Martyn Thomas Development Methods for Trusted Computer Systems. 5-18 1989 1 Formal Asp. Comput. 1 db/journals/fac/fac1.html#Thomas89