Linearizability: a correctness condition for concurrent objects
Abstract data types and software validation