Manfred Broy Proceedings of the NATO Advanced Study Institute on Deductive Program Design, Marktoberdorf, Germany NATO ASI DPD 1996 3-540-60947-4 db/conf/nato/dpd1996.html