Gilles Kahn An Approach to System Correctness. 86-94 1971 SOSP db/conf/sosp/sosp71.html#Kahn71