modular specification, and modular verification for applicative object-oriented programs (1993)

by Subtyping