How the design of JML accommodates both runtime assertion checking and formal verification (2005)

by Gary T Leavens, Yoonsik Cheon, Curtis Clifton, Clyde Ruby, David R Cok
Venue:Science of Computer Programming