Hans-Dieter Ehrich Udo W. Lipeck Proving Implementations Correct - Two Alternative Approaches. 83-88 1980 IFIP Congress db/conf/ifip/ifip80.html#EhrichL80