Diyaa-Addein Atiya Steve King Jim Woodcock Simpler Reasoning About System Properties: a Proof-by-Refinement Technique. 5-22 2005 137 Electr. Notes Theor. Comput. Sci. 2 http://dx.doi.org/10.1016/j.entcs.2005.04.022 db/journals/entcs/entcs137.html#AtiyaKW05