<i>Necessity</i> specifications for robustness

Robust modules guarantee to do only what they are supposed – even in the presence of untrusted malicious clients, and considering not just direct behaviour individual methods, but also emergent from calls more than one method. Necessity is a language for specifying robustness, based on novel necessity operators capturing temporal implication, proof logic that derives explicit robustness specifications functional specifications. Soundness an exemplar mechanised Coq.