Program correctness over abstract data types, with error-state semantics - Tucker, John V. (CWI monograph, 1988)