Formal Refinement for Operating System Kernels - Craig, Iain D. (Springer London, 2007)