Holger Busch Transformational Design in a Theorem Prover. 175-196 1992 conf/tpcd/1992 TPCD db/conf/tpcd/tpcd1992.html#Busch92