sur 17
Formal Refinement for Operating System Kernels — Iain D. Craig