A Formal Z Specification of ProSet-Linda