Verifying object-oriented prograsm that use subtypes (1989)