Added formal specification