Using Z: specification, refinement and proof (1996)

by J Woodcock, J Davies