Program verification - Francez, Nissim (Addison-Wesley, 1992)