Protective Interface Speci cations

The interface speci cation of a procedure describes the procedure s behavior using pre and postconditions These pre and postconditions are written using various functions If some of these functions are partial or underspeci ed then the procedure speci cation may not be well de ned We show how to write pre and postcondition speci cations that avoid such problems by having the precondition protect the postcondition from the e ects of partiality and underspeci cation We formalize the notion of pro tection from partiality in the context of speci cation languages like VDM SL and COLD K We also formalize the notion of protection from underspeci ca tion for the Larch family of speci cation languages and for Larch show how one can prove that a procedure speci cation is protected from the e ects of underspeci cation