formal specification of function init