin{proof}
        \pf\ \stepref{<4>1}, \stepref{<4>2},  \stepref{<4>3}, 
        assumption \levelref{<1>1}, and the definition
        of \plus{v}{(\ldots)}.~\qed
        \end{proof}  
      \end{proof}
    \qedstep
    \end{proof}
  \qedstep
    \begin{proof}
    \pf\ The definition of $\newsigma$, \stepref{<2>1}, and
         the definition of $\EE$.
    \end{proof}
  \end{proof}

\addvspace{\jot}

\step{<1>2}{\valid{\EE s : \widehat{\init}
  \land\Box\sqact{{}\widehat{\act{N}}}{\tuple{w,\,v,\,s}}
     \implies 
  \plus{v}{(\init\land\Box\sqact{N}{w})}}}
  \assume{$\sigma \validop \EE s : \widehat{\init}
          \land\Box\sqact{{}\widehat{\act{N}}}{\tuple{w,\,v,\,s}}$}
  \prove{$\sigma \validop \plus{v}{(\init\land\Box\sqact{N}{w})}$}
  \begin{proof} 
  \step{<2>1}{Choose  $\newsigma$ such that $\newsigma \vseqv{s} \sigma$ and 
    $\newsigma \validop \widehat{\init}
    \land\Box\sqact{{}\widehat{\act{N}}}{\tuple{w,\,v,\,s}}$.}
    \begin{proof}
    \pf\ Assumption \levelref{<1>2} and the definition of $\EE$.
    \qed
    \end{proof}
  \step{<2>2}{$\newsigma \validop \plus{v}{(\init\land\Box\sqact{N}{w})}$}
    \begin{proof}
    \step{<3>1}{\case{$\newsigma \validop \Box\,(s=0)$}}
      \begin{proof}
      \step{<4>1}{$\newsigma \validop (\init\land\Box\sqact{N}{w})$}
        \begin{proof}
        \pf\ \stepref{<2>1}, case assumption \levelref{<3>1}, and 
        the definitions of $\widehat{\init}$ and $\widehat{\act{N}}$.
        \qed
        \end{proof}
      \qedstep
        \begin{proof}
        \pf\ \stepref{<4>1}, since the operator \plus{v}{(\ldots)} is \sd.
        \qed
        \end{proof}
      \end{proof}
    \step{<3>2}{\case{$\newsigma \validop \Box\,(s=1)$}}
      \begin{proof}
      \step{<4>1}{$\newsigma \validop \Box\,\sqact{\false}{v}$}
        \begin{proof}
        \pf\ \stepref{<2>1}, the definition of $\widehat{\act{N}}$, and 
        case assumption \levelref{<3>2}.
        \qed
        \end{proof}
      \qedstep
        \begin{proof}
        \pf\ \stepref{<4>1} and the definition of \plus{v}{(\ldots)}.
        \qed
        \end{proof}
      \end{proof}
    \step{<3>3}{\case{$\newsigma \not\validop \Box\,(s=0)$
                     and $\newsigma \not\validop \Box\,(s=1)$}}
      \begin{proof}
     \step{<4>1}{Choose $\newrho$ and $\newtau$ with $\length{\newrho} > 0$
                 such that 
         \begin{pfenum}
           \item $\newsigma = \newrho \circ \newtau$
           \item $\newrho \validop \Box\,(s=0)$
           \item $\newtau \validop \Box\,(s=1)$, 
          \end{pfenum}}
         \begin{proof}
           \pf\ Case assumption \levelref{<3>3}, \stepref{<2>1},
            and the definitions of $\widehat{\init}$ and $\widehat{\act{N}}$.
           \qed
         \end{proof}
      \step{<4>2}{$\newrho \validop (\init\land\Box\sqact{N}{w})$}
        \begin{proof}
        \pf\ \stepref{<2>1}, \stepref{<4>1}.2, and the definitions of 
         $\widehat{\init}$ and
        $\widehat{\act{N}}$.
        \qed
        \end{proof}
      \step{<4>3}{$\newtau \validop \Box\,\sqact{\false}{v}$}
        \begin{proof}
        \pf\ \stepref{<2>1}, \stepref{<4>1}.3, and the definition 
          of $\widehat{\act{N}}$.
        \qed
        \end{proof}
      \qedstep
        \begin{proof}
        \pf\ \stepref{<4>1}.1, \stepref{<4>2}, \stepref{<4>3}, \levelref{<3>3}, 
        and the definition of \plus{v}{(\ldots)}.
        \qed
        \end{proof}
      \end{proof}
    \qedstep
    \end{proof}
  \qedstep
    \begin{proof}
    \pf\ \stepref{<2>1}, \stepref{<2>2}, and
    the hypothesis that $s$ does not occur in $\init$, $\act{N}$, $w$,
    or~$v$.
    \qed
    \end{proof}
  \end{proof}
\qedstep
\end{proof}      

%try
\noindent{\sc Proposition \ref{prop:prop-plus}.}
\begin{it}
If $x$ is a tuple of variables none of which occurs in $v$, and $s$ is
a variable that does not occur in \init, \act{N}, $w$, $v$, or $x$,
and
 \[ 
\begin{array}{@{}l@{\;\;\deq\;\;}l@{}}
\widehat{\init} & (\init\land(s=0) )\,\lor\,(\lnot\init\land(s=1))\\[\jot]
\widehat{\act{N}} & 
  \begin{array}[t]{@{\lor\;}l@{}}
       (s=0)\,\land\,
     \begin{array}[t]{@{\lor\;}l@{}}
          (s'=0) \land(\act{N}\lor(w'=w))\\
         (s'=1)\land\lnot(\act{N}\lor(w'=w))
     \end{array}
   \\
       (s=1) \,\land\, (s'=1)\land (v'=v)
   \end{array}
\end{array} 
\]
then  \ \valid{\plus{v}{(\EE\, x: \init\land\Box\sqact{N}{w})}
   \;=\; \EE\, x, s : \widehat{\init}
      \land\Box\sqact{{}\widehat{\act{N}}}{\tuple{w,\,v,\,s}}}.
\end{it}

\begin{proof}
\pf\ Follows immediately from Lemmas~\ref{lemma:plusone} 
and~\ref{lemma:plustwo}.
\qed
\end{proof}      

%try
\subsection{Properties of $\perp$}


\begin{lemma} \label{lemma:factoid-Perp1}\label{lemma:Factoid-Perp2}
\mbox{}
\begin{enumerate*}
\item For any properties $P$ and $Q$, 
\valid{P \perp Q = \closure{P} \perp \closure{Q}}.
\item If $P$ and $Q$ are safety properties, then
\valid{P \perp Q = \whilep{(P \land Q)}{(P \lor Q)}}.
\end{enumerate*}
\end{lemma}

%try

%\marginalnote{Used only in proof of Proposition \ref{prop:perp-plus}.}
\begin{lemma} \label{lemma:Factoid-Perp3}
 For any properties $P$ and $Q$,
\vspace{-.5\baselineskip}
  \[\valid{(\whilep{P}{Q}) \,=\, (\while{P}{Q}) \land (P \perp Q)}\]
\end{lemma}
\begin{proof}
  \step{<1>1}{\case{$P$ and $Q$ safety properties}}
  \begin{proof}
    \step{<2>1}{\valid{(\whilep{P}{Q}) \implies
                (\while{P}{Q}) \land (P \perp Q)}}
    \begin{proof}
       \step{<3>1}{\valid{(\whilep{P}{Q}) \implies (\while{P}{Q})}}
        \begin{proof}
          \pf\ Obvious from the definitions of \whileop\ and \whilepop.
          \qed
        \end{proof}
       \step{<3>2}{\valid{(\whilep{P}{Q}) \implies (P \perp Q)}}
       \begin{proof}
          \pf\ Lemma~\ref{lemma:factoid-Perp1}(2), since
           \whilepop\ is monotonic in its second argument and
           antimonotonic in its first.
          \qed
       \end{proof}
       \qedstep
     \end{proof}%%%{1-1}

    \step{<2>2}{\valid{ (\while{P}{Q}) \land (P \perp Q)
                 \;\implies\; (\whilep{P}{Q})}}
     \begin{proof}
	\step{<3>1}{\valid{ (\while{P}{Q}) \land (P \perp Q) 
                              \land (\while{Q}{P}) \;\implies\; Q}}
	\begin{proof}
        \begin{tabbing}
 	\pf\\
        $(P \perp Q) \land (\while{P}{Q}) \land (\while{Q}{P})$\\
         $\;\;$\=\+$\implies\;\;$\=\kill
         $=$ \> $(\while{(\while{(P \lor Q)}{(P \land Q)})}{(P \lor Q)}) 
             \land (\while{P}{Q}) \land (\while{Q}{P})$\\*
         \> \pfcomment{case assumption~\levelref{<1>1}, 
                     Lemma~\ref{lemma:factoid-Perp1}(2), and 
                     Lemma~\ref{lemma:RedArrow+}}\\
        $\implies$ \> $(\while{(\while{(P \lor Q)}{(P \land Q)})}{(P \lor Q)}) 
             \land (\while{(P\lor Q)}{(P \land Q)})$\\*
        \> \pfcomment{by Lemma~\ref{lemma:ArrowNew}}\\
        $\implies$ \> $(P \lor Q) \land (\while{(P\lor Q)}{(P \land Q)})$\\*
        \> \pfcomment{by Lemma~\ref{lemma:2p-of-appendix}(1)}\\
        $\implies$ \> $Q$  \\
        \> \pfcomment{by Lemma~\ref{lemma:2p-of-appendix}(1). \ \qed}
        \end{tabbing}
%        $\begin{array}{@{\;\;}l@{\;\;}l@{}}
%         = & (\while{(\while{(P \lor Q)}{(P \land Q)})}{(P \lor Q)}) 
%             \land (\while{P}{Q}) \land (\while{Q}{P})\\
%        & \pfcomment{case assumption~\levelref{<1>1}, 
%                     Lemma~\ref{lemma:factoid-Perp1}(2), and 
%                     Lemma~\ref{lemma:RedArrow+}}\\
%        \implies & (\while{(\while{(P \lor Q)}{(P \land Q)})}{(P \lor Q)}) 
%             \land (\while{(P\lor Q)}{(P \land Q)})\\
%        & \pfcomment{by Lemma~\ref{lemma:ArrowNew}}\\
%        \implies & (P \lor Q) \land (\while{(P\lor Q)}{(P \land Q)})\\
%        & \pfcomment{by Lemma~\ref{lemma:2p-of-appendix}(1)}\\
%        \implies & Q  \\
%        & \pfcomment{by Lemma~\ref{lemma:2p-of-appendix}(1). \ \qed}
%        \end{array}$ 
  

      \end{proof}

	\step{<3>2}{\valid{ (\while{P}{Q}) \land (P \perp Q) 
                 \;\implies\; (\while{(\while{Q}{P})}{Q})}}
	\begin{proof}
	\pf\ \stepref{<3>1} and Lemma~\ref{lemma:2-of-appendix}(2).
	\qed
	\end{proof}
      \qedstep
	\begin{proof}
	\pf\ \stepref{<3>2}, case assumption~\levelref{<1>1}, 
              and Lemma~\ref{lemma:RedArrow+}.
	\qed
	\end{proof}
    \end{proof}
  \end{proof} %%%{1} }}}}}


\qedstep
\begin{proof}
  \pf\ % In the general case, we have:\\
   $\begin{array}[t]{@{}l@{\;\;}l@{\;\;}l@{}}
     \whilep{P}{Q} 
       &  =  & (P \implies Q) \land (\whilep{\closure{P}}{\closure{Q}})\\
       & &   \pfcomment{by Lemma~\ref{lemma:ArrowClosedImpl}(2)}\\
       & =  & (P \implies Q) \land (\while{\closure{P}}{\closure{Q}}) 
                  \land (\closure{P} \perp \closure{Q})\\
       & & \pfcomment{by \stepref{<1>1}}\\
       & = & (P \implies Q) \land (\while{\closure{P}}{\closure{Q}}) 
               \land (P \perp Q) \\
       & & \pfcomment{by Lemma~\ref{lemma:Factoid-Perp2}(1)}\\
       & = & (\while{P}{Q}) \land (P \perp Q)\\
        & & \pfcomment{by Lemma~\ref{lemma:ArrowClosedImpl}(1). \ \ \qed}
    \end{array}$
\end{proof}

\end{proof} %%% 



%try
\noindent{\sc Proposition \ref{prop:perp-plus}.}
\begin{it}
\assume{%
\begin{pfenum}
 \item $P$, $Q$, and $R$ are safety properties.
 \item $\valid{P \land Q \implies R}$
 \item $\valid{Q \implies P {\perp} R}$
 \item the tuple $x$ contains all the free variables of $R$.
\end{pfenum}}
\prove{$\valid{\plus{x}{P} \land Q \implies R}$}
\end{it}
\begin{proof}
\step{<1>1}{\valid{Q \implies ({\while{P}{R})}}}
\begin{proof}
 \pf\ Assumptions \toplevel:1 and \toplevel:2, and 
       Lemma~\ref{lemma:2-of-appendix}(2). \qed
\end{proof}

\step{<1>2}{\valid{Q \implies ({\whilep{P}{R})}}}
\begin{proof}
   \pf\ \stepref{<1>1}, assumption~\toplevel:3, and
         Lemma~\ref{lemma:Factoid-Perp3}.  \qed
\end{proof}

\step{<1>3}{\valid{Q \implies (\while{\plus{x}{P}}{R})}}
\begin{proof}
   \pf\ \stepref{<1>2}, assumptions \toplevel:1 and \toplevel:4, 
        and Lemma~\ref{lemma:factoid-F+1}.
   \qed
\end{proof}

\qedstep
\begin{proof}
  \pf\ \stepref{<1>3} and Lemma~\ref{lemma:2-of-appendix}(2).
  \qed
\end{proof}
\end{proof}

%try
%\marginalnote{Used only in proof of Proposition \ref{prop:orthogonality}.}
\begin{lemma} \label{lemma:preortho} \mbox{}
\pflet{%
$E$ $\deq$ $\env{\vbl{Init}} \land 
                \Box\,\sqact{{}\env{\act{N}}}{\tuple{x,\, e}}$ \\
 $M$ $\deq$ $\sys{\vbl{Init}} \land 
                 \Box\,\sqact{{}\sys{\act{N}}}{\tuple{y,\, m}}$}
\prove{\valid{(
    (\EE\,  x : \env{\vbl{Init}}) \lor (\EE\,  y : \sys{\vbl{Init}})) 
       \land \disjoint{e, m}
          \implies \\
     \hspace*{2em}\closure{\EE\,  x : E} \perp \closure{\EE\,  y : M}}}
\end{lemma} 
\begin{proof}
\pf\ By definition of $\perp$, it suffices to prove the following, for
all $n\geq0$:
\assume{%
\begin{pfenum}
% \setcounter{pfenumi}{1}
\item $\sigma \validop 
    ((\exists\,  x : \env{\vbl{Init}}) \lor 
        (\exists\,  y : \sys{\vbl{Init}}))$
\item $\sigma  \validop \disjoint{e, m}$
\item $\prefix{\sigma}{n} \validop 
    \closure{\EE\,  x : E} \land \closure{\EE\,  y : M}$
\end{pfenum}}
\prove{$\prefix{\sigma}{n+1} \validop 
    \closure{\EE\,  x : E} \lor \closure{\EE\,  y : M}$}
\step{<1>1}{\case{$n=0$}}
\begin{proof}
  \step{<2>1}{\case{$\sigma \validop (\exists\,x : \env{\vbl{Init}})$}}
  \begin{proof}
    \step{<3>1}{Choose a state $s$ such that $s \sequalv{x} \sigma_{1}$ and 
                $s\validop\env{\vbl{Init}}$.}
    \begin{proof}
      \pf\ Case assumption \levelref{<2>1}.
      \qed    
    \end{proof}%%%{<3>1}

    \step{<3>2}{$\tuple{s, s, s, \ldots\,} \validop E$}
    \begin{proof}
      \pf\ \stepref{<3>1} and the definition of $E$.
      \qed
    \end{proof}%%%{<3>2}

    \step{<3>3}{$\tuple{\sigma_1, s, s, s, \ldots\,} \validop \EE\,  x : E$}
    \begin{proof}
      \pf\ \stepref{<3>1}, \stepref{<3>2}, and the definition of $\EE$.
      \qed
    \end{proof}

    \step{<3>4}{$\prefix{\sigma}{1} \validop \EE  x : E$}
    \begin{proof}
      \pf\ \stepref{<3>3}.
    \qed
    \end{proof}  

    \qedstep
  \end{proof}%%%{<2>1}

  \step{<2>2}{\case{$\sigma \validop (\exists\,x : \sys{\vbl{Init}})$}}
   \begin{proof}
      \pf\ The proof is the same as the proof of \stepref{<2>1}, with
      $M$ substituted for $E$ and $y$ substituted for $x$.
      \qed
   \end{proof}  

   \qedstep
   \begin{proof}
      \pf\ \stepref{<2>1}, \stepref{<2>2}, and assumption \toplevel:1.
   \end{proof}
\end{proof}%%%{<1>1}

\step{<1>2}{\case{$n>0$}}
\begin{proof}
   \step{<2>1}{$(\M{e}(\sigma_n) = \M{e}(\sigma_{n+1})) \;\lor\;
                (\M{m}(\sigma_n) = \M{m}(\sigma_{n+1}))$}
   \begin{proof}
     \pf\ Assumption \toplevel:2.
     \qed
   \end{proof}

   \step{<2>2}{\case{$\M{e}(\sigma_n) = \M{e}(\sigma_{n+1})$}}
   \begin{proof}
      \step{<3>1}{Choose $\rho$ such that:
                   \begin{pfenum}
                      \item $\rho \vseqv{x} \prefix{\sigma}{n}$
                      \item $\rho \validop E$
                   \end{pfenum}}
      \begin{proof}
        \pf\ Assumption \toplevel:3, 
%\marginalnote{Should ``$\prefix{\sigma}{n} \validop \closure{P}$ iff
%$\prefix{\sigma}{n} \validop P$'' be a lemma?}
         since  $ \eta \validop \closure{P}$ iff
         $ \eta\validop P$, for any property $P$ and finite
         behavior $\eta$.
        \qed
      \end{proof}%%%{<3>1}
     \pflet{$t$ be the state such that $t\sequalv{x}\sigma_{n+1}$ and 
                  $\M{x}(t) = \M{x}(\last{\rho})$.}
      \step{<3>2}{$\rho \circ \tuple{t} \validop E$}
      \begin{proof}
        \pf\ \stepref{<3>1}.2, case assumption \levelref{<2>2},
         and the definitions of $t$ and $E$.~\qed
      \end{proof}%%%{<3>2}
      \step{<3>3}{$\prefix{\sigma}{n+1} \vseqv{x} 
                    \rho \circ \tuple{t}$}
      \begin{proof}
        \pf\ \stepref{<3>1}.1 and the definition of $t$.
        \qed
      \end{proof}
      \step{<3>4}{$\prefix{\sigma}{n+1} \validop \EE  x : E$}
      \begin{proof}
        \pf\ \stepref{<3>2} and \stepref{<3>3}.
        \qed
      \end{proof}   
      \qedstep
      \begin{proof}
        \pf\ \stepref{<3>4}.
        \qed
      \end{proof}
    \end{proof}%%%{<2>2}
    \step{<2>3}{\case{$\M{m}(\sigma_{n}) = \M{m}(\sigma_{n+1})$}}
      \begin{proof}
        \pf\ The proof is the same as the proof of \stepref{<2>2}, with $m$,
        $M$, and $y$ substituted for $e$, $E$, and $x$, respectively.
        \qed
      \end{proof}
    \qedstep
      \begin{proof}
  \pf\ \stepref{<2>1}, \stepref{<2>2}, and \stepref{<2>3}. 
  \qed
      \end{proof}
  \end{proof}%%%{<1>2}
  \qedstep
\end{proof}

%try
\noindent{\sc Proposition \ref{prop:orthogonality}.}
\begin{it}
\assume{%
\begin{pfenum}
\item \valid{\closure{E} = 
    \env{\vbl{Init}} \land \Box\,\sqact{{}\env{\act{N}}}{\tuple{x,\, e}}}
\item \valid{\closure{M} = 
    \sys{\vbl{Init}} \land \Box\,\sqact{{}\sys{\act{N}}}{\tuple{y,\, m}}}
\end{pfenum}}
\prove{\valid{
    ((\EE\,  x : \env{\vbl{Init}}) \lor (\EE\,  y : \sys{\vbl{Init}})) 
    \land \disjoint{e, m}
          \implies \\ \hspace*{2em}
          \closure{\EE\,  x : E} \perp \closure{\EE\,  y : M}}}
\end{it}
\begin{proof}
\pf\ Follows from Lemma~\ref{lemma:preortho}, with
\closure{E} substituted for $E$ and 
$\closure{M}$ substituted for $M$, and Lemma~\ref{lemma:1-of-appendix}. \qed
\end{proof}


%try
\subsection{Composition as Conjunction}


\noindent{\sc Proposition \ref{prop:conj-to-canonical}.}
{\it
Let $m_{1},\ldots\,,m_{n},\,x_{1},\ldots\,,x_{n}$ be
tuples of variables, and let
\vspace{-.5\baselineskip}
\[\begin{array}{@{}c@{}}
    m \;\;\deq\;\; \tuple{m_{1},\ldots\,,m_{n}}\s{3}
    x \;\;\deq\;\; \tuple{x_{1},\ldots\,,x_{n}}\\[\jot]
    \widehat{x}_{i} \;\;\deq\;\; 
        \tuple{x_{1},\ldots\,,x_{i-1},\,x_{i+1},\,\ldots\,,x_{n}}\\[\jot]
 M_{i} \;\;\deq\;\; \EE\,x_{i} : \vbl{Init}_{i} 
      \;\land\; \Box\sqact{N_{i}}{\tuple{m_{i},\,x_{i}}} 
      \;\land\; L_{i}
   \end{array}
\]
\vspace{-.75\baselineskip}
\assume{For all $i, j$ with $i \neq j$:
\begin{pfenum}
\item no variable of $x_j$ occurs free in $x_{i}$ or $M_i$.
\item $m$ includes all free variables of $M_i$.
\item \valid{\act{N}_{i} \implies (m'_{j} = m_{j})}
\end{pfenum}}
\prove{\valid{\;\bigwedge_{i=1}^{n}M_{i} \;\;=\;\;\\ \hspace*{2em}
    \EE\, x : 
                \bigwedge_{i=1}^{n}\vbl{Init}_{i} 
      \;\land\; \Box\sqact{{}\bigvee_{i=1}^{n}
               \act{N}_{i}\land
                  (\widehat{x}_{i}'=\widehat{x}_{i})}{\tuple{m,\,x}}
    \;\land\; \bigwedge_{i=1}^{n}L_{i}}}
}
%try
\begin{proof}
\pf\ The hypotheses remain true and the conclusion is unchanged if we
remove from $m_{j}$ any variable that appears in $x_{j}$.  (Assumption
2 remains true because, by assumption 1, the variable removed cannot
occur free in $M_{i}$.)  Therefore, without loss of generality, we can
strengthen assumption 1 to: 
\assume{\renewcommand{\thepfenumi}{1(a)}%
         \begin{pfenum} 
            \item The variables in $x_j$ do not occur free in $M_i$, 
                  and are distinct from the variables in $x_{i}$ and $m_{j}$.
            \end{pfenum}}
The proof is by induction on $n$, with
the cases for $n=1$ and $n=2$ proved separately.

\step{<1>1}{\case{$n = 1$}}
  \begin{proof}
    \pf\ This case follows immediately from the definition of $M_{i}$.
    \qed
  \end{proof}

\step{<1>2}{\case{$n = 2$}}
\begin{proof}
\pflet{$\begin{array}[t]{@{}l@{\;\;\deq\;\;}l@{}}
  \GoalNext & \left[ \begin{array}{@{\lor\;}l@{}}
                            \act{N}_{1} \land (x_{2}'=x_{2}) \\
                            \act{N}_{2} \land (x_{1}' = x_{1})
                                     \end{array}
                           \right]_{\tuple{m,\, x}} \\
       \UNext & \left[ \begin{array}{@{\lor\;}l@{}}
                                       \act{N}_{1} \land (x_{2}'=x_{2})\\
                                       \act{N}_{2} \land (x_{1}' = x_{1})\\
                                       \act{N}_{1} \land \act{N}_{2}
                                    \end{array}
                              \right]_{\tuple{m,\, x}}\\
       \Goal & \EE\,  x_{1}, x_{2} : 
          \vbl{Init}_{1} \land \vbl{Init}_{2} \land 
                      \Box\,\GoalNext \land L_{1} \land L_{2}\\
       \Unq & \vbl{Init}_{1} \land \vbl{Init}_{2} 
                             \land \Box\,\UNext \land L_{1} \land L_{2}
  \end{array}$}

\prove{\valid{M_{1}\land M_{2}= \Goal}}
  \step{<2>1}{%
    \valid{M_{1} \land M_{2} \;=\;         \EE\,  x_{1}, x_{2} : \Unq}
             }
  \begin{proof}
    \pflet{$\begin{array}[t]{@{}l@{\;\;\deq\;\;}l@{}}
       \UNextp & 
        \left[\begin{array}{@{\land\;}l@{}}
               \act{N}_{1} \lor (\tuple{m_{1},\,x_{1}}'=\tuple{m_{1},\,x_{1}})\\
               \act{N}_{2} \lor (\tuple{m_{2},\,x_{2}}'=\tuple{m_{2},\,x_{2}})
               \end{array}
        \right]_{\tuple{m,\, x}} \\
      \Unqp & \vbl{Init}_{1} \land \vbl{Init}_{2} \land \Box\,\UNextp \land
                       L_{1} \land L_{2}
            \end{array}$}

    \step{<3>1}{$\valid \UNextp = \UNext$}
       \begin{proof}
        \pf\ Assumption \toplevel:3, which implies\\
      \mbox{}\hfill\( \begin{array}{@{}l}
         \valid{\act{N}_{2} \land (\tuple{m_{1},\,x_{1}}'=\tuple{m_{1},\,x_{1}})
           = \act{N}_{2} \land (x_{1}'=x_{1})}\\
         \valid{\act{N}_{1} \land (\tuple{m_{2},\,x_{2}}'=\tuple{m_{2},\,x_{2}})
            = \act{N}_{1} \land (x_{2}'=x_{2})}\s{1}\qed
        \end{array}\)\hfill\mbox{}
       \end{proof}
    \step{<3>2}{$\valid \Unqp = \Unq$}
       \begin{proof}
        \pf\ \stepref{<3>1} and the definitions of $\Unqp$ and $\Unq$.
        \qed
       \end{proof}
    \step{<3>3}{\valid{\sqact{N_{1}}{\tuple{m_{1},\,x_{1}}}
                        \land \sqact{N_{2}}{\tuple{m_{2},\,x_{2}}}
                    = \UNextp}}
       \begin{proof}
        \pf\ The definition of $m$ and $x$.
        \qed
      \end{proof}
    \step{<3>4}{\valid{M_{1} \land M_{2} \;=\; \EE\,  x_{1}, x_{2} : \Unqp}}
      \begin{proof}
        \pf\ \stepref{<3>3} and assumption \toplevel:1(a), since
         $\Box$ distributes over $\land$.~\qed
        
      \end{proof}
    \qedstep
      \begin{proof}
           \pf\ \stepref{<3>2} and \stepref{<3>4}.
       \qed
          \end{proof}
  \end{proof}

  \step{<2>2}{$\valid{\Goal \implies M_{1} \land M_{2}}$}
  \begin{proof}
    \pf\ \stepref{<2>1},
     since \valid{\GoalNext\implies \UNext}.
    \qed
  \end{proof}

  \step{<2>3}{\valid{M_{1} \land M_{2} \implies \Goal}}
  \begin{proof}
  \assume{$\sigma \validop M_{1} \land M_{2}$}
  \prove{$\sigma \validop \Goal$}
    \step{<3>1}{Choose $\tau$ such that
                $\tau \vseqv{\tuple{x_{1},\, x_{2}}} \sigma$ and 
                $\tau \validop \Unq$.}
      \begin{proof}
        \pf\ $\tau$ exists by assumption \levelref{<2>3},  \stepref{<2>1}, 
         and the definition of $\EE$.
        \qed
      \end{proof} %%%{<3>1}

   \pflet{$\eta$ be the behavior such that, for all $n>0$:\\
          \s{1}$\begin{array}[t]{@{}l@{\;\;\deq\;\;}l@{}}
                  \eta_{2n-1} & \tau_{n} \\
                  \eta_{2n} & 
                    \begin{array}[t]{@{}l@{}}
                     {\bf if}\; \M{x_1}(\tau_n) = \M{x_1}(\tau_{n+1}) 
                                   \mbox{ or }
                                \M{x_2}(\tau_n) = \M{x_2}(\tau_{n+1})\\
                      \s{1}\begin{array}[t]{@{}ll@{}}
                           {\bf then} & \tau_{n}\\
                           {\bf else} & \mbox{the state such that 
                                $\M{x_1}(\eta_{2n}) = \M{x_1}(\tau_{n+1})$}\\
                              & \mbox{and $\eta_{2n}\sequalv{x_{1}}\tau_{n}$.}
                          \end{array} 
                    \end{array}
                 \end{array}$\\
      ($\eta$ is the same as $\tau$ except that each step is split in two.
      A step that changes both $x_{1}$ and $x_{2}$ is split into a step that
      changes only $x_{1}$ followed by one that leaves $x_{1}$ unchanged.
      For a step that leaves $x_{1}$ or $x_{2}$ unchanged, a stuttering step
      is added.)}

    \step{<3>2}{For all $n>0$, if $\M{x_1}(\tau_n) \neq \M{x_1}(\tau_{n+1})$ 
                  and  $\M{x_2}(\tau_n) \neq \M{x_2}(\tau_{n+1})$ 
                  then $\tuple{\tau_{n},\,\tau_{n+1}}$ is an 
                  $\act{N}_{1} \land \act{N}_{2}\land (m'=m)$ step.}
       \begin{proof}
         \assume{$\M{x_1}(\tau_n) \neq \M{x_1}(\tau_{n+1})$ 
                   and  $\M{x_2}(\tau_n) \neq \M{x_2}(\tau_{n+1})$.}
         \prove{$\tuple{\tau_{n},\,\tau_{n+1}}$ is an 
                $\act{N}_{1} \land \act{N}_{2}\land (m'=m)$ step.}

          \step{<4>1}{$\tuple{\tau_n,\,\tau_{n+1}}$ is an $\UNext$ step.}
           \begin{proof}
             \pf\ \stepref{<3>1} (which asserts $\tau \validop \Unq$) 
    and the definition
                of $\Unq$.
            \qed
           \end{proof}     

          \step{<4>2}{$\tuple{\tau_n,\,\tau_{n+1}}$ is an 
                      $\act{N}_{1} \land \act{N}_{2}$ step.}
           \begin{proof}
             \pf\  Assumption \levelref{<3>2}, \stepref{<4>1},
             and the definition of \UNext. \qed
           \end{proof}     

      \qedstep
        \begin{proof}
           \pf\ \stepref{<4>2} and assumption \toplevel:3.
           \qed
        \end{proof}     
    \end{proof}

    \step{<3>3}{For all $n>0$, \tuple{\eta_n,\,\eta_{n+1}} is an 
                \GoalNext\ step.}
    \begin{proof}
     \pflet{$k \;\deq\;  (n+1) \hbox{\rm \  div\ } 2$}
      \step{<4>1}{\case{$\M{x_1}(\tau_k) = \M{x_1}(\tau_{k+1})$ 
                         or $\M{x_2}(\tau_k) = \M{x_2}(\tau_{k+1})$%
                  \\
                  (In this case, \tuple{\eta_n,\,\eta_{n+1}} is a step of 
                   $\tau$ or a stutter.)%
           }}
      \begin{proof}
        \step{<5>1}{$\tuple{\eta_n,\,\eta_{n+1}} = 
                     \tuple{\tau_k,\, \tau_{k+1}}$ or $\eta_n = \eta_{n+1}$.}
         \begin{proof}
          \pf\ The definition of $\eta$  and case assumption \levelref{<4>1}.
          \qed
         \end{proof}     
       \step{<5>2}{$\M{x_1}(\eta_n) = \M{x_1}(\eta_{n+1})$ or
                   $\M{x_2}(\eta_n) = \M{x_2}(\eta_{n+1})$.}
         \begin{proof}
          \pf\ \stepref{<5>1} and case assumption \levelref{<4>1}.
           \qed
         \end{proof}     
       \step{<5>3}{$\tuple{\eta_n,\,\eta_{n+1}}$ is an $\UNext$ step.}
         \begin{proof}
          \pf\ \stepref{<5>1}, \stepref{<3>1}
           (which asserts $\tau \validop \Unq$), and the
           definition of $\Unq$.
        \qed
         \end{proof}     
       \qedstep
      \begin{proof}
          \pf\ \stepref{<5>2} and \stepref{<5>3}, since 
        \valid{\UNext \land ((x_1'=x_1) \lor (x_2'=x_2)) 
           \implies \GoalNext}.~\qed
          \end{proof}
      \end{proof} %%%{<4>1} 

     \step{<4>2}{\case{$n = 2k-1$, $\M{x_1}(\tau_k) \neq \M{x_1}(\tau_{k+1})$, and\\
                        $\M{x_2}(\tau_k) \neq \M{x_2}(\tau_{k+1})$.\\
                       (In this case, \tuple{\eta_n,\,\eta_{n+1}} is 
                       a step that changes only $x_{1}$.)}}
      \begin{proof}
        \step{<5>1}{$\eta_n=\tau_k$, $\M{x_1}(\eta_{n+1})= \M{x_1}(\tau_{k+1})$,
           and $\eta_{n+1}\sequalv{x_{1}}\tau_k$}
         \begin{proof}
      \pf\ The definition of $\eta$  and case assumption \levelref{<4>2}.
        \qed
         \end{proof}     

        \step{<5>2}{$\tuple{\tau_k,\,\tau_{k+1}}$ is an 
                   $\act{N}_{1} \land \act{N}_{2} \land (m'= m)$ step.}
         \begin{proof}
          \pf\  \stepref{<3>2} and case assumption \levelref{<4>2}.
        \qed
         \end{proof}     

        \step{<5>3}{$\M{m}(\eta_{n}) = 
                     \M{m}(\tau_{k})$ and
                  $\M{m}(\eta_{n+1}) = 
                     \M{m}(\tau_{k+1})$}
         \begin{proof}
           \pf\ \stepref{<5>1} implies $\M{m}(\eta_{n}) = 
                     \M{m}(\tau_{k})$, \stepref{<5>1} and
                assumption \toplevel:1(a) (which implies that
                no variable in $x_{1}$ occurs in $m_{1}$ or $m_{2}$)
                imply 
     \linebreak
          $\M{m}(\eta_{n+1}) = \M{m}(\tau_{k})$,
                and \stepref{<5>2} implies 
                   $\M{m}(\tau_{k}) = \M{m}(\tau_{k+1})$.
            \qed
         \end{proof}
       \step{<5>4}{$\M{x_{1}}(\eta_{n}) = 
                     \M{x_{1}}(\tau_{k})$ and
                  $\M{x_{1}}(\eta_{n+1}) = 
                     \M{x_{1}}(\tau_{k+1})$}
         \begin{proof}
           \pf\ \stepref{<5>1}.  \qed
         \end{proof}     
       \step{<5>5}{$\tuple{m,\, x_1}$ contains all variables free 
                   in $\act{N}_{1}$.}
         \begin{proof}
            \pf\ Assumption \toplevel:2 and the definition of $M_1$.
          \qed
         \end{proof}     

        \step{<5>6}{$\tuple{\eta_n,\,\eta_{n+1}}$ is an $\act{N}_{1}$ step}
         \begin{proof} 
     \pf\ \stepref{<5>2}, \stepref{<5>3}, 
             \stepref{<5>4}, and \stepref{<5>5}.
           \qed
         \end{proof}     

    \step{<5>7}{$\tuple{\eta_n,\,\eta_{n+1}}$ is an $x_2'=x_2$ step.}
         \begin{proof} 
          \pf\ \stepref{<5>1} and \toplevel:1(a), which implies
           that $x_1$ and $x_2$ have no variable in common.
         \qed
         \end{proof}

         \qedstep
          \begin{proof} 
	   \pf\ \stepref{<5>6} and \stepref{<5>7}, 
        since $\valid{\act{N}_1 \land (x_2'=x_2) \implies \GoalNext}$.
                \qed
          \end{proof}

      \end{proof} %%%{<4>2}

      \step{<4>3}{\case{$n=2k$, $\M{x_1}(\tau_k) \neq \M{x_1}(\tau_{k+1})$, 
                         and\\
                   $\M{x_2}(\tau_k) \neq \M{x_2}(\tau_{k+1})$.\\
                  (In this case, \tuple{\eta_n,\,\eta_{n+1}} is a step 
                   that leaves $x_{1}$ unchanged.)}}
      \begin{proof}
        \step{<5>1}{$\eta_{n+1}=\tau_{k+1}$, 
                     $\M{x_1}(\eta_{n})= \M{x_1}(\tau_{k+1})$, 
                and $\eta_{n}\sequalv{x_{1}}\tau_k$.}
         \begin{proof}
          \pf\ The definition of $\eta$  and case assumption \levelref{<4>3}.
          \qed
         \end{proof}     

        \step{<5>2}{$\tuple{\tau_k,\,\tau_{k+1}}$ is an 
                    $\act{N}_{2}$ step.}
         \begin{proof}
           \pf\ \stepref{<3>2} and case assumption \levelref{<4>2}.
           \qed
         \end{proof}     

        \step{<5>3}{$\M{\tuple{m,\, x_2}}(\eta_{n}) 
                     = \M{\tuple{m,\, x_2}}(\tau_{k})$ and\\
                  $ \M{\tuple{m,\, x_2}}(\eta_{n+1}) 
                    = \M{\tuple{m,\, x_2}}(\tau_{k+1})$.}
         \begin{proof}
          \pf\ \stepref{<5>1} and assumption \toplevel:1(a), which implies
          that $x_1$ has no variable in common with $x_2$ or $m$.
          \qed
         \end{proof}     
  
        \step{<5>4}{$\tuple{m,\, x_2}$ contains all variables free 
              in $\act{N}_{2}$.}
           \begin{proof}
            \pf\ Assumption \toplevel:2 and the definition of $M_2$.
          \qed
           \end{proof}     

        \step{<5>5}{$\tuple{\eta_n,\,\eta_{n+1}}$ is an $\act{N}_{2}$ step}
           \begin{proof} 
    \pf \stepref{<5>2}, \stepref{<5>3}, and \stepref{<5>4}.
                  \qed
           \end{proof}     

        \step{<5>6}{$\tuple{\eta_n,\,\eta_{n+1}}$ is an $x_1'=x_1$ step.}
           \begin{proof} \pf\ \stepref{<5>1}.
                  \qed
           \end{proof}

        \qedstep
          \begin{proof} 
               \pf \stepref{<5>5} and \stepref{<5>6},         
                since $\valid{\act{N}_2 \land (x_1'=x_1) \implies \GoalNext}$.
                \qed
          \end{proof}
      \end{proof}  %%%%<4>3
      
     \qedstep

     \begin{proof}
       \pf\  \stepref{<4>1}, \stepref{<4>2}, and \stepref{<4>3}.
       \qed
     \end{proof}

    \end{proof} %%%{<3>3}
 
    \step{<3>4}{$\eta \validop \vbl{Init}_{1} \land \vbl{Init}_{2}$}
    \begin{proof}
      \step{<4>1}{$\tau \validop \vbl{Init}_{1} \land \vbl{Init}_{2}$}
        \begin{proof}
          \pf\ The definition of $\Unq$ and 
          \stepref{<3>1} (which asserts $\tau \validop \Unq$).
                  \qed
            \end{proof}
      \step{<4>2}{$\eta_1 = \tau_{1}$}
         \begin{proof}
            \pf\ The definition of $\eta$.
            \qed
          \end{proof}
      \qedstep
        \begin{proof}
          \pf\ \stepref{<4>1} and \stepref{<4>2}, since
            $\M{P}(\rho) = \M{P}(\rho_{1})$ for any predicate 
           $P$ and behavior $\rho$.
             \qed
        \end{proof}
    \end{proof} %%%{<3>4}

    \step{<3>5}{$\eta \validop L_{1} \land L_{2}$}
    \begin{proof}
      

      \step{<4>1}{$\eta \validop L_{1}$}
      \begin{proof}
        \step{<5>1}{$\tau \validop L_{1}$}
          \begin{proof}
            \pf\ \stepref{<3>1} and
            the definition of $\Unq$. \qed
          \end{proof}

      \step{<5>2}{For all $n>0$:
            \begin{pfenum}
              \item $\eta_{2n-1}=\tau_{n}$
              \item $\M{\tuple{m,\,x_{1}}}(\eta_{2n})=
                      \M{\tuple{m,\,x_{1}}}(\tau_{n})$ or\\
                      $\M{\tuple{m,\,x_{1}}}(\eta_{2n})=
                      \M{\tuple{m,\,x_{1}}}(\tau_{n+1})$ 
            \end{pfenum}}
          \begin{proof}
        \pf\ Part 1 follows from the definition of $\eta$.  Part
             2 follows from the definition of $\eta$ and
             \stepref{<3>2}, which implies 
             $\M{m}(\tau_{n})=\M{m}(\tau_{n+1})$ when the {\bf if}
             condition in the definition is false. \qed
          \end{proof}
      \step{<5>2a}{Choose $\neweta$ such that
                     $\neweta_{2n-1} = \tau_{n}$ and\\
                    \mbox{}\hfill\(\neweta_{2n} \;\;= \;\;
                     {\bf if}\;\;\M{\tuple{m,\,x_{1}}}(\eta_{2n})=
                      \M{\tuple{m,\,x_{1}}}(\tau_{n})
                        \;\;\begin{array}[t]{@{}l@{\;\;}l@{}}
                        {\bf then} & \tau_{n} \\
                         {\bf else} & \tau_{n+1}
                        \end{array}\)\hfill\mbox{}\\
                   for all $n$.
                 Then $\neweta$ is stuttering equivalent to $\tau$,
                 and, for all $n$,
               $\M{\tuple{m,\,x_{1}}}(\neweta_{n}) =
                  \M{\tuple{m,\,x_{1}}}(\eta_{n})$.}
         \begin{proof}
         \pf\ \stepref{<5>2}.~\qed
         \end{proof}
      \step{<5>2b}{$\neweta\validop L_{1}$}
      \begin{proof}
        \pf\ \stepref{<5>1} and \stepref{<5>2a}, since TLA formulas
         are invariant under stuttering.~\qed
      \end{proof}
      \step{<5>3}{$\M{L_{1}}(\neweta)=\M{L_{1}}(\eta)$}
         \begin{proof}
           \pf\ \stepref{<5>2a}, since \tuple{m,\,x_{1}} contains all 
               variables occurring free in $L_{1}$, by
             assumption \toplevel:2 and the definition of $M_{1}$.
           \qed
         \end{proof}

      

%      \step{<5>4}{$\tau \vseqv{\tuple{m,\, x_1}} \eta$}
%         \begin{proof}
%    \pf\ \stepref{<5>2}. 
%    \qed
%         \end{proof}
      \qedstep
          \begin{proof}
            \pf\ 
             \stepref{<5>2b} and \stepref{<5>3}.~\qed
         \end{proof}
      \end{proof} %%%{<4>2}

     \step{<4>2}{$\eta \validop L_{2}$}
      \begin{proof}
        \step{<5>1}{$\tau \validop L_{2}$}
          \begin{proof}
             \pf\ \stepref{<3>1} and the definition of $\Unq$.
            \qed
          \end{proof}                
        \step{<5>2}{$\eta \vseqv{x_{1}} \tau$}
          \begin{proof}
              \pf\    The definition of $\eta$. \qed
           \end{proof}
        \qedstep
          \begin{proof}
           \pf\ \stepref{<5>1}, \stepref{<5>2}, and 
              assumption \toplevel:1(a), which
              implies that $x_{1}$ does not occur free in $L_{2}$.
        \qed
      \end{proof}
        \end{proof}


    \qedstep
%     \begin{proof}
%       \pf\  \stepref{<4>1} and \stepref{<4>2}.
%       \qed
%     \end{proof}
    \end{proof} %%%{<3>5}

    \step{<3>6}{$\eta \validop \Goal$}
     \begin{proof}
      \pf\  \stepref{<3>3}, \stepref{<3>4}, and \stepref{<3>5}, and the 
         definition of $\Goal$.
      \qed
     \end{proof}

    \step{<3>7}{$\eta \vseqv{\tuple{x_{1},\, x_{2}}} \sigma$}
     \begin{proof}
      \pf\  \stepref{<3>1}, which asserts 
           $\tau\vseqv{\tuple{x_{1},\, x_{2}}} \sigma$,
       and the definition of $\eta$, which implies
        $\eta\vseqv{x_{1}}\tau$.
      \qed
     \end{proof}

   \qedstep 
     \begin{proof}
      \pf\  \stepref{<3>6}, \stepref{<3>7}, and the definition of $\Goal$.
      \qed
     \end{proof}

  \end{proof} %%%{<2>3}
  \qedstep
\end{proof}%%%{<1>2} 

\newlength{\foolength}
\step{<1>3}{\case{$n > 2$, and the theorem holds 
          with $p$ substituted for $n$, for all $p < n$.}}
\begin{proof}
  \pflet{$\begin{array}[t]{@{}l@{\;\;\deq\;\;}l@{}}
           mm & \tuple{m_{1},\ldots\,,m_{n-1}}\\
           xx & \tuple{x_{1},\ldots\,,x_{n-1}} \\
           \widehat{xx}_i & 
            \tuple{x_{1},\ldots\,x_{i-1},\,,x_{i+1},\,\ldots\,,x_{n-1}}
      \end{array}$}
  \pf\\ 
\settowidth{\foolength}{$\bigwedge_{i\leq n} M_{i}$}%
$
\bigwedge_{i\leq n} M_{i} \;\;=\;\;
   \begin{array}[t]{@{}l@{}}
     (\bigwedge_{i \leq n-1} M_{i}) \land M_n\\
       \pfcomment{by propositional logic} 
   \end{array}\\[\jot]  
\hspace*{\foolength}
  \;\;=\;\;
   \begin{array}[t]{@{}l@{}}
     \begin{conj}
       \EE  xx : 
         \begin{conj}
           \bigwedge_{i \leq n-1} \vbl{Init}_{i} \\
           \Box\,\sqact{{} \bigvee_{i\leq n-1} \act{N}_{i} \land 
                (\widehat{xx}_{i}' = \widehat{xx}_{i})}{\tuple{mm,\, xx}}\\
           \bigwedge_{n-1} L_{i}
          \end{conj}\\
      M_n
    \end{conj}\\
   \pfcomment{by case assumption \levelref{<1>3}, with $n-1$ substituted
                  for $p$}
   \end{array}\\[\jot]
\hspace*{\foolength}
  \;\;=\;\;
   \begin{array}[t]{@{}l@{}}  
     \EE xx, x_n : 
      \begin{conj}
        \bigwedge \vbl{Init}_{i}\\
        \Box\,\left[
          \begin{array}{@{\lor\;}l@{}}
            \begin{conj}
               \bigvee_{i \leq n-1} 
              \act{N}_{i} \land (\widehat{xx}_{i}' = \widehat{xx}_{i}) \\
               (x_n' = x_n) 
            \end{conj} \\
            \act{N}_n \land (\widehat{x}_n' = \widehat{x}_n)
          \end{array}
          \right]_{\tuple{mm,\, xx,\, m_n,\, x_n}}\\
       \bigwedge L_{i}
     \end{conj}\\
  \pfcomment{by case assumption \levelref{<1>3}, with $2$ substituted
                  for $p$}
   \end{array}\\[\jot]
\hspace*{\foolength}
  \;\;=\;\;  
    \EE\, x : 
                \bigwedge_{i=1}^{n}\vbl{Init}_{i} 
      \;\land\; \Box\sqact{{}\bigvee_{i=1}^{n}
               \act{N}_{i}\land
                  (\widehat{x}_{i}'=\widehat{x}_{i})}{\tuple{m,\,x}}
    \;\land\; \bigwedge_{i=1}^{n}L_{i} \ \
      \qed
$
\end{proof}
\qedstep
   \begin{proof}
     \pf\ \stepref{<1>1}, \stepref{<1>2}, \stepref{<1>3}, 
 and mathematical induction.
    \qed
  \end{proof}
\end{proof}

%try   
 
\subsection{Decomposition and Composition}

Theorem~\ref{thm:decomposition} is an immediate consequence of
Theorem~\ref{thm:general-decomposition}.  The proof of
Theorem~\ref{thm:general-decomposition} assumes
Theorem~\ref{thm:composition}, but
Theorem~\ref{thm:general-decomposition} is not used in the proof of
Theorem~\ref{thm:composition} or of any lemma, so there is no
circularity.

\noindent{\sc Theorem \ref{thm:general-decomposition}.}
\begin{it}
\assume{For $i=1,\ldots\,, n$:
\begin{pfenum}
\item \valid{\closure{E}\land\BIGWEDGE_{j=1}^{n}\closure{\hi{M_{j}}}
      \;\implies\;E_{i}}
\item \begin{pfenum}
  \item \valid{\plus{v}{\closure{E_{i}}}\land \closure{\lo{M_{i}}} 
           \;\implies\; \closure{\hi{M_{i}}}}
  \item \valid{E_{i}\land \lo{M_{i}} \;\implies\; \hi{M_{i}}}
   \end{pfenum}
\item $v$ is a tuple of variables including all the free variables
      of \hi{M_{i}}.
\end{pfenum}}
\prove{\begin{pfenum}
\item[a.] \valid{\plus{v}{\closure{E}}\land 
           \BIGWEDGE_{j=1}^{n}\closure{\lo{M_{j}}} 
        \;\implies\;
  \BIGWEDGE_{j=1}^{n}\closure{\hi{M_{j}}}}
\item[b.] \valid{E\land\BIGWEDGE_{j=1}^{n}\lo{M_{j}}\;\implies\;
         \BIGWEDGE_{j=1}^{n}\hi{M_{j}}}
\end{pfenum}}
\end{it}
\begin{proof}
\step{<1>1}{For any $E$, $E_{i}$, $\lo{M_{i}}$, and $\hi{M_{i}}$
satisfying assumptions \toplevel:1--3, and all
    $i=1,\ldots\,, n$: \
\valid{(\BIGWEDGE_{j=1}^{n}M_{j}^l) \implies (\whilep{E}{M_{i}})}}
\begin{proof}
  \step{<2>1}{For $j=1,\ldots\,, n$: 
                \valid{M_{j}^l \implies (\whilep{E_{i}}{M_{j}})}}
  \begin{proof}
    \step{<3>1}{For $i=1,\ldots\,, n$:
        \valid{\closure{M_{i}^l} \implies 
           (\whilep{\closure{E_{i}}}{\closure{M_{i}}})} }
    \begin{proof}
      \pf\ Assumption \toplevel:2(a), Lemma~\ref{lemma:2-of-appendix}(2),
  assumption \toplevel:3, and 
%\linebreak  %%% FORMATTING
   Lemma~\ref{lemma:factoid-F+1}.~\qed
    \end{proof}
    \step{<3>2}{For $i=1,\ldots\,, n$:
                 \valid{M_{i}^l \implies (E_i \implies M_i)}}
    \begin{proof}
      \pf\ Assumption \toplevel:2(b).
      \qed
    \end{proof}

    \qedstep
    \begin{proof}
      \pf\ \stepref{<3>1}, \stepref{<3>2}, and 
       Lemma~\ref{lemma:ArrowClosedImpl}(2).
      \qed
    \end{proof}
  \end{proof}%%%{<2>1}
  \step{<2>2}{For $i=1,\ldots\,, n$:
                \valid{(\BIGWEDGE_{j=1}^{n} (\whilep{E_{j}}{M_{j}})) \implies 
                             (\whilep{E}{M_{i}})}}
  \begin{proof}
    \pf\ The 
Composition Theorem (Theorem~\ref{thm:composition}), 
    with $M_{i}$ substituted for $M$, 
    where hypothesis~1 of the Composition Theorem follows from
    assumption \toplevel:1, and hypotheses 2(a) and 2(b)
    are vacuous when $M_{i}$ is substituted for $M$.
    \qed
  \end{proof}

  \qedstep
  \begin{proof}
    \pf\ \stepref{<2>1}, \stepref{<2>2}, and propositional reasoning.
    \qed
  \end{proof}
\end{proof}%%%{<1>1}

\step{<1>2}{Conclusion (a) holds.}
\begin{proof}
  \step{<2>1}{For $i=1,\ldots\,, n$: 
               \valid{(\BIGWEDGE_{j=1}^{n} \closure{M_{j}^l}) \implies 
                 (\whilep{\closure{E}}{\closure{M_{i}}})}}
  \begin{proof}
    \pf\ \stepref{<1>1}, substituting $\closure{E}$ for $E$, 
    $\closure{M_{j}^l}$ for $M_{j}^l$, and $\closure{M_{i}}$ for $M_{i}$.
    Since \closureop\ is idempotent, this instantiation changes
    only assumption 2(b), which becomes
     \valid{\closure{E_{i}} \land \closure{M_{i}^l} \implies \closure{M_{i}}}.
    This assumption follows from 2(a), since \valid{P \implies \plus{v}{P}},
    for any $P$.
    \qed
  \end{proof}

  \step{<2>2}{For $i=1,\ldots\,, n$:
           \valid{(\BIGWEDGE_{j=1}^{n}\closure{M_{j}^l}) \implies 
                (\while{\plus{v}{\closure{E}}}{\closure{M_{i}}})}}
  \begin{proof}
    \pf\ \stepref{<2>1}, 
    assumption \toplevel:3, and 
    Lemma~\ref{lemma:factoid-F+1}.
    \qed
  \end{proof}
  \qedstep
  \begin{proof}
    \pf\ \stepref{<2>2} and Lemma~\ref{lemma:2-of-appendix}(2) 
         (conjoining over all $i$).~\qed
  \end{proof}
\end{proof}%%%{<1>2}

\step{<1>3}{Conclusion (b) holds.}
\begin{proof}
  \step{<2>1}{\valid{E \land (\BIGWEDGE_{j=1}^{n} M_{j}^l) \implies M_{i}}}
  \begin{proof}
    \pf\ \stepref{<1>1} and Lemma~\ref{lemma:ArrowClosedImpl}(2).
    \qed
  \end{proof}

  \qedstep
  \begin{proof}
    \pf\ \stepref{<2>1} (conjoining over all $i$). \qed
  \end{proof}
\end{proof}%%%{<1>3}
\qedstep
\end{proof}

%try
\begin{lemma} \label{lemma:SafeComposition}
\mbox{}
\assume{For $i = 1, \ldots, n$:
  \begin{pfenum}
    \setcounter{pfenumi}{-1}
    \item $M_{i}$ is a safety property.
    \item $E$ and $E_{i}$ are safety properties.
    \item \valid{(E \land \BIGWEDGE_{j=1}^{n} M_{j}) \;\implies\; E_{i}}
  \end{pfenum}}
\vspace{-.2\baselineskip}
\prove{\valid{
     (\BIGWEDGE_{j=1}^{n} (\whilep{E_{j}}{M_{j}})) \;\implies\; 
        (\whilep{E}{(\BIGWEDGE_{j=1}^{n} M_{j})})}}
\end{lemma}
\vspace{-.5\baselineskip}
\begin{proof}
\pf\
$\begin{array}[t]{l@{\;\;}c@{\;\;}l@{}}
\makebox[0pt][l]{$\bigwedge_{j=1}^{n} (\whilep{E_{j}}{M_{j}}))$}\\[\jot]
 & \implies & 
       \whilep{(\bigwedge_{j=1}^{n} E_{j})}{(\bigwedge_{j=1}^{n} M_{j})}\\
 & & \pfcomment{Lemma~\ref{lemma:QRS} and 
                assumptions \toplevel:0 and \toplevel:1}\\[\jot]
 & \implies & \whilep{E}{(\bigwedge_{j=1}^{n} M_{j})}\\
 & & \pfcomment{assumption \toplevel:2 and Lemma~\ref{lemma:QRT}, 
               substituting $E$ for $R$,}\\ 
 & & \pfcomment{$\bigwedge_{j=1}^{n} E_{j}$ for $P$, 
              and $\bigwedge_{j=1}^{n} M_{j}$ for $Q$. \ \qed}
\end{array}$
% }}}}}
%   \step{<1>1}{\valid{(\bigwedge_{j=1}^{n} (\whilep{E_{j}}{{M_{j}})))
%          \;\implies\;
%       (\whilep{(\bigwedge_{j=1}^{n} E_{j})}{(\bigwedge_{j=1}^{n} M_{j})})}}}
%   \begin{proof}
%     \pf\ Lemma~\ref{lemma:QRS} and assumptions \toplevel:0 and \toplevel:1.
%     \qed
%   \end{proof}
% 
%   \step{<1>2}{\valid{(\whilep{(\bigwedge_{j=1}^{n} E_{j})}%
%              {(\bigwedge_{j=1}^{n} M_{j})}) 
%         \;\implies\; (\whilep{E}{(\bigwedge_{j=1}^{n} M_{j})})}}
%   \begin{proof}
%     \pf\ Assumption \toplevel:2 and Lemma~\ref{lemma:QRT}, substituting $E$ for $R$, 
%            $\bigwedge_{j=1}^{n} E_{j}$ for $P$, 
%        and $(\bigwedge_{j=1}^{n} M_{j})$ for $Q$.
%     \qed
%   \end{proof}
% 
%   \qedstep
%   \begin{proof}
%     \pf\ By \stepref{<1>1}  and \stepref{<1>2}.
%     \qed
%   \end{proof}
\end{proof} 


%try  
\noindent{\sc Theorem \ref{thm:composition}. }
\begin{it}
\assume{For $i=1,\ldots,n$:
   \begin{pfenum}
     \item \valid{\closure{E} \land \BIGWEDGE_{j=1}^{n}\closure{M_{j}} 
            \;\implies\; E_{i}}
     \item 
        \begin{pfenum}
         \item \valid{\plus{v}{\closure{E}}\land
                       \BIGWEDGE_{j=1}^{n}\closure{M_{j}}
                    \;\implies\; \closure{M}}
         \item \valid{E\land\BIGWEDGE_{j=1}^{n}M_{j}
                     \;\implies\; M}
           \end{pfenum}
   \end{pfenum}}
\prove{\valid{\BIGWEDGE_{j=1}^{n} (\whilep{E_{j}}{M_{j}})
                            \;\implies\; (\whilep{E}{M})}}
\end{it}
\begin{proof}
\step{<1>1}{\valid{(\bigwedge_{j=1}^{n}(
            \whilep{\closure{E_{j}}}{\closure{M_{j}}})) \;\implies\;
        (\whilep{\closure{E}}{(\bigwedge_{j=1}^{n} \closure{M_{j}})})}}
\begin{proof}
  \pf\ Assumption~\toplevel:1 and Lemma~\ref{lemma:SafeComposition},
  since \valid{E_{i}\implies\closure{E_{i}}}
      (because \closureop\ is \sd).~\qed
\end{proof}

\step{<1>2}{\valid{(\whilep{\closure{E}}{(\bigwedge_{j=1}^{n}
        \closure{M_{j}})}) \;\implies\;
        (\whilep{\closure{E}}{\closure{M}})}}
\begin{proof}
  \pf\ Assumption \toplevel:2(a) and Lemma~\ref{lemma:ABX}.
  \qed
\end{proof}

\step{<1>3}{\valid{(\bigwedge_{j=1}^{n}(\whilep{E_{j}}{M_{j}})) 
        \;\implies\; (E \implies M)}}
\begin{proof}
  \step{<2>1}{\valid{\closure{E} \land (\bigwedge_{j=1}^{n}
              (\whilep{\closure{E_{j}}}{\closure{M_{j}}})) \;\implies\;
                    \bigwedge_{j=1}^{n}\closure{M_{j}}}}
  \begin{proof}
    \pf\ \stepref{<1>1} and Lemma~\ref{lemma:2p-of-appendix}(2).
    \qed
  \end{proof}
  \step{<2>2}{\valid{E \land (\bigwedge_{j=1}^{n}
              (\whilep{E_{j}}{M_{j}})) \;\implies\;
                    \bigwedge_{j=1}^{n}\closure{M_{j}}}}
  \begin{proof}
    \pf\ \stepref{<2>1}, since \valid{E \implies \closure{E}} 
  (because \closureop\ is \sd) and 
     \valid{(\whilep{E_{j}}{M_{j}}) \implies 
                    (\whilep{\closure{E_{j}}}{\closure{M_{j}}})}
  by Lemma~\ref{lemma:ArrowClosedImpl}.
    \qed
  \end{proof}
  \step{<2>3}{\valid{E \land (\bigwedge_{j=1}^{n} (\whilep{E_{j}}{M_{j}})) 
                \;\implies\;
                  \bigwedge_{j=1}^{n}E_{j}}}
  \begin{proof}
    \pf\ \stepref{<2>2} and assumption~\toplevel:1, since \closureop\ is \sd.
    \qed
  \end{proof}

  \step{<2>4}{\valid{E \land (\bigwedge_{j=1}^{n} 
                (\whilep{E_{j}}{M_{j}})) \;\implies\;
                \bigwedge_{j=1}^{n} M_{j}}}
  \begin{proof}
    \pf\ \stepref{<2>3} and Lemma~\ref{lemma:2p-of-appendix}(2).
    \qed
  \end{proof}

  \step{<2>5}{\valid{E \land (\bigwedge_{j=1}^{n} (\whilep{E_{j}}{M_{j}})) 
              \;\implies\; M}}
  \begin{proof}
    \pf\ \stepref{<2>4} and assumption~\toplevel:2(b).
    \qed
  \end{proof}

  \qedstep
  \begin{proof}
    \pf\ \stepref{<2>5}.
    \qed
  \end{proof}
\end{proof}%%%{3}

\qedstep
\begin{proof}
  \pf\ \stepref{<1>1} and \stepref{<1>2}, which imply
    \[\valid{\bigwedge_{j=1}^{n} 
       (\whilep{\closure{E_{j}}}{\closure{M_{j}}}) \;\implies\;
       (\whilep{\closure{E}}{\closure{M}})}\]
   \stepref{<1>3}, and Lemma~\ref{lemma:ArrowClosedImpl}(2).
  \qed
\end{proof}

\end{proof}
%try

%\cleardoublepage
\ifseparateappendix{}{\addcontentsline{toc}{section}{References}
\bibliographystyle{acmtrans}
%\bibliography{mybib}
\begin{thebibliography}{}

\bibitem[\protect\citeauthoryear{Abadi and Lamport}{Abadi and
  Lamport}{1994}]{abadi:old-fashioned}
{\sc Abadi, M.} {\sc and} {\sc Lamport, L.} 1994.
\newblock An old-fashioned recipe for real time.
\newblock {\em ACM Trans.\ Program.\ Lang.\ Syst.\/}~{\em 16,\/}~5 (Sept.),
  1543--1571.

\bibitem[\protect\citeauthoryear{Abadi and Lamport}{Abadi and
  Lamport}{1993}]{abadi:composing}
{\sc Abadi, M.} {\sc and} {\sc Lamport, L.} 1993.
\newblock Composing specifications.
\newblock {\em ACM Trans.\ Program.\ Lang.\ Syst.\/}~{\em 15,\/}~1 (Jan.),
  73--132.

\bibitem[\protect\citeauthoryear{Abadi and Lamport}{Abadi and
  Lamport}{1991}]{abadi:existence}
{\sc Abadi, M.} {\sc and} {\sc Lamport, L.} 1991.
\newblock The existence of refinement mappings.
\newblock {\em Theor.\ Comput.\ Sci.\/}~{\em 82,\/}~2 (May), 253--284.

\bibitem[\protect\citeauthoryear{Abadi and Plotkin}{Abadi and
  Plotkin}{1993}]{abadi:logical-view}
{\sc Abadi, M.} {\sc and} {\sc Plotkin, G.} 1993.
\newblock A logical view of composition.
\newblock {\em Theor.\ Comput.\ Sci.\/}~{\em 114,\/}~1 (June), 3--30.

\bibitem[\protect\citeauthoryear{Abramsky and Jagadeesan}{Abramsky and
  Jagadeesan}{1994}]{abramsky:games}
{\sc Abramsky, S.} {\sc and} {\sc Jagadeesan, R.} 1994.
\newblock Games and full completeness for multiplicative linear logic.
\newblock {\em J.\ Symb.\ Logic\/}~{\em 59,\/}~2 (June), 543--574.

\bibitem[\protect\citeauthoryear{Alpern and Schneider}{Alpern and
  Schneider}{1985}]{alpern:defining}
{\sc Alpern, B.} {\sc and} {\sc Schneider, F.~B.} 1985.
\newblock Defining liveness.
\newblock {\em Inf. Process. Lett.\/}~{\em 21,\/}~4 (Oct.), 181--185.

\bibitem[\protect\citeauthoryear{Berthet and Cerny}{Berthet and
  Cerny}{1988}]{berthet:algebraic-model}
{\sc Berthet, C.} {\sc and} {\sc Cerny, E.} 1988.
\newblock An algebraic model for asynchronous circuits verification.
\newblock {\em IEEE Trans.\ Comput.\/}~{\em 37,\/}~7 (July),
  835--847.

\bibitem[\protect\citeauthoryear{Collette}{Collette}{1993}]{collette:applicati%
on}
{\sc Collette, P.} 1993.
\newblock Application of the composition principle to {U}nity-like
  specifications.
\newblock In {\em
  TAPSOFT'93: Theory and Practice of Software Development}, 
  {\rm M.-C. Gaudel} {\rm and} {\rm J.-P. Jouannaud}, Eds.
  {\rm Lecture Notes in Computer Science}, 
  vol.\ 668. Springer-Verlag, Berlin, 230--242. 

\bibitem[\protect\citeauthoryear{Jones}{Jones}{1983}]{jones:specification}
{\sc Jones, C.~B.} 1983.
\newblock Specification and design of (parallel) programs.
\newblock In {\em Information Processing 83:
  Proceedings of the IFIP 9th World Congress},
  {\rm R.~E.~A. Mason}, Ed. North-Holland, Amsterdam, 321--332. 
  

\bibitem[\protect\citeauthoryear{Kurshan and Lamport}{Kurshan and
  Lamport}{1993}]{kurshan:multiplier}
{\sc Kurshan, R.~P.} {\sc and} {\sc Lamport, L.} 1993.
\newblock Verification of a multiplier: 64 bits and beyond.
\newblock In  {\em Computer-Aided Verification},
   {\rm C.~Courcoubetis}, Ed.
  {\rm Lecture Notes in Computer Science}, vol.\ 697.
  Springer-Verlag, Berlin, 
  166--179. 
\newblock Proceedings of the 5th International Conference, CAV'93.

\bibitem[\protect\citeauthoryear{Lamport}{Lamport}{1994}]{lamport:newtla}
{\sc Lamport, L.} 1994.
\newblock The temporal logic of actions.
\newblock {\em ACM Trans.\ Program.\ Lang.\ Syst.\/}~{\em 16,\/}~3 (May),
  872--923.

\bibitem[\protect\citeauthoryear{Lamport}{Lamport}{1989}]{lamport:simple}
{\sc Lamport, L.} 1989.
\newblock A simple approach to specifying concurrent systems.
\newblock {\em Commun. ACM\/}~{\em 32,\/}~1 (Jan.), 32--45.

\bibitem[\protect\citeauthoryear{Lamport}{Lamport}{1983}]{lamport:what-good}
{\sc Lamport, L.} 1983.
\newblock What good is temporal logic?
\newblock In {\em Information Processing 83:
  Proceedings of the IFIP 9th World Congress},
  {\rm R.~E.~A. Mason}, Ed. 
  North-Holland, Amsterdam, 657--668. 
  

\bibitem[\protect\citeauthoryear{Mead and Conway}{Mead and
  Conway}{1980}]{seitz:system-timing}
{\sc Mead, C.} {\sc and} {\sc Conway, L.} 1980.
\newblock {\em Introduction to VLSI Systems}. 
\newblock Addison-Wesley, Reading, Mass., chap.~7.

\bibitem[\protect\citeauthoryear{Misra and Chandy}{Misra and
  Chandy}{1981}]{misra:proofs}
{\sc Misra, J.} {\sc and} {\sc Chandy, K.~M.} 1981.
\newblock Proofs of networks of processes.
\newblock {\em IEEE Trans.\ Softw.\ Eng.}~{\em SE-7,\/}~4
  (July), 417--426.

\bibitem[\protect\citeauthoryear{Pandya and Joseph}{Pandya and
  Joseph}{1991}]{pandya:p-a-logic}
{\sc Pandya, P.~K.} {\sc and} {\sc Joseph, M.} 1991.
\newblock {P-A} logic---a compositional proof system for distributed programs.
\newblock {\em Distrib.\ Comput.}~{\em 5,\/}~1, 37--54.

\bibitem[\protect\citeauthoryear{Pnueli}{Pnueli}{1984}]{pnueli:transition}
{\sc Pnueli, A.} 1984.
\newblock In transition from global to modular temporal reasoning about
  programs.
\newblock In {\em Logics and Models of Concurrent Systems},
  {\rm K.~R. Apt}, Ed. 
    NATO ASI Series, Springer-Verlag, Berlin, 123--144. 

\bibitem[\protect\citeauthoryear{Pnueli}{Pnueli}{1981}]{pnueli:temporal-semant%
ics}
{\sc Pnueli, A.} 1981.
\newblock The temporal semantics of concurrent programs.
\newblock {\em Theor.\ Comput.\ Sci.\/}~{\em 13}, 45--60.

\bibitem[\protect\citeauthoryear{Stark}{Stark}{1985}]{stark:technique}
{\sc Stark, E.~W.} 1985.
\newblock A proof technique for rely/guarantee properties.
\newblock In {\em Foundations of Software
  Technology and Theoretical Computer Science},
  {\rm S.~N. Maheshwari}, Ed. 
  {\rm Lecture  Notes in Computer Science}, vol.\ 206.
  Springer-Verlag, Berlin, 369--391. 

\bibitem[\protect\citeauthoryear{Zave and Jackson}{Zave and
  Jackson}{1993}]{zave:conjunction}
{\sc Zave, P.} {\sc and} {\sc Jackson, M.} 1993.
\newblock Conjunction as composition.
\newblock {\em ACM Trans.\ Softw.\ Eng.\ Method.}~{\em
  2,\/}~4 (Oct.), 379--411.

\end{thebibliography}


\begin{received}
           Received December 1993; revised July 1994 and January 1995; 
           accepted January 1995.
           \end{received}}


\cleardoublepage
\addcontentsline{toc}{section}{Index}
%\printindex
\begin{theindex}

  \item $\Box$, 7
  \item $\Diamond$, 7
  \item $\EE$, 8
  \item \plusop, 13--14
  \item $\circ$, 5
  \item $'$ (prime), 7
  \item $\perp$, 14--15
  \item \sequalv{\ldots}, A--1
  \item $\vseqv{\ldots}$, A--2
  \item $\Rightarrow $, precedence of, 8
  \item \whileop, 14
  \item \whilepop, 2, 14
  \item \validop, 7, A--1
  \item $\ldots\prefix{}{\ldots}$, A--1
  \item $\length{\ldots}$, 5
  \item $\langle\ldots\rangle$
    \subitem enclosing atomic operation, 3
    \subitem sequence notation, 5
  \item \sqact{\ldots}{\ldots}, 7
  \item \anact{\ldots}{\ldots}, 7
  \item \M{\ldots}, A--1
  \item $\land $, list of, 8
  \item $\lor $, list of, 8

  \indexspace

  \item action, 7
    \subitem next-state, 11
  \item angle brackets
    \subitem enclosing atomic operation, 3
    \subitem sequence notation, 5
  \item antimonotonic, A--2
  \item assumption, environment, 2, 5, 22
  \item assumption/guarantee specification, 5, 22

  \indexspace

  \item behavior, 7
    \subitem intuitive interpretation of, 8
  \item Berthet, Christian, 26
  \item Boolean operator, 7
  \item brackets, angle
    \subitem enclosing atomic operation, 3
    \subitem sequence notation, 5

  \indexspace

  \item $\closureop$, 12, A--1
  \item canonical form, 8
  \item Cerans, Karlis, 26
  \item Cerny, Eduard, 26
  \item Chandy, K. Mani, 26
  \item channel, 4
  \item circuit description as low-level specification, 1
  \item circular reasoning, 19
  \item closure, 12
  \item closure, machine, 13
  \item Collette, Pierre, 26
  \item complete system, 2
    \subitem decomposition of, 2--4, 15--22
  \item component guarantee, 2
  \item composition, 2, 4--7, 22--24
  \item Composition Theorem, 23
  \item conditional implementation, 12
  \item conjunction of components, 17--19
  \item conjunction, list notation for, 8
  \item COSPAN, 26
  \item CSP, 26

  \indexspace

  \item decomposition, 2--4, 15--22
  \item Decomposition Theorem, 19
  \item Decomposition Theorem, General, 21
  \item \vbl{Disjoint}, 8
  \item disjunction, list notation for, 8

  \indexspace

  \item enabled, 7
  \item $\enabled{\ldots}$, 7
  \item environment assumption, 2, 5, 22

  \indexspace

  \item fairness
    \subitem strong, 7
    \subitem weak, 7
  \item flexible variable, 7
  \item form, canonical, 8
  \item formula, TLA, 7
  \item function, state, 7

  \indexspace

  \item GCD program, 3--4, 8, 16, 18, 20
  \item General Decomposition Theorem, 21
  \item guarantee, 2, 5, 22

  \indexspace

  \item \vbl{Head}, 5
  \item hiding, 2, 13
  \item Hoare triple, 26

  \indexspace

  \item iff, 3
  \item implementation, 1
    \subitem conditional, 12
  \item indentation, eliminating parentheses with, 8
  \item inductively defined system, 21
  \item \vbl{Init}, 8
  \item input variable, 15, 17
  \item interface refinement, 12
  \item interleaving representation, 8--9
  \item internal variable, 8
  \item invariant under stuttering, A--1

  \indexspace

  \item Joseph, Mathai, 26

  \indexspace

  \item \vbl{last}, A--1

  \indexspace

  \item machine closure, 13
  \item mapping, refinement, 11
  \item Merz, Stephan, 26
  \item Misra, Jayadev, 26
  \item monotonic, A--2
  \item multiplier
    \subitem recursive definition, 21
    \subitem verification, 26

  \indexspace

  \item next-state action, 11
  \item noninterleaving representation, 8--9
  \item number, statement (in proof), A--2

  \indexspace

  \item open system, 4
  \item operator
    \subitem Boolean, 7
    \subitem precedence of, 8
  \item output variable, 15, 17

  \indexspace

  \item Pandya, Paritosh K., 26
  \item Plotkin,Gordon, 26
  \item Pnueli, Amir, 1, 26
  \item predicate, state, 7
  \item program as low-level specification, 1
  \item proof style, explanation, A--2

  \indexspace

  \item queue, 4--6, 9--10, 16--18, 24
    \subitem implemented by two queues, 11--12

  \indexspace

  \item real-time specification, 12
  \item refinement mapping, 11
  \item refinement, interface, 12

  \indexspace

  \item safety property, 6, 12
  \item semantics of TLA, 7--8
  \item sequences, notation for, 5
  \item SF, 7
  \item specification
    \subitem assumption/guarantee, 5
    \subitem higher-level, 1
    \subitem low-level, 1
    \subitem real-time, 12
  \item Stark, Eugene W., 26
  \item state, 7
  \item state function, 7
  \item state predicate, 7
  \item statement number (in proof), A--2
  \item step, 7
    \subitem stuttering, 1
  \item strong fairness, 7
  \item stutter-free version of a behavior, A--1
  \item stuttering equivalent, A--1
  \item stuttering step, 1
  \item stuttering, invariant under, A--1
  \item subaction, 13
  \item \sd, A--2
  \item syntax of TLA, 7--8
  \item system
    \subitem defined inductively, 21
    \subitem open, 4
  \item system guarantee, 5, 22
  \item system, complete, 2

  \indexspace

  \item \vbl{Tail}, 5
  \item Temporal Logic of Actions, 1
  \item TLA, 1, 7--8

  \indexspace

  \item Unity, 26
  \item universe, 8

  \indexspace

  \item valid, 7
  \item variable
    \subitem flexible, 7
    \subitem hiding of, 2, 13
    \subitem history, 26
    \subitem input, 15, 17
    \subitem internal, 8
    \subitem intuitive interpretation of, 8
    \subitem output, 15, 17
    \subitem primed, 7

  \indexspace

  \item weak fairness, 7
  \item WF, 7

  \indexspace

  \item Yu, Yuan, 26

\end{theindex}

\end{document}%

\end{document}



%% major changes on 12 Sep 93:
%%  Added def of invariance under stuttering, and mentioned it in
%%  proofs.

%%  Added def of \EE .
%%  Added P -+-> Q to Lemma 1(1).
