Simon Bainbridge Albert John Camilleri Roger Fleming Theorem Proving as an Industrial Tool for System Level Desgin. 253-274 1992 conf/tpcd/1992 TPCD db/conf/tpcd/tpcd1992.html#BainbridgeCF92