Aho, A.V., Hopcroft, J.E., and Ullman, J.D. 2000. *Introduction to Automata Theory, Languages, and Computation*. Addison-Wesley.

Alur, R., Henzinger, T., Mang, F., Qadeer, S., Rajamani, S., and Tasiran, S. 1998. Mocha: Modularity in model checking. In *Proceedings of 10th International Conference on Computer Aided Verification (CAV)*, volume 1427 of *Lecture Notes in Computer Science*, Springer Verlag, pp. 521–525.

Alur, R., Henzinger, T.A., and Kupferman, O. 1997. Alternating-time temporal logic. In de Roever et al., pp. 23–60.

Aziz, A., Balarin, F., Brayton, R.K., Dibenedetto, M.D., Sladanha, A., and Sangiovanni-Vincentelli, A.L. 1995. Supervisory control of finite state machines. In P. Wolper, editor, *7th International Conference On Computer Aided Verification*, vol. 939 of *Lecture Notes in Computer Science*. Liege, Belgium: Springer Verlag, pp. 279–292.

Balemi, S., Hoffmann, G., Gyugyi, P., Wong-Toi, H., and Franklin, G. 1993. Supervisory control of a rapid thermal multiprocessor. *IEEE Transactions on Automatic Control*, 38(7):1040–1059, 1993.

Cheung, S. and Kramer, J. 1996. Context constraints for compositional reachability analysis.

*ACM Transactions on Software Engineering and Methodology*, 5(4):334–377.

CrossRefGoogle ScholarCheung, S. and Kramer, J. 1999. Checking safety properties using compositional reachability analysis.

*ACM Transactions on Software Engineering and Methodology*, 8(1):49–78.

CrossRefGoogle ScholarClarke, E.M., Grumberg, O., and Peled, D. 2000. *Model Checking*. MIT Press.

Cobleigh, J.M., Giannakopoulou, D., and Păsăreanu, C.S. 2003. Learning assumptions for compositional verification. In *Proceedings of the 9th International Conference on Tools and Algorithms for Construction and Analysis of Systems (TACAS)*.

de Alfaro, L. and Henzinger, T. 2001. Interface automata. In *Proc. of the Joint 8th European Software Engineering Conference and 9th ACM SIGSOFT International Symposium on Foundations of Software Engineering (ESEC/FSE)*, ACM Press.

de Alfaro, L. and Henzinger, T. 2001. Interface theories for component-based design. In *Proceedings of EMSOFT 01: Embedded Software*, volume 2211 of *Lecture Notes in Computer Science*, Springer Verlag, pp. 148–165.

de Roever, W.-P. 1997. The need for compositional proof systems: A survey. In de Roever et al., pp. 1–22.

de Roever, W.P., de Boer, F., Hanneman, U., Hooman, J., Lakhnech, Y., Poel, M., and Zwiers, J. 2001. *Concurrency Verification: Introduction to Compositional and Non-compositional Methods*. Cambridge University Press.

de Roever, W.-P., Langmaack, H., and Pnueli, A. (ed.) 1997. *Compositionality: The Significant Difference - An International Symposium, COMPOS’97*, volume 1536 of *Lecture Notes in Computer Science*. Springer-Verlag.

di Benedetto, M. and Sangiovanni-Vincentelli, A. 2001. Model matching for finite-state machines.

*IEEE Transactions on Automatic Control*, 46(11):1726–1743.

CrossRefGoogle ScholarFlanagan, C., Freund, S., and Qadeer, S. 2002. Thread-modular verification for shared-memory programs. In *Proceedings of the European Symposium on Programming*.

Giannakopoulou, D., Kramer, J., and Cheung, S. 1999. Analysing the behaviour of distributed systems using Tracta.

*Journal of Automated Software Engineering, special issue on Automated Analysis of Software*, 6(1):7–35.

Google ScholarGiannakopoulou, D., Păsăreanu, C.S., and Barringer, H. 2002. Assumption generation for software component verification. In *Proceedings of the 17th IEEE International Conference on Automated Software Engineering*.

Graf, S., Steffen, B., and Lüttgen, G. 1996. Compositional minimisation of finite state systems using interface specifications. *Formal Aspects of Computation*, 8.

Haghverdi, E. and Ural, H. 1999. Submodule construction from concurrent system specifications.

*Information and Software Technology*, 41:499–506.

CrossRefGoogle ScholarHavelund, K. and Rosu, G. 2001. Monitoring Java programs with Java pathexplorer. In *First Workshop on Runtime Verification (RV’01)*, volume 55(2) of *Electronic Notes in Theoretical Computer Science*, Paris, France.

Havelund, K., Lowry, M., and Penix, J. 2001. Formal analysis of a space craft controller using SPIN. In *IEEE Transactions on Software Engineering*, Vol. 27, Num. 8.

Holzmann, G. 1991. *The Design and Validation of Computer Protocols*. Prentice Hall.

Inverardi, P., Wolf, A., and Yankelevich, D. 2000. Static checking of system behaviors using derived component assumptions.

*ACM Transactions on Software Engineering Methods*, 9(3):239–272.

CrossRefGoogle ScholarJones, C. 1983. Tentative steps towards a development method for interfering programs.

*ACM Transactions on Programming Languages and Systems*, 5(4):596–619.

CrossRefGoogle ScholarKhatri, S., Narayan, A., Krishnan, S., McMillan, K., Brayton, R., and Sangiovanni-Vincentelli, A. 1996. Engineering change in a non-deterministic FSM setting. In *Proceedings of 33rd IEEE/ACM Design Automation Conference*.

Krimm, J.-P. and Mounier, L. 1997. Compositional state space generation from LOTOS programs. In E. Brinksma, editor, *3rd International Workshop on Tools and Algorithms for the Construction and Analysis of Systems (TACAS’97)*, volume 1217 of *Lecture Notes in Computer Science*. Enschede, The Netherlands: Springer.

Larsen, K. and Thomsen, B. 1988. A modal process logic. In *Proceedings of the IEEE/ACM Conference on Logic in Computer Science, LICS’88*.

Larsen, K. and Xinxin, L. 1990. Equation solving using modal transition systems. In *Proceedings of the IEEE/ACM Conference on Logic in Computer Science, LICS’90*.

Magee, J., Dulay, N., and Kramer, J. 1994. Regis: A constructive development environment for parallel and distributed programs.

*Distributed Systems Engineering Journal, Special Issue on Configurable Distributed Systems*, 1(5):304–312.

Google ScholarMagee, J., and Kramer, J. 1999. *Concurrency: State Models & Java Programs*. John Wiley & Sons.

Magee, J., Kramer, J., and Giannakopoulou, D. 1999. Behaviour analysis of software architectures. In *1st Working IFIP Conference on Software Architecture (WICSA1)*: San Antonio, TX, USA.

Magee, J., Pryce, N., Giannakopoulou, D., and Kramer, J. 2000. Graphical animation of behavior models. In *Proceedings of the 22nd International Conference of Software Engineering (ICSE)*.

Merlin, P., and Bochmann, G.V. 1983. On the construction of submodule specification and communication protocols.

*ACM Transactions on Programming Languages and Systems*, 5:1–25.

CrossRefGoogle ScholarMilner, R. 1989. *Communication and Concurrency*. Prentice-Hall.

Parrow, J. 1989. Submodule construction as equation solving CCS.

*Theoretical Computer Science*, 68:175–202.

CrossRefGoogle ScholarPăsăreanu, C.S., Dwyer, M.B., and Huth, M. 1999. Assume-guarantee model checking of software: A comparative case study. In D. Dams, R. Gerth, S. Leue, and M. Massink, editors, *Theoretical and Practical Aspects of SPIN Model Checking*, volume 1680 of *Lecture Notes in Computer Science*. Springer-Verlag, pp. 168–183.

Pnueli, A., 1984. In transition from global to modular temporal reasoning about programs. In K. Apt, editor,

*Logic and Models of Concurrent Systems*, volume 13, New York: Springer-Verlag.

Google ScholarPell, B., Gat, E., Keesing, R., Muscettola, N., and Smith, B. 1997. Plan execution for autonomous spacecrafts. In *Proc. of the Int. Joint Conf. on Artificial Intelligence*.

Shields, M. 1989. A note on the simple interface equation.

*The Computer Journal*, 32(5):399–412.

CrossRefGoogle ScholarSidhu, D.P. and Aristizabal, J. 1988. Constructing submodule specifications and network protocols.

*IEEE Transactions on Software Engineering*, 14(11):1565–1577.

CrossRefGoogle ScholarStølen, K. 1991. A method for the development of totally correct shared-state parallel programs. In J. Baeten and J. Groote, editors, *Proceedings of Concur’91*, volume 527 of *Lecture Notes in Computer Science*. Springer Verlag.

Tronci, E. 1998. Automatic synthesis of controllers from formal specifications. In *Proc. of 2nd IEEE Int. Conf. on Formal Engineering Methods*. Brisbane, Australia.

Xu, Q., de Roever, W.-P., and He, J. 1997. The rely-guarantee method for verifying shared variable concurrent programs.

*Formal Aspects of Computing*, 9(2):149–174.

CrossRefGoogle Scholar