Introduction To Formal Specification And Z door Ben Potter & David Till