Specifying Concurrent Program Modules
The early methods for reasoning about concurrent programs dealt with proving that a program satisfied certain properties--usually invariance properties. But, proving particular properties showed only that the program satisfied those properties. There remained the possibility that the program was incorrect because it failed to satisfy…