Leo Marcus Timothy Redmond Two Automated Methods in Implementation Proofs. 622-642 1988 conf/cade/1988 CADE db/conf/cade/cade88.html#MarcusR88 http://dx.doi.org/10.1007/BFb0012862