High-Assurance Design by Clifford J. Berg