verification of an implementation of tomasulo ' s algorithm by compositional model checking .
Verifying Properties of Parallel Programs : An Axiomatic Approach