Reasoning about formal software specifications : an initial investigation