Describir: Specification and Proof in Real−time CSP