Mechanical verification of concurrency control and recovery protocols by