David W. J. Stringer-Calvert Susan Stepney Ian Wand Using PVS to Prove a Z Refinement: A Case Study. 573-588 1997 conf/fm/1997 FME db/conf/fm/fme1997.html#Stringer-CalvertSW97 https://doi.org/10.1007/3-540-63533-5_30