How the design of JML accommodates both runtime assertion checking and formal verification. (2005)

by G T Leavens, Y Cheon, C Clifton, C Ruby, D R Cok
Venue:Sci. Comput. Program.