The SRI hierarchical development methodology (HDM) and its applications to the development of secure software - Levitt, Karl N.; Neumann, Peter; Robinson, Lawrence (United States. National Bureau of Standards: NBS special publication, 1980)