Formal specs as sets of behaviors