A constructive method for the architectural design and correctness verification of real-time programs - Saukkonen, Samuli (Mathematics and computer science series, 1983)