Jim Woodcock Two Refinement Case Studies. 118-140 1991 conf/fm/1991-2 VDM Europe (2) db/conf/fm/vdme1991-2.html#Woodcock91c