Sany M. Leinwand Logical correctness by construction. 825-831 1982 DAC http://doi.acm.org/10.1145/800263.809296 conf/dac/1982 db/conf/dac/dac1982.html#Leinwand82