Ana Cavalcanti Jim Woodcock A Weakest Precondition Semantics for Z. 1-15 1998 41 Comput. J. 1 db/journals/cj/cj41.html#CavalcantiW98