Paul Curzon Tracking Design Changes with Formal Machine - Checked Proof. 91-100 1995 38 Comput. J. 2 db/journals/cj/cj38.html#Curzon95