Victor L. Winter James M. Boyle Proving refinement transformations for deriving high-assurance software. 68-77 1996 conf/hase/1996 HASE http://computer.org/proceedings/hase/7629/76290068abs.htm db/conf/hase/hase1996.html#WinterB96