Formal methods of program verification and specification (Prentice-Hall, 1982)