Using Event-B for Critical Device Software Systems - Neeraj Kumar Singh (Springer)