Jean-François Monin Proving a Real Time Algorithm for ATM in Coq. 277-293 1996 conf/types/1996 TYPES db/conf/types/types96.html#Monin96 http://dx.doi.org/10.1007/BFb0097797