%%* TOPLAS Version of SRC91, 
%%* "An Old-Fashioned Recipe for Real Time"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%             \ifseparateappendix%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% \ifseparateappendix{this text if appendix appears separately}{this
%                       text for a normal version}

\newcommand{\ifseparateappendix}[2]{#1}
\newcommand{\iftoplas}[2]{#1}

\iftoplas{\documentstyle[makeidx]{article}}%
         {\documentstyle[11pt,twoside,pf,makeidx]{article}}

\makeatletter
% acmtrans.sty 03-Nov-1993
% Here is the basic framework that is needed to convert your paper 
% into ACM TOPLAS format and bibliographic format.  For a tutorial
% introduction, see ``acmtr.tex'' (compile it with LaTeX) that
% accompanies the distribution of this style file.
%
%  -> \documentstyle{acmtrans}
%  -> \markboth{}{}
%         takes 2 arguments and it is for the left- and right-page headers:
%         first set of braces is for author's name(s) and
%         the second set of braces is for the title 
%             (if the title is too long, contraction may be needed
%  -> \title{}
%         if the title is too long, it can be separated by \\
%  -> \author{}
%         author1 \\ author1 affiliation
%         \and
%         author2 \\ author2 affiliation
%  -> \begin{abstract}
%  -> \end{abstract}
%
%  -> \category{}{}{}
%         takes 3 arguments for the Computing Reviews Classification Scheme.
%         ex: \category{D.3.3}{Programming Languages}{Language Constructs and 
%                   Features}[data types and structures]
%                   the last argument, in square brackets, is optional.
%  -> \terms{} (ex: \terms{Human Factors, Languages})
%  -> \keywords{} (ex: \keywords{document processing, sequences, string searching, 
%                      subsequences, substrings})
%  -> \begin{document}
%
%  -> \begin{bottomstuff}
%          similar to \thanks     
%          for authors' addresses; research/grant statements
%  -> \end{bottomstuff}
%  -> \maketitle
%
%     Now you can start the body of the paper; your figures, tables and 
%          use all the latex constructs.
%
%  -> \begin{acks}
%          acknowledgements
%  -> \end{acks}
%
%  -> \bibliographystyle{acmtrans}
%  -> \bibliography{mybib_file}
%
%     ****
%     If your paper has been accepted with a separate (electronic only)
%        appendix, you need to add the following control sequence:
%
%  ->  \appendixhead{}{}{}{}
%        takes 4 arguments to identify your appendix section.
%        first = journal name (e.g.  toplas )
%        second = paper-id  (a four-digit number)
%        third = year of appearance, for copyright notice
%	          (approximation will suffice)
%        fourth = journal, volume and year of publication if known
%
%       body of appendix 

%  -> \end{document}
%
% Do not worry about the other definitions in this style file
% Remember to compile: latex, bibtex, latex latex
%
% Bibliographic cite forms needed:
%
%  \cite{key}
%    which produces citations with full author list and year.
%    eg. [Brown 1978; Jarke, Turner, Stohl, et al. 1985]
%  \citeA{key}
%    which produces citations with only the full author list.
%    eg. [Brown; Jarke, Turner and Stohl]
%  \citeN{key}
%    which produces citations with the full author list and year, but
%    can be used as nouns in a sentence; no brackets appear around
%    the author names, but only around the year.
%      eg. Shneiderman [1978] states that......
%    \citeN should only be used for a single citation.
%  \shortcite{key}
%    which produces citations with abbreviated author list and year.
%  \shortciteA{key}
%    which produces only the abbreviated author list.
%  \shortciteN{key}
%    which produces the abbreviated author list and year, with only the
%    year in brackets. Use with only one citation.
%  \citeyear{key}
%    which produces the year information only, within brackets.
%
% Abbreviated author lists use the ``et al.'' construct.
%
% The above are examples of required ACM bibliographic cite formats needed.
% *******************
% Here is the complete list of cite forms from the chicago bibliographic style
%
%  \cite{key}
%    which produces citations with full author list and year.
%    eg. (Brown 1978; Jarke, Turner, Stohl, et al. 1985)
%  \citeNP{key}
%    which produces citations with full author list and year, but without
%    enclosing parentheses:
%    eg. Brown 1978; Jarke, Turner and Stohl 1985
%  \citeA{key}
%    which produces citations with only the full author list.
%    eg. (Brown; Jarke, Turner and Stohl)
%  \citeANP{key}
%    which produces citations with only the full author list, without
%    parentheses eg. Brown; Jarke, Turner and Stohl
%  \citeN{key}
%    which produces citations with the full author list and year, but
%    can be used as nouns in a sentence; no parentheses appear around
%    the author names, but only around the year.
%      eg. Shneiderman (1978) states that......
%    \citeN should only be used for a single citation.
%  \shortcite{key}
%    which produces citations with abbreviated author list and year.
%  \shortciteNP{key}
%    which produces citations with abbreviated author list and year.
%  \shortciteA{key}
%    which produces only the abbreviated author list.
%  \shortciteANP{key}
%    which produces only the abbreviated author list.
%  \shortciteN{key}
%    which produces the abbreviated author list and year, with only the
%    year in parentheses. Use with only one citation.
%  \citeyear{key}
%    which produces the year information only, within parentheses.
%  \citeyearNP{key}
%    which produces the year information only.
%
% Abbreviated author lists use the ``et al.'' construct.
%
% `NP' means `no parentheses' 
%
\typeout{Document Style `acmtrans' <22 Dec 87>.}

\@twosidetrue \@mparswitchtrue \def\ds@draft{\overfullrule 5pt} 
\@options

\lineskip 1pt \normallineskip 1pt
\def\baselinestretch{1}

\def\@normalsize{\@setsize\normalsize{12pt}\xpt\@xpt
\abovedisplayskip 6pt plus2pt minus1pt\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip 6pt plus0pt minus 3pt
\belowdisplayshortskip 6pt plus0pt minus3pt\let\@listi\@listI} 
\def\small{\@setsize\small{11pt}\ixpt\@ixpt
\abovedisplayskip 5pt plus 2pt minus 1pt\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip 5pt plus0pt minus2pt\belowdisplayshortskip 5pt plus0pt
minus 2pt
\def\@listi{\leftmargin\leftmargini \topsep 5pt plus 2pt minus 1pt\parsep 0pt
plus .7pt 
\itemsep 1.6pt plus .8pt}}
\def\footnotesize{\@setsize\footnotesize{10pt}\viiipt\@viiipt
\abovedisplayskip 4pt plus 1pt minus 0pt\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip 4pt plus 0pt minus 1pt\belowdisplayshortskip 4pt plus
0pt minus 1pt\def\@listi{\leftmargin\leftmargini \topsep 4pt plus 1pt minus
0pt\parsep 0pt plus .5pt 
\itemsep 1pt plus .7pt}}
\def\scriptsize{\@setsize\scriptsize{8pt}\viipt\@viipt}
\def\tiny{\@setsize\tiny{6pt}\vpt\@vpt}
\def\large{\@setsize\large{14pt}\xiipt\@xiipt}
\def\Large{\@setsize\Large{18pt}\xivpt\@xivpt}
\def\LARGE{\@setsize\LARGE{20pt}\xviipt\@xviipt}
\def\huge{\@setsize\huge{25pt}\xxpt\@xxpt}
\def\Huge{\@setsize\Huge{30pt}\xxvpt\@xxvpt}
\normalsize 

 \oddsidemargin .75in \evensidemargin .75in \marginparwidth .5in 
 \marginparsep .125in 
 \topmargin .25in \headheight 12pt \headsep 16pt \footheight 10pt \footskip
15pt 

\textheight 48pc \textwidth 30pc \columnsep 10pt \columnseprule 0pt 

\footnotesep 7pt 
\skip\footins 15pt plus 4pt minus 3pt 
\floatsep 12pt plus 2pt minus 2pt \textfloatsep \floatsep \intextsep 1pc plus
1pc \@maxsep 1pc \dblfloatsep 12pt plus 2pt minus 2pt \dbltextfloatsep 20pt
plus 2pt minus 4pt \@dblmaxsep 20pt 
\@fptop 0pt plus 1fil \@fpsep 1pc plus 2fil \@fpbot 0pt plus 1fil 
\@dblfptop 0pt plus 1fil \@dblfpsep 8pt plus 2fil \@dblfpbot 0pt plus 1fil
\marginparpush 6pt 

\parskip 0pt plus .1pt \parindent 10pt \partopsep 0pt 
\@lowpenalty 51 \@medpenalty 151 \@highpenalty 301 
\@beginparpenalty -\@lowpenalty \@endparpenalty -\@lowpenalty \@itempenalty
-\@lowpenalty 




\def\part{\@ucheadtrue
 \@startsection{part}{9}{\z@}{-10pt plus -4pt minus 
 -2pt}{4pt}{\normalsize\sf}}
\def\section{\@ucheadtrue
 \@startsection{section}{1}{\z@}{-10pt plus -4pt minus 
 -2pt}{4pt}{\normalsize\sf}}
\def\subsection{\@ucheadfalse
 \@startsection{subsection}{2}{\z@}{-8pt plus -2pt minus 
 -1pt}{4pt}{\normalsize\sf}}
\def\subsubsection{\@ucheadfalse
 \@startsection{subsubsection}{3}{\parindent}{6pt plus 
1pt}{-5pt}{\normalsize\it}}
\def\paragraph{\@ucheadfalse
 \@startsection{paragraph}{3}{\parindent}{6pt plus 
1pt}{-5pt}{\normalsize\it}}



\gdef\@period{.}
\def\@trivlist{\@topsepadd\topsep
\if@noskipsec \gdef\@period{}\leavevmode\gdef\@period{.}\fi
 \ifvmode \advance\@topsepadd\partopsep \else \unskip\par\fi
 \if@inlabel \@noparitemtrue \@noparlisttrue 
 \else \@noparlistfalse \@topsep\@topsepadd \fi
 \advance\@topsep \parskip
 \leftskip\z@\rightskip\@rightskip \parfillskip\@flushglue
 \@setpar{\if@newlist\else{\@@par}\fi} \global\@newlisttrue
\@outerparskip\parskip}

\def\@startsection#1#2#3#4#5#6{\if@noskipsec\gdef\@period{}\leavevmode
 \gdef\@period{.}\fi
 \par \@tempskipa #4\relax
 \@afterindenttrue
 \ifdim \@tempskipa <\z@ \@tempskipa -\@tempskipa \@afterindentfalse\fi
 \if@nobreak \everypar{}\else
 \addpenalty{\@secpenalty}\addvspace{\@tempskipa}\fi \@ifstar
 {\@ssect{#3}{#4}{#5}{#6}}{\@dblarg{\@sect{#1}{#2}{#3}{#4}{#5}{#6}}}}
\def\@sect#1#2#3#4#5#6[#7]#8{\ifnum #2>\c@secnumdepth
 \def\@svsec{}\else 
 \refstepcounter{#1}\edef\@svsec{\ifnum 
 #2=1\relax \@appsec\fi \csname the#1\endcsname
 \ifnum #2=1\relax .\fi \hskip .5em }\fi
 \@tempskipa #5\relax
 \ifdim \@tempskipa>\z@ 
 \begingroup #6\relax
 \@hangfrom{\hskip #3\relax\@svsec}{\interlinepenalty \@M
 \if@uchead\uppercase{#8}\else#8\fi
 \par}
 \endgroup
 \csname #1mark\endcsname{#7}\addcontentsline
 {toc}{#1}{\ifnum #2>\c@secnumdepth \else
 \protect\numberline{\csname the#1\endcsname}\fi
 #7}\else
 \def\@svsechd{#6\hskip #3\@svsec \if@uchead\uppercase{#8}\else#8\fi
 \csname #1mark\endcsname
 {#7}\addcontentsline
 {toc}{#1}{\ifnum #2>\c@secnumdepth \else
 \protect\numberline{\csname the#1\endcsname}\fi
 #7}}\fi
 \@xsect{#5}}
\def\@xsect#1{\@tempskipa #1\relax
 \ifdim \@tempskipa>\z@
 \par \nobreak
 \vskip \@tempskipa
 \@afterheading
 \else \global\@nobreakfalse \global\@noskipsectrue
 \everypar{\if@noskipsec \global\@noskipsecfalse
 \clubpenalty\@M \hskip -\parindent
 \begingroup \@svsechd\@period \endgroup \unskip
 \hskip -#1
 \else \clubpenalty \@clubpenalty
 \everypar{}\fi}\fi\ignorespaces}
\newif\if@uchead\@ucheadfalse


\setcounter{secnumdepth}{3}

\newfont{\apbf}{cmbx9}

\def\@withappendix#1{\rm A--\number #1}

\newcommand{\elecappendix}{
}

\def\appenheader{\global\@topnum\z@ \global\@botroom \textheight \begin{figure}
\newfont{\sc}{cmcsc10}
\parindent\z@
\hbox{}
\vskip -\textfloatsep
\vskip 11pt
\hrule height .4pt width 30pc
\vskip 2pt\rule{0pt}{10pt}\ignorespaces}
\def\endappenheader{\end{figure}\gdef\appendixhead{}}
\long\def\appendixhead#1#2#3#4{
\section*{Appendix}
An appendix to this paper is available in electronic form 
(Postscript$^{\mbox{\tiny TM}}$).  Any of the following methods may be
used to obtain it; or see the inside back cover of a current
issue for up-to-date instructions.

\begin{itemize}
\item By anonymous ftp from {\apbf acm.org}, file 
{\apbf [pubs.journals.#1.append]p#2.ps}
\item Send electronic mail to {\apbf mailserve@acm.org} containing
the line\\ {\apbf send~[anonymous.pubs.journals.#1.append]p#2.ps}
\item By {\it Gopher} from {\apbf acm.org}
\item By anonymous ftp from {\apbf ftp.cs.princeton.edu},
file {\apbf pub/#1/append/p#2.ps}
\item Hardcopy from {\it Article Express}, for a fee: phone 800-238-3458, fax
201-216-8526, or write P.O.~Box~1801, Hoboken NJ 07030; and request
{\sc acm-#1-appendix-{\small #2}}.
\end{itemize}
\clearpage
\makeatletter
\pagenumbering{withappendix}
\makeatother
\appendix
\par\noindent{\sc this document is the appendix to the following paper:}\hfill \vskip 1em
\vbox{\sf \parindent0pt\@title{}}\vskip .5em
\vbox{\sf \parindent0pt\@author{}}\vskip .5em\noindent
\vskip 10pt\noindent
#4
\vskip 10pt\noindent
\hrule
\par
\bottomstuff
Permission to copy without fee all or part of
this material is granted provided that the copies are not made or distributed
for direct commercial advantage, the ACM copyright notice and the title of
the publication and its date appear, and notice is given that copying is
by permission of the Association for Computing Machinery.
To copy otherwise, or to republish, requires a fee and/or specific permission.
\par
\copyright #3 ACM
\par
\endbottomstuff
}



\def\@appsec{}
\def\appendix{\par
 \setcounter{section}{0}
 \setcounter{subsection}{0}
 \def\@appsec{APPENDIX } \def\thesection{\Alph{section}}
 \def\thesubsection {\thesection\arabic{subsection}}}



\labelsep 5pt
\settowidth{\leftmargini}{(9)} \addtolength\leftmargini\labelsep
\settowidth{\leftmarginii}{(b)} \addtolength\leftmarginii\labelsep
\leftmarginiii \leftmarginii
\leftmarginiv \leftmarginii 
\leftmarginv \leftmarginii 
\leftmarginvi \leftmarginii 
\leftmargin\leftmargini
\labelwidth\leftmargini\advance\labelwidth-\labelsep
\def\@listI{\leftmargin\leftmargini \parsep 0pt plus 1pt\topsep 6pt plus 2pt
minus 2pt\itemsep 2pt plus 1pt minus .5pt}
\let\@listi\@listI
\@listi 
\def\@listii{\leftmargin\leftmarginii
 \labelwidth\leftmarginii\advance\labelwidth-\labelsep
 \topsep 0pt plus 1pt 
 \parsep 0pt plus .5pt 
 \itemsep \parsep}
\def\@listiii{\leftmargin\leftmarginiii
 \labelwidth\leftmarginiii\advance\labelwidth-\labelsep
 \topsep 0pt plus 1pt 
 \parsep 0pt plus .5pt 
 \itemsep \parsep}
\def\@listiv{\leftmargin\leftmarginiv
 \labelwidth\leftmarginiv\advance\labelwidth-\labelsep}
\def\@listv{\leftmargin\leftmarginv
 \labelwidth\leftmarginv\advance\labelwidth-\labelsep}
\def\@listvi{\leftmargin\leftmarginvi
 \labelwidth\leftmarginvi\advance\labelwidth-\labelsep}




\def\enumerate{\ifnum \@enumdepth >3 \@toodeep\else
 \advance\@enumdepth \@ne 
 \edef\@enumctr{enum\romannumeral\the\@enumdepth}\list
 {\csname label\@enumctr\endcsname}{\usecounter
 {\@enumctr}\def\makelabel##1{##1\hss}}\fi}
\def\longenum{\ifnum \@enumdepth >3 \@toodeep\else
 \advance\@enumdepth \@ne 
 \edef\@enumctr{enum\romannumeral\the\@enumdepth}\list
 {\csname label\@enumctr\endcsname}{\usecounter
 {\@enumctr}\labelwidth\z@
 \leftmargin\z@ \itemindent\parindent}\fi}
\let\endlongenum\endlist
\def\labelenumi{(\arabic{enumi})} 
\def\theenumi{\arabic{enumi}} 
\def\labelenumii{(\alph{enumii})}
\def\theenumii{\alph{enumii}}
\def\p@enumii{\theenumi}
\def\labelenumiii{\roman{enumiii}.}
\def\theenumiii{\roman{enumiii}}
\def\p@enumiii{\theenumi(\theenumii)}
\def\labelenumiv{\Alph{enumiv}.}
\def\theenumiv{\Alph{enumiv}} 
\def\p@enumiv{\p@enumiii\theenumiii}

\def\itemize{\list{---\hskip -\labelsep}{\settowidth
 {\leftmargin}{---}\labelwidth\leftmargin
 \addtolength{\labelwidth}{-\labelsep}}}
\let\enditemize\endlist
\def\longitem{\list{---}{\labelwidth\z@
 \leftmargin\z@ \itemindent\parindent \advance\itemindent\labelsep}}
\let\endlongitem\endlist
\def\verse{\let\\=\@centercr 
 \list{}{\leftmargin 2pc 
 \itemindent -1.5em\listparindent \itemindent 
 \rightmargin\leftmargin\advance\leftmargin 1.5em}\item[]}
\let\endverse\endlist
\def\quotation{\list{}{\leftmargin 2pc \listparindent .5em
 \itemindent\listparindent
 \rightmargin\leftmargin \parsep 0pt plus 1pt}\item[]}
\let\endquotation=\endlist
\def\quote{\list{}{\leftmargin 2pc \rightmargin\leftmargin}\item[]}
\let\endquote=\endlist

\def\description{\list{}{\labelwidth\z@
 \leftmargin\z@ \itemindent\parindent \advance\itemindent\labelsep
 \def\makelabel##1{\it ##1.}}}
\let\enddescription\endlist
\def\describe#1{\list{}{\settowidth{\labelwidth}{#1}\leftmargin
 \labelwidth\addtolength\leftmargin\labelsep\def\makelabel##1{##1\hfil}}}
\let\enddescribe\endlist

\def\program{\ifx\@currsize\normalsize\small \else \rm \fi\tabbing}
\let\endprogram\endtabbing
\def\@begintheorem#1#2{\it \trivlist \item[\hskip 10pt\hskip 
 \labelsep{\sc #1\hskip 5pt\relax#2.}]}
\def\@opargbegintheorem#1#2#3{\it \trivlist
 \item[\hskip 10pt \hskip \labelsep{\sc #1\savebox\@tempboxa{#3}\ifdim 
 \wd\@tempboxa>\z@ \hskip 5pt\relax \box\@tempboxa\fi.}]}

\newif\if@qeded\global\@qededfalse
\def\proof{\global\@qededfalse\@ifnextchar[{\@xproof}{\@proof}}
\def\endproof{\if@qeded\else\qed\fi\endtrivlist}
\def\qed{\unskip\kern 10pt{\unitlength1pt\linethickness{.4pt}\framebox(6,6){}}
\global\@qededtrue}
\def\@proof{\trivlist \item[\hskip 10pt\hskip 
 \labelsep{\sc Proof.}]\ignorespaces}
\def\@xproof[#1]{\trivlist \item[\hskip 10pt\hskip 
 \labelsep{\sc Proof #1.}]\ignorespaces}

\def\newdef#1#2{\expandafter\@ifdefinable\csname #1\endcsname
{\@definecounter{#1}\expandafter\xdef\csname
the#1\endcsname{\@thmcounter{#1}}\global
 \@namedef{#1}{\@defthm{#1}{#2}}\global
 \@namedef{end#1}{\@endtheorem}}}
\def\@defthm#1#2{\refstepcounter
 {#1}\@ifnextchar[{\@ydefthm{#1}{#2}}{\@xdefthm{#1}{#2}}}
\def\@xdefthm#1#2{\@begindef{#2}{\csname the#1\endcsname}\ignorespaces}
\def\@ydefthm#1#2[#3]{\trivlist \item[\hskip 10pt\hskip 
 \labelsep{\it #2\savebox\@tempboxa{#3}\ifdim 
 \wd\@tempboxa>\z@ \ \box\@tempboxa\fi.}]\ignorespaces}
\def\@begindef#1#2{\trivlist \item[\hskip 10pt\hskip 
 \labelsep{\it #1\ \rm #2.}]}

\def\theequation{\arabic{equation}}


\def\titlepage{\@restonecolfalse\if@twocolumn\@restonecoltrue\onecolumn
 \else \newpage \fi \thispagestyle{empty}\c@page\z@}
\def\endtitlepage{\if@restonecol\twocolumn \else \newpage \fi}

\arraycolsep 2.5pt \tabcolsep 6pt \arrayrulewidth .4pt \doublerulesep 2pt 
\tabbingsep \labelsep 

\skip\@mpfootins = \skip\footins
\fboxsep = 3pt \fboxrule = .4pt 

%\newcounter{part}
%\newcounter {section}
%\newcounter {subsection}[section]
%\newcounter {subsubsection}[subsection]
%\newcounter {paragraph}[subsubsection]

\def\thepart{\Roman{part}} \def\thesection {\arabic{section}}
\def\thesubsection {\thesection.\arabic{subsection}}
\def\thesubsubsection {{\rm \thesubsection .\arabic{subsubsection}}}
\def\theparagraph {{\rm \thesubsection .\arabic{subsubsection}.\arabic
 {paragraph}}}

\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}

\def\tableofcontents{\section*{Contents\@mkboth{CONTENTS}{CONTENTS}}
 \@starttoc{toc}}
\def\l@part#1#2{\addpenalty{\@secpenalty}
 \addvspace{2.25em plus 1pt} \begingroup
 \@tempdima 3em \parindent \z@ \rightskip \@pnumwidth \parfillskip
-\@pnumwidth 
 {\large \bf \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}}\par
 \nobreak \endgroup}
\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
\@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bf \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\listoffigures{\section*{List of Figures\@mkboth
 {LIST OF FIGURES}{LIST OF FIGURES}}\@starttoc{lof}}
\def\l@figure{\@dottedtocline{1}{1.5em}{2.3em}}
\def\listoftables{\section*{List of Tables\@mkboth
 {LIST OF TABLES}{LIST OF TABLES}}\@starttoc{lot}}
\let\l@table\l@figure


\def\thebibliography#1{\par \footnotesize 
\@ucheadfalse
\@startsection{subsection}{2}{\z@}{16pt plus 2pt minus 
 1pt}{2pt}{\sf}*{REFERENCES}
\list{\arabic{enumi}.}{\settowidth\labelwidth{99.}\leftmargin\labelwidth
 \advance\leftmargin\labelsep \topsep \z@ \parsep 0pt plus .1pt
 \itemsep \parsep
 \usecounter{enumi}}
 \def\newblock{\hskip .11em plus .33em minus .07em}
 \sloppy
 \widowpenalty=4500
 \clubpenalty=4500
 \sfcode`\.=1000\relax}
\let\endthebibliography=\endlist
 

\newif\if@restonecol
\def\theindex{\@restonecoltrue\if@twocolumn\@restonecolfalse\fi
\columnseprule \z@
\columnsep 35pt\twocolumn[\section*{Index}]
 \@mkboth{INDEX}{INDEX}\thispagestyle{plain}\parindent\z@
 \parskip\z@ plus .3pt\relax\let\item\@idxitem}
\def\@idxitem{\par\hangindent 40pt}
\def\subitem{\par\hangindent 40pt \hspace*{20pt}}
\def\subsubitem{\par\hangindent 40pt \hspace*{30pt}}
\def\endtheindex{\if@restonecol\onecolumn\else\clearpage\fi}
\def\indexspace{\par \vskip 10pt plus 5pt minus 3pt\relax}

\def\footnoterule{\kern-3\p@
 \hrule width 4pc \kern 2.6\p@} 

\long\def\@makefntext#1{\parindent 1em\noindent 
 $^{\@thefnmark}$#1}


\setcounter{topnumber}{2}
\def\topfraction{.89}
\setcounter{bottomnumber}{1}
\def\bottomfraction{.5}
\setcounter{totalnumber}{3}
\def\textfraction{.11}
\def\floatpagefraction{.6}
\setcounter{dbltopnumber}{2}
\def\dbltopfraction{.7}
\def\dblfloatpagefraction{.5}

\long\def\@makecaption#1#2{\vskip 1pc \setbox\@tempboxa\hbox{#1.\hskip
1em\relax #2}
 \ifdim \wd\@tempboxa >\hsize #1: #2\par \else \hbox
to\hsize{\hfil\box\@tempboxa\hfil} 
 \fi}

\def\nocaption{\refstepcounter\@captype \par
 \vskip 1pc \hbox to\hsize{\hfil \footnotesize Figure \thefigure
 \hfil}}


%\newcounter{figure}
\def\thefigure{\@arabic\c@figure}
\def\fps@figure{tbp}
\def\ftype@figure{1}
\def\ext@figure{lof}
\def\fnum@figure{Fig.\ \thefigure}
\def\figure{\let\normalsize\footnotesize \normalsize \@float{figure}}
\let\endfigure\end@float
\@namedef{figure*}{\@dblfloat{figure}}
\@namedef{endfigure*}{\end@dblfloat}

%\newcounter{table}
\def\thetable{\@Roman\c@table}
\def\fps@table{tbp}
\def\ftype@table{2}
\def\ext@table{lot}
\def\fnum@table{Table \thetable}
\def\table{\let\normalsize\footnotesize \normalsize\@float{table}}
\let\endtable\end@float
\@namedef{table*}{\@dblfloat{table}}
\@namedef{endtable*}{\end@dblfloat}
\def\acmtable#1{\@narrowfig #1\relax
 \let\caption\@atcap \let\nocaption\@atnocap
 \def\@tmpnf{}\@ifnextchar[{\@xntab}{\@ntab}}
\def\endacmtable{\hbox to \textwidth{\hfil
\vbox{\hsize \@narrowfig
\box\@nfcapbox
{\baselineskip 4pt \hbox{\vrule height .4pt width \hsize}}
\vskip -1pt
\box\@nfigbox\vskip -1pt
{\baselineskip 4pt \hbox{\vrule height .4pt width \hsize}}}\hfil}
\end@float}
\def\@xntab[#1]{\def\@tmpnf{[#1]}\@ntab}
\def\@ntab{\expandafter\table\@tmpnf
 \setbox\@nfigbox\vbox\bgroup
 \hsize \@narrowfig \@parboxrestore}
\def\@atmakecap #1#2{\setbox\@tempboxa\hbox{#1.\hskip 1em\relax #2}
 \ifdim \wd\@tempboxa >\hsize \sloppy #1.\hskip 1em\relax #2 \par \else \hbox
to\hsize{\hfil\box\@tempboxa\hfil}
 \fi}
\def\@atcap{\par\egroup\refstepcounter\@captype 
 \@dblarg{\@atcapx\@captype}}
\long\def\@atcapx#1[#2]#3{\setbox\@nfcapbox\vbox {\hsize \wd\@nfigbox
 \@parboxrestore
 \@atmakecap{\csname fnum@#1\endcsname}{\ignorespaces #3}\par}}
\def\@atnocap{\egroup \refstepcounter\@captype 
 \setbox\@nfcapbox\vbox {\hsize \wd\@nfigbox
 \hbox to\hsize{\hfil \footnotesize Table \thetable\hfil}}}

\def\narrowfig#1{\@narrowfig #1\relax
 \let\caption\@nfcap \let\nocaption\@nfnocap
 \def\@tmpnf{}\@ifnextchar[{\@xnfig}{\@nfig}}
\def\endnarrowfig{\hbox to \textwidth{\if@nfeven
 \box\@nfcapbox\hfil\box\@nfigbox
 \else \box\@nfigbox\hfil\box\@nfcapbox\fi}\end@float}
\def\@xnfig[#1]{\def\@tmpnf{[#1]}\@nfig}
\def\@nfig{\expandafter\figure\@tmpnf
 \setbox\@nfigbox\vbox\bgroup
 \hsize \@narrowfig \@parboxrestore}
\def\@nfmakecap #1#2{\setbox\@tempboxa\hbox{#1.\hskip 1em\relax #2}
 \ifdim \wd\@tempboxa >\hsize \sloppy #1.\hskip 1em\relax #2 \par \else \hbox
to\hsize{\if@nfeven\else\hfil\fi\box\@tempboxa\if@nfeven\hfil\fi}
 \fi}
\def\@nfcap{\par\egroup\refstepcounter\@captype 
 \@dblarg{\@nfcapx\@captype}}
\long\def\@nfcapx#1[#2]#3{\@seteven
 \setbox\@nfcapbox\vbox to \ht\@nfigbox
 {\hsize \textwidth \advance\hsize -2pc \advance\hsize -\wd\@nfigbox
 \@parboxrestore
 \vfil 
 \@nfmakecap{\csname fnum@#1\endcsname}{\ignorespaces #3}\par
 \vfil}}
\def\@nfnocap{\egroup \refstepcounter\@captype \@seteven
 \setbox\@nfcapbox\vbox to \ht\@nfigbox
 {\hsize \textwidth \advance\hsize -2pc \advance\hsize -\wd\@nfigbox
 \@parboxrestore
 \vfil 
 \hbox to\hsize{\if@nfeven\else\hfil\fi 
 \footnotesize Figure \thefigure
 \if@nfeven\hfil\fi}
 \vfil}}
\def\@seteven{\@nfeventrue 
\@ifundefined{r@@nf\thefigure}{}{\edef\@tmpnf{\csname 
 r@@nf\thefigure\endcsname
 }\edef\@tmpnf{\expandafter\@cdr\@tmpnf\@nil}\ifodd\@tmpnf\relax
 \@nfevenfalse\fi}\label{@nf\thefigure}\edef\@tmpnfx{\if@nfeven e\else o\fi}
\edef\@tmpnf{\write\@unused {\noexpand\ifodd \noexpand\c@page 
 \noexpand\if \@tmpnfx e\noexpand\@nfmsg{\thefigure} \noexpand\fi
 \noexpand\else 
 \noexpand\if \@tmpnfx o\noexpand\@nfmsg{\thefigure}\noexpand\fi 
 \noexpand\fi }}\@tmpnf}
\def\@nfmsg#1{Bad narrowfig: Figure #1 on page \thepage}

\newdimen\@narrowfig
\newbox\@nfigbox
\newbox\@nfcapbox
\newif\if@nfeven 

\def\and{\\ and\\}
\def\maketitle{\newpage \thispagestyle{titlepage}\par
 \begingroup \lineskip = \z@\null \vskip -30pt\relax 
 \parindent\z@ \LARGE {\raggedright \hyphenpenalty\@M
 \sf \@title \par}
 \vskip 12pt\relax \normalsize \sf
 \begingroup \addtolength{\baselineskip}{2pt}
 \@author\par 
 \endgroup
 {\ifx \@categories\@empty 
 \else 
 \baselineskip 17pt\relax
 \hbox{\vrule height .5pt width 30pc}}
 \vskip 12pt \footnotesize \box\@abstract \vskip 4pt\relax
 {\def\and{\unskip\/{\rm ; }}
 Categories and Subject Descriptors: \@categories \fi}\par\vskip 4pt\relax
 \box\@terms \vskip 4pt\relax
 \box\@keywords \par \label{@firstpg}
 {\baselineskip 14pt\relax 
 \hbox{\vrule height .5pt width 30pc}}
 \vskip 22pt\relax
 \endgroup
\let\maketitle\relax
 % \gdef\@author{}\gdef\@title{}
 \gdef\@categories{}}

\newbox\@abstract
\newbox\@terms
\newbox\@keywords
\def\abstract{\global\setbox\@abstract=\vbox\bgroup \everypar{}
 \footnotesize \hsize 30pc \parindent 10pt \noindent 
 \rule{0pt}{10pt}\ignorespaces}
\def\endabstract{\egroup}

\def\terms#1{\setbox\@terms=\vbox{\everypar{}
 \footnotesize \hsize 30pc \parindent 0pt \noindent 
 General terms: \ignorespaces #1}}
\def\keywords#1{\setbox\@keywords=\vbox{\everypar{}
 \footnotesize \hsize 30pc \parindent 0pt \noindent 
 Additional Key Words and Phrases: \ignorespaces #1}}

\def\category#1#2#3{\@ifnextchar
 [{\@category{#1}{#2}{#3}}{\@xcategory{#1}{#2}{#3}}}
\def\@category#1#2#3[#4]{\edef\@tempa{\ifx \@categories\@empty 
 \else ; \fi}{\def\protect{\noexpand\protect
 \noexpand}\def\and{\noexpand\and}\xdef\@categories{\@categories\@tempa #1
[{\bf #2}]: 
 #3\kern\z@---\hskip\z@{\it #4}}}}
\def\@xcategory#1#2#3{\edef\@tempa{\ifx \@categories\@empty \else ;
\fi}{\def\protect{\noexpand\protect\noexpand}\def\and{\noexpand
 \and}\xdef\@categories{\@categories\@tempa #1 [{\bf #2}]: #3}}}
\def\@categories{}
\def\bottomstuff{\global\@topnum\z@ \global\@botroom \textheight \begin{figure}
\parindent\z@
\hbox{}
\vskip -\textfloatsep
\vskip 11pt
\hrule height .4pt width 30pc
\vskip 2pt\rule{0pt}{10pt}\ignorespaces}
\def\endbottomstuff{\end{figure}\gdef\permission{}}
\long\def\permission{\par Permission to copy without fee all or part of
this material is granted provided that the copies are not made or distributed
for direct commercial advantage, the ACM copyright notice and the title of
the publication and its date appear, and notice is given that copying is
by permission of the Association for Computing Machinery. To copy otherwise,
or to republish, requires a fee and/or specific permission.\par}
\def\acks{\par \footnotesize 
\@ucheadfalse
\@startsection{subsection}{2}{\z@}{-16pt plus -2pt minus 
 -1pt}{2pt}{\sf}*{ACKNOWLEDGMENTS}\par\normalsize}
\def\endacks{\par}
\def\received{\par\footnotesize\addvspace{18pt plus 0pt minus
4pt}\parindent\z@}
\def\endreceived{\label{@lastpg}\par}

\mark{{}{}} 

\def\ps@myheadings{\let\@mkboth\@gobbletwo
\def\@oddhead{\hbox{}\hfill \small\sf \rightmark\hskip
19pt{\Large$\cdot$}\hskip 17pt\thepage}\def\@oddfoot{\hbox{}\hfill
\tiny\@runningfoot}\def\@evenhead{\small\sf\thepage \hskip
17pt{\Large$\cdot$}\hskip
 19pt\leftmark\hfill \hbox{}}\def\@evenfoot{\tiny\@runningfoot
 \hfill\hbox{}}\def\sectionmark##1{}\def\subsectionmark##1{}}
\def\@runningfoot{}
\def\runningfoot#1{\def\@runningfoot{#1}}
\def\@firstfoot{}
\def\firstfoot#1{\def\@firstfoot{#1}}
\def\pages{\pageref{@firstpg}--\pageref{@lastpg}}
\def\ps@titlepage{\let\@mkboth\@gobbletwo
\def\@oddhead{}\def\@oddfoot{\hbox{}\hfill
\tiny\@firstfoot}\def\@evenhead{}\def\@evenfoot{\tiny\@firstfoot\hfill\hbox{}}}

\def\today{\ifcase\month\or
 January\or February\or March\or April\or May\or June\or
 July\or August\or September\or October\or November\or December\fi
 \space\number\day, \number\year}
\def\@marrayclassiv{\@addtopreamble{$\displaystyle \@nextchar$}}
\def\@marrayclassz{\ifcase \@lastchclass \@acolampacol \or \@ampacol \or
 \or \or \@addamp \or
 \@acolampacol \or \@firstampfalse \@acol \fi
\edef\@preamble{\@preamble
 \ifcase \@chnum 
 \hfil$\relax\displaystyle\@sharp$\hfil \or $\relax\displaystyle\@sharp$\hfil 
 \or \hfil$\relax\displaystyle\@sharp$\fi}}
\def\marray{\arraycolsep 2.5pt\let\@acol\@arrayacol \let\@classz\@marrayclassz
 \let\@classiv\@marrayclassiv \let\\\@arraycr\def\@halignto{}\@tabarray}
\def\endmarray{\crcr\egroup\egroup}


\ps@myheadings \pagenumbering{arabic} \onecolumn 


%-----------------------BIBLIOGRAPHY STUFF-------------------------
% this is adapted (November 1993) by Andrew Appel and Rebecca Davies from
% 
%%%     filename        = "chicago.sty",
%%%     version         = "4",  % MODIFIED!
%%%     date            = "31 August 1992",
%%%     time            = "09:42:44 199",
%%%     author          = "Glenn Paulley",
%%%     address         = "Data Structuring Group
%%%                        Department of Computer Science
%%%                        University of Waterloo
%%%                        Waterloo, Ontario, Canada
%%%                        N2L 3G1",
%%%     telephone       = "(519) 885-1211",
%%%     FAX             = "(519) 885-1208",
%%%     email           = "gnpaulle@bluebox.uwaterloo.ca",

%%% ====================================================================
%
% this file: Modification of chicago.sty for new ACM bibliography
% style, which is similar (but not identical) to the ``Chicago'' style.
%
% chicago.sty: Style file for use with bibtex style chicago.bst, for
% bibliographies formatted according to the 13th Edition of the Chicago
% Manual of Style.
%
% 'newapa.bst' was made from 'plain.bst', 'named.bst', and 'apalike.bst',
% with lots of tweaking to make it look like APA style, along with tips
% from Young Ryu and Brian Reiser's modifications of 'apalike.bst'.
% newapa.sty formed the basis of this style, chicago.sty. Author-date
% references in newapa.bst formed the basis for chicago.bst. Chicagoa.bst
% supports annotations.
%
% Version 4 (August, 1992):
% - fixed chicago.bst and chicagoa.bst to handle long author lists in
%   sorting
% - fixed chicago.bst and chicagoa.bst so that missing page numbers in
%   ``article'' entries are handled correctly
% - modified chicago.sty to format entries with 2nd and subsequent lines
%   indented.
%
%   Citation format: (author-last-name year)
%             (author-last-name and author-last-name year)
%             (author-last-name et al. year)
%             (author-last-name)
%             author-last-name
%             author-last-name (year)
%             (author-last-name and author-last-name)
%             (author-last-name et al.)
%             (year) or (year,year)
%             year or year,year
%
%   Reference list ordering: alphabetical by author or whatever passes
%    for author in the absence of one.
%
% This BibTeX style has support for abbreviated author lists and for
%    year-only citations.  This is done by having the citations
%    actually look like
%
%    \citeauthoryear{full-author-info}{abbrev-author-info}{year}
%
% The LaTeX style has to have the following (or similar)
%
%     \let\@internalcite\cite
%     \def\fullcite{\def\citeauthoryear##1##2##3{##1, ##3}\@internalcite}
%     \def\fullciteA{\def\citeauthoryear##1##2##3{##1}\@internalcite}
%     \def\shortcite{\def\citeauthoryear##1##2##3{##2, ##3}\@internalcite}
%     \def\shortciteA{\def\citeauthoryear##1##2##3{##2}\@internalcite}
%     \def\citeyear{\def\citeauthoryear##1##2##3{##3}\@internalcite}
%
% -------------------------------------------------------------------------
% This file implements citations for the ``chicago'' bibliography style.
%  Place it in a file called chicago.sty in the TeX search path.
%(Placing it in the same directory as the LaTeX document should also work.)
%
%    This file is a modification of the ``newapa'' LaTeX style,
%    originally adapted by Steven Spencer from the ``apalike'' LaTeX style.
%    It was originally modified by Stephen N. Spencer, with further
%    modifications by Young U. Ryu.
%
% The ``chicago'' BibTeX bibliography style creates citations with labels:

%       \citeauthoryear{author-info}{abbrev. author-info}{year}
%
% These labels are processed by the following LaTeX commands:
%
%  \cite{key}
%    which produces citations with full author list and year.
%    eg. (Brown 1978; Jarke, Turner, Stohl, et al. 1985)
%  \citeNP{key}
%    which produces citations with full author list and year, but without
%    enclosing parentheses:
%    eg. Brown 1978; Jarke, Turner and Stohl 1985
%  \citeA{key}
%    which produces citations with only the full author list.
%    eg. (Brown; Jarke, Turner and Stohl)
%  \citeANP{key}
%    which produces citations with only the full author list, without
%    parentheses eg. Brown; Jarke, Turner and Stohl
%  \citeN{key}
%    which produces citations with the full author list and year, but
%    can be used as nouns in a sentence; no parentheses appear around
%    the author names, but only around the year.
%      eg. Shneiderman (1978) states that......
%    \citeN should only be used for a single citation.
%  \shortcite{key}
%    which produces citations with abbreviated author list and year.
%  \shortciteNP{key}
%    which produces citations with abbreviated author list and year.
%  \shortciteA{key}
%    which produces only the abbreviated author list.
%  \shortciteANP{key}
%    which produces only the abbreviated author list.
%  \shortciteN{key}
%    which produces the abbreviated author list and year, with only the
%    year in parentheses. Use with only one citation.
%  \citeyear{key}
%    which produces the year information only, within parentheses.
%  \citeyearNP{key}
%    which produces the year information only.
%
% Abbreviated author lists use the ``et al.'' construct.
%
% `NP' means `no parentheses'.
%
% This LaTeX style file must be used a MODERN (1993 or later) version
% of ``acmtrans'' BibTeX style.
%
\typeout{Using ACM bibliography style}
%
% -------------------------------------------------------------------------
%
% Citation macros.
%
\let\@internalcite\cite
%
\def\cite{\def\@citeseppen{-1000}%
    \def\@cite##1##2{[##1\if@tempswa , ##2\fi]}%
    \def\citeauthoryear##1##2##3{##1 ##3}\@internalcite}
\def\citeNP{\def\@citeseppen{-1000}%
    \def\@cite##1##2{##1\if@tempswa , ##2\fi}%
    \def\citeauthoryear##1##2##3{##1 ##3}\@internalcite}
\def\citeN{\def\@citeseppen{-1000}%
    \def\@cite##1##2{##1\if@tempswa , ##2]\else{]}\fi}%
    \def\citeauthoryear##1##2##3{##1 [##3}\@citedata}
\def\citeA{\def\@citeseppen{-1000}%
    \def\@cite##1##2{[##1\if@tempswa , ##2\fi]}%
    \def\citeauthoryear##1##2##3{##1}\@internalcite}
\def\citeANP{\def\@citeseppen{-1000}%
    \def\@cite##1##2{##1\if@tempswa , ##2\fi}%
    \def\citeauthoryear##1##2##3{##1}\@internalcite}
%
\def\shortcite{\def\@citeseppen{-1000}%
    \def\@cite##1##2{[##1\if@tempswa , ##2\fi]}%
    \def\citeauthoryear##1##2##3{##2\ ##3}\@internalcite}
\def\shortciteNP{\def\@citeseppen{-1000}%
    \def\@cite##1##2{##1\if@tempswa , ##2\fi}%
    \def\citeauthoryear##1##2##3{##2\ ##3}\@internalcite}
\def\shortciteN{\def\@citeseppen{-1000}%
    \def\@cite##1##2{##1\if@tempswa , ##2]\else{]}\fi}%
    \def\citeauthoryear##1##2##3{##2\ [##3}\@citedata}
\def\shortciteA{\def\@citeseppen{-1000}%
    \def\@cite##1##2{[##1\if@tempswa , ##2\fi]}%
    \def\citeauthoryear##1##2##3{##2}\@internalcite}
\def\shortciteANP{\def\@citeseppen{-1000}%
    \def\@cite##1##2{##1\if@tempswa , ##2\fi}%
    \def\citeauthoryear##1##2##3{##2}\@internalcite}
%
\def\citeyear{\def\@citeseppen{-1000}%
    \def\@cite##1##2{[##1\if@tempswa , ##2\fi]}%
    \def\citeauthoryear##1##2##3{##3}\@citedata}
\def\citeyearNP{\def\@citeseppen{-1000}%
    \def\@cite##1##2{##1\if@tempswa , ##2\fi}%
    \def\citeauthoryear##1##2##3{##3}\@citedata}

%
% \@citedata and \@citedatax:
%
% Place commas in-between citations in the same \citeyear, \citeyearNP,
% \citeN, or \shortciteN command.
% Use something like \citeN{ref1,ref2,ref3} and \citeN{ref4} for a list.
%
\def\@citedata{%
	\@ifnextchar [{\@tempswatrue\@citedatax}%
				  {\@tempswafalse\@citedatax[]}%
}

\def\@citedatax[#1]#2{%
\if@filesw\immediate\write\@auxout{\string\citation{#2}}\fi%
  \def\@citea{}\@cite{\@for\@citeb:=#2\do%
    {\@citea\def\@citea{, }\@ifundefined% by Young
       {b@\@citeb}{{\bf ?}%
       \@warning{Citation `\@citeb' on page \thepage \space undefined}}%
{\csname b@\@citeb\endcsname}}}{#1}}%

% don't box citations, separate with ; and a space
% also, make the penalty between citations negative: a good place to break.
%
\def\@citex[#1]#2{%
\if@filesw\immediate\write\@auxout{\string\citation{#2}}\fi%
  \def\@citea{}\@cite{\@for\@citeb:=#2\do%
    {\@citea\def\@citea{; }\@ifundefined% by Young
       {b@\@citeb}{{\bf ?}%
       \@warning{Citation `\@citeb' on page \thepage \space undefined}}%
{\csname b@\@citeb\endcsname}}}{#1}}%

% (from apalike.sty)
% No labels in the bibliography.
%
\def\@biblabel#1{}

% (from apalike.sty)
% Set length of hanging indentation for bibliography entries.
%
\newlength{\bibhang}
\setlength{\bibhang}{2em}

% Indent second and subsequent lines of bibliographic entries. Stolen
% from openbib.sty: \newblock is set to {}.

\newdimen\bibindent
\bibindent=1.5em
\@ifundefined{refname}%
   {\@ifundefined{chapter}%
     {\newcommand{\refname}{References}}%
     {\newcommand{\refname}{Bibliography}}%
   }%
   {}%
\@ifundefined{chapter}%
 {\def\thebibliography#1{\section*{\refname\@mkboth
   {\uppercase{\refname}}{\uppercase{\refname}}}\list
   {[\arabic{enumi}]}{\settowidth\labelwidth{[#1]}
   \leftmargin\labelwidth
   \advance\leftmargin\labelsep
   \advance\leftmargin\bibindent
   \itemindent -\bibindent
   \listparindent \itemindent
   \parsep \z@
   \usecounter{enumi}}
   \def\newblock{}
   \sloppy
   \sfcode`\.=1000\relax}}
 {\def\thebibliography#1{\chapter*{\refname\@mkboth
   {\uppercase{\refname}}{\uppercase{\refname}}}\list
   {[\arabic{enumi}]}{\settowidth\labelwidth{[#1]}
   \leftmargin\labelwidth
   \advance\leftmargin\labelsep
   \advance\leftmargin\bibindent
   \itemindent -\bibindent
   \listparindent \itemindent
   \parsep \z@
   \usecounter{enumi}}
   \def\newblock{}
   \sloppy
   \sfcode`\.=1000\relax}}


\makeatother



% THE FOLLOWING FIXES AN APPARENT BUG IN THE enumerate ENVIRONMENT.
% Here is the history: The current version of enumerate in acmtrans.sty
% differs slightly from the standard one defined in latex.tex.  This
% difference causes an enumeration to behave badly inside a trivlist--
% for example, in a theorem environment.  Presumably, the modification
% was made for some reason, but I have no idea for what reason.  The
% following redefines the enumerate environment to its original definition.
% HOWEVER, THIS MAY CAUSE OTHER PROBLEMS.
\makeatletter
  \def\enumerate{\ifnum \@enumdepth >3 \@toodeep\else
      \advance\@enumdepth \@ne 
      \edef\@enumctr{enum\romannumeral\the\@enumdepth}\list
      {\csname label\@enumctr\endcsname}{\usecounter
        {\@enumctr}\def\makelabel##1{\hss\llap{##1}}}\fi}



% THE FOLLOWING CHANGES "General terms" to "General Terms" 

\def\terms#1{\setbox\@terms=\vbox{\everypar{}
 \footnotesize \hsize 30pc \parindent 0pt \noindent 
 General Terms: \ignorespaces #1}}

\makeatother

% \ordinarily : Command to make it easy to switch to LNCS style
% IF the control sequence \notordinary is undefined
%    THEN \ordinarily{foo} is defined to expand to foo
%    ELSE \ordinarily{foo} is defined to expand to nothing.
%
% Add \newcommand{\notordinary}{} before this definition to
% produce the exceptional definition.
\makeatletter
\@ifundefined{notordinary}{\newcommand{\ordinarily}[1]{#1}}%
  {\newcommand{\ordinarily}[1]{}}
\makeatother



\makeatletter
%%%% file pf-acm.sty
% pf-acm.sty  (same as pf.sty except assumes \proof and \qed already defined)
%
% last modified on Mon Jul 25 10:24:28 PDT 1994 by lamport

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                       SPACING                               %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% COMMANDS
%   \pflongindent == Indent proofs to full width of item label
%   \pfshortindent == Indent proofs by \pfindent [the default]

\newif\if@pfLongIndent %  true if indent proof to width of label.
\@pfLongIndentfalse
\newcommand{\pflongindent}{\@pfLongIndenttrue}
\newcommand{\pfshortindent}{\@pfLongIndentfalse}

% PARAMETERS
%  \pfindent   == indentation at beginning of a proof
%  \pftopsep   == space above first proof environment
%  \pfbotsep   == space below first proof environment
%  \pfsep      == space above and below inner proof environment
%  \stepsep    == space above and below proof step
%  pfhidelevel == counter, specifying level at which proofs are hidden

\newlength{\pfindent}      
\newlength{\pftopsep}  
\newlength{\pfbotsep}  
\newlength{\pfsep}  
\newlength{\stepsep}        
\newbox{\pfbox}
\newcounter{pfhidelevel}
\setcounter{pfhidelevel}{9999}
\newcommand{\pfhidelevel}[1]{\setcounter{pfhidelevel}{#1}}

\setlength{\pfindent}{1em} 
\setlength{\pftopsep}{1ex}     % space above first proof environment
\setlength{\pfbotsep}{1ex}     % space below first proof environment
\setlength{\pfsep}{0pt}        % space above and below inner proof environment
\setlength{\stepsep}{0pt}      % space above and below proof step

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                   STEP NUMBERING                            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% COMMANDS
%   \pfshortnumbers{N} == Use short step numbers for all levels >= N
%
%   \pfsidenumbers{N}{D} == print side numbers for proof steps of all
%                           levels >= N, left-aligned length D 
%                           to left of left margin
%   \pfnosidenumbers     == do not print side numbers (the default)

%\newcommand{\pflongnumbers}{\@pfLongNumberstrue}
\newcommand{\pfshortnumbers}[1]{\pfshortNumberLevel=#1\relax}

\newcount\pfshortNumberLevel \pfshortNumberLevel=0


\newcommand{\pfstepnumber}[3]{%
   \ifnum \pfLevelCount < \pfshortNumberLevel
       #3%
     \else $\langle#1\rangle#2$%
   \fi}

\newcommand{\pflevelnumber}[2]{%
   \ifnum \pfLevelCount < \pfshortNumberLevel
       #2%
     \else $\langle#1\rangle$%
   \fi}

\newif\if@pfSideNumbers %  true if putting long numbers at margin
\@pfSideNumbersfalse
\newcounter{pf@sidenumberdepth}
\newlength{\pf@sidenumberoutdent}
\newcommand{\pfsidenumbers}[2]{\@pfSideNumberstrue
     \setcounter{pf@sidenumberdepth}{#1}%
     \addtocounter{pf@sidenumberdepth}{-1}%
     \setlength{\pf@sidenumberoutdent}{#2}}
\newcommand{\pfnosidenumbers}{\@pfSideNumbersfalse}


\newcount\pfLevelCount  \pfLevelCount=0 % current level number
\newcount\pfStepCount   \pfStepCount=0  % current step number
\newcommand{\pfLongLevel}{} % The long version of current level--e.g., 2.7.5
\newcommand{\pfLongStep}{}  % The long version of current step--e.g., 2.7.5.2
\newcommand{\pfStepName}{}  % {current level name}{current step name} 

% \pfSetName ==  LongStep := current long step name
%                StepName := current step name
\newcommand{\pfSetName}{%
  \edef\pfLongStep{%
    \ifnum\pfLevelCount>\@ne
      \pfLongLevel\pfdot\the\pfStepCount
     \else\the\pfStepCount\fi}%
  \edef\pfStepName{%
   \ifnum \pfLevelCount < \pfshortNumberLevel
    {\pfLongStep}{\pfLongStep}%
    \else
     {$\langle\the\pfLevelCount\rangle$}%
     {$\langle\the\pfLevelCount\rangle\the\pfStepCount$}%
   \fi}}

% \pfSetRef{foo} ==  IF \pf@foo UNDEFINED
%                       THEN \pf@foo := StepName 
%                       ELSE WARNING
\newcommand{\pfSetRef}[1]{%
  \@ifundefined{pf@#1}%
    {\expandafter
      \edef\csname pf@#1\endcsname{\pfStepName}}%
    {\typeout{WARNING:
         proof step "#1" (<\the\pfLevelCount>\the\pfStepCount) 
        already defined}}%
    }


\newcommand{\pfPrintStepNumber}[2]{#2}
\newcommand{\pfPrintLevelNumber}[2]{#1}

% \stepref{FOO} == Print \pf@FOO as a step number
\newcommand{\stepref}[1]{\@ifundefined{pf@#1}{{\bf ??}\typeout{WARNING:
 proof step "#1" undefined}}{\expandafter\expandafter\expandafter
 \pfPrintStepNumber\csname pf@#1\endcsname}}

\newcommand{\levelref}[1]{\@ifundefined{pf@#1}{{\bf ??}\typeout{WARNING:
 proof step #1 undefined}}%
  {\expandafter\expandafter\expandafter
 \pfPrintLevelNumber\csname pf@#1\endcsname}}

\newcommand{\toplevel}{\pflevelnumber{0}{0}}

\newlength{\pf@outdent}
\newcommand{\pfSideNumber}{%
  \if@pfSideNumbers 
   \ifnum\pfLevelCount>\value{pf@sidenumberdepth}%
    \hspace*{-\pf@outdent}%
    \makebox[0pt][l]{\footnotesize\pfLongStep}%
    \hspace*{\pf@outdent}%
    \else\fi
   \else\fi}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                   THE pflist ENVIRONMENT                    %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%% The pflist environment is the same as list environment except 
%% it can be nested deeper.

\def\pflist#1#2{\ifnum \@listdepth >15\relax \@toodeep 
     \else \global\advance\@listdepth\@ne \fi
  \rightmargin \z@ \listparindent\z@ \itemindent\z@
  \csname @list\romannumeral\the\@listdepth\endcsname 
  \def\@itemlabel{#1}\let\makelabel\@mklab \@nmbrlistfalse #2\relax
  \@trivlist
  \parskip\parsep \parindent\listparindent
  \advance\linewidth -\rightmargin \advance\linewidth -\leftmargin
  \advance\@totalleftmargin \leftmargin
  \parshape \@ne \@totalleftmargin \linewidth 
  \ignorespaces}

\def\endpflist{\global\advance\@listdepth\m@ne
    \endtrivlist}

\let\@listvii=\@listv
\let\@listviii=\@listv
\let\@listix=\@listv
\let\@listx=\@listv
\let\@listxi=\@listv
\let\@listxii=\@listv
\let\@listxiii=\@listv
\let\@listxiv=\@listv
\let\@listxv=\@listv
\let\@listxvi=\@listv

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                   THE proof ENVIRONMENT                     %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%

\renewenvironment{proof}{%       BEGIN:
  \edef\pfLongLevel          % LongLevel := 
   {\ifnum\pfLevelCount>\z@  %    IF LevelCount > 0
     \ifnum\pfLevelCount>\@ne%     THEN IF LevelCount > 1
      \pfLongLevel\pfdot\else\fi  %            THEN LongLevel * "." FI
      \the\pfStepCount       %          * StepCount
     \else\fi}%              %     ELSE FI
  \advance\pfLevelCount\@ne  %   LevelCount := LevelCount + 1
  \@tempcnta=\value{pfhidelevel}%
  \ifnum\@tempcnta<\@ne
    \setcounter{pfhidelevel}{1}%
    \typeout{WARNING: pfhidelevel < 1, setting to 1}%
    \@tempcnta=\@ne\fi
  \advance\@tempcnta\@ne
  \if@qedstep
    \advance\@tempcnta\@ne
    \ifnum\pfLevelCount 
        = \@tempcnta 
     \sbox{\pfbox}\bgroup\begin{minipage}{\textwidth}\fi
  \else     
   \ifnum\pfLevelCount 
        = \@tempcnta 
     \sbox{\pfbox}\bgroup\begin{minipage}{\textwidth}\fi\fi
  \pfStepCount=\z@           %   StepCount  := 0
  \ifnum\pfLevelCount>\@ne   %   IF LevelCount > 1
   \begin{pflist}{}{%          %     THEN Begin List with
    \topsep=\pfsep\relax     %           \topsep     := \pfsep
    \itemsep=\z@             %           \itemsep    := 0
    \parsep=\z@              %           \parsep     := 0
    \partopsep=\z@           %           \partopsep  := 0
    \if@pfLongIndent         %          IF LongIndent
     \settowidth{\leftmargin}%%           THEN
      {\expandafter          %              \leftmargin := width of step name
       \pfPrintStepNumber    %                             + \labelsep
       \pfStepName.}%
     \advance\leftmargin
     \labelsep 
    \else                    %           ELSE
    \leftmargin=\pfindent    %            \leftmargin := \pfindent
    \fi\relax        
   }   \item[]
   \else \par                %     ELSE \par
    \addvspace{\pftopsep}%   %          addvspace of \pftopsep
    \parindent=\z@           %          \parindent := 0
    \parskip = \z@           %          \parskip := 0
    \@ifundefined{mathindent}{%
      \abovedisplayskip=\z@ plus .2ex       % set display skips
      \abovedisplayshortskip=\z@ plus .2ex
      \belowdisplayskip=\z@ plus .2ex
      \belowdisplayshortskip=\z@ plus .2ex}{%
      \mathindent=1em}%
    \let\enumerate\pfenum       %   enumerate environment <- pfenum
    \let\endenumerate\endpfenum %
 \fi
\@qedstepfalse
    }%                       % END:
  {\ifnum\pfLevelCount>\@ne  %   IF LevelCount > 1
    \end{pflist}%              %     THEN End List
   \else \par                %     ELSE \par
     \addvspace{\pfbotsep}%  %          addvspace of \pfbotsep
   \fi
  \@tempcnta=\value{pfhidelevel}%
  \advance\@tempcnta\@ne
  \if@qedstep
    \advance\@tempcnta\@ne
    \ifnum\pfLevelCount 
        = \@tempcnta 
     \end{minipage}\egroup\sbox{\pfbox}{}\@qedstepfalse\fi
  \else 
      \ifnum\pfLevelCount 
        =\@tempcnta 
        \end{minipage} 
        \egroup\sbox{\pfbox}{}\fi
 \fi}


\newenvironment{noproof}{%   % BEGIN:
  \edef\pfLongLevel          % LongLevel := 
   {\ifnum\pfLevelCount>\z@  %    IF LevelCount > 0
     \ifnum\pfLevelCount>\@ne%     THEN IF LevelCount > 1
      \pfLongLevel.\else\fi  %            THEN LongLevel * "." FI
      \the\pfStepCount       %          * StepCount
     \else\fi}%              %     ELSE FI
  \advance\pfLevelCount\@ne  %   LevelCount := LevelCount + 1
  \pfStepCount=\z@           %   StepCount  := 0
  \par                       %   \par
  \parindent=\z@             %          \parindent := 0
  \parskip = \z@             %          \parskip := 0
  \@ifundefined{mathindent}{%
      \abovedisplayskip=\z@ plus .2ex       % set display skips
      \abovedisplayshortskip=\z@ plus .2ex
      \belowdisplayskip=\z@ plus .2ex
      \belowdisplayshortskip=\z@ plus .2ex}{%
      \mathindent=1em}%
  \let\enumerate\pfenum       %   enumerate environment <- pfenum
  \let\endenumerate\endpfenum %
  }%                         % END:
  {\par}                     %  \par

%% step 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                     \step, \assume, ETC.                    %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
\newcommand{\step}[2]{\begin{step+}{#1}#2\end{step+}}
\newif\if@qedstep %  true right after a \qedstep if in the scope of an 
                  %  \unhideqedproof declaration
\@qedstepfalse

\newif\if@unhideqedstep % set true by \unhideqproof, false by \hideqproof. 

\@unhideqedstepfalse
\newcommand{\unhideqedproof}{\@unhideqedsteptrue}
\newcommand{\hideqedproof}{\@unhideqedstepfalse}

\newcommand{\qedstep}{\step{qedstep\the\pfLevelCount}{Q.E.D.}
\if@unhideqedstep\@qedsteptrue\fi}

\newcommand{\nostep}[1]{% 
  \advance\pfStepCount\@ne       % StepCount := StepCount + 1
  \pfSetName                     % SetName
  \pfSetRef{#1}%                 % SetRef
  }

\newenvironment{step+}[1]%
 {\endgroup                      % Move Outside environment scope
  \advance\pfStepCount\@ne       % StepCount := StepCount + 1
  \pfSetName                     % SetName
  \pfSetRef{#1}%                 % SetRef
 \begingroup\@endpefalse         % Move inside environment scope
   \def\@currenvir{step+}%       %   by simulating \begin{step+}
 \begin{pflist}{}{%                % Begin list environment with
   \setlength
     {\pf@outdent}{\textwidth}%  %   \pf@outdent = outdent
   \addtolength                  %                 for side numbers
    {\pf@outdent}{-\linewidth}%  
   \addtolength
    {\pf@outdent}%
    {\pf@sidenumberoutdent}%
   \topsep=\stepsep\relax        %   \topsep     := \stepsep
   \itemsep=\z@                  %   \itemsep    := 0
   \parsep=\z@                   %   \parsep     := 0
   \partopsep=\z@                %   \partopsep  := 0
   \settowidth{\labelwidth}%     %   \labelwidth := width of step name.
     {\expandafter
      \pfPrintStepNumber
      \pfStepName.}%
   \leftmargin=\labelwidth\relax %   \leftmargin := \labelwidth
   \advance\leftmargin\labelsep %                   + \labelsep
   \relax}%
 \item[\pfSideNumber%               % \item[ \pfSideNumber
  \expandafter                       %        StepNumber]
  \pfPrintStepNumber\pfStepName.]}%
 {\end{pflist}}

%%%%% \assume, \prove, and \case commands

\newenvironment{assume+}{%
 \begin{pflist}{}{%                % Begin list environment with
   \topsep=\z@                   %   \topsep     := 0
   \itemsep=\z@                  %   \itemsep    := 0
   \parsep=\z@                   %   \parsep     := 0
   \partopsep=\z@                %   \partopsep  := 0
   \settowidth{\labelwidth}%     %   \labelwidth := width "Assume:"
     {{\kwfont Assume\/}:}%
   \leftmargin=\labelwidth\relax %   \leftmargin := \labelwidth
   \advance\leftmargin\labelsep  %                   + \labelsep
   \relax}%
 \item[{\kwfont Assume\/}:]}%    % \item[Assume:]]
 {\end{pflist}}

\newcommand{\assume}[1]{\begin{assume+}#1\end{assume+}}

\newcommand{\prove}[1]{\begin{prove+}#1\end{prove+}}
\newenvironment{prove+}{%
 \begin{pflist}{}{%                % Begin list environment with
   \topsep=\z@                   %   \topsep     := 0
   \itemsep=\z@                  %   \itemsep    := 0
   \parsep=\z@                   %   \parsep     := 0
   \partopsep=\z@                %   \partopsep  := 0
   \settowidth{\labelwidth}%     %   \labelwidth := width "Assume:"
     {{\kwfont Assume\/}:}%
   \leftmargin=\labelwidth\relax %   \leftmargin := \labelwidth
   \advance\leftmargin\labelsep  %                   + \labelsep
   \relax}%
 \item[{\kwfont 
          Prove\/}:\hfill]}%     % \item[Prove:]]
 {\end{pflist}}

\newcommand{\pflet}[1]{\begin{pflet+}#1\end{pflet+}}
\newenvironment{pflet+}{%
 \begin{pflist}{}{%                % Begin list environment with
   \topsep=\z@                   %   \topsep     := 0
   \itemsep=\z@                  %   \itemsep    := 0
   \parsep=\z@                   %   \parsep     := 0
   \partopsep=\z@                %   \partopsep  := 0
   \settowidth{\labelwidth}%     %   \labelwidth := width "Assume:"
     {{\kwfont Let\/}:}%
   \leftmargin=\labelwidth\relax %   \leftmargin := \labelwidth
   \advance\leftmargin\labelsep  %                   + \labelsep
   \relax}%
 \item[{\kwfont 
          Let\/}:\hfill]}%     % \item[Let:]]
 {\end{pflist}}

%\newcommand{\prove}[1]{%
% \begin{pflist}{}{%                % Begin list environment with
%   \topsep=\z@                   %   \topsep     := 0
%   \itemsep=\z@                  %   \itemsep    := 0
%   \parsep=\z@                   %   \parsep     := 0
%   \partopsep=\z@                %   \partopsep  := 0
%   \settowidth{\labelwidth}%     %   \labelwidth := width "Assume:"
%     {{\kwfont Assume\/}:}%
%   \leftmargin=\labelwidth\relax %   \leftmargin := \labelwidth
%   \advance\leftmargin\labelsep  %                   + \labelsep
%   \relax}%
% \item[{\kwfont Prove\/}:\hfill]     % \item[Prove:]]
% #1
% \end{pflist}}

\newcommand{\case}[1]{%
 \begin{pflist}{}{%                % Begin list environment with
   \topsep=\z@                   %   \topsep     := 0
   \itemsep=\z@                  %   \itemsep    := 0
   \parsep=\z@                   %   \parsep     := 0
   \partopsep=\z@                %   \partopsep  := 0
   \settowidth{\labelwidth}%     %   \labelwidth := width "Case:"
     {{\kwfont Case\/}:}%
   \leftmargin=\labelwidth\relax %   \leftmargin := \labelwidth
   \advance\leftmargin\labelsep  %                   + \labelsep
   \relax}%
 \item[{\kwfont
           Case\/}:]             % \item[Case:]]
 #1
 \end{pflist}}



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                       MISCELLANY                            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
\newcommand{\pf}{{\kwfont Proof\/}:}
\newcommand{\pfsketch}{{\kwfont Proof sketch\/}:}
%\newcommand{\qed}{\rule{.4em}{1.75ex}}
\renewcommand{\qed}{{\fboxsep=\z@\fbox{\rule{.5em}{0pt}\rule{0pt}{2ex}}}}
\let\kwfont=\sc
\def\pfdot{.}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                        STACKS                               %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% \@push{\stack}{element}  == \stack := <<element>> :o: \stack
% \@pop{\stack}{\cmd}  == \cmd := head(\stack)
%                            \stack := tail(\stack)
% \newstack{\stack}  == \stack := emptystack
%
% \@head{\stack}{\var}  ==  \var := head(\stack)
%   Note: to push a counter value, use \the\value{ctr}
%         to push a length \foo, use \the\foo

%
\def\@push#1#2{{\let\@nil\relax\let\@elt\relax\xdef#1{#2\@elt#1}}}
\def\@pop#1#2{{\let\@nil\relax\let\@elt\relax
              \xdef#2{\expandafter\@innerhead#1}
              \xdef#1{\expandafter\@innerpop#1}}}
\def\@innerpop#1\@elt#2\@nil{#2\@nil}
\def\@head#1#2{{\let\@elt\relax\xdef#2{\expandafter\@innerhead#1}}}
\def\@innerhead#1\@elt#2\@nil{#1}
\def\newstack#1{\gdef#1{\@nil}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%           LISTS OF CONJUNCTIONS AND DISJUNCTIONS            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%    \begin{conj}       ->   /\ A
%      A \\ B \\ C           /\ B
%    \end{conj}              /\ C
%
%    \begin{conj*}      ->   1./\ A
%      A \\ B \\ C           2./\ B
%    \end{conj*}             3./\ C
%
%    The disj and disj* environments are similar. Disjuncts
%    are numbered a, b, c 
%
%    These environments are arrays; they must be used in math mode.

\newcounter{pf@conjCounter}   % counter for conj* and disj*
\newstack\pf@conj             % stack of counters

\newenvironment{conj}{%
 \begin{array}[t]{@{\land\;}l@{}}%
 }{%
 \end{array}}

\newenvironment{disj}{%
 \begin{array}[t]{@{\lor\;}l@{}}%
 }{%
 \end{array}}

\newenvironment{conj*}{%
 \@push\pf@conj{\the\value{pf@conjCounter}}%
 \setcounter{pf@conjCounter}{0}%
 \begin{array}[t]{@{\addtocounter{pf@conjCounter}{1}%
   \mbox{\protect\small\protect\arabic{pf@conjCounter}.}
   \land\;}l@{}}%
 }{%
 \end{array}%
 \@pop\pf@conj\pf@temp
  \setcounter{pf@conjCounter}{\pf@temp}}

\newenvironment{disj*}{%
 \@push\pf@conj{\the\value{pf@conjCounter}}%
 \setcounter{pf@conjCounter}{0}%
 \begin{array}[t]{@{\addtocounter{pf@conjCounter}{1}%
   \mbox{\protect\small\protect\alph{pf@conjCounter}.}
   \lor\;}l@{}}%
 }{%
 \end{array}%
 \@pop\pf@conj\pf@temp
  \setcounter{pf@conjCounter}{\pf@temp}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                      ENUMERATED LISTS                       %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% pfenum environment : In proofs, the enumerate environment 
%                      is redefined to be the pfenum environment
%
% enumerate* environment : Like pfenum, except with additional
%                          indentation.
%
% \enumindent :  The indentation for enumerate*
% pfenumdepth  : Depth of current pfenum list
% pfenum       : pfenum list counter
%
% Uses counters pfenumi, ... , pfenumiii just like the
% ordinary enumerate environment uses counters enumi, ... , enumiv.
% \pf@setEnumWidth{\cmd} : Sets \cmd to the width of the label of the
%                          item number 2 for the current enumeration level.
%
% \pf@enumLabel : prints the current pfenum label, using the
%                 pfenumi... counter.

\newcounter{pfenum}
\newcounter{pfenumdepth}
\newlength{\enumindent}
\setlength{\enumindent}{1em}

\@definecounter{pfenumi}
\@definecounter{pfenumii}
\@definecounter{pfenumiii}
%\@definecounter{pfenumiv}

\def\labelpfenumi{\thepfenumi.}    
\def\thepfenumi{\arabic{pfenumi}}     
 
\def\labelpfenumii{(\thepfenumii)}
\def\thepfenumii{\alph{pfenumii}}
\def\p@pfenumii{\thepfenumi}

\def\labelpfenumiii{\thepfenumiii.}
\def\thepfenumiii{\roman{pfenumiii}}
\def\p@pfenumiii{\thepfenumi\thepfenumii}

%\def\labelpfenumiv{\thepfenumiv.}
%\def\thepfenumiv{\Alph{pfenumiv}}     
%\def\p@pfenumiv{\p@pfenumiii\thepfenumiii}


\newcommand{\pf@setEnumWidth}[1]{%
  \settowidth{#1}{\setcounter{\@pfenumctr}{2}%
  \csname the\@pfenumctr\endcsname.%
  \setcounter{\@pfenumctr}{0}}}



\newcommand{\pf@enumLabel}{%
  \hfill\makebox[0pt][r]{\csname the\@pfenumctr\endcsname.}}

\newenvironment{pfenum}{%        % BEGIN
  \ifnum \value{pfenumdepth}>2%  %  IF pfenumdepth > 2
    \relax\@toodeep \else        %    THEN error
  \addtocounter{pfenumdepth}{1}% %    ELSE  pfenumdepth := pfenumdepth + 1
  \edef\@pfenumctr{pfenum%           %          @pfenumctr  := pfenumN
    \romannumeral\the            %            where N = Roman(pfenumdepth)
    \value{pfenumdepth}}%        %
   \fi                           %  FI
  \begin{pflist}%                  %   Begin list environment with
  {\pf@enumLabel}{%              %    Default label = pf@enumlabel
   \labelsep=                    %   \labelsep =
    \ifcase\value{pfenumdepth}   %     CASE OF pfenumdepth
      \labelsep                  %        
     \or .67\labelsep            %       1 -> .67\labelsep
     \or .67\labelsep            %       2 -> .67\labelsep
     \else \labelsep             %      >2 -> \labelsep
     \fi                         %
   \topsep=\z@                   %    \topsep     := 0
   \itemsep=\z@                  %    \itemsep    := 0
   \parsep=\z@                   %    \parsep     := 0
   \partopsep=\z@                %    \partopsep  := 0
   \pf@setEnumWidth\labelwidth   %    set \labelwidth with setEnumWidth
   \leftmargin=\labelwidth\relax %    \leftmargin := \labelwidth
   \advance\leftmargin\labelsep  %                   + \labelsep
   \relax
   \usecounter{\@pfenumctr}%       %    counter @pfenumctr
 }%
 }{%                             % END
   \end{pflist}%                   %   End list
   \addtocounter{pfenumdepth}{-1}%   pfenumdepth := pfenumdepth - 1
 }

\newenvironment{enumerate*}{%    % BEGIN
  \ifnum \value{pfenumdepth}>2%  %  IF pfenumdepth > 2
    \relax\@toodeep \else        %    THEN error
  \addtocounter{pfenumdepth}{1}% %    ELSE  pfenumdepth := pfenumdepth + 1
  \edef\@pfenumctr{pfenum%           %          @pfenumctr  := pfenumN
    \romannumeral\the            %            where N = Roman(pfenumdepth)
    \value{pfenumdepth}}%        %
   \fi                           %  FI
  \begin{pflist}%                  %   Begin list environment with
  {\pf@enumLabel}{%              %    Default label = pf@enumlabel
   \labelsep=                    %   \labelsep =
    \ifcase\value{pfenumdepth}   %     CASE OF pfenumdepth
      \labelsep                  %        
     \or .67\labelsep            %       1 -> .67\labelsep
     \or .67\labelsep            %       2 -> .67\labelsep
     \else \labelsep             %      >2 -> \labelsep
     \fi                         %
   \topsep=\z@                   %    \topsep     := 0
   \itemsep=\z@                  %    \itemsep    := 0
   \parsep=\z@                   %    \parsep     := 0
   \partopsep=\z@                %    \partopsep  := 0
   \pf@setEnumWidth\labelwidth   %    set \labelwidth with setEnumWidth
   \leftmargin=\labelwidth\relax %    \leftmargin := \labelwidth
   \advance\leftmargin\labelsep  %                   + \labelsep
   \advance\leftmargin\enumindent%                   + \enumindent
   \relax
   \usecounter{\@pfenumctr}%       %    counter @pfenumctr
 }%
 }{%                             % END
   \end{pflist}%                   %   End list
   \addtocounter{pfenumdepth}{-1}%   pfenumdepth := pfenumdepth - 1
 }

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                        FUNCTIONS                            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% \makefcn{\FOO}{V0}{{V1}...{Vk}} :
%      Defines \FOO{n}  ==  CASE  n = 0    -> V0
%                                 n = 1    -> V1
%                                 ...
%                                 n \geq k -> Vk
%
%      Useful when Vi is a dimension applying to a depth-i environment

\def\makefcn#1#2#3{{\let\or\relax
     \gdef\fcn@temp{}%
     \gdef\fcn@tempb{#2}%
     \@tfor\foo:=#3\do{\xdef\fcn@temp{\fcn@temp\or\foo}\xdef\fcn@tempb{\foo}}%
     \let\ifcase\relax\let\else\relax\let\fi\relax
     \xdef#1##1{\ifcase ##1 #2\fcn@temp\else\fcn@tempb\fi}}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                        FUNCTIONS                            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% \pfif{A}{B}{C} :  if A then B    \pfIF{A}{B}{C} :  if A
%                        else C                        THEN B
%                                                      ELSE C

\newcommand{\pfmathdef}[1]{\relax\ifmmode #1\else $#1$\fi}
\newcommand{\pfif}[3]{{\pfmathdef{%
 \begin{array}[t]{@{}l@{\;\;}l@{\;\;}l@{}}
   {\bf if}\;\;#1&{\bf then}&#2\\
                 &{\bf else}&#3
   \end{array}}}}

\newcommand{\pfIF}[3]{{\pfmathdef{%
 \begin{array}[t]{@{}l@{\;\;}l@{}}
   {\bf if}\;\;#1\\ 
  \begin{array}[t]{@{\hspace{1em}}l@{\;\;}l@{}}
     {\bf then}&#2\\
     {\bf else}&#3
   \end{array}
  \end{array}}}}
\makeatother


% Typos in the 14 October 91 version
%   Found by Peter G and corrected 16 Oct 91:
%     Page 7: T_Q => \Box T_Q  (two instances)
%     Page 8: s.x -> s.x+1
%     Page 10: <A>_v -> <A>_f   (two instances)
%     
%   Corrected 18 October 91
%      Page 20, in 2(b): equals -> implies  [this is the actual hypothesis]
%
% Revised 29 October
%
% Revised 2 Dec to make it clear that protocol is one-shot.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                        THEORA                          %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
\newtheorem{theorem}{Theorem}
\newtheorem{proposition}{Proposition}
\newtheorem{definition}{Definition}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                MISCELLANEOUS NOTATION                  %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% \infInterval{a} = interval from a to :oo: = (a, :oo:)
% \ooInterval{a}{b} = interval (a,b)
% \ocInterval{a}{b} = interval (a,b]
% \ccInterval{a}{b} = interval [a,b]
% \coInterval{a}{b} = interval [a,b)
% \RT
% \NZ{x}
% \subseq
%  \seq{...}    == The sequence << ... >>
%  \lseq, \rseq == The sequence delimiters.
\newcommand{\sys}{\mbox{\boldmath$\Pi$}}        % a system
\newcommand{\boldlp}{\mbox{\bf \protect\makebox[0pt][l]{(}\kern.25pt(}}
\newcommand{\boldrp}{\mbox{\bf \protect\makebox[0pt][l]{)}\kern.25pt)}}
\newcommand{\boldlb}{\mbox{\bf \protect\makebox[0pt][l]{[}\kern.25pt[}}
\newcommand{\boldrb}{\mbox{\bf \protect\makebox[0pt][l]{]}\kern.25pt]}}
\newcommand{\infInterval}[1]{\mathdef{\boldlp#1,\oo\boldrp}}
\newcommand{\ooInterval}[2]{\mathdef{\boldlp#1,#2\boldrp}}
\newcommand{\ocInterval}[2]{\mathdef{\boldlp#1,#2\boldrb}}
\newcommand{\ccInterval}[2]{\mathdef{\boldlb#1,#2\boldrb}}
\newcommand{\coInterval}[2]{\mathdef{\boldlb#1,#2\boldrp}}
\newcommand{\RT}{\vbl{RT}}
\newcommand{\NZ}[1]{\vbl{NZ}} % ^{#1}}}
\newcommand{\subseq}{\mathdef{\preceq}}
\newcommand{\seq}[1]{\mathdef{\lseq#1\rseq}}
\newcommand{\lseq}{\langle\!\langle}
\newcommand{\rseq}{\rangle\!\rangle}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%           VARIABLE AND CONSTANT NAMES                  %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% 
%  \qvbl{name}  == quoted variable "name"
%  \rvbl{name}  == rigid variable "name"
%  \init        == Init
%  \inpval      == ival (the input value)
%  \inpbit      == ibit (the input bit)
%  \outval      == oval (the output value)
%  \outbit      == obit (the output bit)
%  \now         == now
%  \Real        == the set of real numbers
%  \oo          == infinity
%  \PC          == pc (the program counter)
%  \inv         == Inv  (used in appendix)

\newcommand{\vbl}[1]{{\it #1\/}}
\newcommand{\qvbl}[1]{\mbox{``{\sf #1}''}}
\newcommand{\rvbl}[1]{{\sf #1}}
\newcommand{\init}{{\it Init\/}}
\newcommand{\inpval}{{\it ival\/}}
\newcommand{\inpbit}{{\it ibit\/}}
\newcommand{\outval}{{\it oval\/}}
\newcommand{\outbit}{{\it obit\/}}
\newcommand{\now}{{\it now\/}}
\newcommand{\Real}{{\bf R}}
\newcommand{\oo}{\mathdef{\infty}}
\newcommand{\PC}{{\it pc\/}}
\newcommand{\inv}{\vbl{Inv}}

\newcommand{\mathdef}[1]{\relax\ifmmode #1\else $#1$\fi}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                       LOGIC                            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% 
%  \true, \false == booleans
%  \deq          == equals by definition
%  \implies      == =>
%  \valid{F}     == |= F  (validity)
%  \provable{F}  == |- F  (provability)
%  \M{F}         == semantic meaning of F
%                                      hyp1
%                                      hyp2
%  \proofrule{hyp1\\hyp2}{concl}  ==  ------
%                                      concl
%
% \act{exp} : Formats exp in math mode, with the first
%                character in \cal style.  Thus,
%                \act{A_1} -> ${\cal A}_1$
%
% \sqact{A}{v}  == [A]_v   (formatted like \act)
% \anact{A}{v}  == <A>_v   (formatted like \act)
% \unchanged{f} == Unchanged f
% \enabled{A} == enabled predicate of A
% \WF{f}{A}  == WF_f(A)
% \SF{f}{A}  == SF_f(A)
% \WFop  == WF
% \SFop == SF
% \while{P}{Q}       : P --|> Q
% \whileop           : --|> 
%                        a
% \agent{a}          :  --->
% \rpart{mu}{P}      : The mu-realizable part of P.
% \closure{P}        : The closure of P.
%
% FOR APPENDIX
%
%  \seqv : ~ (stuttering equivalence)
%  \vseqv{x} : ~_x
%  \prefix{sigma}{n} = sigma|_n
% \oset{mu}{f}       : The set of behaviors generated by mu-strategy f.
% \poset{mu}{f}{rho} : The set of behaviors generated by mu-strategy f
%                      starting from rho
%  \EE           ==  existential quantification over flexible variables

%% Type \fact{N} for the appropriate citation to the fact.
\newcommand{\fact}[1]{Lemma~\ref{lemma:facts}.\ref{fact:#1}}


\newcommand{\oset}[2]{\mathdef{{\cal O}_{#1}(#2)}}
\newcommand{\poset}[3]{\mathdef{{\cal O}_{#1}(#2,#3)}}
\newcommand{\emptyseq}{\mathdef{\lambda}}
\newcommand{\xitem}[2]{\item[#1 {\small[for\ #2]}]}
\newtheorem{lemma}{Lemma}
\newcommand{\lasttime}{\vbl{lasttime}}
\newcommand{\able}{\vbl{able}}
\newcommand{\oldestlast}{\vbl{oldestlast}}
\newcommand{\nextact}{\vbl{nextact}}

\newcommand{\true}{{\sf true}}
\newcommand{\false}{{\sf false}}
\newcommand{\deq}{\mathrel{\stackrel{\scriptscriptstyle\Delta}{=}}}
\newcommand{\implies}{\Rightarrow}
\newcommand{\valid}[1]{\mathdef{\models #1}}
\newcommand{\provable}[1]{\mathdef{\vdash #1}}
\newcommand{\M}[1]{\mathdef{[\![#1]\!]}}
\newcommand{\proofrule}[2]{\setlength{\arrayrulewidth}{.6pt}%
  {\mathdef{\begin{array}[t]{@{}c@{}}%
       \begin{array}[t]{@{}l@{}} #1\raisebox{-.1em}{\strut}\end{array}\\
       \hline \raisebox{.1em}{\strut}#2\end{array}}}}
\newcommand{\act}[1]{\mathdef{\makecal#1}}
\newcommand{\makecal}[1]{{\cal #1}}
\newcommand{\sqact}[2]{\mathdef{[\act{#1}]_{#2}}}
\newcommand{\anact}[2]{\mathdef{\langle\act{#1}\rangle_{#2}}}
\newcommand{\unchanged}[1]{\mathdef{{\it Unchanged}~#1}}
\newcommand{\enabled}[1]{\mathdef{{\it Enabled}~#1}}
\newcommand{\WF}[2]{\mathdef{{\rm WF}_{#1}(#2)}}
\newcommand{\SF}[2]{\mathdef{{\rm SF}_{#1}(#2)}}
\newcommand{\WFop}{{\rm WF}}
\newcommand{\SFop}{{\rm SF}}
\newcommand{\while}[2]{\relax
 \ifmmode #1\mathrel{-\hspace{-.2em}\triangleright}#2
   \else $#1\mathrel{-\hspace{-.2em}\triangleright}#2$\fi}
\newcommand{\whileop}{\relax
 \ifmmode -\hspace{-.2em}\triangleright
   \else $-\hspace{-.2em}\triangleright$\fi}
\newcommand{\agent}[1]{\stackrel{#1}{\longrightarrow}}
% \newcommand{\rpart}[2]{\mathdef{{\cal R}_{#1}(#2)}}
\newcommand{\closure}[1]{\mathdef{{\cal C}(#1)}}
%\newcommand{\dnc}[2]{\mathdef{#1^{#2}}}
%\newcommand{\cam}[2]{\mathdef{#1_{#2}}}
% \newcommand{\initpart}[1]{\mathdef{#1_{0}}}
% \newcommand{\boxpart}[1]{\mathdef{#1_{\Box}}}
\newcommand{\seqv}{\mathdef{\simeq}}
\newcommand{\vseqv}[1]{\mathdef{\simeq_{#1}}}
\newcommand{\prefix}[2]{\mathdef{#1|_{#2}}}
\newcommand{\EE}{\makebox{$\raisebox{.05em}{\makebox
   [0pt][l]{$\exists\s{-.517}\exists\s{-.517}\exists$}}\exists\s{-.517}\exists
            \s{-.517}\exists$}}

%added for the sake of the index
\newcommand{\length}[1]{\relax      \ifmmode |#1|\else $|#1|$\fi }

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                        FORMATTING                      %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% \s{n}  - an n-em horiontal space.
% \vs{n} - an n-em vertical space.
\newcommand{\s}[1]{\hspace*{#1em}}
\newcommand{\vs}[1]{\raisebox{-#1em}{\rule{0pt}{.1pt}}}

\renewcommand{\o}{\circ}

\iftoplas{
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%    TITLE AND START OF DOCUMENT FOR TOPLAS  VERSION     %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\title{An Old-Fashioned Recipe for Real Time}
\author{MART\'{I}N ABADI and LESLIE LAMPORT\\
        Digital Equipment Corporation}
\runningfoot{ACM Transactions on Programming Languages and Systems, Vol
?, No.\ ?, November 1993.}

\firstfoot{ACM Transactions on Programming Languages and Systems, Vol
? No.\ ?, November 1993, Pages \pages.}

\markboth{Mart\'{\i}n Abadi and Leslie Lamport}%
         {An Old-Fashioned Recipe for Real Time}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                 MODIFICATION DATE                            %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                                                              %
% Defines \moddate to expand to the modification date like     %
%                                                              %
%    Mon  5 Aug 1991  [10:34]                                  %
%                                                              %
% and \prdate to print it in a large box.  Assumes editor      %
% updates modification date in standard SRC style.             %
% (Should work for any user name).                             %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\def\ypmd{%                                                    %
%                                                              %
%                                                              %
  Last modified on Wed Dec 22 17:32:03 PST 1993
 by lamport     %
       modified on Mon Oct  4 16:37:26 PDT 1993 by ma          %
  endypmd}                                                     %
%                                                              %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\newcommand{\moddate}{\expandafter\xpmd\ypmd}                  %
\def\xpmd Last modified                                        %
on #1 #2 #3 #4:#5:#6 #7 by #8 endypmd{#1 \ #3 #2 #7 \ [#4:#5]} %
\newcommand{\prdate}{\noindent\fbox{\Large\moddate}}           %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
}{
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%             TITLE  FOR SRC REPORT VERSION              %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\title{An Old-Fashioned Recipe for Real Time}
\author{Mart\'{\i}n Abadi and Leslie Lamport\\[5pt]
\begin{minipage}{.7\textwidth}
\centering
 \small Digital Equipment Corporation\\
               130 Lytton Avenue\\
             Palo Alto, California 94301, USA 
\end{minipage}}
% \author{Mart\'{\i}n Abadi and Leslie Lamport}
\ordinarily{\date{27 July 1992}}
}
\begin{document}
\iftoplas{
%try
\begin{titlepage}
\vspace*{150pt}
\centering
{\Large\bf An Old-Fashioned Recipe for Real Time}

\vspace{20pt}
{\large Mart\'{\i}n Abadi and Leslie Lamport}

\vspace{20pt}
\moddate

\vspace{20pt}


\begin{minipage}{.8\textwidth}
This is a revised version of SRC Research Report 91.  It will
appear in {\em ACM Transactions on Programming Languages and Systems}.
\end{minipage}
\end{titlepage}

\pagenumbering{roman}
\tableofcontents
\clearpage
\pagenumbering{arabic}


\begin{abstract}
Traditional methods for specifying and reasoning about concurrent
systems work for real-time systems.  Using TLA (the temporal logic of
actions), we illustrate how they work with the examples of a queue and
of a mutual-exclusion protocol.  In general, two problems must be
addressed: avoiding the real-time programming version of Zeno's
paradox, and coping with circularities when composing real-time
assumption/guarantee specifications.  Their solutions rest on
properties of machine closure and realizability.
\end{abstract}

\category{D.2.4}{Software Engineering}{Program 
                  Verification}[correctness proofs]

\category{F.3.1}{Logics and Meanings of Programs}{Specifying and 
                  Verifying and Reasoning about Programs}[Specification
                   techniques]

\terms{Theory, Verification}

\keywords{Composition, concurrent programming, 
          liveness properties, real time, safety properties, 
          temporal logic, Zeno}
          
\maketitle

\begin{bottomstuff}
Author's address: Systems Research Center, Digital Equipment Corporation,
130 Lytton Avenue, Palo Alto, CA 94301.
\permission
\copyright\ 1993 ACM 0000-0000/93/0000-0000 \$00.00
\end{bottomstuff}
}{
\begin{document}
%\maketitle
\pagenumbering{roman}
\thispagestyle{empty}
\vspace*{2.23cm}

\noindent
{\Large \bf An Old-Fashioned Recipe for Real Time}

\vspace{.5cm}

{\large
\noindent
Mart\'{\i}n Abadi and Leslie Lamport\\[.25cm]
October 12, 1992}


\cleardoublepage

\mbox{}

\vfill

\noindent
{\bf \copyright Digital Equipment Corporation 1992}\\[\baselineskip]
This work may not be copied or reproduced in whole or in part for 
any commercial purpose. Permission to copy in whole or in part
without payment of fee is granted for nonprofit educational and
research purposes provided that all such whole or partial copies
include the following: a notice that such copying is by permission
of the Systems Research Center of Digital Equipment Corporation
in Palo Alto, California; an acknowledgment of the authors and
individual contributors to the work; and all applicable portions
of the copyright notice. Copying, reproducing, or republishing for
any other purpose shall require a license with payment of fee to
the Systems Research Center. All rights reserved.

\cleardoublepage
\thispagestyle{empty}

\subsubsection*{Authors' Abstract} 
\vspace{-2pt} 

Traditional methods for specifying and reasoning about concurrent
systems work for real-time systems.  Using TLA (the temporal logic of
actions), we illustrate how they work with the examples of a queue and
of a mutual-exclusion protocol.  In general, two problems must be
addressed: avoiding the real-time programming version of Zeno's
paradox, and coping with circularities when composing real-time
assumption/guarantee specifications.  Their solutions rest on
properties of machine closure and realizability.


\cleardoublepage
\thispagestyle{empty}
\tableofcontents
\thispagestyle{empty}

\cleardoublepage
\pagenumbering{arabic}
}

%try
\section{Introduction}

A new class of systems is often viewed as an opportunity to invent a
new semantics.  A number of years ago, the new class was distributed
systems.  More recently, it has been real-time systems.  The
proliferation of new semantics may be fun for semanticists, but
developing a practical method for reasoning formally about systems is a
lot of work.  It would be unfortunate if every new class of systems
required inventing new semantics, along with proof rules, languages,
and tools.

Fortunately, no fundamental change to the old methods for specifying
and reasoning about systems is needed for these new classes.  It
has long been known that the methods originally developed for
shared-memory multiprocessing apply equally well to distributed
systems~\cite{chandy:parallel,lamport:assertional}.  The first
application we have seen of a clearly ``off-the-shelf'' method to a
real-time algorithm was in 1983~\cite{neumann:highly-dependable}, but
there were probably earlier ones.  Indeed, the ``extension'' of an
existing temporal logic to real-time programs by
  \index{Bernstein, Arthur}%%%
  \index{Harter, Paul K., Jr.}%%%
\iftoplas{\citeN{bernstein:proving}}{Bernstein and Harter 
in 1981~\cite{bernstein:proving}} 
can be viewed as an application of
that logic.

The old-fashioned methods handle real time by introducing a variable,
  \index{now@\now}%%%
which we call {\em now}, to represent time.  This idea is so simple and
obvious that it seems hardly worth writing about, except that few
people appear to be aware that it works in practice.  We therefore
describe how to apply a conventional method to real-time systems.  

Any formalism for reasoning about concurrent programs can be used to
prove properties of real-time systems.  However, in a conventional
formalism based on a programming language, real-time assumptions are
expressed by adding program operations that read and modify the
variable \now.  The result can be a complicated program that is hard to
understand and easy to get wrong.  We take as our formalism TLA, the
temporal logic of actions~\cite{lamport:newtla}.  In TLA, programs and
properties are represented as logical formulas.  A real-time program
can be written as the conjunction of its untimed version,
expressed in a standard way as a TLA formula, and its timing
assumptions, expressed in terms of a few standard parameterized
formulas.  This separate specification of timing properties makes
real-time specifications easier to write and understand.

The method is illustrated with two examples.  The first is a queue in
which the sender and receiver synchronize by the use of timing
assumptions instead of acknowledgements.  We indicate how safety and
liveness properties of the queue can be proved.  The second example is
an $n$-process mutual exclusion protocol, in which mutual exclusion
depends on assumptions about the length of time taken by the
operations.  Its correctness is proved by a conventional invariance
argument.


We also discuss two problems that arise when time is represented as a
program variable---problems that seem to have received little
attention---and present new solutions.  

The first problem is how to avoid the real-time programming version of
Zeno's paradox.  If time becomes an ordinary program variable, then one
can
  \index{paradox!Zeno's}%%%
inadvertently write programs in which time behaves improperly.  An
obvious danger is deadlock, where time stops.  A more insidious
possibility is that time keeps advancing but is bounded, approaching
closer and closer to some limit.  One way to avoid such ``Zeno''
behaviors is to place an a priori lower bound on the duration of any
  \index{lower bound!on action duration}%%%
action, but this can complicate the representation of some systems.  We
provide a more general and, we feel, a more natural solution.

The second problem is coping with the circularity that
arises in open system specifications. The specification of an open
system asserts that it operates correctly under some assumptions on
 \index{open system}%%%
 \index{assumption!environment}%%%
 \index{guarantee, system}%%%
 \index{assumption/guarantee specification}%%%
the system's environment.  A modular specification method requires a
rule asserting that, if each component satisfies its specification,
then it behaves correctly in concert with other components.  This rule
is circular, because a component's specification requires only that it
behave correctly if its environment does, and its environment consists
of all the other components.  Despite its circularity, the rule is
sound for specifications written in a particular
style~\cite{abadi:composing,misra:proofs,pnueli:transition}.  
By examining an apparently
paradoxical example, we discover how real-time specifications of open
systems can be written in this style.

% Sections \ref{sec:closed} and \ref{sec:real-time-closed} treat closed
% systems; sections \ref{sec:open} and \ref{sec:real-time-open} treat
% open systems.  Sections \ref{sec:closed} and \ref{sec:open} explain how
% arbitrary systems are represented in TLA; sections
% \ref{sec:real-time-closed} and \ref{sec:real-time-open} are about
% real-time specifications.

We express these problems and their solutions in terms of TLA\@.
However, we believe that the problems will arise in any formalism that
permits sufficiently general specifications.  Our solutions should be
applicable to any formalism whose semantics is based on sequences of
states or actions.

%try
\section{Closed Systems} \label{sec:closed}

We briefly review how to represent closed systems in TLA\@.  A
closed system is one that is self-contained and does not communicate
   \index{closed system}%%%
with an environment.  No one intentionally designs autistic systems; in
a closed system, the environment is represented as part of the system.
  \index{environment, as part of system}%%%
Open systems, in which the environment and system are separated, are
discussed in Section~\ref{sec:open}.

We begin our review of TLA in Section~\ref{sec:Q-example} with an
informal presentation of an example.  The formal definitions are
summarized in Section~\ref{sec:semantics-of-tla}.  A more leisurely
exposition appears in~\cite{lamport:newtla}, and most definitions in
the current paper are repeated in a list in the appendix.
Section~\ref{sec:safety-and-fairness} reviews the concepts of
safety~\cite{alpern:defining} and machine
closure~\cite{abadi:existence} (also known as
feasibility~\cite{apt:appraising}) and relates them to TLA, and
  \index{feasibility, and machine closure}%%%
Section~\ref{sec:history-determined} defines a useful class of history
variables~\cite{abadi:existence}.  Propositions and theorems are proved
in the appendix.


\subsection{The Lossy-Queue Example} \label{sec:Q-example}

We introduce TLA with the example of the lossy queue shown in
  \index{queue!lossy}%%%
Figure~\ref{fig:Q}.  The interface consists of two pairs of ``wires'',
each pair consisting of a \vbl{val} wire that holds a message and a
boolean-valued \vbl{bit} wire.  A message $m$ is sent over a pair of
wires by setting the \vbl{val} wire to $m$ and complementing the
\vbl{bit} wire.  The receiver detects the presence of a new message by
observing that the \vbl{bit} wire has changed value.  Input to the
queue arrives on the wire pair $(\inpval,\inpbit)$, and output is sent
on the wire pair $(\outval,\outbit)$.  There is no acknowledgment
protocol, so inputs are lost if they arrive faster than the queue
processes them.  (Because of the way \inpbit\ is used, inputs are lost
in pairs.)  The property guaranteed by this lossy queue is that the
sequence of output messages is a subsequence of the sequence of input
messages.  In Section~\ref{sec:timed-queue}, we add timing constraints
to rule out the possibility of lost messages.


\iftoplas{\begin{figure}[b]}{\begin{figure}}
\begin{center}
\begin{picture}(0,90)
%\makegrid(-200,0)(400,150)
\thicklines
\put(-70,0){\framebox(140,90){}}
\put(-110,25){\vector(1,0){40}}
\put(-110,65){\vector(1,0){40}}
\put(70,25){\vector(1,0){40}}
\put(70,65){\vector(1,0){40}}
\put(-90,30){\makebox(0,0)[b]{\inpbit}}
\put(-90,70){\makebox(0,0)[b]{\inpval}}
\put(90,30){\makebox(0,0)[b]{\outbit}}
\put(90,70){\makebox(0,0)[b]{\outval}}
\put(-25,65){%
  \begin{picture}(0,0)
    \thinlines
    \put(0,0){\makebox(0,0)[r]{$q$: }}
%    \put(0,-5){\framebox(60,10){}}
%    \multiput(10,-5)(10,0){5}{\line(0,1){10}}
    \put(55,0){\makebox(0,0)[l]{$\ldots$}}
    \put(0,-5){\line(1,0){55}}
    \put(0,5){\line(1,0){55}}
    \multiput(0,-5)(10,0){6}{\line(0,1){10}}
  \end{picture}}
%\put(5,25){%
\put(-25,25){%
  \begin{picture}(0,0)
    \thinlines
    \put(0,0){\makebox(0,0)[r]{\vbl{last}: }}
    \put(0,-5){\framebox(10,10){}}
  \end{picture}}
\end{picture}
\end{center}
\caption{A simple queue.}
\label{fig:Q}
\end{figure}

A specification is a TLA formula $\Pi$ describing a set of allowed
behaviors.  A property $P$ is also a TLA formula.  The specification
$\Pi$ satisfies property $P$ iff (if and only if) 
every behavior allowed by $\Pi$ is
also allowed by $P$---that is, if $\Pi$ implies $P$.  Similarly, a
specification $\Psi$ implements $\Pi$ iff every behavior allowed by
  \index{implementation relation}%%%
  \index{implementation relation!and implication}%%%
$\Psi$ is also allowed by $\Pi$, so implementation means implication.

The specification of the lossy queue is a TLA formula that mentions the
four variables \inpbit, \outbit, \inpval, and \outval, as well as two
internal variables: $q$, which equals the sequence of messages received
but not yet output; and \vbl{last}, which equals the value of \inpbit\
for the last received message.  (The variable \vbl{last} is used to
prevent the same message from being received twice.) These six
variables are {\em flexible variables\/}; their values can change
  \index{variable!flexible}%%%
  \index{variable!rigid}%%%
  \index{variable!internal}%%%
during a behavior.  We also introduce a {\em rigid variable\/}
\rvbl{Msg} denoting the set of possible messages; it has the same value
throughout a behavior.  We usually refer to flexible variables simply
  \index{constant}%%%
as variables, and to rigid variables as {\em constants}.

The TLA specification is shown in Figure~\ref{fig:PiQ}, using the
following notation.  A list of formulas, each prefaced by $\land$,
denotes the conjunction of the formulas, and indentation is used to
eliminate parentheses.  The expression \seq{\,} denotes the empty
sequence, \seq{m} denotes the singleton sequence having $m$ as its one
element, $\o$ denotes concatenation,
  \index{#2o@$\o$}%%%
  \index{Head@$\vbl{Head}$}%%%
  \index{Tail@$\vbl{Tail}$}%%%
$\vbl{Head}(\sigma)$ denotes the first
element of $\sigma$, and $\vbl{Tail}(\sigma)$ denotes the sequence
obtained by removing the first element of $\sigma$.  The symbol
  \index{deq@$\deq$}%%%
$\deq$ means {\em is defined to equal}.

\begin{figure}
\begin{center}
\(\begin{array}{@{}lcl@{}}
\init_{Q} & \deq & 
  \begin{array}[t]{@{\land\s{.4}}l}
         \inpbit, \outbit \in \{\true,\false\}\\
         \inpval, \outval \in \rvbl{Msg} \\
         \vbl{last}  = \inpbit \\
        q = \seq{} \vs{.7}
  \end{array}\\
%
\vbl{Inp}  & \deq &  
  \begin{array}[t]{@{\land\s{.4}}l}
          \inpbit' = \lnot\inpbit \\
          \inpval' \in \rvbl{Msg} \\
          (\outbit, \outval, q, \vbl{last})' =
            (\outbit, \outval, q, \vbl{last}) \vs{.7}
  \end{array}\\
%
\vbl{EnQ}  & \deq &  
 \begin{array}[t]{@{\land\s{.4}}l}
          \vbl{last} \neq \inpbit \\
          q' = q \o \seq{\inpval} \\
          \vbl{last}' = \inpbit \\
         (\inpbit, \outbit, \inpval, \outval)' = 
            (\inpbit, \outbit, \inpval, \outval) \vs{.7}
  \end{array}\\
%
\vbl{DeQ}  & \deq &  
  \begin{array}[t]{@{\land\s{.4}}l}
          q \neq \seq{} \\
          \outval' = \vbl{Head}(q) \\
          q' = \vbl{Tail}(q) \\
          \outbit' = \lnot\outbit \\
         (\inpbit, \inpval, \vbl{last})' =
            (\inpbit, \inpval, \vbl{last}) \vs{.7}
  \end{array}\\
%
\act{N}_{Q}  & \deq &  Inp \,\lor\, EnQ \,\lor\, DeQ \vs{.7} \\
%
v  & \deq &  (\inpbit, \outbit, \inpval, \outval, q, \vbl{last}) \vs{.7} \\
%
\Pi_{Q}  & \deq &  \init_{Q} \,\land\, \Box[\act{N}_{Q}]_{v} \vs{.7}\\
%
\Phi_{Q} & \deq & \EE q, \vbl{last} : \Pi_{Q}
\end{array}
\)
\end{center}
\caption{The TLA specification of a lossy queue.}
\label{fig:PiQ}
\end{figure}

The first definition is of the {\em predicate\/} $\init_{Q}$, which
describes the initial state.  This predicate asserts that the values of
variables \inpbit\ and \outbit\ are arbitrary booleans, the values of
\inpval\ and \outval\ are elements of \rvbl{Msg}, the values of
\vbl{last} and \inpbit\ are equal, and the value of $q$ is the empty
sequence.

Next is defined the {\em action\/} \vbl{Inp}, which describes all state
changes that represent the sending of an input message.  (Since this is
the specification of a closed system, it includes the environment's \vbl{Inp}
action.) The first conjunct, $\inpbit' = \lnot\inpbit$, asserts that
the new value of \inpbit\ equals the complement of its old value.  The
second conjunct asserts that the new value of \inpval\ is an element of
\rvbl{Msg}.  The third conjunct asserts that the value of the
four-tuple $(\outbit, \outval, q, \vbl{last})$ is unchanged; it is
equivalent to the assertion that the value of each of the four
variables \outbit, \outval, $q$, and \vbl{last} is unchanged.  The
action \vbl{Inp} is always {\em enabled}, meaning that, in any state, a
new input message can be sent.


Action \vbl{EnQ} represents the receipt of a message by the system.
The first conjunct asserts that \vbl{last} is not equal to \inpbit, so
the message on the input wire has not yet been received.  The second
conjunct asserts that the new value of $q$ equals the sequence obtained
by concatenating the old value of \inpval\ to the end of $q$'s old
value.  The third conjunct asserts that the new value of \vbl{last}
equals the old value of \inpbit.  The final conjunct asserts that the
values of \inpbit, \outbit, \inpval, and \outval\ are unchanged.
Action \vbl{EnQ} is enabled in a state iff the values
of \vbl{last} and \inpbit\ in that state are unequal.

The action \vbl{DeQ} represents the operation of removing a message
from the head of $q$ and sending it on the output wire.  It is enabled
iff the value of $q$ is not the empty sequence.

The action $\act{N}_{Q}$ is the specification's {\em next-state
relation}.  It describes all allowed changes to the queue system's
  \index{next-state relation}%%%
variables.  Since the only allowed changes are the ones described by
the actions \vbl{Inp}, \vbl{EnQ}, and \vbl{DeQ}, action $\act{N}_{Q}$
is the disjunction of those three actions.

In TLA specifications, it is convenient to give a name to the tuple of
all relevant variables.  Here, we call it $v$.

Formula $\Pi_{Q}$ is the internal specification of the lossy
  \index{internal specification}%%%
queue---the formula specifying all sequences of values that may be
assumed by the queue's six variables, including the internal variables
$q$ and \vbl{last}.  Its first conjunct asserts that $\init_{Q}$ is
true in the initial state.  Its second conjunct, 
$\Box[\act{N}_{Q}]_{v}$,
asserts that every step is either an $\act{N}_{Q}$ step (a state change
allowed by $\act{N}_{Q}$) or else leaves $v$ unchanged, meaning that it
leaves all six variables unchanged.

Formula $\Phi_{Q}$ is the actual specification, in which the internal
variables $q$ and \vbl{last} have been hidden.  A behavior satisfies
$\Phi_{Q}$ iff there is some way to assign sequences of values to $q$
and \vbl{last} such that $\Pi_{Q}$ is satisfied.  The free variables of
$\Phi_{Q}$ are \inpbit, \outbit, \inpval, and \outval, so $\Phi_{Q}$
specifies what sequences of values these four variables can assume.
All the preceding definitions just represent one possible way of
structuring the definition of $\Phi_{Q}$; there are infinitely many
ways to write formulas that are equivalent to $\Phi_{Q}$ and are
therefore equivalent specifications.

TLA is an untyped logic; variables may assume any values
in a fixed universal domain.  Type
correctness can be expressed by the formula $\Box T$, where $T$ is the
predicate asserting that all relevant variables have values of the
  \index{predicate!type-correctness}%%%
expected ``types''.  For the internal
queue specification, the type-correctness predicate is
\begin{equation} \label{eq:typeOK}
 T_{Q} \;\;\deq\;\;
\begin{array}[t]{@{\land\s{.4}}l}
  \inpbit, \outbit, \vbl{last} \in \{\true,\false\}\\
  \inpval, \outval \in \rvbl{Msg} \\
  q\in \rvbl{Msg}^{*}
\end{array}
\end{equation}
where $\rvbl{Msg}^{*}$ is the set of finite sequences of messages.
Type correctness of $\Pi_{Q}$ is asserted by the formula
$\Pi_{Q}\implies \Box T_{Q}$, which is easily proved~\cite{lamport:newtla}.
Type correctness of $\Phi_{Q}$ follows from $\Pi_{Q}\implies \Box T_{Q}$ by
the usual rules for reasoning about quantifiers.

Formulas $\Pi_{Q}$ and $\Phi_{Q}$ are {\em safety properties}, meaning
that they are satisfied by an infinite behavior iff they are satisfied
by every finite initial portion of the behavior.  Safety properties
allow behaviors in which a system performs properly for a while and
then the values of all variables are frozen, never to change again.
In asynchronous systems, such undesirable behaviors are ruled out by
adding {\em fairness\/} properties.  We could strengthen our
  \index{safety}%%%
  \index{fairness}%%%
  \index{fairness!weak}%%%
  \index{fairness!strong}%%%
lossy-queue specification by conjoining the {\em weak fairness\/}
property $\WF{v}{DeQ}$ and the {\em strong fairness\/} property
$\SF{v}{\vbl{EnQ}}$ to $\Pi_{Q}$, obtaining
\begin{equation} \label{eq:canonical-form-of-spec}
  \EE\,q, \vbl{last} :
(\init_{Q} \,\land\, \Box[\act{N}_{Q}]_{v} \,\land\, \WF{v}{DeQ} \,\land\, 
           \SF{v}{\vbl{EnQ}})
\end{equation}
Property \WF{v}{DeQ} asserts that if action \vbl{DeQ} is enabled
forever, then infinitely many \vbl{DeQ} steps must occur.  This
property implies that every message reaching the queue is eventually
output.  Property $\SF{v}{\vbl{EnQ}}$ asserts that if action \vbl{EnQ}
is enabled infinitely often, then infinitely many \vbl{EnQ} steps
must occur.  It implies that if infinitely many inputs are sent, then the
queue must receive infinitely many of them.  The formula
(\ref{eq:canonical-form-of-spec}) implies the {\em liveness 
property\/}~\cite{alpern:defining} that an infinite number of inputs
  \index{liveness}%%%
produces an infinite number of outputs.  
% This formula also implies the
% same safety properties as $\Phi_{Q}$.  
A formula such as
(\ref{eq:canonical-form-of-spec}), which is the conjunction of an
initial predicate, a term of the form $\Box[\act{A}]_{f}$, and a
  \index{canonical form}%%%
fairness property, is said to be in {\em canonical form}.


\subsection{The Semantics of TLA}
\label{sec:semantics-of-tla}

We begin with some definitions.  We assume a universal domain of
{\em values}, and we let \M{F} denote the semantic meaning of
a formula $F$.%
  \index{#7meaning@$\M{\ldots}$}%%%
\begin{description}
\item[state] A mapping from variables to values.
We let $s.x$ denote the value that state $s$ assigns to 
  \index{state}%%%
variable $x$.

\item[state function] An expression formed from variables, constants,
  \index{state function}%%%
and operators.  The meaning of a state function is a mapping from
states to values.  For example, $x+1$ is a state function such that
$\M{x+1}(s)$ equals $s.x+1$, for any state $s$.

\item[predicate] A boolean-valued state function, such as $x>y+1$.%
  \index{predicate}%%%

\item[transition function] An expression formed from variables, primed
  \index{transition function}%%%
variables, constants, and operators.  The meaning of a transition
function is a mapping from pairs of states to values, with unprimed
variables referring to the first state of a pair and primed variables
to the second.  For example, $x+y'+1$ is a transition function, and
$\M{x+y'+1}(s,t)$ equals the value $s.x+t.y+1$, for any pair of states
$s, t$.


\item[action] A boolean-valued transition function, such as $x>(y'+1)$.%
  \index{action}%%%

\item[step] A pair of states $s,t$.  For an action \act{A}, the pair
is called an \act{A} {\em
  \index{step}%%%
step\/} iff $\M{\act{A}}(s,t)$ equals \true.  It
is called a {\em stuttering\/} step iff $s=t$.%
  \index{step!stuttering}%%%

\item[$f'$] The transition function obtained from the state function
$f$ by priming all the free variables of $f$, so $\M{f'}(s,t)=\M{f}(t)$
for any states $s$ and $t$.%  
  \index{#3prime@$\ldots'$}
 % The action $f'=f$ is sometimes written \unchanged{f}.

\item[${[\act{A}]}_{f}$] The action $\act{A}\lor(f'=f)$, for
  \index{#4sqact@${[\act{\ldots}]}_{\ldots}$}%%%
any action \act{A} and state function $f$.

\item[\anact{A}{f}] The action 
$\act{A}\land(f'\neq f)$, for any action \act{A} and state function $f$.%
  \index{#4anact@$\anact{\ldots}{\ldots}$}%%%

\item[\enabled{\act{A}}] For any action \act{A}, the predicate such
  \index{action!enabled}%%%
  \index{enabled@{\it Enabled}}%%%
that $\M{\enabled{\act{A}}}(s)$ equals $\exists t:\M{\act{A}}(s,t)$,
for any state $s$.

\end{description}
Informally, we often identify a formula and its meaning.  For example we
say that a predicate $P$ is true in state $s$ instead of $\M{P}(s)=\true$.

An RTLA (raw TLA) formula is a boolean expression built from actions,
classical operators (boolean operators and quantification over rigid
  \index{quantification!over rigid variables}%%%
variables), and the unary temporal operator $\Box$.  The meaning of an
RTLA formula is a boolean-valued function on {\em behaviors}, where a
  \index{behavior}%%%
behavior is an infinite sequence of states.  The meaning of the
operator $\Box$ is defined by
 % \begin{equation} \label{eq:box}
  \[ \M{\Box F}(s_{1},s_{2},s_{3},\ldots) \;\;\deq\;\;
     \forall \, n>0 : \M{F}(s_{n}, s_{n+1}, s_{n+2}, \ldots)
  \] 
 % \end{equation}
Intuitively, $\Box F$ asserts that $F$ is always true.  The meaning
of an action as an RTLA formula is defined in terms of its meaning as
an action by letting $\M{\act{A}}(s_{1}, s_{2}, \linebreak[0]
s_{3},\ldots)$ equal
$\M{\act{A}}(s_{1},s_{2})$.  A predicate $P$ is an action; $P$ is true
for a behavior iff it is true for the first state of the behavior, and
$\Box P$ is true iff $P$ is true in all states.  For any action \act{A}
and state function $f$, the formula $\Box[\act{A}]_{f}$ is true for a
behavior iff each step is an \act{A} step or else leaves $f$ unchanged.
The classical operators have their usual meanings.

A TLA formula is one that can be constructed from predicates and
formulas $\Box[\act{A}]_{f}$ using classical operators, $\Box$, and
existential quantification over flexible variables.  
Thus, an action that is not a predicate can appear
in a TLA formula $F$ only as a subformula of an action \act{A} 
in a subformula $\Box[\act{A}]_{f}$ or \enabled{\act{A}} of $F$.
The semantics of
  \index{quantification!over flexible variables}%%%
actions, classical operators, and $\Box$ are defined as before.  The
approximate meaning of quantification over a flexible variable is that
$\EE x:F$ is true for a behavior iff there is some sequence of
values that can be assigned to $x$ that makes $F$ true.  The precise
definition appears in \cite{lamport:newtla} and is recalled in the
appendix.  As usual, we write
  $\EE\,x_{1},\ldots,x_{n}:F$ instead of 
  $\EE\,x_{1}:\ldots\EE\,x_{n}:F$.

A {\em property\/} is a set of behaviors that is {\em invariant under
  \index{property}%%%
stuttering}, meaning that it contains a behavior $\sigma$ iff it
  \index{stuttering, invariant under}%%%
contains every behavior obtained from $\sigma$ by adding and/or
removing stuttering steps.  The set of all behaviors satisfying a TLA
formula is a property, which we often identify with the formula.

For any TLA formula $F$, action \act{A}, and state function
  \index{fairness}%%%
  \index{fairness!weak}%%%
  \index{WF}%%%
  \index{fairness!strong}%%%
  \index{SF}%%%
$f$:
 \[ \begin{array}[t]{@{}lcl@{}}
    \Diamond F & \deq & \lnot \Box \lnot F \\
     \WF{f}{\act{A}} & \deq & \Box\Diamond\lnot(\enabled{\anact{A}{f}})
                        \;\lor\; \Box\Diamond\anact{A}{f}\\
     \SF{f}{\act{A}} & \deq & \Diamond\Box\lnot(\enabled{\anact{A}{f}})
                        \;\lor\; \Box\Diamond\anact{A}{f}
     \end{array}
  \]
These are TLA formulas, since $\Diamond\anact{A}{f}$ equals
$\lnot\Box[\lnot\act{A}]_{f}$.

\subsection{Safety and Fairness} \label{sec:safety-and-fairness}

A {\em finite behavior\/} 
  \index{behavior!finite}%%%
is a finite sequence of states.  We say that
a finite behavior satisfies a property $F$ iff
it can be continued to an infinite behavior in $F$.  
A property $F$ is a {\em safety property\/}~\cite{alpern:defining}
  \index{safety}%%%
 iff the following condition
holds: $F$ contains a behavior iff it is satisfied by every finite
prefix of the behavior.\footnote{One sometimes defines $s_{1}, \ldots,
s_{n}$ to satisfy $F$ iff the behavior
 $s_{1},\ldots,s_{n},s_{n},s_{n},\ldots\,$ is in $F$.  Since properties
are invariant under stuttering, this alternative definition leads to the
same definition of a safety property.}
Intuitively, a safety property asserts that something
``bad'' does not happen.  Predicates and formulas of the form
$\Box[\act{A}]_{f}$ are safety properties.

Safety properties are closed sets in a topology on the set of all
   \index{closed set}%%%
   \index{safety!and closed sets}%%%
behaviors~\cite{abadi:existence}.  Hence, if two TLA formulas $F$ and
$G$ are safety properties, then $F\land G$ is also a safety property.
The {\em closure\/} \closure{F} of a property $F$ is the smallest
safety
  \index{closure}%%%
  \index{c@$\closure{\ldots}$}%%%
property containing $F$.  It can be shown that \closure{F} 
is expressible in TLA, for any TLA formula $F$.

If $\Pi$ is a safety property and $L$ an arbitrary property, then the
pair $(\Pi,L)$ is {\em machine closed\/} iff every finite behavior
  \index{machine closure}%%%
satisfying $\Pi$ can be extended to an infinite behavior in $\Pi\land
L$\@.  Two equivalent definitions are that $(\Pi,L)$ is machine closed
iff (i)~$\closure{\Pi\land L}$ equals $\Pi$, or (ii)~for any safety
property $\Psi$, if $\Pi\land L$ implies $\Psi$ then $\Pi$ implies
$\Psi$.  The lack of machine closure can be a source of 
  \index{completeness}%%%
incompleteness for proof methods.  Most methods for proving safety
properties use only safety properties as hypotheses, so they can prove
$\Pi\land L\implies\Psi$ for safety properties $\Pi$ and $\Psi$ only
by proving $\Pi\implies\Psi$.  If $\Pi$ is not machine closed, then
$\Pi\land L\implies\Psi$ could hold even though $\Pi\implies\Psi$ does
not, and these methods will be unable to prove that the system with
specification $\Pi$ satisfies $\Psi$.  

Proposition~\ref{prop:fairness-is-machine-closed} below shows
that machine closure generalizes the concept of fairness.  
  \index{machine closure!and fairness}%%%
The {\em
canonical form\/} for a TLA formula is
\begin{equation} \label{eq:canonical-form}
 \EE\,x: (\init \,\land\, \Box[\act{N}]_{v} \,\land\, L)
\end{equation}
where \init\ is a predicate, \act{N} is an action, $v$ is a state function,
$L$ is a formula, 
$(\init\land\Box[\act{N}]_{v},L)$ is machine closed, and $x$ is a
  \index{canonical form}%%%
tuple of variables called the {\em internal variables\/} of the
  \index{variable!internal}%%%
formula.  Usually, $v$ will  be the tuple of all variables
appearing free in \init, \act{N}, and $L$ (including the variables of
$x$).  It follows from the definitions that
a behavior satisfies (\ref{eq:canonical-form}) iff there is some
way of choosing values for $x$ such that (a)~\init\ is true in the
initial state, (b)~every step is either an \act{N} step or leaves all
the variables in $v$ unchanged, and (c)~the entire behavior satisfies $L$.

%try
An action \act{A} is said to be a {\em subaction\/} of a
  \index{action!subaction}%%%
safety property $\Pi$ iff, whenever an \act{A} step is possible, an
\act{A} step that satisfies $\Pi$ is possible.  More precisely,
\act{A} is a subaction of $\Pi$ iff for every finite behavior $s_{1},
\ldots, s_{n}$ satisfying $\Pi$ with \enabled{\act{A}} true in state
$s_{n}$, there exists a state $s_{n+1}$ such that $(s_{n}, s_{n+1})$
is an \act{A} step and $s_{1}, \ldots, s_{n+1}$ satisfies $\Pi$.  By
this definition, if \act{A} implies \act{N} then \act{A} is a
subaction of $\init\land\Box[\act{N}]_{v}$.  The exact condition is
that \act{A} is a subaction of $\init\land\Box[\act{N}]_{v}$
 iff\footnote{We let
$\implies$ have lower precedence than the other boolean operators.}
 \[ \init\land\Box[\act{N}]_{v}\;\implies\; \Box((\enabled{\act{A}})
     \implies\enabled{(\act{A}\land[\act{N}]_{v})})
  \]
Two actions are {\em disjoint\/} iff their conjunction is identically false.
A weaker notion is disjointness of two actions for a property:
\act{A} and \act{B} are {\em disjoint for\/} 
  \index{action!disjoint}%%%
$\Pi$ iff no behavior satisfying $\Pi$ contains an $\act{A}
\land \act{B}$ step.  By this definition, \act{A} and \act{B} are
disjoint for $\init\land\Box[\act{N}]_{v}$ iff
 \[ \init\land\Box[\act{N}]_{v}\;\implies\; 
     \Box\lnot\enabled{(\act{A}\land\act{B}\land[\act{N}]_{v})}
 \] 
%try

The following result shows that the conjunction of \WFop\ and \SFop\
formulas is a fairness property.  It is a special case of
Proposition~\ref{prop:fairness-is-machine-realizable} of
Section~\ref{sec:open}.
\begin{proposition} \label{prop:fairness-is-machine-closed}
If $\Pi$ is a safety property and $L$ is the conjunction of a finite or 
countably infinite number of
formulas\/ of the form \WF{w}{\act{A}} and/or \SF{w}{\act{A}} such that
each \anact{A}{w} is a subaction of $\Pi$,
then $(\Pi,L)$ is machine closed.
\end{proposition}
In practice, each $w$ will usually be a tuple of variables changed by
the corresponding action \act{A}, so \anact{A}{w} will equal
\act{A}.\footnote{More precisely, $T\land\act{A}$ will imply $w'\neq w$,
where $T$ is the type-correctness invariant.} In the informal
exposition, we often omit the subscript and talk about \act{A} when we
really mean \anact{A}{w}.

Machine closure for more general classes of properties can be proved
with the following two propositions, which are proved in the appendix.
To apply the first, one must prove that $\EE x: \Pi$ is a safety
  \index{machine closure!and quantification}%%%
  \index{machine closure!and implication}%%%
property.  By Proposition~2 of \cite[page~265]{abadi:existence}, it
suffices to prove that $\Pi$ has finite internal nondeterminism (fin),
  \index{finite internal nondeterminism (fin)}%%%
with $x$ as its internal state component.  Here, fin means roughly that
there are only a finite number of sequences of values for $x$ that can
make a finite behavior satisfy $\Pi$.
\begin{proposition} \label{prop:exists-preserves-machine-closed}
If\/ $(\Pi, L)$ is machine closed, $x$ is
a tuple of variables that do not occur free in $L$, and\/
$\EE x : \Pi$ is a safety property, then\/ $((\EE x:\Pi), L)$ is
machine closed.
\end{proposition}

\begin{proposition} \label{prop:proving-machine-closure} 
If\/ $(\Pi, L_{1})$ is machine closed and\/
$\Pi\land L_{1}$ implies $L_{2}$, then\/
$(\Pi,L_{2})$ is machine closed.
\end{proposition}


\subsection{History-Determined Variables} \label{sec:history-determined} 

A {\em history-determined\/} variable is one whose current value can be
inferred from the current and past values of other variables.  For the
  \index{variable!history-determined}%%%
precise definition, let
\begin{equation} \label{eq:Hist}
  \vbl{Hist}(h,f,g,v) \;\;\deq\;\;
(h = f) \;\land\; 
    \Box[(h' = g)\land(v'\neq v)]_{(h,v)}
\end{equation}
where $f$ and $v$ are state functions and $g$ is a transition function.
A variable $h$ is a history-determined variable for a formula $\Pi$ iff
$\Pi$ implies $\vbl{Hist}(h,f,g,v)$, for some $f$, $g$, and $v$ such
that $h$ occurs free in neither $f$ nor $v$, and $h'$ does not occur
free in $g$.

If $f$ and $v$ do not depend on $h$, and $g$ does not depend on $h'$,
then $\EE h:\vbl{Hist}(h,f,g,v)$ is true for all behaviors.  Therefore,
if $h$ does not occur free in formula $\Phi$, then 
$\EE h:(\Phi\land\vbl{Hist}(h,f,g,v))$ is equivalent to $\Phi$.  In other
words, conjoining $\vbl{Hist}(h,f,g,v)$ to $\Phi$ does not change the
behavior of its variables, so it makes $h$ a ``dummy variable'' for
$\Phi$---in fact, it is a special kind of history
  \index{variable!history}%%%
variable~\cite[page~270]{abadi:existence}.  

As an example, we add to the lossy queue's specification $\Phi_{Q}$ a
history variable \vbl{hin} that records the sequence of values
transmitted on the input wire.  Let
\begin{equation}  \label{eq:hin}
    H_{\vbl{in}}\;\;\deq\;\;
    \begin{array}[t]{@{\land\;}l@{}}
       \vbl{hin} = \seq{\,}\\
       \Box[\;\begin{array}[t]{@{\land\;}l@{}}
               \vbl{hin}' = \vbl{hin} \circ \seq{\inpval'} \\
               (\inpval,\inpbit)'\neq (\inpval,\inpbit) \;\;
                  ]_{(\vbl{hin},\inpval,\inpbit)}
             \end{array}
    \end{array}
\end{equation}
Then $H_{\vbl{in}}$ equals 
$\vbl{Hist}(\vbl{hin},\seq{\,},\vbl{hin}\o\seq{\inpval'},(\inpval,\inpbit))$;
therefore, \vbl{hin} is a history-determined variable for 
 $\Phi_{Q}\land H_{\vbl{in}}$, and
$\EE\,\vbl{hin}: (\Phi_{Q}\land H_{\vbl{in}})$ 
equals $\Phi_{Q}$.

If $h$ is a history-determined variable for a property $\Pi$, then
$\Pi$ is fin, with $h$ as its internal state component.
  \index{finite internal nondeterminism (fin)!and history-determined
	variables}%%%
Hence, if $\Pi$ is a safety property, then $\EE h: \Pi$ is also a
safety property.

%try

\section{Real-Time Closed Systems} \label{sec:real-time-closed}

We now use TLA to specify and reason about timing properties of closed
systems.  We focus on worst-case upper and lower bounds on real-time
delays.  However, our approach should be applicable to other real-time
properties as well.  We believe that its only inherent limitation is
that it cannot handle probabilistic real-time properties, such as
average delay requirements.  This limitation arises because, like most
specification formalisms, TLA cannot express probabilistic properties.

Section~\ref{sec:time} explains how time and timing
properties can be represented with TLA formulas, and
Section~\ref{sec:reasoning} describes how to reason about these
formulas.  The problem of Zeno specifications is addressed in
Section~\ref{sec:The-nonZeno-Condition}.  Our method of specifying and
reasoning about timing properties is illustrated in
Section~\ref{sec:fischer} with the example of a real-time mutual
exclusion protocol.


\subsection{Time and Timers} \label{sec:time}

In real-time TLA specifications, real time is represented by the
variable \now.  Although it has a special interpretation, \now\ is just
  \index{now@\now}%%%
an ordinary variable of the logic.  The value of \now\ is always a real
number, and it never decreases---conditions expressed by the TLA
  \index{RT@$\RT{}$}%%%
formula
 \[ \RT{} \;\;\deq\;\; 
    (\now\in\Real) \,\land\, \Box[\now'\in\infInterval{\now}]_{\now}
 \]
where \Real\ is the set of real numbers and \infInterval{r} is
$\{t\in\Real: t > r\}$.

It is convenient to make time-advancing steps distinct from ordinary
program steps.  This is done by strengthening the formula \RT{}
to
 \[ \RT{}_{v} \;\;\deq\;\;
    (\now\in\Real) \;\land\; \Box[(\now'\in\infInterval{\now}) \,\land\,
       (v'=v)]_{\now}
 \]
This property differs from \RT{} only in asserting that $v$ does
not change when \now\ advances.  Simple logical manipulation
shows that  
$\RT{}_{v}$ is equivalent
to $\RT{}\land\Box[\now'=\now]_{v}$, and
 % \begin{equation} \label{eq:tickv-to-tick}
 \[ \init\land\Box[\act{N}]_{v} \land\RT{}_{v}
    \;=\;
   \init\land\Box[\act{N}\land(\now'=\now)]_{v} \land\RT{}
  \] 
 % \end{equation}
 
We express real-time constraints by placing timing bounds on actions.
Such bounds are the bread-and-butter of many real-time formalisms,
such as real-time process algebras~\cite{debakker:real-time}.
Timing bounds on actions
are imposed by using {\em timers\/} to restrict
  \index{timer}%%%
  \index{timing constraints}%%%
the increase of \now.  A {\em timer for $\Pi$\/} is a state function
$t$ such that $\Pi$ implies $\Box(t\in\Real\cup\{\pm\oo\})$.  Timer
  \index{timer!upper-bound}%%%
  \index{MaxTime@$\vbl{MaxTime}$}%%%
$t$ is used as an upper-bound timer by conjoining the formula
 \[ \vbl{MaxTime(t)} \;\;\deq\;\; (\now\leq t) \,\land\,
         \Box[\now'\leq t']_{\now}
 \]
to a specification.  This formula asserts that \now\ is never advanced
past $t$.  Timer $t$ is used as a lower-bound timer for an
  \index{timer!lower-bound}%%%
  \index{MinTime@$\vbl{MinTime}$}%%%
action \act{A} by conjoining the formula
 \[ \vbl{MinTime(t,\act{A},v)} \;\;\deq\;\;
    \Box[\act{A}\implies(t \leq \now)]_{v}
 \] 
to a specification.  This formula asserts that an $\anact{A}{v}$ step
cannot occur when \now\ is less than $t$.\footnote{Unlike the usual
timers in computer systems that represent an increment of time, our
timers represent an absolute time.  To allow the type of strict time
bound that would be expressed by replacing $\leq$ with $<$ in the
definition of \vbl{MaxTime} or \vbl{MinTime}, we could introduce, as
additional possible values for timers, the set of all ``infinitesimally
shifted'' real numbers $r^{-}$, where $t\leq r^{-}$ iff
$t<r$, for any reals $t$ and $r$.}

A common type of timing constraint asserts that an \act{A} step must
occur within $\delta$ seconds of when the action \act{A} becomes
enabled, for some constant $\delta$.  After an \act{A} step, the next
\act{A} step must occur within $\delta$ seconds of when 
action \act{A} is re-enabled.  There are at least two reasonable
interpretations of this requirement.  

The first interpretation is that the \act{A}
step must occur if \act{A} has been continuously enabled for $\delta$
seconds.  This is expressed by $\vbl{MaxTime}(t)$ when $t$ is a state
  \index{VTimer@$\vbl{VTimer}$}%%%
function satisfying
\[
\begin{array}{@{}l@{}}
\vbl{VTimer}(t, A, \delta, v) \;\;\deq\;\; 
  \begin{array}[t]{@{\land\s{.4}}l@{}}
    t = \mbox{\bf if $\enabled{\anact{A}{v}}$ } 
           \begin{array}[t]{@{}l@{}l@{}}
            \mbox{\bf then } & \now+\delta\\
            \mbox{\bf else } & \oo
           \end{array} \\
%
    \Box[\,\begin{array}[t]{@{\land\s{.4}}l@{}l@{}}
         t' = \begin{array}[t]{@{}l}
                 \mbox{\bf if $(\enabled{\anact{A}{v}})'$} \\
                     \s{1}\begin{array}[t]{@{}l@{}l@{}}
                              \mbox{\bf then } & 
                               \begin{array}[t]{@{}l@{}l@{}}
                                  \mbox{\bf if $\anact{A}{v} \lor 
                                          \lnot\enabled{\anact{A}{v}}$ }\\
                                   \s{1}\begin{array}[t]{@{}l@{}l@{}}
                                           \mbox{\bf then } & \now+\delta\\
                                           \mbox{\bf else } & t
                                          \end{array} 
                               \end{array}\\
                              \mbox{\bf else } & \oo
                              \end{array}
                       \end{array}\\ 
%
          v' \neq v \s{.4}
        ]_{(t,v)}
           \end{array}
  \end{array}
\end{array}
 \]
Such a $t$ is called a {\em volatile $\delta$-timer}.% 
  \index{timer!volatile $\delta$-timer}%%%

Another
interpretation of the timing requirement
is that an \act{A} step must occur if \act{A} has been
enabled for a total of $\delta$ seconds, though not necessarily
continuously enabled.  This is expressed by $\vbl{MaxTime}(t)$ when $t$
  \index{PTimer@$\vbl{PTimer}$}%%%
satisfies
 \[ 
\begin{array}{@{}l@{}}
\vbl{PTimer}(t, A, \delta, v) \;\;\deq\;\;% \\
%\s{2}
  \begin{array}[t]{@{\land\s{.4}}l@{}}
    t = \now+\delta\\
%
    \Box[\,\begin{array}[t]{@{\land\s{.4}}l@{}l@{}}
         t' = \begin{array}[t]{@{}l}
                 \mbox{\bf if $\enabled{\anact{A}{v}}$} \\
                     \s{1}\begin{array}[t]{@{}l@{}l@{}}
                              \mbox{\bf then } & 
                                 \mbox{\bf if $\anact{A}{v}$ } 
                                       \begin{array}[t]{@{}l@{}l@{}}
                                         \mbox{\bf then } & \now+\delta\\
                                         \mbox{\bf else } & t
                                       \end{array} \\
                              \mbox{\bf else } & t+(\now'-\now)
                              \end{array}
                       \end{array}\\ 
%
          (v,\now)' \neq (v,\now) \s{.4}
        ]_{(t,v,\now)}
           \end{array}
  \end{array}
\end{array}
 \]
Such a $t$ is called a {\em persistent $\delta$-timer}.  We can use
  \index{timer!persistent $\delta$-timer}%%%
$\delta$-timers as lower-bound timers as well as upper-bound timers.

Observe that $\vbl{VTimer}(t,\act{A},\delta,v)$ has the form
$\vbl{Hist}(t,f,g,v)$ and $\vbl{PTimer}(t,\act{A},\delta,v)$ has the
form $\vbl{Hist}(t,f,g,(v,\now))$, where \vbl{Hist} is defined by
(\ref{eq:Hist}).  Thus, if formula $\Pi$ implies that a variable $t$
satisfies either of these formulas, then $t$ is a history-determined
variable for~$\Pi$.

As an example of the use of timers, we make the lossy queue of
Section~\ref{sec:Q-example} nonlossy by adding the following timing
  \index{queue!real-time}%%%
constraints.
\begin{itemize}
\item Values must be put on a wire at most once every
$\delta_{\vbl{snd}}$ seconds.  There are two conditions---one on the
input wire and one on the output wire.  They are expressed by using
$\delta_{\vbl{snd}}$-timers $t_{\vbl{Inp}}$ and $t_{\vbl{DeQ}}$, for
the actions \vbl{Inp} and \vbl{DeQ}, as lower-bound timers.

\item A value must be added to the queue at most $\Delta_{\vbl{rcv}}$
      seconds after it appears on the input wire.   This is expressed
      by using a $\Delta_{\vbl{rcv}}$-timer $T_{\vbl{EnQ}}$, for the enqueue
      action, as an upper-bound timer.

\item A value must be sent on the output
      wire within $\Delta_{snd}$ seconds of when it reaches the
      head of the queue.  This is expressed by using a
      $\Delta_{snd}$-timer $T_{\vbl{DeQ}}$, for the
      dequeue action, as an upper-bound timer.
\end{itemize}
The timed queue will be nonlossy if
$\Delta_{\vbl{rcv}}<\delta_{\vbl{snd}}$.  In this case, we expect the
\vbl{Inp}, \vbl{EnQ}, and \vbl{DeQ} actions to remain enabled until
they are ``executed'', so it doesn't matter whether we use volatile or
persistent timers.  We use volatile timers because they are a little
easier to reason about.

\label{sec:timed-queue}
The timed version $\Pi_{Q}^{t}$ of the queue's internal specification
$\Pi_{Q}$ is obtained by conjoining the timing constraints to $\Pi_{Q}$:
\begin{equation} \label{eq:PiT}
\Pi_{Q}^{t} \;\;\deq\;\;
    \begin{array}[t]{@{}l@{}}
%   \EE\,t_{\vbl{Inp}}, t_{\vbl{DeQ}},T_{\vbl{EnQ}}, 
%    T_{\vbl{DeQ}}:\\[.5\jot]
      \relax\land\;\Pi_{Q} \;\land\; \RT{}_{v}\\[.5\jot]
      \relax\land\;\vbl{VTimer}(t_{\vbl{Inp}},\vbl{Inp},\delta_{\vbl{snd}},v)
        \,\land\, \vbl{MinTime}(t_{\vbl{Inp}},\vbl{Inp},v)\\[.5\jot]
      \relax\land\;\vbl{VTimer}(t_{\vbl{DeQ}},\vbl{DeQ},\delta_{\vbl{snd}},v)
        \,\land\, \vbl{MinTime}(t_{\vbl{DeQ}},\vbl{DeQ},v)\\[.5\jot]
      \relax\land\;\vbl{VTimer}(T_{\vbl{EnQ}},\vbl{EnQ},\Delta_{\vbl{rcv}},v)
       \,\land\, \vbl{MaxTime}(T_{\vbl{EnQ}})\\[.5\jot]
      \relax\land\;\vbl{VTimer}(T_{\vbl{DeQ}},\vbl{DeQ},\Delta_{\vbl{snd}},v)
       \,\land\, \vbl{MaxTime}(T_{\vbl{DeQ}})
    \end{array}
\end{equation}
The external specification $\Phi_{Q}^{t}$ of the timed queue is
obtained by existentially quantifying first the timers and then the
variables $q$ and \vbl{last}.

Formula $\Pi_{Q}^{t}$ of (\ref{eq:PiT}) is not in the canonical form
for a TLA formula.  A straightforward calculation, using the
type-correctness invariant (\ref{eq:typeOK}) and the equivalence of
$(\Box F)\land(\Box G)$ and $\Box(F\land G)$, converts the expression
 %%  \index{canonical form!example of conversion}%%%
(\ref{eq:PiT}) for $\Pi_{Q}^{t}$ to the canonical form given in
Figure~\ref{fig:PiT}.\footnote{Further simplification of
this formula is possible, but it requires an invariant.
In particular,
the fourth conjunct of 
$\vbl{DeQ}^{t}$ can be replaced by $T_{\vbl{EnQ}}'=T_{\vbl{EnQ}}$.}
Observe how each subaction \act{A} of the
original formula has a corresponding timed version $\act{A}^{t}$.
 %
\begin{figure}
\begin{center}

\(\begin{array}{@{}lcl@{}}
\init_{Q}^{t} & \deq & 
    \begin{array}[t]{@{\land\s{.4}}l}
          \init_{Q}\\
          \now\in\Real\\
          t_{\vbl{Inp}} = \now + \delta_{\vbl{snd}}\\
          t_{\vbl{DeQ}} = T_{\vbl{EnQ}} = T_{\vbl{DeQ}} = \oo\vs{.7}
    \end{array}\\
%

Inp^{t} & \deq &  
    \begin{array}[t]{@{\land\s{.4}}l}
          Inp \\
          t_{\vbl{Inp}} \leq \now \\
          t_{\vbl{Inp}}' = \now' + \delta_{\vbl{snd}}\\
          T_{\vbl{EnQ}}' \,=\, \mbox{\bf if $\vbl{last}'\neq\inpbit'$ 
                                        then $\now' + \Delta_{\vbl{rcv}}$ 
                                        else \oo}\\
          (t_{\vbl{DeQ}}, T_{\vbl{DeQ}})' \,=\,
            \mbox{\bf if $q=\seq{\,}$ then $(\oo,\oo)$
                                      else $(t_{\vbl{DeQ}}, T_{\vbl{DeQ}})$}
            \s{-1}\\
          \now' = \now\vs{.7}
    \end{array}\\
%
EnQ^{t} & \deq &  
    \begin{array}[t]{@{\land\s{.4}}l}
          EnQ\\
          T_{\vbl{EnQ}}' = \oo\\
          (t_{\vbl{DeQ}}, T_{\vbl{DeQ}})' \,=\,
             \mbox{\bf if $q = \seq{\,}$ }
                  \begin{array}[t]{@{}l@{}l@{}}
                    \mbox{\bf then } & (\now+\delta_{\vbl{snd}},\, 
                                           \now+\Delta_{\vbl{snd}})
                                        \s{-1}\\
                    \mbox{\bf else } & (t_{\vbl{DeQ}}, T_{\vbl{DeQ}})
                  \end{array}\\
          (t_{\vbl{Inp}},\now)' = (t_{\vbl{Inp}},\now)\vs{.7}
  \end{array}\\
%
DeQ^{t} & \deq &  
    \begin{array}[t]{@{\land\s{.4}}l}
          DeQ\\
          t_{\vbl{DeQ}} \leq \now \\
          (t_{\vbl{DeQ}}, T_{\vbl{DeQ}})' \,=\,
             \mbox{\bf if $q' = \seq{\,}$ }
                  \begin{array}[t]{@{}l@{}l@{}}
                    \mbox{\bf then } & (\oo, \oo)\\
                    \mbox{\bf else } & (\now+\delta_{\vbl{snd}},\,
                                            \now+\Delta_{\vbl{snd}})\s{-2}
                  \end{array}\\
          T_{\vbl{EnQ}}' \,= \,
%             \mbox{\bf if $\vbl{last}'=\inpbit'$ }
%                  \begin{array}[t]{@{}l@{}l@{}}
%                    \mbox{\bf then } & \oo \\
%                    \mbox{\bf else } & T_{\vbl{EnQ}}
%                  \end{array}\\
             \mbox{\bf if $\vbl{last}'=\inpbit'$ then \oo\ 
                         else $T_{\vbl{EnQ}}$}\\
         (t_{\vbl{Inp}},\now)' = (t_{\vbl{Inp}},\now) \vs{.7}
  \end{array}\\
%
\vbl{QTick} & \deq &  
    \begin{array}[t]{@{\land\s{.4}}l}
             \now' \in \ocInterval{\now}{\min(T_{\vbl{DeQ}},T_{\vbl{EnQ}})}\\
            (v,t_{\vbl{Inp}},t_{\vbl{DeQ}},T_{\vbl{DeQ}},T_{\vbl{EnQ}})' = 
              (v,t_{\vbl{Inp}},t_{\vbl{DeQ}},T_{\vbl{DeQ}},T_{\vbl{EnQ}})
     \vs{.7}
  \end{array}\\
%
\vbl{vt} & \deq & (v, \now, t_{\vbl{Inp}}, 
     t_{\vbl{DeQ}}, T_{\vbl{DeQ}}, T_{\vbl{EnQ}}) \vs{.7}\\
%
\Pi_Q^{t}  & \deq &  
    \begin{array}[t]{@{\land\s{.4}}l@{}}
         \init_{Q}^{t}\\
        \Box[Inp^{t} \,\lor\, EnQ^{t} \,\lor\, 
             DeQ^{t} \,\lor\, \vbl{QTick}]_{\vbl{vt}}
  \end{array}
%
\end{array}
\)
\end{center}
\caption{The canonical form for $\Pi_{Q}^{t}$, where
        \ocInterval{r}{s} denotes the set of reals $u$ such
        that $r<u\leq s$.}
\label{fig:PiT}
\end{figure}
 %
Action $\act{A}^{t}$ is obtained by conjoining \act{A} with the
appropriate relations between the old and new values of the timers.  If
\act{A} has a lower-bound timer, then $\act{A}^{t}$ also has a conjunct
asserting that it is not enabled when \now\ is less than this timer.
(The lower-bound timer $t_{\vbl{Inp}}$ for \vbl{Inp} does not affect
the enabling of other subactions because \vbl{Inp} is disjoint from all
other subactions; a similar remark applies to the lower-bound timer
$t_{\vbl{DeQ}}$.) There is also a new action, \vbl{QTick}, that
advances \now.


Formula $\Pi_{Q}^{t}$ is the TLA specification of a program that
satisfies each maximum-delay constraint by preventing \now\ from
advancing before the constraint has been satisfied.  Thus, the program
``implements'' timing constraints by stopping time, an apparent
absurdity.  However, the absurdity results from thinking of a TLA
formula, or the abstract program that it represents, as a {\em
prescription of how\/} something is accomplished.  A TLA formula is
really a {\em description of what\/} is supposed to happen.  Formula
$\Pi_{Q}^{t}$ says only that an action occurs before \now\ reaches a
certain value.  It is just our familiarity with ordinary programs that
makes us jump to the conclusion that \now\ is being changed by the
system.


%try
\subsection{Reasoning About Time} \label{sec:reasoning}

Formula $\Pi_{Q}^{t}$ is a safety property; it is satisfied by a behavior
in which no variables change values.  In particular, it allows
behaviors in which time stops.  We can rule out such behaviors
  \index{NZ@$\NZ{\oo}$}
by conjoining to $\Pi_{Q}^{t}$ the liveness property
 % \begin{equation} \label{eq:NZ-infty}
  \[ \NZ{\oo} \;\;\deq\;\; \forall\, t \in \Real : \Diamond (\now > t)
  \] 
 % \end{equation}
which asserts that \now\ gets arbitrarily large.  However, when
reasoning only about real-time (safety) properties, this should not be
necessary.  For example, suppose we want to show that our timed queue
satisfies a real-time property expressed by formula $\Psi^{t}$, which
is also a safety property.  If $\Pi_{Q}^{t}$ implies $\Psi^{t}$, then
$\Pi_{Q}^{t}\land\NZ{\oo}$ implies $\Psi^{t}\land\NZ{\oo}$.
Conversely, we don't expect conjoining a liveness property to add
  \index{liveness!in proof of safety}%%%
safety properties; if $\Pi_{Q}^{t}\land\NZ{\oo}$ implies $\Psi^{t}$,
then $\Pi_{Q}^{t}$ by itself should imply $\Psi^{t}$.  Hence,
there should be no need to introduce the liveness property \NZ{\oo}.
Section~\ref{sec:The-nonZeno-Condition} below explains precisely
when we can ignore property \NZ{\oo}.


A safety property we might want to prove for the timed queue is that it
does not lose any inputs.  To express this property, let \vbl{hin} be
the history variable, determined by $H_{\vbl{in}}$ of (\ref{eq:hin}),
that records the sequence of input values; and let \vbl{hout} and
$H_{\vbl{out}}$ be the analogous history variable and property for the
outputs.  The assertion that the timed queue loses no inputs is
expressed by 
 % footnote about implies having lower precedence used to go here
% \begin{equation} \label{eq:timed-queue-safety}
 \[ \Pi_{Q}^{t}\land H_{\vbl{in}} \land H_{\vbl{out}} \;\implies\;
   \Box(\vbl{hout}\subseq\vbl{hinp})
  \] 
% \end{equation}
where $\alpha\subseq\beta$ iff $\alpha$ is an initial prefix of
$\beta$.   This is a standard invariance property.  The usual
method for proving such properties leads to the following invariant
 % \begin{equation} \label{eq:PiQT-invariant}
 \[ \begin{array}[t]{@{\land\s{.4}}l@{}}
   T_{Q} 
     \;\land\; (t_{\vbl{Inp}}, \now  \in \Real) 
     \;\land\; (T_{\vbl{EnQ}}, t_{\vbl{DeQ}}, T_{\vbl{DeQ}} \in 
                     \Real \cup \{\oo\})
  \\[\jot]
%
      \now \leq \min(T_{\vbl{EnQ}}, T_{\vbl{DeQ}})     \\[\jot]
%
      (\vbl{last} = \inpbit) \;\implies\; 
                      (T_{\vbl{EnQ}} = \oo)\,\land\,
                     (\vbl{hinp} = \vbl{hout} \o q)     \\[\jot]
%
      (\vbl{last} \neq \inpbit) \;\implies\; 
                     (T_{\vbl{EnQ}} < t_{\vbl{Inp}}) \,\land\,
                     (\vbl{hinp} = \vbl{hout} \o q \o \seq{\inpval}) \\[\jot]
%
      (q = \seq{\,}) \;\equiv\; (T_{\vbl{DeQ}} = \oo)
  \end{array}
 \] 
 % \end{equation}
and to the necessary assumption
$\Delta_{\vbl{rcv}}<\delta_{\vbl{snd}}$.  (Recall that $T_{Q}$ is the
type-correctness predicate (\ref{eq:typeOK}) for $\Pi_{Q}$.)  
Property \NZ{\oo} is not needed to prove this invariant.

Property \NZ{\oo} is needed to prove that real-time properties imply liveness
  \index{liveness!and \NZ{\oo}}%%%
properties.  The desired liveness property for the timed queue is that
the sequence of input messages up to any point eventually appears as
the sequence of output messages. It is expressed by
 \[ \Pi_{Q}^{t}\land\NZ{\oo} \;\implies\; 
     \forall\,\sigma :
     \Box(  (\vbl{hinp} = \sigma)\implies\Diamond(\vbl{hout}=\sigma))
 \]
This formula is proved by first showing 
\begin{equation} 
\Pi_{Q}^{t}\land\NZ{\oo} \;\implies\; \WF{v}{\vbl{EnQ}}\land\WF{v}{\vbl{DeQ}}
\end{equation}
and then using a standard liveness argument to prove
 \[ \Pi_{Q}^{t}\land\WF{v}{\vbl{EnQ}}\land\WF{v}{\vbl{DeQ}}\;\implies\; 
     \forall\,\sigma :
     \Box(  (\vbl{hinp} = \sigma)\implies\Diamond(\vbl{hout}=\sigma))
 \]
The proof that $\Pi_{Q}^{t}\land\NZ{\oo}$ implies \WF{v}{\vbl{EnQ}} is by
contradiction.  Assume \vbl{EnQ} is forever enabled but never occurs.
An invariance argument then shows that $\Pi_{Q}^{t}$ implies that
$T_{\vbl{EnQ}}$ forever equals its current value, preventing \now\ from
advancing past that value; and this contradicts \NZ{\oo}\@.  The proof
that $\Pi_{Q}^{t}\land\NZ{\oo}$ implies \WF{v}{\vbl{DeQ}} is similar.


\subsection{The NonZeno Condition} \label{sec:The-nonZeno-Condition}

The timed queue specification $\Pi_{Q}^{t}$ asserts that a \vbl{DeQ}
action must occur between $\delta_{\vbl{snd}}$ and $\Delta_{\vbl{snd}}$
seconds of when it becomes enabled.  What if
$\Delta_{\vbl{snd}}<\delta_{\vbl{snd}}$?  If an input occurs, it
eventually is put in the queue, enabling \vbl{DeQ}\@.  At that point, the
value of \now\ can never become more than $\Delta_{\vbl{snd}}$ greater
than its current value, so the program eventually reaches a
``time-blocked state''.  
  \index{state!time-blocked}%%%
In a time-blocked state, only the
\vbl{QTick} action can be enabled, and it cannot advance \now\ past some
fixed time.  In other words, eventually a state is reached in which
every variable other than \now\ remains the same, and \now\ either
remains the same or keeps advancing closer and closer to some upper
bound.

We can attempt to correct such pathological specifications by requiring
that \now\ increase without bound.  This is easily done by conjoining
the liveness property \NZ{\oo} to the safety property $\Pi_{Q}^{t}$,
but that doesn't accomplish anything.  Since $\Pi_{Q}^{t}\land\NZ{\oo}$
rules out behaviors in which \now\ is bounded, it allows only
behaviors in which there is no input, if
$\Delta_{\vbl{snd}}<\delta_{\vbl{snd}}$.  Such a specification is no
better than the original specification $\Pi_{Q}^{t}$.  The fact that
the safety property allows the possibility of reaching a time-blocked
state indicates an error in the specification.  One does not add timing
constraints on output actions with the intention of forbidding input.

We call a safety property {\em Zeno\/} if it allows the system to reach
  \index{Zeno, {\em see also} nonZenoness}%%%
a state from which \now\ must remain bounded.  More precisely, a safety
property $\Pi$ is 
 %%  defined to be 
{\em nonZeno\/} iff every finite behavior satisfying $\Pi$ can be
  \index{nonZenoness}%%%
completed to an infinite behavior satisfying $\Pi$ in which \now\
increases without bound.  In other words, $\Pi$ is nonZeno iff the pair
$(\Pi,\NZ{\oo})$ is machine 
  \index{machine closure!and nonZenoness}%%%
closed.\footnote{An arbitrary property
$\Pi$ is nonZeno iff $(\closure{\Pi},\Pi\land\NZ{\oo})$ is machine
closed.  We restrict our attention to real-time constraints for safety
specifications.}

Zenoness can be a source of incompleteness for proof
  \index{completeness}%%%
methods.  Only nonZeno behaviors are physically meaningful, so a
real-time system with specification $\Pi$ satisfies a property $\Psi$
if $\Pi\land\NZ{\infty}$ implies $\Psi$.  As observed in
Section~\ref{sec:safety-and-fairness}, a proof method may be
incapable of showing that $\Pi\land\NZ{\infty}$ implies $\Psi$ if
$(\Pi,\NZ{\infty})$ is not machine closed---that is, if $\Pi$ is Zeno.



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%try

The following result can be used to ensure that a real-time
specification written in terms of volatile $\delta$-timers is nonZeno.
The main hypotheses are: (1)~the maximum-delay timers are on
subactions of the untimed specification, and (3)~a maximum delay for an
action $\act{A}_{j}$ is not smaller than a minimum delay for an action
$\act{A}_{i}$ if $\act{A}_{i}$ and $\act{A}_{j}$ can be simultaneously
enabled.
\begin{theorem} \label{thm:vtimer-NZ}
Let $v$ be the tuple of variables free in \init\ or \act{N}.
The property 
\[ \begin{conj}
     \init \land \Box[\act{N}]_{v} \land \vbl{RT}_{v}\\[\jot]
     \forall i \in I : \vbl{VTimer}(t_{i},\act{A}_{i}, \delta_{i},v)
                        \,\land\,
                       \vbl{MinTime}(t_{i},\act{A}_{i}, v)\\[\jot]
     \forall j \in J : \vbl{VTimer}(T_{j},\act{A}_{j}, \Delta_{j},v)
                        \,\land\,
                       \vbl{MaxTime}(T_{j})
   \end{conj}
\]
is nonZeno if 
%1 
\now\ does not appear in $v$,
%2
$I$ and $J$ are finite sets, 
and for all $i\in I$ and $j\in J$:
\begin{enumerate}
%3
\item 
  %3.1
   $\anact{{A}_{j}}{v}$ is a subaction of $\init\land \Box[\act{N}]_{v}$
  %3.2
   whose free variables appear in $v$,

\item 
   %5.1  
     $\delta_{i}$ and $\Delta_{j}$ are positive reals,
%4
\item $\delta_{i} \leq\Delta_{j}$, or 
     $\anact{{A}_{i}}{v}$ and $\anact{{A}_{j}}{v}$ are
      disjoint for $\init\land \Box[\act{N}]_{v}$ and $i\neq j$, 

%6
\item the $t_{i}$ and $T_{j}$ are distinct variables different
      from \now\ and from the variables in $v$.

\end{enumerate}
\end{theorem}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
We can apply the theorem to prove that the specification $\Pi_{Q}^{t}$
is nonZeno if $\delta_{\vbl{snd}}\leq\Delta_{\vbl{snd}}$.
The hypotheses of the
theorem are checked as follows.
\begin{enumerate}
\item Actions \anact{{}\vbl{DeQ}}{v} and \anact{{}\vbl{EnQ}}{v} imply
$\act{N}_{Q}$, so they are subactions of $\Pi_{Q}$.

\item Trivial.

\item The conjunction of any two of the actions
\anact{{}\vbl{Inp}}{v}, \anact{{}\vbl{DeQ}}{v}, and
\anact{{}\vbl{EnQ}}{v} equals \false, so the actions are pairwise
disjoint for $\Pi_{Q}$.\footnote{Actually, the type-correctness
predicate $T_{Q}$ is needed to prove that
$\anact{{}\vbl{Inp}}{v}\land\anact{{}\vbl{DeQ}}{v}$ equals \false.}
The only remaining cases to consider are those in which $i=j$.  Only
\anact{{}\vbl{DeQ}}{v} has both a lower-bound and an upper-bound
timer, and 
$\delta_{\vbl{snd}}\leq\Delta_{\vbl{snd}}$ holds by hypothesis.


\item Trivial.
\end{enumerate}


The theorem is valid for persistent as well as volatile timers.  Any
combination of \vbl{VTimer} and \vbl{PTimer} formulas may occur,
except that a single $\act{A}_{k}$ cannot have a persistent
lower-bound timer $t_{k}$ and a volatile upper-bound timer $T_{k}$.
In fact, the theorem is valid for any kind of lower-bound timer
$t_{k}$, not just a persistent or volatile one, provided $t_{k}$ is
never greater than the corresponding upper-bound timer~$T_{k}$.  

All of these results are corollaries of Theorem~\ref{thm:NZ} below,
which in turn is a consequence of Theorem~\ref{thm:open-NZ} of
Section~\ref{sec:open}.  To allow arbitrary lower-bound timers,
Theorem~\ref{thm:NZ} uses different notation from
Theorem~\ref{thm:vtimer-NZ}.  The $\Pi$ of Theorem~\ref{thm:NZ}
corresponds to the conjunction of $\init \land \Box[\act{N}]_{v}$ with
all the \vbl{VTimer} formulas of Theorem~\ref{thm:vtimer-NZ}.
 %
\begin{theorem} \label{thm:NZ}
Let  
\begin{itemize}
\item $\Pi$ be a safety property of the form 
$\init\land\Box[\act{N}]_{w}$,

\item $t_{i}$ and\/ $T_{j}$ be timers for\/ $\Pi$ 
and let\/ $\act{A}_{k}$ be an
action, for all\/ $i\in I$, $j\in J$, and\/ $k\in I\cup J$, where $I$
and\/ $J$ are sets, with\/ $J$ finite,

\item $\Pi^{t}\;\;\deq\;\;
    \begin{array}[t]{@{}l@{}}
          \Pi\;\land\,\RT{}_{v}\;\land\;\\
          \s{1}\forall\,i\in I : \vbl{MinTime}(t_{i}, \act{A}_{i},v)
          \;\land\;\forall\,j\in J : \vbl{MaxTime}(T_{j})
    \end{array}$
\end{itemize}
If~%
\begin{minipage}[t]{.9\textwidth}
\begin{enumerate}
%1
\item $\Pi^{t}\implies\Box(t_{i}\leq T_{j})$, or 
  $\anact{A_{i}}{v}$ and\/ $\anact{A_{j}}{v}$ are disjoint
      for\/ $\Pi$ and $i\neq j$, 
for all $i\in I$ and $j\in J$,

%4, 0
\item 
\begin{enumerate}
\item \now\ does not occur free in\/ $v$,
\item $(\now'=r)\land(v'=v)$ is a subaction of\/ $\Pi$, for all\/ 
      $r\in\Real$,
\end{enumerate}


\item for all\/ $j\in J$:\iftoplas{}{\vspace{-.75\topsep}}
\begin{enumerate}
 %2
 \item $\anact{A_{j}}{v}\land(\now'=now)$ is a subaction of\/ $\Pi$,
 %3
 \item $\Pi\;\implies\; 
               \vbl{VTimer}(T_{j}, \act{A}_{j},\Delta_{j},v)$ or%
      \iftoplas{ }{\\*}%
     $\Pi\;\implies\; 
     \vbl{PTimer}(T_{j}, \act{A}_{j}, \Delta_{j},v)$, for some
       $\Delta_{j}\in\infInterval{0}$,

 %11
 \item $\Pi^{t}\;\implies\;\Box(
   \begin{array}[t]{@{}l@{}}
     \enabled{\anact{A_{j}}{v}} = \\
        \s{1}\enabled{(\anact{A_{j}}{v}\,\land\,(\now'=\now))})
   \end{array}$
 %9
 \item $(v'=v)\;\implies\;
     (\enabled{\anact{A_{j}}{v}} = (\enabled{\anact{A_{j}}{v}})')$
\end{enumerate}
%10
\end{enumerate}
\end{minipage}\\
then\/ $(\Pi^{t}, \NZ{\oo})$ is machine closed
\end{theorem}

%try

Most 
  \index{nonZenoness!and $\delta$-timers}%%%
nonaxiomatic approaches, including both real-time process algebras
and more traditional programming languages with timing constraints,
essentially use $\delta$-timers for actions.  Theorem~\ref{thm:NZ}
implies that they automatically yield nonZeno specifications.


 % The first three hypotheses are either trivial or else follow from
 % straightforward calculations of the appropriate {\em Enabled\/}
 % predicates.  
 % The fourth follows from the general result
 %  \[ (\delta\leq\Delta)\,\land\,
 %     \RT{}_{v}\,\land\,
 %     \vbl{VTimer}(t, \act{A},\delta,v)\,\land\,
 %     \vbl{VTimer}(T, \act{A},\Delta,v)
 %     \;\implies\; \Box(t \leq T)
 %   \]
 % which is proved by a simple invariance argument.  (A similar result
 % holds for persistent timers.)

Theorem~\ref{thm:NZ} can be further generalized in two ways.  First, $J$ can be
infinite---if $\Pi^{t}$ implies that only a finite number
of actions $\act{A}_{j}$ with $j\in J$ are enabled before time $r$, for
any $r\in\Real$.  For example, by letting $\act{A}_{j}$ be the action
that sends message number $j$, we can apply the theorem to a program
that sends messages number 1 through $n$ at time $n$, for every integer
$n$.  This program is nonZeno even though the number of actions per
second that it performs is unbounded.  Second, we can extend the
theorem to the more general class of timers obtained by letting the
$\Delta_{j}$ be arbitrary real-valued state functions, rather than just
constants---if all the $\Delta_{j}$ are bounded from below by a
positive constant $\Delta$.

Theorem~\ref{thm:NZ} can be proved using Propositions
\ref{prop:fairness-is-machine-closed} and
\ref{prop:proving-machine-closure} and ordinary TLA reasoning.  By
these propositions, it suffices to display a formula $L$ that is the
conjunction of fairness conditions on subactions of $\Pi^{t}$ such that
$\Pi^{t}\land L$ implies \NZ{\oo}\@.  A suitable $L$ is
\WF{(\now,v)}{\act{C}}, where \act{C} is an action that either
(a)~advances \now\ by $\min_{j\in J}\Delta_{j}$ if allowed by the
upper-bound timers $T_{j}$, or else as far as they do allow, or 
(b)~executes an \anact{A_{j}}{v} action for which $\now=T_{j}$.
 %
% is defined by
% \[ 
% \begin{array}{@{}lcl@{}}
%   \act{A}_{j}^{t}  & \deq & (now'=now) \,\land\,
%       (\mbox{\bf if $\;j \in I\;$ %}
%             then $\;\act{A}_{j} \land (\now \geq t_{j})\;$
%             else $\;\act{A}_{j}$})\\[\jot]
%%
%    J_{E} & \deq & \{j \in J : \enabled{\anact{A}{j}}\}\\[\jot]
%%
%   T & \deq & \displaystyle \min(\now+\min_{j\in J}\Delta_{j},\,
%               \min_{j\in J_{E}} T_{j})  \\[\jot]
%   \act{B}  & \deq & 
%    ((\now = T) \land \act{A}_{j}^{t}) \;\lor\;
%    ((\now \neq T) \land (\now' = T) \land (v'=v))\\[\jot]
%%
%   L & \deq & \SF{(\now,v)}{\act{B}}
% \end{array}
% \]
 %
The proof in the appendix of Theorem~\ref{thm:open-NZ}, which
implies Theorem~\ref{thm:NZ}, generalizes this approach.

Theorem~\ref{thm:NZ} does not cover all situations of interest.  For
  \index{nonZenoness!proving}%%%
example, one can require of our timed queue that the first value appear
on the output line within $\epsilon$ seconds of when it is placed on
the input line.  This effectively places an upper bound on the sum of
the times needed for performing the \vbl{EnQ} and \vbl{DeQ} actions; it
cannot be expressed with $\delta$-timers on individual actions.  For
these general timing constraints, nonZenoness must be proved for the
individual specification.  The proof uses the method described above
for proving Theorem~\ref{thm:NZ}: we add to the timed program $\Pi^{t}$
a liveness property $L$ that is the conjunction of any fairness
properties we like, including fairness of the action that advances
\now, and prove that $\Pi^{t}\land L$ implies \NZ{\oo}\@.  NonZenoness
then follows from Propositions \ref{prop:fairness-is-machine-closed}
and \ref{prop:proving-machine-closure}.


There is another possible approach to proving nonZenoness.  One can
make granularity assumptions---lower bounds both on the amount by which
 \index{assumption!granularity}%%%
 \index{lower bound!on time advance}%%%
 \index{lower bound!on action duration}%%%
\now\ is incremented and on the minimum delay for each action.  Under
these assumptions, nonZenoness is equivalent to the absence of
deadlock, which can be proved by existing methods.  Granularity
  \index{deadlock freedom, and nonZenoness}
assumptions are probably adequate---after all, what harm can come from
pretending that nothing happens in less than $10^{-100}$
nanoseconds?  However, they can be unnatural and cumbersome.  For
example, distributed algorithms often assume that only message delays
are significant, so the time required for local actions is ignored.
The specification of such an algorithm should place no lower bound on
the time required for a local action, but that would violate any
granularity assumptions.  We believe that any proof of deadlock freedom
based on granularity can be translated into a proof of nonZenoness
using the method outlined above.

So far, we have been discussing nonZenoness of the internal
specification, where both the timers and the system's internal
variables are visible.  Timers are defined by adding history-determined
variables, so existentially quantifying over them preserves nonZenoness
by Proposition~\ref{prop:exists-preserves-machine-closed}.  We expect
  \index{nonZenoness!and quantification}%%%
  \index{finite internal nondeterminism (fin)!and nonZenoness}%%%
most specifications to be fin~\cite[page~263]{abadi:existence}, so nonZenoness
will also be preserved by existentially quantifying over the system's
internal variables.  This is the case for the timed queue.

\subsection{An Example: Fischer's Protocol} \label{sec:fischer}


As another example of real-time closed systems, we treat a simplified
  \index{Fischer, mutual exclusion protocol}%%%
version of a real-time mutual exclusion protocol proposed by 
\iftoplas{\citeN{fischer:where} and described in~\cite[page~2]{lamport:fast}}%
  {Fischer~\cite{fischer:where},~\cite[page~2]{lamport:fast}}.  
The example was suggested by 
\iftoplas{\citeN{schneider:REX}}{Schneider~\cite{schneider:REX}}.  
The protocol consists of each process
   \index{Schneider, Fred B.}%%%
$i$ executing the following code, where angle brackets denote
instantaneous atomic actions:
 \[ \begin{tabular}{@{}rl@{}}
        $a$: & {\bf await} $\langle x = 0\rangle$; \\
        $b$: & $\langle x := i\rangle$;            \\
        $c$: & {\bf await} $\langle x = i\rangle$; \\
   \vbl{cs}: & critical section 
\end{tabular}
 \]
There is a maximum delay $\Delta_{b}$ between the execution of the test
in statement $a$ and the assignment in statement $b$, and a minimum
delay $\delta_{c}$ between the assignment in statement $b$ and the test
in statement $c$.  The problem is to prove that, with suitable
conditions on $\Delta_{b}$ and $\delta_{c}$, this protocol guarantees
mutual exclusion (at most one process can enter its critical section).

As written, Fischer's protocol permits only one process to enter its
critical section one time.  The protocol can be converted to an actual
mutual exclusion algorithm.  The correctness proof of the protocol is
easily extended to a proof of such an algorithm.

The TLA specification of the protocol is given in
Figure~\ref{fig:Fischers-protocol}.  The formula $\Pi_{F}$ describing
the untimed version is standard TLA\@.  We assume a finite set \rvbl{Proc} of
processes.  Variable $x$ represents the program variable $x$, and
variable \PC\ represents the control state.  The value of \PC\ will
be an array indexed by \rvbl{Proc}, where $\PC[i]$ equals one of the
strings \qvbl{a}, \qvbl{b}, \qvbl{c}, \qvbl{cs} when control in process
$i$ is at the corresponding statement.  The initial predicate
$\init_{F}$ asserts that $\PC[i]$ equals \qvbl{a} for each process $i$,
so the processes start with control at statement $a$.  No assumption
on the initial value of $x$ is needed to prove mutual exclusion.

\begin{figure}[t]
\begin{center}
\(
\begin{array}[t]{@{}l@{}}
\begin{array}[t]{@{}lcl@{}}
    \init_{F}  & \deq &   \forall\, i \in \rvbl{Proc} : 
                                \PC[i] = \qvbl{a} \vs{.7}\
\end{array}\\
%
\begin{array}[t]{@{}lcl@{}}
    \vbl{Go}(i, u, v) & \deq &  
           \begin{array}[t]{@{\land\s{.4}}l}
                   \PC[i] = u  \vs{.4} \\
                   \PC'[i] = v \vs{.4} \\
                   \forall\, j \in \rvbl{Proc}  : 
                         (j \neq i) \,\implies\, (\PC'[j] = \PC[j]) \vs{.7}
           \end{array}
\end{array}\\
\begin{array}[t]{@{}lcl@{}}
%
    \act{A}_{i} & \deq &  
          \vbl{Go}(i, \qvbl{a}, \qvbl{b}) \,\land\,(x = x' = 0) \vs{.7}\\
%
    \act{B}_{i} & \deq &  
          \vbl{Go}(i, \qvbl{b}, \qvbl{c}) \,\land\,(x' = i)      \vs{.7}\\
%
    \act{C}_{i} & \deq &  
           \vbl{Go}(i, \qvbl{c}, \qvbl{cs})\,\land\,(x = x' = i)  \vs{.7}\\
%
    \act{N}_{F} & \deq &  
       \exists\, i \in \rvbl{Proc} : 
             (\act{A}_{i} \,\lor\, \act{B}_{i} \,\lor\, \act{C}_{i}) \vs{.7}\\
%
    \Pi_{F} & \deq &  \init_{F}\,\land\,\Box[\act{N}_{F}]_{(x,\PC)} \vs{.7}\\
%
    \Pi_{F}^{t} & \deq &  
          \begin{array}[t]{@{\land\s{.4}}l}
               \Pi_{F}\,\land\,\RT{}_{(x,\PC)} \vs{.4}\\
               \forall\, i \in \rvbl{Proc} : 
                  \begin{array}[t]{@{\land\s{.4}}l}
                   \vbl{VTimer}(T_{b}[i],\, \act{B}_{i},\, 
                                 \Delta_{b},\, (x,\PC)) \vs{.4}\\
                           \vbl{MaxTime}(T_{b}[i]) \vs{.4}
                          \end{array} \\
               \forall\, i \in \rvbl{Proc} : 
                       \begin{array}[t]{@{\land\s{.4}}l}
                         \vbl{VTimer}(t_{c}[i],\,
                                     \vbl{Go}(i, \qvbl{c}, \qvbl{cs}),\, 
                                     \delta_c,\, (x,\PC)) \vs{.4}\\
                         \vbl{MinTime}(t_{c}[i],\, \act{C}_{i},\, 
                                         (x,\PC)) \vs{.7}
                        \end{array}
           \end{array}\\
%
\Phi_{F}^{t} & \deq &  \EE\, T_{b}, t_{c} :  \Pi_{F}^{t} 

\end{array}
\end{array}
\)
\end{center}
\vspace{-.5\baselineskip}
\caption{The TLA specification of Fischer's real-time mutual exclusion
         protocol.} 
\label{fig:Fischers-protocol}
\end{figure}

Next come the definitions of the three actions corresponding to program
statements $a$, $b$, and $c$.  They are defined using the formula
\vbl{Go}, where $\vbl{Go}(i,u,v)$ asserts that control in process $i$
changes from $u$ to $v$, while control remains unchanged in
the other processes.  Action $\act{A}_{i}$ represents the execution of
statement $a$ by process $i$; actions $\act{B}_{i}$ and $\act{C}_{i}$
have the analogous interpretation.  In this simple protocol, a process
stops when it gets to its critical section, so there are no other
actions.  The program's next-state action $\act{N}_{F}$ is the
disjunction of all these actions.  Formula $\Pi_{F}$ asserts that
all processes start at statement $a$, and every step consists of
executing the next statement of some process.

Action $\act{B}_{i}$ is enabled by the execution of action
$\act{A}_{i}$.  Therefore, the maximum delay of $\Delta_{b}$ between
the execution of statements $a$ and $b$ can be expressed by an
upper-bound constraint on a volatile $\Delta_{b}$-timer for action
$\act{B}_{i}$.  The variable $T_{b}$ is an array of such timers,
where $T_{b}[i]$ is the timer for  action $\act{B}_{i}$.

The constant $\delta_{c}$ is the minimum delay between when control
reaches statement $c$ and when that statement is executed.  Therefore,
we need an array $t_{c}$ of lower-bound timers for the actions
$\act{C}_{i}$.  The delay is measured from the time control reaches
statement $c$, so we want $t_{c}[i]$ to be a $\delta_{c}$-timer on an
action that becomes enabled when process $i$ reaches statement $c$ and
is not executed until $\act{C}_{i}$ is.  (Since we are placing only a
lower-bound timer on it, the action need not be a subaction of
$\Pi_{F}$.)  A suitable choice for this action is $\vbl{Go}(i,
\qvbl{c}, \qvbl{cs})$.

Adding these timers and timing constraints to the untimed formula
$\Pi_{F}$ yields formula $\Pi_{F}^{t}$ of
Figure~\ref{fig:Fischers-protocol}, the specification of the real-time
protocol with the timers visible.  The final specification,
$\Phi_{F}^{t}$, is obtained by quantifying over the timer variables
$T_{b}$ and $t_{c}$.  Since 
$\anact{B_{j}}{(x,\vbl{pc})}\land(\now'=\now)$ is a
subaction of $\Pi_{F}$ and $\anact{{}\vbl{Go}(i, \qvbl{c}, \qvbl{cs})}{(x,\vbl{pc})}$ is
disjoint from $\anact{B_{j}}{(x,\vbl{pc})}$, for all $i$ and $j$ in \rvbl{Proc},
Theorem~\ref{thm:NZ} implies that $\Pi_{F}^{t}$ is nonZeno if
$\Delta_{b}$ is positive.
Proposition~\ref{prop:exists-preserves-machine-closed} can then be
applied to prove that $\Phi_{F}^{t}$ is nonZeno.

Mutual exclusion asserts that two processes cannot be in their critical
sections at the same time.  It is expressed by the predicate
 \[
  \vbl{Mutex} \;\;\deq\;\;
   \forall\, i, j \in \rvbl{Proc} : (\PC[i]=\PC[j]=\qvbl{cs})\implies(i=j)
  \]
The property to be proved is
\begin{equation} \label{eq:Fischer-invariance}
 \vbl{Assump} \,\land\, \Phi_{F}^{t} \;\implies\; \Box\vbl{Mutex}
\end{equation}
where \vbl{Assump} expresses the assumptions about the constants
\rvbl{Proc}, $\Delta_{b}$, and $\delta_{c}$ needed for correctness.
Since the timer variables do not occur in \vbl{Mutex} or \vbl{Assump},
(\ref{eq:Fischer-invariance}) is equivalent to
 \[ \vbl{Assump} \,\land\, \Pi_{F}^{t} \;\implies\; \Box\vbl{Mutex}
 \]
The standard method for proving this kind of invariance property leads
to the invariant
 \[ \begin{array}[t]{@{}c@{\s{.4}}l@{}}
     \land & \now \in \Real \\[\jot]
     \land & \forall\, i \in \rvbl{Proc} : \\ 
       & \s{1} \begin{array}[t]{@{\land\s{.4}}l}
            T_{b}[i], t_{c}[i] \,\in\, \Real \cup \{\oo\} \vs{.5} \\
            \PC[i] \in \{\qvbl{a}, \qvbl{b}, \qvbl{c}, \qvbl{cs}\} \vs{.5} \\
            (\PC[i] = \qvbl{cs}) \;\implies\;
                    \begin{array}[t]{@{\land\s{.4}}l}
                          x=i \\
                          \forall\, j \in \rvbl{Proc} : \PC[j] \neq \qvbl{b}
                                \vs{.5} 
                     \end{array}\\
            (\PC[i] = \qvbl{c})  \;\implies\;
                    \begin{array}[t]{@{\land\s{.4}}l}
                          x\neq0 \\
                          \forall\, j \in \rvbl{Proc} : 
                                 (\PC[j] = \qvbl{b})\implies
                                        (t_{c}[i] > T_{b}[j]) \vs{.5} 
                     \end{array}\\
            (\PC[i] = \qvbl{b})  \;\implies\; (T_{b}[i] < \now + \delta_{c})
                    \vs{.5} \\
            now \leq T_{b}[i]
        \end{array}
   \end{array}
 \]
and the assumption
 \[   \vbl{Assump} \;\;\deq\;\;
     (0 \notin \rvbl{Proc})           \,\land\,
     (\Delta_{b}, \delta_c \in \Real) \,\land\,
     (\Delta_{b} < \delta_c)
 \]


\section{Open Systems} \label{sec:open}

A closed system is solipsistic.  An open system interacts with an
  \index{open system}%%%
environment, where system steps are distinguished from environment
steps.  Sections \ref{sec:realizability} and \ref{sec:whileop}
reformulate a number of concepts introduced in \cite{abadi:composing}
that are needed for treating open systems in TLA\@.  Some new results
appear in Section~\ref{sec:proving-machine}.  The following two
sections explain how reasoning about open systems is reduced to
reasoning about closed systems, and how open systems are composed.

\subsection{Receptiveness and Realizability} \label{sec:realizability}

To describe an open system in TLA, one defines an action $\mu$ such
that $\mu$ steps are attributed to the system and $\lnot\mu$ steps are
attributed to the environment.  A specification should constrain only
system steps, not environment steps.

For safety properties, the concept of constraining is formalized as
follows: if $\mu$ is an action and $\Pi$ a safety property, then $\Pi$
  \index{constrains at most}%%%
{\em constrains at most\/} $\mu$ iff, for any finite behavior
$s_{1},\ldots,s_{n}$ and state $s_{n+1}$, if $s_{1},\ldots,s_{n}$
satisfies $\Pi$ and $(s_{n},s_{n+1})$ is a $\lnot\mu$ step, then
$s_{1},\ldots,s_{n+1}$ satisfies $\Pi$.  The generalization to
arbitrary properties of constraining at most $\mu$ is {\em
$\mu$-receptiveness}.  Intuitively, $\Pi$ is $\mu$-receptive iff every
  \index{receptiveness}%%%
behavior in $\Pi$ can be achieved by an implementation that performs
only $\mu$ steps---the environment being able to perform any $\lnot\mu$
step.  The concept of receptiveness is due to 
\iftoplas{\citeN{dill:thesis}}{Dill~\cite{dill:thesis}}.
  \index{Dill, David L.}%%%
The generalization to $\mu$-receptiveness is developed in
\cite{abadi:composing}.\footnote{To translate from the semantic model
of \cite{abadi:composing} into that of TLA, we let agents be pairs of
 \index{agent}%%%
states and identify an action $\mu$ with the set of all agents that are
$\mu$ steps.  A TLA behavior $s_{1}, s_{2},\ldots$ corresponds to the
sequence \mbox{\(s_{1} \agent{\alpha_{2}} s_{2} \agent{\alpha_{3}}
s_{3} \agent{\alpha_{4}} \ldots\, \)}, where $\alpha_{i}$ equals
$(s_{i-1},s_{i})$.  With this translation, the definitions in
\cite{abadi:composing} differ from the ones given here and in the
appendix mainly by attributing the choice of initial state to the
  \index{initial state!in open systems}%%%
environment rather than to the system, requiring initial conditions to
be assumptions about the environment rather than guarantees by the
system.}
A safety property is $\mu$-receptive iff it constrains at most
  \index{constrains at most!and receptiveness}
$\mu$.

The generalization of machine closure to open systems is {\em machine
realizability}.  Intuitively, $(\Pi,L)$ is $\mu$-machine realizable iff
  \index{machine realizability}%%%
an implementation that performs only $\mu$ steps can ensure that any
finite behavior satisfying $\Pi$ is completed to an infinite behavior
satisfying $\Pi\land L$.  Formally, $(\Pi,L)$ is defined to be
$\mu$-machine realizable iff $(\Pi,L)$ is machine closed
  \index{machine realizability!and machine closure}%%%
  \index{machine realizability!and receptiveness}%%%
and $\Pi\land L$ is $\mu$-receptive.  For $\mu$ equal to \true, machine 
realizability
reduces to machine closure.


\subsection{The \whileop\ Operator} \label{sec:whileop}

A common way of specifying an open system is in terms of assumptions
and guarantees~\cite{jones:specification}, 
 \index{assumption!environment}%%%
 \index{assumption/guarantee specification}%%%
requiring the system to guarantee a
 \index{guarantee, system}%%%
property $M$ if its environment satisfies an assumption $E$.  An
obvious formalization of such a specification is the property
$E\implies M$.  However, this property contains behaviors in which the
system violates $M$ and then the environment later violates $E$.
Because the system cannot predict what the environment will do, such
behaviors cannot occur in any actual implementation.  A behavior
$\sigma$ generated by any implementation satisfies the additional
property that if any finite prefix of $\sigma$ satisfies $E$, then it
satisfies $M$.  We can therefore formalize the assumption/guarantee
  \index{#7whileop@$\whileop$}%%%
specification by the property \while{E}{M}, defined by:
$\sigma\in\while{E}{M}$ iff $\sigma\in(E\implies M)$ and, for every
finite prefix $\rho$ of $\sigma$, if $\rho$ satisfies $E$ then $\rho$
satisfies $M$.  If $E$ and $M$ are safety properties, then \while{E}{M}
is as well.  

For safety properties, the operator \whileop\ is the implication
  \index{implication, intuitionistic}%%%
operator of an intuitionistic logic~\cite{abadi:src86}.  Most valid
propositional formulas without negation remain valid when $\implies$ is
replaced by \whileop, if all the formulas that appear on the left of a
\whileop\ are safety properties.  For example, the following formulas
are valid if $\Phi$ and $\Pi$ are safety properties.
\begin{equation} \label{eq:while-properties}
 \begin{array}[t]{@{}l@{}}
   \while{\Phi}{(\while{\Pi}{\Psi})} \;\equiv\;
   \while{(\Phi\land\Pi)}{\Psi} \\[\jot]
   (\while{\Phi}{\Psi}) \,\land\, (\while{\Pi}{\Psi})
      \;\equiv\;  
   \while{(\Phi\lor\Pi)}{\Psi} 
 \end{array}
\end{equation}
For any TLA formulas $\Phi$ and $\Pi$, the property \while{\Phi}{\Pi}
is expressible as a TLA formula.

\subsection{Proving Machine Realizability} \label{sec:proving-machine}

Propositions~\ref{prop:fairness-is-machine-closed}%
 --\ref{prop:proving-machine-closure}, which concern machine closure,
have generalizations for machine realizability.
  \index{machine realizability!and fairness}%%%
Proposition~\ref{prop:fairness-is-machine-closed} is the special case
of Proposition~\ref{prop:fairness-is-machine-realizable} in which
$\Phi$ and $\mu$ are identically true.
Proposition~\ref{prop:proving-machine-closure} is similarly a special
case of Proposition~\ref{prop:proving-while-machine-realizability} if
  \index{machine realizability!and implication}%%%
$(\true, L_{2})$ is machine closed---that is, if $L_{2}$ is a
liveness property. This is sufficient for our
purposes, since \NZ{\infty} is a liveness property.  The generalization
of Proposition~\ref{prop:exists-preserves-machine-closed} is omitted;
  \index{machine realizability!and quantification}%%%
it would be analogous to Proposition~10 of \cite{abadi:composing}.

Proposition~\ref{prop:fairness-is-machine-realizable} is stated in
terms of $\mu$-invariance, which generalizes the ordinary concept of
  \index{invariance}%%%
invariance.  A predicate $P$ is a $\mu$-invariant of a formula $\Pi$
iff, in any behavior satisfying $\Pi$, no $\mu$-step makes $P$ false.
This condition is expressed by the TLA formula
$\Pi\implies\Box[(\mu\land P)\implies P']_{P}$.

\begin{proposition} \label{prop:fairness-is-machine-realizable}
If\/ $\Pi$ and $\Phi$ are safety properties, 
$\Pi$ constrains at most
$\mu$,
and $L$ is
the conjunction of a finite or countably infinite number of formulas\/
of the form \WF{w}{\act{A}} and/or\/ \SF{w}{\act{A}}, where,
for each such formula,
\begin{enumerate}
\item \anact{A}{w} is a subaction of\/ $\Pi\land\Phi$,
\item $\Pi\land\Phi\implies \Box[\anact{A}{w}\implies\mu]_{w}$,
\item if\/ \act{A} appears in a formula\/ \SF{w}{\act{A}}, then
  \enabled{\anact{A}{w}} is a\/ $\lnot\mu$-invariant of\/
   $\Pi\land\Phi$,
\end{enumerate}
then\/ $(\while{\Phi}{\Pi},\, \Phi\implies L)$ is\/ $\mu$-machine realizable.
\end{proposition}

\begin{proposition} \label{prop:proving-while-machine-realizability}
If\/ $\Phi$ and\/ $\Pi$ are safety properties,
$(\while{\Phi}{\Pi},L_{1})$ and\/ $(\true,L_{2})$
  \iftoplas{}{\hspace*{-3.51pt}\linebreak}%
are $\mu$-machine
realizable, and $\Phi\land\Pi\land L_{1}$ implies $L_{2}$, then\/
$(\while{\Phi}{\Pi},L_{2})$ is $\mu$-machine realizable.
\end{proposition}

%try
\subsection{Reduction to Closed Systems} \label{sec:more-stuff}

Consider a specification \while{E}{M}, where $E$ and $M$ are safety
properties.  We expect the system's requirement to restrict only system
steps, meaning that $M$ constrains at most $\mu$.  This implies that
\while{E}{M} also constrains at most $\mu$.  We also expect the
environment assumption $E$ not to constrain system steps; formally, $E$
{\em does not constrain $\mu$\/} iff it constrains at most $\lnot\mu$
  \index{constrains at most!and does not constrain}%%%
and it is satisfied by every (finite behavior consisting only of an)
initial state.\footnote{The asymmetry between {\em constrains at
  \index{initial state!and constrains at most}%%%
most\/} and {\em does not constrain\/} arises because we assign the
system responsibility for the initial state.}  

Suppose $E$ and $M$ have the following form:
 \[ 
 \begin{array}[t]{@{}lcl}
   E & \deq & 
             \Box[\mu\,\lor\,\act{N}_{E}]_{v}
             \\[\jot]
   M & \deq & \init \;\land\; 
                 \Box[\lnot\mu\,\lor\,\act{N}_{M}]_{v} 
 \end{array}
 \]
Then $E$ does not constrain $\mu$ and $M$ constrains at most $\mu$.
If the system's next-state
  \index{next-state relation!calculation}%%%
action $\act{N}_{M}$ implies $\mu$, and the environment's next-state
action $\act{N}_{E}$ implies $\lnot\mu$, then a simple
calculation shows that
 \begin{equation} \label{eq:EandM}
  E\land M \;\;\equiv\;\; \init\,\land\,
        \Box[\act{N}_{E}\lor\act{N}_{M}]_{v}
\end{equation} 
Conjunction represents parallel composition, so $E\land M$ is the
  \index{composition!and conjunction}%%%
formula describing the closed system consisting of the open system
together with its environment.  Observe that $E\land M$ has precisely
the form we expect for a closed system comprising two components with
next-state actions $\act{N}_{E}$ and $\act{N}_{M}$.

We can make the inverse transformation from a closed system
specification $\Pi$ to the corresponding assumption/guarantee
specification \while{E}{M} such that $\Pi$ equals $E\land M$, where $E$
does not constrain $\mu$ and $M$ constrains at most $\mu$.  This is
possible because any safety property $\Pi$ can be written as such a
conjunction.

Implementation means implication.  A system with guarantee $M$
implements a system with guarantee $\widehat{M}$, under environment
  \index{implementation relation!for open systems}%%%
assumption $E$, iff \while{E}{M} implies \while{E}{\widehat{M}}.  It
follows from the definition of \whileop\ that, when $E$ and $M$ are
safety properties, \while{E}{M} implies \while{E}{\widehat{M}} iff
$E\land M$ implies $E\land \widehat{M}$.  Thus, proving that one open
system implements another is equivalent to proving the implementation
relation for the corresponding closed systems.  Implementation for
open systems therefore reduces to implementation for closed systems.


\subsection{Composition} \label{sec:composition}

The distinguishing feature of open systems is that they can be
composed.  The proof that the composition of two specifications
implements a third specification is based on the following result,
which is a reformulation 
  \index{composition!principle}%%%
of Theorem~2
of~\cite{abadi:composing} for safety properties.
\begin{theorem} \label{thm:composing}
If $E$, $E_{1}$, $E_{2}$,, $M_{1}$, and $M_{2}$ are safety properties
and $\mu_{1}$ and $\mu_{2}$ are actions such that
\begin{enumerate}
\item $E_{1}$ does not constrain $\mu_{1}$ and
$E_{2}$ does not constrain
$\mu_{2}$,

\item $M_{1}$ constrains at most $\mu_{1}$ and
$M_{2}$ constrains at most $\mu_{2}$,
\end{enumerate}
then the following proof rule is valid:
 \[ \frac{ E \land M_{1} \land M_{2}
           \;\implies\; E_{1} \land E_{2}  
          }%
         { (\while{E_{1}}{M_{1}}) \,\land\,
           (\while{E_{2}}{M_{2}})
            \;\;\implies\;\; 
           (\while{E}{M_{1}\land M_{2}})
         }
 \]
\end{theorem} 
This theorem is essentially the same as Theorem~1 of
\cite{abadi:src86}; the proof is omitted.



\section{Real-Time Open Systems} \label{sec:real-time-open}

In Section~\ref{sec:real-time-closed}, we saw how we can represent time
by the variable \now\ and introduce timing constraints with timers.  To
extend the method to open systems, we need only decide how to separate
timing properties into environment assumptions and system guarantees.
An examination of a paradoxical example in
Section~\ref{sec:pair-a-ducks} leads to the general form described in
Section~\ref{sec:timing-generals}, where the concept of nonZenoness is
generalized.

%try
\subsection{A Paradox} \label{sec:pair-a-ducks}%%
  \index{paradox!composition, example}%%%


Consider the two components $\sys_{1}$ and $\sys_{2}$ of
Figure~\ref{fig:paradox-figure}.  Let the specification of $\sys_{1}$ be
\while{P_{y}}{P_{x}}, which asserts that it writes a ``good'' sequence
of outputs on $x$ if its environment writes a good sequence of inputs
on $y$.  Let \while{P_{x}}{P_{y}} be the specification of $\sys_{2}$, so
$\sys_{2}$ writes a good sequence of outputs on $y$ if its environment
writes a good sequence of inputs on $x$.  If $P_{x}$ and $P_{y}$ are
safety properties, then it appears that we should be able to apply
Theorem~\ref{thm:composing}, our composition principle, to deduce that
the composite system $\sys_{12}$ satisfies $P_{x}\land P_{y}$,
producing good sequences of values on $x$ and $y$.  (We can define
$\mu_{1}$ and $\mu_{2}$ so that writing on $x$ is a $\mu_{1}$ action
and writing on $y$ is a $\mu_{2}$ action.)

Now, suppose $P_{x}$ and $P_{y}$ both assert that the value 0 is 
written
by noon.  These can be regarded as safety properties, since they assert
that an undesirable event never occurs---namely, noon passing without a
0 having been written.  Hence, the composition principle apparently
asserts that $\sys_{12}$ sends 0's along both $x$ and $y$ by noon.
However, the specifications of $\sys_{1}$ and $\sys_{2}$ are satisfied
by systems that wait for a 0 to be input, whereupon they immediately
output a 0.  The composition of those two systems does nothing.

This paradox depends on the ability of a system to respond
instantaneously to an input.  It is tempting to rule out such
systems---perhaps even to outlaw specifications like these.  We show
that this Draconian measure is unnecessary.  Indeed, if the
specification of $\sys_{2}$ is strengthened to assert that a 0 must
unconditionally be written on $y$ by noon, then there is no paradox, and
the composition does guarantee that a 0 is written on both $x$ and $y$
by noon.
All paradoxes disappear when one carefully examines how the
specifications must be written.

%%% The following Kludge could break easily--especially in LaTeX 2e
\makeatletter\let\realnormalsize\@normalsize\makeatother
\begin{figure}
\begin{center}
\setlength{\unitlength}{.8pt}
\begin{picture}(0,130)
%\makegrid(-200,0)(400,150)
\put(-190,0){%
 \begin{picture}(0,0)
 \put(20,100){\makebox(0,0)[b]{\realnormalsize$\sys_{1}$}}
 \put(0,0){\framebox(40,90){}}
 \put(55,70){\makebox(0,0)[b]{\relax$x$}}
 \put(40,65){\vector(1,0){30}}
 \put(55,33){\makebox(0,0)[b]{\relax$y$}}
 \put(70,25){\vector(-1,0){30}}
 \end{picture}}
%
%\put(-95,45){\makebox(0,0){\red\large$\land$}}
%
\put(-70,0){%
 \begin{picture}(0,0)
 \put(50,100){\makebox(0,0)[b]{\realnormalsize$\sys_{2}$}}
 \put(30,0){\framebox(40,90){}}
 \put(15,70){\makebox(0,0)[b]{\relax$x$}}
 \put(0,65){\vector(1,0){30}}
 \put(15,33){\makebox(0,0)[b]{\relax$y$}}
 \put(30,25){\vector(-1,0){30}}
 \end{picture}}
%
%\put(40,60){\makebox(0,0)[b]{\red\large ?}}
%\put(40,45){\makebox(0,0){\red\large$\not\implies$}}
%
\put(80,0){%
 \begin{picture}(0,0)
% \put(20,100){\makebox(0,0)[b]{$\sys_{1}$}}
 \put(0,0){\framebox(40,90){}}
 \put(55,70){\makebox(0,0)[b]{\relax$x$}}
 \put(40,65){\vector(1,0){30}}
 \put(55,33){\makebox(0,0)[b]{\relax$y$}}
 \put(70,25){\vector(-1,0){30}}
 \end{picture}}
\put(135,100){\makebox(0,0)[b]{\realnormalsize$\sys_{12}$}}
\put(110,0){%
 \begin{picture}(0,0)
% \put(20,100){\makebox(0,0)[b]{$\sys_{2}$}}
 \put(40,0){\framebox(40,90){}}
% \put(15,70){\makebox(0,0)[b]{\relax$x$}}
% \put(0,65){\vector(1,0){30}}
% \put(15,33){\makebox(0,0)[b]{\relax$y$}}
% \put(30,25){\vector(-1,0){30}}
 \end{picture}}
\end{picture}
\end{center}
\caption{The composition of two systems.%%%%%%
\protect\rule[-.75\baselineskip]{0pt}{1pt}}   %%%% \pagebreak - like hack
\label{fig:paradox-figure}
\end{figure}

To resolve the paradox, we examine more closely the specifications
$S_{1}$ and $S_{2}$ of $\sys_{1}$ and $\sys_{2}$.  For simplicity, let
the only possible output actions be the setting of $x$ and $y$ to 0.
The untimed version of $S_{1}$ then asserts that, if the environment
does nothing but set $y$ to 0, then the system does nothing but set $x$
to 0.  This is expressed in TLA by letting
 \[ \begin{array}[t]{@{}lcl@{\s{4}}lcl@{}}
      \act{M}_{x} & \deq & (x'=0) \,\land\,(y'=y) & 
       \nu_{1}    & \deq & x'\neq x\\
      \act{M}_{y} & \deq & (y'=0) \,\land\,(x'=x)\\
   \end{array}
 \]
and defining the untimed version of specification $S_{1}$ to be
\begin{equation} \label{eq:untimed-S1}
 \while{\Box[\nu_{1}\lor\act{M}_{y}]_{(x,y)}}%
    {\Box[\lnot\nu_{1}\lor\act{M}_{x}]_{(x,y)}}
\end{equation}

To add timing constraints, we must first decide whether the system or
the environment should change \now.  Since the advancing of \now\ is a
mythical action that does not have to be performed by any device,
either decision is possible.  Somewhat surprisingly, it turns out to be
more convenient to let the system advance time.  With the convention
that initial conditions appear in the system guarantee, we define:
 \[ \begin{array}{@{}c@{}}
     \begin{array}[t]{@{}lcl@{\s{3}}lcl@{}}
      \act{N}_{x} & \deq & \act{M}_{x} \,\land\, (\now'=\now) 
  &
      \vbl{MT}_{x} & \deq &\vbl{MaxTime}(T_{x}) 
  \\[.5\jot]
      \act{N}_{y} & \deq & \act{M}_{y}\,\land\, (\now'=\now) 
   &
      \vbl{MT}_{y} & \deq & \vbl{MaxTime}(T_{y})
   \\[.5\jot]
      T_{x} & \deq & 
           \mbox{{\bf if} $x\neq0$ {\bf then} 12 {\bf else} \oo} 
   & 
     \mu_{1} & \deq & \nu_{1} \,\lor\, (\now'\neq\now) 
  \\[.5\jot]
      T_{y} & \deq & 
           \mbox{{\bf if} $y\neq0$ {\bf then} 12 {\bf else} \oo}\vs{.6}
   \end{array}\\
%
   \begin{array}[b]{@{}lcl@{}}
     E_{1} & \deq & 
     \Box[\mu_{1}\lor\act{N}_{y}]_{(x,y,\now)}
     \\[.5\jot]
     M_{1} & \deq & (\now = 0) \,\land\, 
      \Box[\lnot\mu_{1}\lor\act{N}_{x}]_{(x,y,\now)}
           \,\land\,\RT{}_{(x,y)}
           \,\land\, \vbl{MT}_{x}
   \end{array}
   \end{array}
 \]
Adding timing constraints to (\ref{eq:untimed-S1}) the same way we did
for closed systems then leads to the following timed version of
specification $S_{1}$.
\begin{equation} \label{eq:S1-first-try}
  \while{(E_{1} \land \vbl{MT}_{y})}{M_{1}}
\end{equation}
However, this does not have the right form for an open system
  \index{constrains at most!and timing constraints}%%%
specification because $\vbl{MT}_{y}$ constrains the advance of \now, so
the environment assumption constrains $\mu_{1}$.  The conjunct
$\vbl{MT}_{y}$ must be moved from the environment assumption to the
system guarantee.  Using (\ref{eq:while-properties}), we rewrite
(\ref{eq:S1-first-try}) as:
  \[ S_{1} \;\;\deq\;\;
\while{E_{1}}{(\while{\vbl{MT}_{y}}{M_{1}})}
  \] 
This
has the expected form for an open system specification,
 \index{assumption/guarantee specification!and timing properties}%%%
with an environment assumption $E_{1}$ that 
does not constrain $\mu_{1}$ and 
a system guarantee 
 \while{\vbl{MT}_{y}}{M_{1}} that constrains at most $\mu_{1}$.


The specification $S_{2}$ of the second component in
Figure~\ref{fig:paradox-figure} is similar, where $\mu_{2}$, $E_{2}$,
$M_{2}$, and $S_{2}$ are obtained from $\mu_{1}$, $E_{1}$, $M_{1}$,
and $S_{1}$ by substituting $2$ for $1$, $x$ for $y$, and $y$ for $x$.

Both components $\Pi_{1}$ and $\Pi_{2}$ change \now.  This is not a
problem because the components do not really control time.  We have
merely written the specifications $S_{1}$ and $S_{2}$ as if \now\ were
an output variable of both $\Pi_{1}$ and $\Pi_{2}$.  Formulas $S_{1}$
and $S_{2}$ express real-time constraints by making assertions about
how \now\ changes.  There is no problem because these constraints do
not conflict.

We now compose specifications $S_{1}$ and $S_{2}$.
The definitions of $M_{1}$ and $M_{2}$ and
the observation that $\while{P}{Q}$ implies
$P\implies Q$ yield
\begin{equation} \label{eq:first-silly-step}
 (\vbl{MT}_{x} \lor \vbl{MT}_{y})
     \land 
    (\while{\vbl{MT}_{y}}{M_{1}}) \land 
     (\while{\vbl{MT}_{x}}{M_{2}})
    \;\implies\; M_{1}\land M_{2}
\end{equation}
The definitions of $M_{1}$ and $M_{2}$ and simple temporal
reasoning yield
\begin{equation} \label{eq:second-silly-step}
 E \land M_{1} \land M_{2} \;\implies\; E_{1}\land E_{2}
\end{equation} 
where 
 \[ E \;\;\deq\;\; 
           \Box[\mu_{1}\lor\mu_{2}]_{(x,y,\now)}
 \]
Combining (\ref{eq:first-silly-step}) and  (\ref{eq:second-silly-step}) 
proves
 \[ E \land (\vbl{MT}_{x} \lor \vbl{MT}_{y})
     \land 
    (\while{\vbl{MT}_{y}}{M_{1}}) \land 
     (\while{\vbl{MT}_{x}}{M_{2}})
    \;\implies\; E_{1}\land E_{2}
 \]
We can therefore apply 
Theorem~\ref{thm:composing},
substituting $E\land(\vbl{MT}_{x}\lor\vbl{MT}_{y})$ for $E$,
\while{\vbl{MT}_{y}}{M_{1}} for $M_{1}$, and
\while{\vbl{MT}_{x}}{M_{2}} for $M_{2}$, to deduce
 \[ 
S_{1} \land S_{2} \;\;\implies\;\;\\
   (\while{E \land (\vbl{MT}_{x}\lor\vbl{MT}_{y})}%
   {(\while{\vbl{MT}_{y}}{M_{1}})
      \;\land\;(\while{\vbl{MT}_{x}}{M_{2}})}\,)
 \]
Using the implication-like properties of \whileop, this simplifies to
 \begin{equation} \label{eq:S1-composed-with-S2}
   S_{1} \,\land\, S_{2}
    \;\;\implies\;\;
    (\while{E}{(\while{\vbl{MT_{y}}}{M_{1}})
       \,\land\,
     (\while{\vbl{MT_{x}}}{M_{2}})})
\end{equation}
All one can conclude about the composition from
(\ref{eq:S1-composed-with-S2}) is: either $x$ and $y$ are both 0 when
\now\ reaches 12, or neither of them is 0 when \now\ reaches 12.  There
is no paradox.

As another example, we replace $S_{2}$ by the specification
\while{E_{2}}{M_{2}}.  This specification, which we call $S_{3}$,
asserts that the system sets $y$ to 0 by noon, regardless of whether the
environment sets $x$ to 0.  The definitions imply
 \[  \vbl{MT}_{y}
     \land E \land 
    (\while{\vbl{MT}_{y}}{M_{1}}) \land 
     {M_{2}}
    \;\implies\; E_{1}\land E_{2}
  \]
and Theorem~\ref{thm:composing} yields
\[ S_{1} \,\land\, S_{3}
  \;\;\implies\;\;
  (\while{E}{(\while{\vbl{MT_{x}}}{M_{1}})\,\land\,M_{2}})
\]
Since $M_{2}$ implies $\vbl{MT}_{x}$, this
simplifies to
 \[ S_{1} \,\land\, S_{3}
  \;\;\implies\;\;
   (\while{E}{M_{1}\,\land\,M_{2}})
 \]
The composition of $S_{1}$ and $S_{3}$ does guarantee that both $x$ and
$y$ equal 0 by noon.

%try
\subsection{Timing Constraints in General} \label{sec:timing-generals}

Our no-longer-paradoxical example suggests that the form of a real-time
open system specification should be
\begin{equation}  \label{eq:real-time-open-spec}
  \while{E}{(\while{P}{M})}
\end{equation}
where $M$ describes the system's timing constraints and the advancing
of \now, and $P$ describes the upper-bound timing constraints for the
environment.  Since the environment's lower-bound timing constraints do
  \index{timing constraints!in open systems}%%%
not constrain the advance of \now, they can remain in $E$\@.  As we
observed in Section~\ref{sec:more-stuff}, proving that one open
specification implements another reduces to the proof for the
corresponding closed systems.  Since \while{E}{(\while{P}{M})} is
equivalent to \while{(E\land P)}{M}, the closed system corresponding to
(\ref{eq:real-time-open-spec}) is the expected one, $E\land P\land M$.

For the specification (\ref{eq:real-time-open-spec}) to be reasonable,
its closed system version, $E\land P\land M$, should be nonZeno.
However, this is not sufficient.  Consider a specification guaranteeing
that the system produces a sequence of outputs until the environment
sends a {\em stop\/} message, where the $n^{\rm th}$ output must occur
by time $(n-1)/n$.  There is no timing assumption on the environment;
it need never send a {\em stop\/} message.  This is an unreasonable
specification because \now\ cannot reach 1 until the environment sends
its {\em stop\/} message, so the advance of time is contingent on an
optional action of the environment.  However, the corresponding closed
system specification is nonZeno, since time can always be made to
advance without bound by having the environment send a {\em stop\/}
message.

If advancing \now\ is a $\mu$ action, then a system that controls $\mu$
actions can guarantee time to be unbounded while satisfying a safety
specification $S$ iff the pair $(S,\NZ{\oo})$ is $\mu$-machine
  \index{nonZenoness}%%%
  \index{machine realizability!and nonZenoness}%%%
realizable.  We therefore take this condition to be the
definition of nonZenoness for an open system specification $S$.

%try
For specifications in terms of $\delta$-timers, nonZenoness can be
proved with generalizations to open systems of the theorems in
Section~\ref{sec:The-nonZeno-Condition}.  The following is the
generalization of the strongest of them, Theorem~\ref{thm:NZ}.  It
  \index{nonZenoness!and $\delta$-timers}%%%
  \index{nonZenoness!proving nonZenoness}%%%
is applied to a specification of the form
(\ref{eq:real-time-open-spec}) by substituting $E\land P$ for $E$.
\begin{theorem} \label{thm:open-NZ}
With the notation and hypotheses of Theorem~\ref{thm:NZ}, if
$E$ and $M$ are safety properties such that\/ $\Pi=E\land M$,
and 
\begin{enumerate}
 \item[4.] $M$ constrains at most $\mu$,
 \item[5.] \begin{enumerate}
\item $\anact{A_{k}}{v}\implies\mu$, for all $k\in I\cup J$,
\item $(\now'\neq\now)\implies\mu$
\end{enumerate}
\end{enumerate}
then\/ $(\while{E}{M^{t}},\,\NZ{\oo})$ is $\mu$-machine realizable,
where
 \[ \begin{array}[t]{@{}lcl@{}}
         M^{t} & \deq & 
            M
           \;\land\;
            \vbl{RT}_{v} \;\land\; 
          \ordinarily{\\[.5\jot] & &
           \s{1}}
            \forall\,i\in I : \vbl{MinTime}(t_{i}, \act{A}_{i},v)
            \;\land\;\forall\,j\in J : 
            \vbl{MaxTime}(T_{j})
         \end{array} 
\]
\end{theorem}
Hypothesis 4 says that $\mu$ steps are attributed to the system
represented by $M$.  Part~(a) of Hypothesis 5 says that the other 
hypotheses restrict
the timing constraints on system actions \anact{A_{k}}{v} only;
environment actions may have any timing constraints.
Part~(b) says that advancing \now\ is a system action.
%try

The proof of Theorem~\ref{thm:open-NZ}, which appears in the appendix,
is similar to the proof of Theorem~\ref{thm:NZ} sketched in
Section~\ref{sec:The-nonZeno-Condition}.  It uses Propositions
\ref{prop:fairness-is-machine-realizable} and
\ref{prop:proving-while-machine-realizability} instead of Propositions
\ref{prop:fairness-is-machine-closed} and
\ref{prop:proving-machine-closure}.  Since machine realizability
implies machine closure, Theorem~\ref{thm:NZ} follows from
Theorem~\ref{thm:open-NZ} by letting $E$ and $\mu$ equal \true\ and $M$
equal $\Pi$.

Theorem~\ref{thm:open-NZ} applies to the internal specifications, where
all variables are visible.  For closed systems, existential
  \index{nonZenoness!and quantification}%%%
quantification is handled with
Proposition~\ref{prop:exists-preserves-machine-closed}.  For open
systems, the generalization of this proposition---the analog of
Proposition~10 of \cite{abadi:composing}---is needed.



\section{Conclusion}

\subsection{What We Did} 

We started with a simple idea---specifying and reasoning about
real-time systems by representing time as an ordinary variable.  This
idea led to an exposition that most readers probably found quite
difficult.  What happened to the simplicity?

About half of the exposition is a review of concepts unrelated to real
time.  All the fundamental concepts described in Sections
\ref{sec:closed} and \ref{sec:open}, including machine closure, machine
realizability, and the $\whileop$ operator, have appeared
before~\cite{abadi:composing,abadi:existence}.  These concepts are
subtle, but they are important for understanding any concurrent system;
they were not invented for real-time systems.

We chose to formulate these concepts in TLA\@.  Like any language, TLA
seems complicated on first encounter.  We believe that a true measure
of simplicity of a formal language is the simplicity of its formal
description.  The complete syntax and formal semantics of TLA are
given in about one page in~\cite{lamport:newtla}.

We never claimed that specifying and reasoning about concurrent systems
is easy.  Verifying concurrent systems is difficult and error prone.
Our assertions that one formula follows from another, made so casually
in the exposition, must be backed up by detailed calculations.  We have
omitted the proofs for our examples, which, done with the same detail
as the proofs in the appendix, occupy some twenty pages.

We did claim that existing methods for specifying and reasoning about
concurrent systems could be applied to real-time systems.  Now, we can
examine how hard they were to apply.

We found few obstacles in the realm of closed systems.  The second
author has more than fifteen years of experience in the formal
verification of concurrent algorithms, and we knew that old-fashioned
methods could be applied to real-time systems.  However, TLA is
relatively new, and we were pleased by how well it worked.  The formal
specification of Fischer's protocol in
Figure~\ref{fig:Fischers-protocol}, obtained by conjoining timing
constraints to the untimed protocol, is as simple and direct as we
could have hoped for.  Moreover, the formal correctness proofs of this
protocol and of the queue example, using the method of reasoning
described in~\cite{lamport:newtla}, were straightforward.  Perhaps the
most profound discovery was the relation between nonZenoness and
machine closure.

Open systems made up for any lack of difficulty with closed systems.
State-based approaches to open systems were a fairly recent
development, and we had little experience with them.  Studying
real-time systems taught us a great deal, and led to a number of
changes from the approach in~\cite{abadi:composing}.  For example, we
now write specifications with \whileop\ instead of $\implies$, and we
put initial conditions in the system guarantee rather than in the
environment assumption.  Many alternative ways of writing real-time
specifications seemed plausible; choosing one that works was
surprisingly hard.  Even the simple idea of putting the environment's
timing assumptions to the left of a $\whileop$ in the system's
guarantee came only after numerous failed efforts.  Although the basic
ideas we need to handle real-time open systems seem to be in place, we
still have much to learn before reasoning about open systems becomes
routine.


\subsection{Beyond Real Time}

Real-time systems introduce a fundamentally new problem: adding
physical continuity to discrete systems.  Our solution is based on the
observation that, when reasoning about a discrete system, we can
represent continuous processes by discrete actions.  If we can pretend
that the system progresses by discrete atomic actions, we can
pretend that those actions occur at a single instant of time, and that
the continuous change to time also occurs in discrete steps.  If there
is no system action between noon and $\sqrt{2}$ seconds past noon, we
can pretend that time advances by those $\sqrt{2}$ seconds in a single
action.  

Physical continuity arises not just in real-time systems, but in
``real-pressure'' and ``real-temperature'' process-control systems.
Such systems can be described in the same way as real-time systems:
pressure and temperature as well as time are represented by ordinary
variables.  The continuous changes to pressure and temperature that
occur between system actions are represented by discrete changes to the
variables.  The fundamental assumption is that the real, physical
system is accurately represented by a model in which the system
makes discrete, instantaneous changes to the physical parameters
it affects.

The observation that continuous parameters other than time can be
modeled by program variables has probably been known for years.
However, the first published work we know of that uses this idea, by
\iftoplas{\citeN{marzullo:derivation}}%
  {Marzullo, Schneider, and Budhiraja~\cite{marzullo:derivation}},
   \index{Marzullo, Keith}%%%
   \index{Schneider, Fred B.}%%%
   \index{Budhiraja, Navin}%%%
appeared only recently.

\ifseparateappendix{\begin{thebibliography}{}

\bibitem[\protect\citeauthoryear{Abadi and Lamport}{Abadi and
  Lamport}{1991}]{abadi:existence}
{\sc Abadi, M.} {\sc and} {\sc Lamport, L.} 1991.
\newblock The existence of refinement mappings.
\newblock {\em Theoretical Computer Science\/}~{\em 82,\/}~2 (May), 253--284.

\bibitem[\protect\citeauthoryear{Abadi and Lamport}{Abadi and
  Lamport}{1993}]{abadi:composing}
{\sc Abadi, M.} {\sc and} {\sc Lamport, L.} 1993.
\newblock Composing specifications.
\newblock {\em ACM Transactions on Programming Languages and Systems\/}~{\em
  15,\/}~1 (Jan.), 73--132.

\bibitem[\protect\citeauthoryear{Abadi and Plotkin}{Abadi and
  Plotkin}{1992}]{abadi:src86}
{\sc Abadi, M.} {\sc and} {\sc Plotkin, G.} 1992.
\newblock A logical view of composition.
\newblock Research Report~86 (May), Digital Equipment Corporation, Systems
  Research Center.

\bibitem[\protect\citeauthoryear{Alpern and Schneider}{Alpern and
  Schneider}{1985}]{alpern:defining}
{\sc Alpern, B.} {\sc and} {\sc Schneider, F.~B.} 1985.
\newblock Defining liveness.
\newblock {\em Information Processing Letters\/}~{\em 21,\/}~4 (Oct.),
  181--185.

\bibitem[\protect\citeauthoryear{Apt, Francez, and Katz}{Apt
  et~al.}{1988}]{apt:appraising}
{\sc Apt, K.~R.}, {\sc Francez, N.}, {\sc and} {\sc Katz, S.} 1988.
\newblock Appraising fairness in languages for distributed programming.
\newblock {\em Distributed Computing\/}~{\em 2}, 226--241.

\bibitem[\protect\citeauthoryear{Bernstein and Harter}{Bernstein and
  Harter}{1981}]{bernstein:proving}
{\sc Bernstein, A.} {\sc and} {\sc Harter, Jr., P.~K.} 1981.
\newblock Proving real time properties of programs with temporal logic.
\newblock In {\em Proceedings of the Eighth Symposium on Operating Systems
  Principles}, New York, pp.\  1--11. ACM.
\newblock {\em Operating Systems Review 15}, 5.

\bibitem[\protect\citeauthoryear{Chandy and Misra}{Chandy and
  Misra}{1988}]{chandy:parallel}
{\sc Chandy, K.~M.} {\sc and} {\sc Misra, J.} 1988.
\newblock {\em Parallel Program Design}.
\newblock Reading, Massachusetts: Addison-Wesley.

\bibitem[\protect\citeauthoryear{de~Bakker, Huizing, de~Roever, and
  Rozenberg}{de~Bakker et~al.}{1992}]{debakker:real-time}
{\sc de~Bakker, J.~W.}, {\sc Huizing, C.}, {\sc de~Roever, W.~P.}, {\sc and}
  {\sc Rozenberg, G.} (Eds.) 1992.
\newblock {\em Real-Time: Theory in Practice}, Volume 600 of {\em Lecture Notes
  in Computer Science}.
\newblock Berlin: Springer-Verlag.
\newblock Proceedings of a REX Real-Time Workshop, held in The Netherlands in
  June, 1991.

\bibitem[\protect\citeauthoryear{Dill}{Dill}{1988}]{dill:thesis}
{\sc Dill, D.~L.} 1988.
\newblock {\em Trace Theory for Automatic Hierarchical Verification of
  Speed-Independent Circuits}.
\newblock Ph.\ D. thesis, Carnegie Mellon University.

\bibitem[\protect\citeauthoryear{Fischer}{Fischer}{1985}]{fischer:where}
{\sc Fischer, M.} 1985.
\newblock Re: Where are you?
\newblock E-mail message to Leslie Lamport. Arpanet message sent on June 25,
  1985 18:56:29 EDT, number 8506252257.AA07636@YALE-BULLDOG.YALE.ARPA (47
  lines).

\bibitem[\protect\citeauthoryear{Jones}{Jones}{1983}]{jones:specification}
{\sc Jones, C.~B.} 1983.
\newblock Specification and design of (parallel) programs.
\newblock In {\sc R.~E.~A. Mason} (Ed.), {\em Information Processing 83:
  Proceedings of the IFIP 9th World Congress}, pp.\  321--332. IFIP:
  North-Holland.

\bibitem[\protect\citeauthoryear{Lamport}{Lamport}{1982}]{lamport:assertional}
{\sc Lamport, L.} 1982.
\newblock An assertional correctness proof of a distributed algorithm.
\newblock {\em Science of Computer Programming\/}~{\em 2,\/}~3 (Dec.),
  175--206.

\bibitem[\protect\citeauthoryear{Lamport}{Lamport}{1987}]{lamport:fast}
{\sc Lamport, L.} 1987.
\newblock A fast mutual exclusion algorithm.
\newblock {\em ACM Transactions on Computer Systems\/}~{\em 5,\/}~1 (Feb.),
  1--11.

\bibitem[\protect\citeauthoryear{Lamport}{Lamport}{1991}]{lamport:newtla}
{\sc Lamport, L.} 1991.
\newblock The temporal logic of actions.
\newblock Research Report~79 (Dec.), Digital Equipment Corporation, Systems
  Research Center.
\newblock To appear in {\em Transactions on Programming Languages and Systems}.

\bibitem[\protect\citeauthoryear{Marzullo, Schneider, and Budhiraja}{Marzullo
  et~al.}{1991}]{marzullo:derivation}
{\sc Marzullo, K.}, {\sc Schneider, F.~B.}, {\sc and} {\sc Budhiraja, N.} 1991.
\newblock Derivation of sequential, real-time process-control programs.
\newblock In {\sc A.~M. van Tilborg} {\sc and} {\sc G.~M. Koob} (Eds.), {\em
  Foundations of Real-Time Computing: Formal Specifications and Methods},
  Chapter~2, pp.\  39--54. Boston, Dordrecht, and London: Kluwer Academic
  Publishers.

\bibitem[\protect\citeauthoryear{Misra and Chandy}{Misra and
  Chandy}{1981}]{misra:proofs}
{\sc Misra, J.} {\sc and} {\sc Chandy, K.~M.} 1981.
\newblock Proofs of networks of processes.
\newblock {\em IEEE Transactions on Software Engineering\/}~{\em SE-7,\/}~4
  (July), 417--426.

\bibitem[\protect\citeauthoryear{Neumann and Lamport}{Neumann and
  Lamport}{1983}]{neumann:highly-dependable}
{\sc Neumann, P.~G.} {\sc and} {\sc Lamport, L.} 1983.
\newblock Highly dependable distributed systems.
\newblock Technical report (June), SRI International.
\newblock Contract Number DAEA18-81-G-0062, SRI Project 4180.

\bibitem[\protect\citeauthoryear{Pnueli}{Pnueli}{1984}]{pnueli:transition}
{\sc Pnueli, A.} 1984.
\newblock In transition from global to modular temporal reasoning about
  programs.
\newblock In {\sc K.~R. Apt} (Ed.), {\em Logics and Models of Concurrent
  Systems}, NATO ASI Series, pp.\  123--144. Springer-Verlag.

\bibitem[\protect\citeauthoryear{Schneider, Bloom, and Marzullo}{Schneider
  et~al.}{1992}]{schneider:REX}
{\sc Schneider, F.~B.}, {\sc Bloom, B.}, {\sc and} {\sc Marzullo, K.} 1992.
\newblock Putting time into proof outlines.
\newblock In {\sc J.~W. de~Bakker}, {\sc C.~Huizing}, {\sc W.-P. de~Roever},
  {\sc and} {\sc G.~Rozenberg} (Eds.), {\em Real-Time: Theory in Practice},
  Volume 600 of {\em Lecture Notes in Computer Science}, Berlin, Heidelberg,
  New York, pp.\  618--639. Springer-Verlag.

\end{thebibliography}

\clearpage}{}
\iftoplas{\clearpage}{\ordinarily{\cleardoublepage}}



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                      APPENDIX                          %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%

\makeatletter
\renewcommand{\appendixhead}[4]{% 
%
\section*{Appendix}
%
An appendix to this paper is available in electronic form
(Postscript$^{\mbox{\tiny TM}}$).  At the moment, any of the following
methods may be used to obtain it; the inside back cover of a current
issue may contain more up-to-date instructions.  
\begin{itemize}
\item By anonymous ftp from {\apbf acm.org}, file 
{\apbf [pubs.journals.#1.append]p#2.ps}
\item Send electronic mail to {\apbf mailserve@acm.org} containing
the line\\ {\apbf send~[anonymous.pubs.journals.#1.append]p#2.ps}
\item By {\it Gopher} from {\apbf acm.org}
\item By anonymous ftp from {\apbf ftp.cs.princeton.edu},
file {\apbf pub/#1/append/p#2.ps}
\item Hardcopy from {\it Article Express}, for a fee: phone 800-238-3458, fax
201-216-8526, or write P.O.~Box~1801, Hoboken NJ 07030; and request
{\sc acm-#1-appendix-{\small #2}}.
\end{itemize}
The complete paper
can be obtained by anonymous ftp from {\apbf gatekeeper.dec.com}.
\clearpage
\makeatletter
\pagenumbering{withappendix}
\makeatother
\appendix
\par\noindent{\sc this document is the appendix to the following paper:}\hfill \vskip 1em
\vbox{\sf \parindent0pt\@title{}}\vskip .5em
\vbox{\sf \parindent0pt\@author{}}\vskip .5em\noindent
\vskip 10pt\noindent
#4
\vskip 10pt\noindent
\hrule
\par
\bottomstuff
Permission to copy without fee all or part of
this material is granted provided that the copies are not made or distributed
for direct commercial advantage, the ACM copyright notice and the title of
the publication and its date appear, and notice is given that copying is
by permission of the Association for Computing Machinery.
To copy otherwise, or to republish, requires a fee and/or specific permission.
\par
\copyright #3 ACM
\par
\endbottomstuff
}
\makeatother

\ifseparateappendix{\appendixhead{toplas}{1321}{1994}{}}{\appendix}
\part*{Appendix}
\pflongindent




%% Redefine list parameters in the appendix         
\renewcommand{\stepsep}{0pt plus \ifcase \pfLevelCount
                             4pt % level 0 (impossible)
                  \or        4pt % level 1
                  \or        3pt % level 2
                  \or        2pt % level 3
                  \or        1pt % level 4
                   \else 0pt\fi}
\makeatletter
\let\savelisti\@listi
\let\savelistii\@listii
\let\savelistiii\@listiii
\def\@listI{\leftmargin\leftmargini \parsep 0pt %4.5pt plus 2pt minus 1pt
 \topsep 0pt % 9pt plus 3pt minus 5pt%
 \itemsep 0pt % 4.5pt plus 2pt minus 1pt
 }

\let\@listi\@listI
\@listi

\def\@listii{\@listi\leftmargin\leftmarginii
   \labelwidth\leftmarginii\advance\labelwidth-\labelsep}
%   \topsep 4.5pt plus 2pt minus 1pt
%   \parsep 2pt plus 1pt minus 1pt
%   \itemsep \parsep}

\def\@listiii{\@listi\leftmargin\leftmarginiii
    \labelwidth\leftmarginiii\advance\labelwidth-\labelsep}
%    \topsep 2pt plus 1pt minus 1pt
%    \parsep \z@ \partopsep 1pt plus 0pt minus 1pt
%    \itemsep \topsep}
\makeatother

\section{Definitions} 
\subsection{States and Behaviors}
\begin{list}{}{\setlength{\labelwidth}{\leftmargin}
               \addtolength{\leftmargin}{\labelsep}
        \renewcommand{\makelabel}[1]{{\it\hspace{\labelsep}#1\/}:\hfill}}
\item[$\Sigma$] The set of all states (assignments of values to 
  \index{#1Sigma@$\Sigma$}%%%
  \index{state}%%%
   variables).

\item[$\Sigma^{*}$] The   \index{#1Sigmaast@$\Sigma^*$}%%%
set of finite behaviors (finite sequences of
states).%
\item [$\Sigma^{\oo}$] The   \index{#1Sigmainf@$\Sigma^{\oo}$}%%%
set of behaviors (infinite sequences of
states).%
\item[\emptyseq] The   \index{#2emptyseq@$\emptyseq$}%%%
empty sequence.%
\xitem{$|\sigma|$}{$\sigma\in\Sigma^{*}\cup\Sigma^{\oo}$}
  The length of $\sigma$.%
  \index{#2length@\length{\ldots}}%%%
\xitem{$\sigma_{n}$}{$\sigma\in\Sigma^{*}\cup\Sigma^{\oo}$ and 
      $0<n\leq|\sigma|$} The $n^{\rm th}$ state in the sequence $\sigma$.
\xitem{\prefix{\sigma}{n}}{$\sigma\in\Sigma^{*}\cup\Sigma^{\oo}$ and 
      $0\leq n\leq|\sigma|$}  The finite behavior
  \index{#2prefix@$\prefix{\ldots}{\ldots}$}%%%
           $\sigma_{1},\ldots,\sigma_{n}$; equal to \emptyseq\
         when $n=0$.
\xitem{$\sigma\circ s$}{$\sigma\in\Sigma^{*}$ and $s\in\Sigma$}
The   \index{#2o@$\o$}%%%
finite behavior $\sigma_{1}, \ldots, \sigma_{|\sigma|}, s$.
\xitem{$\sigma\seqv\tau$}{$\sigma,\tau\in\Sigma^{*}$
      or $\sigma,\tau\in\Sigma^{\oo}$}
      $\sigma$   \index{#2seqv@$\seqv$}%%%
and $\tau$ are equal
      except for stuttering steps (repetitions of identical states).
\xitem{$\sigma\vseqv{x}\tau$}{$x$ a tuple of variables and either
$\sigma,\tau\in\Sigma^{*}$
      or $\sigma,\tau\in\Sigma^{\oo}$} \mbox{}\\
  There exist behaviors $\widehat{\sigma}$ and $\widehat{\tau}$ such that
\begin{itemize}
   \item[$\land$] $\widehat{\sigma}\seqv\sigma$ and $\widehat{\tau}\seqv\tau$
   \item[$\land$] $|\widehat{\sigma}|=|\widehat{\tau}|$
   \item[$\land$] for every integer $n\leq|\widehat{\sigma}|$, the states
   $\widehat{\sigma}_{n}$ and $\widehat{\tau}_{n}$ are equal except for the values they
   assign to the variables of $x$.  
\end{itemize}
\end{list}

\subsection{Predicates and Actions}
\begin{list}{}{\setlength{\labelwidth}{\leftmargin}
               \addtolength{\leftmargin}{\labelsep}
        \renewcommand{\makelabel}[1]{{\it\hspace{\labelsep}#1\/}:\hfill}}
\item[predicate] A   \index{predicate}%%%
subset of $\Sigma$.
\item[state function] A   \index{state function}%%%
mapping from 
$\Sigma$ to the set of values.
\item[action] A  \index{action}%%%
subset of $\Sigma\times\Sigma$.
\item[transition function] A  \index{transition function}%%%
mapping from $\Sigma\times\Sigma$
  to the set of values.
\xitem{$P'$}{$P$ a predicate} The action $\{(s,t) : t\in P\}$.
\xitem{$f'$}{$f$ a state function} The   \index{#3prime@$\ldots'$}
transition function
such that $f'(s,t)=f(t)$.
\xitem{\enabled{\act{A}}}{\act{A} an action}
The   \index{enabled@{\it Enabled}}%%%
  \index{action!enabled}%%%
predicate $\{s \in \Sigma : (\exists t\in\sigma : (s,t)\in\act{A})\}$.

\xitem{\sqact{A}{f}}{\act{A} an action and $f$ a state function}
$\act{A}\lor(f'=f)$%
  \index{#4sqact@${[\act{\ldots}]}_{\ldots}$}%%%
\xitem{\anact{A}{f}}{\act{A} an action and $f$ a state function}
$\lnot\sqact{\relax\lnot\act{A}}{f}$
  \index{#4anact@$\anact{\ldots}{\ldots}$}%%%
(equals $\act{A}\land(f'\neq f)$).

\end{list}

\subsection{Properties}
\begin{list}{}{\setlength{\labelwidth}{\leftmargin}
               \addtolength{\leftmargin}{\labelsep}
        \renewcommand{\makelabel}[1]{{\it\hspace{\labelsep}#1\/}:\hfill}}

\item[property] A   \index{property}%%%
subset $\Pi$ of $\Sigma^{\oo}$ such
      that for any $\sigma$, $\tau$ in $\Sigma^{\oo}$, if
   $\sigma\seqv\tau$ then $\sigma\in \Pi$ iff $\tau\in \Pi$.
\xitem{$\Box \Pi$}{$\Pi$ a property} \mbox{}\\
The   \index{#5Box@$\Box$}%%
property $\{\sigma\in\sigma^{\oo} : (\forall n > 0 : 
\sigma_{n},\sigma_{n+1}, \ldots\,\in\Pi)\}$.

% such that $\sigma\in\Box\Pi$ iff 
% $\sigma_{n},\sigma_{n+1}, \ldots\,\in\Pi$,
% for all $n>0$.

\xitem{$\Box\sqact{A}{f}$}{\act{A} an action and $f$ a state function}
\mbox{}\\
The   \index{#5Boxsq@$\Box\sqact{\ldots}{\ldots}$}%%
property 
 $\{\sigma\in\Sigma^{\oo}: (\forall n > 0 : 
     (\sigma_{n},\sigma_{n+1})\in\sqact{A}{f})\}$.

\xitem{$\Diamond\Pi$}{$\Pi$ a property or
an   action of the form \anact{A}{f}} $\lnot\Box\lnot\Pi$%
\index{#5Diamond@$\Diamond$}%%

\xitem{$\Pi\leadsto\Phi$}{$\Pi$ and $\Phi$ properties}
$\Box(\Pi\implies\Diamond\Phi)$%%
  \index{#5leadsto@$\leadsto$}

\xitem{\WF{f}{A}}{$f$ a state function and \act{A} an action}
 \mbox{}\\
The   \index{fairness!weak}%%%
  \index{WF}%%%
property $(\Box\Diamond\anact{A}{f})\lor
      (\Box\Diamond\lnot\enabled{\anact{A}{f}})$.

\xitem{\SF{f}{A}}{$f$ a state function and \act{A} an action}
 \mbox{}\\
The   \index{fairness!strong}%%%
  \index{SF}%%%
property $(\Box\Diamond\anact{A}{f})\lor
      (\Diamond\Box \lnot\enabled{\anact{A}{f}})$.

\xitem{$\EE x : \Pi$}{$x$ a tuple of variables and $\Pi$ a property}
\mbox{}\\
The   \index{#6exists@$\EE$}%%%
property $\{\sigma\in\Sigma^{\oo} : 
(\exists \rho\in\Pi : \rho\vseqv{x}\sigma)\}$.%
  \index{quantification!over flexible variables}%%%

\end{list}

\subsection{Closure and Safety}
\begin{list}{}{\setlength{\labelwidth}{\leftmargin}
               \addtolength{\leftmargin}{\labelsep}
        \renewcommand{\makelabel}[1]{{\it\hspace{\labelsep}#1\/}:\hfill}}


\xitem{$\sigma\models\Pi$}{$\sigma\in\Sigma^{*}$ and $\Pi$ a property}
\mbox{}\\
  There   \index{#7models@$\models$}%%%
exists $\tau\in\Pi$ and $n$ such that 
  $\sigma=\prefix{\tau}{n}$.

\xitem{\closure{\Pi}}{$\Pi$ a property}
 %\mbox{}\\
The   \index{closure}%%%
  \index{c@$\closure{\ldots}$}%%%
property $\{\sigma\in\Sigma^{\oo} : 
  (\forall n \geq 0 : \prefix{\sigma}{n}\models\Pi)\}$.%

\item[safety property] A property $\Pi$ such that
  \index{safety}%%%
$\Pi=\closure{\Pi}$.

\xitem{$(\Pi,L)$ machine closed}{$\Pi$ and $L$ properties}
  \index{machine closure}%%%
$\Pi=\closure{\Pi\land L}$

\xitem{\while{\Phi}{\Pi}}{$\Phi$ and $\Pi$ properties}
The   \index{#7whileop@$\whileop$}%%%
property consisting of all behaviors $\sigma$ such that
\begin{itemize}
\item[$\land$] $\sigma\in\Phi$ implies $\sigma\in\Pi$ 
\item[$\land$] for all $n\geq 0$: $\prefix{\sigma}{n}\models\Phi$
       implies $\prefix{\sigma}{n}\models\Pi$.
\end{itemize}
\end{list}

\subsection{Realizability}
\begin{list}{}{\setlength{\labelwidth}{\leftmargin}
               \addtolength{\leftmargin}{\labelsep}
        \renewcommand{\makelabel}[1]{{\it\hspace{\labelsep}#1\/}:\hfill}}


\xitem{$\Pi$ constrains at most $\mu$}{$\Pi$ a safety property and
   $\mu$ an action} \mbox{}\\
  For   \index{constrains at most}%%%
any $s\in\Sigma$ and $\rho\in\Sigma^{*}$ with $|\rho|>0$, if
  $\rho\models\Pi$ and 
  $(\rho_{|\rho|},s)\notin\mu$, then 
  $\rho\circ s\models\Pi$.
  
\xitem{$\Pi$ does not constrain $\mu$}{$\Pi$ a safety property and
   $\mu$ an action} \mbox{}\\
  $\Pi$   \index{constrains at most!and does not constrain}%%%
constrains at most $\lnot\mu$, and every behavior
  of length 1 satisfies $\Pi$.



\xitem{$\mu$-strategy}{$\mu$ an action}
A   \index{strategy}%%%
mapping $f$ from $\Sigma^{*}$ to $\Sigma\cup\{\bot\}$ such that 
$f(\rho)\neq\bot$ implies $(\rho_{|\rho|},f(\rho))\in\mu$,
for any sequence $\rho\in\Sigma^{*}$ with $\rho\neq\emptyseq$.

\xitem{\oset{\mu}{f}}{$\mu$ an action and $f$ a $\mu$-strategy}
The   \index{o@$\oset{\ldots}{\ldots}$}%%%
set of behaviors $\sigma$ such that%%
\begin{itemize}
\item[$\land$] $f(\emptyseq)=\sigma_{1}$
\item[$\land$] for all $n>0$: $(\sigma_{n},\sigma_{n+1})\in\mu$ implies
$\sigma_{n+1}=f(\prefix{\sigma}{n})$
\item[$\land$] for infinitely many $n$: $f(\prefix{\sigma}{n})=\bot$
      or $(\sigma_{n},\sigma_{n+1})\in\mu$.
\end{itemize}

\xitem{\poset{\mu}{f}{\rho}}{$\mu$ an action, $f$ a $\mu$-strategy,
and $\rho\in\Sigma^{*}$}
If   \index{oa@$\poset{\ldots}{\ldots}{\ldots}$}%%%
$\rho=\emptyseq$ then \oset{\mu}{f}, else the set of
behaviors $\sigma$ such that
\begin{itemize}
\item[$\land$] $\rho=\prefix{\sigma}{|\rho|}$
\item[$\land$] for all $n\geq|\rho|$: $(\sigma_{n},\sigma_{n+1})\in\mu$ 
             implies $\sigma_{n+1}=f(\prefix{\sigma}{n})$
\item[$\land$] for infinitely many $n$: $f(\prefix{\sigma}{n})=\bot$
      or $(\sigma_{n},\sigma_{n+1})\in\mu$.
\end{itemize}


\xitem{$\Pi$ is $\mu$-receptive}{$\Pi$ a property and $\mu$ an action}
For   \index{receptiveness}%%%
every behavior $\sigma\in\Pi$ there exists a $\mu$-strategy
$f$ such that $\sigma\in\oset{\mu}{f}$ and $\oset{\mu}{f}\subseteq\Pi$.

\xitem{$(\Pi,L)$ is $\mu$-machine realizable}{$\Pi$ and $L$ properties
and $\mu$ an action} \mbox{}\\
$(\Pi,L)$   \index{machine realizability}%%%
is machine closed and $\Pi\land L$ is $\mu$-receptive.
\end{list}


\section{Proofs}
\subsection{Proof Notation}
We   \index{proof style, explanation}%%%
use hierarchically structured proofs.  The theorem to be proved is
statement \pfstepnumber{0}{1}{?}.  The proof of statement 
\pfstepnumber{i}{j}{?} is either an ordinary paragraph-style proof or 
the
sequence of statements \pfstepnumber{i+1}{1}{?},
\pfstepnumber{i+1}{2}{?}, \ldots\ and
their proofs.  A proof may be preceded by a
proof sketch, which informally describes the proof.
Within a proof, \pfstepnumber{k}{l}{?}
denotes the most recent statement with that number.  
 % That number is meaningful only if it lies within the proof of
 % statement number \pfstepnumber{k}{l'}{?}, for some $l'>l$.
A statement has the form\\ 
 \mbox{\hspace{\leftmargini}{\sc Assume:} {\em Assump\/} 
   \ \ {\sc Prove:} {\em Goal}}\\ 
which is abbreviated to {\em Goal\/} if there is no assumption.  The
assertion Q.E.D. in statement number \pfstepnumber{i+1}{k}{?} of the
proof of statement \pfstepnumber{i}{j}{?} denotes the goal of statement
\pfstepnumber{i}{j}{?}.  The statement\\
 \mbox{\hspace{\leftmargini}{\sc Case:} {\em Assump\/}}\\
is an abbreviation for\\
 \mbox{\hspace{\leftmargini}{\sc Assume:} {\em Assump\/} 
     \ \ {\sc Prove:} Q.E.D.}\\
Within the proof of statement \pfstepnumber{i}{j}{?}, assumption
\pflevelnumber{i}{?} denotes that statement's assumption, and
\pflevelnumber{i}{?}.$k$ denotes the assumption's $k^{\rm th}$ item.

We recommend that proofs be read hierarchically, from the top level
down.  To read the proof of a long level-$k$ step: (i)~read the
level-$(k+1)$ statements that comprise its proof, together with the
proof of the final Q.E.D. step (which is usually a short paragraph),
(ii)~read the proof of each level-$(k+1)$ step, in any
desired order.

\subsection{Proof of Proposition 
       \protect\ref{prop:exists-preserves-machine-closed}}
\begin{proof}
\assume{\begin{pfenum}
\item $(\Pi, L)$ is machine-closed.
\item $x$ a tuple of variables, none of which occurs free in $L$.
\item $\rho$ is a finite behavior satisfying $\EE x:\Pi$.
\end{pfenum}}
\prove{There exists an infinite behavior $\tau$ satisfying $(\EE
x:\Pi)\land L$ such that $\rho$ is a prefix of $\tau$.} 
\step{<1>1}{Choose a finite behavior $\sigma$ satisfying $\Pi$ such that
$\sigma\vseqv{x}\rho$.}
\begin{proof}
\step{<2>1}{Choose a behavior $\phi$ such that
           $\phi\in\EE x:\Pi$ and $\rho$ a prefix of $\phi$.}
\begin{proof}
\pf\ Assumption~\toplevel.1.
\end{proof}

\step{<2>2}{Choose a behavior $\psi$ such that $\psi\in\Pi$
and $\psi\vseqv{x}\phi$.}
\begin{proof}
\pf\ \stepref{<2>1} and the definition of $\EE x:\Pi$.
\end{proof}

\step{<2>3}{There exists an initial prefix $\sigma$ of $\psi$ such that
$\sigma\vseqv{x}\rho$.} 
\begin{proof}
\pf\ $\psi\vseqv{x}\phi$ (by \stepref{<2>2}) and
$\rho$ a prefix of $\phi$ (by \stepref{<2>1}).
\end{proof}

\qedstep
\begin{proof}
\pf\ \stepref{<2>2} and \stepref{<2>3}.  
\end{proof}
\end{proof}

\step{<1>2}{Choose $\eta$ satisfying $\Pi\land L$
such that $\sigma$ is a prefix of $\eta$.}
\begin{proof}
\pf\ The existence of $\tau$ follows from \stepref{<1>1} and 
assumption~\toplevel.1.
\end{proof}

\step{<1>3}{Choose $\tau$ such that $\tau\vseqv{x}\eta$ and
$\rho$ is a prefix of $\tau$.}
\begin{proof}
\pf\ $\tau$ exists because $\sigma$ is a prefix of $\eta$
(by \stepref{<1>2}) and $\sigma\vseqv{x}\rho$ (by \stepref{<1>1}).
\end{proof}

\step{<1>4}{$\tau$ satisfies $\EE x: \Pi$.}
\begin{proof}
\pf\ \stepref{<1>2}, \stepref{<1>3}, and the definition of $\EE x : \Pi$.
\end{proof}

\step{<1>5}{$\tau$ satisfies $L$.}
\begin{proof}
\pf\ \stepref{<1>2}, \stepref{<1>3}, and assumption~\toplevel.2.
\end{proof}

\qedstep
\begin{proof}
\pf\ Steps \stepref{<1>4} and \stepref{<1>5} imply that 
$\tau$ satisfies $(\EE x: \Pi)\land L$, and $\rho$ is a
prefix of $\tau$ by \stepref{<1>3}.
\end{proof}
\end{proof}


\subsection{Proof of Proposition \protect\ref{prop:proving-machine-closure}}
\begin{proof}
\assume{\begin{pfenum}
\item $(\Pi, L_{1})$ is machine closed.
\item $\Pi\land L_{1}$ implies $L_{2}$.
\end{pfenum}}
\prove{$(\Pi,L_{2})$ is machine closed.}
\pf\ \(
\begin{array}[t]{@{}l@{\;\;}c@{\;\;}l@{\hspace{1.5em}}l}
\Pi & = & \closure{\Pi\land L_{1}} & \mbox{[\toplevel.1]}\\
    & \subseteq & \closure{\Pi\land L_{2}} & \mbox{[\toplevel.2
           and monotonicity of closure]}\\
    & \subseteq & \closure{\Pi} & \mbox{[monotonicity of closure]}\\
    & = & \Pi & \mbox{[\toplevel.1, which implies $\Pi$ closed]}
\end{array}
\)\\
This proves that $\Pi=\closure{\Pi\land L_{2}}$.~~\qed
\end{proof}

\subsection{Two Lemmas About Machine-Realizability}
\begin{lemma} \label{lemma:machine-realizable}
$(\Pi,L)$ is $\mu$-machine realizable iff for every finite
behavior $\tau$ satisfying $\Pi$, there exists a $\mu$-strategy
$f$ such that $\tau\models\oset{\mu}{f}$ and
$\oset{\mu}{f}\subseteq\Pi\land L$.
\end{lemma}
\begin{proof}
\pf\ This is proved in Proposition~9 of \cite{abadi:composing}.~\qed
\end{proof}

\begin{lemma}  \label{lemma:x7}
$(\Pi,L)$ is $\mu$-machine realizable iff for every finite
behavior $\tau$ satisfying $\Pi$, there exists a $\mu$-strategy
$f$ such that $\poset{\mu}{f}{\tau}\subseteq\Pi\land L$.
\end{lemma}
\begin{proof}
\step{<1>1}{
  \assume{
    \begin{enumerate}
      \item For all finite $\tau$ such that $\tau\models\Pi$, there exists
           $f_{\tau}$ such that
           \begin{enumerate}
              \item $f_{\tau}$ is a $\mu$-strategy.
              \item $\poset{\mu}{f_{\tau}}{\tau}\subseteq\Pi\land L$
           \end{enumerate}
      \item $\rho$ a finite behavior such that $\rho\models\Pi$.
    \end{enumerate}}
  \prove{There exists a $\mu$-strategy g such that
          \begin{itemize}
             \item[$\land$] $\rho\models\oset{\mu}{g}$
             \item[$\land$] $\oset{\mu}{g}\subseteq \Pi\land L$
          \end{itemize}}}
\begin{proof}
\step{<2>1}{Choose $g$ such that,
for all $\sigma\in\Sigma^{*}$:\\
\hspace*{1em}
  \( g(\sigma) \;\;\deq\;\;
     \pfIF{(\sigma=\prefix{\rho}{n}) \,\land\, (n<|\rho|)}%
          {\pfIF{(n = 0) \lor (\rho_{n}, \rho_{n+1}) \in \mu}%
                {\rho_{n+1}}{\bot}}%
          {f_{\eta}(\sigma),\;\;
                              \begin{tabular}[t]{@{}l@{}}
                                  where $\eta$ is the 
                                  longest common \\
                                 prefix of $\rho$ and $\sigma$
                             \end{tabular}}
\)}
\begin{proof}
  \pf\ The requisite $f_{\eta}$ exists by
  assumption \toplevel.2, since $\rho\models\Pi$ implies
  $\eta\models\Pi$, for any prefix $\eta$ of $\rho$.
\end{proof}
  
  \step{<2>2}{$g$ is a $\mu$-strategy.}
    \begin{proof}
      \pf\ \toplevel.1a and the 
the definition of $g$ (\stepref{<2>1}).

    \end{proof}
   \step{<2>3}{$\oset{\mu}{g}\subseteq \Pi \land L$}
        \begin{proof}
          \pf\ 
        Assumption \toplevel.1b, 
          since $\kappa\in\oset{\mu}{g}$ implies that
        $\kappa \in \poset{\mu}{f_{\eta}}{\eta}$, where $\eta$ is 
          the longest common prefix of $\kappa$ and $\rho$.
        \end{proof}
   \step{<2>4}{$\rho\models\oset{\mu}{g}$}
     \begin{proof}
      \pf\ The definition of $g$ implies that $\rho$ is a prefix 
      of an element of \oset{\mu}{g}.
     \end{proof}
    \qedstep
    \begin{proof}
     \pf\ \stepref{<2>2}, \stepref{<2>3}, and \stepref{<2>4}.
    \end{proof}
\end{proof}
\step{<1>2}{
  \assume{$(\Pi,L)$ is $\mu$-machine realizable and
    $\tau\models\Pi$.}
  \prove{There exists a $\mu$-strategy $f$ such that
         $\poset{\mu}{f}{\tau}\subseteq \Pi\land L$.}}
\begin{proof}
  \step{<2>1}{Choose a $\mu$-strategy $f$ such that
     $\tau\in\oset{\mu}{f}$ and 
     $\oset{\mu}{f} \subseteq \Pi\land L$.}
\begin{proof}
\pf\ Assumption \levelref{<2>1} and
Lemma~\ref{lemma:machine-realizable}.
\end{proof}

  \step{<2>2}{$\poset{\mu}{f}{\tau} \subseteq \Pi\land L$}
  \begin{proof}
    \pf\ \stepref{<2>1}.2 and the definition of \poset{\mu}{f}{\tau}.
  \end{proof}

  \qedstep
  \begin{proof}
      \pf\ \stepref{<2>1} and \stepref{<2>2}.
  \end{proof}
\end{proof}

\qedstep
\begin{proof}
\pf\ By \stepref{<1>1}, \stepref{<1>2} and
  Lemma~\ref{lemma:machine-realizable}.
\end{proof}
\end{proof}


\pfshortindent
\subsection{Proof of Proposition 
\protect\ref{prop:fairness-is-machine-realizable}}
\begin{proof}
\pflet{\(\begin{array}[t]{@{}lcl}
  \Psi & \deq & \Phi\land \Pi\\
  L   & \deq & \begin{conj}
                   \forall i \in I : \WF{w_{i}}{\act{A}_{i}} \\ 
                   \forall j \in J : \SF{w_{j}}{\act{A}_{j}}
                 \end{conj}
   \end{array}\)}
\assume{\begin{enumerate}
 \item \label{p4(a)} $\Phi$ and  $\Pi$ are safety properties. 
 \item \label{p4(b)} $\Pi$ constrains at most $\mu$.
 \item \label{p4(c)}$I \cup J$ a finite or countably infinite set,
       which we take to be a set of natural numbers.
 \item For all $k$ in $I \cup J$: 
    \begin{enumerate}
      \item \label{p4(d)(i)}
         \anact{A_{k}}{w_k} is a subaction of $\Psi$.
      \item \label{p4(d)(ii)}
        $ \Psi \implies \Box[\anact{A_{k}}{w_{k}}\implies\mu]_{w_{k}}$
    \end{enumerate}
 \item \label{p4(e)}Forall $j$ in $J$: \enabled{\anact{A_{j}}{w_{j}}}
       is a $\lnot\mu$ invariant of $\Psi$.
  \end{enumerate}}

\prove{$(\while{\Phi}{\Pi}, \Phi\implies L)$ is $\mu$-machine realizable.}

By Lemma~\ref{lemma:x7}, it suffices to
\assume{ \begin{enumerate} \setcounter{pfenumi}{5}
 \item $\tau\models \while{\Phi}{\Pi}$
\end{enumerate}}
\prove{There exists a $\mu$-strategy $f$ such that\\
  \s{3}\(\poset{\mu}{f}{\tau}\subseteq
(\while{\Phi}{\Pi})\land(\Phi\implies L)\).}

\pfsketch\ Defining the strategy $f$ is tantamount to constructing a
scheduler that executes the actions \anact{A_{k}}{w_{k}} to satisfy the
fairness requirements.  Action \anact{A_{k}}{w_{k}} is never considered
until $k$ steps have occurred, so only finitely many actions are
considered at any point.  The next action scheduled is the enabled
action that has been under consideration for the longest time without
having been executed.  In the event of ties, the lowest-numbered action
is chosen.  The strategy $f$ will never violate $\Psi$, and it stops
making moves if $\Psi$ is ever made false by the environment.  In the
following definitions, $\nextact(\rho)$ is the $k$ such that the
scheduler chooses to execute \anact{A_{k}}{w_{k}} after the finite
behavior~$\rho$.



\pflet{
\begin{tabbing}
  $\act{B}_{k}$ \= $\;\deq\;$ \= \anact{A_{k}}{w_{k}}\\
%
  $n$     \> $\;\deq\;$ \> $|\tau|$\\
%
 $\lasttime(\rho,k)$ \= $\;\deq\;$ \= 
    $\max\, (\{l : 1 < l \leq |\rho| : (\rho_{l-1}, \rho_{l}) \in \act{B}_{k}\}
         \cup \{k\})$\\
%
  $\able(\rho)$ \> $\;\deq\;$ \> 
     \pfif{\rho = \emptyseq}%
          {\mbox{the set of naturals}}%
          {\{k : \rho_{|\rho|}\in \enabled{\act{B}_{k}}\}}\\
%
  $\oldestlast(\rho)$  \> $\;\deq\;$ \> 
    $\min \{\lasttime(\rho,k) : k \in \able(\rho)\}$\\
%
   $\nextact(\rho)$ \> $\;\deq\;$ \> 
       $\min \{k \in \able(\rho) : 
                    \lasttime(\rho,k) = \oldestlast(\rho)\}$

\end{tabbing}}

\step{<1>1}{Choose $f$ such that for all $\rho$ in $\Sigma^{*}$:\\
  \hspace*{1em}%
    \pfIF{(\able(\rho) = \emptyset) \,\lor\, (\rho \notin \Psi)}%
         {f(\rho) = \bot}%
         {\begin{conj}
           (\rho \neq \emptyseq) \implies 
                   (\rho_{|\rho|}, f(\rho)) \in \act{B}_{\nextact(\rho)} \\
           \rho \circ f(\rho) \in \Psi
         \end{conj}}}
 
\begin{proof} % of <1>1
 \pfsketch\ We must show that, for any $\rho$, the requisite
$f(\rho)$ exists.
 \step{<2>1}{
   \assume{$(\able(\rho) \neq \emptyset) \;\land\; \rho \models \Psi$}
   \prove{$\exists\, s \in \Sigma : \;
            \begin{conj}
               (\rho \neq \emptyseq) \,\implies\, (\rho_{|\rho|},s) 
                    \in \act{B}_{\nextact(\rho)}\\
              \rho \circ s \in \Psi
             \end{conj}$}}
   \begin{proof} % of <2>1
    \step{<3>1}{\case{$\rho = \emptyseq$}}
    \begin{proof}
    \pf\ Assumption \levelref{<2>1} and the definition of 
    $\rho\models \Psi$.
    \step{<4>1}{\case{$\rho \neq \emptyseq$}}
      \begin{proof} % of <3>2
           \step{<5>1}{$\rho_{|\rho|}\in\enabled{\act{B}_{\nextact(\rho)}}$}
           \begin{proof} % of <4>1
             \step{<6>1}{$\nextact(\rho) \in \able(\rho)$}
             \begin{proof}
             \pf\ Assumption \levelref{<2>1} and  the
             definitions of \nextact\ and \oldestlast.
             \end{proof}
             \qedstep
             \begin{proof}
             \pf\ Case assumption \levelref{<4>1} and the 
               definition of 
             $\able(\rho)$.
             \end{proof}
           \end{proof} % of <4>1
           \qedstep
           \begin{proof}
           \pf\ \stepref{<5>1} and
           Assumption \toplevel.\ref{p4(d)(i)}.
           \end{proof}
     \end{proof} % of <3>2

     \qedstep
      \begin{proof}
      \pf\ \stepref{<3>1} and \stepref{<4>1}.
      \end{proof}
    \end{proof}

  \end{proof} % of <2>1

  \qedstep
  \begin{proof}
  \pf\ The existence of the required $f$ follows
       easily from \stepref{<2>1}.
  \end{proof}
\end{proof} % of <1>1

\step{<1>2}{$f$ is a $\mu$-strategy.}
\begin{proof} % of <1>2
\assume{$(\rho \neq \emptyseq)\,\land\,(f(\rho) \neq \bot)$}
\prove{$(\rho_{|\rho|}, f(\rho)) \in \mu$}
\pf\ \stepref{<1>1} and assumption \levelref{<1>2} imply
  \[ \begin{conj}
      (\rho_{|\rho|}, f(\rho)) \in \act{B}_{\nextact(\rho)}\\
      \rho \circ f(\rho) \models \Psi
    \end{conj}
 \]
and the result follows from \toplevel.\ref{p4(d)(ii)}.
\end{proof} % of <1>2


\step{<1>3}{$\poset{\mu}{f}{\tau} \subseteq (\while{\Phi}{\Pi})$}
\begin{proof} % of <1>3
 \pfsketch\ This is a straightforward induction proof;
 \pfstepnumber{2}{1}{3.1} is the base case and
 \pfstepnumber{2}{2}{3.2} is the induction step.

   \step{<2>1}{\assume{$\sigma \in \poset{\mu}{f}{\tau}$}
               \prove{$\prefix{\sigma}{0} \models \while{\Phi}{\Pi}$}}
    \begin{proof}
     \pf\ $\prefix{\sigma}{0}=\prefix{\tau}{0}$, and 
      $\tau\models(\while{\Phi}{\Pi})$ by assumption \levelref{<2>1}
     and the definition of \poset{\mu}{f}{\tau}.
    \end{proof}

   \step{<2>2}{
     \assume{
       \begin{enumerate}
         \item $\sigma \in \poset{\mu}{f}{\tau}$
         \item $\prefix{\sigma}{i} \models \while{\Phi}{\Pi}$
         \item $i \geq 0$
       \end{enumerate}}
     \prove{$\prefix{\sigma}{i+1} \models \while{\Phi}{\Pi}$}}
   \begin{proof} % of <2>2
     \step{<3>1}{\case{$i \geq |\tau|$}}
     \begin{proof} % of <3>1
       \step{<4>1}{\case{$(\sigma_{i}, \sigma_{i+1}) \notin \mu$}}
       \begin{proof}
          \pf\ Follows easily from assumption \levelref{<2>2}.2 and 
          assumption \toplevel.\ref{p4(b)}, since
          $\Pi$ constrains at most $\mu$ implies \while{\Phi}{\Pi} constrains
          at most $\mu$.
       \end{proof}
       \step{<4>2}{\case{$(\sigma_{i}, \sigma_{i+1}) \in \mu$}}
       \begin{proof} % of <4>2
         \step{<5>1}{$\sigma_{i+1} = f(\prefix{\sigma}{i})$}
         \begin{proof}
            \pf\ Assumption \levelref{<2>2}.1.
         \end{proof}
         \qedstep
         \begin{proof}
           \pf\ \stepref{<5>1}, assumption \levelref{<2>2}.2, and the 
           {\bf else} clause in \stepref{<1>1} (the definition of $f$).
         \end{proof}
       \end{proof} % of <4>2
       \qedstep
       \begin{proof}
         \pf\ \stepref{<4>1} and \stepref{<4>2}.
       \end{proof}
     \end{proof} % of <3>1

     \step{<3>2}{\case{$i < |\tau|$}}
     \begin{proof}
     \pf\ By assumption \toplevel.6 and assumption 
          \levelref{<2>2}.1, since $i < |\tau|$ implies
           $\prefix{\sigma}{i+1} = \prefix{\tau}{i+1}$. 
     \end{proof}
     \qedstep
     \begin{proof}
       \pf\ \stepref{<3>1} and \stepref{<3>2}.
     \end{proof}
   \end{proof} % of <2>2

   \qedstep % <2>3
   \begin{proof}
   \pf\ \stepref{<2>1}, \stepref{<2>2}, mathematical induction, and 
   assumption \toplevel.\ref{p4(a)}.
   \end{proof}
\end{proof}% of <1>3

\step{<1>4}{$\poset{\mu}{f}{\tau} \subseteq (\Phi\implies L)$}
  \begin{proof} % of <1>4
  \pfsketch\ The proof is by contradiction.  We define
  \vbl{IE} and \vbl{IO} to be
  the sets of indices of actions that 
  should be executed infinitely often  
  and that actually are executed infinitely often, respectively.
  We show that the existence of a $q$ in \vbl{IE} but not in
  \vbl{IO} leads to a contradiction.
 
   \assume{
     \begin{enumerate}
        \item $\sigma \in \poset{\mu}{f}{\tau}$
        \item $\sigma \in \Phi$
        \item $\exists\, k \in I \cup J :
            \begin{disj*}
               k \in I \land \sigma \notin \WF{w_{k}}{\act{A}_{k}} \\
               k \in J \land \sigma \notin \SF{w_{k}}{\act{A}_{k}} 
            \end{disj*}$
     \end{enumerate}}
  \prove{\false}
  \pflet{
    $\begin{array}[t]{@{}lcl@{}}
     \vbl{IE} & \deq & \{i \in I : \Diamond\Box \enabled{\act{B}_{i}}\} \cup
                       \{j \in J : \Box\Diamond \enabled{\act{B}_{j}}\}\\
     \vbl{IO} & \deq & \{k \in I \cup J : 
                    (\sigma_{n}, \sigma_{n+1}) \in \act{B}_{k} 
                  \mbox{ for infinitely many $n$}\}
    \end{array}$}
   \step{<2>1}{$\sigma \in \Phi \land \Pi$}
      \begin{proof}
        \pf\ \stepref{<1>3} and assumption \levelref{<1>4}.1,
       which imply $\sigma\in\while{\Phi}{\Pi}$, and 
       \levelref{<1>4}.2.
      \end{proof}
   \step{<2>2}{Choose $q$ such that
       \begin{enumerate}
         \item $q \in \vbl{IE}$    %(a)
         \item $q \notin \vbl{IO}$ %(b)
       \end{enumerate}}
   \begin{proof}
     \pf\ Assumption \levelref{<1>4}.3.
   \end{proof}

   \step{<2>3}{Choose $m_{1}$ such that
     \begin{enumerate}
       \item $m_{1} > q$  %(a) 
       \item $\forall n \geq m_{1} : 
              (\sigma_{n-1}, \sigma_{n}) \notin \act{B}_{q}$ %(b) 
       \item $m_{1} > |\tau|$ %(c) 
     \end{enumerate}}
     \begin{proof}
       \pf\ \stepref{<2>2}.2
     \end{proof}

   \step{<2>4}{Choose $m_{2}$ such that
       \begin{enumerate}
         \item $m_{2} > m_{1}$ %(a) 
         \item $\forall k \in I \cup J : 
                (k \notin \vbl{IO}) \land (k < m_{1}) \,\implies\,
   % $\\s{3}$
       \forall n > m_{2} : 
                (\sigma_{n}, \sigma_{n+1}) \notin \act{B}_{k}$
                             %(b) 
       \end{enumerate}}
   \begin{proof}
     \pf\ Definition of \vbl{IO}.
   \end{proof}
     
   \step{<2>5}{Choose $m_{3}$ such that
     \begin{enumerate}
       \item $m_{3} > m_{2}$ %(a) 
        \item $\forall k \in I \cup J : (k \in \vbl{IO}) \land (k < m_{1}) 
                 \,\implies$\\
                 \s{3}$\exists\, n > m_{2}: (n < m_{3}) \,\land\,
                    (\sigma_{n}, \sigma_{n+1}) \in \act{B}_{k}$ %(b) 
     \end{enumerate}}
     \begin{proof}
     \pf\ Definition  of \vbl{IO}.
     \end{proof}

   \step{<2>6}{Choose $m_{4}$ such that
      \begin{enumerate}
        \item $m_{4} > m_{3}$ %(a) 
         \item $\sigma_{m_{4}}\in \enabled{\act{B}_{q}}$ %(b) 
        \item $(q \in I) \implies \forall n > m_{4}: \sigma_{n}\in
          \enabled{\act{B}_{q}}$ %(c) 
      \end{enumerate}}
    \begin{proof}
     \pf\ \stepref{<2>2}.1 and the definition of \vbl{IE}.
    \end{proof}

   \step{<2>7}{$\forall n > m_{4} :
      \begin{conj*}
        \sigma_{n}\in\enabled{\act{B}_{q}} \\ %(a)  
        (\sigma_{n-1}, \sigma_{n}) \notin \mu %(b) 
      \end{conj*}$}
      \begin{proof} % of <2>7
       \pfsketch\ By time $m_{4}$, $\act{B}_{q}$ is the next
       action scheduled for execution.  Since $\act{B}_{q}$ 
       is never again executed (by \stepref{<2>3}), there
       can be no further $\mu$ steps.  Since only a $\mu$
       step can disable $\act{B}_{q}$ (by assumption \toplevel.5),
       $\act{B}_{q}$ must be enabled forever.  The formal
       proof is by induction on $n$;
       \pfstepnumber{3}{1}{4.7.1} is the base case and
       \pfstepnumber{3}{2}{4.7.2} is the induction step.

         \step{<3>1}{$\sigma_{m_{4}}\in\enabled{\act{B}_{q}}$}
         \begin{proof}
            \pf\ \stepref{<2>6}.
         \end{proof}

     \step{<3>2}{
       \assume{
         \begin{enumerate}
           \item $\sigma_{n}\in\enabled{\act{B}_{q}}$ %1. 
           \item $(\sigma_{n-1}, \sigma_{n}) \notin \mu$ %2. 
           \item $n \geq m_{4}$ %3. 
         \end{enumerate}}
        \prove{$\begin{conj}
                 \sigma_{n+1}\in\enabled{\act{B}_{q}}\\
                 (\sigma_{n}, \sigma_{n+1}) \notin \mu
                \end{conj}$}}

     \begin{proof} % of <3>2
       \step{<4>1}{$(\sigma_{n}, \sigma_{n+1}) \notin \mu$}

       \begin{proof} % of <4>1
         \assume{$(\sigma_{n}, \sigma_{n+1}) \in \mu$}
         \prove{\false}

          \step{<5>1}{\(\begin{disj}
                         \nextact(\prefix{\sigma}{n}) = q \\
                          \exists\, k \in I\cup J : 
                            \begin{conj}
                              \nextact(\prefix{\sigma}{n}) = k\\
                              k < m_{1} \,\land\, k\notin\vbl{IO}\\
                              k\in\able(\prefix{\sigma}{n})
                            \end{conj}
                         \end{disj}\)}
          \begin{proof} % of <5>1
             \step{<6>1}{$q\in \able(\prefix{\sigma}{n})$}
               \begin{proof}
                 Assumption \levelref{<3>2}.1.
               \end{proof}

             \step{<6>2}{
               \assume{$k\geq m_{1}$}
               \prove{$\lasttime(\prefix{\sigma}{n},k)
                        > \lasttime(\prefix{\sigma}{n},q)$}}
               \begin{proof}
                \pf\ $\lasttime(\prefix{\sigma}{n},k)
                     \geq  m_{1}$ by definition of \lasttime,
                 and $m_{1} > \lasttime(\prefix{\sigma}{n},q)$ by
                                assumption \levelref{<3>2}.1.
               \end{proof} 

            \step{<6>3}{
               \assume{$(k > m_{1})\,\land\,(k\in\vbl{IO})$}
               \prove{$\lasttime(\prefix{\sigma}{n},k)
                        > \lasttime(\prefix{\sigma}{n},q)$}}
               \begin{proof}
                  \pf\ $\lasttime(\prefix{\sigma}{n},k)
                            \geq  m_{2} > m_{1}$ by \stepref{<2>5},
                     and $m_{1} >  \lasttime(\prefix{\sigma}{n},q)$ by
                                assumption \levelref{<3>2}.1.
               \end{proof} 
            \step{<6>4}{\(\begin{disj}
                         \oldestlast(\prefix{\sigma}{n}) = q \\
                          \exists\, k \in I\cup J : 
                            \begin{conj}
                              \oldestlast(\prefix{\sigma}{n}) = k\\
                              k < m_{1} \,\land\, k\notin\vbl{IO}\\
                              k\in\able(\prefix{\sigma}{n})
                            \end{conj}
                         \end{disj}\)}
               \begin{proof}
                 \pf\ \stepref{<6>1}, \stepref{<6>2}, and \stepref{<6>3}.
               \end{proof}
            \qedstep
              \begin{proof}
                 \pf\ \stepref{<6>4} and definition of \nextact.
              \end{proof}
          \end{proof} % of <5>1

          \step{<5>2}{\(\begin{disj}
                         (\sigma_{n}, \sigma_{n+1}) \in \act{B}_{q}\\
                          \exists\, k \in I\cup J : 
                            \begin{conj}
                              (\sigma_{n}, \sigma_{n+1}) \in \act{B}_{k}\\
                              k < m_{1} \,\land\, k\notin\vbl{IO}
                            \end{conj}
                         \end{disj}\)}
             \begin{proof}
             \pf\ \stepref{<5>1}, the definition of $f$ (\stepref{<1>1}),
             assumption \levelref{<4>1}, and assumption \levelref{<1>4}.1,
             since $n >|\tau|$ by assumption \levelref{<3>2}.3 and
             \stepref{<2>3}--\stepref{<2>6}.
             \end{proof}
         \qedstep
           \begin{proof} % step <5>3
             \step{<6>1}{\case{$(\sigma_{n}, \sigma_{n+1}) \in \act{B}_{q}$}}
               \begin{proof}
                \pf\ Contradicts \stepref{<2>3}, since $n>m_{1}$ by
                assumption \levelref{<3>2}.3 and
               \stepref{<2>4}--\stepref{<2>6}.
               \end{proof}
             \step{<6>2}{\case{$\exists\, k \in I\cup J : 
                            \begin{conj}
                              (\sigma_{n}, \sigma_{n+1}) \in \act{B}_{k}\\
                              k < m_{1} \,\land\, k\notin\vbl{IO}
                            \end{conj}$}}
               \begin{proof}
                \pf\ Contradicts \stepref{<2>4}, since $n>m_{2}$ by
                assumption \levelref{<3>2}.3, 
               \stepref{<2>5}, and \stepref{<2>6}.
               \end{proof}

             \qedstep
               \begin{proof}
                \pf\ \stepref{<6>1} and \stepref{<6>2}.
               \end{proof}
           \end{proof} % step <5>3
        \end{proof} % of <4>1


       \step{<4>2}{$\sigma_{n+1}\in \enabled{\act{B}_{q}}$}
       \begin{proof}
         \pf\ Assumption \levelref{<3>2}.1, \stepref{<4>1}, \stepref{<2>1}, 
         and assumption \toplevel.\ref{p4(e)}.
       \end{proof}
       \qedstep
       \begin{proof}
         \pf\ \stepref{<4>1} and \stepref{<4>2}.
       \end{proof}
      \end{proof} % of <3>2
     \qedstep
     \begin{proof}
       \pf\ \stepref{<3>1}, \stepref{<3>2}, and mathematical induction.
     \end{proof}
   \end{proof} % of <2>7
   \qedstep
    \begin{proof} % of <2>8. 
     \step{<3>1}{$\forall n > m_{4}: f(\prefix{\sigma}{n}) \neq \bot$}
     \begin{proof}
       \pf\ \stepref{<2>7}.1, 
         assumption \levelref{<1>4}.1, assumption \levelref{<1>4}.2, 
         and \stepref{<1>3}.
     \end{proof}
    \qedstep
     \begin{proof}
       \pf\ \stepref{<3>1} and \stepref{<2>7}.2 contradict assumption 
        \levelref{<1>4}.1.
     \end{proof}
    \end{proof} % of <2>8. 
  \end{proof} % of <1>4

\qedstep
\begin{proof}
  \pf\ \stepref{<1>2}, \stepref{<1>3}, and \stepref{<1>4}.
\end{proof}
\end{proof} % of proposition


\subsection{Proof of Proposition 
\protect\ref{prop:proving-while-machine-realizability}}
\pflongindent
\begin{proof}
\assume{\begin{pfenum}
\item $\Phi$ and $\Pi$ are safety properties.
\item $(\while{\Phi}{\Pi}, L_{1})$ is $\mu$-machine realizable.
\item $(\true, L_2)$ is $\mu$-machine realizable.
\item $\Phi \land \Pi\land L_{1}$ implies $L_{2}$.
\end{pfenum}}
\prove{$(\while{\Phi}{\Pi},L_{2})$ is $\mu$-machine realizable.}

\step{<1>1}{\assume{$\rho$ is a finite behavior such that 
$\rho \models (\while{\Phi}{\Pi})$.}
\prove{There exists a $\mu$-strategy $f$ such that\\
\s{3}$\poset{\mu}{f}{\rho} \subseteq (\while{\Phi}{\Pi}) \land L_{2}$.}}
\begin{proof}

\step{<2>1}{Choose $\mu$-strategy $h$ such that 
$\poset{\mu}{h}{\rho} \subseteq (\while{\Phi}{\Pi}) \land L_1$.}
\begin{proof}
\pf\ Assumption \pflevelnumber{0}{0}.2, assumption \levelref{<1>1}, and
  Lemma~\ref{lemma:x7}.
\end{proof}

\step{<2>2}{For all $\tau$, choose a $\mu$-strategy $g_\tau$ such that
$\poset{\mu}{g_\tau}{\tau} \subseteq L_2$.}
\begin{proof}
\pf\ Assumption \pflevelnumber{0}{0}.3 and Lemma~\ref{lemma:x7}.
\end{proof}

\step{<2>3}{Let $f(\tau) = h(\tau)$ for $\tau \models \Phi$, and otherwise
let $f(\tau) = g_\eta(\tau)$ where $\eta$ is the shortest prefix of 
$\tau$ such that $\eta \not\models \Phi$. Then $f$ is a $\mu$-strategy.}
\begin{proof}
\pf\ By steps \stepref{<2>1} and \stepref{<2>2} (which say that
$h$ and $g_\eta$ are $\mu$-strategies).
\end{proof}

\step{<2>4}{$\poset{\mu}{f}{\rho} \subseteq (\while{\Phi}{\Pi}) \land L_{2}$}
\begin{proof}
\assume{$\tau \in \poset{\mu}{f}{\rho}$}
\prove{$\tau \in (\while{\Phi}{\Pi}) \land L_{2}$}

\step{<3>1}{\case{$\tau \in \Phi$}}
\begin{proof}

\step{<4>1}{$\tau \in \poset{\mu}{h}{\rho}$}
\begin{proof}
\pf\ By 
assumption \levelref{<2>4}, since the case assumption \levelref{<3>1} 
and
the definition of $f$ (step \stepref{<2>3}) imply $f(\prefix{\tau}{n}) = 
h(\prefix{\tau}{n})$ for all $n$.
\end{proof}

\step{<4>2}{$\tau \in (\while{\Phi}{\Pi}) \land L_{1}$}
\begin{proof}
\pf\ By step \stepref{<4>1} and the choice of $h$ (step \stepref{<2>1}).
\end{proof}

\step{<4>3}{$\tau \in {\Phi}\land {\Pi} \land L_{1}$}
\begin{proof}
\pf\ By step \stepref{<4>2} and case assumption \levelref{<3>1}.
\end{proof}

\qedstep
\begin{proof}
\pf\ By step  \stepref{<4>3} and assumption \pflevelnumber{0}{0}.4. 
\end{proof}
\end{proof} %1.5.1

\step{<3>2}{\case{$\tau \not\in \Phi$}}
\begin{proof}

\step{<4>1}{Let $n$ be the least integer such that $\prefix{\tau}{n}
\not\in \Phi$.}
\begin{proof}
\pf\ Such an $n$ exists by 
case assumption \levelref{<3>2} and assumption \pflevelnumber{0}{0}.1.
\end{proof}

\step{<4>2}{$\tau \in
\poset{\mu}{g_{\prefix{\tau}{n}}}{\prefix{\tau}{n}}$}
\begin{proof}
\pf\ By step \stepref{<4>1}, assumption \levelref{<2>4}, and the
definition of $f$ (step \stepref{<2>3}).
\end{proof}

\step{<4>3}{$\tau \in L_2$}
\begin{proof}
\pf\ By steps \stepref{<4>2} and the choice of $g_{\prefix{\tau}{n}}$
(step \stepref{<2>2}).
\end{proof}

\qedstep
\begin{proof}
\pf\ By steps \stepref{<4>3} and case assumption \levelref{<3>2}.
\end{proof}
\end{proof} %1.5.2

\qedstep
\begin{proof}
\pf\ By steps \stepref{<3>1} and \stepref{<3>2}.
\end{proof}

\end{proof} %1.5

\qedstep 
\begin{proof}
\pf\ By steps \stepref{<2>3} and \stepref{<2>4}.
\end{proof}

\end{proof} %1

\qedstep 
\begin{proof}
\pf\ The result follows immediately from step \stepref{<1>1} and
Lemma~\ref{lemma:x7}.
\end{proof}

\end{proof}

\pfshortindent
\subsection{Proof of Theorem~\protect\ref{thm:open-NZ}}

The proof of Theorem~\ref{thm:open-NZ} is rather long and is presented
in two steps.  Section~\ref{sec:high-level-proof} contains a high-level
view of the proof; Section~\ref{sec:detailed-proof} contains the
complete proof, omitting definitions and complete subproofs that appear
in the high-level view.  If a formula $F$ is a conjunction, we may
number the conjuncts and let $F.i$ denote the $i^{\rm th}$ one.

The proof uses the following two lemmas.

\begin{lemma}[Rule WF1] \label{lemma:sf1} For any
predicates $P$, $Q$, and $I$; actions \act{N} and \act{A}; and state
function $f$; if
\begin{enumerate}
\item $P \land I \land I' \land [\act{N}]_{f} \;\implies\; (P' \lor Q')$
\item $P \land I \land I' \land \anact{\relax \act{N} \land \act{A}}{f} 
        \;\implies\; Q'$
\item $P \land I \;\implies\; \enabled{\anact{A}{f}}$.
\end{enumerate}
then 
$\WF{f}{\act{A}} \land 
    \Box I \land \Box [\act{N}]_{f} \;\implies\; 
    (P \leadsto Q)$
\end{lemma}
\begin{proof}
\pf\ This is a simple generalization of rule WF1 of
\cite{lamport:newtla}; the proof of soundness is omitted.
\end{proof}

\begin{lemma} \label{lemma:facts} For any actions \act{A} and \act{B}, state
function $f$, variable $x$, predicate $P$, and property
$\Pi$:
\begin{enumerate}
\item \begin{enumerate}
        \item \label{fact:0(a)}
              $(\enabled{(x'=f)}) = \true$.
        \item \label{fact:0(b)} 
              If \act{A} and \act{B} have no primed variables in common, 
              then \\\
             $(\enabled{\act{A} \land \act{B}}) = 
                (\enabled{\act{A}}) \land (\enabled{\act{B}})$.
      \end{enumerate}

\item \label{fact:1} 
       $(\enabled{\act{A}}) \land (\lnot\enabled{\act{B}}) \;\implies\; 
         (\enabled{\act{A} \land \lnot\act{B}})$

\item \label{fact:2} 
       $(\enabled{P \land \act{A}}) = (P \land \enabled{\act{A}})$

\item \label{fact:3} 
     $(\enabled{\exists\, x : \act{A}}) = (\exists\, x : \enabled{\act{A}})$

\item \label{fact:4} 
      If $\act{A} \implies \act{B}$ then 
      $(\enabled{\act{A}}) \implies (\enabled{\act{B}})$.

% \item \label{fact:5} 
%      If \act{A} is a subaction of
%      $\Pi$ then $P\land \act{A}$ a subaction of $\Pi$.
\end{enumerate}
\end{lemma}
\begin{proof}
\pf\ These properties all follow easily from the definitions.
\end{proof}


%try
\subsubsection{High-Level Proof of the Theorem} \label{sec:high-level-proof}

\pfhidelevel{2}
\unhideqedproof
%\pfshortnumbers{3}
%\pfsidenumbers{3}{.5em}

\renewcommand{\pfdot}{\mbox{$\cdot$}}

\begin{proof} % theorem
\pflet{\(\begin{array}[t]{@{}lcl@{}}
         \Pi & \deq & E\land M \\
         M^{t} & \deq & M \;\land\; \vbl{RT}_{v} \;\land\\
               &      & \s{1}
            \forall\,i\in I : \vbl{MinTime}(t_{i}, \act{A}_{i},v)
            \;\land\;\forall\,j\in J : \vbl{MaxTime}(T_{j})\\
         \Pi^{t} & \deq & E \land M^{t}
       \end{array}\)}
\assume{
\begin{enumerate}
\setcounter{pfenumi}{-1}
\item 
  \begin{enumerate}
   \item \label{assump:0(a)}
         $\Pi = \init \land \Box [\act{N}]_{w}$ for some predicate
         \init, action \act{N}, and state function $w$.
   \item \label{assump:0(b)}
          $t_{i}$ is a timer for $\Pi$, for all $i$ in $I$.
   \item \label{assump:0(c)}
         $T_{j}$ is a timer for $\Pi$, for all $j$ in $J$.
   \item \label{assump:0(d)}
         $J$ is a finite set.
  \end{enumerate}

\item \label{assump:1and4}                % old {assump:1} and {assump:4}
$\Pi^{t}\implies\Box(t_{i}\leq T_{j})$, or 
  $\anact{A_{i}}{v}$ and\/ $\anact{A_{j}}{v}$ are disjoint
      for\/ $\Pi$ and $i\neq j$, 
for all $i\in I$ and $j\in J$.

\item 
  \begin{enumerate}
    \item \label{assump:2(a)}
          \now\ does not occur free in\/ $v$.
    \item \label{assump:2(b)}
          $(\now'=r)\land(v'=v)$ is a subaction of\/ $\Pi$, for all\/ 
          $r\in\Real$.
   \end{enumerate}
\item For all\/ $j\in J$:
      \begin{enumerate}
        \item \label{assump:3(a)}
              $\anact{A_{j}}{v}\land(\now'=now)$ is a subaction of\/ $\Pi$,
        \item \label{assump:3(b)}
             $\Pi\;\implies\; 
               \vbl{VTimer}(T_{j}, \act{A}_{j},\Delta_{j},v)$ or%
               \iftoplas{ }{\\*}%
               $\Pi\;\implies\; 
                  \vbl{PTimer}(T_{j}, \act{A}_{j},\Delta_{j},v)$, for some
               $\Delta_{j}\in\infInterval{0}$,
 
        \item \label{assump:3(c)}
            $\Pi^{t}\;\implies\;\Box(\enabled{\anact{A_{j}}{v}} = 
              \enabled{(\anact{A_{j}}{v}\,\land\,(\now'=\now))})$
        \item \label{assump:3(d)}
             $(v'=v)\;\implies\;
            (\enabled{\anact{A_{j}}{v}} = (\enabled{\anact{A_{j}}{v}})')$
       \end{enumerate}


\item \label{assump:5}
  $E$ and $M$ are  safety properties, and $M$ constrains at most $\mu$.

\item 
     \begin{enumerate}
       \item \label{assump:6(a)}
             $\anact{A_{k}}{v}\implies\mu$, for all $k\in I\cup J$.
       \item \label{assump:6(b)}
             $(\now'\neq\now)\implies\mu$
     \end{enumerate}
\end{enumerate}
}
\prove{$(\while{E}{M^t},\, \NZ{\oo})$ is $\mu$-machine realizable.}

\pfsketch\ 
We show that a fairness condition \WF{(\now,v)}{\act{C}} implies that
\now\ increases without bound, for a subaction \anact{C}{(\now,v)} of
$\Pi^{t}$, and then apply Propositions
\ref{prop:fairness-is-machine-realizable} and
\ref{prop:proving-while-machine-realizability}.  To prove that \now\
increases without bound, we prove that $\now=r$ leads to
$\now\geq(r+\Delta)$ for any number $r$, where $\Delta$ is the minimum
of the $\Delta_{j}$.  The action \act{C} advances \now\ or, if
that is impossible because $\now=T_{j}$ for some upper-bound timer
$T_{j}$, it performs the action \act{A_{j}} (thereby advancing $T_{j}$).

We begin by naming the next-state relations of the $\vbl{RT}_{v}$,
\vbl{MaxTime}, 
 \iftoplas{}{\linebreak}%%%%
\vbl{MinTime}, \vbl{VTimer}, and \vbl{PTimer} formulas
and defining some actions and predicates, including \act{C}.  A
\act{B_{j}} step is defined to be an \act{A_{j}} step that leaves \now\
unchanged.  An \act{A_{j}^{t}}  step is an \act{A_{j}}
step that satisfies the lower-bound timing constraint,
if there is one.  A \act{B_{j}^{t}} step is a
\act{B_{j}} step taken when
$T_{j}$ equals \now\ that satisfies the lower-bound timing constraint,
if there is one.
The state function $T$ is the smallest
$T_{j}$ that restricts the advance of \now.

\pflet{
\begin{tabbing}
 $\vbl{MinTact}(t,\act{A},v)$ \= $\;\;\deq\;\;$ \= \kill
%
  $\vbl{RTact}_{v}$  \> $\;\;\deq\;\;$ \>
        $[(\now' \in \infInterval{\now}) \land (v'=v)]_{\now}$\\
%
  $\vbl{MaxTact}(t)$ \> $\;\;\deq\;\;$ \>
      $[\now' \leq t']_{\now}$ \\
%
 $\vbl{MinTact}(t,\act{A},v)$ \> $\;\;\deq\;\;$ \> 
       $[\act{A} \implies (t \leq now)]_{v}$ \\
%
  $\vbl{VTact}(t, \act{A}, \delta, v)$ \> $\;\;\deq\;\;$ \>
       \([ \begin{conj}
            t' \;=\; 
              \pfIF{(\enabled{\anact{A}{v}})'}%
                   {\pfIF{\anact{A}{v} \lor \lnot\enabled{\anact{A}{v}}}%
                         {\now+\delta}{t}}%
                   {\oo}\\
             v' \neq v ]_{(t,v)}\end{conj}\)\\
%

  $\vbl{PTact}(t, \act{A}, \delta, v)$ \> $\;\;\deq\;\;$ \>
       \([ \begin{conj}
            t' \;=\; 
              \pfIF{\enabled{\anact{A}{v}}}%
                   {\pfif{\anact{A}{v}}%
                         {\now+\delta}{t}}%
                   {t+(\now'-\now)}\\
             (\now,v)' \neq (\now,v)]_{(t,v,\now)}\end{conj}\)\\\
%
  $\act{B}_{j}^{t}$ \= $\;\;\deq\;\;$ \= \kill
%
  $P_{j}$  \> $\;\;\deq\;\;$ \>  $(j \in I) \implies (t_{j} \leq \now)$\\

  $\act{A}_{j}^{t}$ \> $\;\;\deq\;\;$ \> $\act{A}_{j} \land P_{j}$\\
%
  $\act{B}_{j}$   \> $\;\;\deq\;\;$ \>  $\act{A}_{j}  \land (\now'=\now)$\\
%
  $\act{B}_{j}^{t}$ \> $\;\;\deq\;\;$ \>  $\act{A}_{j}^{t} 
                                            \land (\now'=\now)
                                            \land(T_{j}=\now)$\\
%
  $T$ \> $\;\;\deq\;\;$ \> 
   $\min \{T_{j} : j \in J \land \enabled{\anact{A_{j}}{v}}\}$\\
%
  $\Delta$ \> $\;\;\deq\;\;$ \> $\min\{\Delta_{j} : j \in J\}$\\
%
  \vbl{NowT} \= $\;\;\deq\;\;$ \= $(\now'=\min(\now+\Delta, T)) 
                                   \land (v'=v)$\\
%
  \act{C} \> $\;\;\deq\;\;$ \>  
     $\begin{disj}
        (T \neq \now) \,\land\, \vbl{NowT}\\
        (T = \now) \,\land\, 
          \exists\, j \in J : \act{B}_{j}^{t}
      \end{disj}$
\end{tabbing}}

\step{<1>1}{Choose $J_{P}$ and $J_{V}$ such that:
   \begin{enumerate}
        \item \(J = J_{P} \cup J_{V}\)
        \item \(J_{P} \cap J_{V} = \emptyset\)
        \item \(\forall j \in J_{V} : \Pi \implies 
            \vbl{VTimer}(T_{j}, \act{A}_{j}, \Delta_{j}, v)\)
        \item \(\forall j \in J_{P} : 
            \Pi \implies PTimer(T_{j}, \act{A}_{j}, \Delta_{j}, v) \)
     \end{enumerate}}
\begin{proof}
\pf\ $J_{P}$ and $J_{V}$ exist by assumption \toplevel.\ref{assump:3(b)}.
\end{proof} % of step{0}


\step{<1>2}{$\Pi^{t} \implies \Box \inv$, where\\
  \s{1}\inv $\;\;\deq\;\;$%
   \(\begin{conj*}
       \forall j \in J : T_{j} \in \ccInterval{\now}{\oo} \\
       \now \in \Real \\
       \forall j \in J : 
            \begin{array}[t]{@{}l@{}}
              (\enabled{\anact{A_{j}}{v}} = \\
               \s{1}\enabled{(\anact{A_{j}}{v} \land (\now'=\now))}
             \end{array}\\
        \forall k \in I \cap J : t_{k} \leq T_{k}\\
       \forall j\in J_{V} :
          \lnot\enabled{\anact{A_{j}}{v}}\implies (T_{j}=\infty)
    \end{conj*}\) }
  \begin{proof}
  \pfsketch\  It follows immediately from the hypotheses that 
  $\Pi^{t}$ implies $\Box\inv.3$ and $\Box\inv.4$.
   The proofs for the other conjuncts of \inv\ are straightforward but 
  somewhat tedious invariance proofs, which are omitted.
    \step{<2>1}{$\RT_{v}\implies\Box\inv.2$}
        \begin{proof}
          \pf\ An invariance proof.
        \end{proof}
    \step{<2>2}{For all $j\in J$ : $\Pi\land \Box\inv.2 
                \land\vbl{MaxTime}(T_{j})\implies\Box\inv.1$}
        \begin{proof}
          \pf\ Assumption \toplevel.\ref{assump:0(c)} and an
          invariance proof.
        \end{proof}
    \step{<2>3}{$\Pi^{t}\implies\Box\inv.3$}
        \begin{proof}
          \pf\ Assumption \toplevel.\ref{assump:3(c)}, 
        \end{proof}
    \step{<2>4}{$\Pi^{t}\implies\Box\inv.4$}
        \begin{proof}
          \pf\ Assumption \toplevel.\ref{assump:1and4}.
        \end{proof}
    \step{<2>5}{$\Pi^{t}\implies\Box\inv.5$}
        \begin{proof}
          \pf\ \stepref{<1>1}.3, assumption
        \toplevel.\ref{assump:3(d)}, and an invariance proof.
        \end{proof}
    \qedstep
      \begin{proof}
         \pf\ \stepref{<2>1}--\stepref{<2>5}.
      \end{proof}
  \end{proof} % of step{05}


\step{<1>3}{\begin{enumerate}
 \item $\Pi = Init \land \Box \act{M}$
  \item $\Pi^{t} = Init^{t} \land \Box \act{N}^{t}$, for some predicate
          $\init^{t}$.
  \end{enumerate}
where\\
\s{1}%
  \act{M} $\;\;\deq\;\;$ 
      \(\begin{conj}
          [\act{N}]_{w}\\
          \forall j \in J_{P} : 
               \vbl{PTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)\\
          \forall j \in J_{V} : 
               \vbl{VTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)
       \end{conj}\)\\
\s{1}%
  $\act{N}^{t}$ $\;\;\deq\;\;$ 
      \(\begin{conj}
          \act{M} \\
          \vbl{RTact}_{v} \\
          \forall i \in I : \vbl{MinTact}(t_{i}, \act{A}_{i}, v)\\
          \forall j \in J : \vbl{MaxTact}(T_{j})
       \end{conj}\)}
  \begin{proof}
   \pf\ 1 follows from
        assumptions \toplevel.\ref{assump:0(a)} and 
        \toplevel.\ref{assump:3(b)}, and 2 follows from
       the definition of $\Pi^{t}$, since $\Box$  distributes over $\land$.
       (A simple calculation shows that $\act{M}=[\act{M}]_{f}$
       and $\act{N}^{t}=[\act{N}^{t}]_{g}$, for suitable tuples
       $f$ and $g$, so $\Box\act{M}$ and $\Box{\act{N}^{t}}$ are
       TLA formulas.)
  \end{proof}

\step{<1>4}{\anact{C}{(\now,v)} is a subaction of $\Pi^{t}$.}
\begin{proof} % step 4

\step{<2>1}{For all $j$ in $J$ : \anact{B_{j}^{t}}{v} is a subaction of 
         $\Pi^{t}$.}
  \begin{proof} % step 2
   \assume{$j \in J$}
   \prove{$\Pi^{t} \implies \Box \,(\,\enabled{\anact{B_{j}^{t}}{v}} 
    \;\implies\; \enabled{(\anact{B_{j}^{t}}{v} \land \act{N}^{t})}\,)$}

%%%%%%%%%%%%%%%%% NOTE THAT LOWER LEVELS OF THE PROOF ARE
%%%%%%%%%%%%%%%%% THROWN AWAY HERE.
  \step{<3>1}{$\Pi \;\implies\;
      \Box \,(\,\begin{array}[t]{@{}l@{}}
             \enabled{(\anact{B_{j}^{t}}{v}\land\act{M})} \\
              \s{1}\implies \;
               \enabled{(\begin{conj}
                          \anact{B_{j}^{t}}{v} \land \act{M}\\
                          \forall i \in I - \{j\} : 
                             \lnot(\anact{A_{i}}{v} 
                                 \land \anact{A_{j}}{v} \land\act{M})\,)\,)
                         \end{conj}}
         \end{array}$}
       \begin{proof}
         \step{<4>1}{$\Pi\;\implies\;
                 \lnot\enabled{(\exists\, i \in I - \{j\} : 
                               \anact{A_{i}}{v} 
                                 \land \anact{A_{j}}{v} \land\act{M})}$}
              \begin{proof}
               \pf\ \stepref{<1>3}.1, assumption %\toplevel.\ref{assump:1},  
               and \fact{3}.
              \end{proof}

        \qedstep
          \begin{proof}
            \pf\ \fact{1}, substituting 
            $\anact{B_{j}^{t}}{v} \land \act{M}$ for \act{A}
             and $\exists\, i \in I - \{j\} : 
                               \anact{A_{i}}{v} 
                                 \land \anact{A_{j}}{v} \land\act{M}$
           for \act{B}.
           \end{proof}
       \end{proof}

  \step{<3>2}{
     \( \begin{conj}
          \anact{B_{j}^{t}}{v} \land \act{N}^{t} \\
          \forall i \in I - \{j\} : 
             \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M}) 
        \end{conj}\)\\
        \(=\; \begin{conj}
                \anact{B_{j}^{t}}{v} \land \act{M}\\
                \forall i \in I - \{j\} : 
                 \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M}) 
               \end{conj}\)}
     \begin{proof} % step 2.2
       \begin{tabbing}
        \pf\ \= \+ 
          $\begin{conj}
            \anact{B_{j}^{t}}{v} \land \act{N}^{t}\\
            \forall i \in I - \{j\} : 
                \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M})
          \end{conj}$ \\
%
         \s{.5}\=\+ $=$ \= [by definition of $\anact{B_{j}^{t}}{v}$]\\*
          \> $\begin{conj}
               \act{A}_{j}^{t} \land (v'\neq v) \land (\now'=\now) 
                      \land \act{N}^{t}\\
               \forall i \in I - \{j\} : 
                  \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M})
              \end{conj}$\\
%
           $=$ \> [by definition  of $\act{N}^{t}$]\\*
           \>  $\begin{conj}
                  \act{A}_{j}^{t} \land \act{M} \land (v'\neq v)
                     \land (\now'=\now) \\
                   \forall i \in I : \act{A}_{i} \implies (t_{i} \leq \now)\\
                   \forall i \in I - \{j\} : 
                      \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} 
                            \land \act{M})
               \end{conj}$\\
%
            $=$ \> [by definition of $\act{A}_{j}^{t}$]\\*
            \> $\begin{conj}
                  P_{j} \land \act{A}_{j} \land \act{M} \land (v'\neq v) 
                     \land \now'=\now \\
                  \forall i \in I : \act{A}_{i} \implies (t_{i} \leq \now)\\
                  \forall i \in I - \{j\} : 
                     \lnot(\act{A}_{i} \land \act{A}_{j} \land \act{M} \land 
                            (v'\neq v)) 
                \end{conj}$\\
%
            $=$ \> [by predicate logic]\\*
             \> $\begin{conj}
                   P_{j} \land \act{A}_{j} \land \act{M} \land (v'\neq v) 
                    \land (\now'=\now) \\
                   j \in I \implies (t_{j} \leq \now)\\
                   \forall i \in I - \{j\} : 
                      \lnot(\act{A}_{i} \land \act{A}_{j} \land \act{M} 
                         \land (v'\neq v))
                \end{conj}$\\
%
          $=$ \> [by definition of \anact{A_{k}}{v} and \act{M}]\\*
           \> $\begin{conj}
                P_{j} \land \act{A}_{j} \land \act{M} \land (v'\neq v) 
                   \land (\now'=\now) \\
                j \in I \implies (t_{j} \leq \now)\\
                \forall i \in I - \{j\} : 
                   \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M})
               \end{conj}$\\
%
          $=$ \> [by definition of $P_{j}$]\\*
           \> $\begin{conj}
                 P_{j} \land \act{A}_{j} \land (v'\neq v) \land (\now'=\now) 
                   \land \act{M}\\
                 \forall i \in I - \{j\} : 
                   \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M})
              \end{conj}$\\
%
          $=$ \> [by definition of \anact{B_{j}^{t}}{v}]\\*
           \> $\begin{conj}
                 \anact{B_{j}^{t}}{v} \land \act{M}\\
                 \forall i \in I - \{j\} : 
                   \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M})
              \end{conj}$
       \end{tabbing}
     \end{proof} % step 2.2
   \step{<3>3}{$\Pi \implies \Box 
            \,(\,\enabled{(\anact{B_{j}^{t}}{v} \land \act{M})} \implies 
                     \enabled{(\anact{B_{j}^{t}}{v} \land \act{N}^{t})}\,)\,$}
     \begin{proof}
      \pf\ \stepref{<3>1}, \stepref{<3>2}, and \fact{4}. 
     \end{proof}
        
   \step{<3>4}{$\Pi \implies 
                \Box (P_{j} \land \enabled{\anact{B_{j}}{v}} \implies 
                  P_{j} \land \enabled{(\anact{B_{j}}{v} \land \act{M})})$}
     \begin{proof}
       \pf\ 
     \stepref{<1>3}, Assumption \toplevel.\ref{assump:3(a)}, and
     the definition of $\act{B}_{j}$.  
     \end{proof}
        
   \step{<3>5}{$\Pi \implies \Box 
                \,(\,(\enabled{\anact{B_{j}^{t}}{v}}) \implies 
                      \enabled{(\anact{B_{j}^{t}}{v} \land \act{M})}\,)$}
      \begin{proof}
        \pf\ \stepref{<3>4}, the definition of $\act{B}_{j}^{t}$, and \fact{2}. 
      \end{proof}
        

   \step{<3>6}{$\Pi \implies 
               \Box ((\enabled{\anact{B_{j}^{t}}{v}})
                 \implies \enabled{(\anact{B_{j}^{t}}{v} \land \act{N}^{t})})$}
      \begin{proof}
         \pf\ \stepref{<3>5} and \stepref{<3>3}. 
      \end{proof}
        
   \qedstep
      \begin{proof}
        \pf\ \stepref{<3>6} and the definition of $\Pi^{t}$, which implies 
        $\Pi^{t} \implies \Pi$.
      \end{proof}
  \end{proof} % step 2

\step{<2>2}{\anact{\relax\vbl{NowT}}{\now} is a subaction of $\Pi^{t}$.}
\begin{proof} % step 3
   \step{<3>1}{$\Pi^{t} \,\implies\,
      \Box\,(\,\begin{array}[t]{@{}l@{}}
                 (\enabled{\anact{\relax\vbl{NowT}}{\now}}) \\
                   \s{1}\implies
                  (\enabled{(\anact{\relax\vbl{NowT}}{\now} 
                               \land\act{M})})\,)
                \end{array}$}
   \begin{proof}
     \step{<4>1}{$\Pi^{t} \,\implies\,
      \Box\,(\,\begin{array}[t]{@{}l@{}}
                 (\enabled{\vbl{NowT}) \\
                   \s{1}\implies
                  (\enabled{(\vbl{NowT}\land\act{M})})\,)
                \end{array}$}
      }
        \begin{proof} \pf\ \stepref{<1>3},
          assumption \toplevel.\ref{assump:2(b)}, and the definition
         of \vbl{NowT}, since $\Pi^{t}$ implies $\Pi$.
       \end{proof}        
     \qedstep
       \begin{proof} \pf\  \stepref{<4>1} and
           \fact{2}, substituting $\now\neq T$ for $P$ 
           (since \anact{\relax\vbl{NowT}}{\now} equals
            $\vbl{NowT}\land(\now\neq T)$).
       \end{proof}
   \end{proof}

   \step{<3>2}{$\Pi^{t} \implies \Box 
              (\enabled{(\anact{\relax\vbl{NowT}}{\now} \land \act{M})}
                       \implies 
               \enabled{(\anact{\relax\vbl{NowT}}{\now} \land \act{N}^{t})})$} 
                 %% note: actually have =, not just \implies
  \begin{proof}
    \step{<4>1}{$(\inv\land \anact{\relax\vbl{NowT}}{\now} \land \act{M})
                 \implies (\anact{\relax\vbl{NowT}}{\now} \land \act{N}^{t})$}
      \begin{proof}
        \step{<5>1}{$ \inv \land \anact{\relax\vbl{NowT}}{\now} \implies
                    \vbl{RTact}_{v}$}
        \begin{proof}
          \pf\ \stepref{<1>3} (\inv.1 and \inv.2).
        \end{proof}

      \step{<5>2}{$\forall i \in I : \anact{\relax\vbl{NowT}}{\now} \implies 
                     \vbl{MinTact}(t_{i}, \act{A}_{i}, v)$}
      \begin{proof}
         \pf\ $\vbl{MinTact}(t_{i}, \act{A}_{i}, v) = [\ldots]_{v}$
                  and \anact{\relax\vbl{NowT}}{\now} implies $v'=v$.
      \end{proof}
      \step{<5>3}{$\forall j \in J : 
                    \inv \land \anact{\relax\vbl{NowT}}{\now} \land \act{M}
                                 \implies \vbl{MaxTact}(T_{j})$}
      \assume{\begin{enumerate}
               \item $j\in J$
                \item $\inv \land \anact{\relax\vbl{NowT}}{\now} \land \act{M}$
              \end{enumerate}}
      \prove{$\vbl{MaxTact}(T_{j})$}

      \begin{proof} % step 4.1.3
        \step{<6>1}{\case{\enabled{\anact{A_{j}}{v}}}}
        \begin{proof}
         \step{<7>1}{$\now' \leq T_{j}$}
            \begin{proof}
                  \pf\ \inv.1, \inv.2, \anact{\relax\vbl{NowT}}{\now}, 
                 and the definitions of \vbl{NowT}, since
                 case assumption \levelref{<6>1} and the
                definition of $T$ imply $T_{j}\geq T$.
            \end{proof}
         \step{<7>2}{\case{$j\in J_{P}$}}
            \begin{proof}
                \step{<8>1}{\case{$T_{j}'=T_{j}$}}
                   \begin{proof}
                   \pf\ \stepref{<7>1} and the definition
                 of $\vbl{MaxTact}(T_{j})$.
                   \end{proof}
                \step{<8>2}{\case{$T_{j}'=\now+\Delta_{j}$}}
                  \begin{proof}
                    By \inv.2, \anact{\relax\vbl{NowT}}{\now}, and the
                   definition of $\vbl{MaxTact}(T_{j})$.
                  \end{proof}
                \qedstep
                   \begin{proof}
                    \stepref{<8>1}, \stepref{<8>2}, and case assumption
                     \levelref{<7>2}, since 
                     case assumption \levelref{<6>1}
                    and the definition of 
                    $\vbl{PTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)$
                    imply that these are the only possibilities.
                   \end{proof}
            \end{proof}
         \step{<7>3}{\case{$j\in J_{V}$}}
           \begin{proof}
            \step{<8>1}{$T_{j} = T_{j}'$}
              \begin{proof}
                \pf\ By case assumption \levelref{<7>3} and the definitions 
                 of \act{M} and
                 $\vbl{VTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)$,
                 since \anact{\relax\vbl{NowT}}{v} implies
                 $v=v'$.
              \end{proof}
            \qedstep
              \begin{proof}
                \pf\ \stepref{<7>1}, \stepref{<8>1}, 
                 and the definition
                 of $\vbl{MaxTact}(T_{j})$.
              \end{proof}
           \end{proof}
         \qedstep
           \begin{proof}
              \pf\ \stepref{<7>2}, \stepref{<7>3}, \stepref{<1>1}.1, and
              assumption \levelref{<5>3}.1.
           \end{proof}
        \end{proof} % of 4-1/2.1

        \step{<6>2}{\case{$\lnot\enabled{\anact{A_{j}}{v}}$}}
          \begin{proof}
           \step{<7>1}{$\now,\now'\in\Real$ and $\now' > \now$.}
             \begin{proof}
               \pf\ \inv.1, \inv.2,  \anact{\relax\vbl{NowT}}{\now}, 
               and the definition of $T$.
             \end{proof}
           \step{<7>2}{\case{$j\in J_{P}$}}
            \begin{proof} 
             \step{<8>1}{$T_{j}' \geq \now'$}
                \begin{proof}
                  \pf\ \stepref{<7>1}, case assumption \levelref{<7>2}, \inv.1,
                    and the definitions of \act{M} and
                    $\vbl{PTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)$.
                \end{proof}             
             \qedstep
              \begin{proof}
                \pf\ \stepref{<8>1} and the definition of 
                 $\vbl{MaxTact}(T_{j})$.
              \end{proof}
            \end{proof} % of 5.1
           \step{<7>3}{\case{$j\in J_{V}$}}
             \begin{proof}
               \step{<8>1}{$T_{j} = \infty$}
                 \begin{proof}
                  \pf\ By case assumption \levelref{<7>3} and \inv.5.
                 \end{proof}
               \step{<8>2}{$T_{j}' = \infty$}
                 \begin{proof}
                   \pf\ \stepref{<8>1}, case assumption \levelref{<7>3}, 
                        and the definitions of \act{M} and
                    $\vbl{VTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)$,
                    since \anact{\relax\vbl{NowT}}{v} implies
                    $v=v'$.
                 \end{proof}
               \qedstep
                 \begin{proof}
                   \pf\ \stepref{<7>1}, \stepref{<8>2},
                    and the definition
                    of $\vbl{MaxTact}(T_{j})$.
                 \end{proof}
            \end{proof} % of 5.2

           \qedstep                   
           \begin{proof}
              \pf\ \stepref{<7>2}, \stepref{<7>3}, \stepref{<1>1}.1, and
              assumption \levelref{<5>3}.1.
           \end{proof}

          \end{proof} % of step 4-1/2.2

        \qedstep
          \begin{proof}
            \pf\ \stepref{<6>1} and \stepref{<6>2}.
          \end{proof}
      \end{proof} % of 4.1.3
    \qedstep
     \begin{proof}
           \pf\ \stepref{<5>1}, \stepref{<5>2}, \stepref{<5>3},
        and the definition of $\act{N}^{t}$.
     \end{proof}
    \end{proof} % of 4.1

    \qedstep
     \begin{proof}
      \pf\ By \stepref{<4>1} and \stepref{<1>2}, since by
      \fact{2} and \fact{4},
      $\inv\land\act{D}\implies\act{E}$
       implies 
    $\Box\inv\implies\Box((\enabled{\act{D}})\implies(\enabled{\act{E}}))$,
   for any actions \act{D} and \act{E}.
     \end{proof}

  \end{proof} % of 3.2

   \qedstep
   \begin{proof} % step 3.3
      \pf\ \stepref{<3>1} and \stepref{<3>2}.
   \end{proof} % step 3.3
\end{proof} % step 3

\qedstep
\begin{proof} % qedstep of 4
 \sloppy
    \pf\ By \stepref{<2>1} and \stepref{<2>2}, since
      $\anact{\relax\vbl{NowT}}{\now} =
      \anact{\relax\vbl{NowT}}{(\now,v)}$,
      $\anact{B_{j}^{t}}{v} = \anact{B_{j}^{t}}{(\now,v)}$,
      \fact{3} implies that the disjunction of subactions is a subaction,
      and 
      \fact{2} implies that if \act{D} is a subaction, then
       $P\land\act{D}$ is also a subaction, for any predicate $P$.
\end{proof} % qedstep of 4
\end{proof} % step 4



\step{<1>5}{$\Pi^{t} \land \WF{(\now,v)}{\act{C}} \implies \NZ{\oo}$}
\begin{proof} % of <1>6
  \pf\ By the Lattice Rule~\cite{lamport:newtla}, it suffices to
\assume{$r\in\Real$}
\prove{$\Pi^{t} \land \WF{(\now,v)}{\act{C}}
   \;\implies\; 
    (\,(\now = r) \leadsto (\now \in \coInterval{r+\Delta}{\oo})\,)$}

\pfsketch\ 
The standard method of proving that $\now=r$ leads to $\now \in
\coInterval{r+\Delta}{\oo}$ is to assume that $\now=r$ and \now\ is
never in \coInterval{r+\Delta}{\oo}, and derive a contradiction.
Step \pfstepnumber{2}{2}{5.2} below proves that, if \now\ equals $r$ and it is
never in \coInterval{r+\Delta}{\oo}, then it is always in
\coInterval{r}{r+\Delta}.  It therefore suffices to assume \now\ is
always in \coInterval{r}{r+\Delta} and derive the contradiction.

The contradiction is obtained by showing that eventually there is no
upper-bound timer preventing the advance of \now\ past $r+\Delta$.  The
timers that could prevent the advance of \now\ are the ones in the set
$U$ of timers that are less than $r+\Delta$.  Step
\pfstepnumber{2}{4}{5.4} asserts that $U$ eventually becomes empty, and
\pfstepnumber{2}{5}{5.5} asserts that time then advances past
$r+\Delta$.

%%%% \begin{proof} % step <1>5
  \pflet{\begin{tabbing}
%
    $U$ \= $\;\;\deq\;\;$ \= $\{j \in J : T_{j} < r+\Delta\}$\\
%
    $V$ \> $\;\;\deq\;\;$ \> $\{j \in J : \now < T_{j} < r+\Delta\}$\\
%
    \vbl{TimerAct} \= $\;\;\deq\;\;$ \= 
        $\forall j \in J : 
           \begin{disj}
              \vbl{VTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)\\
              \vbl{PTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)
           \end{disj}$
    \end{tabbing}}

\step{<2>1}{$\inv\implies\enabled{\anact{C}{(\now,v)}}$}
    \begin{proof}
        \step{<3>1}{\case{$T \neq \now$}}
         \begin{proof} 
           \pf\ By the definition of \act{C}, since
            case assumption \levelref{<3>1} implies
           $\enabled{\anact{\relax\vbl{NowT}}{\now}}$.
         \end{proof} 
         \step{<3>2}{\case{$T =  \now$}}
         \begin{proof} 
           \step{<4>1}{Choose $j\in J$ such that
                   $(T_{j}=T)\land\enabled{\anact{A_{j}}{v}}$.}
             \begin{proof}
              \pf\ \inv.2, case assumption \levelref{<3>2}, and
              the definition of $T$.
             \end{proof}

           \step{<4>2}{\enabled{\anact{B_{j}}{v}}}
              \begin{proof}
                \pf\ \stepref{<4>1}, \inv.3, and the definition of
                 \anact{B_{j}}{v}.
              \end{proof}


           \step{<4>3}{\enabled{\anact{B^{t}_{j}}{v}}}
              \begin{proof}
                \pf\ \stepref{<4>2}, \inv.4, case assumption 
               \levelref{<3>2}, and and the definition of
                 \anact{B^{t}_{j}}{v}.
              \end{proof}

          \qedstep
            \begin{proof}
            \pf\ Case assumption \levelref{<3>2}, \stepref{<4>3},
             and the definition of \act{C}.
            \end{proof}

         \end{proof} 
         \qedstep
         \begin{proof} 
           \pf\ \stepref{<3>1} and \stepref{<3>2}.
         \end{proof} 
\end{proof}

   \step{<2>2}{$\begin{array}[t]{@{}l@{}}
               \Pi^{t} \;\implies\\*
               \s{.75}\Box((\now = r) \land \Box (\now \in
                     \ooInterval{-\oo}{r+\Delta})
                 \,\implies\, \Box (\now \in \coInterval{r}{r+\Delta}))
              \end{array}$}
   \begin{proof} % step <2>1
     \step{<3>1}{$\Box [\vbl{RTact}_{v}]_{\now} 
                    \implies ((\now = r) \implies 
                 \Box (\now \in \coInterval{r}{\oo}))$}
     \begin{proof}
       \pf\ A standard invariance argument.
     \end{proof}

     \step{<3>2}{$\Box [\vbl{RTact}_{v}]_{\now} 
         \implies \Box ((\now = r) \implies 
                       \Box (\now \in \coInterval{r}{\oo}))$}
     \begin{proof}
       \pf\ \stepref{<3>1} and simple temporal logic.
     \end{proof}

     \step{<3>3}{$\Pi^{t} \implies 
            \Box((\now = r) \implies \Box (r \leq \now))$}
     \begin{proof}
       \pf\ \stepref{<3>2}, since $\Pi^{t} \implies RT_{v}$ and 
       $RT_{v} \implies \Box [\vbl{RTact}_{v}]_{\now}$
     \end{proof}
     \qedstep
     \begin{proof}
      \pf\ \stepref{<3>3}, using the temporal logic tautology
         \[(F \leadsto G) \implies ((F\land \Box H) 
               \leadsto (G \land \Box H))\]       
     \end{proof}
   \end{proof} % step <2>1

   \step{<2>3}{\assume{$j\in J$}
     \prove{\begin{enumerate}
       \item $\Pi^{t} \land \Box(\now\in\coInterval{r}{r+\Delta})
             \,\implies\, \Box ((j \notin U) \implies \Box (j \notin U))$
       \item $\Pi^{t} \land \Box(\now\in\coInterval{r}{r+\Delta})
           \,\implies\, \Box ((j \notin V) \implies \Box (j \notin V))$
      \end{enumerate}}}
   \begin{proof} % step <2>2
     \pf\ A standard invariance proof, using assumption 
     \toplevel.\ref{assump:3(b)}.
   \end{proof} % step <2>2

   \step{<2>4}{$\Pi^{t} \land \Box (\now \in \coInterval{r}{r+\Delta}) \land 
       \WF{(\now,v)}{\act{C}} 
           \,\implies\, \Diamond \Box (U = \emptyset)$}
   \begin{proof} % step <2>3
      \pfsketch\ 
      The set $V$ consists of those timers in $U$ that are
      not equal to \now.  To prove that $U$ is eventually empty,
      we show that, whenever $U$ is nonempty, eventually $U$ or $V$ 
      gets smaller.  Since $U$ and $V$ are finite, $U$ must eventually
      become empty.      

      \step{<3>1}{\assume{$U_{0}$ and $V_{0}$ sets, 
                   with $U_{0} \neq \emptyset$.}
        \prove{$\begin{array}[t]{@{}l@{}}
           \begin{conj}
             \Box ((U \subseteq U_{0})\land(V \subseteq V_{0}))\\
             \Box (\now \in \coInterval{r}{r+\Delta})\\
             \Box \inv\\
             \Box [\vbl{TimerAct}]_{(\now,v)}\\
             \WF{(\now,v)}{\act{C}}
         \end{conj}\\
           \s{1}\implies ((U = U_{0})\land(V = V_{0}))\;\leadsto\\
             \s{3.5}(U \subset U_{0}) \lor 
               ((U \subseteq U_{0})\land(V \subset V_{0}))
        \end{array}$}}
     \begin{proof} % step <3>1
        \pfsketch\ This is a straightforward application of 
        rule WF1 (Lemma~\ref{lemma:sf1}), with the following
        substitutions.
       \pflet{\begin{tabbing}
           $\act{N}$ \= $\;\;\deq\;\;$ \=  \kill
           $I$ \> $\;\;\deq\;\;$ \>
               $\begin{conj*}
                  \now \in \coInterval{r}{r+\Delta}\\
                (U \subseteq U_{0})\land(V \subseteq V_{0})\\
                \inv
              \end{conj*}$\\
           $P$ \> $\;\;\deq\;\;$ \> $(U = U_{0})\land(V = V_{0})$\\
           $Q$ \> $\;\;\deq\;\;$ \> $(U \subset U_{0}) \lor 
               ((U \subseteq U_{0})\land(V \subset V_{0}))$\\
           $\act{N}$ \> $\;\;\deq\;\;$ \>
              $\vbl{TimerAct}$\\
           \act{A} \> $\;\;\deq\;\;$ \> \act{C}\\
            $f$ \> $\;\;\deq\;\;$ \> $(\now,v)$
        \end{tabbing}}
       \step{<4>1}{$I' \implies (P' \lor Q')$}
       \begin{proof}
         \pf\ Obvious.
       \end{proof}

       \step{<4>2}{\assume{$P \land I \land I' \land 
                     \anact{N\land \act{A}}{f}$}
                   \prove{$Q'$}}
       \begin{proof} % step <4>2
         \step{<5>1}{\case{$T=\now$}}
         \begin{proof} % step <5>1
           \step{<6>1}{Choose $j$ in $J$ 
             such that $(T_{j} = T) \land \anact{B_{j}^{t}}{v}$.}
           \begin{proof}
             \pf\ \act{A} and case assumption \levelref{<5>1}.
           \end{proof}
           \step{<6>2}{$T_{j}' \geq r+\Delta$}
           \begin{proof}
             \pf\ \stepref{<6>1}, $I.1$, the
               definition of $\act{B}_{j}^{t}$, and \vbl{TimerAct}.
           \end{proof}
           \step{<6>3}{$j \in U \land j \notin U'$}
           \begin{proof}
             \pf\ \stepref{<6>1}, case assumption \levelref{<5>1},
             and $I$.1.
           \end{proof}
           \step{<6>4}{$j \notin U'$}
           \begin{proof}
             \pf\ \stepref{<6>2}.
           \end{proof}
           \qedstep
           \begin{proof}
             \pf\ \stepref{<6>3}, \stepref{<6>4}, and $I'$.2.
           \end{proof}
         \end{proof} % step <5>1
         \step{<5>2}{\case{$T\neq\now$}}
         \begin{proof} % step <5>1
           \step{<6>1}{$\now'=T \land v'=v$}
           \begin{proof}
             \pf\ \act{A} and case assumption \levelref{<5>2}.
           \end{proof}
           \step{<6>2}{\case{$T \in (\now,r+\Delta)$}}
           \begin{proof} % step <6>2
             \step{<7>1}{Choose $j$ in $J$ such that 
               $(T_{j} = T)\land\enabled{\anact{A}{v}}$.}
             \begin{proof}
               \pf\ Case assumption \levelref{<6>2} and the definition of 
               $T$.
             \end{proof}
             \step{<7>2}{$\begin{disj}
                             T_{j}' = \now'\\
                             T_{j}' \in \ccInterval{r+\Delta}{\oo}
                         \end{disj}$}
             \begin{proof}
               \pf\ \stepref{<6>1}, \stepref{<7>1}, $I$.1, and \vbl{TimerAct}.
             \end{proof}
             \step{<7>3}{$j \in V$}
             \begin{proof}
               \pf\ \stepref{<7>1}, case assumption
               \levelref{<6>2}, and the definition of $V$.
             \end{proof}
             \step{<7>4}{$j \notin V'$}
             \begin{proof}
               \pf\ \stepref{<7>2} and the definition of $V$.
             \end{proof}
             \qedstep
             \begin{proof}
              \stepref{<7>3}, \stepref{<7>4}, and $I'.2$.
             \end{proof}
           \end{proof} % step <6>2
           \step{<6>3}{\case{$T \in \ccInterval{r+\Delta}{\oo}$}}
           \begin{proof}
             \pf\ Impossible by \stepref{<6>1} and $I'$.1.
           \end{proof}
           \qedstep
           \begin{proof}
             \pf\ \stepref{<6>2}, \stepref{<6>3}, $I$.3.1, and
             case assumption \levelref{<5>2}
           \end{proof}
         \end{proof} % step <5>1
         \qedstep
         \begin{proof} % step <5>1
           \pf\ \stepref{<5>1} and \stepref{<5>2}.             
         \end{proof} % step <5>1
       \end{proof} % step <4>2

       \step{<4>3}{$P \land I 
             \implies \enabled{\anact{A}{f}}$}
       \begin{proof} % step <4>3
         \pf\  \stepref{<2>1}.
       \end{proof} % step <4>3

       \qedstep
       \begin{proof}
         \pf\ \stepref{<4>1}, \stepref{<4>2}, \stepref{<4>3}, and 
         Lemma~\ref{lemma:sf1}.
       \end{proof}
     \end{proof} % step <3>1
     \step{<3>2}{\assume{$U_{0}$ and $V_{0}$ sets, 
                   with $U_{0} \neq \emptyset$.}
        \prove{$\Pi^{t} \land \Box (\now \in \coInterval{r}{r+\Delta}) \land 
       \WF{(\now,v)}{\act{C}} 
           \;\implies$\\
     \s{1}$((U = U_{0})\land(V = V_{0}))\;\leadsto$\\
             \s{2}$((U \subset U_{0}) \lor 
               ((U \subseteq U_{0})\land(V \subset V_{0})))$}}

     \begin{proof}
        \step{<4>1}{$\Pi^{t} \implies 
           \Box( (U \subseteq U_{0})\land(V \subseteq V_{0})
              \implies \Box( (U \subseteq U_{0})\land(V \subseteq V_{0})))$}
         \begin{proof}
           \pf\ Follows from \stepref{<2>3}.
         \end{proof}

        \qedstep
         \begin{proof}
           \pf\ \stepref{<3>1}, \stepref{<4>1}, and \stepref{<1>2}, since 
           $\Pi^{t} \implies \Box [\vbl{TimerAct}]_{(\now,v)}$
           by assumption \toplevel.\ref{assump:3(b)}.
        \end{proof}
     \end{proof}
     \qedstep
     \begin{proof}
       \pf\ Since $U$ and $V$ are finite by assumption
       \toplevel.\ref{assump:0(d)}, it follows from
         \stepref{<3>2} 
        and the Lattice Rule~\cite{lamport:newtla} that
       $\Pi^{t} \land \Box (\now \in \coInterval{r}{r+\Delta}) \land 
       \WF{(\now,v)}{\act{C}}$ 
           implies $\Diamond (U = \emptyset)$. By \stepref{<2>3},
        $\Pi^{t} \land \Box (\now \in \coInterval{r}{r+\Delta})$ implies 
       $\Diamond (U = \emptyset)\implies \Diamond \Box(U = \emptyset)$.
     \end{proof}
   \end{proof} % step <2>3

   \step{<2>5}{
         $\begin{array}[t]{@{}l@{}}
            \begin{conj}
              \Box (\now \in \coInterval{r}{r+\Delta})\\
              \Box (U = \emptyset)\\
              \Box\inv\\
              \WF{(\now,v)}{\act{C}}
            \end{conj}\\
         \implies \true \leadsto (\now \geq r+\Delta)
          \end{array}$}
   \begin{proof} % step <2>5
       \pflet{\begin{tabbing}
           $\act{N}$ \= $\;\;\deq\;\;$ \=  \kill
           $I$ \> $\;\;\deq\;\;$ \>
               $\begin{conj*}
                  U = \emptyset\\
                  \now \in \coInterval{r}{r+\Delta}\\
                  \inv\\
              \end{conj*}$\\
           $P$ \> $\;\;\deq\;\;$ \> \true\\
           $Q$ \> $\;\;\deq\;\;$ \> $\now \geq r+\Delta$\\
           $\act{N}$ \> $\;\;\deq\;\;$ \>
              \true \\
           \act{A} \> $\;\;\deq\;\;$ \> \act{C}\\
            $f$ \> $\;\;\deq\;\;$ \> $(\now,v)$
        \end{tabbing}}
     \step{<3>1}{$I \land I' \land [\act{N}]_{f} \implies (P' \lor Q')$}
     \begin{proof}
       \pf\ Immediate, since $P'=\true$.
     \end{proof}
     \step{<3>2}{\assume{$P \land I \land I' \land 
                   \anact{N\land\act{A}}{f}$}
                   \prove{$Q'$}}
     \begin{proof} % step <3>2
       \step{<4>1}{$T \in \ccInterval{r+\Delta}{\oo}$}
       \begin{proof}
         \pf\ By $I$.
       \end{proof}
       \step{<4>2}{$\anact{\relax\vbl{NowT}}{\now}$}
       \begin{proof}
         \pf\ By \stepref{<4>1}, $I$.2, and \act{A}.
       \end{proof}
       \qedstep
       \begin{proof}
         \pf\ \stepref{<4>1}, \stepref{<4>2}, and the definition of
         \vbl{NowT}.
       \end{proof}
     \end{proof} % step <3>2

     \step{<3>3}{$P \land I 
                     \implies \enabled{\anact{A}{f}}$}
     \begin{proof} 
        \pf\ \stepref{<3>1}. 
     \end{proof} 
     \qedstep
     \begin{proof}
       \pf\ \stepref{<3>1}, \stepref{<3>2}, \stepref{<3>3}, and 
       Lemma~\ref{lemma:sf1}.
     \end{proof}
   \end{proof} % step <2>5

   \qedstep
   \begin{proof} % step <2>6
      \pf\ \stepref{<2>2}, \stepref{<2>4}, \stepref{<2>5}, \stepref{<1>2}, 
       and temporal logic.
   \end{proof} % step <2>6
%%%%% \end{proof} % step <1>5

\end{proof} % of <1>6


\step{<1>6}{$(\while{E}{M^{t}}, E \implies \WF{(\now,v)}{\act{C}})$ 
            is $\mu$-machine realizable.}
\begin{proof} % step <1>7
  \step{<2>1}{$M^{t}$ constrains at most $\mu$.}
  \begin{proof} % <2>1
    \step{<3>1}{$M$ constrains at most $\mu$}
     \begin{proof}
      \pf\ Assumption \toplevel.\ref{assump:5}.
     \end{proof}
    \step{<3>2}{$RT_{v}$ constrains at most $\mu$.}
     \begin{proof}
      \pf\ Assumption \toplevel.\ref{assump:6(b)}.
     \end{proof}
    \step{<3>3}{For all $i$ in $I$, 
                $\vbl{MinTime}(t_{i}, \act{A}_{i}, v)$ constrains at 
                most $\mu$.}
     \begin{proof}
      \pf\ By definition of \vbl{MinTime}, a step violates 
       $\vbl{MinTime}(t_{i}, \act{A}_{i}, v)$
       only if it is an \anact{A_{i}}{v} step, so this follows from 
       Assumption \toplevel.\ref{assump:6(a)}.
     \end{proof}
    \step{<3>4}{For all $j$ in $J$, $\vbl{MaxTime}(T_{j})$ constrains at 
                 most $\mu$.}
     \begin{proof}
      \pf\ Assumption \toplevel.\ref{assump:6(b)}.
     \end{proof}
    \qedstep
     \begin{proof}
      \pf\ \stepref{<3>1}--\stepref{<3>4} and the definition of $M^{t}$.
     \end{proof}
  \end{proof} % <2>1

%  \step{<2>2}{$\Pi^{t} \implies \Box \enabled{\anact{C}{(\now,v)}}$}
%  \begin{proof} % <2>2
%      \pf\ \stepref{4.5} and \stepref{05}.
%  \end{proof} % <2>2
  \qedstep
  \begin{proof} % <2>3
    \pf\ We apply Proposition~\ref{prop:fairness-is-machine-realizable},
   with $E$ substituted for $\Phi$, $M^{t}$ substituted for $\Pi$,
   and the single formula \WF{(\now,v)}{\act{C}}.  Step \stepref{<2>1}
   asserts that $M^{t}$ constrains at most $\mu$.  The three numbered
  hypotheses of the proposition are proved as follows:
   \begin{enumerate}
     \item \stepref{<1>4}.
     \item Assumptions \toplevel.\ref{assump:6(a)} and 
           \toplevel.\ref{assump:6(b)} and the definition of \act{C}.
     \item Vacuous.
   \end{enumerate}
  \end{proof} % <2>3
\end{proof} % step <1>7

\step{<1>7}{$(\true, \NZ{\oo})$ is $\mu$-machine realizable.}
\begin{proof}
  \pf\ Assumption \toplevel.\ref{assump:6(b)}.
\end{proof}


\qedstep
\begin{proof}
  \pf\ Proposition~\ref{prop:proving-while-machine-realizability}, using
\toplevel.\ref{assump:5},
\stepref{<1>6}, \stepref{<1>7}, and \stepref{<1>5}.
\end{proof}

\end{proof} % theorem

%try
\subsubsection{Detailed Proof of the Theorem} \label{sec:detailed-proof}
\pfhidelevel{99}
\begin{proof} % theorem

\step{<1>1}{Choose $J_{P}$ and $J_{V}$ such that:
   \begin{enumerate}
        \item \(J = J_{P} \cup J_{V}\)
        \item \(J_{P} \cap J_{V} = \emptyset\)
        \item \(\forall j \in J_{V} : \Pi \implies 
            \vbl{VTimer}(T_{j}, \act{A}_{j}, \Delta_{j}, v)\)
        \item \(\forall j \in J_{P} : 
            \Pi \implies PTimer(T_{j}, \act{A}_{j}, \Delta_{j}, v) \)
     \end{enumerate}}

\step{<1>2}{$\Pi^{t} \implies \Box \inv$, where\\
  \s{1}\inv $\;\;\deq\;\;$%
   \(\begin{conj*}
       \forall j \in J : T_{j} \in \ccInterval{\now}{\oo} \\
       \now \in \Real \\
       \forall j \in J : 
            \begin{array}[t]{@{}l@{}}
              (\enabled{\anact{A_{j}}{v}} = \\
               \s{1}\enabled{(\anact{A_{j}}{v} \land (\now'=\now))}
             \end{array}\\
        \forall k \in I \cap J : t_{k} \leq T_{k}\\
       \forall j\in J_{V} :
          \lnot\enabled{\anact{A_{j}}{v}}\implies (T_{j}=\infty)
    \end{conj*}\) }
  \begin{proof}
    \step{<2>1}{$\RT_{v}\implies\Box\inv.2$}
        \begin{proof}
          \pf\ An invariance proof.
        \end{proof}
    \step{<2>2}{For all $j\in J$ : $\Pi\land \Box\inv.2 
                \land\vbl{MaxTime}(T_{j})\implies\Box\inv.1$}
        \begin{proof}
          \pf\ Assumption \toplevel.\ref{assump:0(c)} and an
          invariance proof.
        \end{proof}
    \step{<2>3}{$\Pi^{t}\implies\Box\inv.3$}
        \begin{proof}
          \pf\ Assumption \toplevel.\ref{assump:3(c)}.
        \end{proof}
    \step{<2>4}{$\Pi^{t}\implies\Box\inv.4$}
        \begin{proof}
          \pf\ Assumption \toplevel.\ref{assump:1and4}.
        \end{proof}
    \step{<2>5}{$\Pi^{t}\implies\Box\inv.5$}
        \begin{proof}
          \pf\ \stepref{<1>1}.3, assumption
        \toplevel.\ref{assump:3(d)}, and an invariance proof.
        \end{proof}
    \qedstep
  \end{proof} % of step{05}


\step{<1>3}{\begin{enumerate}
 \item $\Pi = Init \land \Box \act{M}$
  \item $\Pi^{t} = Init^{t} \land \Box \act{N}^{t}$, for some predicate
          $\init^{t}$.
  \end{enumerate}
where\\
\s{1}%
  \act{M} $\;\;\deq\;\;$ 
      \(\begin{conj}
          [\act{N}]_{w}\\
          \forall j \in J_{P} : 
               \vbl{PTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)\\
          \forall j \in J_{V} : 
               \vbl{VTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)
       \end{conj}\)\\
\s{1}%
  $\act{N}^{t}$ $\;\;\deq\;\;$ 
      \(\begin{conj}
          \act{M} \\
          \vbl{RTact}_{v} \\
          \forall i \in I : \vbl{MinTact}(t_{i}, \act{A}_{i}, v)\\
          \forall j \in J : \vbl{MaxTact}(T_{j})
       \end{conj}\)}

\step{<1>4}{\anact{C}{(\now,v)} is a subaction of $\Pi^{t}$.}
\begin{proof} % step 4

%%%%%%%%%%%%% low level: start correcting here %%%%%%%%%%%%%%%%
\step{<2>1}{For all $j$ in $J$ : \anact{B_{j}^{t}}{v} is a subaction of 
         $\Pi^{t}$.}
  \begin{proof} % step 2
   \assume{$j \in J$}
   \prove{$\Pi^{t} \implies \Box \,(\,\enabled{\anact{B_{j}^{t}}{v}} 
    \;\implies\; \enabled{(\anact{B_{j}^{t}}{v} \land \act{N}^{t})}\,)$}

  \step{<3>1}{$\Pi^{t} \implies
      \Box \,(\begin{array}[t]{@{}l@{}}
             \enabled{(\anact{B_{j}^{t}}{v}\land\act{M})} \;\implies \\
              \iftoplas{\s{.25}}{\s{1}}
               \enabled{(\begin{conj}
                          \anact{B_{j}^{t}}{v} \land \act{M}\\
                          \forall i \in I - \{j\} : 
                             \lnot(\anact{A_{i}}{v} 
                                 \land \anact{A_{j}}{v} \land\act{M})
                             \,\lor\, (t_{i}\leq T_{j})
                            \,)\,)
                         \end{conj}}
         \end{array}$}
       \begin{proof}
         \step{<4>1}{$\Pi^{t}\;\implies\;
                 \lnot\enabled{(\exists\, i \in I - \{j\} : 
                               (\anact{A_{i}}{v} 
                                 \land \anact{A_{j}}{v} \land\act{M})
                                 \,\land\,\lnot(t_{i}\leq T_{j}))}$}
              \begin{proof}
               \pf\ \stepref{<1>3}.1, assumption \toplevel.\ref{assump:1and4},  
               \fact{2}, and \fact{3}.
              \end{proof}

        \qedstep
          \begin{proof}
            \pf\ \fact{1}, substituting 
            $\anact{B_{j}^{t}}{v} \land \act{M}$ for \act{A}
             and $\exists\, i \in I - \{j\} : 
                               (\anact{A_{i}}{v} 
                                 \land \anact{A_{j}}{v} \land\act{M})
                                 \,\land\,\lnot(t_{i}\leq T_{j})$
           for \act{B}.
           \end{proof}
       \end{proof}

  \step{<3>2}{
     \( \begin{conj}
          \anact{B_{j}^{t}}{v} \land \act{N}^{t} \\
          \forall i \in I - \{j\} : 
             \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M}) 
                             \,\lor\, (t_{i}\leq T_{j})
       \end{conj}\)\\
        \(=\; \begin{conj}
                \anact{B_{j}^{t}}{v} \land \act{M}\\
                \forall i \in I - \{j\} : 
                 \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M}) 
                            \,\lor\, (t_{i}\leq T_{j})
               \end{conj}\)}
     \begin{proof} % step 2.2
       \begin{tabbing}
        \pf\ \= \+ 
          $\begin{conj}
            \anact{B_{j}^{t}}{v} \land \act{N}^{t}\\
            \forall i \in I - \{j\} : 
                \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M})
                            \,\lor\, (t_{i}\leq T_{j})
          \end{conj}$ \\
%
         \s{.5}\=\+ $=$ \= [by definition of $\anact{B_{j}^{t}}{v}$]\\*
          \> $\begin{conj}
               \act{A}_{j}^{t} \land (v'\neq v) \land (\now'=\now) 
                      \land (T_{j}=\now)
                      \land \act{N}^{t}\\
               \forall i \in I - \{j\} : 
                  \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M})
                            \,\lor\, (t_{i}\leq T_{j})
              \end{conj}$\\
%
           $=$ \> [by definition  of $\act{N}^{t}$]\\*
           \>  $\begin{conj}
                  \act{A}_{j}^{t} \land \act{M} \land (v'\neq v)
                     \land (\now'=\now) 
                      \land (T_{j}=\now) \\
                   \forall i \in I : \act{A}_{i} \implies (t_{i} \leq \now)\\
                   \forall i \in I - \{j\} : 
                      \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} 
                            \land \act{M})
                            \,\lor\, (t_{i}\leq T_{j})
               \end{conj}$\\
%
            $=$ \> [by definition of $\act{A}_{j}^{t}$]\\*
            \> $\begin{conj}
                  P_{j} \land \act{A}_{j} \land \act{M} \land (v'\neq v) 
                     \land (\now'=\now) \land (T_{j}=\now)  \\
                  \forall i \in I : \act{A}_{i} \implies (t_{i} \leq \now)\\
                  \forall i \in I - \{j\} : 
                     \lnot(\act{A}_{i} \land \act{A}_{j} \land \act{M} \land 
                            (v'\neq v)) 
                            \,\lor\, (t_{i}\leq T_{j})
                \end{conj}$\\
%
            $=$ \> [by predicate logic]\\*
             \> $\begin{conj}
                   P_{j} \land \act{A}_{j} \land \act{M} \land (v'\neq v) 
                    \land (\now'=\now)\land (T_{j}=\now) \\
                   (j \in I) \implies (t_{j} \leq \now)\\
                   \forall i \in I - \{j\} : 
                      \lnot(\act{A}_{i} \land \act{A}_{j} \land \act{M} 
                         \land (v'\neq v))
                            \,\lor\, (t_{i}\leq T_{j})
                \end{conj}$\\
%
          $=$ \> [by definition of \anact{A_{k}}{v}]\\*
           \> $\begin{conj}
                P_{j} \land \act{A}_{j} \land \act{M} \land (v'\neq v) 
                   \land (\now'=\now) \land (T_{j}=\now)\\
                (j \in I) \implies (t_{j} \leq \now)\\
                \forall i \in I - \{j\} : 
                   \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M})
                            \,\lor\, (t_{i}\leq T_{j})
               \end{conj}$\\
%
          $=$ \> [by definition of $P_{j}$]\\*
           \> $\begin{conj}
                 P_{j} \land \act{A}_{j} \land (v'\neq v) \land (\now'=\now) 
                   \land (T_{j}=\now)\land \act{M}\\
                 \forall i \in I - \{j\} : 
                   \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M})
                            \,\lor\, (t_{i}\leq T_{j})
              \end{conj}$\\
%
          $=$ \> [by definition of \anact{B_{j}^{t}}{v}]\\*
           \> $\begin{conj}
                 \anact{B_{j}^{t}}{v} \land \act{M}\\
                 \forall i \in I - \{j\} : 
                   \lnot(\anact{A_{i}}{v} \land \anact{A_{j}}{v} \land \act{M})
                            \,\lor\, (t_{i}\leq T_{j})
              \end{conj}$
       \end{tabbing}
     \end{proof} % step 2.2
   \step{<3>3}{$\Pi^{t} \implies \Box 
            \,(\,\enabled{(\anact{B_{j}^{t}}{v} \land \act{M})} \implies 
                     \enabled{(\anact{B_{j}^{t}}{v} \land \act{N}^{t})}\,)\,$}
     \begin{proof}
      \pf\ \stepref{<3>1}, \stepref{<3>2}, and \fact{4}. 
     \end{proof}
        
   \step{<3>4}{$\Pi^{t} \implies 
                \Box (P_{j} \land (T_{j}=\now) 
                          \land \enabled{\anact{B_{j}}{v}} \implies 
                  P_{j} \land (T_{j}=\now) 
                          \land \enabled{(\anact{B_{j}}{v} \land \act{M})})$}
     \begin{proof}
       \pf\ 
     \stepref{<1>3}, Assumption \toplevel.\ref{assump:3(a)}, and
     the definition of $\act{B}_{j}$.  
     \end{proof}
        
   \step{<3>5}{$\Pi^{t} \implies \Box 
                \,(\,(\enabled{\anact{B_{j}^{t}}{v}}) \implies 
                      \enabled{(\anact{B_{j}^{t}}{v} \land \act{M})}\,)$}
      \begin{proof}
        \pf\ \stepref{<3>4}, the definition of $\act{B}_{j}^{t}$, and \fact{2}. 
      \end{proof}
        

   \qedstep
      \begin{proof}
         \pf\ \stepref{<3>5} and \stepref{<3>3}. 
      \end{proof}
  \end{proof} % step 2

\step{<2>2}{\anact{\relax\vbl{NowT}}{\now} is a subaction of $\Pi^{t}$.}
\begin{proof} % step 3
   \step{<3>1}{$\Pi^{t} \,\implies\,
      \Box\,(\,\begin{array}[t]{@{}l@{}}
                 (\enabled{\anact{\relax\vbl{NowT}}{\now}})\;\implies \\
                   \s{1}
                  (\enabled{(\anact{\relax\vbl{NowT}}{\now} 
                               \land\act{M})})\,)
                \end{array}$}
   \begin{proof}
     \step{<4>1}{$\Pi^{t} \,\implies\,
      \Box\,(\,\begin{array}[t]{@{}l@{}}
                 (\enabled{\vbl{NowT})\;\implies\;
 %%%%                   \\ \s{1}
                  (\enabled{(\vbl{NowT}\land\act{M})})\,)
                \end{array}$}
      }
        \begin{proof} \pf\ \stepref{<1>3},
          assumption \toplevel.\ref{assump:2(b)}, and the definition
         of \vbl{NowT}, since $\Pi^{t}$ implies $\Pi$.
       \end{proof}        
     \qedstep
       \begin{proof} \pf\  \stepref{<4>1} and
           \fact{2}, substituting $\now\neq T$ for $P$ 
           (since \anact{\relax\vbl{NowT}}{\now} equals
            $\vbl{NowT}\land(\now\neq T)$).
       \end{proof}
   \end{proof}

   \step{<3>2}{$\Pi^{t} \implies \Box 
              (
     \begin{array}[t]{@{}l@{}}
       \enabled{(\anact{\relax\vbl{NowT}}{\now} \land \act{M})}
                       \; \implies \\
        \s{2}\enabled{(\anact{\relax\vbl{NowT}}{\now} \land \act{N}^{t})})
      \end{array}$} 
                 %% note: actually have =, not just \implies
  \begin{proof}
    \step{<4>1}{$(\inv\land \anact{\relax\vbl{NowT}}{\now} \land \act{M})
                 \implies (\anact{\relax\vbl{NowT}}{\now} \land \act{N}^{t})$}
      \begin{proof}
        \step{<5>1}{$ \inv \land \anact{\relax\vbl{NowT}}{\now} \implies
                    \vbl{RTact}_{v}$}
        \begin{proof}
          \pf\ \stepref{<1>3} (\inv.1 and \inv.2).
        \end{proof}

      \step{<5>2}{$\forall i \in I : \anact{\relax\vbl{NowT}}{\now} \implies 
                     \vbl{MinTact}(t_{i}, \act{A}_{i}, v)$}
      \begin{proof}
         \pf\ $\vbl{MinTact}(t_{i}, \act{A}_{i}, v) = [\,\ldots\,]_{v}$,
                  and \anact{\relax\vbl{NowT}}{\now} implies 
    \iftoplas{}{\linebreak}%%%%%
             $v'=v$.
      \end{proof}
      \step{<5>3}{$\forall j \in J : 
                    \inv \land \anact{\relax\vbl{NowT}}{\now} \land \act{M}
                                 \implies \vbl{MaxTact}(T_{j})$}
      \assume{\begin{enumerate}
               \item $j\in J$
                \item $\inv \land \anact{\relax\vbl{NowT}}{\now} \land \act{M}$
              \end{enumerate}}
      \prove{$\vbl{MaxTact}(T_{j})$}

      \begin{proof} % step 4.1.3
        \step{<6>1}{\case{\enabled{\anact{A_{j}}{v}}}}
        \begin{proof}
         \step{<7>1}{$\now' \leq T_{j}$}
            \begin{proof}
                  \pf\ \inv.1, \inv.2, \anact{\relax\vbl{NowT}}{\now}, 
                 and the definitions of \vbl{NowT}, since
                 case assumption \levelref{<6>1} and the
                definition of $T$ imply $T_{j}\geq T$.
            \end{proof}
         \step{<7>2}{\case{$j\in J_{P}$}}
            \begin{proof}
                \step{<8>1}{\case{$T_{j}'=T_{j}$}}
                   \begin{proof}
                   \pf\ \stepref{<7>1} and the definition
                 of $\vbl{MaxTact}(T_{j})$.
                   \end{proof}
                \step{<8>2}{\case{$T_{j}'=\now+\Delta_{j}$}}
                  \begin{proof}
                    \pf\ \inv.2, \anact{\relax\vbl{NowT}}{\now}, and 
                   definition of 
                  $\vbl{MaxTact}(T_{j})$.\hspace*{-3pt}
                  \end{proof}
                \qedstep
                   \begin{proof}
                    \pf\ \stepref{<8>1}, \stepref{<8>2}, and case assumption
                     \levelref{<7>2}, since 
                     case assumption \levelref{<6>1}
                    and the definition of 
                    $\vbl{PTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)$
                    imply that these are the only possibilities.
                   \end{proof}
            \end{proof}
         \step{<7>3}{\case{$j\in J_{V}$}}
           \begin{proof}
            \step{<8>1}{$T_{j} = T_{j}'$}
              \begin{proof}
                \pf\ Case assumption \levelref{<7>3} and the definitions 
                 of \act{M} and 
\iftoplas{\linebreak}{}%
                 $\vbl{VTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)$,
                 since \anact{\relax\vbl{NowT}}{v} implies
                 $v=v'$.
              \end{proof}
            \qedstep
              \begin{proof}
                \pf\ \stepref{<7>1}, \stepref{<8>1}, 
                 and the definition
                 of $\vbl{MaxTact}(T_{j})$.
              \end{proof}
           \end{proof}
         \qedstep
           \begin{proof}
              \pf\ \stepref{<7>2}, \stepref{<7>3}, \stepref{<1>1}.1, and
              assumption \levelref{<5>3}.1.
           \end{proof}
        \end{proof} % of 4-1/2.1

        \step{<6>2}{\case{$\lnot\enabled{\anact{A_{j}}{v}}$}}
          \begin{proof}
           \step{<7>1}{$\now,\now'\in\Real$ and $\now' > \now$.}
             \begin{proof}
               \pf\ \inv.1, \inv.2,  \anact{\relax\vbl{NowT}}{\now}, 
               and the definition of $T$.
             \end{proof}
           \step{<7>2}{\case{$j\in J_{P}$}}
            \begin{proof} 
             \step{<8>1}{$T_{j}' \geq \now'$}
                \begin{proof}
                  \pf\ \stepref{<7>1}, case assumption \levelref{<7>2}, \inv.1,
                    and the definitions of \act{M} and
                    $\vbl{PTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)$.
                \end{proof}             
             \qedstep
              \begin{proof}
                \pf\ \stepref{<8>1} and the definition of 
                 $\vbl{MaxTact}(T_{j})$.
              \end{proof}
            \end{proof} % of 5.1
           \step{<7>3}{\case{$j\in J_{V}$}}
             \begin{proof}
               \step{<8>1}{$T_{j} = \infty$}
                 \begin{proof}
                  \pf\ By case assumption \levelref{<7>3} and \inv.5.
                 \end{proof}
               \step{<8>2}{$T_{j}' = \infty$}
                 \begin{proof}
                   \pf\ \stepref{<8>1}, case assumption \levelref{<7>3}, 
                        and the definitions of \act{M} and
                    $\vbl{VTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)$,
                    since \anact{\relax\vbl{NowT}}{v} implies
     \iftoplas{}{\linebreak}%%%%
                    $v=v'$.
                 \end{proof}
               \qedstep
                 \begin{proof}
                   \pf\ \stepref{<7>1}, \stepref{<8>2},
                    and the definition
                    of $\vbl{MaxTact}(T_{j})$.
                 \end{proof}
            \end{proof} % of 5.2

           \qedstep                   
           \begin{proof}
              \pf\ \stepref{<7>2}, \stepref{<7>3}, \stepref{<1>1}.1, and
              assumption \levelref{<5>3}.1.
           \end{proof}

          \end{proof} % of step 4-1/2.2

        \qedstep
          \begin{proof}
            \pf\ \stepref{<6>1} and \stepref{<6>2}.
          \end{proof}
      \end{proof} % of 4.1.3
    \qedstep
     \begin{proof}
           \pf\ \stepref{<5>1}, \stepref{<5>2}, \stepref{<5>3},
        and the definition of $\act{N}^{t}$.
     \end{proof}
    \end{proof} % of 4.1

    \qedstep
     \begin{proof}
      \pf\ \stepref{<4>1} and \stepref{<1>2}, since by
      \fact{2} and \fact{4},
      $\inv\land\act{D}\implies\act{E}$
       implies 
    $\Box\inv\implies\Box((\enabled{\act{D}})\implies(\enabled{\act{E}}))$,
   for any actions \act{D} and \act{E}.
     \end{proof}

  \end{proof} % of 3.2

   \qedstep
   \begin{proof} % step 3.3
      \pf\ \stepref{<3>1} and \stepref{<3>2}.
   \end{proof} % step 3.3
\end{proof} % step 3

\qedstep
\end{proof} % step 4



\step{<1>5}{$\Pi^{t} \land \WF{(\now,v)}{\act{C}} \implies \NZ{\oo}$}
\begin{proof} % of <1>6
\assume{$r\in\Real$}
\prove{$\Pi^{t} \land \WF{(\now,v)}{\act{C}}
   \;\implies\; 
    (\,(\now = r) \leadsto (\now \in \coInterval{r+\Delta}{\oo})\,)$}
  \pflet{\begin{tabbing}
%
    $U$ \= $\;\;\deq\;\;$ \= $\{j \in J : T_{j} < r+\Delta\}$\\
%
    $V$ \> $\;\;\deq\;\;$ \> $\{j \in J : \now < T_{j} < r+\Delta\}$\\
%
    \vbl{TimerAct} \= $\;\;\deq\;\;$ \= 
        $\forall j \in J : 
           \begin{disj}
              \vbl{VTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)\\
              \vbl{PTact}(T_{j}, \act{A}_{j}, \Delta_{j}, v)
           \end{disj}$
    \end{tabbing}}


\step{<2>1}{$\inv\implies\enabled{\anact{C}{(\now,v)}}$}
    \begin{proof}
        \step{<3>1}{\case{$T \neq \now$}}
         \begin{proof} 
           \pf\ By the definition of \act{C}, since
            case assumption \levelref{<3>1} implies
\iftoplas{\linebreak}{}%
           $\enabled{\anact{\relax\vbl{NowT}}{\now}}$.
         \end{proof} 
         \step{<3>2}{\case{$T =  \now$}}
         \begin{proof} 
           \step{<4>1}{Choose $j\in J$ such that
                   $(T_{j}=T)\land\enabled{\anact{A_{j}}{v}}$.}
             \begin{proof}
              \pf\ \inv.2, case assumption \levelref{<3>2}, and
              the definition of $T$.
             \end{proof}

           \step{<4>2}{$(T_{j}=T)\land\enabled{\anact{B_{j}}{v}}$}
              \begin{proof}
                \pf\ \stepref{<4>1}, \inv.3, and the definition of
                 \anact{B_{j}}{v}.
              \end{proof}


           \step{<4>3}{\enabled{\anact{B^{t}_{j}}{v}}}
              \begin{proof}
                \pf\  \stepref{<4>2}, \inv.4, case assumption 
               \levelref{<3>2}, and the definition of
                 \anact{B^{t}_{j}}{v}.
              \end{proof}

          \qedstep
            \begin{proof}
            \pf\ Case assumption \levelref{<3>2}, \stepref{<4>3},
             and the definition of \act{C}.
            \end{proof}

         \end{proof} 
         \qedstep
         \begin{proof} 
           \pf\ \stepref{<3>1} and \stepref{<3>2}.
         \end{proof} 
\end{proof}

   \step{<2>2}{$\begin{array}[t]{@{}l@{}}
               \Pi^{t} \;\implies\\*
               \s{.75}\Box((\now = r) \land \Box (\now \in
                     \ooInterval{-\oo}{r+\Delta})
                 \,\implies\, \Box (\now \in \coInterval{r}{r+\Delta}))
              \end{array}$}
   \begin{proof} % step <2>1
     \step{<3>1}{$\Box [\vbl{RTact}_{v}]_{\now} 
                    \implies ((\now = r) \implies 
                 \Box (\now \in \coInterval{r}{\oo}))$}
     \begin{proof}
       \pf\ A standard invariance argument.
     \end{proof}

     \step{<3>2}{$\Box [\vbl{RTact}_{v}]_{\now} 
         \implies \Box ((\now = r) \implies 
                       \Box (\now \in \coInterval{r}{\oo}))$}
     \begin{proof}
       \pf\ \stepref{<3>1} and simple temporal logic.
     \end{proof}

     \step{<3>3}{$\Pi^{t} \implies 
            \Box((\now = r) \implies \Box (r \leq \now))$}
     \begin{proof}
       \pf\ \stepref{<3>2}, since $\Pi^{t} \implies RT_{v}$ and 
       $RT_{v} \implies \Box [\vbl{RTact}_{v}]_{\now}$.
     \end{proof}
     \qedstep
     \begin{proof}
      \pf\ \stepref{<3>3}, using the temporal logic tautology
         \[(F \leadsto G) \implies ((F\land \Box H) 
               \leadsto (G \land \Box H))\]       
     \end{proof}
   \end{proof} % step <2>1

   \step{<2>3}{\assume{$j\in J$}
     \prove{\begin{enumerate}
       \item $\Pi^{t} \land \Box(\now\in\coInterval{r}{r+\Delta})
             \,\implies\, \Box ((j \notin U) \implies \Box (j \notin U))$
       \item $\Pi^{t} \land \Box(\now\in\coInterval{r}{r+\Delta})
           \,\implies\, \Box ((j \notin V) \implies \Box (j \notin V))$
      \end{enumerate}}}
   \begin{proof} % step <2>2
     \pf\ A standard invariance proof, using assumption 
     \toplevel.\ref{assump:3(b)}.
   \end{proof} % step <2>2

   \step{<2>4}{$\Pi^{t} \land \Box (\now \in \coInterval{r}{r+\Delta}) \land 
       \WF{(\now,v)}{\act{C}} 
           \,\implies\, \Diamond \Box (U = \emptyset)$}
   \begin{proof} % step <2>3
      \pfsketch\ 
      The set $V$ consists of those timers in $U$ that are
      not equal to \now.  To prove that $U$ is eventually empty,
      we show that, whenever $U$ is nonempty, eventually $U$ or $V$ 
      gets smaller.  Since $U$ and $V$ are finite, $U$ must eventually
      become empty.      

      \step{<3>1}{\assume{$U_{0}$ and $V_{0}$ sets, 
                   with $U_{0} \neq \emptyset$.}
        \prove{$\begin{array}[t]{@{}l@{}}
           \begin{conj}
             \Box ((U \subseteq U_{0})\land(V \subseteq V_{0}))\\
             \Box (\now \in \coInterval{r}{r+\Delta})\\
             \Box \inv\\
             \Box [\vbl{TimerAct}]_{(\now,v)}\\
             \WF{(\now,v)}{\act{C}}
         \end{conj}\\
           \s{1}\implies ((U = U_{0})\land(V = V_{0}))\;\leadsto\\
             \s{3.5}(U \subset U_{0}) \lor 
               ((U \subseteq U_{0})\land(V \subset V_{0}))
        \end{array}$}}
     \begin{proof} % step <3>1
        \pfsketch\ This is a straightforward application of 
        rule WF1 (Lemma~\ref{lemma:sf1}), with the following
        substitutions.
       \pflet{\begin{tabbing}
           $\act{N}$ \= $\;\;\deq\;\;$ \=  \kill
           $I$ \> $\;\;\deq\;\;$ \>
               $\begin{conj*}
                  \now \in \coInterval{r}{r+\Delta}\\
                (U \subseteq U_{0})\land(V \subseteq V_{0})\\
                \inv
              \end{conj*}$\\
           $P$ \> $\;\;\deq\;\;$ \> $(U = U_{0})\land(V = V_{0})$\\
           $Q$ \> $\;\;\deq\;\;$ \> $(U \subset U_{0}) \lor 
               ((U \subseteq U_{0})\land(V \subset V_{0}))$\\
           $\act{N}$ \> $\;\;\deq\;\;$ \>
              $\vbl{TimerAct}$\\
           \act{A} \> $\;\;\deq\;\;$ \> \act{C}\\
            $f$ \> $\;\;\deq\;\;$ \> $(\now,v)$
        \end{tabbing}}
       \step{<4>1}{$I' \implies (P' \lor Q')$}
       \begin{proof}
         \pf\ Obvious.
       \end{proof}

       \step{<4>2}{\assume{$P \land I \land I' \land 
                     \anact{N\land \act{A}}{f}$}
                   \prove{$Q'$}}
       \begin{proof} % step <4>2
         \step{<5>1}{\case{$T=\now$}}
         \begin{proof} % step <5>1
           \step{<6>1}{Choose $j$ in $J$ 
             such that $(T_{j} = T) \land \anact{B_{j}^{t}}{v}$.}
           \begin{proof}
             \pf\ \act{A} (from case assumption \levelref{<4>2})
                and case assumption \levelref{<5>1}.
           \end{proof}
           \step{<6>2}{$T_{j}' \geq r+\Delta$}
           \begin{proof}
             \pf\ \stepref{<6>1}, $I.1$, the
               definition of $\act{B}_{j}^{t}$, and \vbl{TimerAct}.
           \end{proof}
           \step{<6>3}{$j \in U \land j \notin U'$}
           \begin{proof}
             \pf\ \stepref{<6>1}, case assumption \levelref{<5>1},
             and $I$.1.
           \end{proof}
           \step{<6>4}{$j \notin U'$}
           \begin{proof}
             \pf\ \stepref{<6>2}.
           \end{proof}
           \qedstep
           \begin{proof}
             \pf\ \stepref{<6>3}, \stepref{<6>4}, and $I'$.2.
           \end{proof}
         \end{proof} % step <5>1
         \step{<5>2}{\case{$T\neq\now$}}
         \begin{proof} % step <5>1
           \step{<6>1}{$(\now'=T) \,\land\, (v'=v)$}
           \begin{proof}
             \pf\ \act{A} and case assumption \levelref{<5>2}.
           \end{proof}
           \step{<6>2}{\case{$T \in (\now,r+\Delta)$}}
           \begin{proof} % step <6>2
             \step{<7>1}{Choose $j$ in $J$ such that 
               $(T_{j} = T)\land\enabled{\anact{A}{v}}$.}
             \begin{proof}
               \pf\ Case assumption \levelref{<6>2} and the definition of 
               $T$.
             \end{proof}
             \step{<7>2}{$\begin{disj}
                             T_{j}' = \now'\\
                             T_{j}' \in \ccInterval{r+\Delta}{\oo}
                         \end{disj}$}
             \begin{proof}
               \pf\ \stepref{<6>1}, \stepref{<7>1}, $I$.1, and \vbl{TimerAct}.
             \end{proof}
             \step{<7>3}{$j \in V$}
             \begin{proof}
               \pf\ \stepref{<7>1}, case assumption
               \levelref{<6>2}, and the definition of $V$.
             \end{proof}
             \step{<7>4}{$j \notin V'$}
             \begin{proof}
               \pf\ \stepref{<7>2} and the definition of $V$.
             \end{proof}
             \qedstep
             \begin{proof}
              \stepref{<7>3}, \stepref{<7>4}, and $I'.2$.
             \end{proof}
           \end{proof} % step <6>2
           \step{<6>3}{\case{$T \in \ccInterval{r+\Delta}{\oo}$}}
           \begin{proof}
             \pf\ Impossible by \stepref{<6>1} and $I'$.1.
           \end{proof}
           \qedstep
           \begin{proof}
             \pf\ \stepref{<6>2}, \stepref{<6>3}, $I$.3.1, and
             case assumption \levelref{<5>2}.
           \end{proof}
         \end{proof} % step <5>1
         \qedstep
         \begin{proof} % step <5>1
           \pf\ \stepref{<5>1} and \stepref{<5>2}.             
         \end{proof} % step <5>1
       \end{proof} % step <4>2

       \step{<4>3}{$P \land I 
             \implies \enabled{\anact{A}{f}}$}
       \begin{proof} % step <4>3
         \pf\  \stepref{<2>1}.
       \end{proof} % step <4>3

       \qedstep
       \begin{proof}
         \pf\ \stepref{<4>1}, \stepref{<4>2}, \stepref{<4>3}, and 
         Lemma~\ref{lemma:sf1}.
       \end{proof}
     \end{proof} % step <3>1
     \step{<3>2}{\assume{$U_{0}$ and $V_{0}$ sets, 
                   with $U_{0} \neq \emptyset$.}
        \prove{$\Pi^{t} \land \Box (\now \in \coInterval{r}{r+\Delta}) \land 
       \WF{(\now,v)}{\act{C}} 
           \;\implies$\\*
     \s{1}$((U = U_{0})\land(V = V_{0}))\;\leadsto$\\*
             \s{2}$((U \subset U_{0}) \lor 
               ((U \subseteq U_{0})\land(V \subset V_{0})))$}}

     \begin{proof}
        \step{<4>1}{$\Pi^{t} \implies 
           \Box( (U \subseteq U_{0})\land(V \subseteq V_{0})
              \implies \Box( (U \subseteq U_{0})\land(V \subseteq V_{0})))$}
         \begin{proof}
           \pf\ Follows from \stepref{<2>3}.
         \end{proof}

        \qedstep
         \begin{proof}
           \pf\ \stepref{<3>1}, \stepref{<4>1}, and \stepref{<1>2}, since 
           $\Pi^{t} \implies \Box [\vbl{TimerAct}]_{(\now,v)}$
           by assumption \toplevel.\ref{assump:3(b)}.
        \end{proof}
     \end{proof}
     \qedstep
     \begin{proof}
       \pf\ Since $U$ and $V$ are finite by assumption
       \toplevel.\ref{assump:0(d)}, it follows from
         \stepref{<3>2} 
        and the Lattice Rule~\cite{lamport:newtla} that
       $\Pi^{t} \land \Box (\now \in \coInterval{r}{r+\Delta}) \land 
       \WF{(\now,v)}{\act{C}}$ 
           implies $\Diamond (U = \emptyset)$. By \stepref{<2>3},
        $\Pi^{t} \land \Box (\now \in \coInterval{r}{r+\Delta})$ implies 
       $\Diamond (U = \emptyset)\implies \Diamond \Box(U = \emptyset)$.
     \end{proof}
   \end{proof} % step <2>3

   \step{<2>5}{
         $\begin{array}[t]{@{}l@{}}
            \begin{conj}
              \Box (\now \in \coInterval{r}{r+\Delta})\\
              \Box (U = \emptyset)\\
              \Box\inv\\
              \WF{(\now,v)}{\act{C}}
            \end{conj}\\
         \implies \true \leadsto (\now \geq r+\Delta)
          \end{array}$}
   \begin{proof} % step <2>5
       \pflet{\begin{tabbing}
           $\act{N}$ \= $\;\;\deq\;\;$ \=  \kill
           $I$ \> $\;\;\deq\;\;$ \>
               $\begin{conj*}
                  U = \emptyset\\
                  \now \in \coInterval{r}{r+\Delta}\\
                  \inv\\
              \end{conj*}$\\
           $P$ \> $\;\;\deq\;\;$ \> \true\\
           $Q$ \> $\;\;\deq\;\;$ \> $\now \geq r+\Delta$\\
           $\act{N}$ \> $\;\;\deq\;\;$ \>
              \true \\
           \act{A} \> $\;\;\deq\;\;$ \> \act{C}\\
            $f$ \> $\;\;\deq\;\;$ \> $(\now,v)$
        \end{tabbing}}
     \step{<3>1}{$I \land I' \land [\act{N}]_{f} \implies (P' \lor Q')$}
     \begin{proof}
       \pf\ Immediate, since $P'=\true$.
     \end{proof}
     \step{<3>2}{\assume{$P \land I \land I' \land 
                   \anact{N\land\act{A}}{f}$}
                   \prove{$Q'$}}
     \begin{proof} % step <3>2
       \step{<4>1}{$T \in \ccInterval{r+\Delta}{\oo}$}
       \begin{proof}
         \pf\ By $I$.
       \end{proof}
       \step{<4>2}{$\anact{\relax\vbl{NowT}}{\now}$}
       \begin{proof}
         \pf\ By \stepref{<4>1}, $I$.2, and \act{A}.
       \end{proof}
       \qedstep
       \begin{proof}
         \pf\ \stepref{<4>1}, \stepref{<4>2}, and the definition of
         \vbl{NowT}.
       \end{proof}
     \end{proof} % step <3>2

     \step{<3>3}{$P \land I 
                     \implies \enabled{\anact{A}{f}}$}
     \begin{proof} 
        \pf\ \stepref{<3>1}. 
     \end{proof} 
     \qedstep
     \begin{proof}
       \pf\ \stepref{<3>1}, \stepref{<3>2}, \stepref{<3>3}, and 
       Lemma~\ref{lemma:sf1}.
     \end{proof}
   \end{proof} % step <2>5

   \qedstep

\end{proof} % of <1>6


\step{<1>6}{$(\while{E}{M^{t}}, E \implies \WF{(\now,v)}{\act{C}})$ 
            is $\mu$-machine realizable.}
\begin{proof} % step <1>7
  \step{<2>1}{$M^{t}$ constrains at most $\mu$.}
  \begin{proof} % <2>1
    \step{<3>1}{$M$ constrains at most $\mu$.}
     \begin{proof}
      \pf\ Assumption \toplevel.\ref{assump:5}.
     \end{proof}
    \step{<3>2}{$RT_{v}$ constrains at most $\mu$.}
     \begin{proof}
      \pf\ Assumption \toplevel.\ref{assump:6(b)}.
     \end{proof}
    \step{<3>3}{For all $i$ in $I$, 
                $\vbl{MinTime}(t_{i}, \act{A}_{i}, v)$ constrains at 
                most $\mu$.}
     \begin{proof}
      \pf\ By definition of \vbl{MinTime}, a step violates 
       $\vbl{MinTime}(t_{i}, \act{A}_{i}, v)$
       only if it is an \anact{A_{i}}{v} step, so this follows from 
       Assumption \toplevel.\ref{assump:6(a)}.
     \end{proof}
    \step{<3>4}{For all $j$ in $J$, $\vbl{MaxTime}(T_{j})$ constrains at 
                 most $\mu$.}
     \begin{proof}
      \pf\ Assumption \toplevel.\ref{assump:6(b)}.
     \end{proof}
    \qedstep
     \begin{proof}
      \pf\ \stepref{<3>1}--\stepref{<3>4} and the definition of $M^{t}$.
     \end{proof}
  \end{proof} % <2>1

%  \step{<2>2}{$\Pi^{t} \implies \Box \enabled{\anact{C}{(\now,v)}}$}
%  \begin{proof} % <2>2
%      \pf\ \stepref{4.5} and \stepref{05}.
%  \end{proof} % <2>2
  \qedstep
\end{proof} % step <1>7

\step{<1>7}{$(\true, \NZ{\oo})$ is $\mu$-machine realizable.}


\qedstep

\end{proof} % theorem
%try
%%% restore list parameters
\makeatletter
\let\@listi\savelisti
\let\@listii\savelistii
\let\@listiii\savelistiii
\makeatother

\iftoplas{\normalsize}{}

\iftoplas{\bibliographystyle{acmtrans}}
         {\cleardoublepage
            \addcontentsline{toc}{section}{References}
            \bibliographystyle{plain}}%
         
\ifseparateappendix{}{\begin{thebibliography}{}

\bibitem[\protect\citeauthoryear{Abadi and Lamport}{Abadi and
  Lamport}{1991}]{abadi:existence}
{\sc Abadi, M.} {\sc and} {\sc Lamport, L.} 1991.
\newblock The existence of refinement mappings.
\newblock {\em Theoretical Computer Science\/}~{\em 82,\/}~2 (May), 253--284.

\bibitem[\protect\citeauthoryear{Abadi and Lamport}{Abadi and
  Lamport}{1993}]{abadi:composing}
{\sc Abadi, M.} {\sc and} {\sc Lamport, L.} 1993.
\newblock Composing specifications.
\newblock {\em ACM Transactions on Programming Languages and Systems\/}~{\em
  15,\/}~1 (Jan.), 73--132.

\bibitem[\protect\citeauthoryear{Abadi and Plotkin}{Abadi and
  Plotkin}{1992}]{abadi:src86}
{\sc Abadi, M.} {\sc and} {\sc Plotkin, G.} 1992.
\newblock A logical view of composition.
\newblock Research Report~86 (May), Digital Equipment Corporation, Systems
  Research Center.

\bibitem[\protect\citeauthoryear{Alpern and Schneider}{Alpern and
  Schneider}{1985}]{alpern:defining}
{\sc Alpern, B.} {\sc and} {\sc Schneider, F.~B.} 1985.
\newblock Defining liveness.
\newblock {\em Information Processing Letters\/}~{\em 21,\/}~4 (Oct.),
  181--185.

\bibitem[\protect\citeauthoryear{Apt, Francez, and Katz}{Apt
  et~al.}{1988}]{apt:appraising}
{\sc Apt, K.~R.}, {\sc Francez, N.}, {\sc and} {\sc Katz, S.} 1988.
\newblock Appraising fairness in languages for distributed programming.
\newblock {\em Distributed Computing\/}~{\em 2}, 226--241.

\bibitem[\protect\citeauthoryear{Bernstein and Harter}{Bernstein and
  Harter}{1981}]{bernstein:proving}
{\sc Bernstein, A.} {\sc and} {\sc Harter, Jr., P.~K.} 1981.
\newblock Proving real time properties of programs with temporal logic.
\newblock In {\em Proceedings of the Eighth Symposium on Operating Systems
  Principles}, New York, pp.\  1--11. ACM.
\newblock {\em Operating Systems Review 15}, 5.

\bibitem[\protect\citeauthoryear{Chandy and Misra}{Chandy and
  Misra}{1988}]{chandy:parallel}
{\sc Chandy, K.~M.} {\sc and} {\sc Misra, J.} 1988.
\newblock {\em Parallel Program Design}.
\newblock Reading, Massachusetts: Addison-Wesley.

\bibitem[\protect\citeauthoryear{de~Bakker, Huizing, de~Roever, and
  Rozenberg}{de~Bakker et~al.}{1992}]{debakker:real-time}
{\sc de~Bakker, J.~W.}, {\sc Huizing, C.}, {\sc de~Roever, W.~P.}, {\sc and}
  {\sc Rozenberg, G.} (Eds.) 1992.
\newblock {\em Real-Time: Theory in Practice}, Volume 600 of {\em Lecture Notes
  in Computer Science}.
\newblock Berlin: Springer-Verlag.
\newblock Proceedings of a REX Real-Time Workshop, held in The Netherlands in
  June, 1991.

\bibitem[\protect\citeauthoryear{Dill}{Dill}{1988}]{dill:thesis}
{\sc Dill, D.~L.} 1988.
\newblock {\em Trace Theory for Automatic Hierarchical Verification of
  Speed-Independent Circuits}.
\newblock Ph.\ D. thesis, Carnegie Mellon University.

\bibitem[\protect\citeauthoryear{Fischer}{Fischer}{1985}]{fischer:where}
{\sc Fischer, M.} 1985.
\newblock Re: Where are you?
\newblock E-mail message to Leslie Lamport. Arpanet message sent on June 25,
  1985 18:56:29 EDT, number 8506252257.AA07636@YALE-BULLDOG.YALE.ARPA (47
  lines).

\bibitem[\protect\citeauthoryear{Jones}{Jones}{1983}]{jones:specification}
{\sc Jones, C.~B.} 1983.
\newblock Specification and design of (parallel) programs.
\newblock In {\sc R.~E.~A. Mason} (Ed.), {\em Information Processing 83:
  Proceedings of the IFIP 9th World Congress}, pp.\  321--332. IFIP:
  North-Holland.

\bibitem[\protect\citeauthoryear{Lamport}{Lamport}{1982}]{lamport:assertional}
{\sc Lamport, L.} 1982.
\newblock An assertional correctness proof of a distributed algorithm.
\newblock {\em Science of Computer Programming\/}~{\em 2,\/}~3 (Dec.),
  175--206.

\bibitem[\protect\citeauthoryear{Lamport}{Lamport}{1987}]{lamport:fast}
{\sc Lamport, L.} 1987.
\newblock A fast mutual exclusion algorithm.
\newblock {\em ACM Transactions on Computer Systems\/}~{\em 5,\/}~1 (Feb.),
  1--11.

\bibitem[\protect\citeauthoryear{Lamport}{Lamport}{1991}]{lamport:newtla}
{\sc Lamport, L.} 1991.
\newblock The temporal logic of actions.
\newblock Research Report~79 (Dec.), Digital Equipment Corporation, Systems
  Research Center.
\newblock To appear in {\em Transactions on Programming Languages and Systems}.

\bibitem[\protect\citeauthoryear{Marzullo, Schneider, and Budhiraja}{Marzullo
  et~al.}{1991}]{marzullo:derivation}
{\sc Marzullo, K.}, {\sc Schneider, F.~B.}, {\sc and} {\sc Budhiraja, N.} 1991.
\newblock Derivation of sequential, real-time process-control programs.
\newblock In {\sc A.~M. van Tilborg} {\sc and} {\sc G.~M. Koob} (Eds.), {\em
  Foundations of Real-Time Computing: Formal Specifications and Methods},
  Chapter~2, pp.\  39--54. Boston, Dordrecht, and London: Kluwer Academic
  Publishers.

\bibitem[\protect\citeauthoryear{Misra and Chandy}{Misra and
  Chandy}{1981}]{misra:proofs}
{\sc Misra, J.} {\sc and} {\sc Chandy, K.~M.} 1981.
\newblock Proofs of networks of processes.
\newblock {\em IEEE Transactions on Software Engineering\/}~{\em SE-7,\/}~4
  (July), 417--426.

\bibitem[\protect\citeauthoryear{Neumann and Lamport}{Neumann and
  Lamport}{1983}]{neumann:highly-dependable}
{\sc Neumann, P.~G.} {\sc and} {\sc Lamport, L.} 1983.
\newblock Highly dependable distributed systems.
\newblock Technical report (June), SRI International.
\newblock Contract Number DAEA18-81-G-0062, SRI Project 4180.

\bibitem[\protect\citeauthoryear{Pnueli}{Pnueli}{1984}]{pnueli:transition}
{\sc Pnueli, A.} 1984.
\newblock In transition from global to modular temporal reasoning about
  programs.
\newblock In {\sc K.~R. Apt} (Ed.), {\em Logics and Models of Concurrent
  Systems}, NATO ASI Series, pp.\  123--144. Springer-Verlag.

\bibitem[\protect\citeauthoryear{Schneider, Bloom, and Marzullo}{Schneider
  et~al.}{1992}]{schneider:REX}
{\sc Schneider, F.~B.}, {\sc Bloom, B.}, {\sc and} {\sc Marzullo, K.} 1992.
\newblock Putting time into proof outlines.
\newblock In {\sc J.~W. de~Bakker}, {\sc C.~Huizing}, {\sc W.-P. de~Roever},
  {\sc and} {\sc G.~Rozenberg} (Eds.), {\em Real-Time: Theory in Practice},
  Volume 600 of {\em Lecture Notes in Computer Science}, Berlin, Heidelberg,
  New York, pp.\  618--639. Springer-Verlag.

\end{thebibliography}
}

\begin{received}
           Received November 1992; revised November 1993; accepted ???.
\end{received}

\ifseparateappendix{}{
\cleardoublepage
\addcontentsline{toc}{section}{Index}
\begin{theindex}

  \item $\Sigma$, 28
  \item $\Sigma^*$, 28
  \item $\Sigma^{\oo}$, 28
  \item $\emptyseq$, 28
  \item \length{\ldots}, 28
  \item $\o$, 4, 28
  \item $\prefix{\ldots}{\ldots}$, 28
  \item $\seqv$, 28
  \item $\ldots'$, 6, 28
  \item $\anact{\ldots}{\ldots}$, 6, 28
  \item ${[\act{\ldots}]}_{\ldots}$, 6, 28
  \item $\Box$, 28
  \item $\Box\sqact{\ldots}{\ldots}$, 28
  \item $\Diamond$, 28
  \item $\leadsto$, 28
  \item $\EE$, 28
  \item $\M{\ldots}$, 6
  \item $\models$, 28
  \item $\whileop$, 20, 29

  \indexspace

  \item action, 6, 28
    \subitem disjoint, 8
    \subitem enabled, 6, 28
    \subitem subaction, 8
  \item agent, 20
  \item assumption
    \subitem environment, 2, 20
    \subitem granularity, 17
  \item assumption/guarantee specification, 2, 20
    \subitem and timing properties, 24

  \indexspace

  \item behavior, 6
    \subitem finite, 7
  \item Bernstein, Arthur, 1
  \item Budhiraja, Navin, 27

  \indexspace

  \item $\closure{\ldots}$, 7, 29
  \item canonical form, 6, 8
  \item closed set, 7
  \item closed system, 2
  \item closure, 7, 29
  \item completeness, 7, 14
  \item composition
    \subitem and conjunction, 21
    \subitem principle, 22
  \item constant, 4
  \item constrains at most, 19, 29
    \subitem and does not constrain, 21, 29
    \subitem and receptiveness, 20
    \subitem and timing constraints, 24

  \indexspace

  \item deadlock freedom, and nonZenoness, 17
  \item $\deq$, 4
  \item Dill, David L., 20

  \indexspace

  \item {\it Enabled}, 6, 28
  \item environment, as part of system, 3

  \indexspace

  \item fairness, 5, 7
    \subitem strong, 5, 7, 28
    \subitem weak, 5, 7, 28
  \item feasibility, and machine closure, 3
  \item finite internal nondeterminism (fin), 8
    \subitem and history-determined variables, 9
    \subitem and nonZenoness, 17
  \item Fischer, mutual exclusion protocol, 17

  \indexspace

  \item guarantee, system, 2, 20

  \indexspace

  \item Harter, Paul K., Jr., 1
  \item $\vbl{Head}$, 4

  \indexspace

  \item implementation relation, 3
    \subitem and implication, 3
    \subitem for open systems, 21
  \item implication, intuitionistic, 20
  \item initial state
    \subitem and constrains at most, 21
    \subitem in open systems, 20
  \item internal specification, 5
  \item invariance, 21

  \indexspace

  \item liveness, 6
    \subitem and \NZ{\oo}, 14
    \subitem in proof of safety, 13
  \item lower bound
    \subitem on action duration, 2, 17
    \subitem on time advance, 17

  \indexspace

  \item machine closure, 7, 29
    \subitem and fairness, 8
    \subitem and implication, 8
    \subitem and nonZenoness, 14
    \subitem and quantification, 8
  \item machine realizability, 20, 29
    \subitem and fairness, 20
    \subitem and implication, 20
    \subitem and machine closure, 20
    \subitem and nonZenoness, 25
    \subitem and quantification, 20
    \subitem and receptiveness, 20
  \item Marzullo, Keith, 27
  \item $\vbl{MaxTime}$, 10
  \item $\vbl{MinTime}$, 10

  \indexspace

  \item next-state relation, 5
    \subitem calculation, 21
  \item nonZenoness, 14, 25
    \subitem and $\delta$-timers, 16, 25
    \subitem and quantification, 17, 26
    \subitem proving, 16
    \subitem proving nonZenoness, 25
  \item \now, 1, 10
  \item $\NZ{\oo}$, 13

  \indexspace

  \item $\oset{\ldots}{\ldots}$, 29
  \item $\poset{\ldots}{\ldots}{\ldots}$, 29
  \item open system, 2, 19

  \indexspace

  \item paradox
    \subitem composition, example, 22
    \subitem Zeno's, 2
  \item predicate, 6, 28
    \subitem type-correctness, 5
  \item proof style, explanation, 29
  \item property, 7, 28
  \item $\vbl{PTimer}$, 11

  \indexspace

  \item quantification
    \subitem over flexible variables, 7, 28
    \subitem over rigid variables, 6
  \item queue
    \subitem lossy, 3
    \subitem real-time, 11

  \indexspace

  \item receptiveness, 19, 29
  \item $\RT{}$, 10

  \indexspace

  \item safety, 5, 7, 29
    \subitem and closed sets, 7
  \item Schneider, Fred B., 17, 27
  \item SF, 7, 28
  \item state, 6, 28
    \subitem time-blocked, 14
  \item state function, 6, 28
  \item step, 6
    \subitem stuttering, 6
  \item strategy, 29
  \item stuttering, invariant under, 7

  \indexspace

  \item $\vbl{Tail}$, 4
  \item timer, 10
    \subitem lower-bound, 10
    \subitem persistent $\delta$-timer, 11
    \subitem upper-bound, 10
    \subitem volatile $\delta$-timer, 11
  \item timing constraints, 10
    \subitem in open systems, 25
  \item transition function, 6, 28

  \indexspace

  \item variable
    \subitem flexible, 3
    \subitem history, 9
    \subitem history-determined, 9
    \subitem internal, 3, 8
    \subitem rigid, 3
  \item $\vbl{VTimer}$, 10

  \indexspace

  \item WF, 7, 28

  \indexspace

  \item Zeno, {\em see also} nonZenoness, 14

\end{theindex}
}%

\end{document}

