Proving a computer correct with the LCF-LSM hardware verification system (1983)

by Mike J C Gordon