Piton: a mechanically verified assembly-language (1996)

by J S Moore