Putting Theories Together to Make Specifications
Guarded commands, nondeterminacy and formal derivation of programs