Occam in the specification and verification of microprocessors - Roscoe, A (1992)