Formal specification and verification of control software for cryptographic equipment. - D. Richard Kuhn; James F. Dray (ACSAC, 1990)