iDLab
copyright Peter H. Gregson, 2002
Formal design methods
can help.