CS-TR-1334 May , 2012 Refining rely-guarantee thinking