Verification of secure systems - Rushby, John M. (1981)