modular specification, and modular verification for applicative objectoriented programs (1992)

by Subtyping