Using Z specification, refinement, and proof - Woodcock, Jim (Prentice-Hall international series in computer science, 1996)