Luqi Joseph A. Goguen Formal Methods: Promises And Problems. 73-85 1997 14 IEEE Software 1 db/journals/software/software14.html#LuqiG97