David Robertson An empirical study of the LSS specification toolkit in use. 115-123 1998 42 Journal of Systems and Software 2 http://dx.doi.org/10.1016/S0164-1212(98)10003-1 db/journals/jss/jss42.html#Robertson98