"Mechanically Checked Proofs of Kernel Specification."

William R. Bevier, Jørgen F. Søgaard-Andersen (1991)
a service of Schloss Dagstuhl - Leibniz Center for Informatics