Design and Proof of a Mail Service - Hoare, C; Jifeng, H (1987)