Using Z: Specification, Refinement, and Proof (Prentice-hall International Series in Computer Science)