Verifying Safety of a Token Coherence Implementation by Compositional Parametric Refinement Sebastian Burckhardt Rajeev Alur Milo M.K. Martin University.