An electronic purse: specification, refinement, and proof (2000)

by S Stepney, D Cooper, J Woodcock