E. Thomas Schubert Verification of Integrated Subsystems. 38-51 1991 conf/tphol/1991 TPHOLs db/conf/tphol/tphol1991.html#Schubert91