The Correctness-by-construction Approach to Programming Volume 668 ||Kourie et al. · 10.1007/972012PDF375 KB