Mila E. Majster-Cederbaum Frank Salger Correctness by Construction: Towards Verification in Hierarchical System Development. 163-180 2000 conf/spin/2000 SPIN db/conf/spin/spin2000.html#Majster-CederbaumS00