  Data replication is essential to ensure reliability, availability and
fault-tolerance of massive distributed applications over large scale systems
such as the Internet. However, these systems are prone to partitioning, which
by Brewer's CAP theorem [1] makes it impossible to use a strong consistency
criterion like atomicity. Eventual consistency [2] guaranties that all replicas
eventually converge to a common state when the participants stop updating.
However, it fails to fully specify shared objects and requires additional
non-intuitive and error-prone distributed specification techniques, that must
take into account all possible concurrent histories of updates to specify this
common state [3]. This approach, that can lead to specifications as complicated
as the implementations themselves, is limited by a more serious issue. The
concurrent specification of objects uses the notion of concurrent events. In
message-passing systems, two events are concurrent if they are enforced by
different processes and each process enforced its event before it received the
notification message from the other process. In other words, the notion of
concurrency depends on the implementation of the object, not on its
specification. Consequently, the final user may not know if two events are
concurrent without explicitly tracking the messages exchanged by the processes.
A specification should be independent of the system on which it is implemented.
We believe that an object should be totally specified by two facets: its
abstract data type, that characterizes its sequential executions, and a
consistency criterion, that defines how it is supposed to behave in a
distributed environment. Not only sequential specification helps repeal the
problem of intention, it also allows to use the well studied and understood
notions of languages and automata. This makes possible to apply all the tools
developed for sequential systems, from their simple definition using structures
and classes to the most advanced techniques like model checking and formal
verification. Eventual consistency (EC) imposes no constraint on the convergent
state, that very few depends on the sequential specification. For example, an
implementation that ignores all the updates is eventually consistent, as all
replicas converge to the initial state. We propose a new consistency criterion,
update consistency (UC), in which the convergent state must be obtained by a
total ordering of the updates, that contains the sequential order of each
