Proving programs correct - Anderson, Robert Brockett (Wiley, 1979)