Using Event-B for Critical Device Software Systems - Singh (Springer London, 2013)