Proof of correctness of a transparent design abstraction