Paul Curzon I. M. Leslie A case study on design for provability. 59-62 1995 conf/iceccs/1995 ICECCS http://doi.ieeecomputersociety.org/10.1109/ICECCS.1995.479304 db/conf/iceccs/iceccs1995.html#CurzonL95