David W. J. Stringer-Calvert, Susan Stepney, Ian Wand: Using PVS to Prove a Z Refinement: A Case Study. FME 1997: 573-588