An example of hierarchical design and proof (1978)

by J M Spitzen, K N Levitt, L Robinson
Venue:Communications of the ACM