% $Id$
% Software engineering, specification, verification.

@TechReport{Abadi-Lamport88,
  Author =	 "Mart\'{i}n Abadi and Leslie Lamport",
  Title =	 "The Existence of Refinement Mappings",
  Institution =	 DECSRC,
  Year =	 1988,
  Month =	 aug,
  Number =	 29,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Note =	 "A shorter version appeared in {\em Proceedings of
                  the LICS Conference}, Edinburgh, Scotland, July
                  1988",
  Annote =	 "10 references."
}

@TechReport{Abadi-Lamport90,
  Author =	 "Mart\'{\i}n Abadi and Leslie Lamport",
  Title =	 "Composing Specifications",
  Institution =	 DECSRC,
  Year =	 1990,
  Number =	 66,
  Month =	 oct,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "26 references."
}

@article{Abadi-Lamport91,
 author = {Mart\'{\i}n Abadi and Leslie Lamport},
 title = {The existence of refinement mappings},
 journal = TCS,
 volume = 82,
 issue = 2,
 month = may,
 year = 1991,
 pages = {253–284},
 url = {http://dx.doi.org/10.1016/0304-3975(91)90224-P},
 publisher = {Elsevier},
 address = NY,
 annote = "14 references."
} 

@Article{Abadi-Lamport93,
  Author =	 "Mart\'{\i}n Abadi and Leslie Lamport",
  Title =	 "Composing Specifications",
  Journal =	 "ACM Transactions on Programming Languages and
                  Systems",
  Month =	 jan,
  Year =	 1993,
  Volume =	 15,
  Number =	 1,
  Pages =	 "73-132",
  Annote =	 "27 references."
}

@article{Abadi-Lamport94,
 author = {Mart\'{\i}n Abadi and Leslie Lamport},
 title = {An old-fashioned recipe for real time},
 journal = TOPLAS,
 volume = 16,
 issue = 5,
 month = sep,
 year = 1994,
 pages = {1543-1571},
 numpages = 29,
 url = {http://doi.acm.org/10.1145/186025.186058},
 publisher = {ACM},
 address = NY,
 annote = "19 references."
} 

@InCollection{Abadi-Leino97,
  Author =	 "Mart\'{\i}n Abadi and K. Rustan M. Leino",
  Title =	 "A Logic of Object-Oriented Programs",
  BookTitle =	 "{TAPSOFT '97}: Theory and Practice of Software
                  Development, 7th International Joint Conference
                  {CAAP/FASE}, Lille, France",
  Publisher =	 SV,
  Year =	 1997,
  Editor =	 "Michel Bidoit and Max Dauchet",
  Series =	 LNCS,
  Volume =	 1214,
  Pages =	 "682-696",
  Address =	 NY,
  Note =	 {Expanded in DEC SRC report 161},
  URL = {http://www.springerlink.com/content/kp4n0b4xhn8rjg4p},
  Annote =	 "24 references."
}

@TechReport{Abadi-Leino98,
  Author =	 "Mart\'{\i}n Abadi and K. Rustan M. Leino",
  Title =	 "A Logic of Object-Oriented Programs",
  institution =	 DECSRC,
  Year =	 1998,
  number =	 161,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "29 references."
}

@InProceedings{Abadi-Plotkin91,
  Author =	 "Mart\'{\i}n Abadi and Gordon D. Plotkin",
  Title =	 "A Logical View of Composition and Refinement",
  BookTitle =	 "Conference Record of the Eighteenth Annual ACM
                  Symposium on Principles of Programming Languages,
                  Orlando",
  Organization = ACM,
  Month =	 jan,
  Year =	 1991,
  Pages =	 "323-332",
  Annote =	 "Two logics of safety specifications for reactive
                  systems. 25 references."
}

@TechReport{Abadi90,
  Author =	 "Mart\'{\i}n Abadi",
  Title =	 "An Axiomatization of Lamport's Temporal Logic of
                  Actions",
  Institution =	 DECSRC,
  Year =	 1990,
  Number =	 65,
  Month =	 oct,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "12 references."
}

@Article{Abbott87,
  Author =	 "Russell J. Abbott",
  Title =	 "Knowledge Abstraction",
  Journal =	 CACM,
  Volume =	 30,
  Number =	 8,
  Month =	 aug,
  Year =	 1987,
  Pages =	 "664-671",
  Annote =	 "Argues that knowledge abstraction allows software to
                  move closer to the problem domain as opposed to data
                  abstraction. 59 references."
}

@techreport{Abowd-etal89,
    author = "Gregory Abowd and Jonathan P. Bowen and Alan Dix and Michael Harrison and Roger Took",
    title = "User Interface Languages: A survey of existing methods",
    institution = "Oxford University Computing Laboratory",
    number = "PRG-TR-5-89",
    month = "October",
    year = 1989,
    url = "citeseer.ist.psu.edu/abowd89user.html" 
}

@InCollection{Abraham-Mumm-etal03,
  author =	 {E. Abraham-Mumm and F.S. de Boer and W.P. {de Roever}
                  and and M. Steffen},
  title =	 {A Tool-supported Proof System for Multithreaded
                  Java},
  booktitle =	 {FMCO 2002: Formal Methods for Component Objects,
                  Proceedings},
  publisher =	 SV,
  year =	 2003,
  editor =	 {Frank de Boer and Marcello Bonsangue and Susanne
                  Graf and Willem-Paul de Roever},
  series =	 LNCS
}

@TechReport{Abran-etal04,
  author =	"Alain Abran and James W. Moore and Pierre Bourque and Robert Dupuis",
  institution =  "IEEE Computer Society",
  title =	"Guide to the Software Engineering Body of Knowledge",
  year = 	"2004",
  URL = "http://www.swebok.org/"
}

@Book{Abrial-Boerger-Langmaack96,
  editor =	 "J.-R. Abrial and E. B{\"o}rger and H. Langmaack",
  title =	 "Formal Methods for Industrial Applications:
                  Specifying and Programming the Steam Boiler
                  Controller",
  booktitle =	 "Formal Methods for Industrial Applications",
  publisher =	 SV,
  series =	 "Lecture Notes in Computer Science",
  volume =	 "1165",
  year =	 "1996",
  ISBN =	 "3-540-61929-1",
  url =
                  "http://www.informatik.uni-kiel.de/~procos/dag9523/dag9523.html",
  annote =	 "A comparative collection of formal methods case
                  studies for a real-time control application."
}

@InProceedings{Abrial-Hallerstede05,
  author    = {Jean-Raymond Abrial and Stefan Hallerstede},
  title     = {Decomposition, refinement and instantiation of generic models},
  booktitle = {ASM 05},
  month     = {March},
  year      = {2005},
  place     = {Paris}
}

@Article{Abrial-Hallerstede06,
  author    = {Jean-Raymond Abrial and Stefan Hallerstede},
  title     = {Refinement, Decomposition, and Instantiation of Discrete Models: Application to {Event-B}},
  journal = {Fundamenta Informaticae},
  year      = {2006},
  volume =    {XXI}
}

@InProceedings{Abrial-etal06,
  author = 	 {J.-R. Abrial and M. Butler and S. Hallerstede and L. Voisin},
  title = 	 {An open extensible tool environment for {Event-B}},
  booktitle = 	 {International Conference on Formal Engineering Methods (ICFEM)},
  year =	 2006,
  series =	 LNCS,
  publisher =	 SV,
  address =      NY
}

@Book{Abrial96,
  author =	 "J.-R. Abrial",
  title =	 "The {B}-Book: Assigning Programs to Meanings",
  publisher =	 "Cambridge University Press",
  ISBN =	 "0521496195",
  year =	 "1996",
  month =	 aug,
  address =      "Cambridge, UK"
}

@Article{Agarwal-etal00,
  author =       "Ritu Agarwal and Prabuddha De and Atish P. Sinha and
                 Mohan Tanniru",
  title =        "On the usability of {OO} representations",
  journal =      CACM,
  volume =       43,
  number =       10,
  pages =        "83-89",
  month =        oct,
  year =         2000,
  URL =          "http://www.acm.org/pubs/citations/journals/cacm/2000-43-10/p83-agarwal/",
  annote =       "OO is not well suited to some tasks, but better suited to others.  12 references."
}

@InProceedings{Agerbo-Cornils98,
  author =	 {Ellen Agerbo and Aino Cornils},
  title =	 {How to Preserve the Benefits of Design Patterns},
  BookTitle =	 "OOPSLA '98 Conference Proceedings",
  Series =	 SIGPLAN,
  Volume =	 "33(10)",
  Month =	 oct,
  Year =	 1998,
  organization = ACM,
  pages =	 {134-143},
  annote =	 {16 references.}
}


@Inproceedings{Aguiar00,
 author = {Ademar Aguiar},
 title = {A minimalist approach to framework documentation},
 booktitle = {OOPSLA '00: Addendum to the 2000 proceedings of the conference
on Object-oriented programming, systems, languages, and applications
(Addendum)},
 year = 2000,
 pages = {143-144},
 location = {Minneapolis, Minnesota},
 doi = {http://doi.acm.org/10.1145/367845.368050},
 publisher = {ACM Press},
 address = {New York, NY, USA}
}

@Article{Ahmad-Steegmans98,
  author =	 {W. Al-Ahmad and E. Steegmans},
  title =	 {Specialization of Behavior: Comparison, Critique,
                  and a New Approach},
  journal =	 JOOP,
  year =	 1998,
  volume =	 10,
  number =	 9,
  month =	 feb,
  pages =	 {29-37},
  annote =	 {Study of inheritance in various OO languages. 10
                  references.}
}

@article{Ahrendt-etal05,
  author =       {W. Ahrendt and Th. Baar and B. Beckert and R. Bubel
                  and M. Giese and R. H\"{a}hnle and W. Menzel and
                  W. Mostowski and A. Roth and S. Schlager and
                  P. H. Schmitt},
  title =        {The {KeY} Tool},
  journal =      {Software and System Modeling},
  publisher =    SV,
  volume =       4,
  pages =        {32-54},
  year =         2005
}                  

@Book{Ahrendt-etal16,
  editor = 	 {Wolfgang Ahrendt and Bernhard Beckert and Richard Bubel and
                  Reiner H\"{a}hnle and Peter H. Schmitt and Mattias Ulbrich},
  title = 	 {Deductive Software Verification -- The {KeY} Book},
  publisher = 	 SV,
  year = 	 2016,
  volume = 	 10001,
  address =      "Cham, Switzerland",
  series = 	 LNCS
}

@Article{Alagar-Periyasamy92,
  Author =	 "Vangalur S. Alagar and K. Periyasamy",
  Title =	 "A Methodology for Deriving an Object-oriented Design
                  from Functional Specifications",
  Journal =	 "Software Engineering Journal",
  Month =	 jul,
  Year =	 1992,
  Pages =	 "247-263",
  Annote =	 "23 references."
}

@Book{Alagar-Periyasamy98,
  Author =	 "V. S. Alagar and K. Periyasamy",
  Title =	 "Specification of Software Systems",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1998,
  Annote =	 "Several references in each chapter."
}

@Article{Alagar-Ramanathan91,
  Author =	 "Vangalur S. Alagar and Geetha Ramanathan",
  Title =	 "Functional Specification and Proof of Correctness
                  for Time Dependent Behaviour of Reactive Systems",
  Journal =	 "Formal Aspects of Computing",
  Year =	 1991,
  Pages =	 "253-283",
  Annote =	 "18 references."
}

@InProceedings{Alagic-Kouznetsova02,
  author =	 {Suad Alagic and Svetlana Kouznetsova},
  title =	 {Behavioral Compatibility of Self-Typed Theories},
  booktitle =	 {ECOOP 2002 --- Object-Oriented Programming, 16th
                  European Conference, M\'{a}alaga, Spain,
                  Proceedings},
  pages =	 {585-608},
  year =	 2002,
  editor =	 {Boris Magnusson},
  volume =	 2374,
  series =	 LNCS,
  address =	 {Berlin},
  month =	 jun,
  publisher =	 SV,
  annote =	 {Behavioral matching is an institution. 41 references.}
}

@InProceedings{Alagic-Royer-Crews06,
  author =	 {Suad Alagi\'{c} and Mark Royer and Dennis Crews},
  title = 	 {Temporal Verification Theories for {Java-like} Classes},
  booktitle =	 {Workshop on Formal Techniques for Java-like Programs (FTfJP)},
  year =	 2006,
  month =	 jul,
  URL = 	 {http://www.disi.unige.it/person/AnconaD/FTfJP06/paper08.pdf},
  annote =       {33 references.}
}

@Article{Alavi84,
  Author =	 "Maryam Alavi",
  Title =	 "An Assessment of the Prototyping Approach to
                  Information Systems Development",
  Journal =	 CACM,
  Volume =	 27,
  Number =	 6,
  Month =	 jun,
  Year =	 1984,
  Pages =	 "556-563",
  Annote =	 "Discusses results from studies of commercial
                  products and an experiment comparing prototyping
                  with standard life cycle techniques. Finds
                  prototyping useful in many situations and discusses
                  these and the problems of managing a prototype-based
                  development. Annotations and 15 references."
}

@InProceedings{Aldrich-Chambers-Notkin02,
  author =	 {Jonathan Aldrich and Craig Chambers and David Notkin},
  title =	 {Architectural Reasoning in {ArchJava}},
  booktitle =	 {ECOOP 2002 --- Object-Oriented Programming, 16th
                  European Conference, M\'{a}alaga, Spain,
                  Proceedings},
  pages =	 {334-367},
  year =	 2002,
  editor =	 {Boris Magnusson},
  volume =	 2374,
  series =	 LNCS,
  address =	 {Berlin},
  month =	 jun,
  publisher =	 SV,
  annote =	 {28 references.}
}

@inproceedings{Aldrich-Chambers04,
	Title = {Ownership Domains: Separating Aliasing Policy from Mechanism},
	Author = {Jonathan Aldrich and Craig Chambers},
	Annote = {This paper presents an ownership type system that is decoupled from the encapsulation relation in a program.  This allows very fine grained specification, and static typechecking, of the aliasing relationships in a program.  The system replaces the traditional owners-as-dominators property of ownership type systems with a link soundness property.  The link soundness property says that the only inter-domain aliases are those between domains which are explicitly given permission to hold such aliases.  The authors' ownership domains are significantly more fine-grained than my concern domains, with each object (not class) having its own member domains.

 Their related work section is a nice, concise summary of work on alias control in Java.
},
	Crossref = {ECOOP04},
	Pages = {1-25}
}

@inproceedings{Aldrich04,
	Author = {Jonathan Aldrich},
	Title = {Open Modules: A Proposal for Modular Reasoning in Aspect-Oriented Programming},
	Crossref = {FOAL04},
	Pages = {7-18},
	Address = {Lancaster, UK},
	Annote = {The paper presents TinyAspect, and ML-like core language with function and aspect declarations.  The paper then describes and extension to TinyAspect, Open Modules, that allow module declarations that expose certain join points to outside code.  Only function calls at the boundary of a module may be advised from outside the module; recursive calls to the same functions from within the module are not advised.  The paper proves a version of Reynold's abstraction property, a bisimulation/observational equivalence result.}
}

@InCollection{Aldrich05,
  author = {Jonathan Aldrich},
  title = {Open Modules: Modular Reasoning about Advice},
  booktitle =	 {ECOOP 2005 --- Object-Oriented Programming 19th
                  European Conference, Glasgow, UK},
  pages =	 {144-168},
  year =	 2005,
  editor =	 {Andrew P. Black},
  volume =	 3586,
  series =	 LNCS,
  address =	 {Berlin},
  month =	 jul,
  publisher =	 SV,
  annote =	 {39 references.},
  URL = {http://dx.doi.org/10.1007/11531142_7}
}

@InCollection{Alencar-Goguen91,
  Author =	 "A. J. Alencar and J. A. Goguen",
  Title =	 "{OOZE}: An Object Oriented {Z} Environment",
  BookTitle =	 "ECOOP '91: European Conference on Object Oriented
                  Programming",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "P. America",
  Series =	 LNCS,
  Volume =	 512,
  Pages =	 "180-199",
  Address =	 NY
}

@InCollection{Alencar-Goguen92,
  Author =	 "A. J. Alencar and J. A. Goguen",
  title =	 "{OOZE}",
  BookTitle =	 "Object Orientation in {Z}",
  Publisher =	 SV,
  Year =	 1992,
  Address =	 "Cambridge CB2 1LQ, UK",
  Series =	 "Workshops in Computing",
  Crossref =	 "Stepney-Barden-Cooper92",
  Pages =	 "79-94"
}

@InCollection{Alencar-Goguen94,
  Author =	 "A. J. Alencar and J. A. Goguen",
  title =	 "Specification in {OOZE} with Examples",
  booktitle =	 "Object-Oriented Specification Case Studies",
  Publisher =	 "Prentice Hall",
  Year =	 1994,
  Address =	 NY,
  Series =	 "The Object-Oriented Series",
  Crossref =	 "Lano-Haughton94",
  Pages =	 "158-183"
}

@InProceedings{Alexander-Rangarajan-Baraona99,
  title =        "A Brief Summary of {VSPEC}",
  author =       "Perry Alexander and Murali Rangarajan and Phillip
                 Baraona",
  booktitle =    "FM99: The World Congress in Formal Methods",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  LongBookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1709,
  pages =        "1068-1086",
  annote =       "28 references."
}

@Book{Alhir98,
  author =	 {Sinan Si Alhir},
  title =	 {UML in a Nutshell},
  publisher =	 {O'Reilly},
  year =	 1998,
  address =	 {Sebastapol, CA},
  annote =	 {39 references.}
}


@Article{Allen-Garlan-Ivers98,
  author =	 {Robert J. Allen and David Garlan and James Ivers},
  title =	 {Formal Modeling and Analysis of the {HLA} Component
                  Integration Standard},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 6,
  month =	 nov,
  pages =	 {70-79},
  note =	 {Proceedings of the ACM SIGSOFT Sixth Internatioal
                  Symposium on the Foundations of Software
                  Engineering},
  annote =	 {23 references.}
}

@Article{Allen-Garlan94,
  Author =	 "Robert Allen and David Garlan",
  Title =	 "Beyond Definition/Use: Architectural Interconnection",
  Journal =	 SIGPLAN,
  Year =	 1994,
  Volume =	 29,
  Number =	 8,
  Month =	 aug,
  Pages =	 "35-45",
  Annote =	 "14 references."
}

@InProceedings{Alt-Reitwiessner18,
author="Leonardo Alt and Christian Reitwiessner",
editor="Tiziana Margaria and Bernhard Steffen",
title="SMT-Based Verification of Solidity Smart Contracts",
booktitle="Leveraging Applications of Formal Methods, Verification and Validation. Industrial Practice",
year="2018",
publisher="Springer International Publishing",
address="Cham",
pages="376--388",
abstract="Ethereum smart contracts are programs that run inside a public distributed database called a blockchain. These smart contracts are used to handle tokens of value, can be accessed and analyzed by everyone and are immutable once deployed. Those characteristics make it imperative that smart contracts are bug-free at deployment time, hence the need to verify them formally. In this paper we describe our current efforts in building an SMT-based formal verification module within the compiler of Solidity, a popular language for writing smart contracts. The tool is seamlessly integrated into the compiler, where during compilation, the user is automatically warned of and given counterexamples for potential arithmetic overflow/underflow, unreachable code, trivial conditions, and assertion fails. We present how the component currently translates a subset of Solidity into SMT statements using different theories, and discuss future challenges such as multi-transaction and state invariants.",
isbn="978-3-030-03427-6",
annote="18 references."
}
                  
@InProceedings{Altman-Cyment-Kicillof05,
  author       = "Ruben Altman and Alan Cyment and Nicolas Kicillof",
  title        = {On the Need for {Setpoints}},
  booktitle    = "European Interactive Workshop on Aspects in Software",
  year         = "2005"
}

@InProceedings{Alur-Courcoubetts-Dill90,
  author = 	 {Rajeev Alur and C. Courcoubetts and David Dill"},
  title = 	 {Model checking for real-time systems},
  booktitle = {Proceedings of the 5th Annual Sympostum on Logic in Computer Science},
  pages = 	 {414-425},
  year = 	 1990,
  address = NY,
  publisher = {IEEE Computer Society Press}}

@InCollection{Alur-Henzinger92,
  Author =	 "Rajeev Alur and Thomas A. Henzinger",
  Title =	 "Logics and Models of Real Time: A Survey",
  BookTitle =	 "Real Time: Theory in Practice",
  Editor =       "J. W. de Bakker and C. Huizing and W. P. de Roever and G. Rozenberg",
  Publisher =	 SV,
  address =      NY,
  Year =	 1992,
  Series =	 LNCS,
  Volume =	 600,
  Pages =	 "74-106",
  Annote =       "50 references."
}

@article{Alur-Henzinger94,
 author = {Rajeev Alur and Thomas A. Henzinger},
 title = {A really temporal logic},
 journal = JACM,
 volume = 41,
 number = 1,
 year = 1994,
 pages = {181-203},
 doi = {http://doi.acm.org/10.1145/174644.174651},
 publisher = {ACM},
 address = {New York, NY, USA}
}

@Book{Ambler03,
  author =	 {Scott Ambler},
  title = 	 {The Elements of UML Style},
  publisher = 	 {Cambridge},
  year = 	 2003,
  address =	 {Cambridge, UK},
  annote =	 {30 references.}
} 

@Book{Ambler04,
  author =	 {Scott Ambler},
  title = 	 {The Object Primer Third Edition Agile Model-Driven Development with UML 2.0},
  publisher = 	 {Cambridge},
  year = 	 2004,
  address =	 {Cambridge, UK},
  annote =	 {Many references.}
}


@Article{Ambriola-Bendix-Ciancarini90,
  Author =	 "V. Ambriola and L. Bendix and P. Ciancarini",
  Title =	 "The evolution of configuration management and
                  version control",
  Journal =	 "Software Engineering Journal",
  Year =	 1990,
  Volume =	 5,
  Number =	 6,
  Month =	 nov,
  Pages =	 "303-310"
}

@TechReport{America-deBoer90a,
  Author =	 "Pierre America and Frank de Boer",
  Title =	 "A sound and complete proof theory for {SPOOL}",
  Institution =	 "Philips Research Laboratories",
  Address =	 "Nederlandse Philips Bedrijven B. V.",
  Number =	 505,
  Month =	 may,
  Year =	 1990,
  Annote =	 "A Hoare-style proof system. No subtyping, no
                  parallelism, no dynamic binding. 14 references."
}

@TechReport{America-deBoer90b,
  Author =	 "Pierre America and Frank de Boer",
  Title =	 "A Proof System for Process Creation",
  Institution =	 "Philips Research Laboratories",
  Address =	 "Nederlandse Philips Bedrijven B. V.",
  Number =	 506,
  Month =	 apr,
  Year =	 1990,
  Annote =	 "18 references."
}

@Article{America-deBoer90c,
  Author =	 "Pierre America and Frank de Boer",
  Title =	 "Proving Total Correctness of Recursive Procedures",
  journal={Information and Computation},
  volume=84,
  number=2,
  year=1990,
  pages={129--164}
}

@TechReport{America86,
  Author =	 "Pierre America",
  Title =	 "A proof theory for a sequential version of POOL",
  Institution =	 "Philips Research Laboratories",
  Address =	 "Nederlandse Philips Bedrijven B. V.",
  Number =	 "0188",
  Month =	 oct,
  Year =	 1986,
  Annote =	 "Explores the possibilities for a Hoare-style proof
                  system. No subtyping, no parallelism, no dynamic
                  binding. 13 references."
}

@InProceedings{Amtoft-etal08,
  author = 	 {Torben Amtoft and John Hatcliff and Edwin Rodriguez and Robby and Jonathan Hoag and David Greve},
  title = 	 {Specification and Checking of Software Contracts for Conditional Information Flow},
  booktitle =    {15th International Symposium on Formal Methods (FM'08)},
  year = 	 2008,
  series = 	 LNCS,
  volume =       5014,
  pages =        {229-245},
  month = 	 may,
  publisher =    SV,
  address =      NY
}

@InCollection{Andersen-Reenskaug92,
  Author =	 "Egil P. Andersen and Trygve Reenskaug",
  Title =	 "System Design by Composing Structures of Interacting
                  Objects",
  BookTitle =	 "ECOOP '92, European Conference on Object-Oriented
                  Programming, Utrecht, The Netherlands",
  Publisher =	 SV,
  Year =	 1992,
  Editor =	 "Ole Lehrmann Madsen",
  Series =	 LNCS,
  Address =	 NY,
  Volume =	 615,
  Pages =	 "133-152",
  Annote =	 "21 references"
}

@Unpublished{Andersen-etal93,
  Author =	 "Jorgen F. Sogaard-Andersen and Stephen J. Garland
                  and John V. Guttag and Nancy A. Lynch and Anna Pogosyants",
  Title =	 "Computer Assisted Simulation Proofs",
  Month =	 jan,
  Year =	 1993,
  Note =	 "Obtained from the Authors"
}

@Article{Anderson-etal96,
  author =	 {Richard J. Anderson and Paul Beame and Steve Burns
                  and William Chan and Francesmary Modugno and David
                  Notkin and Jon D. Reese},
  title =	 {Model Checking Large Software Specifications},
  journal =	 SIGSOFT,
  year =	 1996,
  editor =	 {David Garlan},
  volume =	 21,
  number =	 6,
  month =	 nov,
  pages =	 {156-166},
  note =	 {SIGSOFT '96: Proceedings of the Fourth ACM SIGSOFT
                  Symposium on the Foundations of Software
                  Engineering, San Francisco, California},
  annote =	 {22 references.}
}

@Book{Andleigh-Gretzinger92,
  Author =	 "Prabhat K. Andleigh and Michael R. Gretzinger",
  Title =	 "Distributed Object-Oriented Data-Systems Design",
  Publisher =	 "PTR Prentice Hall",
  Year =	 1992,
  Address =	 "Englewood Cliffs, New Jersey",
  Annote =	 "27 references."
}

@Book{Andrews-Gibbins88,
  author =	 {D. Andrews and P. Gibbins},
  title =	 {An Introduction to Formal Methods of Software
                  Development},
  publisher =	 {The Open University Press},
  year =	 1988,
  address =	 {Milton Keynes, UK}
}

@TechReport{Andrews-etal93,
  author =	 "D.J. Andrews and others",
  title =	 "Information Technology Programming Languages ---
                  {VDM-SL}: First Committee Draft Standard {CD1387-1}",
  institution =	 "International Standards Organization",
  year =	 "1993",
  type =	 "Document",
  number =	 "ISO/IEC JTC1/SC22/WG19 N-20",
  month =	 nov,
  note =	 "\url{ftp://gatekeeper.dec.com/pub/standards/vdmsl/}",
  URL =		 "ftp://gatekeeper.dec.com/pub/standards/vdmsl/"
}

@TechReport{Andrews96,
  author =	 "D. J. Andrews",
  title =	 "Information Technology Programming Languages, Their Environments and System Software Interfaces: {Vienna Development Method} -- Specification Language -- Part 1: Base Language",
  institution =	 "International Standards Organization",
  year =	 "1996",
  type =	 "International Standard",
  number =	 "ISO/IEC 13817-1"
}

@Book{Andrews97,
  author =	 {Derek Andrews},
  title =	 {A Theory and Practice of Program Development},
  publisher =	 SV,
  year =	 1997,
  series =	 {FACIT},
  address =	 {London, UK},
  annote =	 {Introduction to formal software development based on
                  VDM-SL.}
}

@inproceedings{Anlauff00,
 author = {Matthias Anlauff},
 title = {XASM - An Extensible, Component-Based ASM Language},
 booktitle = {ASM '00: Proceedings of the International Workshop on Abstract State Machines, Theory and Applications},
 year = {2000},
 isbn = {3-540-67959-6},
 pages = {69--90},
 publisher = SV,
 address = {London, UK}
}

@InCollection{Antoniou-Sperschneider89,
  Author =	 "G. Antoniou and V. Sperschneider",
  Title =	 "On the verification of modules",
  BookTitle =	 "CSL '89",
  Publisher =	 SV,
  Year =	 1989,
  Editor =	 "E. Gorger and H. Kleine Buning and M. M. Richter",
  Series =	 LNCS,
  Volume =	 440,
  Pages =	 "16-35",
  Address =	 NY
}

@Article{Antoy-Gannon94,
  Author =	 "S. Antoy and J. Gannon",
  Title =	 "Using Term Rewriting to Verify Software",
  Journal =	 IEEETSE,
  Year =	 1994,
  Volume =	 20,
  Number =	 4,
  Month =	 apr,
  Pages =	 "259-274",
  Annote =	 "30 references."
}

@article{Antoy-Hamlet00,
  author =	 {Sergio Antoy and Dick Hamlet},
  title =	 {Automatically Checking an Implementation against its
                  Formal Specification},
  journal =	 IEEETSE,
  year =	 {2000},
  month =	 jan,
  volume =	 {26},
  number =	 {1},
  pages =	 {55-69},
  annote =       "Generates test oracles for C++ or Java from algebraic specifications with representation functions."
}

@inproceedings{Aotani-Leavens16,
 author = {Tomoyuki Aotani and Gary T. Leavens},
 title = {Towards Modular Reasoning for Context-Oriented Programs},
 booktitle = {Proceedings of the 18th Workshop on Formal Techniques for Java-like Programs},
 series = {FTfJP'16},
 year = {2016},
 location = {Rome, Italy},
 pages = {8:1--8:7},
 articleno = {8},
 numpages = {7},
 url = {http://doi.acm.org/10.1145/2955811.2955819},
 doi = {10.1145/2955811.2955819},
 publisher = {ACM},
 address = NY,
 annote = "15 references."
}

@Misc{ApacheStruts08,
	author 				= {{Apache Software Foundation}},
	title 				= {Struts},
	year 					= {2008},
	howpublished 	= {From 
	                      \url{http://struts.apache.org/}
	                      (Date retrieved: March 19, 2008)}
}

@Misc{ApacheTapestry508,
	author 				= {{Apache Software Foundation}},
	title 				= {Tapestry 5},
	year 					= {2008},
	howpublished 	= {From
	                      \url{http://tapestry.apache.org/tapestry5/}
	                      (Date retrieved: March 19, 2008)}
}

@Article{Apt-Francez-deRoever80,
  Author =	 "K. R. Apt and N. Francez and W. P. de Roever",
  Title =	 "A Proof System for Communicating Sequential
                  Processes",
  Journal =	 TOPLAS,
  Volume =	 2,
  Number =	 3,
  Month =	 jul,
  Year =	 1980,
  Pages =	 "359-385"
}

@InCollection{Apt-Olderog91,
  Author =	 "Krzysztof R. Apt and {Ernst-Rudiger} Olderog",
  Title =	 "Introduction to Program Verification",
  BookTitle =	 "Formal Description of Programming Concepts",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "E. J. Neuhold and M. Paul",
  Series =	 "IFIP State-of-the-Art Reports",
  Pages =	 "363-429",
  Address =	 NY,
  Annote =	 "ISBN 0-387-53961-1. 15 references."
}

@Book{Apt-Olderog97,
  author =	 {Krzystof R. Apt and {Ernst-R\"{u}diger} Olderog},
  title =	 "Verification of sequential and concurrent programs",
  publisher =	 SV,
  address =	 NY,
  year =	 1997,
  edition =	 "2nd ed.",
  series =	 "Graduate texts in computer science series."
}

@Article{Apt81,
  Author =	 "Krzystof R. Apt",
  Title =	 "Ten Years of {Hoare}'s Logic: A Survey---Part {I}",
  Journal =	 TOPLAS,
  Volume =	 3,
  Number =	 4,
  Month =	 oct,
  Year =	 1981,
  Pages =	 "431-483",
  URL =          {http://doi.acm.org/10.1145/357146.357150},
  Annote =	 "Survey of soundness and completeness results in
                  Hoare's logic. 55 references."
}

@Book{Arlow-Neustadt02,
  author =	 {Jim Arlow and Ila Neustadt},
  title =	 {UML and the Unified Process: Practical
                  Object-Oriented Analysis and Design},
  publisher =	 {Addison-Wesley},
  address =	"Indianoplis, IN",
  year =	 2002,
  annote =	 {15 references.}
}

@Book{Arlow-Neustadt05,
  author =	 {Jim Arlow and Ila Neustadt},
  title =	 {UML 2 and the Unified Process Second Edition:
                  Practical Object-Oriented Analysis and Design},
  publisher =	 {Addison-Wesley},
  address =	"Indianoplis, IN",
  year =	 2005,
  annote =	 {26 references.}
}

@Article{Arsac79,
  Author =	 "J. J. Arsac",
  Title =	 "Syntactic Source-to-Source Transforms and Program
                  Manipulation",
  Journal =	 CACM,
  Year =	 1979,
  Month =	 jan,
  Volume =	 22,
  Number =	 1,
  Pages =	 "43-54"
}

@Article{Ashcroft75,
  author =	 "Ashcroft",
  title =	 "Proving Assertions about Parallel Programs",
  journal =	 "Journal of Computer and System Sciences",
  volume =	 "10",
  pages =	 "110-135",
  year =	 "1975"
}

@TechReport{Assaad-Leavens01,
  author =	 {Medhat G. Assaad and Gary T. Leavens},
  title =	 {Alias-free parameters in {C} for Better Reasoning
                  and Optimization},
  institution =	 "Department of Computer Science, Iowa State
                  University",
  year =	 2001,
  number =	 "01-11",
  address =	 "226 Atanasoff Hall, Ames, Iowa 50011",
  month =	 nov,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR01-11/TR.pdf",
  Note =	 "Available from \url{archives.cs.iastate.edu}.",
  Annote =	 "Applies the ACL approach to C. Describes the
                  optimization opportunities that arise. 33
                  references."
}

@TechReport{Assaad01,
  author =	 {Medhat G. Assaad},
  title =	 {Alias-free parameters in {C} using multibodies},
  institution =	 "Department of Computer Science, Iowa State
                  University",
  year =	 2001,
  number =	 "01-05",
  address =	 "226 Atanasoff Hall, Ames, Iowa 50011",
  month =	 jul,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR01-05/TR.pdf",
  Note =	 "Available from \url{archives.cs.iastate.edu}.",
  Annote =	 "Applies the ACL approach to C. 16 references."
}

@InCollection{Astesiano-Reggio91,
  Author =	 "Egidio Astesiano and Gianna Reggio",
  Title =	 "Algebraic Specification of Concurrency",
  BookTitle =	 "Recent Trends in Data Type Specification",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "M. Bidot and C. Choppy",
  Series =	 LNCS,
  Volume =	 655,
  Pages =	 "1-39",
  Address =	 NY,
  Annote =	 "66 references."
}

@InCollection{Astesiano-Reggio93,
  Author =	 "Egidio Astesiano and Gianna Reggio",
  Title =	 "A Metalanguage for the Formal Requirement
                  Specification of Reactive Systems",
  BookTitle =	 "Industrial-Strength Formal Methods, First
                  International Symposium of Formal Methods Europe,
                  Odense, Denmark",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "J.C.P. Woodcock and P.G. Larsen",
  Series =	 LNCS,
  Volume =	 670,
  Pages =	 "110-128",
  Address =	 NY,
  Month =	 apr,
  Annote =	 "22 references."
}

@InProceedings{Atkey06,
  author =	 {Robert Atkey},
  title = 	 {Specifying and Verifying Heap Space Allocation
                 with {JML} and {ESC/Java2} (Preliminary Report)},
  booktitle =	 {Workshop on Formal Techniques for Java-like Programs (FTfJP)},
  year =	 2006,
  month =	 jul,
  URL = 	 {http://www.disi.unige.it/person/AnconaD/FTfJP06/paper02.pdf},
  annote =       {10 references.}
}

@TechReport{Attardi-Simi82,
  Author =	 "Giuseppe Attardi and Maria Simi",
  Title =	 "Semantics of Inheritance and Attributions in the
                  Description System Omega",
  Institution =	 MITAI,
  Type =	 "A.I. Memo",
  Number =	 642,
  Month =	 jan,
  Year =	 1982,
  Annote =	 "26 references."
}

@InProceedings{Audsley-etal91,
    author = "N. C. Audsley and A. Burns and M. F. Richardson and A. J. Wellings",
    title = "Hard Real-Time Scheduling: The Deadline Monotonic Approach",
    booktitle = "Proceedings 8th {IEEE} Workshop on Real-Time Operating Systems and Software",
    address = "Atalanta",
    year = "1991"
}

@unpublished{BCore99,
  author    = {{B-Core (UK) Limited}},
  title     = {B-Toolkit Manuals},
  note = {\url{http://www.b-core.com}},
  year      = 1999
}

@Book{Baader-Nipkow98,
  author =	 {Franz Baader and Tobias Nipkow},
  title =	 {Term Rewriting and All That},
  publisher =	 {Cambridge University Press},
  year =	 1998,
  address =	 {Cambridge, UK},
  annote =	 {252 references.}
}

@Article{Babin-Lustman-Shoval91,
  Author =	 "Gilbert Babin and Francois Lustman and Peretz
                  Shoval",
  Title =	 "Specification and Design of Transactions in
                  Information Systems: A Formal Approach",
  Journal =	 IEEETSE,
  Year =	 1991,
  Volume =	 17,
  Number =	 8,
  Month =	 aug,
  Pages =	 "814-829",
  Annote =	 "14 references."
}

@InProceedings{Back-Butler95,
  author =	 "R.-J. R. Back and M. Butler",
  title =	 "Exploring summation and product operators in the
                  refinement calculus",
  series =	 LNCS,
  volume =	 "947",
  pages =	 "128ff",
  booktitle =	 "Mathematics of Program Construction, Kloster Irsee, Germany",
  editor =	 {B. M\"{o}ller},
  year =	 1995
}

@Article{Back-Butler98,
  author =	 "R.-J. R. Back and M. Butler",
  title =	 "Fusion and Simultaneous Execution in the Refinement Calculus",
  journal =	 "Acta Informatica",
  volume =	 35,
  number =       11,
  pages =	 "921-949",
  year =	 1998,
  annote =       "29 references."
}

@Article{Back-Mikhajlova-vonWright00,
  author =	 {Ralph-Johan Back and Anna Mikhajlova and Joakim von
                  Wright},
  title =	 {Class Refinement as Semantics of Correct Object
                  Substitutability},
  journal =	 {Formal Aspects of Computing},
  volume =	 12,
  number =	 1,
  pages =	 "18-40",
  year =	 2000,
  annote =       {38 references.},
  url = {http://dx.doi.org/10.1007/s001650070034}
}

@TechReport{Back-Mikhajlova-vonWright97,
  Author =	 "Ralph Back and Anna Mikhajlova and Joakim von
                  Wright",
  Title =	 "Class Refinement as Semantics of Correct
                  Subclassing",
  Institution =	 "Turku Centre for Computer Science",
  Year =	 1997,
  Number =	 147,
  month =	 dec,
  note =	 "\newline
                  {http://www.tucs.abo.fi/publications/techreports/TR147.html}",
  URL =
                  {http://www.tucs.abo.fi/publications/techreports/TR147.html}
}

@TechReport{Back-Mikhajlova-vonWright98,
  Author =	 "Ralph Back and Anna Mikhajlova and Joakim von
                  Wright",
  Title =	 "Modeling Component Environments and Interactive
                  Programs Using Iterative Choice",
  Institution =	 "Turku Centre for Computer Science",
  Year =	 1998,
  Number =	 200,
  month =	 sep,
  note =	 "\url{http://www.tucs.abo.fi/publications/techreports/TR200.html}",
  URL =          {http://www.tucs.abo.fi/publications/techreports/TR200.html}
}

@InProceedings{Back-Mikhajlova-vonWright99,
  author =       "R. J. R. Back and Anna Mikhajlova and Joakim von
                 Wright",
  title =        "Reasoning About Interactive Systems",
  editor =	 {Jeannette M. Wing and Jim Woodcock and Jim Davies},
  booktitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  series =	 LNCS,
  publisher =	 SV,
  volume =       "1709",
  year =         "1999",
  pages =        "1460-1476",
  annote =       "14 references."
}

@Article{Back-Sere90,
  AUTHOR =	 "R. J. R. Back and K. Sere",
  TITLE =	 "Stepwise Refinement of Parallel Algorithms",
  JOURNAL =	 SCP,
  YEAR =	 1990,
  VOLUME =	 13,
  NUMBER =	 "2-3",
  PAGES =	 "133-180"
}

@TechReport{Back-vonWright89a,
  Author =	 "R. J. R. Back and J. {von Wright}",
  Title =	 "Refinement Calculus, Part {I}: Sequential
                  Nondeterministic Programs",
  Institution =	 {Abo Akademi University, Department of Computer
                  Science, Lemmink\"{a}inengatan 14, 20520 Abo,
                  Finland},
  Number =	 "Ser. A, No 92",
  Year =	 1989,
  Note =	 "Appears in {\em Stepwise Refinement of Distributed
                  Systems, Models, Formalisms, Correctness, REX
                  Workshop}, Mook, The Netherlands, May/June 1989,
                  Spring-Verlag, LNCS 430, J. W. de Bakker, et al,
                  (eds.), pages 42--66"
}

@TechReport{Back-vonWright89b,
  Author =	 "R. J. R. Back and J. {von Wright}",
  Title =	 "Refinement Calculus, Part {II}: Parallel and
                  Reactive Programs",
  Institution =	 {Abo Akademi University, Department of Computer
                  Science, Lemmink\"{a}inengatan 14, 20520 Abo,
                  Finland},
  Number =	 "Ser. A, No 93(?)",
  Year =	 1989,
  Note =	 "Appears in {\em Stepwise Refinement of Distributed
                  Systems, Models, Formalisms, Correctness, REX
                  Workshop}, Mook, The Netherlands, May/June 1989,
                  Spring-Verlag, LNCS 430, J. W. de Bakker, et al,
                  (eds.), pages 67--93"
}

@Article{Back-vonWright90,
  Author =	 "R. J. R. Back and J. {von Wright}",
  Title =	 "Duality in Specification Languages: A
                  Lattice-theoretical Approach",
  Journal =	 "Acta Informatica",
  Volume =	 27,
  Number =	 7,
  Month =	 jul,
  Year =	 1990,
  Pages =	 "583-626"
}

@Article{Back-vonWright92,
  Author =	 "R. J. R. Back and J. {von Wright}",
  Title =	 "Combining Angels, deamons and miracles in program
                  specifications",
  Journal =	 TCS,
  Volume =	 100,
  Number =	 2,
  Month =	 jun,
  Year =	 1992,
  Pages =	 "365-383"
}

@TechReport{Back-vonWright96,
  author =	 "Ralph-Johan Back and Joakim von Wright",
  title =	 "Interpreting Nondeterminism in the Refinement
                  Calculus",
  institution =	 "TUCS - Turku Centre for Computer Science",
  number =	 "TUCS-TR-35",
  month =	 jul # " 26",
  year =	 "1996",
  keywords =	 "Refinement Calculus, nondeterminism",
  url =
                  "http://www.tucs.abo.fi/publications/techreports/TR35.html",
  abstract =	 "We introduce a simple programming language and
                  define its predicate transformer semantics. We
                  motivate the choice of the constructs for the
                  language by algebra ic arguments, showing that the
                  constructs are essentially the basic algebraic op
                  erations that are available for predicate
                  transformers, when these are viewed as forming a
                  complete lattice enriched category. We then show
                  that the statements in the language can be given a
                  simple operational interpretation, as describing the
                  interaction between a user and a computing
                  system. This gives a general intuitive
                  interpretation of angelic and demonic
                  nondeterminism. We also consider the notion of
                  correctness and refinement of program statements
                  that this intuitive interpretation gives rise to,
                  and show the connection between the user-system
                  interpretation and the interpretation of program
                  execution as a game."
}

@Book{Back-vonWright98,
  Author =	 "Ralph-Johan Back and Joakim von Wright",
  Title =	 "Refinement Calculus: A Systematic Introduction",
  Series =	 {Graduate Texts in Computer Science},
  Publisher =	 SV,
  Address =      "Berlin",
  Year =	 1998,
  Annote =	 "Mathematical foundations of the refinement
                  calculus. 144 references."
}

@phdthesis{Back78,
  author    = "R.-J. R. Back",
  title     = "On the Correctness of Refinement Steps in Program Development",
  school    = "University of Helsinki",
  year      = 1978,
  note      = "Report A-1978-4"
}

@Book{Back80,
  author =	 "R. J. R. Back",
  title =	 "Correctness Preserving Program Refinements: Proof
                  Theory and Applications",
  series =	 "Mathematical Center Tracts",
  volume =	 131,
  publisher =	 "Mathematical Centre",
  address =	 "Amsterdam",
  year =	 1980
}

@Article{Back88,
  Author =	 "R. J. R. Back",
  Title =	 "A Calculus of Refinements for Program Derivations",
  Journal =	 "Acta Informatica",
  Volume =	 25,
  Number =	 6,
  Month =	 aug,
  Year =	 1988,
  Pages =	 "593-624"
}

@InProceedings{Back89,
  author =	 "R. J. R. Back",
  title =	 "Refinement calculus, part {II}: Parallel and
                  reactive programs",
  editor =	 "J. W. {de Bakker} and W.-P. {de Roever} and
                  G. Rozenberg",
  booktitle =	 "Stepwise Refinement of Distributed Systems",
  other =	 "REX Workshop for Refinement of Distributed Systems",
  location =	 "Nijmegen, The Netherlands, 1989",
  publisher =	 SV,
  series =	 "LNCS 430",
  year =	 "1990"
}

@InCollection{Back93,
  author =	 "Ralph-Johan Back",
  title =	 "Refinement Calculus, Lattices and Higher Order
                  Logic",
  booktitle =	 "Program Design Calculi",
  publisher =	 SV,
  editor =	 "F. L. Bauer and M. Broy and E. W. Dijkstra and
                  D. Gries and C. A. R. Hoare",
  year =	 1993
}

@Book{Backhouse86,
  Author =	 "Roland C. Backhouse",
  Title =	 "Program Construction and Verification",
  Publisher =	 Prentice-Hall,
  Address =	 "Englewood Cliffs, N.J.",
  Year =	 1986
}

@inproceedings{Bagherzadeh-Leavens-Dyer11,
 author = {Mehdi Bagherzadeh and Gary T. Leavens and Robert Dyer},
 title = {Applying translucid contracts for modular reasoning about aspect and object oriented events},
 booktitle = {Proceedings of the 10th international workshop on Foundations of aspect-oriented languages},
 series = {FOAL '11},
 year = {2011},
 location = {Porto de Galinhas, Brazil},
 pages = {31--35},
 numpages = {5},
 url = {http://doi.acm.org/10.1145/1960510.1960517},
 doi = {http://doi.acm.org/10.1145/1960510.1960517},
 publisher = {ACM},
 address = {New York, NY, USA},
}

@TechReport{Bagherzadeh-etal10,
Author = {Mehdi Bagherzadeh and Hridesh Rajan and Gary T. Leavens and Sean Mooney},
Title = {Translucid Contracts: Expressive Specification and Modular Verification for Aspect-oriented Interfaces},
institution = {Department of Computer Science, Iowa State University},
year = 2010,
number = {10-02a},
month = jul,
URL = {http://www.cs.iastate.edu/~design/papers/TR-10-02/TR-10-02.pdf},
note = {To appear in AOSD 2011.},
Annote = {32 references.}                  
}

@InProceedings{Bagherzadeh-etal10a,
Author = {Mehdi Bagherzadeh and Hridesh Rajan and Gary T. Leavens and Sean Mooney},
Title = {Translucid Contracts for Modular Reasoning about Aspect-oriented Programs},
BookTitle = {SPLASH'10 Companion},
year = 2010,
pages = {245-246},
month = oct,
URL = {http://dx.doi.org/10.1145/1869542.1869596},
Annote = {7 references.}                  
}

@InProceedings{Bagherzadeh-etal11,
 Author = {Mehdi Bagherzadeh and Hridesh Rajan and Gary T. Leavens and Sean Mooney},
 Title = {Translucid Contracts: Expressive Specification and Modular Verification for Aspect-oriented Interfaces},
 booktitle = {Proceedings of the tenth international conference on Aspect-oriented software development},
 series = {AOSD '11},
 year = {2011},
 location = {Porto de Galinhas, Brazil},
 pages = {141--152},
 numpages = {12},
 url = {http://doi.acm.org/10.1145/1960275.1960293},
 doi = {http://doi.acm.org/10.1145/1960275.1960293},
 acmid = {1960293},
 publisher = {ACM},
 address = {New York, NY, USA},
}

@inproceedings{Bagherzadeh-etal15,
 author = {Mehdi Bagherzadeh and Robert Dyer and Rex D. Fernando and Jos{\'e} S\'{a}nchez and Hridesh Rajan},
 title = {Modular Reasoning in the Presence of Event Subtyping},
 booktitle = {Proceedings of the 14th International Conference on Modularity},
 series = {MODULARITY 2015},
 year = {2015},
 isbn = {978-1-4503-3249-1},
 location = {Fort Collins, CO, USA},
 pages = {117--132},
 numpages = {16},
 url = {http://doi.acm.org/10.1145/2724525.2724569},
 doi = {10.1145/2724525.2724569},
 acmid = {2724569},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {Event subtyping, event specification refinement, event type inheritance, modular reasoning, translucid contracts},
 annote = {50 references.}
}

@Article{Bahlke-Snelting86,
  Author =	 "Rolf Bahlke and Gregor Snelting",
  Title =	 "The PSG System: From Formal Language Definitions to
                  Interactive Programming Environments",
  Journal =	 TOPLAS,
  Volume =	 8,
  Number =	 4,
  Month =	 oct,
  Year =	 1986,
  Pages =	 "547-576",
  Annote =	 "43 references."
} 

@InProceedings{Bailey-Davidson95,
  Author =	 {Mark W. Bailey and Jack W. Davidson},
  Title =	 "A Formal Model and Specification Language for
                  Procedure Calling Conventions",
  BookTitle =	 "Conference Record of POPL '95: 22nd Annual ACM
                  SIGPLAN-SIGACT Symposium on Principles of
                  Programming Languages, San Francisco, Calif.",
  Month =	 jan,
  Year =	 1995,
  Organization = ACM,
  Address =	 NY,
  Pages =	 "298-310",
  Annote =	 "For compilers or assembly language. 18 references."
}

@InProceedings{Ball-Rajamani01,
  author =	 "Thomas Ball and Sriram K. Rajamani",
  title =	 "The {SLAM} Toolkit",
  booktitle =	 "Computer Aided Verification",
  publisher =    SV,
  address =      "Berlin",
  year =	 "2001",
  pages =	 "260-264",
  series =       LNCS,
  volume =       2102,
  url =          {http://dx.doi.org/10.1007/3-540-44585-4_25}
}

@InProceedings{Ball-Rajamani02,
  author =	 "Thomas Ball and Sriram K. Rajamani",
  title =	 "The {SLAM} Project: Debugging System Software via Static Analysis",
  booktitle =	 "Conference Record of {POPL}'02: The 29th {ACM}
                  {SIGPLAN}-{SIGACT} Symposium on Principles of
                  Programming Languages",
  location =	 "Portland, Oregon",
  month =	 jan # " 16--18,",
  year =	 "2002",
  pages =	 "1-3",
  publisher =    ACM,
  address =      NY,
  url = {http://doi.acm.org/10.1145/503272.503274}
}

@InProceedings{Ball-etal06,
  author = "Thomas Ball and Ella Bounimova and Byron Cook and
            Vladimir Levin and Jakob Lichtenberg and Con McGarvey and
            Bohus Ondrusek and Sriram K. Rajamani and Abdullah Ustuner",
  title = "Thorough Static Analysis of Device Drivers",
  booktitle = {EuroSys'06},
  pages = {73-85},
  year = {2006},
  publisher = ACM,
  location = {Leuven, Belgium},
  URL = {http://doi.acm.org/10.1145/1217935.1217943}
}

@Article{Ball98,
  author =	 {Ball},
  title =	 {On the Limit of Control Flow Analysis for Regression
                  Test Selection},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 2,
  month =	 mar,
  pages =	 {134-142},
  note =	 {ISSTA 98: Proceedings of the ACM SIGSOFT
                  International Symposium on Software Testing and
                  Analysis},
  annote =	 {12 references.}
}

@Article{Balsamo-etal04,
  author = 	 {Simonetta Balsamo and Antinisca {Di Marco} and Paola Inverardi and Marta Simeoni},
  title = 	 {Model-Based Performance Prediction in Software Development: A Survey},
  journal = 	 IEEETSE,
  year = 	 2004,
  volume =	 30,
  number =	 5,
  pages =	 {295-310},
  month =	 {May}
}

@InProceedings{Balzer-Goldman-Wile76,
  Author =	 "R. Balzer and N. Goldman and D. Wile",
  Title =	 "On the Transformational Implementation Approach to
                  Programming",
  BookTitle =	 "Proceedings of the Second International Conference
                  on Software Engineering",
  Organization = IEEE,
  Year =	 1976,
  Pages =	 "337-344"
}

@Article{Balzer-Swartout82,
  Author =	 "R. Balzer and W. Swartout",
  Title =	 "On the Inevitable Intertwining of Specification and
                  Implementation",
  Journal =	 CACM,
  Year =	 1982,
  Month =	 jul,
  Volume =	 25,
  Number =	 7,
  Pages =	 "438-440"
}

@InProceedings{Balzer67,
  Author =	 "R. Balzer",
  Title =	 "Dataless Programming",
  BookTitle =	 "1967 Fall Joint Computer Conference",
  Organization = AFIPS,
  Year =	 1967,
  Pages =	 "535-544"
}

@Article{Balzer81,
  Author =	 "Robert Balzer",
  Title =	 "Transformational Implementation: an Example",
  Journal =	 IEEETSE,
  Year =	 1981,
  Month =	 jan,
  Volume =	 "SE-7",
  Number =	 1,
  Annote =	 "System for transforming specifications into
                  implementations under user control. An example is
                  worked. An evaluation of this approach is
                  discussed. 18 references."
}

@INPROCEEDINGS{Bancroft93,
  author =	 {P. G. Bancroft},
  title =	 {Pointers in refinement calculus: A case study},
  booktitle =	 {Proceedings of the 7th Australian Software
                  Engineering Conference},
  year =	 1993,
  month =	 jul,
  pages =	 "11-19",
  organization = {IREE}
}

@INCOLLECTION{Bancroft95,
  author =	 {P. G. Bancroft and I. J. Hayes},
  title =	 {A formal semantics for a language with type
                  extension},
  editor =	 {Jonathan P. Bowen and Michael Hinchey},
  booktitle =	 {ZUM'95: The Z Formal Specification Notation},
  number =	 967,
  series =	 {Lecture Notes in Computer Science},
  pages =	 "299-314",
  publisher =	 SV,
  year =	 1995
}

@inproceedings{Banerjee-Barnett-Naumann08,
  author    = {Anindya Banerjee and Michael Barnett and David A. Naumann},
  title     = {Boogie Meets Regions: A Verification Experience Report},
  booktitle = {Verified Software: Theories, Tools, Experiments (VSTTE)},
  year      = 2008,
  pages     = {177-191},
  editor    = {Natarajan Shankar and Jim Woodcock},
  publisher = SV,
  address   = NY,
  series    = LNCS,
  volume    = 5295
}

@inproceedings{Banerjee-Naumann-Rosenberg08,
  author    = {Anindya Banerjee and David A. Naumann and Stan Rosenberg},
  title     = {Regional Logic for Local Reasoning about Global Invariants},
  booktitle = {European Conference on Object-Oriented Programming (ECOOP)},
  year      = 2008,
  pages     = {387-411},
  editor    = {Jan Vitek},
  publisher = SV,
  address   = NY,
  series    = LNCS,
  volume    = 5142
}

@article{Banerjee-Naumann-Rosenberg13,
 author = {Anindya Banerjee and David A. Naumann and Stan Rosenberg},
 title = {Local Reasoning for Global Invariants, Part I: Region Logic},
 journal = JACM,
 volume = {60},
 number = {3},
 month = jun,
 year = {2013},
 issn = {0004-5411},
 pages = {18:1--18:56},
 articleno = {18},
 numpages = {56},
 url = {http://doi.acm.org/10.1145/2485982},
 doi = {10.1145/2485982},
 publisher = {ACM},
 address = NY,
 keywords = {Modularity, data abstraction, data invariants, heap separation, information hiding, resource protection},
 annote = {83 references.}
}

@InProceedings{Banerjee-Naumann02,
  author =	 {Anindya Banerjee and David A. Naumann},
  title =	 {Representation Independence, Confinement and Access
                  Control},
  booktitle =	 POPL,
  year =	 2002,
  pages =	 {166-177}
}

@article{Banerjee-Naumann05,
author={Anindya Banerjee and David A. Naumann},
title={Ownership Confinement Ensures Representation Independence for Object-Oriented Programs},
journal=JACM,
volume=52,
number=6,
year=2005,
month=nov,
pages={894-960},
URL={http://www.cs.stevens-tech.edu/~naumann/oceri.ps}
}

@InProceedings{Banerjee-Naumann05a,
author="Anindya Banerjee and David A. Naumann",
editor="Andrew P. Black",
title="State Based Ownership, Reentrance, and Encapsulation",
booktitle="ECOOP 2005 -- Object-Oriented Programming",
year="2005",
publisher=SV,
address="Berlin, Heidelberg",
pages="387-411",
abstract="A properly encapsulated data representation can be revised for refactoring or other purposes without affecting the correctness of client programs and extensions of a class. But encapsulation is difficult to achieve in object-oriented programs owing to heap based structures and reentrant callbacks. This paper shows that it is achieved by a discipline using assertions and auxiliary fields to manage invariants and transferrable ownership. The main result is representation independence: a rule for modular proof of equivalence of class implementations.",
isbn="978-3-540-31725-8",
annote="31 references."
}

@article{Banerjee-Naumann13,
 author = {Anindya Banerjee and David A. Naumann},
 title = {Local Reasoning for Global Invariants, Part II: Dynamic Boundaries},
 journal = JACM,
 issue_date = {June 2013},
 volume = {60},
 number = {3},
 month = jun,
 year = {2013},
 issn = {0004-5411},
 pages = {19:1--19:73},
 articleno = {19},
 numpages = {73},
 url = {http://doi.acm.org/10.1145/2485981},
 doi = {10.1145/2485981},
 acmid = {2485981},
 publisher = {ACM},
 address = NY,
 keywords = {Modularity, data abstraction, data invariants, heap separation, information hiding, resource protection},
 annote = {90 references.}                  
} 

@inproceedings{Bannwart-Mueller05,
 author = {Fabian Bannwart and Peter M{\"u}ller},
 title = {A Logic for Bytecode},
 booktitle = {Bytecode Semantics, Verification, Analysis and Transformation (BYTECODE)},
 editor = {Fausto Spoto},
 year = 2005,
 series = {Electronic Notes in Theoretical Computer Science},
 volume = {141(1)},
 pages = {255-273},
 URL = {http://dx.doi.org/10.1016/j.entcs.2005.02.026},
 publisher = {Elsevier}
}

@Article{Bansler-Bodker93,
  Author =	 "Jorgen P. Bansler and Keld Bodker",
  Title =	 "A Reappraisal of Structured Analysis: Design in an
                  Organizational Context",
  Journal =	 "ACM Transactions on Office Information Systems",
  Volume =	 11,
  Number =	 2,
  Pages =	 "165-193",
  Year =	 1993
}
                  
@TechReport{Bao-Leavens-Ernst14,
  author = 	 {Yuyan Bao and Gary T. Leavens and Gidon Ernst},
  title = 	 {Translating Separation Logic into Dynamic Frames Using Fine-Grained Region Logic},
  institution =  {Computer Science, University of Central Florida},
  year = 	 2014,
  number = 	 {CS-TR-13-02a},
  address = 	 {Orlando, Florida},
  month = 	 mar,
  URL =         {\url{http://goo.gl/jLv7g0}},
  Note =         {\url{http://goo.gl/jLv7g0}},
  annote =      {21 references.}
}

@TechReport{Bao-Leavens-Ernst15,
  author = 	 {Yuyan Bao and Gary T. Leavens and Gidon Ernst},
  title = 	 {Conditional Effects in Fine-grained Region Logic},
  institution =  {Computer Science, University of Central Florida},
  year = 	 2015,
  number = 	 {CS-TR-15-01},
  address = 	 {Orlando, Florida},
  month = 	 mar,
  annote = 	 {13 references.}
}

@inproceedings{Bao-Leavens-Ernst15a,
  author = {Yuyan Bao and Gary T. Leavens and Gidon Ernst},
  title = {Conditional Effects in Fine-grained Region Logic},
  booktitle = {Proceedings of the 17th Workshop on Formal Techniques for Java-like Programs},
  series = {FTfJP '15},
  year = {2015},
  isbn = {978-1-4503-3656-7},
  location = {Prague, Czech Republic},
  pages = {5:1--5:6},
  articleno = {5},
  numpages = {6},
  url = {http://doi.acm.org/10.1145/2786536.2786537},
  doi = {10.1145/2786536.2786537},
  acmid = {2786537},
  publisher = {ACM},
  address = {New York, NY, USA},
  keywords = {formal specification, formal verification, framing, hoare logic, region logic}
}

@article{Bao-Leavens-Ernst18,
  author = {Yuyan Bao and Gary T. Leavens and Gidon Ernst},
  year = 2018,
  title = {Unifying separation logic and region logic to allow interoperability},
  journal = {Formal Aspects of Computing},
  issn = {0934-5043},
  doi = {10.1007/s00165-018-0455-5},
  volume = 30,
  month = 5,
  pages = {381–441},
  url = {http:https://doi.org/10.1007/s00165-018-0455-5},
  abstract = {Framing is important for specification and verification, especially in programs that mutate data structures with shared data, such as DAGs. Both separation logic and region logic are successful approaches to framing, with separation logic providing a concise way to reason about data structures that are disjoint, and region logic providing the ability to reason about framing for shared mutable data. In order to obtain the benefits of both logics for programs with shared mutable data, this paper unifies them into a single logic, which can encode both of them and allows them to interoperate. The new logic thus provides a way to reason about program modules specified in a mix of styles.},
  annote = {61 references.}
}

@TechReport{Bao-Leavens13,
  author = 	 {Yuyan Bao and Gary T. Leavens},
  title = 	 {Fine Grained Region Logic for Reasoning about Frame Properties},
  institution =  {Computer Science, University of Central Florida},
  year = 	 2013,
  number = 	 {CS-TR-13-02},
  address = 	 {Orlando, Florida},
  month = 	 mar,
  annote = 	 {19 references.}
}

@InBook{Bao-Leavens18,
  author = 	 {Yuyan Bao and Gary T. Leavens},
  title = 	 {Principled Software Development: Essays Dedicated to
                  {Arnd Poetzsch-Heffter} on the Occasion of his 60th Birthday},
  chapter = 	 {A Methodology for Invariants, Framing, and Subtyping in {JML}},
  publisher = 	 SV,
  year = 	 2018,
  address = 	 {Switzerland},
  pages = 	 {19-39},
  annote = 	 {32 references.}
}

@TechReport{Bao17,
  author = 	 {Yuyan Bao},
  title = 	 {Reasoning About Frame Properties in Object-Oriented Programs},
  institution =  {Computer Science, University of Central Florida},
  year = 	 2017,
  number = 	 {CS-TR-17-05},
  address = 	 {Orlando, Florida},
  month = 	 dec,
  url =          {https://goo.gl/WZGMiB},
  note =         {The author's dissertation.},
  annote = 	 {86 references.}
}

@Article{Barbier-etal98,
  author =	 {Franck Barbier and Henri Briand and
                  B\'{e}n\'{e}dicte Dano and St\'{e}phane Rideau},
  title =	 {The Executability of Object-Oriented Finite State
                  Machines},
  journal =	 JOOP,
  year =	 1998,
  volume =	 11,
  number =	 4,
  month =	 jul,
  pages =	 {16-24},
  annote =	 {24 references.}
}

@InProceedings{Barbon-Leroy-Sala17,
author="Gianluca Barbon and Vincent Leroy and Gwen Sala{\"u}n",
editor="Mehdi Dastani and Marjan Sirjani",
title="Debugging of Concurrent Systems Using Counterexample Analysis",
booktitle="Fundamentals of Software Engineering",
year="2017",
publisher="Springer International Publishing",
address="Cham",
pages="20--34",
abstract="Model checking is an established technique for automatically verifying that a model satisfies a given temporal property. When the model violates the property, the model checker returns a counterexample, which is a sequence of actions leading to a state where the property is not satisfied. Understanding this counterexample for debugging the specification is a complicated task for several reasons: (i) the counterexample can contain hundreds of actions, (ii) the debugging task is mostly achieved manually, and (iii) the counterexample does not give any clue on the state of the system (e.g., parallelism or data expressions) when the error occurs. This paper presents a new approach that improves the usability of model checking by simplifying the comprehension of counterexamples. Our solution aims at keeping only actions in counterexamples that are relevant for debugging purposes. To do so, we first extract in the model all the counterexamples. Second, we define an analysis algorithm that identifies actions that make the behaviour skip from incorrect to correct behaviours, making these actions relevant from a debugging perspective. Our approach is fully automated by a tool that we implemented and applied on real-world case studies from various application areas for evaluation purposes.",
isbn="978-3-319-68972-2"
}

@InProceedings{Bardin-etal18,
author="S{\'e}bastien Bardin and Nikolai Kosmatov and Bruno Marre and David Mentr{\'e} and Nicky Williams",
editor="Tiziana Margaria and Bernhard Steffen",
title="Test Case Generation with \textsc{PathCrawler/LTest}: How to Automate an Industrial Testing Process",
booktitle="Leveraging Applications of Formal Methods, Verification and Validation. Industrial Practice",
year="2018",
publisher="Springer International Publishing",
address="Cham",
pages="104--120",
abstract="Automatic white-box testing based on formal methods is now a relatively mature technology and operational tools are available. Despite this, and the cost of manual testing, the technology is still rarely applied in an industrial setting. This paper describes how the specific needs of the user can be taken into account in order to build the necessary interface with a generic test tool. We present PathCrawler/LTest, a generator of test inputs for structural coverage of C functions, recently extended to support labels. Labels offer a generic mechanism for specification of code coverage criteria and make it possible to prototype and implement new criteria for specific industrial needs. We describe the essential participation of the research branch of an industrial user in bridging the gap between the tool developers and their business unit and adapting PathCrawler/LTest to the needs of the latter. We present the excellent results so far of their ongoing adoption and finish by mentioning possible improvements.",
isbn="978-3-030-03427-6",
annote="35 references."
}

@Article{Baresi-Pezze98,
  author =	 {Luciano Baresi and Mauro Pezz\'{e}},
  title =	 {Toward Formalizing Structured Analysis},
  journal =	 TOSEM,
  year =	 1998,
  volume =	 7,
  number =	 1,
  month =	 jan,
  pages =	 {80-107},
  annote =	 {38 references.}
}

@inproceedings{Barghouti-Krishnamurthy95,
 author = {Naser S. Barghouti and Balachander Krishnamurthy},
 title = {Using event contexts and matching constraints to monitor software processes},
 booktitle = {ICSE '95: Proceedings of the 17th international conference on Software engineering},
 year = {1995},
 isbn = {0-89791-708-1},
 pages = {83--92},
 location = {Seattle, Washington, United States},
 doi = {http://doi.acm.org/10.1145/225014.225022},
 publisher = {ACM},
 address = {New York, NY, USA},
}

@InProceedings{Barnes-etal06,
  author = 	 {Janet Barnes and Rod Chapman and Randy Johnson and James Widmaier and Bill Everett and David Cooper},
  title = 	 {Engineering the Tokeneer Enclave Protection System},
  booktitle = {IEEE International Symposium on Secure Software Engineering},
  year = 	 2006,
  month = 	 mar,
  publisher = IEEE,
  address =	 {Los Alamitos, California}
}

@Book{Barnes03,
  author =	 {John Barnes},
  title = 	 {High Integrity Software: The {SPARK} Approach to Safety and Security},
  publisher = 	 {Addison Wesley},
  year = 	 2003,
  address =	 NY,
  annote =	 {Includes CD-ROM. Background refrences in addition to the text's cited 18 references.}
}

@Book{Barnes97,
  author =	"J. Barnes",
  title =	"High Integrity {Ada}: The {SPARK} Approach",
  publisher =	"Addison Wesley Longman, Inc.",
  address =	"Reading",
  year = 	1997
}

@InProceedings{Barnett-Leino-Schulte04,
  author =   {Mike Barnett and K. Rustan M. Leino and Wolfram Schulte},
  title =    {The {Spec\#} Programming System: An Overview},
  booktitle = {Construction and Analysis of Safe,
               Secure, and Interoperable Smart devices (CASSIS 2004)},
  editor = "Gilles Barthe and Lilian Burdy and Marieke Huisman and Jean-Louis Lanet and Traian Muntean",
  series = LNCS,
  volume = 3362,
  publisher = SV,
  address = NY,
  year = 2005,
  pages = "49-69",
  URL = {http://www.springerlink.com/content/0m789xre652nuv06}
}

@inproceedings{Barnett-Leino05,
  author    = {Mike Barnett and K. Rustan M. Leino},
  title     = {Weakest-precondition of unstructured programs},
  booktitle = {Program Analysis For Software Tools and Engineering (PASTE)},
  year      = 2005,
  month     = sep,
  pages     = {82-87},
  editor    = {Michael D. Ernst and Thomas P. Jensen},
  URL       = {http://doi.acm.org/10.1145/1108792.1108813},
  publisher = ACM
}

@TechReport{Barnett-Nachmanson-Schulte01,
  author =	 {Mike Barnett and Lev Nachmanson and Wolfram Schulte},
  title =	 {Conformance Checking of Components Against Their
                  Non-deterministic Specifications},
  institution =	 {Microsoft Research},
  year =	 2001,
  number =	 {MSR-TR-2001-56},
  month =	 jun,
  note =	 {Available from
                  \url{http://research.microsoft.com/pubs}}
}

@InProceedings{Barnett-Naumann04,
  author = 	 {Mike Barnett and David Naumann},
  title = 	 {Friends Need a Bit More: Maintaining Invariants Over Shared State},
  booktitle =	 {Mathematics of Program Construction (MPC)},
  editor =	 {Kozen, Dexter},
  volume =       3125,
  month =        jul,
  year =	 2004,
  series =	 LNCS,
  pages =        {54-84},
  URL =	         {http://www.springerlink.com/content/6gt28um7j5jgra12},
  publisher =	 SV
}

@InProceedings{Barnett-Schulte01,
  author =	 {Mike Barnett and Wolfram Schulte},
  title =	 {Spying on Components: A Runtime Verification
                  Technique},
  booktitle =	 {SAVCBS 2001 Proceedings: Specification and
                  Verification of Component-Based Systems},
  pages =	 {7-13},
  year =	 2001,
  editor =	 {Dimitra Giannakopoulou and Gary T. Leavens and
                  Murali Sitaraman},
  number =	 {01-09a},
  series =	 {ISU CS Technical Report},
  month =	 nov,
  annote =	 {AsmL. 26 references.},
  URL =
                  {http://www.cs.iastate.edu/~leavens/SAVCBS/2001/papers-2001/barnett-schulte.pdf}
}

@Article{Barnett-Schulte01a,
  Author =	 "Mike Barnett and Wolfram Schulte",
  title =	 "The {ABC}s of Specification: {AsmL}, Behavior, and
                  Components",
  journal =	 "Informatica",
  month =	 nov,
  year =	 2001,
  volume =	 25,
  number =	 4,
  pages =	 {517-526}
}

@TechReport{Barnett-Schulte02,
  author =	 {Mike Barnett and Wolfram Schulte},
  title =	 {Contracts, Components, and their Runtime
                  Verification on the {.NET} Platform},
  institution =	 {Microsoft Research},
  year =	 2002,
  number =	 {MSR-TR-2002-38},
  month =	 apr,
  note =	 {Available from
                  \url{http://research.microsoft.com/pubs}}
}

@Article{Barnett-Schulte03,
  Author =	 "Mike Barnett and Wolfram Schulte",
  Title =	 "Runtime verification of {.NET} contracts",
  Journal =	 "The Journal of Systems and Software",
  Volume =	 65,
  Number =	 3,
  Month =	 mar,
  Pages =	 "199-208",
  Year =	 2003,
  Annote =	 "Translation of AsmL into .NET intermediate language
                  (IL) to attach contracts to .NET types."
}

@INPROCEEDINGS{Barnett-etal00,
  AUTHOR =	 "Mike Barnett and Egon B{\"o}rger and Yuri Gurevich
                  and Wolfram Schulte and Margus Veanes",
  TITLE =	 "Using {A}bstract {S}tate {M}achines at {M}icrosoft:
                  A Case Study",
  BOOKTITLE =	 "Abstract State Machines: Theory and Applications",
  SERIES =	 LNCS,
  VOLUME =	 1912,
  PAGES =	 {367-379},
  MONTH =	 mar,
  PUBLISHER =	 SV,
  ADDRESS =	 "Berlin, Germany",
  YEAR =	 {2000}
}

@article{Barnett-etal04,
  author    = {Mike Barnett and Robert DeLine and Manuel F{\"a}hndrich and
               K. Rustan M. Leino and Wolfram Schulte},
  title     = {Verification of Object-Oriented Programs with Invariants},
  journal   = JOT,
  publisher = {ETH Zurich},
  address   = {Zurich, Switzerland},
  volume    = 3,
  number    = 6,
  year      = 2004,
  pages     = {27-56},
  URL       = {http://tinyurl.com/m2a8j},
  Annote    = {Spec\# and the Boogie methodology.}
}

@InProceedings{Barnett-etal04a,
  author = 	 {Mike Barnett and David A. Naumann Wolfram Schulte and Qi Sun},
  title = 	 {99.44\% pure: Useful Abstractions in Specification},
  editor =       {Erik Poll},
  booktitle = "Formal Techniques for Java-like Programs (FTfJP)",
  Month = jun,
  Year =  2004,
  Pages="11-19",
  note = {\url{http://www.cs.ru.nl/ftfjp/2004/Purity.pdf}},
  publisher = "Radbod University",
  Address = "Nijmegen",
  annote = "18 references."
}

@Unpublished{Barnett-etal05,
  author = 	 {Mike Barnett and David A. Naumann Wolfram Schulte and Qi Sun},
  title = 	 {99.44\% pure: Useful Abstractions in Specification},
  note = 	 {Obtained from the following URL: \url{http://guinness.cs.stevens-tech.edu/~naumann/publications/purityJoT.pdf}},
  month =	 {January},
  year =	 2005
}

%   URL = {\url{http://dx.doi.org/10.1007/11804192_17}}
@InProceedings{Barnett-etal06,
  author = 	 {Mike Barnett and Bor-Yuh Evan Chang and Robert DeLine and Bart Jacobs and K. Rustan M. Leino},
  title = 	 {Boogie: A Modular Reusable Verifier for Object-Oriented Programs},
  booktitle =	 {Formal Methods for Components and Objects (FMCO) 2005, Revised Lectures},
  year =	 2006,
  series =	 LNCS,
  volume =       4111,
  publisher =	 SV,
  address =      NY,
  pages = {364-387}
}

@InProceedings{Barnett-etal06a,
   author = "Mike Barnett and David A. Naumann and Wolfram Schulte and Qi Sun",
   title = "Allowing State Changes in Specifications",
   booktitle = "International Conference on Emerging Trends in Information
and Communication Security ({ETRICS})",
   year = 2006,
   pages     = {321--336},
   editor    = {G{\"u}nter M{\"u}ller},
   publisher = SV,
   series    = LNCS,
   volume    = 3995,
   URL       =  {http://dx.doi.org/10.1007/11766155_23}
}

@Article{Barrett-Kaplan-Wileden96,
  author =	 {Daniel Barrett and Alan Kaplan and Jack C. Wileden},
  title =	 {Automated Support for Seamless Interoperability in
                  Polylingual Software Systems},
  journal =	 SIGSOFT,
  year =	 1996,
  editor =	 {David Garlan},
  volume =	 21,
  number =	 6,
  month =	 nov,
  pages =	 {147-155},
  note =	 {SIGSOFT '96: Proceedings of the Fourth ACM SIGSOFT
                  Symposium on the Foundations of Software
                  Engineering, San Francisco, California},
  annote =	 {The PolySPIN approach and toolkit for connecting
                  programs written in different languages. 21
                  references.}
}

@InProceedings{Barrett-Tinelli07,
  author =       {Clark Barrett and Cesare Tinelli},
  title =        "{CVC3}",
  booktitle = {Proceedings of the 19th International Conference on
                  Computer Aided Verification (CAV '07)},
  editor =    {Werner Damm and Holger Hermanns},
  series =    LNCS,
  volume =    4590,
  month =     jul,
  year =      2007,
  publisher = SV,
  address =   {Berlin},
  pages =     {298-302}
}

@Book{Barrett-Wagner96,
  author = 	 {Martin L. Barrett and Clifford H. Wagner},
  title = 	 {C and {Unix}: Tools for Software Design},
  publisher = 	 {Wiley},
  year = 	 1996,
  address = 	 NY
}

@Article{Barringer-Cheng-Jones84,
  Author =	 "H. Barringer and J. H. Cheng and C. B. Jones",
  Title =	 "A Logic Covering Undefinedness in Program Proofs",
  Journal =	 "Acta Informatica",
  Volume =	 21,
  Number =	 3,
  Month =	 oct,
  Year =	 1984,
  Pages =	 "251-269",
  Annote =	 "Axiomatization and examples. 33 references."
}

@TechReport{Barringer86,
  Author =	 "Howard Barringer",
  Title =	 "Using Temporal Logic in the Compositional
                  Specification of Concurrent Systems",
  Institution =	 "Department of Computer Science, University of
                  Manchester",
  Address =	 "Manchester M13 9PL, England",
  Number =	 "UMCS-86-10-1",
  Month =	 oct,
  Year =	 1986,
  Annote =	 "20 references."
}

@Article{Barroca-McDermid92,
  author =	 "L. Barroca and J. A. McDermid",
  title =	 "Formal methods: Use and relevance for the
                  development of safety critical systems",
  journal =	 "The Computer Journal",
  volume =	 35,
  number =	 6,
  pages =	 "579-599",
  month =	 dec,
  year =	 1992
}

@TechReport{Barstow77,
  Author =	 "D. R. Barstow",
  Title =	 "Automatic Construction of Algorithms and Data
                  Structures using a Knowledge Base of Programming
                  Rules",
  Institution =	 "Stanford A.I. Lab",
  Number =	 308,
  Year =	 1977,
  Month =	 nov
}

@InProceedings{Bartetzko-etal01,
  author =	 "D. Bartetzko and C. Fischer and M. Moller and
                  H. Wehrheim",
  title =	 "Jass - {Java} with assertions",
  BookTitle =	 "Workshop on Runtime Verification held in conjunction
                  with the 13th Conference on Computer Aided
                  Verification, CAV'01",
  year =	 "2001",
  Note =	 "Published in {\em Electronic Notes in Theoretical
                  Computer Science}, K. Havelund and G. Rosu (eds.),
                  55(2), 2001."
}

@InProceedings{Barthe-etal07,
   author =       {Gilles Barthe and Lilian Burdy and Julien Charles and
                   Benjamin Gr{\'e}goire and Marieke Huisman 
                   and Jean-Louis Lanet and Mariela Pavlova and Antoine Requet},
   title =        {{JACK}: A Tool for Validation of Security and Behaviour of {Java} Applications},
   booktitle =     {Formal Methods for Components and Objects (FMCO)},
   year = 2007,
   publisher = SV,
   volume = 4709,
   series = LNCS,
   address = {Berlin},
   pages =        {152-174},
   doi =          {http://dx.doi.org/10.1007/978-3-540-74792-5_7},
   pdf = {ftp://ftp-sop.inria.fr/everest/Marieke.Huisman/fmco06.pdf}
}

@InProceedings{Barthes-Pavlova-Schneider05,
  author = 	 {Gilles Barthe and Mariela Pavlova and Gerardo Schneider},
  title = 	 {Precise analysis of memory consumption using program logics},
  booktitle =	 {Proceedings of the 3rd International Conference on Software Engineering and Formal Method (SEFM)},
  pages =	 {86-95},
  year =	 2005,
  URL = 	 {ftp://ftp-sop.inria.fr/lemme/personnel/Gilles.Barthe/sefm2005.pdf}
}

@InCollection{Bartussek-Parnas78,
  Author =	 "W. Bartussek and D. L. Parnas",
  Title =	 "Using Assertions About Traces to Write Abstract
                  Specifications for Software Modules",
  BookTitle =	 "Proceedings of the Second Conference of the 
                  European Cooperation on Informatics:
                  Information Systems Methodology,
                  October 10-12, 1978, London, UK",
  Series =	 LNCS,
  Editor =	 "G. Bracchi and P. C. Lockemann",
  Publisher =	 SV,
  Volume =	 65,
  Year =	 1978,
  Pages =	 "211-236"
}

@Article{Basili-Perricone84,
  Author =	 "Victor R. Basili and Barry T. Perricone",
  Title =	 "Software Errors and Complexity: An Empirical
                  Investigation",
  Journal =	 CACM,
  Volume =	 27,
  Number =	 1,
  Month =	 jan,
  Year =	 1984,
  Pages =	 "42-52",
  Annote =	 "Observations from a particular medium sized
                  project. Modified modules tended to have errors in
                  data values and initializations. Module size and
                  complexity inversely related to number of errors per
                  line of code. Errors in modified modules are harder
                  to correct than errors in new modules. Interface
                  errors account for most errors of all types. Error
                  corrections account for 62% of changes, enhancements
                  account for 38% of changes. Other studies found
                  error corrections account for 40-64% of all
                  changes. 9 references."
}

@InProceedings{Basili-Turner75,
  Author =	 "V. R. Basili and A. J. Turner",
  Title =	 "Iterative Enhancement: A Practical Technique for
                  Software Development",
  BookTitle =	 "Proceedings of the First National Conference on
                  Software Engineering",
  Organization = IEEE,
  Pages =	 "56-62",
  Year =	 1975
}

@Article{Basili-etal99,
  author =	 {Victor R. Basili and others},
  title =	 {Final Report {NSF} Workshop on a Software Research
                  Program For the 21st Century, Greenbelt, Maryland},
  journal =	 SIGSOFT,
  year =	 1999,
  volume =	 24,
  number =	 3,
  month =	 may,
  pages =	 {37-44}
}

@InCollection{Bastide-Sy-Palanque99,
  author =	 {R\'{e}mi Bastide and Ousmane Sy and Philippe
                  Palanques},
  title =	 {Formal Specification and Prototyping of {CORBA}
                  Systems},
  booktitle =	 {ECOOP '99 --- Object-Oriented Programming 13th
                  European Conference, Lisbon Portugal},
  publisher =	 SV,
  year =	 1999,
  editor =	 {Rachid Guerraoui},
  volume =	 1628,
  series =	 LNCS,
  address =	 NY,
  month =	 jun,
  pages =	 {474-494},
  annote =	 {Java and its Jini mechanism. 9 references.}
}

@inproceedings{Basu-Kumar07,
  author = {Samik Basu and Ratnesh Kumar},
  title = {Quotient-based Control Synthesis for Partially Observed Non-deterministic Plants with Mu-calculus Specifications},
  booktitle = {46th IEEE Conference on Decision and Control},
  pages = {5294-5299},
  month = dec,
  year = 2007
}                  
                  
@Article{Bates-Constable85,
  Author =	 "Joseph L. Bates and Robert L. Constable",
  Title =	 "Proofs as Programs",
  Journal =	 TOPLAS,
  Volume =	 7,
  Number =	 1,
  Month =	 jan,
  Year =	 1985,
  Pages =	 "113-136",
  Annote =	 "The PRL program development system and its
                  rationale. Aid in construction of formal
                  explanations of programs. 40 references."
}

@Article{Batory-Geraci97,
  author =	 {Don Batory and Bart J. Geraci},
  title =	 {Composition Validation and Subjectivity in {GenVoca}
                  Generators},
  journal =	 IEEETSE,
  year =	 1997,
  volume =	 23,
  number =	 2,
  month =	 feb,
  pages =	 {67-82},
  annote =	 {58 references.}
}

@Article{Batory-OMalley92,
  Author =	 "Don Batory and Sean O'Malley",
  Title =	 "The Design and Implementation of Hierarchical
                  Software Systems with Reusable Components",
  Journal =	 TOSEM,
  Year =	 1992,
  Volume =	 1,
  Number =	 4,
  Month =	 oct,
  Pages =	 "355-398",
  Annote =	 "69 references."
}

@Article{Batory-Sarvela-Rauschmayer04,
  title =	"Scaling Step-Wise Refinement",
  author =	"Don S. Batory and Jacob Neal Sarvela and Axel Rauschmayer",
  journal =	IEEETSE,
  year = 	2004,
  number =	6,
  month =       jun,
  volume =	30,
  pages =	"355-371",
  URL =  	"http://doi.ieeecomputersociety.org/10.1109/TSE.2004.23",
}

@Article{Batory-etal94,
  author =	 {Don Batory and Vivek Singhal and Jeff Thomas and
                  Sankar Dasari and Bart Geraci and Marty Sirkin},
  title =	 {The {GenVoca} Model of Software-System Generation},
  journal =	 {IEEE Software},
  year =	 1994,
  volume =	 11,
  number =	 5,
  month =	 sep,
  pages =	 {89-94},
  annote =	 {10 references.}
}

@InProceedings{Batory04,
  title =	"Program Comprehension in Generative Programming: {A}
		 History of Grand Challenges",
  author =	"Don S. Batory",
  publisher =	"IEEE Computer Society",
  year = 	2004,
  booktitle =	"International Workshop on Program Comprehension (IWPC), Bari, Italy",
  pages =	"2-13",
  URL =  	"http://csdl.computer.org/comp/proceedings/iwpc/2004/2149/00/21490002abs.htm"
}

@Article{Batory06,
  author = 	 {Don Batory},
  title = 	 {Multi-Level Models in Model Driven Development, Product-Lines, and Metaprogramming},
  journal = 	 IBMSJ,
  year = 	 2006,
  volume =	 3
}

@Book{Bauer-etal85,
  Author =	 "F. L. Bauer and others",
  Title =	 "The Munich Project CIP, Vol. 1: The Wide Spectrum
                  Language CIP-L",
  Series =	 LNCS,
  Volume =	 183,
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1985
}

@InCollection{Baugh92,
  Author =	 "J.W. Baugh Jr",
  Title =	 "Is Engineering Software Amenable to Formal
                  Specification?",
  Editor =	 "Ursala Martin and Jeannette M. Wing",
  BookTitle =	 "First International Workshop on Larch, Dedham 1992",
  Publisher =	 SV,
  Year =	 1992,
  Pages =	 "1-17",
  Annote =	 "22 references"
}

@InProceedings{Baumeister95,
  author =	 "Baumeister",
  title =	 "Relations as Abstract Datatypes: An Institution to
                  Specify Relations between Algebras",
  editor =	 "P. D. Mosses and M. Nielsen and M. I. Schwartzbach",
  series =	 LNCS,
  booktitle =	 "TAPSOFT'95: Theory and Practice of Software
                  Development",
  publisher =	 SV,
  number =	 915,
  year =	 1995,
  month =	 may,
  pages =	 "756-771",
  annote =	 "17 references."
}

@Article{Bazelmans85,
  Author =	 "Rudy Bazelmans",
  Title =	 "Evolution of Configuration Management",
  Journal =	 SIGSOFT,
  Volume =	 10,
  Number =	 5,
  Month =	 oct,
  Year =	 1985,
  Pages =	 "37-46",
  Annote =	 "Survey of configuration management systems,
                  including some proprietary ones. 27 references."
}

@Article{Bear-etal90,
  Author =	 "Stephen Bear and Phillip Allen and Derek Coleman and
                  Fiona Hayes",
  Title =	 "Graphical Specification of Object Oriented Systems",
  Journal =	 SIGPLAN,
  Year =	 1990,
  Volume =	 25,
  Number =	 10,
  Month =	 oct,
  Pages =	 "28-37",
  Note =	 "{\em OOPSLA ECOOP '90 Proceedings}, N. Meyrowitz
                  (editor).",
  Annote =	 "5 references."
}

@Article{Beck-Cunningham89,
  Author =	 "Kent Beck \& Ward Cunningham",
  Title =	 "A Laboratory for Teaching Object-Oriented Thinking",
  Journal =	 SIGPLAN,
  Volume =	 24,
  Number =	 10,
  Month =	 oct,
  Year =	 1989,
  Pages =	 "1-6",
  Note =	 "OOPSLA '89 Conference Proceedings, Norman Meyerowitz
                  (editor), October 1989, New Orleans, Louisiana.",
  Annote =	 "Class, responsibility, collaborator (CRC) cards."
}

@Article{Beck-Gamma98,
  author =	 {Kent Beck and Erich Gamma},
  title =	 {Test Infected: Programmers Love Writing Tests},
  journal =	 {Java Report},
  year =	 1998,
  volume =	 3,
  number =	 7,
  pages =	 {37-50},
  URL =
                  "http://junit.sourceforge.net/doc/testinfected/testing.htm"
}

@Article{Beck-Perkins83,
  Author =	 "Leland L. Beck and Thomas E. Perkins",
  Title =	 "A Survey of Software Engineering Practice: Tools,
                  Methods and Results",
  Journal =	 IEEETSE,
  Volume =	 "SE-9",
  Number =	 5,
  Month =	 sep,
  Year =	 1983,
  Pages =	 "541-561",
  Annote =	 "20 references."
}

@Book{Beck96,
  author =	 {Kent Beck},
  title =	 {Smalltalk Best Practice Patterns},
  publisher =	 {Prentice-Hall},
  year =	 1996,
}

@Article{Beck97,
  author =	 {Kent Beck},
  title =	 {Make It Run, Make It Right: Design through
                  Refactoring},
  journal =	 {The Smalltalk Report},
  year =	 1997,
  volume =	 6,
  number =	 4,
  pages =	 {19-24},
  month =	 jan
}

@Book{Beck99,
  author =	 {Kent Beck},
  title =	 {Extreme Programming Explained: Embrace Change},
  publisher =	 {Addison-Wesley},
  year =	 1999
}

@techreport{Becker-Gilham-Smith03,
   author = "Marcel Becker and Limei Gilham and Douglas R. Smith",
   title = "Planware {II}: Synthesis of Schedulers for Complex
            Resource Systems",
   year = "2003",
   institution = "Kestrel Technology"
}

@InCollection{Becker93,
  Author =	 "K. Becker",
  Title =	 "Proving Ground Confluence and Inductive Validity in
                  Constructor Based Equational Specifications",
  Journal =	 LNCS,
  Number =	 668,
  Publisher =	 SV,
  Address =	 NY,
  Editor =	 "M. C. Gaudel and J. P. Jouannaud",
  Year =	 1993,
  Booktitle =	 "TAPSOFT '93: Theory and Practice of Software
                  Development. 4th International Joint Conference
                  CAAP/FASE",
  Pages =	 "46-60",
  Annote =	 "22 references"
}

@Book{Beckert-Hahnle-Schmitt07,
   author =  {Bernhard Beckert and Reiner H\"{a}hnle and Peter H. Schmitt},
   title =   {Verification of Object-Oriented Software: The {KeY} Approach},
   series = LNCS,
   volume =   4334,
   publisher     = SV,
   address       = "Berlin",
   year          = 2007,
   annote        = {Many references.}
}

@inproceedings{Beckert-Sasse01,
  author = {Bernhard Beckert and Bettina Sasse},
  title = {Handling {Java}'s Abrupt Termination in a Sequent Calculus
		  for {Dynamic Logic}},
  booktitle = {IJCAR Workshop on Precise Modelling and
		  Deduction for Object-oriented Software Development},
  editor = {Bernhard Beckert and Robert France and Reiner H\"{a}hnle and Bart Jacobs},
  pages = {5-14},
  year = 2001
}

@InProceedings{Beckert00,
  author = 	 {Bernhard Beckert},
  title = 	 {A Dynamic Logic for {Java Card}},
  booktitle = 	 {Workshop on Formal Techniques for {Java} Programs (FTfJP)},
  year =	 2000,
  editor =	 {Sophia Drossopoulou and Susan Eisenbach and Bart Jacobs and  Gary T. Leavens and Peter M{\"u}ller and Arnd Poetzsch-Heffter},
  organization = {Technical Report~269, Fernuniversit{\"at} Hagen}
}

@Article{Beckman-etal10,
  author = 	 {Nels E. Beckman and Aditya V. Nori and Sriram K. Rajamani and Robert J. Simmons and Sai Deep Tetali and Aditya V. Thakur},
  title = 	 {Proofs from Tests},
  journal = 	 IEEETSE,
  year = 	 2010,
  volume = 	 36,
  number = 	 4,
  pages = 	 {495-508},
  month = 	 {July/August},
  annote = 	 {27 references.}
}

@incollection{Behm-etal99,
author={Patrick Behm and Paul Benoit and Alain Faivre and Jean-Marc Meynadier},
title={M\'{e}t\'{e}or: A Successful Application of {B} in a Large Project},
year={1999},
isbn={978-3-540-66587-8},
booktitle={FM’99 — Formal Methods},
volume={1708},
series={Lecture Notes in Computer Science},
editor={Jeannette M. Wing and Jim Woodcock and Jim Davies},
doi={10.1007/3-540-48119-2_22},
url={http://dx.doi.org/10.1007/3-540-48119-2_22},
publisher={Springer Berlin Heidelberg},
pages={369-387},
}


@InProceedings{Behrmann-etal01,
  author = 	 {Gerd Behrmann and Alexandre David and Kim G.\ Larsen and Oliver M\"{o}ller and Paul Pettersson and Wang Yi},
  title = 	 {{\sc Uppaal} - Present and Future},
  booktitle = 	 {Proc.\ of 40{\em th} IEEE Conference on Decision and Control},
  year =         2001,
  publisher =    {IEEE Computer Society Press},
  address =      "Los Alamitos, CA"
}

@Article{Belkhouche-Wu99,
  author =	 {Boumediene Belkhouche and Joel Wu},
  title =	 {Behavioral Specification and Analysis of
                  Object-Oriented Designs},
  journal =	 JOOP,
  year =	 1999,
  volume =	 11,
  number =	 8,
  month =	 jan,
  pages =	 {37-46},
  annote =	 {Modeling by communication and other
                  events. Histories. Uses CSP. 16 references.}
}

@Article{Bellini-Mattolini-Nesi00,
  Author =	 "P. Bellini and R. Mattolini and R. Nesi",
  Title =	 "Temporal logics for real-time system specification",
  Journal =	 "ACM Computing Surveys",
  Year =	 2000,
  Volume =	 32,
  Number =	 1,
  Month =	 mar,
  Pages =	 "12-42"
}

@Article{Ben-Shaul-Gish-Robinson98,
  author =	 {Israel Ben-Shaul James W. Gish and William Robinson},
  title =	 {An Integrated Network Component Architecture},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 5,
  month =	 sep,
  pages =	 {79-87},
  annote =	 {11 references.}
}

@Book{Bentley82,
  Author =	 "Jon Louis Bentley",
  Title =	 "Writing Efficient Programs",
  Publisher =	 "Prentice-Hall",
  Year =	 1982,
  Series =	 "Software Series",
  Address =	 "Englewood Cliffs, N.J.",
  Annote =	 "System independent and system dependent rules for
                  making programs more efficient in time, space,
                  etc. 119 references."
}

@Book{Bentley86b,
  Author =	 "Jon Louis Bentley",
  Title =	 "Programming pearls",
  Publisher =	 "Addison-Wesley",
  Year =	 1986,
  Address =	 "Reading, Mass."
}

@Book{Bentley88,
  Author =	 "Jon Louis Bentley",
  Title =	 "More programming pearls : confessions of a coder",
  Publisher =	 "Addison-Wesley",
  Year =	 1988,
  Address =	 "Reading, Mass."
}

@InProceedings{Benton05,
  author = 	 {Nick Benton},
  title = 	 {A Typed, Compositional Logic for a Stack-Based Abstract Machine},
  booktitle = 	 {Programming Languages and Systems: Third Asian Symposium (APLAS)},
  pages =	 {364-380},
  month =        nov,
  year =	 2005,
  editor =	 {Kwangkeun Yi},
  volume =	 3780,
  series =	 LNCS,
  URL =          {http://dx.doi.org/10.1007/11575467_24},
  publisher =	 SV
}

@book{Berard-etal99,
 author = {B. Berard and M. Bidot and A. Finkel and F. Laroussinie and A. Petit and L. Petrucci and Ph. Schnoebelen and P. McKenzie},
 title = {Systems and software verification: model-checking techniques and tools},
 year = {1999},
 publisher = SV,
 address = NY,
 annote = {56 references.}
}

@Unpublished{Berard90,
  Author =	 "Edward V. Berard",
  Title =	 "Issues in the Testing of Object-Oriented Software",
  Note =	 "from Newsgroups: comp.object",
  Annote =	 "approximately 85 references.",
  Month =	 oct,
  Year =	 1990
}

@InProceedings{Berdine-Calcagno-OHearn05,
  author = {Josh Berdine and Cristiano Calcagno and Peter W. O'Hearn},
  title =  {Smallfoot: Modular Automatic Assertion Checking with Separation Logic},
  booktitle = {Formal Methods for Components and Objects (FMCO)},
  year      = 2005,
  pages     = {115-137},
  editor    = {Frank S. de Boer and Marcello M. Bonsangue and
               Susanne Graf and Willem P. de Roever},
  publisher = SV,
  address   = "Berlin",
  series    = LNCS,
  volume    = 4111,
  URL = {http://dx.doi.org/10.1007/11804192_6}
}

@inproceedings{Berdine-etal07,
  author    = {Josh Berdine and Cristiano Calcagno and
               Byron Cook and Dino Distefano and
               Peter W. O'Hearn and Thomas Wies and Hongseok Yang},
  title     = {Shape Analysis for Composite Data Structures},
  booktitle = {Computer Aided Verification (CAV)},
  year      = 2007,
  pages     = {178-192},
  editor    = {Werner Damm and Holger Hermanns},
  publisher = SV,
  address   = "Berlin",
  series    = LNCS,
  volume    = 4590,
  URL = {http://dx.doi.org/10.1007/978-3-540-73368-3_22}
}

@InCollection{Bergner-etal00,
  Author =	 "Klaus Bergner and Andreas Rausch and Marc Sihling
                  and Alexander Vilbig and Manfred Broy",
  Title =	 "A Formal Model for Componentware",
  BookTitle =	 {Foundations of Component-Based Systems},
  Editor =	 {Gary T. Leavens and Murali Sitaraman},
  Year =	 2000,
  Publisher =	 {Cambridge University Press},
  Address =	 NY,
  ISBN =	 {0-521-77164-1},
  Chapter =	 9,
  Pages =	 "189-210",
  Annote =	 "21 references."
}

@InCollection{Bergstein-Hursch93,
  Author =	 "Paul L. Bergstein and Walter L. Hursch",
  Title =	 "Maintaining Behavioral Consistency during Schema
                  Evolution",
  BookTitle =	 "Object Technologies for Advanced Software",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Shojiro Nishio and Akinori Yonezawa",
  Series =	 LNCS,
  Volume =	 742,
  Pages =	 "176-193",
  Month =	 aug,
  Annote =	 "17 references."
}

@Article{Bergstein97,
  author =	 {Paul L. Bergstein},
  title =	 {Maintenance of Object-Oriented Systems During
                  Structural Evolution},
  journal =	 TAPOS,
  year =	 1997,
  volume =	 3,
  number =	 3,
  pages =	 {185-212},
  annote =	 {Object restructuring via class graph
                  transformations. 38 references.}
}

@article{Bergstra-Bethke-Rodenburg95,
  author =	 "J.A. Bergstra and I. Bethke and P. Rodenburg",
  title =	 "A propositional logic with 4 values: true, false,
                  divergent and meaningless",
  journal =	 "Journal of Applied NonClassical Logics",
  volume =	 "5",
  number =	 "2",
  month =	 feb,
  pages =	 "199-217",
  year =	 "1995"
}

@Article{Bergstra-Heering-Klint90,
  Author =	 "J. A. Bergstra and J. Heering and P. Klint",
  Title =	 "Module Algebra",
  Journal =	 JACM,
  Volume =	 37,
  Number =	 2,
  Month =	 apr,
  Year =	 1990,
  Pages =	 "335-372"
}

@article{Bergstra-Ponse98,
  author =	 "Jan A. Bergstra and Alban Ponse",
  title =	 "Kleene's Three-Valued Logic and Process Algebra",
  journal =	 "Information Processing Letters",
  volume =	 "67",
  number =	 "2",
  pages =	 "95-103",
  year =	 "1998",
  url =		 "citeseer.nj.nec.com/bergstra98kleenes.html"
}

@incollection{Bergstra-Ponse99,
  author =	 "J.A. Bergstra and A. Ponse",
  title =	 "Process algebra with five-valued conditions",
  booktitle =	 "Combinatorics, Complexity, and Logic, Proceedings of
                  DMTCS'99 and CATS'99",
  publisher =	 SV,
  address =	 "Singapore",
  editor =	 "C.S. Calude and M.J. Dinneen",
  year =	 1999,
  url =		 "citeseer.nj.nec.com/article/bergstra99process.html"
}

@InCollection{Bergstra-etal81,
  Author =	 "J. A. Bergstra and M. Broy and J. V. Tucker and
                  M. Wirsing",
  Title =	 "On the Power of Algebraic Specifications",
  BookTitle =	 "Mathematical Foundations of Computer Science,
                  Proceedings, Strbske Pleso, Czechoslovakia",
  Editor =	 "Jozef Gruska and Michal Chytil",
  Publisher =	 SV,
  Address =	 NY,
  Series =	 LNCS,
  Volume =	 "118",
  Year =	 1981,
  Pages =	 "193-204",
  Annote =	 "Every computable partial algebra has an equational
                  hidden enrichment specification. Specification of a
                  simple nondeterministic programming language. 40
                  references."
}

@InCollection{Bernot-Bidoit-Knapik92,
  Author =	 "Gilles Bernot and Michel Bidoit and Teodor Knapik",
  Title =	 "Towards an Adequate Notion of Observation",
  BookTitle =	 "ESOP '92, 4th European Symposium on Programming,
                  Rennes, France, February 1992, Proceedings",
  Publisher =	 SV,
  Year =	 1992,
  Editor =	 "Bernd Krieg-Bruckner",
  Series =	 LNCS,
  Address =	 NY,
  Volume =	 582,
  Pages =	 "39-55",
  Annote =	 "18 references"
}

@InProceedings{Bernot-Bidoit91,
  Author =	 "Gilles Bernot and Michel Bidoit",
  Title =	 "Proving Correctness of Algebraically Specified
                  Software: Modularity and Observability Issues",
  BookTitle =	 "Proceedings of the Second International Conference
                  on Algebraic Methodology and Software Technology",
  Year =	 1991,
  Pages =	 "139-161",
  Organization = "The University of Iowa, Department of Computer
                  Science",
  Address =	 "Iowa City, Iowa",
  Month =	 may,
  Annote =	 "38 references."
}

@InCollection{Bernot-Gall93,
  Author =	 "G. Bernot and P. Le Gall",
  Title =	 "Exception handling and Term labelling",
  Journal =	 LNCS,
  Number =	 668,
  Publisher =	 SV,
  Address =	 NY,
  Editor =	 "M. C. Gaudel and J. P. Jouannaud",
  Year =	 1993,
  Booktitle =	 "TAPSOFT '93: Theory and Practice of Software
                  Development. 4th International Joint Conference
                  CAAP/FASE",
  Pages =	 "421-436",
  Annote =	 "35 references"
}

@InProceedings{Bernot-Gaudel-Marre91,
  Author =	 "Gilles Bernot and Marie Claude Gaudel and Bruno
                  Marre",
  Title =	 "A Formal Approach to Software Testing",
  BookTitle =	 "Proceedings of the Second International Conference
                  on Algebraic Methodology and Software Technology",
  Year =	 1991,
  Pages =	 "163-170",
  Organization = "The University of Iowa, Department of Computer
                  Science",
  Address =	 "Iowa City, Iowa",
  Month =	 may,
  Annote =	 "Black box testing using formal specifications and
                  formally stated testing strategies stated as
                  hypotheses. For example: it does not matter what
                  items are pushed in a stack in testing a stack. 26
                  references."
}

@article{Bernot-etal91,
  author =	 {Gilles Bernot and Marie Claude Claudel and Bruno
                  Marre},
  title =	 {Software testing based on formal specifications: a
                  theory and a tool},
  journal =	 {Software Engineering Journal},
  year =	 {1991},
  month =	 nov,
  volume =	 {6},
  number =	 {6},
  pages =	 {387-405}
}

@Manual{Bertot-etal18,
  title = 	 {Reference Manual of the Coq proof assistant},
  author = 	 {Yves Bertot and others},
  organization = {INRIA},
  edition = 	 {8.8.2},
  year = 	 2018,
  note = 	 {At \url{https://coq.inria.fr/distrib/current/refman/}}
}

@Article{Berzins-Gray-Naumann86,
  Author =	 "Valdis Berzins and Michael Gray and David Naumann",
  Title =	 "Abstraction-Based Software Development",
  Journal =	 CACM,
  Volume =	 29,
  Number =	 5,
  Month =	 may,
  Year =	 1986,
  Pages =	 "402-415",
  Annote =	 "Discussion of software development method based on
                  abstractions, especially practical
                  experience. Points out research directions. 57
                  references."
}

@Book{Berzins-Luqi91,
  Author =	 "Valdis Berzins and Lucia Luqi",
  Title =	 "Software Engineering with Abstractions",
  Publisher =	 "Addison-Wesley",
  Address =	 "Reading, MA",
  Year =	 1991,
  Annote =	 "PSDL is an enhanced DFD for hard real-time
                  systems. 1 reference."
}

@Article{Best-etal92,
  Author =	 "Eike Best, Ludmila Cherkasova and Jorg Desel",
  Title =	 "Compositional Generation of Home States in Free
                  Choice Nets",
  Journal =	 "Formal Aspects of Computing",
  Volume =	 4,
  Number =	 6,
  Year =	 1992,
  Pages =	 "572-581",
  Annote =	 "7 references."
}

@Article{Beugnard-etal99,
  author =	 {Antoine Beugnard and Jean-Marc J\'{e}z\'{e}quel and
                  N\"{o}el Plouzeau and Damien Watkins},
  title =	 {Making Components Contract Aware},
  journal =	 {Computer},
  year =	 1999,
  volume =	 32,
  number =	 7,
  month =	 jul,
  pages =	 {38-44},
  annote =	 {12 references.}
}

@InProceedings{Beyer-etal04,
  author={Dirk Beyer and Adam J. Chlipala and Thomas A. Henzinger and Ranjit Jhala and Rupak Majumdar},
  booktitle={Proceedings. 26th International Conference on Software Engineering (ICSE'04)}, 
  title={Generating tests from counterexamples}, 
  year={2004},
  publisher=IEEE,
  address="Los Altos, CA",
  volume={},
  number={},
  pages={326-335},
  doi={10.1109/ICSE.2004.1317455},
  annote="32 references."
}

@InProceedings{Beyer-etal18,
author="Dirk Beyer and Matthias Dangl and Thomas Lemberger and Michael Tautschnig",
editor="Catherine Dubois and Burkhart Wolff",
title="Tests from Witnesses",
booktitle="Tests and Proofs",
year="2018",
publisher="Springer International Publishing",
address="Cham",
pages="3--23",
abstract="The research community made enormous progress in the past years in developing algorithms for verifying software, as shown by international competitions. Unfortunately, the transfer into industrial practice is slow. A reason for this might be that the verification tools do not connect well to the developer work-flow. This paper presents a solution to this problem: We use verification witnesses as interface between verification tools and the testing process that every developer is familiar with. Many modern verification tools report, in case a bug is found, an error path as exchangeable verification witness. Our approach is to synthesize a test from each witness, such that the developer can inspect the verification result using familiar technology, such as debuggers, profilers, and visualization tools. Moreover, this approach identifies the witnesses as an interface between formal verification and testing: Developers can use arbitrary (witness-producing) verification tools, and arbitrary converters from witnesses to tests; we implemented two such converters. We performed a large experimental study to confirm that our proposed solution works well in practice: Out of 18Â 966Â verification results obtained fromÂ 21 verifiers, 14Â 727Â results were confirmed by witness-based result validation, and 10Â 080Â of these results were confirmed alone by extracting and executing tests, meaning that the desired specification violation was effectively observed. We thus show that our approach is directly and immediately applicable to verification results produced by software verifiers that adhere to the international standard for verification witnesses.",
isbn="978-3-319-92994-1",
annote="48 references."
}

@InProceedings{Beyer-Jakobs19,
author="Dirk Beyer and Marie-Christine Jakobs",
editor="Reiner H{\"a}hnle and Wil van der Aalst",
title="CoVeriTest: Cooperative Verifier-Based Testing",
booktitle="Fundamental Approaches to Software Engineering",
year="2019",
publisher="Springer International Publishing",
address="Cham",
pages="389--408",
abstract="Testing is a widely used method to assess software quality. Coverage criteria and coverage measurements are used to ensure that the constructed test suites adequately test the given software. Since manually developing such test suites is too expensive in practice, various automatic test-generation approaches were proposed. Since all approaches come with different strengths, combinations are necessary in order to achieve stronger tools. We study cooperative combinations of verification approaches for test generation, with high-level information exchange.",
isbn="978-3-030-16722-6",
annote="64 references."
}

@Article{Bhansali-Hoar98,
  author =	 {Sanjay Bhansali and Tim J. Hoar},
  title =	 {Automated Software Synthesis: An Application in
                  Mechanical {CAD}},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 10,
  month =	 oct,
  pages =	 {848-862},
  annote =	 {32 references.}
}

@TechReport{Bhorkar00,
  Author =	 "Abhay Bhorkar",
  Title =	 "A Run-time Assertion Checker for {Java} using {JML}",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Year =	 2000,
  Number =	 "00-08",
  Address =	 "226 Atanasoff Hall, Ames, Iowa 50011",
  Month =	 may,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR00-08/TR.ps.gz",
  Note =	 "Available by anonymous ftp from ftp.cs.iastate.edu
                  or by e-mail from almanac@cs.iastate.edu."
}

@Article{Bicarregui-Hoare-Woodcock06,
  title =	"The verified software repository: a step towards the
		 verifying compiler",
  author =	"Juan Bicarregui and C. A. R. Hoare and J. C. P. Woodcock",
  journal =	FAC,
  year = 	2006,
  number =	2,
  volume =	18,
  pages =	"143-151",
  URL =  	"http://dx.doi.org/10.1007/s00165-005-0079-4",
}

@InCollection{Bicarregui-Ritchie93,
  Author =	 "Juan Bicarregui and Brian Ritchie",
  Title =	 "Invariants, Frames and Postconditions: a Comparison
                  of the {VDM} and {B} Notations",
  BookTitle =	 "Industrial-Strength Formal Methods, First
                  International Symposium of Formal Methods Europe,
                  Odense, Denmark",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "J.C.P. Woodcock and P.G. Larsen",
  Series =	 LNCS,
  Volume =	 670,
  Pages =	 "162-182",
  Address =	 NY,
  Month =	 apr,
  Annote =	 "9 references."
}

@Article{Bicarregui-Ritchie95,
  Author =	 "Juan Bicarregui and Brian Ritchie",
  Title =	 "Invariants, Frames and Postconditions: a Comparison
                  of the {VDM} and {B} Notations",
  journal =	 IEEETSE,
  year =	 1995,
  volume =	 21,
  number =	 2,
  pages =	 "79-89",
  month =	 feb,
  Annote =	 "9 references."
}

@Book{Bicarregui-etal94,
  author =	 "Juan Bicarregui and John S. Fitgerald and Peter
                  A. Lindsay and Richard Moore and Brian Ritchie",
  title =	 "Proof in {VDM}: A Practitioner's Guide",
  publisher =	 SV,
  year =	 1994,
  address =	 NY,
  annote =	 "30 references."
}

@Book{Bidoit-Mosses04,
  author =       "Michel Bidoit and Peter D. Mosses",
  title =        "\textsc{Casl} User Manual",
  year =         2004,
  publisher =    SV,
  series =       "LNCS 2900 (IFIP Series)",
  Annote =       "With chapters by T. Mossakowski, D. Sannella,
                 and A. Tarlecki"
}

@Book{Bidoit-etal91,
  Editor =	 "M. Bidoit and H.-J. Kreowski and P. Lescanne and
                  F. Orejas and D. Sannella",
  Title =	 "Algebraic System Specification and Development: A
                  Survey and Annotated Bibliography",
  Publisher =	 SV,
  Year =	 1991,
  Series =	 LNCS,
  Volume =	 501,
  Note =	 "ISBN 0-387-54060-1",
  Annote =	 "Hundreds of references.",
  Address =      "Berlin"
}

@Proceedings{Bidot-Dauchet97,
  Title =	 "{TAPSOFT '97}: Theory and Practice of Software
                  Development, 7th International Joint Conference
                  {CAAP/FASE}, Lille, France",
  BookTitle =	 "{TAPSOFT '97}: Theory and Practice of Software
                  Development, 7th International Joint Conference
                  {CAAP/FASE}, Lille, France",
  Publisher =	 SV,
  Year =	 1997,
  Editor =	 "Michel Bidoit and Max Dauchet",
  Series =	 LNCS,
  Address =      {Berlin},
  Volume =	 1214,
  Address =	 NY
}

@Article{Bieman-Kang98,
  author =	 {James M. Bieman and Byung-Kyoo Kang},
  title =	 {Measuring Design-Level Cohesion},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 2,
  month =	 feb,
  pages =	 {111-124},
  annote =	 {20 references.}
}

@Article{Bieman-Ott94,
  author =	 {James M. Bieman and Linda M. Ott},
  title =	 {Measuring Functional Cohesion},
  journal =	 IEEETSE,
  year =	 1994,
  volume =	 20,
  number =	 8,
  month =	 aug,
  pages =	 {644-657},
  annote =	 {42 references.}
}

@Article{Bieman-etal88,
  Author =	 "James M. Bieman and Albert L. Baker and Paul
                  N. Clites and David A. Gustafson and Austin
                  C. Melton",
  Title =	 "A Standard Representation of Imperative Language
                  Programs for Data Collection and Software Measures
                  Specification",
  Journal =	 "The Journal of Systems and Software",
  Month =	 jan,
  Year =	 1988
}

@inproceedings{Bierhoff-Aldrich05,
author = {Kevin Bierhoff and Jonathan Aldrich},
title = {Lightweight Object Specification with Typestates},
year = {2005},
isbn = {1595930140},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/1081706.1081741},
doi = {10.1145/1081706.1081741},
abstract = {Previous work has proven typestates to be useful for modeling protocols in object-oriented
languages. We build on this work by addressing substitutability of subtypes as well
as improving precision and conciseness of specifications. We propose a specification
technique for objects based on abstract states that incorporates state refinement,
method refinement, and orthogonal state dimensions. Union and intersection types form
the underlying semantics of method specifications. The approach guarantees substitutability
and behavioral subtyping. We designed a dynamic analysis to check existing object-oriented
software for protocol conformance and validated our approach by specifying two standard
Java libraries. We provide preliminary evidence for the usefulness of our approach.},
booktitle = {Proceedings of the 10th European Software Engineering Conference Held Jointly with 13th ACM SIGSOFT International Symposium on Foundations of Software Engineering},
pages = {217–226},
numpages = {10},
keywords = {refinement, typestate, substitutability, behavioral subtyping, union and intersection types},
location = {Lisbon, Portugal},
series = {ESEC/FSE-13}
}

% doi = {10.1145/1095430.1081741},
@article{Bierhoff-Aldrich05a,
author = {Kevin Bierhoff and Jonathan Aldrich},
title = {Lightweight Object Specification with Typestates},
year = 2005,
issue_date = {September 2005},
publisher = ACM,
address = NY,
volume = 30,
number = 5,
issn = {0163-5948},
url = {https://doi.org/10.1145/1095430.1081741},
abstract = {Previous work has proven typestates to be useful for modeling protocols in object-oriented
languages. We build on this work by addressing substitutability of subtypes as well
as improving precision and conciseness of specifications. We propose a specification
technique for objects based on abstract states that incorporates state refinement,
method refinement, and orthogonal state dimensions. Union and intersection types form
the underlying semantics of method specifications. The approach guarantees substitutability
and behavioral subtyping. We designed a dynamic analysis to check existing object-oriented
software for protocol conformance and validated our approach by specifying two standard
Java libraries. We provide preliminary evidence for the usefulness of our approach.},
journal = {SIGSOFT Softw. Eng. Notes},
month = sep,
pages = {217–226},
numpages = 10,
keywords = {behavioral subtyping, typestate, refinement, union and intersection types, substitutability}
}

@InProceedings{Bierhoff-Aldrich08,
  author = 	 {Kevin Bierhoff and Jonathan Aldrich},
  title = {Permissions to Specify the Composite Design Pattern}, 
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {89-94},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  annote = 	 {11 references.},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/Bierhoff-Aldrich.pdf}
}

@InCollection{Bijlsma90,
  author =	 "A. Bijlsma",
  title =	 "Semantics of quasi-boolean expressions",
  booktitle =	 "Beauty is Our Business",
  publisher =	 SV,
  year =	 1990,
  editor =	 "W. H. J. Feijen and others",
  pages =	 "27-35"
}

@Article{Binkley97,
  author =	 {David Binkley},
  title =	 {Semantics Guided Regression Test Cost Reduction},
  journal =	 IEEETSE,
  year =	 1997,
  volume =	 23,
  number =	 8,
  month =	 aug,
  pages =	 {498-516},
  annote =	 {43 references.}
}

@Article{Bird-Gibbons-Jones89,
  Author =	 "R. S. Bird and J. Gibbons and G. Jones",
  Title =	 "Formal Derivation of a Pattern Matching Algorithm",
  Journal =	 SCP,
  Volume =	 12,
  Number =	 2,
  Month =	 jul,
  Year =	 1989,
  Pages =	 "93-104",
  Annote =	 "6 references."
}

@Article{Bird84,
  Author =	 "R. S. Bird",
  Title =	 "The Promotion and Accumulation Strategies in
                  Transformational Programming",
  Journal =	 TOPLAS,
  Volume =	 6,
  Number =	 4,
  Pages =	 "487-504",
  Year =	 1984
}

@Article{Bird89a,
  Author =	 "R. S. Bird",
  Title =	 "Algebraic Identities for Program Calculation",
  Journal =	 "The Computer Journal",
  Volume =	 32,
  Number =	 2,
  Month =	 apr,
  Pages =	 "122-126",
  Year =	 1989
}

@InCollection{Bird89b,
  Author =	 "Richard S. Bird",
  Title =	 "Lectures on Constructive Functional Programming",
  Booktitle =	 "Constructive Methods in Computing Science",
  Series =	 "NATO ASI Series",
  Volume =	 "F55",
  Editor =	 "Manfred Broy",
  Publisher =	 SV,
  Address =	 NY,
  Pages =	 "151-216",
  Year =	 1989,
  Annote =	 "13 refernces."
}

@InCollection{Bird90,
  Author =	 "R. S. Bird",
  Title =	 "A Calculus of Functions for Program Derivation",
  Editor =	 "David A. Turner",
  BookTitle =	 "Research Topics in Functional Programming",
  Publisher =	 Addison-Wesley,
  Year =	 1990,
  Series =	 "University of Texas at Austin Year of Programming
                  Series",
  Address =	 NY,
  Pages =	 "287-307",
  Annote =	 "6 references."
}

@TechReport{Birrell-etal87,
  Author =	 "A. D. Birrell and J. V. Guttag and J. J. Horning and
                  R. Levin",
  Title =	 "Synchronization Primitives for a Multiprocessor: A
                  Formal Specification",
  Institution =	 DECSRC,
  Month =	 aug,
  Year =	 1987,
  Number =	 20,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "21 references."
}

@Book{Bishop03,
  author = 	 {Matt Bishop},
  title = 	 {Computer Security: Art and Science},
  publisher = 	 {Addison-Wesley},
  year = 	 2003,
  address = 	 {Boston, MA},
  annote = 	 {Textbook on Computer Security. 1076 references.}
}

@Article{Bjorner-Browne-Manna97,
  author =	 {Nikolaj Bj{\o}rner and Anca Browne and Zohar Manna},
  title =	 {Automatic generation of invariants and intermediate
                  assertions},
  journal =	 TCS,
  year =	 1997,
  volume =	 173,
  number =	 1,
  month =	 feb,
  pages =	 {49-87}
}

@book{Bjorner-Henson08,
 editor = {Dines Bj{\o}rner and Martin C. Henson},
 title = {Logics of Specification Languages},
 booktitle = {Logics of Specification Languages},
 publisher = SV,
 year = 2008,
 annote = "Chapters on ASM, B, CASL, CafeOBJ, the Duration Calculus, RAISE,
           VDM, TLA+, and Z.",
 address = "Berlin"
}

@Book{Bjorner-Jones82,
  Author =	 "Dines Bj{\o}rner and Cliff B. Jones",
  Title =	 "Formal Specification and Software Development",
  Publisher =	 Prentice-Hall,
  Series =	 "International Series in Computer Science",
  Address =	 "London",
  Year =	 1982,
  Annote =	 "About 400 references."
}

@InCollection{Bjorner91,
  Author =	 "Dines Bj{\o}rner",
  Title =	 "Specification and Transformation: Methodology
                  Aspects of the Vienna Development Method",
  BookTitle =	 "Formal Description of Programming Concepts",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "E. J. Neuhold and M. Paul",
  Series =	 "IFIP State-of-the-Art Reports",
  Pages =	 "137-258",
  Address =	 NY,
  Annote =	 "ISBN 0-387-53961-1. 16 references."
}

@Book{Blaha-Premerlani98,
  author =	 "Michael Blaha and William Premerlani",
  title =	 "Object-Oriented Modelling and Design for Database
                  Applications",
  publisher =	 "Prentice Hall",
  address =	 "Englewood Cliffs",
  year =	 "1998",
}

@Book{Blaha-Rumbaugh05,
  author =	 "Michael Blaha and James Rumbaugh",
  title =	 "Object-Oriented Modelling and Design with UML",
  publisher =	 "Pearson Prentice Hall",
  edition =      "Second edition",
  address =	 "Upper Saddle River, NJ",
  year =	 2005,
}

% doi = {10.1145/2489837.2489838},
@inproceedings{Blanc-etal13,
author = {R\'{e}gis Blanc and Viktor Kuncak and Etienne Kneuss and Philippe Suter},
title = {An Overview of the Leon Verification System: Verification by Translation to Recursive Functions},
year = {2013},
isbn = {9781450320641},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/2489837.2489838},
abstract = {We present the Leon verification system for a subset of the Scala programming language. Along with several functional features of Scala, Leon supports imperative constructs such as mutations and loops, using a translation into recursive functional form. Both properties and programs in Leon are expressed in terms of user-defined functions. We discuss several techniques that led to an efficient semi-decision procedure for first-order constraints with recursive functions, which is the core solving engine of Leon. We describe a generational unrolling strategy for recursive templates that yields smaller satisfiable formulas and ensures completeness for counterexamples. We illustrate the current capabilities of Leon on a set of examples, such as data structure implementations; we show that Leon successfully finds bugs or proves completeness of pattern matching as well as validity of function postconditions.},
booktitle = {Proceedings of the 4th Workshop on Scala},
articleno = {1},
numpages = {10},
keywords = {satisfiability, verification},
location = {Montpellier, France},
series = {SCALA '13}
}

@InProceedings{Blanchet-etal02,
  title =	"Design and Implementation of a Special-Purpose Static Program Analyzer for Safety-Critical Real-Time Embedded Software",
  author =	{Bruno Blanchet and Patrick Cousot and Radhia Cousot
		 and J{\'e}r{\^o}me Feret and Laurent Mauborgne and
		 Antoine Min{\'e} and David Monniaux and Xavier Rival},
  year = 	2002,
  editor =      {Torben A.E. Mogensen and David A. Schmidt and I. Hal Sudborough},
  booktitle =	{The Essence of Computation: Complexity, Analysis, Transformation},
  pages =	"85-108",
  publisher =   SV,
  series =      LNCS,
  volume =      2566,
  URL =  	"http://dx.doi.org/10.1007/3-540-36377-7_5"
}

@InProceedings{Blanchet-etal03,
  title =	"A static analyzer for large safety-critical software",
  author =	{Bruno Blanchet and Patrick Cousot and Radhia Cousot
		 and J{\'e}r{\^o}me Feret and Laurent Mauborgne and
		 Antoine Min{\'e} and David Monniaux and Xavier Rival},
  year = 	2003,
  booktitle =	{Proceedings of the ACM SIGPLAN 2003 conference on Programming language design and implementation},
  location = "San Diego, California, USA",
  pages =	"196-207",
  publisher =   ACM,
  URL =  	"http://doi.acm.org/10.1145/781131.781153",
}

@InProceedings{Blanchette-Nipkow10,
author="Jasmin Christian Blanchette and Tobias Nipkow",
editor="Matt Kaufmann and Lawrence C. Paulson",
title="Nitpick: A Counterexample Generator for Higher-Order Logic Based on a Relational Model Finder",
booktitle="Interactive Theorem Proving",
year="2010",
publisher="Springer",
address="Berlin, Heidelberg",
pages="131--146",
abstract="Nitpick is a counterexample generator for Isabelle/HOL that builds on Kodkod, a SAT-based first-order relational model finder. Nitpick supports unbounded quantification, (co)inductive predicates and datatypes, and (co)recursive functions. Fundamentally a finite model finder, it approximates infinite types by finite subsets. As case studies, we consider a security type system and a hotel key card system. Our experimental results on Isabelle theories and the TPTP library indicate that Nitpick generates more counterexamples than other model finders for higher-order logic, without restrictions on the form of the formulas to falsify.",
isbn="978-3-642-14052-5",
annote="24 references."
}

@TechReport{Bleyberg91,
  Author =	 "Maria Zamfir Bleyberg",
  Title =	 "On the Semantics of {Petri Nets}",
  Institution =	 "Department of Computing & Information Sciences,
                  Kansas State University",
  Year =	 1991,
  Number =	 "TR-CS-91-8",
  Address =	 "Manhattan, KS 66506",
  Month =	 may,
  Annote =	 "9 references."
}

@Article{Blikle81,
  author =	 "Andrzej Blikle",
  title =	 "The Clean Termination of Iterative Programs",
  journal =	 "Acta Informatica",
  year =	 1981,
  volume =	 16,
  pages =	 "199-217",
  annote =	 "25 references."
}

@Article{Blikle91,
  author =	 "A. Blikle",
  title =	 "Three-valued predicates for software specification
                  and validation",
  journal =	 "Fundamenta Informaticae",
  year =	 1991,
  volume =	 "XIV",
  pages =	 "387-410"
}

% doi = 10.1007/978-3-319-06410-9_9,
@InProceedings{Blom-Huisman14,
author="Stefan Blom and Marieke Huisman",
editor="Cliff Jones and Pekka Pihlajasaari and Jun Sun",
title="The {VerCors} Tool for Verification of Concurrent Programs",
booktitle="FM 2014: Formal Methods",
year="2014",
publisher="Springer International Publishing",
address="Cham",
pages="127--131",
abstract="The VerCors tool implements thread-modular static verification of concurrent programs, annotated with functional properties and heap access permissions. The tool supports both generic multithreaded and vector-based programming models. In particular, it can verify multithreaded programs written in Java, specified with JML extended with separation logic. It can also verify parallelizable programs written in a toy language that supports the characteristic features of OpenCL. The tool verifies programs by first encoding the specified program into a much simpler programming language and then applying the Chalice verifier to the simplified program. In this paper we discuss both the implementation of the tool and the features of its specification language.",
isbn="978-3-319-06410-9",
url={https://doi.org/10.1007/978-3-319-06410-9_9}                  
}

@Article{Bloom-Cheng-Dsouza97,
  author =	 {Bard Bloom and Allan Cheng and Ashvin Dsouza},
  title =	 {Using a Protean Language to Enhance Expressiveness
                  in Specification},
  journal =	 IEEETSE,
  year =	 1997,
  volume =	 23,
  number =	 4,
  month =	 apr,
  pages =	 {224-234},
  annote =	 {Examples of using Structural Operational Semantics
                  as a metanotation for specifications. 22
                  references.}
}

@InProceedings{Bloom95,
  Author =	 {Bard Bloom},
  Title =	 "Structured Operational Semantics as a Specification
                  Language",
  BookTitle =	 "Conference Record of POPL '95: 22nd Annual ACM
                  SIGPLAN-SIGACT Symposium on Principles of
                  Programming Languages, San Francisco, Calif.",
  Month =	 jan,
  Year =	 1995,
  Organization = ACM,
  Address =	 NY,
  Pages =	 "107-117",
  Annote =	 "21 references."
}

@Article{Blum85,
  Author =	 "Bruce Blum",
  Title =	 "Understanding the Software Paradox",
  Journal =	 SIGSOFT,
  Volume =	 10,
  Number =	 1,
  Month =	 jan,
  Year =	 1985,
  Pages =	 "43-47",
  Note =	 "Reprinted from the proceedings of the 23rd Annual
                  Technical Symposium of the Washington, D.C. Chapter
                  of the ACM, 1984",
  Annote =	 "Discussion of the problems of software engineering,
                  focusing on the development process. 38 references."
}

@Article{Blum87,
  Author =	 "Bruce Blum",
  Title =	 "A Paradigm for Developing Information Systems",
  Journal =	 IEEETSE,
  Volume =	 "SE-13",
  Number =	 4,
  Month =	 apr,
  Year =	 1987,
  Pages =	 "432-439",
  Annote =	 "18 references"
}

@inproceedings{Blume-McAllester04,
 author = {Matthias Blume and David McAllester},
 title = {A sound (and complete) model of contracts},
 booktitle = {ICFP '04: Proceedings of the ninth ACM SIGPLAN international conference on Functional programming},
 year = {2004},
 pages = {189-200},
 location = {Snow Bird, UT, USA},
 doi = {http://doi.acm.org/10.1145/1016850.1016876},
 publisher = ACM,
 address = NY
 }

@PhdThesis{Boake98,
  author =	 {Andrew Boake},
  title =	 {A Knowledge-Based Software Design Supervisor},
  school =	 {University of Pretoria},
  year =	 1998,
  address =	 {Pretoria, South Africa},
  month =	 jun,
  annote =	 {The Umhloli design supervisor combines elements of
                  object-oriented design with a logic programming
                  engine. Many references.}
}

@inproceedings{Bobot-etal11,
  hal = {http://hal.inria.fr/hal-00790310},
  author = {Fran\c{c}ois Bobot and Jean-Christophe Filli\^atre and
Claude March\'e and Andrei Paskevich},
  title = {Why3: Shepherd Your Herd of Provers},
  booktitle = {Boogie 2011: First International Workshop on Intermediate Verification Languages},
  year = 2011,
  address = {Wroc\l{}aw, Poland},
  month = {August},
  pages = {53--64},
  note = {\url{https://hal.inria.fr/hal-00790310}},
  x-international-audience = {yes}
}

@inproceedings{Bobot-etal13,
  TITLE = {{Preserving User Proofs Across Specification Changes}},
  AUTHOR = {Fran{\c c}ois Bobot and Jean-Christophe Filli{\^a}tre and Claude March{\'e} and Guillaume Melquiond and Andrei Paskevich},
  URL = {https://hal.inria.fr/hal-00875395},
  BOOKTITLE = {{Fifth Working Conference on Verified Software: Theories, Tools and Experiments}},
  ADDRESS = {Atherton, United States},
  EDITOR = {Ernie Cohen and Andrey Rybalchenko},
  PUBLISHER = {{Springer}},
  VOLUME = {8164},
  PAGES = {191-201},
  YEAR = {2013},
  MONTH = May,
  PDF = {https://hal.inria.fr/hal-00875395/file/main.pdf},
}

@InProceedings{Bochot-etal10,
author={Thomas Bochot and Pierre Virelizier and Helene Waeselynck and Virginie Wiels},
booktitle={2010 IEEE 12th International Symposium on High Assurance Systems Engineering},
title={Paths to Property Violation: A Structural Approach for Analyzing Counter-Examples},
year=2010,
pages={74-83},
publisher=IEEE,
address="Los Altos, CA",
doi={10.1109/HASE.2010.15},
annote="21 references."
}

@Article{Bodenstab-etal,
  Author =	 "D. E. Bodenstab and T. F. Houghton and
                  K. A. Kelleman and G. Ronkin and E. P. Schan",
  Title =	 "UNIX Operating System Porting Experiences",
  Journal =	 BSTJ,
  Volume =	 63,
  Number =	 8,
  Month =	 oct,
  Year =	 1984,
  Pages =	 "1769-1790",
  Annote =	 "Discusses porting the UNIX kernel to 4 different
                  computers. 10 references."
}

@Article{Bodik-Jobstmann13,
  author = 	 {Rastislav Bodik and Barbara Jobstmann},
  title = 	 {Algorithmic program synthesis: introduction},
  journal = 	 {International Journal on Software Tools for Technology Transfer},
  year = 	 2013,
  volume = 	 15,
  number = 	 5,
  pages = 	 {397-411},
  URL = {https://doi.org/10.1007/s10009-013-0287-9}
}

@unpublished{Bodkin-Almaer-Laddad04,
	Author = {Ron Bodkin and Don Almaer and Ramnivas Laddad},
	Month = {March},
	Note = {A demonstration at AOSD 2004, available from \url{https://atrack.dev.java.net/} on July 17, 2005},
	Title = {{aTrack}: an enterprise bug tracking system using {AOP}},
	Year = {2004}
}

@Article{Boehm-Jacopini66,
  author =	 {Corrado B\"{o}hm and Guiseppe Jacopini},
  title =	 {Flow Diagrams, Turing Machines and languages with
                  only two formation rules},
  journal =	 {CACM},
  year =	 1966,
  volume =	 9,
  month =	 may,
  pages =	 {366-371},
  annote =	 {One can translate an arbitrary flow diagram in to
                  one without jumps, that is, into a structured
                  program.}
}

@Article{Boehm-Port99,
  author =	 {Barry Boehm and Dan Port},
  title =	 {Escaping the Software Tar Pit: Model Clashes and How
                  to Avoid Them},
  journal =	 SIGSOFT,
  year =	 1999,
  volume =	 24,
  number =	 1,
  month =	 jan,
  pages =	 {36-48},
  annote =	 {34 references.}
}

@InCollection{Boehm79,
  Author =	 "B. Boehm",
  Title =	 "Software Engineering: R \& D Trends and Defense
                  Needs",
  BookTitle =	 "Research Directions in Software Technology",
  Editor =	 "Peter Wegner",
  Publisher =	 MITP,
  Address =	 "Cambridge, Mass.",
  Year =	 1979,
  Pages =	 "44-79",
  Annote =	 "Discusses state of software engineering and likely
                  trends. 110 references."
}

@Book{Boehm81,
  Author =	 "Barry W. Boehm",
  Title =	 "Software Engineering Economics",
  Publisher =	 Prentice-Hall,
  Address =	 "Englewood Cliffs, N.J.",
  Year =	 1981
}

@Article{Boehm81b,
  Author =	 "Barry W. Boehm",
  Title =	 "An Experiment in Small-Scale Application Software
                  Engineering",
  Journal =	 IEEETSE,
  Volume =	 "SE-7",
  Number =	 5,
  Month =	 sep,
  Year =	 1981,
  Pages =	 "482-493",
  Annote =	 "19 references"
}

@InProceedings{Boehm82,
  Author =	 "Hans-Juergen Boehm",
  Title =	 "A Logic for Expressions with Side-Effects",
  BookTitle =	 "Conference Record of the Ninth Annual ACM Symposium
                  on Principles of Programming Languages, Albuquerque,
                  New Mexico",
  Organization = ACM,
  Month =	 jan,
  Year =	 1982,
  Pages =	 "268-280"
}

@Article{Boehm84,
  Author =	 "Barry W. Boehm",
  Title =	 "Verifying and Validating Software Requirements and
                  Design Specifications",
  Journal =	 "IEEE Software",
  Month =	 jan,
  Year =	 1984,
  Volume =	 1,
  Number =	 1,
  Pages =	 "75-88",
  Annote =	 "Detailed procedures and a checklist for ensuring
                  quality of requirements and design
                  specifications. 16 references."
}

@Article{Boehm85,
  Author =	 "Hans-Juergen Boehm",
  Title =	 "Side Effects and Aliasing Can Have Simple Axiomatic
                  Descriptions",
  Journal =	 TOPLAS,
  Volume =	 7,
  Number =	 4,
  Month =	 oct,
  Year =	 1985,
  Pages =	 "637-655",
  Annote =	 "Axiomatic descriptions for imperative expression
                  languages such as Algol-68. Simple treatment of
                  pointers, side-effects, aliasing, mutation, etc. 29
                  references."
}

@Article{Boehm87,
  Author =	 "Barry W. Boehm",
  Title =	 "Improving Software Productivity",
  Journal =	 "Computer",
  Volume =	 20,
  Number =	 9,
  Month =	 sep,
  Year =	 1987,
  Pages =	 "43-57",
  Annote =	 "83 references."
}

@Book{Boerger-Staerk03,
  author =	 {Egon B\"{o}rger and Robert St\"{a}rk},
  title = 	 {Abstract State Machines: A Method for High-Level System Design and Analysis},
  publisher = 	 SV,
  address =      "Berlin",
  year = 	 2003,
  annote =	 {440 references in an annotated bibliography.}
}

@InProceedings{Boerman-Huisman-Joosten18,
author="Jan Boerman and Marieke Huisman and Sebastiaan Joosten",
editor="Carlo A. Furia and Kirsten Winter",
title="Reasoning About {JML}: Differences Between {KeY} and {OpenJML}",
booktitle="Integrated Formal Methods",
year="2018",
publisher="Springer International Publishing",
address="Cham",
pages="30--46",
abstract="To increase the impact and capabilities of formal verification, it should be possible to apply different verification techniques on the same specification. However, this can only be achieved if verification tools agree on the syntax and underlying semantics of the specification language and unfortunately, in practice, this is often not the case.",
isbn="978-3-319-98938-9"
}

@inproceedings{Boettcher-etal08,
 author = {Carolyn Boettcher and Rance DeLong and John Rushby and Wilmar Sifre},
 title = {The {MILS} Component Integration Approach to Secure Information Sharing},
 booktitle = {27th {IEEE}/{AIAA} Digital Avionics Systems Conference
                      (DASC '08)},
 year = 2008,
 publisher = IEEE,
 pages = "1.C.2-1--1.C.2-14",
 address = "Los Alamitos, California",
 URL = {http://dx.doi.org/10.1109/DASC.2008.4702758}
}

@InProceedings{Bokowski99,
  author =       {Boris Bokowski},
  title =        "{CoffeeStrainer}: Statically-Checked Constraints on the Definiiton and Use of Types in Java",
  booktitle =    "Software Engineering --- ESEC/FSE '99",
  month =        nov,
  year =         "1999",
  editor =       "Oscar Nierstrasz and Michel Lemoine",
  volume =       "1687",
  series =       LNCS,
  publisher =    SV,
  pages =        {355-374},
  note =         {Also ACM SIGSOFT {\em Software Engineering Notes},
                  volume 24, number 6.},
  annote =       {12 references.}
}

@InCollection{Bonsangue-Kok93,
  Author =	 "M. Bonsangue and J. N. Kok",
  Title =	 "Semantics, orderings and Recursion in the Weakest
                  Precondition Calculus",
  Journal =	 LNCS,
  Number =	 666,
  Editor =	 "J. W. de Baker and W. P. de Rover and G. Rozenberg",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1993,
  Booktitle =	 "Semantics: Foundations and Applications REX
                  Workshop",
  Page =	 "91-109",
  Annote =	 "23 references"
}

@Book{Booch-Rumbaugh-Jacobson99,
  author =	 {Grady Booch and James Rumbaugh and Ivar Jacobson},
  title =	 {The Unified Modeling Language User Guide},
  publisher =	 {Addison Wesley Longman},
  year =	 1999,
  series =	 {Object Technology Series},
  address =	 {Reading, Mass.}
}

@Article{Booch02,
  author = 	 {Grady Booch},
  title = 	 {Growing the UML},
  journal = 	 {Software and Systems Modeling},
  year = 	 2002,
  volume =	 1,
  number =	 2,
  pages =	 {157-160},
  month =	 dec,
  annote =       {An opinion piece about the future of UML that talks about
                  model-driven development (MDD).  No references.}
}

@InCollection{Booch83,
  Author =	 "G. Booch",
  Title =	 "Object-Oriented Design",
  BookTitle =	 "Tutorial: Software Design Techniques",
  Editor =	 "P. Freeman and A. I. Wasserman",
  Publisher =	 "IEEE Comp. Soc. Press",
  Year =	 1983,
  Pages =	 "420-436"
}

@Article{Booch90,
  Author =	 "Grady Booch",
  Title =	 "The Design of the C++ Booch Components",
  Journal =	 SIGPLAN,
  Year =	 1990,
  Volume =	 25,
  Number =	 10,
  Month =	 oct,
  Pages =	 "1-11",
  Note =	 "{\em OOPSLA ECOOP '90 Proceedings}, N. Meyrowitz
                  (editor).",
  Annote =	 "15 references."
}

@Book{Booch91,
  Author =	 "Grady Booch",
  Title =	 "Object-Oriented Design: With Applications",
  Publisher =	 "Benjamin Cummings",
  Address =	 NY,
  Year =	 1991,
  Annote =	 "Concepts, method, and applications in Smalltalk,
                  Object Pascal, C++, CLOS, and Ada. Classified
                  bibliography with hundreds of references."
}

@Book{Booch94,
  Author =	 "Grady Booch",
  Title =	 "Object-Oriented Design: With Applications",
  Publisher =	 "Benjamin Cummings",
  Address =	 NY,
  Year =	 1994,
  Edition =	 "Second",
  Annote =	 "Concepts, method, and applications in Smalltalk,
                  Object Pascal, C++, CLOS, and Ada. Classified
                  bibliography with hundreds of references."
}

@Book{Borenstein91,
  Author =	 "Nathaniel S. Borenstein",
  Title =	 "Programming as if People Mattered",
  Publisher =	 "Princeton University Press",
  Year =	 1991,
  Address =	 "Princeton, NJ",
  Annote =	 "ISU Call number QA76.758 B67 1991"
}

@InProceedings{Borgida-Mylopoulos-Reiter93,
  Author =	 "Alex Borgida and John Mylopoulos and Raymond Reiter",
  Title =	 {`... And Nothing Else Changes': The Frame Problem in
                  Procedure Specification},
  BookTitle =	 "Proceedings Fifteenth International Conference on
                  Software Engineering, Baltimore",
  Year =	 1993,
  Month =	 may,
  Note =	 "Preliminary version obtained from the authors.",
  Annote =	 "22 references."
}

@Article{Borgida-Mylopoulos-Reiter95,
  author =	 {Alex Borgida and John Mylopoulos and Raymond Reiter},
  title =	 {On the Frame Problem in Procedure Specifications},
  journal =	 IEEETSE,
  year =	 1995,
  volume =	 21,
  number =	 10,
  month =	 oct,
  pages =	 {785-798},
  URL =          {http://doi.ieeecomputersociety.org/10.1109/32.469460},
  annote =	 {34 references.}
}

@inproceedings{Bornat-etal05,
 author = {Richard Bornat and Cristiano Calcagno and Peter O'Hearn and Matthew Parkinson},
 title = {Permission accounting in separation logic},
 booktitle = "Principles of Programming Languages (POPL)",
 SigPlanNoticesVolume = {40(1)},
 month = jan,
 year = 2005,
 pages = {259--270},
 publisher = {ACM},
 URL = {http://doi.acm.org/10.1145/1040305.1040327}
}

@InCollection{Borras-etal88,
  author =	 "P. Borras and D. Clement and Th. Despeyroux and
                  J. Incerpi and G. Kahn and B. Lang and V. Pascual",
  title =	 "{CENTAUR}: the system",
  booktitle =	 "Proceedings of the ACM SIGSOFT/SIGPLAN Software
                  Engineering Symposium on Practical Software
                  Development Environments",
  year =	 1988,
  editor =	 "Peter Henderson",
  volume =	 24,
  number =	 2,
  series =	 "SIGPLAN",
  Publisher = ACM,
  pages =	 "14-24",
  month =	 feb,
  annote =	 "CENTAUR takes a formal specification of a
                  programming language and produces a language
                  specific environment. 25 references."
}

@Article{Bothe81,
  Author =	 "Klaus Bothe",
  Title =	 "A Comparative Study of Abstract Data Type Concepts",
  Journal =	 "Journal of Information Processing and Cybernetics",
  Volume =	 17,
  Number =	 "4/6",
  Pages =	 "237-257",
  Year =	 1981,
  Annote =	 "Initiality, finality and external behavior. 29
                  references."
}

@incollection{Boulme07,
   author={Sylvain Boulm\'{e}},
   title={Intuitionistic Refinement Calculus},
year={2007},
isbn={978-3-540-73227-3},
booktitle={Typed Lambda Calculi and Applications},
volume={4583},
series={Lecture Notes in Computer Science},
editor={Della Rocca, SimonaRonchi},
doi={10.1007/978-3-540-73228-0_6},
url={http://dx.doi.org/10.1007/978-3-540-73228-0_6},
publisher={Springer Berlin Heidelberg},
pages={54-69},
annote={Refinement calculus tool made by a shallow embedding in Isabelle/HOL.}
}

@InProceedings{Bouquet-Dadeau-Groslambert05,
  author = 	 {F. Bouquet and F. Dadeau and J. Groslambert},
  title = 	 {Checking {JML} Specifications with {B} Machines},
  booktitle =	 {Proceedings of the International Conference on Formal Specification and Development in Z and B (ZB'05)},
  pages =	 {435-454},
  year =	 2005,
  volume =	 3455,
  series =	 LNCS,
  address =	 NY,
  month =	 apr,
  publisher =	 SV
}

@InProceedings{Bouquet-etal05,
  author = 	 {F. Bouquet and F. Dadeau and B. Legeard and M. Utting},
  title = 	 {Symbolic Animation of {JML} Specifications},
  booktitle =	 {Proceedings of the International Conference on Formal Methods 2005 (FM'05)},
  pages =	 {75-90},
  year =	 2005,
  volume =	 3582,
  series =	 LNCS,
  address =	 NY,
  month =	 jul,
  publisher =	 SV
}

@inproceedings{Bowen-Hinchey05,
 author = {Jonathan P. Bowen and Michael G. Hinchey},
 title = {Ten commandments revisited: a ten-year perspective on the industrial application of formal methods},
 booktitle = {Proceedings of the 10th international workshop on Formal methods for industrial critical systems},
 series = {FMICS '05},
 year = {2005},
 isbn = {1-59593-148-1},
 location = {Lisbon, Portugal},
 pages = {8-16},
 url = {http://doi.acm.org/10.1145/1081180.1081183},
 doi = {10.1145/1081180.1081183},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {correctness, formal methods, industrial application, software engineering},
} 

@Article{Bowen-Hinchey06,
  author =	 "Jonathan P. Bowen and Michael G. Hinchey",
  title =	 "Ten Commandments of Formal Methods ... Ten Years Later",
  journal =	 "IEEE Computer",
  volume =	 39,
  number =	 1,
  pages =	 "40-48",
  month =	 jan,
  year =	 2006,
  annote =	 "14 references."
}

@Article{Bowen-Hinchey95,
  author =	 "J. P. Bowen and M. G. Hinchey",
  title =	 "Seven More Myths of Formal Methods",
  journal =	 "IEEE Software",
  volume =	 "12",
  number =	 "4",
  pages =	 "34-41",
  month =	 jul,
  year =	 "1995",
  url =
                  "http://www.cl.cam.ac.uk/users/mgh1001/TECHREPORTS/7myths.ps.Z",
  annote =	 "This article deals with further myths in addition to
                  those presented in \cite{Z:Hall90b}. Previous
                  versions issued as: \begin{itemize} \item Technical
                  Report PRG-TR-7-94, Oxford University Computing
                  Laboratory, June 1994. \item Technical Report 357,
                  University of Cambridge, Computer Laboratory,
                  January 1995. \end{itemize}"
}

@Article{Bowen-Hinchey95b,
  author =	 "J. P. Bowen and M. G. Hinchey",
  title =	 "Ten Commandments of Formal Methods",
  journal =	 "IEEE Computer",
  volume =	 28,
  number =	 4,
  pages =	 "56-63",
  month =	 apr,
  year =	 1995,
  url =		 "http://www.cl.cam.ac.uk/users/mgh1001/10comms.html",
  annote =	 "Previously issued as: Technical Report 350,
                  University of Cambridge, Computer Laboratory,
                  September 1994."
}

@Proceedings{Bowen-Hinchey99,
  Editor =	 {Jonathan P. Bowen and Michael G. Hinchey},
  Title =	 "High-Integrity System Specification and Design",
  Publisher =	 SV,
  Series =	 {FACIT},
  Year =	 1999
}

@InProceedings{Boyapati-Khurshid-Marinov02,
  author =	 "Chandrasekhar Boyapati and Sarfraz Khurshid and
                  Darko Marinov",
  title =	 "Korat: Automated Testing Based on {Java} Predicates",
  BookTitle =	 "Proceedings International Symposium on Software
                  Testing and Analysis (ISSTA)",
  Year =	 2002,
  Month =	 jul,
  Pages =	 "123-133",
  Organization = ACM,
  Annote =	 "32 references.",
  URL =		 "http://doi.acm.org/10.1145/566172.566191"
}

@InProceedings{Boyapati-Liskov-Shrira03,
  author =	 "Chandrasekhar Boyapati and Barbara Liskov and Liuba
                  Shrira",
  title =	 "Ownership types for object encapsulation",
  pages =	 "213-223",
  editor =	 "Cindy Norris and {Jr.} James B. Fenwick",
  booktitle =	 "Proceedings of the 30th {ACM} {SIGPLAN}-{SIGACT}
                  symposium on Principles of programming languages
                  ({POPL}-03)",
  month =	 jan # " ~15--17",
  series =	 "ACM SIGPLAN Notices",
  volume =	 "38, 1",
  publisher =	 "ACM Press",
  address =	 "New York",
  year =	 "2003"
}

@Book{Boyer-Moore79,
  Author =	 "R. S. Boyer and J. S. Moore",
  Title =	 "A Computational Logic",
  Series =	 "ACM Monograph Series",
  Publisher =	 "Academic Press",
  Address =	 NY,
  Year =	 1979
}

@InCollection{Boyland-etal08,
  author = 	 {John Boyland and Dave Clarke and Gary Leavens and Francesco Logozzo and Arnd Poetzsch-Heffter},
  title = 	 {Formal Techniques for {Java}-Like Programs},
  booktitle = 	 {Object-Oriented Technology ECOOP 2007 Workshop Reader},
  pages =	 {99-107},
  publisher =	 SV,
  year =	 2008,
  volume =	 4906,
  series =	 LNCS,
  address =	 NY,
  DOI =          {http://dx.doi.org/10.1007/978-3-540-78195-0_10},
  annote =	 {6 references.}
}

@inproceedings{Boyland03,
  author    = {John Boyland},
  title     = {Checking Interference with Fractional Permissions},
  year      = 2003,
  pages     = {55-72},
  editor    = {R. Cousot},
  booktitle = {Static Analysis (SAS)},
  publisher = SV,
  address   = {Berlin},
  series    = LNCS,
  volume    = 2694,
  URL = {http://dx.doi.org/10.1007/3-540-44898-5_4}
}
                  
@TechReport{Boysen-Leavens05,
  author =	 {Kristina P. Boysen and Gary T. Leavens},
  title =	 {Automatically generating consistent graphical user interfaces using a parser generator},
  institution =	 "Department of Computer Science, Iowa State
                  University",
  year =	 2005,
  number =	 "04-07a",
  address =	 "226 Atanasoff Hall, Ames, Iowa 50011",
  month =	 nov,
  URL =
                 "ftp://ftp.cs.iastate.edu/pub/techreports/TR04-07/TR.pdf",
  Note =	 "Available from archives.cs.iastate.edu.",
  Annote =	 "13 references."
}

@TechReport{Boysen-Leavens08,
  author =	 {Kristina P. Boysen and Gary T. Leavens},
  title =	 {Discussion of Design Alternatives for {JML Java 5} Annotations},
  institution =	 "Department of Computer Science, Iowa State University",
  year =	 2008,
  number =	 "08-01",
  address =	 "226 Atanasoff Hall, Ames, Iowa 50011",
  month =	 jan,
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR08-01/TR.pdf",
  Annote =	 "1 reference."
}

@InProceedings{Braberman-Felder99,
  author =       {Victor A. Braberman and Miguel Felder},
  title =        "Verification of Real-Time Designs: Combining Scheduling Theory with Automatic Formal Verification",
  booktitle =    "Software Engineering --- ESEC/FSE '99",
  month =        nov,
  year =         "1999",
  editor =       "Oscar Nierstrasz and Michel Lemoine",
  volume =       "1687",
  series =       LNCS,
  publisher =    SV,
  pages =        {494-510},
  note =         {Also ACM SIGSOFT {\em Software Engineering Notes},
                  volume 24, number 6.},
  annote =       {27 references.}
}

@Book{Braude01,
  author =	 {Eric J. Braude},
  title = 	 {Software Engineering: An Object-Oriented Perspective},
  publisher = 	 {Wiley},
  year = 	 2001,
  annote =	 {Several references.}
}

@InCollection{Breu-etal97,
  author =	 {Ruth Breu and Ursula Hinkel and Christoph Hofmann
                  and Cornel Klein and Barbara Paech and Bernhard
                  Rumpe and Veronika Thurner},
  title =	 {Towards a Formalization of the {Unified Modeling
                  Language}},
  booktitle =	 {ECOOP '97 --- Object-Oriented Programming 11th
                  European Conference, Jyv\"{a}skyl\"{a}, Finland},
  publisher =	 SV,
  year =	 1997,
  editor =	 {Mehmet Ak\c{s}it and Satoshi Matsuoka},
  volume =	 1241,
  series =	 LNCS,
  address =	 NY,
  month =	 jun,
  pages =	 {344-366},
  annote =	 {29 references.}
}

@Book{Breu91,
  Author =	 "Ruth Breu",
  Title =	 "Algebraic Specification Techniques in Object
                  Oriented Programming Environments",
  Publisher =	 SV,
  Year =	 1991,
  Volume =	 562,
  Series =	 LNCS,
  Address =	 NY,
  Annote =	 "Framework for the design of of object-oriented
                  programs using algebraic specification
                  techniques. 77 references."
}

@InProceedings{Breunesse-Poll03,
  author = 	 {Cees-Bart Breunesse and Erik Poll},
  title = 	 {Verifying {JML} specifications with model fields},
  booktitle =	 {Formal Techniques for Java-like Programs (FTfJP)},
  pages =	 {51-60},
  year =	 2003,
  number =	 408,
  series =	 {Technical Report, ETH Zurich},
  month =	 jul,
  URL = 	 {http://www.cs.ru.nl/~erikpoll/publications/ftfjp03.pdf}
}

@Article{Breunesse-etal05,
  Author = {Cess-Bart Breunesse and N\'{e}stor Cata{\~n}o and Marieke Huisman and Bart Jacobs},
  Title = {Formal Methods for Smart Cards: an experience report},
  Journal = SCP,
  Year = 2005,
  Volume = 55,
  Pages = {53-80},
  URL = {http://dx.doi.org/10.1016/j.scico.2004.05.011}
}

@Article{Briand-Daly-Wuest99,
  author =	 {Lionel C. Briand and John W. Daly and J\"{u}rgen
                  K. W\"{u}st},
  title =	 {A Unified Framework for Coupling Measurement in
                  Object-Oriented Systems},
  journal =	 IEEETSE,
  year =	 1999,
  volume =	 25,
  number =	 1,
  month =	 jan,
  pages =	 {91-121},
  annote =	 {37 references.}
}

@InCollection{Briggs-Werth94,
  Author =	 "Ted. L. Briggs and John Werth",
  Title =	 "A Specification Language for Object-Oriented
                  Analysis and Design",
  BookTitle =	 "Object-Oriented Programming 8th European Conference,
                  ECOOP '94 Bologna, Italy, Proceedings",
  Publisher =	 SV,
  Year =	 1994,
  Editor =	 "Mario Tokoro and Remo Pareschi",
  Series =	 LNCS,
  Volume =	 821,
  Pages =	 "365-385",
  Address =	 NY,
  Month =	 jul,
  Annote =	 "26 references."
}

@Book{Brill01e,
  editor =	 {Gregory Brill},
  title = 	 {{CodeNotes} for {J2EE}: EJB, JDBC, JSP, and Servlets},
  publisher = 	 {Random House},
  year = 	 2001,
  address = 	 NY,
}

@Book{Brill01j,
  editor =	 {Gregory Brill},
  title = 	 {{CodeNotes} for {Java}: Intermediate and Advanced Language Features},
  publisher = 	 {Random House},
  year = 	 2001,
  address = 	 NY,
}

@Book{Brill01n,
  editor =	 {Gregory Brill},
  title = 	 {{CodeNotes} for {.NET}},
  publisher = 	 {Random House},
  year = 	 2001,
  address = 	 NY,
}

@Book{Brill01w,
  editor =	 {Gregory Brill},
  title = 	 {{CodeNotes} for Web-based {UI}},
  publisher = 	 {Random House},
  year = 	 2001,
  address = 	 NY,
}

@Book{Brill01x,
  editor =	 {Gregory Brill},
  title = 	 {{CodeNotes} for {XML}},
  publisher = 	 {Random House},
  year = 	 2001,
  address = 	 NY,
}

@Article{Brilliant-Knight99,
  author =	 {Susan Brilliant and John C. Knight},
  title =	 {Empirical Research in Software Engineering: A
                  Workshop},
  journal =	 SIGSOFT,
  year =	 1999,
  volume =	 24,
  number =	 3,
  month =	 may,
  pages =	 {45-52},
  annote =	 {35 references.}
}

@Article{Brinksma-Bolognesi,
  Author =	 "Ed Brinksma and Tommaso Bolognesi",
  Title =	 "Introduction to the ISO Specification Language
                  {LOTOS}",
  Journal =	 "Computer Networks and ISDN Systems",
  Year =	 1987,
  Volume =	 14,
  Number =	 1
}

@InProceedings{Brinksma-Scollo-Steenbergen86,
  Author =	 "Ed Brinksma and Giuseppe Scollo and Chris
                  Steenbergen",
  Title =	 "{LOTOS} specifications, their implementations and
                  their tests",
  BookTitle =	 "Sixth Interantional Symposium on Protocol
                  Specification, Testing and Verification, Montreal",
  Year =	 1986,
  Publisher =	 "North Holland"
}

@InProceedings{Broekens-Moeller02,
  author = 	 {M. Br\"{o}rkens and M. M\"{o}ller},
  title = 	 {Jassda trace assertions, runtime checking the dynamic of {Java} programs},
  booktitle =	 {Trends in Testing Communicating Systems, International Conference on Testing of Communicating Systems, Berlin, Germany},
  pages =	 {39-48},
  year =	 2002,
  editor =	 {I. Schieferdecker and H. K\"{o}nig and A. Wolisz}
}


@InCollection{Brookes85,
  Author =	 "Stephen D. Brookes",
  Title =	 "A Fully Abstract Semantics and a Proof System for an
                  Algol-like Language with Sharing",
  BookTitle =	 "Mathematical Foundations of Programming Semantics,
                  International Conference, Manhattan, Kansas",
  Editor =	 "Austin Melton",
  Month =	 apr,
  Year =	 1985,
  Series =	 LNCS,
  Volume =	 239,
  Pages =	 "59-100",
  Publisher =	 SV,
  Address =	 NY,
  Annote =	 "Denotational semantics based on sharing relations
                  instead of locations to capture aliasing. 32
                  references."
}

@Book{Brooks75,
  Author =	 "Brooks, Jr., Frederick P.",
  Title =	 "The Mythical Man-Month",
  Publisher =	 Addison-Wesley,
  Address =	 "Reading, Mass.",
  Year =	 1975
}

@Article{Brooks87,
  Author =	 "Brooks, Jr., Frederick P.",
  Title =	 "No Silver Bullet: Essence and Accidents of Software
                  Engineering",
  Journal =	 "Computer",
  Month =	 apr,
  Year =	 1987,
  Volume =	 20,
  Number =	 4,
  Pages =	 "10-19",
  Annote =	 "12 references."
}

@TechReport{Brown-Nelson89,
  Author =	 "Mark R. Brown and Greg Nelson",
  Title =	 "IO Streams: Abstract Types, Real Programs",
  Institution =	 DECSRC,
  Year =	 1980,
  Month =	 nov,
  Number =	 53,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "Modula-3 interfaces for text input and output and
                  their implementation. Specifications of a real-world
                  example. 5 references."
}

@Article{Brown-Wallnau98,
  author =	 {Alan W. Brown and Kurt C. Wallnau},
  title =	 {The Current State of {CBSE}},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 5,
  month =	 sep,
  pages =	 {37-46},
  annote =	 {5 references.}
}

@Book{Brown96,
  author =	 {Alan W. Brown},
  title =	 {Component-Based Software Engineering: Selected
                  Papers from the Software Engineering Institute},
  publisher =	 {IEEE Computer Society Press},
  year =	 1996,
  address =	 {Los Alamitos, California}
}

@TechReport{Broy-Nelson89,
  Author =	 "Manfred Broy and Greg Nelson",
  Title =	 "Can fair choice be added to Dijkstra's calculus?",
  Month =	 feb,
  Year =	 1989,
  Institution =	 DECSRC,
  Number =	 38,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "4 references."
}

@Article{Broy-Nelson94,
  Author =	 "Manfred Broy and Grag Nelson",
  Title =	 "Adding Fair Choice to Dijkstra's Calculus",
  Journal =	 TOPLAS,
  Year =	 1994,
  Volume =	 16,
  Number =	 3,
  Month =	 may,
  Pages =	 "924-938",
  Annote =	 "8 references."
}

@Book{Broy-Schmidt82,
  Editor =	 "Manfred Broy and Gunther Schmidt",
  Title =	 "Theoretical Foundations of Programming Methodology
                  Lecture Notes of an International Summer School
                  directed by F. L. Bauer, E. W. Dijkstra and
                  C. A. R. Hoare",
  Publisher =	 "D. Reidel",
  Address =	 "Hingham, Mass.",
  Year =	 1982
}

@InCollection{Broy-Wirsing81a,
  Author =	 "M. Broy and M. Wirsing",
  Title =	 "On the Algebraic Specification of Nondeterministic
                  Programming Languages",
  BookTitle =	 "CAAP '81: Trees in Algebra and Programming, 6th
                  Colloquium, Genoa, March 1981, Proceedings",
  Editor =	 "E. Astesiano and C. Bohm",
  Series =	 LNCS,
  Volume =	 112,
  Publisher =	 SV,
  Address =	 NY,
  Month =	 mar,
  Year =	 1981,
  Pages =	 "162-179",
  Annote =	 "20 references."
}

@InCollection{Broy-Wirsing81b,
  Author =	 "Manfred Broy and Martin Wirsing",
  Title =	 "On the Algebraic Extensions of Abstract Data Types",
  BookTitle =	 "Formalization of Programming Concepts, International
                  Colloquium, Peniscola, Spain, April 1981",
  Publisher =	 SV,
  Address =	 NY,
  Series =	 LNCS,
  Volume =	 107,
  Editor =	 "J. Diaz and I. Ramos",
  Year =	 1981,
  Pages =	 "244-251",
  Annote =	 "Algebraic specifications. 21 references."
}

@Article{Broy-Wirsing82,
  Author =	 "Manfred Broy and Martin Wirsing",
  Title =	 "Partial Abstract Types",
  Journal =	 "Acta Informatica",
  Volume =	 18,
  Number =	 1,
  Month =	 nov,
  Year =	 1982,
  Pages =	 "47-64",
  URL =          {http://dx.doi.org/10.1007/BF00625280},
  Annote =	 "Studies hierarchical abstract types with conditional
                  equations as formulas. Discussion of different kinds
                  of homomorphisms, initial and weakly terminal
                  models. Full abstraction. Specification of the
                  semantics of programming languages. 41 references."
}

@TechReport{Broy-etal93,
  Author =	 "Manfred Broy and others",
  Title =	 "The Requirement and Design Specification Language
                  {SPECTRUM}---An informal introduction - part {I}",
  Institution =	 "Institute for Information - Technical University
                  Munchen",
  Month =	 may,
  Year =	 1993,
  Number =	 "TUM-I9311",
  Annote =	 "Part I and II - The Munich Spectrum Group"
}

@InCollection{Broy82,
  Author =	 "Manfred Broy",
  Title =	 "A Fixed Point to Applicative Multiprogramming",
  BookTitle =	 "Theoretical Foundations of Programming Methodology",
  Editor =	 "M. Broy and G. Schmidt",
  Publisher =	 "Ridel Publishing",
  Year =	 1982,
  Pages =	 "565-623"
}

@InCollection{Broy83,
  Author =	 "Manfred Broy",
  Title =	 "Fixed Point Theory for Communication and Concurrency",
  BookTitle =	 "Formal Description of Programming Concepts --- II",
  Editor =	 "Dines Bj{\o}rner",
  Publisher =	 North-Holland,
  Address =	 NY,
  Month =	 jun,
  Year =	 1983,
  Pages =	 "125-147",
  Annote =	 "The applicative language AMPL can represent
                  concurrent programs and communicating systems in the
                  form of mutually recursive streams of
                  nondeterministic equations for functions and
                  streams. Fully abstract mathematical semantics using
                  fixed points. 37 references."
}

@Article{Broy86,
  Author =	 "Manfred Broy",
  Title =	 "A Theory for Nondeterminism, Parallelism,
                  Communication, and Concurrency",
  Journal =	 TCS,
  Volume =	 45,
  Number =	 1,
  Year =	 1986,
  Pages =	 "1-61",
  Annote =	 "The applicative language AMPL represents
                  communicating systems in the form of mutually
                  recursive systems of nondeterministic equations for
                  functions and streams. A mathematical and
                  operational semantics. 85 references."
}

@TechReport{Broy92,
  Author =	 "Manfred Broy",
  Title =	 "Compositional Refinement of Interactive Systems",
  Month =	 jul,
  Year =	 1992,
  Institution =	 "Systems Research Center",
  Number =	 89,
  Address =	 "Palo Alto, California",
  Annote =	 "17 references."
}

@TechReport{Broy92a,
  Author =	 "Manfred Broy",
  Title =	 "Experiences with Software Specification and
                  Verification Using LP, the Larch Proof Assistant",
  Month =	 jul,
  Year =	 1992,
  Institution =	 DECSRC,
  Number =	 93,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "31 references."
}

@Article{Broy93,
  Author =	 "Manfred Broy",
  Title =	 "Functional Specification of Time-Sensitive
                  Communicating Systems",
  Journal =	 "ACM Transactions on Software Engineering and
                  Methodology",
  Volume =	 2,
  Number =	 1,
  Month =	 jan,
  Year =	 1993,
  Pages =	 "1-46",
  Annote =	 "45 references."
}

@TechReport{Bruckner-Sannella91,
  Author =	 "Bernd Krieg Bruckner and Donald Sannella",
  Title =	 "Structuring Specifications in-the-Large and
                  in-the-Small: Higher-Order Functions, Dependent
                  Types and Inheritance in SPECTRAL",
  Institution = "Laboratory for Foundations of Computer Science,
                  Department of Computer Science, University of
                  Edinburgh",
  Month =	 jan,
  Year =	 1991,
  Number =	 "ECS-LFCS-91-135",
  Annote =	 "51 references."
}

@Book{Bruegge-Dutoit00,
  author =	 {Bernd Bruegge and Allen H. Dutoit},
  title =	 {Object-Oriented Software Engineering: Conquering
                  Complex and Changing Systems},
  publisher =	 {Prentice Hall},
  year =	 2000,
  address =	 {Upper Saddle River, NJ},
  annote =	 {Many references.}
}

@Book{Bruegge-Dutoit04,
  author =	 {Bernd Bruegge and Allen H. Dutoit},
  title =	 {Object-Oriented Software Engineering: Using UML,
                  Patterns and Java},
  publisher =	 {Prentice Hall},
  year =	 2004,
  edition =      {Second edition},
  address =	 {Upper Saddle River, NJ},
  annote =	 {Many references.}
}

@InProceedings{Bruza-vanderWeide89,
  author =	 "P. D. Bruza and Th. P. van der Weide",
  title =	 "The Semantics of Data Flow Diagrams",
  editor =	 "N. Prakash",
  booktitle =	 "Proceedings of the International Conference on
                  Management of Data, Hyderabad, India",
  year =	 1989,
  note =
                  "ftp://ftp.cs.kun.nl/pub/SoftwEng.InfSyst/articles/ProcSem1.ps.Z"
}

@InProceedings{Buechi-Back99,
  author =       {Martin B\"{u}chi and Ralph Back},
  title =        "Compositional Symmetric Sharing in {B}",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  BookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1708,
  Pages =	 "431-451",
  annote =       "Allowing limited aliasing using rely/guarantee conditions. 27 references."
}

@InProceedings{Buechi-Sekerinski97,
  author =	 {Martin B\"{u}chi and Emil Sekerinski},
  title =	 "Formal Methods for Component Software: The
                  Refinement Calculus Perspective",
  booktitle =	 {Proceedings of the Second Workshop on
                  Component-Oriented Programming (WCOP)},
  year =	 1997,
  month =	 jun,
  note =
                  {ftp://ftp.abo.fi/pub/cs/papers/mbuechi/FMforCS.ps.gz},
  annote =	 "30 references."
}

@InProceedings{Buechi-Weck00,
  author =	 {Martin B{\"u}chi and Wolfgang Weck},
  title =        {Generic Wrappers},
  editor =       {Elisa Bertino},
  booktitle =    {ECOOP 2000 --- Object-Oriented Programming 14th European Conference},
  series =       LNCS,
  volume =       1850,
  year =         2000,
  pages =        {201-225},
  annote =       {Allows objects to be aggregated at run-time. 32 references.}
}

@TechReport{Buechi-Weck97,
  author =	 {Martin B{\"u}chi and Wolfgang Weck},
  title =	 {A Plea for Grey-Box Components},
  institution =	 {Turku Center for Computer Science},
  number =	 {122},
  isbn =	 {952-12-0047-2},
  note =         {\url{http://tinyurl.com/2833tr}},
  address =	 "Presented at the Workshop on Foundations of
                  Component-Based Systems, Z{\"u}rich, September 1997",
  year =	 {1997}
}

@InProceedings{Buechi-Weck97a,
  author =	 {Martin B{\"u}chi and Wolfgang Weck},
  title =	 {A Plea for Grey-Box Components},
  booktitle = {Foundations of Component-Based Systems Workshop},
  year = 	 1997,
  editor = 	 {Gary T. Leavens and Murali Sitaraman},
  month = 	 sep,
  organization = {University of Central Florida},
  URL = {https://www.cs.ucf.edu/~leavens/FoCBS/buechi.html}
}
% {\url{http://www.abo.fi/~mbuechi/publications/GreyBoxes.html}}

@TechReport{Buechi-Weck99,
  author =	 {Martin B{\"u}chi and Wolfgang Weck},
  title =	 {The Greybox Approach: When Blackbox Specifications
                  Hide Too Much},
  institution =	 {Turku Center for Computer Science},
  number =	 {297},
  isbn =	 {952-12-0508-3},
  note =         {\url{http://tinyurl.com/ywmuzy}},
  month =	 aug,
  year =	 1999
}

@TechReport{Buechi00,
  author =	 {Martin B{\"u}chi},
  title =	 {Safe Language Mechanisms for Modularization and Concurrency},
  institution =	 {Turku Center for Computer Science},
  year =	 2000,
  number =	 {TUCS Dissertations No. 28},
  month =	 may
}
% {\url{http://www.abo.fi/~mbuechi/publications/TR297.html}}


@InProceedings{Burdy-Huisman-Pavlova07,
   author =       "Lilian Burdy and Marieke Huisman and Mariela Pavlova",
   title =        "Preliminary Design of {BML}: A Behavioral Interface Specification Language for {Java} bytecode",
   booktitle =    {Fundamental Approaches to Software Engineering (FASE)},
   publisher =    SV,
   address =      {Berlin},
   series =       LNCS,
   volume =       4422,
   pages =        "215-229",
   year =         2007,
   url =          "ftp://ftp-sop.inria.fr/everest/Marieke.Huisman/bml.pdf"
}

@InProceedings{Burdy-Pavlova06,
  author = 	 {Lilian Burdy and Mariela Pavlova},
  title = 	 {Java Bytecode Specification and Verification},
  booktitle =	 {SAC 2006},
  year =	 2006,
  organization = {ACM},
  URL = 	 {http://www-sop.inria.fr/everest/personnel/Mariela.Pavlova/bcSpecVerify.pdf}
}
@InProceedings{Burdy-Requet-Lanet02,
  author =  "Lilian Burdy and Jean-Louis Lanet and Antoine Requet",
  title =   "{JACK}: {Java} Applet Correctness Kit",
  booktitle = {4th Gemplus Developer Conference},
  year =	 2002,
  month =	 nov,
  note =	 "\url{http://www.gemplus.com/smart/r\_d/trends/jack.html}"
}

@InProceedings{Burdy-Requet-Lanet03,
  author = "Lilian Burdy and Antoine Requet and Jean-Louis Lanet",
  title = "Java Applet Correctness: a Developer-Oriented Approach",
  booktitle = "FME 2003: Formal Methods, International Symposium of Formal Methods Europe",
  editor = "Keijiro Araki and Stefania Gnesi and Dino Mandrioli",
  series = LNCS,
  volume = 2805,
  publisher = SV,
  month = sep,
  year = 2003,
  URL = {http://www.springerlink.com/content/wje4yrg7mm7k4u88},
  pages = "422-439"
}

@InProceedings{Burdy-etal03,
  author =	 {Lilian Burdy and Yoonsik Cheon and David R. Cok and
                  Michael D. Ernst and Joeseph R. Kiniry and Gary T. Leavens and
                  K. Rustan M. Leino and Erik Poll},
  title =	 {An overview of {JML} tools and applications},
  booktitle =	 {Eighth International Workshop on Formal Methods for
                  Industrial Critical Systems (FMICS 03)},
  pages =	 {73-89},
  year =	 {2003},
  editor =	 {Thomas Arts and Wan Fokkink},
  volume =	 {80},
  series =	 {Electronic Notes in Theoretical Computer Science
                  (ENTCS)},
  month =	 {June},
  publisher =	 {Elsevier},
  annote =	 {42 references.},
  URL =		 {http://www.sciencedirect.com/science/journal/15710661}
}

@TechReport{Burdy-etal03a,
  author =	 {Lilian Burdy and Yoonsik Cheon and David M. Cok and
                  Michael D. Ernst and Joeseph R. Kiniry and Gary T. Leavens and
                  K. Rustan M. Leino and Erik Poll},
  title =	 {An overview of {JML} tools and applications},
  institution =	 {Dept. of Computer Science, University of Nijmegen},
  year =	 {2003},
  number =	 {NIII-R0309},
  annote =	 {42 references.},
  URL =
                  {ftp://ftp.cs.iastate.edu/pub/leavens/JML/jml-white-paper.pdf}
}

@Article{Burdy-etal05,
  author = 	 {Lilian Burdy and Yoonsik Cheon and David R. Cok and 
                   Michael D. Ernst and Joeseph R. Kiniry and Gary T. Leavens and 
                   K. Rustan M. Leino and Erik Poll},
  title = 	 {An overview of {JML} tools and applications},
  journal = 	 {International Journal on Software Tools 
                  for Technology Transfer},
  volume =       7,
  number =       3,
  month =        jun,
  year = 	 {2005},
  publisher =    SV,
  pages =        {212-232},
  URL =          {http://dx.doi.org/10.1007/s10009-004-0167-4},
  annote =     {93 references.}
}

@InProceedings{Burkhart92,
  Author =	 "Roger Burkhart",
  Title =	 "Enterprise Integration Modelling",
  Booktitle =	 "Proc. of the first international conference",
  Publisher =	 MITP,
  Address =	 NY,
  Year =	 1992,
  Annote =	 "11 references"
}

@Article{Burmeister82,
  Author =	 "Peter Burmeister",
  Title =	 "Partial Algebras --- Survey of a Unifying Approach
                  Towards a Two-valued Model Theory for Partial
                  Algebras",
  Journal =	 "Algebra Universalis",
  Volume =	 15,
  Pages =	 "306-358",
  Year =	 1982,
  Annote =	 "91 references."
}

@Article{Burns-Lin07,
  author = 	 {A. Burns and T.-M. Lin},
  title = 	 {An engineering process for the verification of real-time systems},
  journal = 	 {Formal Aspects of Computing},
  year = 	 2007,
  volume = 	 19,
  number = 	 1,
  pages = 	 {111-136},
  month = 	 mar,
  annote = 	 {41 references.},
  url =          {http://dx.doi.org/10.1007/s00165-006-0021-4}
}

@article{Burns03,
 author = {A. Burns},
 title = {How to Verify a Safe Real-Time System: The Application of Model Checking and Timed Automata to the Production Cell Case Study},
 journal = {Real-Time Syst.},
 volume = 24,
 number = 2,
 year = 2003,
 pages = {135-151},
 doi = {http://dx.doi.org/10.1023/A:1021758401878},
 publisher = {Kluwer Academic Publishers},
 address = {Norwell, MA, USA}
}

@Article{Burstall-Darlington77,
  Author =	 "R. M. Burstall and J. L. Darlington",
  Title =	 "A Transformation System for Developing Recursive
                  Programs",
  Journal =	 JACM,
  Year =	 1977,
  Month =	 jan,
  Volume =	 24,
  Number =	 1,
  Pages =	 "44-67"
}

@InProceedings{Burstall-Goguen77,
  Author =	 "R. M. Burstall and J. A. Goguen",
  Title =	 "Putting theories together to make specifications",
  BookTitle =	 "Fifth International Joint Conference on Artifical
                  Intelligence, MIT, Cambridge, Mass.",
  Organization = "IJCAI-77, Department of Computer Science, Carnegie
                  Mellon, Pittsburgh",
  Year =	 1977,
  Month =	 aug,
  Pages =	 "1045-1058",
  Volume =	 2,
  Annote =	 "The specification language Clear. 35 references."
}

@InCollection{Burstall-Goguen80,
  Author =	 "R. M. Burstall and J. A. Goguen",
  Title =	 "The Semantics of {CLEAR}, a Specification Language",
  BookTitle =	 "Abstract Software Specification, Copenhagen Winter
                  School",
  Series =	 LNCS,
  Volume =	 86,
  Note =	 "Also University of Edinburgh, Department of Computer
                  Science, Internal Report, CSR-65-80, Feb., 1980",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1980,
  Pages =	 "292-332"
}

@InCollection{Burstall-Goguen81,
  Author =	 "R. M. Burstall and J. Goguen",
  Title =	 "An Informal Introduction to Specification Using
                  CLEAR",
  BookTitle =	 "The Correctness Problem in Computer Science",
  Editor =	 "Robert S. Boyer and J. Strother Moore",
  Publisher =	 "Academic Press, Inc.",
  Address =	 NY,
  Year =	 1981,
  Pages =	 "185-213",
  Annote =	 "23 references."
}

@InCollection{Burstall-Goguen82,
  Author =	 "R. M. Burstall and J. A. Goguen",
  Title =	 "Algebras, Theories and Freeness: An Introduction for
                  Computer Scientists",
  BookTitle =	 "Theoretical Foundations of Programming Methodology:
                  Lecture Notes of an International Summer School
                  directed by F. L. Bauer, E. W. Dijkstra and
                  C. A. R. Hoare",
  Editor =	 "Manfred Broy and Gunther Schmidt",
  Year =	 1982,
  Publisher =	 "D. Ridel",
  Address =	 "Dordrecht, Holland",
  Pages =	 "329-348",
  Series =	 "series C",
  Volume =	 91,
  Annote =	 "44 references."
}

@Book{Buschmann-etal96,
  author =	 "Frank Buschmann and Regine Meunier and Hans Rohnert
                  and Peter Sommerlad and Michael Stal",
  title =	 "Pattern-Oriented Software Architecture: A System of
                  Patterns",
  year =	 "1996",
  publisher =	 "John Wiley \& Sons",
  series =	 "Wiley series in Software design patterns",
  annote =	 "Many references."
}

@Article{Bustard-Winstanley94,
  author =	 {David W. Bustard and Adam C. Winstanley},
  title =	 {Making Changes to Formal Specifications:
                  Requirements and an Example},
  journal =	 IEEETSE,
  year =	 1994,
  volume =	 20,
  number =	 8,
  month =	 aug,
  pages =	 {562-568},
  annote =	 {26 references.}
}

@InProceedings{Butler-DiVito91,
  Author =	 "Ricky W. Butler and Ben L. Di Vito",
  Title =	 "Design Strategy for a Formally Verified Reliable
                  Computing Platform",
  BookTitle =	 "6th Annual Conference on Computer Assurance (COMPASS
                  91)",
  Year =	 1991,
  Month =	 jun
}

@inproceedings{Butler-Sekerinski-Sere95,
  author    = {Michael J. Butler and Emil Sekerinski and Kaisa Sere},
  title     = {An Action System Approach to the Steam Boiler Problem.},
  booktitle = {Formal Methods for Industrial Applications},
  year      = 1995,
  pages     = {129-148},
  crossref  = {FMIA95},
}

@article{Butler02,
  author    = {Michael J. Butler},
  title     = {On the Use of Data Refinement in the Development of Secure
               Communications Systems.},
  journal   = FAC,
  volume    = 14,
  number    = 1,
  year      = 2002,
  pages     = {2-34},
  URL        = {http://link.springer.de/link/service/journals/00165/bibs/2014001/20140002.htm},
}

@InProceedings{Butler91,
  Author =	 "Ricky W. Butler",
  Title =	 "NASA Langley's Research Program in Formal Methods",
  BookTitle =	 "6th Annual Conference on Computer Assurance (COMPASS
                  91)",
  Year =	 1991,
  Month =	 jun
}

@article{Butler96,
  author    = {Michael J. Butler},
  title     = {Stepwise Refinement of Communicating Systems},
  journal   = SCP,
  volume    = 27,
  number    = 2,
  year      = 1996,
  pages     = {139-173}
}

@TechReport{Buxton-Stenning80,
  Author =	 "John N. Buxton and Vic Stenning",
  Title =	 "Requirements for Ada Programming Support
                  Environments: Stoneman",
  Institution =	 "U.S. Department of Defense",
  Month =	 feb,
  Year =	 1980,
  Annote =	 "2 references."
}

@unpublished{CZT06,
  author    = {{CZT Partners}},
  title     = {Community {Z} tools.},
  year      = 2006,
  note = {\url{http://czt.sourceforge.net/}}
}

@InProceedings{Cadar-etal11,
author={Cristian Cadar and Patrice Godefroid and Sarfraz Khurshid and Corina S. Pasareanu and Koushik Sen and Nikolai Tillmann and Willem Visser},
booktitle={33rd International Conference on Software Engineering (ICSE)},
title={Symbolic execution for software testing in practice: preliminary assessment},
year={2011},
publisher=IEEE,
address="Los Altos, CA",
pages={1066-1071},
doi={10.1145/1985793.1985995}
}

@Article{Calcagno-OHearn-Bornat03,
  author = 	 {Cristiano Calcagno and Peter O'Hearn and Richard Bornat},
  title = 	 {Program logic and equivalence in the presence of garbage collection},
  journal = 	 TCS,
  year = 	 2003,
  volume =	 298,
  number =	 2,
  pages =	 {557-581},
  annote =       {15 references.},
  url =          {http://dx.doi.org/10.1016/S0304-3975(02)00868-X}
}

@PhdThesis{Camarao94,
  author =	 "Carlos Camar{\~{a}}o de Figueiredo",
  title =	 "A Proof System for a Sequential Object-Based
                  Language",
  school =	 "University of Manchester",
  year =	 1995,
  month =	 "September",
  note =	 "Also in University of Manchester Technical Report
                  UMCS--95--1--1, available via
                  \url{ftp.cs.man.ac.uk:pub/TR/UMCS-95-1-1.ps.Z}, or
                  \url{http://www.cs.man.ac.uk/csonly/cstechrep/Abstracts/UMCS-95-1-1.html}"
}

@Book{Cameron83,
  Author =	 "J. R. Cameron",
  Editor =	 "P. Bruce Berra and Bill D. Carroll and Jack Cotton
                  and Jerome R. Cox, Jr. and Ez Nahouraii and
                  Chuan-lin Wu",
  Title =	 "Tutorial JSP \& JSD: The Jackson Approach to
                  Software Development",
  Publisher =	 "IEEE Computer Society Press",
  Year =	 1983,
  Series =	 "A Monograph in the Computer Society Press Series",
  Address =	 "Silver Spring, MD",
  Note =	 "ISBN 0-8186-8516-6 (casebound), 0-8186-4516-4
                  (microfiche)"
}

@Article{Cameron86,
  Author =	 "John R. Cameron",
  Title =	 "An Overivew of {JSD}",
  Journal =	 IEEETSE,
  Volume =	 "SE-12",
  Number =	 2,
  Month =	 feb,
  Year =	 1986,
  Pages =	 "222-240",
  Annote =	 "7 references."
}

@Article{Campbell-Islam93,
  author =	"Roy H. Campbell and Nayeem Islam",
  title =	"A Technique for Documenting the Framework of an
		 Object-Oriented System",
  journal =	"Computing Systems",
  year = 	1993,
  number =	4,
  volume =	6,
  pages =	"363-389"
}

@InCollection{Cansell-Mery08,
  author = 	 {Dominique Cansell and Dominique M\'{e}ry},
  title = 	 {The {event-B} Modelling Method: Concepts and Case Studies},
  crossref =  {Bjorner-Henson08},
  pages = 	 {47-152},
  annote = 	 {104 references.}
}

@Book{Carrano95,
  author =	 "Frank M. Carrano",
  title =	 "Data Abstraction and Problem Solving with C++: Walls
                  and Mirrors",
  publisher =	 "Benjamin/Cummings",
  year =	 1995,
  address =	 "Redwood City, CA"
}

@InProceedings{Carrington-etal89,
  Author =	 "D. Carrington and D. Duke and R. Duke and P. King
                  and G. Rose and G. Smith",
  Title =	 "{Object-Z}: An object-oriented extension to {Z}",
  BookTitle =	 "Formal Description Techniques (FORTE '89),
                  Vancouver",
  Month =	 dec,
  Year =	 1989,
  Publisher =	 North-Holland,
  Pages =	 "281-296",
  Annote =	 "Encapsulation for state variables in 'classes',
                  inheritance of specs, and subtype polymorphism."
}

@InProceedings{Cartwright81,
  Author =	 "Robert Cartwright",
  Title =	 "Formal Program Testing",
  BookTitle =	 "Conference Record of the Eighth ACM Symposium on
                  Principles of Programming Languages",
  Publisher =	 ACM,
  Month =	 jan,
  Year =	 1981,
  Pages =	 "125-132",
  Annote =	 "Generate verification conditions, and test them. 25
                  references."
}

@Unpublished{Casais-etal93,
  Author =	 "E. Casais and C. Lewerentz and T. Lindner and
                  F. Weber",
  Title =	 "Formal Methods and Object-Orientation",
  Note =	 "Tutorial at TOOLS Europe '93",
  Annote =	 "127 references.",
  Year =	 1993
}

@InProceedings{Catano-Huisman02,
  author =	 {N\'estor Cata{\~n}o and Marieke Huisman},
  title =	 {Formal specification of {Gemplus}'s electronic purse case study},
  booktitle =	 {FME 2002},
  volume =	 {LNCS 2391},
  editor =	 {L. H. Eriksson and P. A. Lindsay},
  publisher =	 SV,
  address   = {Berlin},
  year =	 {2002},
  pages =	 {272--289},
}

@InProceedings{Catano-Rivera14,
  author =	 {N\'estor Cata{\~n}o and V\'ictor Rivera},
  title =	 {Translating {Event-B} to {JML}-specified {Java} Programs},
  booktitle =	 {SAC'14},
  year =	 {2014},
  URL = {http://poporo.uma.pt/~ncatano/Projects/docs/eb2java.pdf}
}

@Article{Cavalcanti-Naumann00,
  Author =	 {A. L. C. Cavalcanti and D. Naumann},
  Title =	 {A Weakest Precondition Semantics for an
                  Object-oriented Language of Refinement},
  Year =	 2000,
  Journal =	 IEEETSE,
  month =	 aug,
  volume =	 26,
  number =	 8,
  pages =	 {713-728},
  Annote =	 "Defines predicate transformer semantics for a
                  Java-like language with dynamic dispatch,
                  inheritance, recursive classes and methods, and
                  specification constructs from refinement
                  calculus. The language has no pointers or
                  threads. This semantics has been used to prove
                  refinement laws and is currently being used for
                  results on behavioral subclassing; the paper
                  includes an informal discussion of the latter."
}

@InProceedings{Cavalcanti-Naumann02a,
  author =	 {A. L. C. Cavalcanti and D. A. Naumann},
  title =	 {Forward Simulation for Data Refinement of Classes},
  volume =	 {2391},
  series =	 LNCS,
  booktitle =	 {Formal Methods Europe},
  editor =	 {L. Eriksson and P. A. Lindsay},
  pages =	 {471-490},
  year =	 2002
}

@InProceedings{Cavalcanti-Naumann02b,
  author =	 {Ana Cavalcanti and David A. Naumann},
  title =	 {On a Specification-oriented Model for
                  Object-orientation},
  year =	 {2002},
  volume =	 5,
  booktitle =	 {Sixth Brazilian Symposium on Programming Languages},
  editor =	 {Edward Hermann Haeusler and Carlos Camarao de
                  Figueiredo and Alex de Vasconcellos Garcia and
                  Renato F.G. Cerqueira},
  pages =	 {114-127}
}

@InProceedings{Cavalcanti-Naumann99,
  author =       "Ana Cavalcanti and David A. Naumann",
  title =        "A Weakest Precondition Semantics for an
                 Object-Oriented Language of Refinement",
  editor =       "Jeanette M. Wing and Jim Woodcock and Jim Davies",
  booktitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  series =	 LNCS,
  publisher =	 SV,
  year =         1999,
  volume =       1709,
  pages =        "1439-1459",
  annote =       "18 references.",
}

@Article{Cavalcanti-Sampaio-Woodcook99,
  title =	 "An inconsistency in procedures, parameters, and
                  substitution in the refinement calculus",
  author =	 "Ana Cavalcanti and Augusto Sampaio and Jim Woodcock",
  pages =	 "87-96",
  journal =	 SCP,
  month =	 jan,
  year =	 "1999",
  volume =	 "33",
  number =	 "1"
}

@INPROCEEDINGS{Cha-etal12,  
author={Sang Kil Cha and Thanassis Avgerinos and Alexandre Rebert and David Brumley},
booktitle={2012 IEEE Symposium on Security and Privacy},
title={Unleashing \textsc{Mayhem} on Binary Code},
year=2012,
pages={380-394},
doi={10.1109/SP.2012.31},
publisher=IEEE,
address="Los Altos",
annote="28 references."
}

@phdthesis{Chai00,
 author = {Ian Chai},
 title = {Pedagogical framework documentation:
           how to document object-oriented frameworks.  An empirical study},
 year = 2000,
 isbn = {0-599-76181-4},
 School = "Univiersity of Illinois, Urbana-Champaign"
}

@InProceedings{Chai99,
  author = 	 {Ian Chai},
  title = 	 {Pedagogical Framework Documentation: How to Document Object-Oriented Frameworks: Summary of Empirical Results},
  booktitle =	 {Proceedings, World Engineering Congress '99, Kuala Lumpur, Malaysia},
  year =	 1999,
  month =        jul
}

@InProceedings{Chalin-Grogono-Radhakrishnan96,
  author =	 {Patrice Chalin and Peter Grogono and
                  T. Radhakrishnan},
  title =	 {Identification of and solutions to shortcomings of
                  {LCL}, a {Larch/C} interface specification language},
  editor =	 "Marie-Claude Gaudel and James Woodcock",
  volume =	 1051,
  series =	 LNCS,
  pages =	 "385-404",
  booktitle =	 "FME '96: Industrial Benefit and Advances in Formal
                  Methods",
  year =	 1996,
  publisher =	 SV,
  address =	 NY,
  month =	 mar,
  annote =	 "21 references."
}

@TechReport{Chalin-James-Karabotsos07,
  author = 	 {Patrice Chalin and Perry R. James and George Karabotsos},
  title = 	 {The Architecture of {JML4}, a Proposed Integrated Verification Environment for {JML}},
  institution =  {Concordia University},
  year = 	 2007,
  type =	 {ENCS-CSE-TR},
  number =	 {2007-006},
  address =	 {Montreal, Canada},
  month =	 may,
  URL = 	 {\url{http://users.encs.concordia.ca/~chalin/papers/TR-2007-006-v1zr.pdf}}
}

@InProceedings{Chalin-James-Karabotsos07a,
  author = 	 {Patrice Chalin and Perry R. James and George Karabotsos},
  title = 	 {An Integrated Verification Environment for {JML}: Architecture and Early Results},
  booktitle =	 {Sixth International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2007)},
  pages =	 {47-53},
  year =	 2007,
  month =	 sep,
  organization = ACM,
  URL = 	 {http://www.cs.iastate.edu/~leavens/SAVCBS/2007/papers/Chalin-James-Karabotsos.pdf}
}

@TechReport{Chalin-James-Karabotsos08,
  author = 	 {Patrice Chalin and Perry R. James and George Karabotsos},
  title = 	 {{JML4}: Towards an Industrial Grade {IVE} for {Java} and Next Generation Research Platform for {JML}},
  institution =  {Concordia University},
  year = 	 2008,
  type =	 {ENCS-CSE-TR},
  number =	 {2008-01x},
  address =	 {Montreal, Canada},
  URL = 	 {\url{http://users.encs.concordia.ca/~chalin/papers/2008-01x.pdf}}
}

@InProceedings{Chalin-Rioux05,
  author = 	 {Patrice Chalin and Fr\`{e}d\`{e}ric Rioux},
  title = 	 {Non-null References by Default in the {Java Modeling Language}},
  booktitle =	 {Proceedings of the Workshop on the Specification and Verification of Component-Based Systems (SAVCBS'05)},
  year =	 2005,
  volume =	 {31(2)},
  series =	 {ACM Software Engineering Notes},
  organization = {ACM}
}

@InProceedings{Chalin-etal06,
  author = 	 {Patrice Chalin and Joseph R. Kiniry and Gary T. Leavens and Erik Poll},
  title = 	 {Beyond Assertions: Advanced Specification and Verification with {JML} and {ESC/Java2}},
  booktitle =	 {Formal Methods for Components and Objects (FMCO) 2005, Revised Lectures},
  year =	 2006,
  series =	 LNCS,
  volume =       4111,
  publisher =	 SV,
  address =      "Berlin",
  pages =        {342-363},
  URL = {https://tinyurl.com/3z2vk55n}
}


% DOI = {10.1007/11804192_16},
@TechReport{Chalin02,
  author =	 {Patrice Chalin},
  title =	 {Back to Basics: Language Support and Semantics of
                  Basic Infinite Integer Types in {JML} and {Larch}},
  institution =	 {Computer Science Department, Concordia University},
  year =	 2002,
  number =	 {CU-CS 2002-003.1},
  month =	 oct,
  URL =
                  "http://www.cs.concordia.ca/~faculty/chalin/papers/TR-CU-CS-2002-003.1.pdf",
  annote =	 "29 references."
}

@inproceedings{Chalin03,
  author    = {Patrice Chalin},
  title     = {Improving {JML}: For a Safer and More Effective Language},
  booktitle = {Formal Methods (FME)},
  pages     = {440-461},
  editor    = {Keijiro Araki and Stefania Gnesi and Dino Mandrioli},
  publisher = SV,
  series    = LNCS,
  volume    = 2805,
  year      = 2003,
  URL       = {http://www.springerlink.com/content/26cpmd9b3vbgd2et}
}

@TechReport{Chalin03a,
  author =	 "Patrice Chalin",
  title =	 "Improving {JML}: For a Safer and More Effective
                  Language",
  institution =	 "Computer Science Department, Concordia University",
  number =	 "2003-001.1",
  year =	 2003,
  month =	 "March"
}

@Article{Chalin04,
  author =	 {Patrice Chalin},
  title = 	 {{JML} Support for Primitive Arbitrary Precision Numeric Types: Definition and Semantics},
  journal = 	 JOT,
  year = 	 2004,
  volume =	 3,
  number =	 6,
  pages =	 {57-79},
  month =	 jun,
  URL = 	 {http://www.jot.fm/issues/issue_2004_06/article3},
  annote =	 {19 references}
}

@InProceedings{Chalin05,
  author =	 {Patrice Chalin},
  title = 	 {Logical Foundations of Program Assertions: What do Practitioners Want?},
  booktitle =	 {Proceedings of the 3rd International Conference on Software Engineering and Formal Method (SEFM)},
  year =	 2005,
  publisher =    {IEEE Computer Society},
  address =      {Los Alamitos, California},
  URL = 	 {http://www.cs.concordia.ca/~chalin/papers/TR-2005-002-r2.pdf}
}

@InProceedings{Chalin06,
  author =	 {Patrice Chalin},
  title = 	 {Towards Support for Non-null Types and Non-null-by default in {Java}},
  booktitle =	 {Workshop on Formal Techniques for Java-like Programs (FTfJP)},
  year =	 2006,
  month =	 jul,
  URL = 	 {http://www.disi.unige.it/person/AnconaD/FTfJP06/paper03.pdf},
  annote =       {41 references.}
}

@InProceedings{Chalin06a,
  author =	 {Patrice Chalin},
  title = 	 {Early Detection of {JML} Specification Errors using {ESC/Java2}},
  booktitle =	 {Fifth International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2006)},
  pages =	 {25-32},
  year =	 2006,
  month =	 nov,
  organization = ACM,
  URL = 	 {http://www.cs.iastate.edu/~leavens/SAVCBS/2006/papers/Chalin.pdf}
}

@InProceedings{Chalin07,
  author = 	 {Patrice Chalin},
  title = 	 {A Sound Assertion Semantics for the Dependable Systems Evoluation Verifying Compiler},
  booktitle =	 {International Conference on Software Engineering (ICSE)},
  pages =	 {23-33},
  year =	 2007,
  month =	 may,
  publisher =    IEEE,
  address =      {Los Alamitos, California},
  URL =          {http://dx.doi.org/10.1109/ICSE.2007.9}
}

@TechReport{Chalin95,
  author =	 "Patrice Chalin",
  title =	 "Shortcomings of LCL 2.4",
  institution =	 "Concordia University, Department of Computer
                  Science",
  year =	 1995,
  number =	 "CU/DCS-TR-95-04",
  address =	 "1455 de Maisonneuve Blvd. West, Montreal, Quebec,
                  Canada",
  month =	 apr,
  note =	 "Available by anonymous ftp at ftp.cs.concordia.ca in
                  \url{pub/chalin/CU-DCS-TR-95-04.ps.Z}."
}

@PhdThesis{Chalin95b,
  author =	 {Patrice Chalin},
  title =	 {On the Language Design and Semantic Foundation of
                  {LCL}, a {Larch/C} Interface Specification Language},
  school =	 {Concordia University},
  year =	 1995,
  address =	 {1455 de Maisonneuve Blvd. West, Montreal, Quebec,
                  Canada},
  month =	 oct,
  note =	 {Available as CU/DCS TR 95-12, from the
                  \url{ftp://ftp.cs.concordia.ca/pub/chalin/tr.ps.Z}.}
}

@InCollection{Chalmers-etal91,
  Author =	 "D. L. Chalmers and B. Dandanell and J. Gortz and
                  J. S. Pedersen and E. Zierau",
  Title =	 "Using {RAISE} --- First Impressions from the LaCoS
                  Applications",
  BookTitle =	 "VDM '91 Formal Software Development Methods 4th
                  International Symposium of VDM Europe
                  Noordwijkerhout, The Netherlands, Volume 1:
                  Conference Contributions",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "S. Prehn and W. J. Toetenel",
  Series =	 LNCS,
  Volume =	 551,
  Pages =	 "645-657",
  Address =	 NY,
  Month =	 oct,
  Annote =	 "12 references."
}

@article{Champion-Delmas-Dierkes15,
title = {Generating property-directed potential invariants by quantifier elimination in a k-induction-based framework},
journal = {Science of Computer Programming},
volume = {103},
pages = {71-87},
year = {2015},
note = {Selected papers from the First International Workshop on Formal Techniques for Safety-Critical Systems (FTSCS 2012)},
issn = {0167-6423},
doi = {https://doi.org/10.1016/j.scico.2014.10.004},
url = {https://www.sciencedirect.com/science/article/pii/S0167642314004638},
author = {Adrien Champion and RÃ©mi Delmas and Michael Dierkes},
keywords = {Software verification, Formal methods, Invariant discovery, Satisfiability modulo theory, Quantifier elimination},
abstract = {This paper addresses the issue of potential invariant generation in the formal analysis of transition systems with k-induction, in the linear real/integer arithmetic fragment. First, quantifier elimination is used to find parameters for generic templates such that the said templates become inductive. Second, a backward analysis, also using quantifier elimination, outputs preimages of the negation of the proof objective, viewed as unauthorized states, or gray states. Two heuristics are proposed to take advantage of this source of information and generate potential invariants: a thorough exploration of the possible partitionings of the gray state space, and an inexact exploration regrouping and over-approximating disjoint areas of the gray state space. Both aim at discovering hidden relations between state variables. K-induction is used to isolate actual invariants and to check if they make the proof objective inductive. These heuristics can be used on the first preimage of the backward exploration, and each time a new one is output, refining the information on the gray states. We show, on examples of interest in the application field of critical embedded systems, that our approach is able to prove properties for which other academic or commercial tools fail. The different methods are introduced as components of a collaborative formal verification framework based on k-induction and are motivated through two examples, one of which was provided by Rockwell Collins.}
}

@InProceedings{Chan-Boyland-Scherlis98,
  author =	 {Edwin C. Chan and John T. Boyland and William
                  L. Scherlis},
  title =	 {Promises: Limited Specifications for Analysis and
                  Manipulation},
  booktitle =	 {Proceedings of the 1998 International Conference on
                  Software Engineering: ICSE 98, Kyoto, Japan},
  month =	 apr,
  year =	 1998,
  pages =	 {167-176},
  publisher =	 IEEE,
  address =	 {Los Alamitos, CA},
  annote =	 {22 references.}
}

@inproceedings{Chandra-Fink-Sridharan09,
author = {Satish Chandra and Stephen J. Fink and Manu Sridharan},
title = {Snugglebug: A Powerful Approach to Weakest Preconditions},
year = {2009},
isbn = {9781605583921},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/1542476.1542517},
abstract = {Symbolic analysis shows promise as a foundation for bug-finding, specification inference, verification, and test generation. This paper addresses demand-driven symbolic analysis for object-oriented programs and frameworks. Many such codes comprise large, partial programs with highly dynamic behaviors--polymorphism, reflection, and so on--posing significant scalability challenges for any static analysis.We present an approach based on interprocedural backwards propagation of weakest preconditions. We present several novel techniques to improve the efficiency of such analysis. First, we present directed call graph construction, where call graph construction and symbolic analysis are interleaved. With this technique, call graph construction is guided by constraints discovered during symbolic analysis, obviating the need for exhaustively exploring a large, conservative call graph. Second, we describe generalization, a technique that greatly increases the reusability of procedure summaries computed during interprocedural analysis. Instead of tabulating how a procedure transforms a symbolic state in its entirety, our technique tabulates how the procedure transforms only the pertinent portion of the symbolic state. Additionally, we show how integrating an inexpensive, custom logic simplifier with weakest precondition computation dramatically improves performance.We have implemented the analysis in a tool called Snugglebug and evaluated it as a bug-report feasibility checker. Our results show that the algorithmic techniques were critical for successfully analyzing large Java applications.},
booktitle = {Proceedings of the 30th ACM SIGPLAN Conference on Programming Language Design and Implementation},
pages = {363–374},
numpages = {12},
keywords = {weakest preconditions, interprocedural analysis, symbolic analysis},
location = {Dublin, Ireland},
series = {PLDI '09}
}

% doi = {10.1145/1542476.1542517},
@InProceedings{Chang-Richardson99,
  author =       {Juei Chang and Debra J. Richardson},
  title =        "Structural Specification-based Testing: Automated Support and Experimental Evaluation",
  booktitle =    "Software Engineering -- ESEC/FSE '99",
  month =        nov,
  year =         "1999",
  editor =       "Oscar Nierstrasz and Michel Lemoine",
  volume =       "1687",
  series =       LNCS,
  publisher =    SV,
  pages =        {285-302},
  note =         {Also ACM SIGSOFT {\em Software Engineering Notes},
                  volume 24, number 6.},
  annote =       {33 references.}
}

@InProceedings{Chang-etal96,
  Author =	 {Juei Chang and Debra J. Richardson and Sriram
                  Sankar},
  Title =	 {Structural Specification-based Testing with {ADL}},
  Year =	 1996,
  Pages =	 {62-70},
  Booktitle =	 {Proceedings of ISSTA 96, San Diego, CA},
  Publisher =	 {IEEE Computer Society},
  address =	 {Los Alamitos, California}
}

@article{Chapman00,
    author = "Roderick Chapman",
    title = "Industrial Experience with {SPARK}",
    journal = "ACM SIGADA Ada Letters",
    volume = 20,
    number = 4,
    pages = "64-68",
    year = "2000",
    URL = {http://doi.acm.org/10.1145/369264.369270}
}

@Article{Charette05,
  author = 	 {Robert N. Charette},
  title = 	 {Why Software Fails},
  journal = 	 {IEEE Spectrum},
  year = 	 2005,
  volume =	 42,
  number =	 9,
  pages =	 {42-49},
  month =	 sep,
  annote =	 {No references.}
}

@InProceedings{Charles06,
  author =	 {Julien Charles},
  title = 	 {Adding native specifications to {JML}},
  booktitle =	 {Workshop on Formal Techniques for Java-like Programs (FTfJP)},
  year =	 2006,
  month =	 jul,
  URL = 	 {http://www.disi.unige.it/person/AnconaD/FTfJP06/paper04.pdf},
  annote =       {The native in the title refers to the language of a theorem prover.  15 references.}
}

@inproceedings{Chatterjee-etal20,
author = {Krishnendu Chatterjee and Hongfei Fu and Amir Kafshdar Goharshady and Ehsan Kafshdar Goharshady},
title = {Polynomial Invariant Generation for Non-Deterministic Recursive Programs},
year = {2020},
isbn = {9781450376136},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3385412.3385969},
doi = {10.1145/3385412.3385969},
abstract = {We consider the classical problem of invariant generation for programs with polynomial
assignments and focus on synthesizing invariants that are a conjunction of strict
polynomial inequalities. We present a sound and semi-complete method based on positivstellensaetze,
i.e. theorems in semi-algebraic geometry that characterize positive polynomials over
a semi-algebraic set. On the theoretical side, the worst-case complexity of our approach
is subexponential, whereas the worst-case complexity of the previous complete method
(Kapur, ACA 2004) is doubly-exponential. Even when restricted to linear invariants,
the best previous complexity for complete invariant generation is exponential (Colon
et al, CAV 2003). On the practical side, we reduce the invariant generation problem
to quadratic programming (QCLP), which is a classical optimization problem with many
industrial solvers. We demonstrate the applicability of our approach by providing
experimental results on several academic benchmarks. To the best of our knowledge,
the only previous invariant generation method that provides completeness guarantees
for invariants consisting of polynomial inequalities is (Kapur, ACA 2004), which relies
on quantifier elimination and cannot even handle toy programs such as our running
example.},
booktitle = {Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation},
pages = {672–687},
numpages = {16},
keywords = {Polynomial programs, Positivstellensaetze, Invariant generation},
location = {London, UK},
series = {PLDI 2020}
}

@article{Chaudhuri-Gulwani-Lublinerman12,
 author = {Swarat Chaudhuri and Sumit Gulwani and Roberto Lublinerman},
 title = {Continuity and robustness of programs},
 journal = CACM,
 volume = 55,
 number = 8,
 month = aug,
 year = 2012,
 pages = {107-115},
 url = {http://doi.acm.org/10.1145/2240236.2240262},
 publisher = ACM,
 address = NY,
 annote = "20 references."
}

                  
@InProceedings{Cheatham-Holloway-Townley81,
  Author =	 "T. E. Cheatham and G. H. Holloway and J. A. Townley",
  Title =	 "Program Refinement by Transformation",
  BookTitle =	 "Fifth International Conference on Software
                  Engineering",
  Organization = IEEE,
  Year =	 1981,
  Pages =	 "430-437"
} 

@InProceedings{Cheatham-Wegbreit72,
  Author =	 "T. E. Cheatham and B. Wegbreit",
  Title =	 "A Laboratory for the Study of Automating
                  Programming",
  BookTitle =	 "1972 Spring Joint Computer Conference",
  Organization = AFIPS,
  Year =	 1972 ,
  Pages =	 "11-21"
}

@InCollection{Cheatham82,
  Author =	 "T. E. Cheatham",
  Title =	 "An Overview of the Harvard Program Development
                  System",
  Year =	 1981,
  BookTitle =	 "Software Engineering Environments",
  Editor =	 "H. Hunke",
  Publisher =	 North-Holland,
  Address =	 NY
}

@InCollection{Chen-Cheng00,
  Author =	 "Yonghao Chen and Betty H. C. Cheng",
  Title =	 "A Semantic Foundation for Specification Matching",
  BookTitle =	 {Foundations of Component-Based Systems},
  Editor =	 {Gary T. Leavens and Murali Sitaraman},
  Year =	 2000,
  Publisher =	 {Cambridge University Press},
  Address =	 NY,
  Pages =	 "91-109",
  Annote =	 "34 references."
}

@inproceedings{Chen-Xi05,
  author = "Chiyan Chen and Hongwei Xi",
  title = {Combining Programming with Theorem Proving},
  booktitle = "Proceedings of the 10th International Conference on Functional Programming (ICFP05)",
  year = 2005,
  location = "Tallinn, Estonia",
  month = sep
}

@Article{Chen-etal98,
  author =	 {Huo Yan Chen and T. H. Tse and F. T. Chan and
                  T. Y. Chen},
  title =	 {In Black and White: An Integrated Approach to
                  Class-Level Testing of Object-Oriented Programs},
  journal =	 TOSEM,
  year =	 1998,
  volume =	 7,
  number =	 3,
  pages =	 {250-295},
  month =	 jul,
  annote =	 {39 references.}
}

@TechReport{Chen89,
  Author =	 "Jolly Chen",
  Title =	 "The {Larch/Generic} Interface Language",
  Institution =	 "Massachusetts Institute of Technology, EECS
                  department",
  Month =	 may,
  Year =	 1989,
  Note =	 "The author's Bachelor's thesis. Available from John
                  Guttag at MIT (guttag@lcs.mit.edu)",
  Annote =	 "Generic interface language defining traits for state
                  and conventions for procedure and module interface
                  specfications. 7 references."
}

@inproceedings{Cheng-Atlee07,
 author = {Betty H. C. Cheng and Joanne M. Atlee},
 title = {Research Directions in Requirements Engineering},
 booktitle = {FOSE '07: 2007 Future of Software Engineering},
 year = {2007},
 isbn = {0-7695-2829-5},
 pages = {285--303},
 doi = {http://dx.doi.org/10.1109/FOSE.2007.17},
 publisher = {IEEE Computer Society},
 address = {Washington, DC, USA}
}

@Article{Cheng-Clements-Woodside00,
  author =	 {Albert Mo Kim Cheng and Paul Clements and Murray
                  Woodside},
  title =	 {Guest Editor's Introduction: Workshop on Software
                  Performance},
  journal =	 IEEETSE,
  year =	 2000,
  volume =	 26,
  number =	 11,
  pages =	 {1025-1026},
  month =	 nov
}

@InProceedings{Cheng-Jones91,
  author =	 "J. H. Cheng and C. B. Jones",
  editor =	 "C. Morgan and J. C. P. Woodcock",
  title =	 "{On the usability of logics which handle partial
                  functions}",
  booktitle =	 "{Proceedings of the Third refinement Workshop}",
  publisher =	 SV,
  address =	 "Berlin",
  year =	 "1991",
  pages =	 "51-69",
  series =	 "Workshops in Computing Series"
}

@TechReport{Cheon-Hayashi-Leavens03,
  Author =	 "Yoonsik Cheon and Yoshiki Hayashi and Gary
                  T. Leavens",
  Title =	 "A Thought on Specification Reflection",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Month =	 dec,
  Year =	 2003,
  Number =	 "03-16",
  Note =	 "Available from \url{archives.cs.iastate.edu}.
                  Appears in SCI 2004.",
  Annote =	 "21 references."
}

@InProceedings{Cheon-Hayashi-Leavens04,
  Author =	 "Yoonsik Cheon and Yoshiki Hayashi and Gary
                  T. Leavens",
  Editor =	 "N. Callaos and W. Lesso and B. Sanchez",
  Title =	 "A Thought on Specification Reflection",
  BookTitle =	 "The 8th World Multi-Conference on Systemics, 
                  Cybernetics and Informatics (SCI)
                  Volume II, Computing Techniques",
  Year =	 2004,
  Pages =	 "485-490"
}

@InProceedings{Cheon-Kim-Perumendla05,
  Author =	 {Yoonsik Cheon and Myoung Kim and 
                  Ashaveena Perumendla},
  Title =	 {A Complete Automation of Unit Testing for {Java} Programs},
  BookTitle =	 {Proceedings of the 2005 International Conference on
                  Software Engineering Research and Practice (SERP '05),
                  Volume I, Las Vegas, Nevada, June 27-29, 2005},
  Editor =	 {Hamid R. Arabnia and Hassan Reza},
  Pages =	 {290-295},
  Year =	 2005,
  Publisher =	 {CSREA Press}
}

@InProceedings{Cheon-Kim06,
  Author =	 {Yoonsik Cheon and Myoung Kim},
  Title =	 {A Fitness Function for Evolutionary Testing
                  of Object-Oriented Programs},
  BookTitle =	 {Genetic and Evolutionary Computation Conference,
                  Seattle, WA, USA, July 8-12, 2006},
  Pages =	 {1952-1954},
  Month =	 jul,
  Year =	 2006,
  Publisher =	 {ACM Press},
  Annote =       {An extended abstract of TR 05-36}
}

@TechReport{Cheon-Leavens01,
  Author =	 "Yoonsik Cheon and Gary T. Leavens",
  Title =	 "A Simple and Practical Approach to Unit Testing: The
                  {JML} and {JUnit} Way",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Month =	 nov,
  Year =	 2001,
  Number =	 "01-12",
  Note =	 "Available from \url{archives.cs.iastate.edu}.",
  Annote =	 "51 references."
}

@InProceedings{Cheon-Leavens02,
  author =	 {Yoonsik Cheon and Gary T. Leavens},
  title =	 {A Simple and Practical Approach to Unit Testing: The
                  {JML} and {JUnit} Way},
  booktitle =	 {{ECOOP 2002 --- Object-Oriented Programming, 16th
                  European Conference, M\'{a}alaga, Spain},
                  Proceedings},
  pages =	 {231-255},
  year =	 2002,
  editor =	 {Boris Magnusson},
  volume =	 2374,
  series =	 LNCS,
  address =	 {Berlin},
  month =	 jun,
  publisher =	 SV,
  annote =	 {The jmlunit tool. 38 references.},
  URL =          {https://tinyurl.com/4tk2nzzd}
}

%  DOI = {10.1007/3-540-47993-7_10},
@TechReport{Cheon-Leavens02a,
  Author =	 "Yoonsik Cheon and Gary T. Leavens",
  Title =	 "A Simple and Practical Approach to Unit Testing: The
                  {JML} and {JUnit} Way",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Month =	 mar,
  Year =	 2002,
  Number =	 "01-12a",
  Note =	 "Appears in ECOOP 2002 proceedings, LNCS 2374,
                  pp. 231-255.",
  Annote =	 "51 references."
}

@InProceedings{Cheon-Leavens02b,
  author =	 {Yoonsik Cheon and Gary T. Leavens},
  title =	 {A Runtime Assertion Checker for the {Java Modeling
                  Language (JML)}},
  booktitle =	 {Proceedings of the International Conference on
                  Software Engineering Research and Practice (SERP
                  '02), Las Vegas, Nevada, USA, June 24-27, 2002},
  pages =	 {322-328},
  year =	 2002,
  editor =	 {Hamid R. Arabnia and Youngsong Mun},
  month =	 jun,
  publisher =	 {CSREA Press},
  annote =	 {23 references.},
  url =
                  {ftp://ftp.cs.iastate.edu/pub/techreports/TR02-05/TR.pdf}
}

@TechReport{Cheon-Leavens02c,
  Author =	 "Yoonsik Cheon and Gary T. Leavens",
  Title =	 "A Runtime Assertion Checker for the {Java Modeling
                  Language (JML)}",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Month =	 mar,
  Year =	 2002,
  Number =	 "02-05",
  Note =	 "In SERP 2002, pp. 322-328",
  Annote =	 "19 references.",
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR02-05/TR.pdf"
}

@TechReport{Cheon-Leavens04,
  Author =	 "Yoonsik Cheon and Gary T. Leavens",
  Title =	 "The {JML} and {JUnit} Way of Unit Testing and its
                  Implementation",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Month =	 apr,
  Year =	 2004,
  Number =	 "04-02a",
  Note =         "Submitted for publication",
  Annote =	 "51 references.",
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR04-02/TR.pdf"
}

@InProceedings{Cheon-Leavens05,
  author =	 {Yoonsik Cheon and Gary T. Leavens},
  title =	 {A Contextual Interpretation of Undefinedness
                  for Runtime Assertion Checking},
  booktitle =	 {AADEBUG 2005, 
                  Proceedings of the Sixth International Symposium
                  on Automated and Analysis-Driven Debugging,
                  Monterey, California, September 19--21, 2005},
  pages =	 {149-157},
  year =	 2005,
  month =	 sep,
  publisher =	 {ACM Press},
  address =      NY,
  URL =          {http://doi.acm.org/10.1145/1085130.1085150},
  annote =	 {30 references.}
}

@TechReport{Cheon-Leavens05a,
  Author =	 "Yoonsik Cheon and Gary T. Leavens",
  Title =	 "A Contextual Interpretation of Undefinedness
                  for Runtime Assertion Checking",
  Institution =	 "Department of Computer Science, 
                  The University of Texas at El Paso",
  Month =	 mar,
  Year =	 2005,
  Number =	 "05-10",
  Note =         "To appear in AADEBUG 2005",
  Annote =       "28 references.",
  URL =          "http://www.cs.utep.edu/~cheon/techreport/tr05-10.pdf"
}

@TechReport{Cheon-Leavens93a,
  Author =	 "Yoonsik Cheon and Gary T. Leavens",
  Title =	 "A Quick Overview of {Larch/C++}",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Month =	 jun,
  Year =	 1994,
  Number =	 "93-18a",
  Note =	 "Appears in the {\em Journal of Object-Oriented
                  Programming\/}, 7(6):39-49, October 1994.",
  Annote =	 "29 references."
}

@Article{Cheon-Leavens94,
  Author =	 "Yoonsik Cheon and Gary T. Leavens",
  Title =	 "The {Larch/Smalltalk} Interface Specification
                  Language",
  Journal =	 "ACM Transactions on Software Engineering and
                  Methodology",
  Month =	 jul,
  Year =	 1994,
  Volume =	 3,
  Number =	 3,
  Pages =	 "221-253",
  Annote =	 "44 references.",
  URL =          "http://doi.acm.org/10.1145/196092.195325"
}

@TechReport{Cheon-Leavens94b,
  Author =	 "Yoonsik Cheon and Gary T. Leavens",
  Title =	 "The {Larch/Smalltalk} Interface Specification
                  Language",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Month =	 may,
  Year =	 1994,
  Number =	 "93-24a",
  Note =	 "To appear in {\it ACM TOSEM}, July 1994. Available
                  by anonymous ftp from ftp.cs.iastate.edu, and by
                  e-mail from almanac@cs.iastate.edu.",
  Annote =	 "44 references."
}

@TechReport{Cheon-Leavens94c,
  Author =	 "Yoonsik Cheon and Gary T. Leavens",
  Title =	 "A gentle introduction to {Larch/Smalltalk}
                  specification browsers",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Month =	 jan,
  Year =	 1994,
  Number =	 "94-01",
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR94-01/TR.ps.Z",
  Note =	 "Available by anonymous ftp from ftp.cs.iastate.edu,
                  and by e-mail from almanac@cs.iastate.edu."
}

@Article{Cheon-Leavens94d,
  Author =	 "Yoonsik Cheon and Gary T. Leavens",
  Title =	 "A Quick Overview of {Larch/C++}",
  Journal =	 "Journal of Object-Oriented Programming",
  Year =	 1994,
  Volume =	 7,
  Number =	 6,
  Month =	 oct,
  Pages =	 "39-49",
  Annote =	 "29 references."
}

@InProceedings{Cheon-Perumendla05,
  Author =	 {Yoonsik Cheon and Ashaveena Perumendla},
  Title =	 {Specifying and Checking Method Call Sequences in {JML}},
  BookTitle =	 {Proceedings of the 2005 International Conference on
                  Software Engineering Research and Practice (SERP '05),
                  Volume II, Las Vegas, Nevada, June 27-29, 2005},
  Editor =	 {Hamid R. Arabnia and Hassan Reza},
  Pages =	 {511-516},
  Year =	 2005,
  Publisher =	 {CSREA Press}
}

@TechReport{Cheon-Perumendla05a,
  author = 	 {Yoonsik Cheon and Ashaveena Perumendla},
  title =        {Specifying and Checking Method Call Sequences in {JML}},
  institution =  {Department of Computer Science, University of Texas at El Paso},
  year = 	 2005,
  number =	 {05-04},
  address =	 {500 West University Ave., El Paso, TX, 79968},
  month =	 feb,
  annote =	 {17 references.}
}

@Article{Cheon-Perumendla06,
  Author =       {Yoonsik Cheon and Ashaveena Perumendla},
  Title =        {Specifying and Checking Method Call Sequences of {Java} 
                  Programs},
  Journal = 	 {Software Quality Journal},
  Year =	 2006,
  Note =         {To appear}
}

@TechReport{Cheon-Perumendla06a,
  Author =       {Yoonsik Cheon and Ashaveena Perumendla},
  Title =        {Specifying and Checking Method Call Sequences of {Java} Programs},
  Institution =  {Department of Computer Science,
                  The University of Texas at El Paso},
  Month =        apr,
  Year =         2006,
  Number =       {05-36},
  Address =      {500 West University Ave., El Paso, TX, 79968},
  Annote =       {Extended version of SERP 2006 paper},
  URL =          {http://www.cs.utep.edu/~cheon/techreport/tr05-36.pdf}
}

@Article{Cheon-Perumendla07,
  Author =       {Yoonsik Cheon and Ashaveena Perumendla},
  Title =        {Specifying and Checking Method Call Sequences of {Java} 
                  Programs},
  Journal = 	 {Software Quality Journal},
  Volume =       15,
  Number =       1,
  Month =        mar,
  Year =	 2007,
  Pages =        {7--25},
  Publisher =    SV,
  URL =          {http://dx.doi.org/10.1007/s11219-006-9001-4}
}

@TechReport{Cheon-etal03,
  Author =	 "Yoonsik Cheon and Gary T. Leavens and Murali
                  Sitaraman and Stephen Edwards",
  Title =	 "Model Variables: Cleanly Supporting Abstraction in
                  Design By Contract",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Month =	 sep,
  Year =	 2003,
  Number =	 "03-10a",
  Note =	 "In \emph{Software -- Practice \& Experience}, 
                  35(6):583--599, May 2005.
                  Available from \url{archives.cs.iastate.edu}.",
  Annote =	 "39 references."
}

@TechReport{Cheon-etal04,
  Author =	 "Yoonsik Cheon and Gary T. Leavens and Murali
                  Sitaraman and Stephen Edwards",
  Title =	 "Model Variables: Cleanly Supporting Abstraction in
                  Design By Contract",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Month =	 aug,
  Year =	 2004,
  Number =	 "03-10b",
  Note =	 "In \emph{Software -- Practice \& Experience}, 
                  35(6):583--599, May 2005.
                  Available from \url{archives.cs.iastate.edu}.",
  Annote =	 "26 references."
}

@Article{Cheon-etal05,
  Author =	 "Yoonsik Cheon and Gary T. Leavens and Murali
                  Sitaraman and Stephen Edwards",
  Title =	 "Model Variables: Cleanly Supporting Abstraction in
                  Design By Contract",
  Journal = 	 SPandE,
  Year =	 2005,
  Volume =	 35,
  Number =	 6,
  Month =	 may,
  Pages =	 "583-599",
  url =          "http://dx.doi.org/10.1002/spe.649",
  Annote =	 "DOE: 10.1002/see.649"
}

@InProceedings{Cheon-etal08,
  Author =	 "Yoonsik Cheon and Antonio Cortes and Martine Ceberio and Gary T. Leavens",
  Title =	 "Integrating Random Testing with Constraints for Improved Efficiency and Diversity",
  BookTitle =    "Proceedings of SEKE 2008: The 20th International Conference on Software Engineering and Knowledge Engineering",
  Month =	 jul,
  Year =	 2008,
  pages =        "861-866",
  location =     "San Francisco, CA",
  URL =          "http://www.cs.utep.edu/~cheon/techreport/tr08-07.pdf"
}

@TechReport{Cheon-etal08a,
  Author =	 "Yoonsik Cheon and Antonio Cortes and Martine Ceberio and Gary T. Leavens",
  Title =	 "Integrating Random Testing with Constraints for Improved Efficiency and Diversity",
  Institution =	 "Department of Computer Science, The University of Texas at El Paso",
  Month =	 may,
  Year =	 2008,
  Number =	 "08-07",
  Note =	 "In \emph{SEKE 2008}, pages 861-866",
  URL =          "http://www.cs.utep.edu/~cheon/techreport/tr08-07.pdf"
}

@TechReport{Cheon03,
  Author =	 "Yoonsik Cheon",
  Title =	 "A Runtime Assertion Checker for the {Java Modeling
                  Language}",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Year =	 2003,
  Number =	 "03-09",
  Address =	 "Ames, IA",
  Month =	 apr,
  Note =	 "The author's Ph.D. dissertation.",
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR03-09/TR.pdf",
  Annote =	 "160 references."
}

@PhdThesis{Cheon03a,
  Author =	 "Yoonsik Cheon",
  Title =	 "A Runtime Assertion Checker for the {Java Modeling
                  Language}",
  School =	 "Iowa State University",
  Address =	 "Ames, Iowa, 50011",
  Year =	 2003,
  Note =	 "Available as ISU/CS TR 03-09, from
                  \url{archives.cs.iastate.edu}",
  Annote =	 "160 references."
}

@TechReport{Cheon91,
  Author =	 "Yoonsik Cheon",
  Title =	 "{Larch/Smalltalk}: A Specification Language for
                  {Smalltalk}",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Year =	 1991,
  Number =	 "91-15",
  Address =	 "Ames, IA",
  Month =	 jun,
  Note =	 "Available by anonymous ftp from ftp.cs.iastate.edu,
                  and by e-mail from almanac@cs.iastate.edu.",
  Annote =	 "40 references."
}

@Article{Chetali98,
  author =	 {Boutheina Chetali},
  title =	 {Formal Verification of Concurrent Programs Using the
                  {Larch Prover}},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 1,
  month =	 jan,
  pages =	 {46-62},
  annote =	 {Proofs of UNITY programs in LP. 35 references.}
}

@Inproceedings{Chiba98,
	author 		= {Shigeru Chiba},
	title 		= {Javassist - A Reflection-based Programming Wizard for Java},
	booktitle = {Proceedings of OOPSLA'98 Workshop on Reflective Programming in C++ and Java},
	month 		= oct,
	year 			= {1998}
}

@Article{Chikofsky-Cross90,
author={Elliot J. Chikofsky and James H. Cross II}, 
journal={IEEE Software}, 
title={Reverse engineering and design recovery: a taxonomy}, 
year={1990}, 
month={Jan}, 
volume={7}, 
number={1}, 
pages={13-17}, 
doi={http://dx.doi.org/10.1109/52.43044}, 
ISSN={0740-7459},
annote={3 references.}
}

@inproceedings{Chin-etal08,
 author = {Wei-Ngan Chin and Cristina David and Huu Hai Nguyen and Shengchao Qin},
 title = {Enhancing Modular OO Verification with Separation Logic},
 booktitle = POPL,
 editor = {Philip Wadler},
 month = jan,
 year = 2008,
 pages = {87-99},
 publisher = ACM,
 address = NY,
 annote={36 references.}
}

@TechReport{Christensen-Jepsen91,
  Author =	 "Soren Christensen and Leif Obel Jepsen",
  Title =	 "Modelling and Simulation of a Network Management
                  System using {Hierarchical Coloured Petri Nets}
                  (extended version)",
  Institution =	 "Computer Science Department, Aarhus University",
  Year =	 1991,
  Number =	 "DAIMI PB 349",
  Month =	 apr,
  Annote =	 "14 references."
}

@inproceedings{Chrzaszcz-Huisman-Schubert09,
title = {{BML} and related tools},
author =  {Jacek Chrz{\k a}szcz and Marieke Huisman and Aleksy Schubert},
booktitle = {Software Technologies Concertation on Formal Methods for Components and Objects (FMCO 2008)},
year = 2009,
note = {To appear.},
series = LNCS,
publisher = SV,
pdf = {http://wwwhome.ewi.utwente.nl/~marieke/bml_tools.pdf}
}

@Manual{Chrzaszcz-etal08,
   title = 	 {BML Reference Manual},
   author = 	 {Jacek Chrz{\k a}szcz and Marieke Huisman and Aleksy Schubert and Joseph Kiniry and Mariela Pavlova and and Erik Poll},
   month =        dec,
   year =         2008,
   institute =    "INRIA and University of Warsaw",
   note =         "In Progress. Available from {\url{http://bml.mimuw.edu.pl}}"
}

@InProceedings{Chudnov-etal18,
author="Andrey Chudnov and Nathan Collins and Byron Cook and Joey Dodds and Brian Huffman and Colm MacC{\'a}rthaigh and Stephen Magill and Eric Mertens and Eric Mullen and Serdar Tasiran and Aaron Tomb and Eddy Westbrook",
editor="Hana Chockler and Georg Weissenbacher",
title="Continuous Formal Verification of {Amazon} s2n",
booktitle="Computer Aided Verification",
year="2018",
publisher="Springer International Publishing",
address="Cham",
pages="430--446",
abstract="We describe formal verification of s2n, the open source TLS implementation used in numerous Amazon services. A key aspect of this proof infrastructure is continuous checking, to ensure that properties remain proven during the lifetime of the software. At each change to the code, proofs are automatically re-established with little to no interaction from the developers. We describe the proof itself and the technical decisions that enabled integration into development.",
isbn="978-3-319-96142-2",
annote="25 references."
}

@Article{Ciapessoni-etal99,
  author =	 {Emanuelle Ciapessoni and Alberto Coen-Porisini and
                  Ernani Crivelli and Dino Mandrioli and Piergiorgio
                  Mirandola and Angelo Morzenti},
  title =	 {From Formal Models to Formally Based Methods: An
                  Industrial Experience},
  journal =	 TOSEM,
  year =	 1999,
  volume =	 8,
  number =	 1,
  month =	 jan,
  pages =	 {79-113},
  annote =	 {Adopting formal methods incrementally can work. Many
                  references.}
}

@Article{Cicalese-Rotenstreich99,
  author =	 {Cynthia Della Torre Cicalese and Shmuel
                  Rotenstreich},
  title =	 {Behavioral Specification of Distributed Software
                  Component Interfaces},
  journal =	 {Computer},
  year =	 1999,
  volume =	 32,
  number =	 7,
  month =	 jul,
  pages =	 {46-53},
  annote =	 {Biscotti, a Java extension. 4 references.}
}

@inproceedings{Ciccia-Ciancarini-Penzo95a,
  author =	 {P. Ciaccia and P. Ciancarini and W. Penzo},
  title =	 "A Formal Approach to Software Design: The
                  {Clepsydra} Methodology",
  Booktitle =	 {Proc. 9th Int. Conf. on the Z Formal Specification
                  Notation (ZUM95), Limerick, Ireland},
  publisher =	 SV,
  editor =	 {J. Bowen and M. Hinchey},
  month =	 {September},
  series =	 LNCS,
  volume =	 967,
  year =	 1995,
  pages =	 {5-24},
  address =	 NY,
  annote =	 "17 references."
}

@inproceedings{Ciccia-Ciancarini-Penzo95b,
  author =	 {P. Ciaccia and P. Ciancarini and W. Penzo},
  title =	 "From Formal Requirements to Formal Design",
  booktitle =	 {Proc. 7th Int. Conf. on Software Engineering and
                  Knowledge Engineering, Rockville, Maryland},
  year =	 {1995},
  pages =	 {23-30},
  publisher =	 {Knowledge Systems Institute},
}

@techreport{Ciccia-Ciancarini-Penzo95c,
  author =	 {P. Ciaccia and P. Ciancarini and W. Penzo},
  title =	 "The {Clepsydra} Methodology",
  institution =	 "Dept. of Computer Science, Univ. of Bologna",
  address =	 "Pza. di Porta S.Donato, 5 -- 40127 Bologna, Italy",
  year =	 1995,
  number =	 {UBLCS 95-2},
}

@misc{Ciccia-Ciancarini-Penzo96,
  author =	 {P. Ciaccia and P. Ciancarini and W. Penzo},
  title =	 "Formal Requirements and Design Specifications: The
                  {Clepsydra} Methodology",
  year =	 1996,
  Note =	 "To appear in Int. Journal on Sw Eng. and Knowledge Eng.
              Available from
                  \url{ftp://ftp.cs.unibo.it/pub/cianca/ij.ps.gz}"
}

@Article{Ciccia-Ciancarini-Penzo97,
  title =	"Formal Requirements and Design Specifications: The
		 Clepsydra Methodology",
  author =	"Paolo Ciaccia and Paolo Ciancarini and Wilma Penzo",
  journal =	"International Journal of Software Engineering and
		 Knowledge Engineering",
  month =	mar,
  year = 	1997,
  number =	1,
  volume =	7,
  pages =	"1-42",
  URL =  	"http://dx.doi.org/10.1142/S0218194097000023",
}

@InProceedings{Clark-Devnani-Chulani-Boehm98,
  author =	 {Bradford Clark and Sunita Devnani-Chulani and Barry
                  Boehm},
  title =	 {Calibrating the {COCOMO II} Post-Arichitecture
                  Model},
  booktitle =	 {Proceedings of the 1998 International Conference on
                  Software Engineering: ICSE 98, Kyoto, Japan},
  year =	 1998,
  organization = IEEE,
  address =	 {Los Alamitos, California},
  month =	 apr,
  pages =	 {477-480},
  annote =	 {5 references.}
}

@Book{Clark-Warmer02,
  editor =	 {Tony Clark and Jos Warmer},
  title =	 {Object Modeling with the {OCL}: The Rationale behind
                  the {Object Constraint Language}},
  publisher =	 SV,
  address =      NY,
  year =	 2002
}

@TechReport{Clark82,
  Author =	 "D. Clark",
  Title =	 "Modularity and efficiency in protocol
                  implementation",
  Institution =	 "Arpanet RFC",
  Number =	 817,
  Year =	 1982,
  Month =	 jul
}

@Book{Clarke-Baniassad05,
  author =	 {Siobh\'{a}n Clarke and Elisa Baniassad},
  title = 	 {Aspect-Oriented Analysis and Design: The Theme Approach},
  publisher = 	 {Addison-Wesley},
  year = 	 2005,
  annote =	 {20 references.}
}

@Article{Clarke-Emerson-Sistla86,
  author =	 "E. M. Clarke and E. Allen Emerson and A. P. Sistla",
  title =	 "Automatic Verification of Finite State Concurrent
                  Systems Using Temporal Logic Specifications",
  journal =	 TOPLAS,
  volume =	 8,
  number =	 2,
  pages =	 "244-263",
  year =	 1986,
  annote =	 "Model checking of a CTL formula versus a transition
                  graph is introduced. An algorithm is presented that
                  iteratively labels the nodes of the graph with
                  progressively larger subformulas. 19 references."
}

@Book{Clarke-Grumberg-Peled99,  
  author =	 {Edmund M. Clarke, Jr. and Orna Grumberg and Doran A. Peled},
  title =	 {Model Checking},
  publisher =	 MITP,
  year =	 1999,
  address =	 {Cambridge, Mass.},
  annote =	 {253 references}
}

% Clarke00 was a duplicate of Clarke-Grumberg-Peled99
@InProceedings{Clarke-Noble-Potter01,
  author =	 {David G. Clarke and James Noble and John M. Potter},
  title =	 {Simple Ownership Types for Object Containment},
  booktitle =	 {ECOOP 2001 --- Object-Oriented Programming: 15th
                  European Conference, Budapest, Hungary},
  pages =	 {53-76},
  year =	 2001,
  editor =	 {Jorgen Lindskov Knudsen},
  volume =	 2072,
  series =	 LNCS,
  address =	 {Berlin},
  month =	 jun,
  publisher =	 SV,
  annote =	 {42 references.}
}

@InProceedings{Clarke-Potter-Noble98,
  author =	 {David G. Clarke and John M. Potter and James Noble},
  title =	 {Ownership Types for Flexible Alias Protection},
  BookTitle =	 "OOPSLA '98 Conference Proceedings",
  Series =	 SIGPLAN,
  Volume =	 "33(10)",
  Month =	 oct,
  Year =	 1998,
  publisher =    ACM,
  address =      NY,
  pages =	 {48-64},
  annote =	 {46 references.},
  URL = {http://doi.acm.org/10.1145/286936.286947}
}

@Article{Clarke-Rosenblum06,
  Author =	 "Lori A. Clarke and David S. Rosenblum",
  Title =	 "A Historical Perspective on Runtime Assertion Checking in Software Development",
  journal = SIGSOFT,
  volume = 31,
  number = 3,
  pages = "25-37",
  month = mar,
  year = 2006,
  note = {\url{http://doi.acm.org/10.1145/1127878.1127900}},
  publisher = ACM,
  address = NY,
  annote = "96 references."
}

@inproceedings{Clarke-Walker01,
  Author =	 {Siobh\'{a}n Clarke and Robert J. Walker},
  Booktitle =	 {Proceedings of the 23rd international conference on
                  Software engineering},
  Isbn =	 {0-7695-1050-7},
  Local-Url =
                  {file://localhost/Users/cclifton/Documents/OthersPapersAndTalks/p5-clarke.pdf},
  Location =	 {Toronto, Ontario, Canada},
  Pages =	 {5-14},
  Publisher =	 {IEEE Computer Society},
  Title =	 {Composition patterns: an approach to designing
                  reusable aspects},
  Year =	 {2001}
}

@inproceedings{Clarke-Walker02,
  Author =	 {Siobh\'{a}n Clarke and Robert J. Walker},
  Booktitle =	 {Proceedings of the 1st international conference on
                  Aspect-oriented software development},
  Doi =		 {http://doi.acm.org/10.1145/508386.508400},
  Isbn =	 {1-58113-469-X},
  Local-Url =
                  {file://localhost/Users/cclifton/Documents/OthersPapersAndTalks/p113-clarke.pdf},
  Location =	 {Enschede, The Netherlands},
  Pages =	 {113-119},
  Publisher =	 {ACM Press},
  Title =	 {Towards a standard design language for AOSD},
  Year =	 {2002}
}

@Article{Clarke-Wing96,
  author =	 "Edmund M. Clarke and Jeannette M. Wing and others",
  title =	 "Formal Methods: State of the Art and Future
                  Directions",
  journal =	 ACMCS,
  volume =	 28,
  number =	 4,
  pages =	 "626-643",
  month =	 dec,
  year =	 1996,
  url =
                  "http://www.acm.org/pubs/citations/journals/surveys/1996-28-4/p626-clarke/",
  annote =	 "Survey of specification and verification
                  techniques. Many references."
}

@InProceedings{Clarke-Wrigstad,
  author =	 {David Clarke and Tobias Wrigstad},
  title =	 {External Uniqueness is Unique Enough},
  booktitle =	 {ECOOP 2003 --- Object-Oriented Programming: 17th
                  European Conference, Darmstadt, Germany},
  pages =	 {176-200},
  year =	 2003,
  editor =	 {Luca Cardelli},
  volume =	 2743,
  series =	 LNCS,
  address =	 {Berlin},
  month =	 jul,
  publisher =	 SV,
  annote =	 {42 references.}
}

@InProceedings{Clarke-etal00,
  author = 	 {Edmund Clarke and Orna Grumberg and Somesh Jha and Yuan Lu and Helmut Veith},
  title = 	 {Counterexample-Guided Abstraction Refinement},
  booktitle = {Computer Aided Verification},
  pages = 	 {154-169},
  year = 	 2000,
  volume = 	 1855,
  series = 	 {LNCS},
  address = 	 {Berlin},
  publisher = {SV},
  URL = 	 {http://dx.doi.org/10.1007/b12001},
  annote = 	 {23 references.}
}

@inproceedings{Clarke-etal95,
author = {E. M. Clarke and O. Grumberg and K. L. McMillan and X. Zhao},
title = {Efficient Generation of Counterexamples and Witnesses in Symbolic Model Checking},
year = {1995},
isbn = {0897917251},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/217474.217565},
doi = {10.1145/217474.217565},
booktitle = {Proceedings of the 32nd Annual ACM/IEEE Design Automation Conference},
pages = {427–432},
numpages = {6},
location = {San Francisco, California, USA},
series = {DAC '95}
}

@article{Clavel-etal02,
 author = {M. Clavel and F. Dur{\'a}n and S. Eker and P. Lincoln and N. Mart{\'i}-Oliet and J. Meseguer and J. F. Quesada},
 title = {Maude: specification and programming in rewriting logic},
 journal = TCS,
 volume = 285,
 number = 2,
 year = 2002,
 pages = {187--243},
 doi = {http://dx.doi.org/10.1016/S0304-3975(01)00359-0},
 publisher = {Elsevier Science Publishers Ltd.},
 address = {Essex, UK},
}

@unpublished{ClearSy96,
  author    = {ClearSy},
  title     = {{Atelier B}, User and Reference Manuals},
  note      = {\url{http://tinyurl.com/lkj72}},
  year      = 1996
}

@InCollection{Clerici-Orejas88,
  Author =	 "S. Clerici and F. Orejas",
  Title =	 "GSBL: An Algebraic Specification Language Based on
                  Inheritance",
  BookTitle =	 "ECOOP '88, European Conference on Object-Oriented
                  Programming, Oslo, Norway",
  Editor =	 "S. Gjessing and K. Nygaard",
  Publisher =	 SV,
  Address =	 NY,
  Month =	 aug,
  Year =	 1988,
  Pages =	 "78-92",
  Series =	 LNCS,
  Volume =	 322,
  Annote =	 "Allows incomplete specifications. Order-sorted. 16
                  references."
}

@InProceedings{Clifton-Leavens-Noble07,
  author = 	 {Curtis Clifton and Gary T. Leavens and James Noble},
  title = 	 {{MAO}: Ownership and Effects for more Effective Reasoning about Aspects},
  booktitle =	 {ECOOP 2007 --- Object-Oriented Programming, 21st
                  European Conference, Berlin, Germany,
                  Proceedings},
  pages =	 {451-475},
  editor =	 {Erik Ernst},
  volume =	 4609,
  series =	 LNCS,
  address =	 {Berlin},
  publisher =	 SV,
  year =	 2007,
  month =	 jul,
  URL =          "http://dx.doi.org/10.1007/978-3-540-73589-2_22",
  annote =	 {32 references.}
}

@TechReport{Clifton-Leavens-Noble07a,
  author = 	 {Curtis Clifton and Gary T. Leavens and James Noble},
  title = 	 {{MAO}: Ownership and Effects for more Effective Reasoning about Aspects},
  year =	 2007,
  number =	 {06-35a},
  address =	 {Ames, IA, 50011},
  month =	 apr,
  institution =  {Dept. of Computer Science, Iowa State University},
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR06-35/TR.pdf",
  note =         {In {\em ECOOP 2007}, Springer-Verlag LNCS Volume 4609, pages 451--475.},
  annote =	 {32 references.}
}

@TechReport{Clifton-Leavens02,
  Author =	 {Curtis Clifton and Gary T. Leavens},
  Title =	 {Observers and Assistants: A Proposal for Modular
                  Aspect-Oriented Reasoning},
  institution =	 {Iowa State University, Department of Computer
                  Science},
  year =	 2002,
  number =	 {02-04a},
  month =	 apr,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR02-04/TR.pdf",
  Annote =	 "25 references."
}

@InCollection{Clifton-Leavens02a,
  Author =	 {Curtis Clifton and Gary T. Leavens},
  Title =	 {Observers and Assistants: A Proposal for Modular
                  Aspect-Oriented Reasoning},
  Pages =	 "33-44",
  BookTitle =	 {FOAL 2002 Proceedings: Foundations of
                  Aspect-Oriented Languages Workshop at AOSD 2002},
  year =	 2002,
  Editor =	 {Gary T. Leavens and Ron Cytron},
  Publisher = {Department of Computer Science, Iowa State University},
  Series =	 {Technical Reports},
  number =	 {02-06},
  month =	 apr,
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR02-06/TR.pdf"
}

@InProceedings{Clifton-Leavens03,
  Author = 	 {Curtis Clifton and Gary T. Leavens},
  Title = 	 {Obliviousness, Modular Reasoning, and the Behavioral 
                  Subtyping Analogy}, 
  institution =  {Iowa State University, Department of Computer Science},
  year = 	 2003,
  BookTitle =    {SPLAT 2003: Software engineering Properties of Languages for Aspect Technologies at AOSD 2003},
  month =	 mar,
  note =          "Available as Computer Science Technical Report TR03-01a from ftp//:ftp.cs.iastate.edu/pub/techreports/TR03-01/TR.pdf",
  Annote =       "19 references."
}

@TechReport{Clifton-Leavens03a,
  Author =	 {Curtis Clifton and Gary T. Leavens},
  Title =	 {Obliviousness, Modular Reasoning, and the Behavioral
                  Subtyping Analogy},
  institution =	 {Iowa State University, Department of Computer
                  Science},
  year =	 2003,
  number =	 {03-15},
  month =	 dec,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR03-15/TR.pdf",
  Annote =	 "19 references.",
  Note = {Revised version of TR03-01}
}

@TechReport{Clifton-Leavens05b,
  author = 	 {Curtis Clifton and Gary T. Leavens},
  title = 	 {A Design Discipline and Language Features for Formal Modular Reasoning in Aspect-Oriented Programs},
  year =	 2005,
  number =	 {05-23},
  address =	 {Ames, IA, 50011},
  month =	 jan,
  institution =  {Dept. of Computer Science, Iowa State University},
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR05-23/TR.pdf",
  annote =	 {35 references.}
}

@TechReport{Clifton05,
  author = 	 {Curtis Clifton},
  title = 	 {A design discipline and language features for
                  modular reasoning in aspect-oriented programs},
  institution =  {Department of Computer Science, Iowa State
                  University},
  year = 	 2005,
  number =	 {05-15},
  address =	 {226 Atanasoff Hall, Ames, Iowa 50011},
  month =	 jul,
  URL =          {ftp://ftp.cs.iastate.edu/pub/techreports/TR05-15/TR.pdf},
  annote =	 {The author's Ph.D. thesis.  162 references.}
}

@PhdThesis{Clifton05a,
  author = 	 {Curtis Clifton},
  title = 	 {A design discipline and language features for
                  modular reasoning in aspect-oriented programs},
  school =       {Iowa State University},
  year = 	 2005,
  note =	 {Available as TR \#05-15.},
  month =	 jul,
  URL =          {ftp://ftp.cs.iastate.edu/pub/techreports/TR05-15/TR.pdf},
  annote =	 {162 references.}
}

@Article{Cline-Girou00,
  author =       "Marshall Cline and Mike Girou",
  title =        "Enduring business themes",
  journal =      CACM,
  volume =       43,
  number =       5,
  pages =        "101-106",
  month =        may,
  year =         2000,
  URL =          "http://www.acm.org/pubs/citations/journals/cacm/2000-43-5/p101-cline/",
  annote =       "Advocates OO design around business themes that endure.  8 references."
}

@Article{Clyde-Embley-Woodfield92,
  Author =	 "Stephen W. Clyde and David W. Embley and Scott
                  N. Woodfield",
  Title =	 "Tunable Formalism in Object-Oriented Systems
                  Analysis: Meeting the Needs of Both Theoreticians
                  and Practitioners",
  Journal =	 SIGPLAN,
  Volume =	 27,
  Number =	 10,
  Month =	 oct,
  Year =	 1992,
  Pages =	 "452-465",
  Note =	 "{\em OOPSLA '92 Proceedings}, Andreas Paepcke
                  (editor).",
  Annote =	 "17 references."
}


@Book{CoFI04,
  author =       "{CoFI (The Common Framework Initiative)}",
  title =        "\textsc{Casl} Reference Manual",
  year =         "2004",
  publisher =    SV,
  series =       "LNCS 2960 (IFIP Series)",
  address =      "Berlin"
}

@inproceedings{Coady-Kiczales03,
  author =	 {Yvonne Coady and Gregor Kiczales},
  title =	 {Back to the Future: {A} Retroactive Study of Aspect
                  Evolution in Operating System Code},
  crossref =	 {aosd03},
  pages =	 {50-59}
}

@Article{Coady-etal01,
  Author =	 "Yvonne Coady and Gregor Kiczales and Mike Feeley and
                  Norm Hutchinson and Joon Suan Ong",
  Title =	 "Structuring operating system aspects: using {AOP} to
                  improve {OS} structure modularity",
  Journal =	 CACM,
  Year =	 2001,
  Volume =	 44,
  Number =	 10,
  Month =	 oct,
  Pages =	 "79-82",
  url =
                  "http://portal.acm.org/toc.cfm?id=383845&type=issue&coll=portal&dl=ACM&idx=J79&part=magazine&WantType=Magazines&title=CACM"
}

@Article{Coady-etal01b,
  author =	 {Yvonne Coady and Gregor Kiczales and Mike Feeley and
                  Greg Smolyn},
  title =	 {Using {AspectC} to improve the modularity of
                  path-specific customization in operating system
                  code},
  journal =	 SIGSOFT,
  year =	 2001,
  volume =	 26,
  number =	 5,
  month =	 sep,
  pages =	 {88-98},
  note =	 {Proceedings of the 8th European software engineering
                  conference held jointly with 9th ACM SIGSOFT
                  symposium on Foundations of software engineering,
                  Vienna, Austria}
}

@InCollection{Coen-Porsini-Kemmerer-Mandrioli,
  Author =	 "A. Coen-Porsini and R. A. Kemmerer D. Mandrioli",
  Title =	 "A Formal FrameWork of ASTRAL Inter-Level Proof
                  Obligations",
  Journal =	 LNCS,
  Number =	 717,
  Editor =	 "Ian SommrVille and Manfred Paul",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1993,
  Booktitle =	 "Software Engineering= ESEC '93. 4th European
                  Software Engineering Conference",
  Page =	 "483-500",
  Annote =	 "11 references"
}

@InProceedings{Coglio-Green05,
  author = 	 {Alessandro Coglio and Cordell Green},
  title = 	 {A Constructive Approach to Correctness, Exemplified
                  by a Generator for Certified {Java Card} Appplets},
  booktitle = 	 {Proc.\ {IFIP} Working Conference on Verified Software:
                  Tools, Techniques, and Experiments},
  year = 	 {2005},
  month = 	 oct,
  URL =          {\url{}}
}

@Book{Cohen-Harwood-Jackson86,
  Author =	 "B. Cohen and W. T. Harwood and M. I Jackson",
  Title =	 "The Specification of Complex Systems",
  Publisher =	 "Addison-Wesley",
  Year =	 1986
}

@Article{Cohen-Porisini-Ghezzi-Kemmerer94,
  author =	 {Alberto Cohen-Porisini and Carlo Ghezzi and Richard
                  A. Kemmerer},
  title =	 {A Formal Framework for {ASTRAL} Intralevel Proof
                  Obligations},
  journal =	 IEEETSE,
  year =	 1994,
  volume =	 20,
  number =	 8,
  month =	 aug,
  pages =	 {548-561},
  annote =	 {13 references.}
}

@Article{Cohen-Porisini-Ghezzi-Kemmerer97,
  author =	 {Alberto Cohen-Porisini and Carlo Ghezzi and Richard
                  A. Kemmerer},
  title =	 {Specification of Realtime Systems using {ASTRAL}},
  journal =	 IEEETSE,
  year =	 1997,
  volume =	 23,
  number =	 9,
  month =	 sep,
  pages =	 {572-598},
  annote =	 {ASTRAL is a formal specification language for
                  real-time systems. 59 references.}
}

@InProceedings{Cohen-etal09,
  author =       {Ernie Cohen and Markus Dahlweid and Mark Hillebrand and Dirk Leinenbach and
                  Micha{\l} Moskal and Thomas Santen and Wolfram Schulte and Stephan Tobies},
  title =        {{VCC}: A Practical System for Verifying Concurrent {C}},
  booktitle =    {Theorem Proving in Higher Order Logics, 22nd International Conference, TPHOLs 2009},
  pages =        {23-42},
  editor =       {Stefan Berghofer and Tobias Nipkow and Christian Urban and Makarius Wenzel},
  volume =       {5674},
  series =       LNCS,
  publisher =    SV,
  address =      {Berlin},
  month =        aug,
  year =         {2009},
}

@Book{Cohen90,
  Author =	 "Edward Cohen",
  Title =	 "Programming in the 1990s: An Introduction to the
                  Calculation of Programs",
  Publisher =	 SV,
  Year =	 1990,
  Address =	 NY,
  Annote =	 "32 references."
}

@TechReport{Cok-Kiniry04,
  author =   {David R. Cok and Joseph Kiniry},
  title =    {{ESC/Java2}: Uniting {ESC/Java} and {JML}},
  note =     {{NIII Technical Report NIII-R0413}.},
  institution = {University of Nijmegen},
  url =     {http://www.cs.kun.nl/research/reports},
  year =     {2004},
}


@Unpublished{Cok-Kiniry04b,
 author = { David R. Cok and Joseph Kiniry },
 title = {{ESC/Java2}: Uniting {ESC/Java} and {JML}.  Progress and
          issues in building and using {ESC/Java2} and a report on a case study
          involving the use of {ESC/Java2} to verify portions of an
          Internet voting tally system},
 Month =       may,
 Year  =       2004,
 Note  = {Presented at CASSIS 2004 and submitted for publication}
}

@InProceedings{Cok-Leavens08,
  author = 	 {David Cok and Gary T. Leavens},
  title = 	 {Extensions of the theory of observational purity and a practical design for {JML}},
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {43-50},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  publisher =    {School of EECS, UCF},
  annote = 	 {14 references.},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/Cok-Leavens.pdf}
}

@InProceedings{Cok-Tasiran18,
author="David R. Cok and Serdar Tasiran",
editor="Ruzica Piskac and Philipp R{\"u}mmer",
title="Practical Methods for Reasoning About {Java} 8's Functional Programming Features",
booktitle="Verified Software. Theories, Tools, and Experiments",
year="2018",
publisher="Springer International Publishing",
address="Cham",
pages="267--278",
abstract="We describe new capabilities added to the Java Modeling Language and the OpenJML deductive program verification tool to support functional programming features introduced in Java 8. We also report on the application of the extensions to a secure streaming protocol library developed by Amazon Web Services and used as a foundation by services it provides. We found that the application under study used a small set of functional programming idioms; methods using these idioms could be verified by techniques that used only first-order logic and did not need all the features that might be required for full generality of functional programming.",
isbn="978-3-030-03592-1"
}

@InProceedings{Cok04,
  author = {David R. Cok},
  title = {Reasoning with specifications containing method calls in {JML} and first-order provers},
  editor =       {Erik Poll},
  booktitle="ECOOP Workshop FTfJP'2004 Formal Techniques for Java-like Programs",
  Month = jun,
  Year =  2004,
  Pages="41-48",
  URL = "\url{http://www.cs.ru.nl/~erikpoll/ftfjp/2004/SpecificationsWithMethodCalls.pdf}",
  publisher = {Rabound University},
  address = {Nijmegen}
}

@ARTICLE{Cok05,
  AUTHOR =	 {David R. Cok},
  TITLE =	 {Reasoning with specifications containing method calls and model fields},
  journal =	 JOT,
  VOLUME =       4,
  NUMBER =       8,
  PAGES =        {77-103},
  YEAR =	 2005,
  URL = {http://www.jot.fm/issues/issue_2005_10/article4}
}

@InProceedings{Cok06,
  author =	 {David R. Cok},
  title = 	 {Specifying {Java} Iterators with {JML} and {Esc/Java2}},
  booktitle =	 {Fifth International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2006)},
  pages =	 {71-74},
  year =	 2006,
  month =	 nov,
  organization = ACM,
  URL = 	 {http://www.cs.iastate.edu/~leavens/SAVCBS/2006/challenges/Cok.pdf}
}

@InProceedings{Cok08,
  author = 	 {David Cok},
  title = 	 {Adapting {JML} to generic types and {Java} 1.6},
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {27-34},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  annote = 	 {12 references.},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/Cok.pdf}
}
                  
@article {Cok10,
  author = {David Cok},
  affiliation = {Eastman Kodak Company, Rochester, NY USA},
  title = {Improved usability and performance of {SMT} solvers for debugging specifications},
  journal = {International Journal on Software Tools for Technology Transfer (STTT)},
  publisher = SV,
  address="Berlin",
  issn = {1433-2779},
  keyword = {Computer Science},
  pages = {467-481},
  volume = 12,
  issue = 6,
  url = {http://dx.doi.org/10.1007/s10009-010-0138-x},
  year = 2010
}

@incollection{Cok11,
  author = {Cok, David},
  affiliation = {GrammaTech, Inc., Ithaca, NY 14850, USA},
  title = {{OpenJML}: {JML} for {Java} 7 by Extending {OpenJDK}},
  booktitle = {NASA Formal Methods},
  series = LNCS,
  editor = {Bobaru, Mihaela and Havelund, Klaus and Holzmann, Gerard and Joshi, Rajeev},
  publisher = SV,
  address = {Berlin},
  pages = {472-479},
  volume = 6617,
  url = {https://tinyurl.com/3rympeb8},
  year = 2011
}

% doi = {10.1007/978-3-642-20398-5_35},
@Misc{Cok13,
  author = 	 {David R. Cok},
  title = 	 {The {SMT-LIBv2} Language and Tools: A Tutorial},
  howpublished = {\url{https://smtlib.github.io/jSMTLIB/SMTLIBTutorial.pdf}},
  year = 	 2013,
  annote = 	 {7 references}
}

@InProceedings{Cok18c, 
author = {David R. Cok}, 
title = {Reasoning about Functional Programming in {Java} and {C++}}, 
year = {2018}, 
isbn = {9781450359399}, 
publisher = {Association for Computing Machinery}, 
address = {New York, NY, USA}, 
url = {https://doi.org/10.1145/3236454.3236483}, 
abstract = {Verification projects on industrial code have required reasoning about functional programming constructs in Java 8. General functional programming requires reasoning about how the specifications of function objects that are inputs to a method combine to produce the specifications of output function objects. This short paper describes our in-progress experience in adapting prior work (Kassios & M\"{u}ller) to Java 8, JML, OpenJML, and to ACSL++, a specification language for C++ built on ACSL.}, 
booktitle = {Companion Proceedings for the ISSTA/ECOOP 2018 Workshops}, 
pages = {37–39}, 
numpages = {3}, 
keywords = {JML, ACSL, OpenJML, formal verification, functional programming, specification, ACSL++}, 
location = {Amsterdam, Netherlands}, 
series = {ISSTA '18}
}

% doi = {10.1145/3236454.3236483}, 
@inproceedings{Cok21,
author = {David R. Cok},
title = {{JML} and {OpenJML} for {Java} 16},
year = {2021},
isbn = {9781450385435},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3464971.3468417},
abstract = {As the Java language evolves, the Java Modeling Language (JML) and the OpenJML deductive
verification tool must evolve with it. Changes in Java since Java 8 bring language
and organizational changes which affect the semantics of JML and the implementation
of OpenJML. They also raise questions about language definition, joint efforts, and
community engagement, some enumerated in this paper, for the Java formal reasoning
community to address.},
booktitle = {Proceedings of the 23rd ACM International Workshop on Formal Techniques for Java-like Programs},
pages = {65–67},
numpages = {3},
keywords = {software verification, Java Modeling Language, deductive verification, JML, OpenJML},
location = {Virtual, Denmark},
series = {FTfJP 2021}
}

% doi = {10.1145/3464971.3468417},
@Unpublished{Colagrosso-Achuthan-Alagar93,
  Author =	 "Piero Colagrosso and Ramesh Achuthan and Vangalur
                  S. Alagar",
  Title =	 "Evaluating the Completeness of Class Interface
                  Specifications for Software Reuse",
  Year =	 1993,
  Note =	 "Obtained from authors",
  Annote =	 "29 references."
}

@inproceedings{Colby-etal00,
 author = {Christopher Colby and Peter Lee and George C. Necula and Fred Blau and Mark Plesko and Kenneth Cline},
 title = {A certifying compiler for {Java}},
 booktitle = {PLDI '00: Proceedings of the ACM SIGPLAN 2000 Conference on Programming Language Design and Implementation},
 year = {2000},
 isbn = {1-58113-199-2},
 pages = {95-107},
 location = {Vancouver, British Columbia, Canada},
 URL = {http://doi.acm.org/10.1145/349299.349315},
 publisher = {ACM Press},
 address = {New York, NY, USA}
}

@Article{Coleman-Hughes79,
  author =	 "D. Coleman and J. W. Hughes",
  title =	 "The Clean Termination of {Pascal} Programs",
  journal =	 "Acta Informatica",
  year =	 1979,
  volume =	 11,
  pages =	 "195-210",
  annote =	 "8 references."
}

@InProceedings{Coleman-etal05,
  author = 	 {Joey Coleman and Cliff Jones and Ian Oliver and Alexander Romanovsky and Elena Troubitsyna},
  title = 	 {{RODIN (Rigorous Open Development Environment for Complex Systems)}},
  booktitle =	 {Fifth European Dependable Computing Conference: EDCC-5 supplementary volume},
  pages =	 {23-26},
  year =	 2005,
  month =	 apr,
  URL = {http://rodin.cs.ncl.ac.uk/Publications/RODIN-Desc.pdf}
}

@Book{Coleman-etal94,
  author =	 "D. Coleman and P. Arnold and S. Bodoff and C. Dollin
                  and H. Gilchrist and F. Hayes and P. Jeremaes",
  title =	 "Object-Oriented Development: The Fusion Method",
  publisher =	 "Prentice-Hall",
  address =	 "Englewood Cliffs, NJ",
  year =	 1994
}

@PhdThesis{Coleman91,
  Author =	 "David L. Coleman",
  Title =	 "Formalized structured analysis specifications",
  School =	 "Iowa State University",
  Year =	 1991,
  Address =	 "Ames, Iowa, 50011",
  Annote =	 "Formalization of syntax and some of the semantics of
                  data flow diagrams. 66 references."
}

@Unpublished{CommonCriteria12,
  author = 	 {Common Criteria},
  title = 	 {Common Criteria for Information Technology Security Evaluation},
  note = 	 {Version 3.1, revision 4},
  month = 	 sep,
  year = 	 2012,
  URL =          {https://www.commoncriteriaportal.org/cc/}
}

@InCollection{Comon90,
  Author =	 "Hubert Comon",
  Title =	 "Equational Formulas in Order-Sorted Algebra",
  BookTitle =	 "17th International Colloquium on Automata,
                  Languages, and Programming (ICALP), Warwick,
                  England",
  Publisher =	 SV,
  Year =	 1990,
  Editor =	 "M. S. Paterson",
  Series =	 LNCS,
  Pages =	 "674-688",
  Address =	 NY,
  Month =	 jul,
  Annote =	 "26 references."
}

@Book{Constantine-Yourdan79,
  Author =	 "L. L. Constantine and E. Yourdan",
  Title =	 "Structured Design",
  Publisher =	 "Prentice-Hall",
  Year =	 1979,
  Address =	 "Englewood Cliffs, NJ"
}

@Book{Conway-Gries75,
  Author =	 "Richard Walter Conway and David Gries",
  Title =	 "An Introduction to Programming, a Structured
                  Approach Using PL/1 and PL/C-7",
  Publisher =	 "Winthrop Publishers, Inc.",
  Address =	 "Cambridge, Mass.",
  Year =	 1975
}

@inproceedings{Cook-Kroening-Sharygina05,
   AUTHOR    = {Byron Cook and Daniel Kroening and Natasha Sharygina},
   TITLE     = {Cogent: Accurate theorem proving for program verification},
   BOOKTITLE = {Computer Aided Verification (CAV)},
   YEAR      = 2005,
   PUBLISHER = SV,
   PAGES     = {296-300},
   SERIES    = LNCS,
   VOLUME    = 3576,
   EDITOR    = {Kousha Etessami and Sriram K. Rajamani},
   URL = {http://dx.doi.org/10.1007/11513988_30}
}

@inproceedings{Cook-Podelski-Rybalchenko06,
  author = {Byron Cook and Andreas Podelski and Andrey Rybalchenko},
  title = {Termination proofs for systems code},
  booktitle = {Proceedings of the ACM SIGPLAN 2006 Conference on
                  Programming Language Design and Implementation
                  (PLDI)},
  editor = {Michael I. Schwartzbach and Thomas Ball},
  month = jun,
  year = 2006,
  pages = {415--426},
  publisher = ACM,
  address = NY,
  URL = {http://doi.acm.org/10.1145/1133981.1134029}
}

@InProceedings{Cook18,
author="Byron Cook",
editor="Chockler, Hana
and Weissenbacher, Georg",
title="Formal Reasoning About the Security of {Amazon Web Services}",
booktitle="Computer Aided Verification",
year="2018",
publisher="Springer International Publishing",
address="Cham",
pages="38--47",
abstract="We report on the development and use of formal verification tools within Amazon Web Services (AWS) to increase the security assurance of its cloud infrastructure and to help customers secure themselves. We also discuss some remaining challenges that could inspire future research in the community.",
isbn="978-3-319-96145-3"
}

@Article{Cook78,
  Author =	 "S. A. Cook",
  Title =	 "Soundness and completeness of an axiom system for
                  program verification",
  Journal =	 SIAMJC,
  Year =	 1978,
  Volume =	 7,
  Pages =	 "70-90",
  Annote =	 "Defines relative completeness."
}

@Book{Cooke98,
  author =	 {John Cooke},
  title =	 {Constructing Correct Software: the basics},
  publisher =	 SV,
  year =	 1998,
  series =	 {FACIT},
  address =	 {London, UK}
}

@Article{Cooper-Kennedy-Torczon86,
  Author =	 "Keith D. Cooper and Ken Kennedy and Linda Torczon",
  Title =	 "The Impact of Interprocedural Analysis and
                  Optimization in the ${\bf R}^{n}$ Programming
                  Environment",
  Journal =	 TOPLAS,
  Volume =	 8,
  Number =	 4,
  Month =	 oct,
  Year =	 1986,
  Pages =	 "491-523",
  Annote =	 "47 references."
}

@TechReport{Cooprider79,
  Author =	 "Lee W. Cooprider",
  Title =	 "The Representation of Families of Software Systems",
  Institution =	 CMU,
  Number =	 "CMU-CS-79-116",
  Month =	 apr,
  Year =	 1979,
  Annote =	 "Software construction database for different
                  versions of systems. 85 references."
}

@Book{Coplien-Harrison05,
  author =	 {James O. Coplien and Neil B. Harrison},
  title = 	 {Organizational Patterns of Agile Software Development},
  publisher = 	 {Pearson Prentice Hall},
  year = 	 2005,
  annote =	 {Many references.}
}

@Article{Coplien-Hoffman-Weiss98,
  author =	 {James Coplien and Daniel Hoffman and David Weiss},
  title =	 {Commonality and Variability in Software Engineering},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 6,
  month =	 nov,
  pages =	 {37-45},
  annote =	 {16 references.}
}

@Book{Coplien-Schmidt95,
  author =	 {James O. Coplien and Douglas C. Schmidt},
  title =	 {Pattern Languages of Program Design},
  publisher =	 {Addison-Wesley},
  year =	 1995,
  address =	 {Reading, Mass.}
}

@InProceedings{Corbett-etal00,
  author =       {James C. Corbett and Matthew B. Dwyer and John Hatcliff and Shawn Laubach and Corina S. Pasareanu and Robby and Hongjun Zheng},
  title =        "Bandera: Extracting Finite-State Models from {Java} Source Code",
  booktitle =    {Proceedings of the 22nd International Conference on
                 Software Engineering},
  month =        jun,
  publisher =    "ACM Press",
  address =      NY,
  year =         2000,
  pages =        {439-448},
  annote =       {23 references.}
}

@InProceedings{Corella93,
  author =	 "F. Corella",
  title =	 "Automated high-level verification against clocked
                  algorithmic specification",
  booktitle =	 "Computer Hardware Description Languages and their
                  Applications",
  year =	 "1993",
  editor =	 "{D. Agnew} and {L. Claesen} and {R. Camposano}",
  pages =	 "135-142",
  organization = "IFIP WG10.2, CHDL'93, IEEE COMPSOC",
  publisher =	 "Elsevier Science Publishers B.V., Amsterdam,
                  Netherland",
  address =	 "Ottawa, Canada",
  month =	 apr
}

@InCollection{Corradini98,
  author =       "A. Corradini",
  title =        "A completeness result for equational deduction in
                 coalgebraic specification",
  booktitle =    "Recent Trends in Algebraic Development Techniques",
  series =       LNCS,
  publisher =    SV,
  volume =       1376,
  pages =        "190ff.",
  year =         1998
}

@InProceedings{Costa-etal08,
  author = 	 {Umberto Costa and Anamaria Moreira and Martin Musicante and Placido Souza Neto},
  title = 	 {Specification and Runtime Verification of Java Card Programs},
  booktitle =	 {Brazilian Symposium on Formal Methods (SBMF)},
  month =        oct,
  year =	 2008,
  URL = 	 {http://www.cefetrn.br/~placido/JCML_SBMF08.pdf}
}

@InProceedings{Courbot-etal06,
  author = 	 {Alexandre Courbot and Mariela Pavlova and Gilles Grimaud and Jean-Jacques Vandewalle},
  title = 	 {A Low-Footprint Java-to-Native Compilation Scheme Using Formal Methods},
  booktitle =	 {CARDIS 2006},
  pages =	 {329-344},
  year =	 2006,
  URL = 	 {http://www-sop.inria.fr/everest/M.P./cardis05.pdf}
}
                 

@InProceedings{Cousot-Ganty-Raskin07,
  title =	"Fixpoint-Guided Abstraction Refinements",
  author =	"Patrick Cousot and Pierre Ganty and Jean-Fran{\c c}ois Raskin",
  bibdate =	"2007-08-23",
  booktitle =	"Static Analysis, 14th International Symposium, {SAS}
		 2007, Kongens Lyngby, Denmark, August 22-24, 2007,
		 Proceedings",
  publisher =	SV,
  year = 	2007,
  volume =	4634,
  editor =	"Hanne Riis Nielson and Gilberto Fil{\'e}",
  pages =	"333-348",
  series =	LNCS,
  URL =  	"http://dx.doi.org/10.1007/978-3-540-74061-2_21",
}
                  
@InCollection{Cousot90,
  Author =	 "Patrick Cousot",
  Booktitle =	 "Handbook of Theoretical Computer Science",
  Title =	 "Methods and Logics for Proving Programs",
  Chapter =	 15,
  Publisher =	 MITP,
  Year =	 1990,
  Editor =	 "J. van Leewen",
  Pages =	 "841-993",
  Volume =	 "B: Formal Models and Semantics",
  Address =	 NY,
  Annote =	 "410 references."
}

@inproceedings{10.1145/53990.54003,
author = {Coutant, D. S. and Meloy, S. and Ruscetta, M.},
title = {DOC: A Practical Approach to Source-Level Debugging of Globally Optimized Code},
year = {1988},
isbn = {0897912691},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/53990.54003},
doi = {10.1145/53990.54003},
abstract = {As optimizing compilers become more sophisticated, the problem of debugging the source code of an application becomes more difficult. In order to investigate this problem, we implemented DOC, a prototype solution for Debugging Optimized Code. DOC is a modification of the existing C compiler and source-level symbolic debugger for the HP9000 Series 800. This paper describes our experiences in this effort. We show in an actual implementation that source-level debugging of globally optimized code is viable.},
booktitle = {Proceedings of the ACM SIGPLAN 1988 Conference on Programming Language Design and Implementation},
pages = {125–134},
numpages = {10},
location = {Atlanta, Georgia, USA},
series = {PLDI '88}
}

@article{Coutant-Meloy-Ruscetta88,
author = {D. S. Coutant and S. Meloy and M. Ruscetta},
title = {{DOC}: A Practical Approach to Source-Level Debugging of Globally Optimized Code},
year = 1988,
issue_date = {July 1988},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
volume = 23,
number = 7,
issn = {0362-1340},
url = {https://doi.org/10.1145/960116.54003},
doi = {10.1145/960116.54003},
abstract = {As optimizing compilers become more sophisticated, the problem of debugging the source code of an application becomes more difficult. In order to investigate this problem, we implemented DOC, a prototype solution for Debugging Optimized Code. DOC is a modification of the existing C compiler and source-level symbolic debugger for the HP9000 Series 800. This paper describes our experiences in this effort. We show in an actual implementation that source-level debugging of globally optimized code is viable.},
journal = {SIGPLAN Not.},
month = {jun},
pages = {125–134},
numpages = 10
}
                  
@InCollection{Coutaz87,
  Author =	 {Jo\"{e}lle Coutaz},
  Title =	 "The Construction of User Interfaces and the Object
                  Paradigm",
  BookTitle =	 "ECOOP '87, European Conference on Object-Oriented
                  Programming, Paris, France",
  Editor =	 "Jean Bezivin and others",
  Publisher =	 SV,
  Address =	 NY,
  Month =	 jun,
  Year =	 1987,
  Pages =	 "121-130",
  Note =	 "Lecture Notes in Computer Science, Volume 276",
  Annote =	 "23 references."
}

@Article{Criagen-Gerhart-Ralston95,
  author =	 {Dan Criagen and Susan Gerhart and Ted Ralston},
  title =	 {Formal Methods Reality Check: Industrial Usage},
  journal =	 IEEETSE,
  year =	 1995,
  volume =	 21,
  number =	 2,
  pages =	 "90-98",
  month =	 feb,
  annote =	 "Summary of usage and recommendations for enhancement
                  of formal methods, based on a survey and
                  analysis. Notational issues are important. Points in
                  favor of Z, including close interaction with
                  industry and a substantial pedagogical
                  literature. Industry is willing to augment and
                  extend its practices, but not to abandon current
                  practice. They identified 14 features and a rating
                  system for formal methods payoff: A. Product
                  Features: 1. Client Satisfaction 2. Cost of Product
                  3. Impact of Product 4. Quality 5. Time to Market
                  B. Process Features 6. Cost of Process 7. Impact of
                  Process 8. Pedagogical 9. Tools C. Process Features
                  (specific process effects) 10. Design 11. Reusable
                  components 12. Maintainability 13. Requirements
                  Capture 14. V&V 5 references."
}

@article{Cristian84,
  author = "Flaviu Cristian",
  title = "Correct and Robust Programs",
  journal = IEEETSE,
  volume = 10,
  year = 1984,
  pages = "163-174"
}

@Article{Crnkovic-etal02,
  author =       "Ivica Crnkovic and Brahim Hnich and Torsten Jonsson
                 and Zeynep Kiziltan",
  title =        "Specification, Implementation, and Deployment of
                 Components",
  journal =      CACM,
  volume =       45,
  number =       10,
  pages =        "35-40",
  month =        oct,
  year =         2002,
  annote =       "Notes need for nonfunctional properties.  12 references."
}

@Article{Crowley-etal96,
  Author =	 {J. L. Crowley and J. F. Leathrum and K. A. Liburdy},
  Title =	 {Issues in the Full Scale Use of Formal Methods for
                  Automated Testing},
  Journal =	 SIGSOFT,
  Volume =	 21,
  Number =	 3,
  Year =	 1996,
  Month =	 may,
  Pages =	 {71-78}
}

@InProceedings{Croxford-Sutton95,
  title =	"Breaking Through the {V} and {V} Bottleneck",
  author =	"Martin Croxford and James Sutton",
  publisher =	SV,
  year = 	1995,
  volume =	1031,
  booktitle =	"Ada-Europe",
  editor =	"Marcel Toussaint",
  ISBN = 	"3-540-60757-9",
  pages =	"344-354",
  series =	LNCS
}

@inproceedings{Csallner-Smaragdakis06,
   author = {Christoph Csallner and Yannis Smaragdakis},
   title = {{DSD-Crasher}: A hybrid analysis tool for bug finding},
   booktitle = {Proc. International Symposium on Software Testing and Analysis},
   pages = {245-254},
   month = jul,
   year = 2006,
   URL = {http://www-static.cc.gatech.edu/~csallnch/papers/csallner06dsd-crasher.pdf}
}

@inproceedings{Csallner-Smaragdakis06a,
   author = {Christoph Csallner and Yannis Smaragdakis},
   title = {Dynamically discovering likely interface invariants},
   booktitle = {Proc. 28th International Conference on Software
	Engineering, Emerging Results Track},
   pages = {861-864},
   month = may,
   year = 2006
}

@Article{Cunha-Lucena-Maibaum80,
  Author =	 "Paulo R. F. Cunha and Carlos J. Lucena and
                  T. S. E. Maibaum",
  Title =	 "On the Design and Specification of Message Oriented
                  Programs",
  Journal =	 "International Journal of Computer and Information
                  Sciences",
  Volume =	 9,
  Number =	 3,
  Year =	 1980,
  Annote =	 "40 references."
}

@Article{Cunningham-Beck86,
  Author =	 "Ward Cunningham and Kent Beck",
  Title =	 "A Diagram for Object-Oriented Programs",
  Journal =	 SIGPLAN,
  Volume =	 21,
  Number =	 11,
  Month =	 nov,
  Year =	 1986,
  Pages =	 "361-367",
  Note =	 "OOPSLA '86 Conference Proceedings, Norman Meyrowitz
                  (editor), September 1986, Portland, Oregon.",
  Annote =	 "Diagramatic notation for object-oriented algorithms
                  in Smalltalk-80. 5 references."
}

@Article{Cunningham-Gilford76,
  Author =	 "R. J. Cunningham and M. E. J. Gilford",
  Title =	 "A note on the semantic definition of side effects",
  Journal =	 "Information Processing Letters",
  Year =	 1976,
  Volume =	 4,
  Number =	 5,
  Pages =	 "118-120"
}

@Article{Curcio98,
  author =	 {Igor D. D. Curcio},
  title =	 {{ASAP} --- A Simple Assertion Preprocessor},
  journal =	 SIGPLAN,
  year =	 1998,
  volume =	 33,
  number =	 12,
  month =	 dec,
  pages =	 {44-51},
  annote =	 {13 references.}
}

@InCollection{Cusack-Lai91,
  Author =	 "Elspeth Cusack and Michael Lai",
  Title =	 "Object-Oriented Specification in LOTOS and Z, or My
                  Cat Really is Object-Oriented!",
  BookTitle =	 "Foundations of Object-Oriented Languages, REX
                  School/Workshop, Noordwijkerhout, The Netherlands,
                  May/June 1990",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "J. W. de Bakker and W. P. de Roever and
                  G. Rozenberg",
  Series =	 LNCS,
  Volume =	 489,
  Pages =	 "179-202",
  Address =	 NY,
  Annote =	 "Object-oriented interpretation of LOTOS. 23
                  references."
}

@InCollection{Cusack-Rafsanjani92,
  Author =	 "Elspeth Cusack and G. H. B. Rafsanjani",
  Title =	 "{ZEST}",
  Editor =	 "Susan Stepney and Rosalind Barden and David Cooper",
  BookTitle =	 "Object Orientation in {Z}",
  Publisher =	 SV,
  Year =	 1992,
  Address =	 "Cambridge CB2 1LQ, UK",
  Series =	 "Workshops in Computing",
  Crossref =	 "Stepney-Barden-Cooper92",
  Pages =	 "113-126"
}

@InProceedings{Cusack-Wezeman93,
  Author =	 {E. Cusack and C. Wezeman},
  Title =	 {Deriving Tests for Objects Specified in {Z}},
  Crossref =	 "Bowen-Nicholls93",
  Pages =	 "180-195"
}

@Unpublished{Cusack90,
  Author =	 "Elspeth Cusack",
  Title =	 "Inheritance in Object Oriented {Z}",
  Note =	 "Obtained from the Author. This has been submitted to
                  ECOOP '91",
  Annote =	 "Distinguishes subtype inheritance from incremental
                  inheritance. Both are at level of
                  specification. Formal model of subtype is
                  subsumption, but allows coercions. Substutability
                  condition based on semantics of operations as
                  relations in Z. 22 refrences.",
  Month =	 nov,
  Year =	 "1990"
}

@Article{Cusack91a,
  Author =	 "Elspeth Cusack",
  Title =	 "Refinement, Conformance, and Inheritance",
  Journal =	 "Formal Aspects of Computing",
  Month =	 jan,
  Year =	 1991,
  Volume =	 3,
  Pages =	 "129-141",
  Annote =	 "20 references."
}

@Unpublished{Cusack91b,
  Author =	 "Elspeth Cusack",
  Title =	 "Object Oriented Modelling in {Z}",
  Note =	 "Obtained from the Author.",
  Annote =	 "Argues that inheritance is a means for effectively
                  and economically structuring descriptions at the
                  level of specifications. 15 references.",
  Month =	 feb,
  Year =	 "1991"
}

@InProceedings{Cusack91c,
  Author =	 "Elspeth Cusack",
  Title =	 "Object Oriented Modelling in {Z} For Open
                  Distributed Systems",
  BookTitle =	 "International Workshop on Open Distributed
                  Processing",
  Year =	 1991,
  Month =	 oct,
  Note =	 "Obtained from the author",
  Annote =	 "20 references."
}

@InProceedings{Cusack91d,
  author =	 "E. Cusack",
  editor =	 "Pierre America",
  title =	 "Inheritance in Object Oriented {Z}",
  booktitle =	 "Proceedings of the European Conference on
                  Object-Oriented Programming (ECOOP), Geneva
                  Switzerland",
  series =	 "Lecture Notes in Computer Science",
  Volume =	 512,
  pages =	 "167-179",
  publisher =	 SV,
  address =	 NY,
  year =	 1991
}

@Book{Cusumano-Selby95,
  author =	 "Michael A. Cusumano and Richard W. Selby",
  title =	 "Microsoft Secrets",
  publisher =	 "The Free Press",
  year =	 1995,
  address =	 NY
}

@manual{DO178B,
  organization = {Radio Technical Commission for Aeronautics (RTCA)},
  title = {DO-178B: Software Considerations in Airborne Systems and Equipment
	Certification},
  year = 1982,
}

@Book{DSouza-Wills99,
  author =	 {Desmond F. D'Souza and Alan Cameron Wills},
  title =	 {Objects, Components, and Frameworks with UML: The
                  Catalysis Approach},
  publisher =	 {Addison Wesley},
  year =	 1999,
  series =	 {Object Technology Series},
  address =	 {Reading Mass.},
  annote =	 {93 references.}
}

@InProceedings{DaSilva-Dehboei-Mejia92,
  Author =	 "Clara DaSilva and Babak Dehboei and Fernando Mejia",
  Title =	 "Formal Specification in the Development of
                  Industrial Applications: Subway Speed Control
                  System",
  BookTitle =	 "IFIP Formal Description Techniques",
  Year =	 1992,
  Editor =	 "M Diaz and R Groz",
  Publisher =	 "Esevier",
  Address =	 "Amsterdam",
  Annote =	 "The B method"
}

@Book{Dahl-Dijkstra-Hoare72,
  Author =	 "Ole-J. Dahl and E. Dijkstra and C. A. R. Hoare",
  Title =	 "Structured Programming",
  Publisher =	 "Academic Press, Inc.",
  Address =	 NY,
  Year =	 1972,
  Annote =	 "See Knuth's comments in STAN-CS-73-371"
}

@Unpublished{Dahl86,
  Author =	 "Ole-Johan Dahl",
  Title =	 "Object Oriented Specification",
  Year =	 "1986",
  Month =	 jun,
  Note =	 "Presented at the Object-Oriented Programming
                  Workshop, June, 1986",
  Annote =	 "Programming and specification language ABEL. 7
                  references."
}

@InCollection{Dahl87,
  Author =	 "Ole-Johan Dahl",
  Title =	 "Object Oriented Specification",
  Editor =	 "Bruce Shriver and Peter Wegner",
  BookTitle =	 "Research Directions in Object-Oriented Programming",
  Publisher =	 MITP,
  Address =	 "Cambridge, Mass.",
  Year =	 1987,
  Pages =	 "561-576",
  Annote =	 "Programming and specification language ABEL. 7
                  references."
}

@Book{Dahl92,
  Author =	 "Ole-Johan Dahl",
  Title =	 "Verifiable Programming",
  Publisher =	 "Prentice-Hall",
  Year =	 1992,
  Series =	 "International Series in Computer Science",
  Address =	 NY,
  Annote =	 "29 references."
}

@Article{Damiani-Fugini-Bellettini99,
  author =	 {E. Damiani and M. G. Fugini and C. Bellettini},
  title =	 {A Hierarchy-Aware Approach to Faceted Classification
                  of Object-Oriented Components},
  journal =	 TOSEM,
  year =	 1999,
  volume =	 8,
  number =	 3,
  month =	 jul,
  pages =	 {215-262},
  annote =	 {69 references.}
}

@article{Damm-Josko83,
  author    = {Werner Damm and Bernhard Josko},
  title     = {A Sound and Relatively Complete {Hoare}-Logic for a Language with Higher Type Procedures.},
  journal   = {Acta Informatica},
  volume    = 20,
  number    = 1,
  month     = oct,
  year      = 1983,
  URL       = {http://dx.doi.org/10.1007/BF00264295},
  pages     = {59-101}
}

@Article{Damon-Jackson-Jha96,
  author =	 {Craig A. Damon and Daniel Jackson and Somesh Jha},
  title =	 {Checking Relational Specifications With Binary
                  Decision Diagrams},
  journal =	 SIGSOFT,
  year =	 1996,
  editor =	 {David Garlan},
  volume =	 21,
  number =	 6,
  month =	 nov,
  pages =	 {70-80},
  note =	 {SIGSOFT '96: Proceedings of the Fourth ACM SIGSOFT
                  Symposium on the Foundations of Software
                  Engineering, San Francisco, California},
  annote =	 {23 references.}
}

@TechReport{Dandanell-George91,
  Author =	 "Bent Dandanell and Chris George",
  Title =	 "The {LaCoS} Project",
  Institution =	 "Computer Resources Interational A/S",
  Year =	 1991,
  Number =	 "LACOS/CRI/BDH/8/V2",
  Address =	 "Denmark",
  Month =	 aug,
  Annote =	 "13 references."
}

@Article{Dandanell91,
  Author =	 "Bent Dandanell",
  Title =	 "Rigorous Development Using {RAISE}",
  Journal =	 "Software Engineering Notes",
  Year =	 1991,
  Volume =	 16,
  Number =	 5,
  Month =	 dec,
  Pages =	 "29-43",
  Note =	 "ACM SIGSOFT '91 Conference on Software for Critical
                  Systems, New Orleans Louisiana, Dec. 4-6",
  Annote =	 "11 references."
}

@inproceedings{Dantas-Walker05a,
	Author = {Daniel S. Dantas and David Walker},
	Title = {Harmless Advice},
	Booktitle = {The 12th international workshop on Foundations of object-oriented languages},
	Organization = {ACM},
        Year = 2005,
	Annote = {The paper describes a core calculus for ``harmless advice''.  Harmless advice may affect the control flow of a program and may perform I/O, but it may not change the data of the base program (excepting through I/O).  The paper uses the basic technique of \citet{Walker-Zdancewic-Ligatti03}, but does not allow data exchange.  More specifically, the system allows data to flow from high protection domains to lower protection domains, but not vice versa.  The protection domains are part of the type system and form a lattice order.  The paper gives a proof of a weak non-interference property.

Following \citet{Walker-Zdancewic-Ligatti03}, they give a simple object-oriented language that can be translated to the core language in a type-preserving way.}
}

@InProceedings{Dantas-Walker06,
	Author = {Daniel S. Dantas and David Walker},
	Title = {Harmless Advice},
  booktitle =	 {Proceedings of the 33th {ACM} {SIGPLAN}-{SIGACT}
                  symposium on Principles of programming languages
                  ({POPL}-06)",},
  month =        jan,
  pages =	 {383-396},
  year =	 2006,
  volume =	 "41, 1",
  series =	 SIGPLAN,
  organization = {ACM}
}

@InProceedings{Darlington-Burstall73,
  Author =	 "J. Darlington and R. M. Burstall",
  Title =	 "A System which Automatically Improves Programs",
  BookTitle =	 "Proceedings of the Third International Joint
                  Conference on Artificial Intelligence",
  Organization = "IJCAI",
  Year =	 1973,
  Pages =	 "479-485"
}

@Article{Dart-etal87,
  Author =	 "Susan A. Dart and Robert J. Ellison and Peter
                  H. Feiler and A. Nico Habermann",
  Title =	 "Software Development Environments",
  Journal =	 "Computer",
  Volume =	 20,
  Number =	 11,
  Month =	 nov,
  Year =	 1987,
  Pages =	 "18-28",
  Annote =	 "Survey and taxonomy. 53 references."
}

@Article{Dart-etal97,
  author =	 {Philip Dart and Lorraine Johnston and Cameron
                  Schmidt and Liz Sonenberg},
  title =	 {Developing an Accredited Software Engineering
                  Program},
  journal =	 {IEEE Software},
  year =	 1997,
  volume =	 14,
  number =	 6,
  month =	 nov,
  pages =	 {66-70},
  annote =	 {10 references.}
}

@inproceedings{Darvas-Leino07,
  author    = {{\'A}d{\'a}m Darvas and K. Rustan M. Leino},
  title     = {Practical reasoning about invocations and implementations
               of pure methods},
  booktitle = {Fundamental Approaches to Software Engineering, 10th
                  International Conference, FASE 2007},
  editor = {Matthew B. Dwyer, Ant\'{o}nia Lopes},
  series = LNCS,
  volume = 4422,
  publisher = SV,
  address = "Berlin",
  month = mar # "--" # apr,
  year = 2007,
  pages = {336-351}
}

@inproceedings{Darvas-Mueller05,
 author = {{\'A}d{\'a}m Darvas and Peter M{\"u}ller},
 title = {Reasoning About Method Calls in {JML} Specifications},
 booktitle = {Formal Techniques for {Java-like} Programs},
 year = {2005},
 publisher = "ETH",
 address = "Zurich, Switzerland",
 URL = {http://tinyurl.com/ocp7y}
}

@Article{Darvas-Mueller06,
 author = {{\'A}d{\'a}m Darvas and Peter M{\"u}ller},
 title = {Reasoning About Method Calls in Interface Specifications},
 journal = JOT,
 year = {2006},
 volume = 5,
 number = 5,
 pages = {59-85},
 month = jun,
 URL = {http://www.jot.fm/issues/issue_2006_06/article3.pdf}
}

@InProceedings{Darvas-Mueller07,
  author = {{\'A}d{\'a}m Darvas and Peter M{\"u}ller},
  title = 	 {Faithful mapping of model classes to mathematical structures},
  booktitle =	 {Sixth International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2007)},
  pages =	 {31-38},
  year =	 2007,
  month =	 sep,
  organization = ACM,
  URL = 	 {http://www.cs.iastate.edu/~leavens/SAVCBS/2007/papers/Chalin-James-Karabotsos.pdf}
}

@phdthesis{Darvas09,
   author = {{\'A}d{\'a}m Peter Darvas},
   title = {Reasoning About Data Abstraction in Contract Languages},
   school = {ETH Zurich, Switzerland},
   year = 2009
}

@Book{Davis90,
  Author =	 "A. M. Davis",
  Title =	 "Software Requirements: Analysis and Specification",
  Publisher =	 "Prentice-Hall",
  Year =	 1990,
  Address =	 "Englewood Cliffs, NJ"
}

@inproceedings{Davis-Weyuker81,
  title={Pseudo-oracles for non-testable programs},
  author={Martin D. Davis and Elaine J. Weyuker},
  booktitle={Proceedings of the ACM'81 Conference},
  pages={254--257},
  year={1981}
}
                  
@Article{Dawson-Newsham97,
  author =	 {Ray Dawson and Ron Newsham},
  title =	 {Introducing Software Engineers to the Real World},
  journal =	 {IEEE Software},
  year =	 1997,
  volume =	 14,
  number =	 6,
  month =	 nov,
  pages =	 {37-43},
  annote =	 {Dirty tricks to play on students. 12 references.}
}

@InProceedings{Dawson00,
  author =       {Ray Dawson},
  title =        "Twenty Dirty Tricks to Train Software Engineers",
  booktitle =    {Proceedings of the 22nd International Conference on
                 Software Engineering},
  month =        jun,
  publisher =    "ACM Press",
  address =      NY,
  year =         2000,
  pages =        {209-218},
  annote =       {13 references.}
}

@InCollection{DeBakker-Klop-Meyer82,
  author =	 {J. W. De Bakker and J. W. Klop and J.-J. Ch. Meyer},
  title =	 {Correctness of Programs with Function Procedures},
  booktitle =	 {Logics of Programs},
  publisher =	 SV,
  year =	 1982,
  editor =	 {D. Kozen},
  number =	 131,
  series =	 LNCS,
  address =	 NY,
  pages =	 {94-112},
  annote =	 {Discusses transforming a program with side-effects
                  in expressions to one in which only simple side
                  effect statements are used (no nested expressions).}
}

@InCollection{DeLeon-Grumber93,
  Author =	 "Hana deLeon and Orna Grumberg",
  Title =	 "Modular Abstractions for Verifying Real-Time
                  Distributed Systems",
  Journal =	 LNCS,
  Number =	 663,
  Publisher =	 SV,
  Address =	 NY,
  Editor =	 "G. V. Bochmann and D. K. Probst",
  Year =	 1993,
  Booktitle =	 "Computer Aided Verification. 4th Annual workshop,
                  CAV '92",
  Pages =	 "2-15",
  Annote =	 "15 references"
}

@InProceedings{DeLine-Fahndrich04,
author="Robert DeLine and Manuel F{\"a}hndrich",
editor="Martin Odersky",
title="Typestates for Objects",
booktitle="ECOOP 2004 -- Object-Oriented Programming",
year="2004",
publisher=SV,
address="Berlin, Heidelberg",
pages="465-490",
abstract="Today's mainstream object-oriented compilers and tools do not support declaring and statically checking simple pre- and postconditions on methods and invariants on object representations. The main technical problem preventing static verification is reasoning about the sharing relationships among objects as well as where object invariants should hold. We have developed a programming model of typestates for objects with a sound modular checking algorithm. The programming model handles typical aspects of object-oriented programs such as down-casting, virtual dispatch, direct calls, and subclassing. The model also permits subclasses to extend the interpretation of typestates and to introduce additional typestates. We handle aliasing by adapting our previous work on practical linear types developed in the context of the Vault system. We have implemented these ideas in a tool called Fugue for specifying and checking typestates on Microsoft .NET-based programs.",
isbn="978-3-540-24851-4"
}

@TechReport{DeLine-Leino05,
  author = 	 {Rob DeLine and K. Rustan M. Leino},
  title = 	 {{BoogiePL}: A typed procedural language for checking object-oriented programs},
  institution =  {Microsoft Research},
  year = 	 2005,
  number =	 {MSR-TR-2005-70},
  URL = {ftp://ftp.research.microsoft.com/pub/tr/TR-2005-70.pdf}
}

@Book{DeMarco78,
  Author =	 "Tom DeMarco",
  Title =	 "Structured Analysis and System Specification",
  Publisher =	 "Yourdon , Inc.",
  Year =	 1978,
  Address =	 "Englewood Cliffs, New Jersey"
}

@Article{DeRemer-Kron76,
  Author =	 "F. DeRemer and H. H. Kron",
  Title =	 "Programming in the Large versus Programming in the
                  Small",
  Journal =	 IEEETSE,
  Year =	 1976,
  Month =	 jun,
  Volume =	 "SE-2",
  Number =	 2,
  Pages =	 "80-86"
}

@InProceedings{Delcambre-Lim-Urban91,
  Author =	 "L. Delcambre and B. Lim and S. Urban",
  Title =	 "Object-Centered Constraints",
  BookTitle =	 "IEEE International Data Engineering Conference",
  Year =	 1991
}

@Article{Delisle-Garlan90,
  Author =	 "Norman Delisle and David Garlan",
  Title =	 "A Formal Specification of an Oscilloscope",
  Journal =	 "IEEE Software",
  Volume =	 7,
  Number =	 5,
  Month =	 sep,
  Year =	 1990,
  Pages =	 "29-36",
  Annote =	 "Specification framework for exploring design space,
                  written in Z. 6 references."
}

@InProceedings{Dellacherie-Devulder-Lambert99,
  author =       "S. Dellacherie and S. Devulder and J.-L. Lambert",
  title =        "Software Verification Based on Linear Programming",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  BookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1709,
  pages =        "1147-1165",
  annote =       "18 references.",
}

@Article{Demeyer-etal99,
  author =	 {Demeyer and Matthias Rieger and Theo Dirk Meijler
                  and Edzard Gelsema},
  title =	 {Class Composition for Specifying Framework Design},
  journal =	 TAPOS,
  year =	 1999,
  volume =	 5,
  number =	 2,
  pages =	 {73-81},
  annote =	 {22 references.}
}

@Article{Demillo-Lipton-Perlis79,
  Author =	 "Richard A. De Millo and Richard J. Lipton and Alan
                  J. Perlis",
  Title =	 "Social Processes and Proofs of Theorems and
                  Programs",
  Journal =	 CACM,
  Volume =	 22,
  Number =	 5,
  Month =	 may,
  Year =	 1979,
  Pages =	 "271-280",
  Annote =	 "Formal verification of programs will never play the
                  role that proofs do in mathematics. Formal
                  verification is difficult to justify and
                  manage. Ease of formal verification should not
                  dominate programming language design. 20
                  references."
}

@Article{Demillo-Lipton91,
  Author =	 "R. A. DeMillo and R. J. Lipton",
  Title =	 "Defining Software by Continuous, Smooth Functions",
  Journal =	 IEEESE,
  Year =	 1991,
  Volume =	 17,
  Number =	 4,
  Month =	 apr,
  Pages =	 "383-384",
  Annote =	 "5 references."
}

@article{Derrick-Schellhorn-Wehrheim11,
 author = {John Derrick and Gerhard Schellhorn and Heike Wehrheim},
 title = {Mechanically Verified Proof Obligations for Linearizability},
 journal = {ACM Trans. Program. Lang. Syst.},
 issue_date = {January 2011},
 volume = {33},
 number = {1},
 month = jan,
 year = {2011},
 issn = {0164-0925},
 pages = {4:1--4:43},
 articleno = {4},
 numpages = {43},
 doi = {10.1145/1889997.1890001},
 acmid = {1890001},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {KIV, Z, concurrent access, linearizability, nonatomic refinement, refinement, theorem proving},
}


@article{Dershowitz-Manna81,
  Author = {Nachum Dershowitz and Zohar Manna},
  Title = {Inference Rules for Program Annotation.},
  Journal = IEEETSE,
  Number = 2,
  Pages = {207-223},
  Volume = 7,
  DOI = {https://dx.doi.org/10.1109/TSE.1981.234518},
  Year = 1981
} 

@Article{Desharnais-etal98,
  author =	 {Jules Desharnais and Marc Frappier and Ridha
                  Khe\'{e}dri and Ali Mili},
  title =	 {Integration of Sequential Scenarios},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 9,
  month =	 sep,
  pages =	 {695-708},
  annote =	 {Descriptions of interactions between single users
                  and systems. 44 references.}
}

@Inproceedings{Desmet-Piessens-Joosen-Verbaeten06,
	author 		= {Lieven Desmet and Frank Piessens and Wouter Joosen and Pierre Verbaeten},
	title 		= {Bridging the gap between web application firewalls and web applications},
	booktitle = {FMSE '06: Proceedings of the fourth ACM workshop on Formal methods in security},
	year 			= {2006},
	location 	= {Las Vegas, Nevada, USA},
	isbn 			= {1-59593-550-9},
	pages 		= {67--77},
	location 	= {Alexandria, Virginia, USA},
	doi 			= {http://doi.acm.org/10.1145/1180337.1180344},
	publisher = {ACM},
	address 	= {New York, NY, USA}
}

@TechReport{Detlefs-Leino-Nelson98,
  author =	 {David L. Detlefs and K. Rustan M. Leino and Greg
                  Nelson},
  title =	 {Wrestling with rep exposure},
  institution =	 {Compaq Systems Research Center},
  year =	 1998,
  type =	 {SRC Research Report},
  number =	 156,
  address =	 {130 Lytton Ave., Palo Alto},
  month =	 {July},
  annote =	 {16 references.}
}

@TechReport{Detlefs-Nelson-Saxe03,
  author = "David Detlefs and Greg Nelson and James B. Saxe",
  title = "Simplify: A Theorem Prover for Program Checking",
  institution = "HP Labs",
  number = "HPL-2003-148",
  month = jul,
  year = 2003
}

@article{Detlefs-Nelson-Saxe05,
 author = {David Detlefs and Greg Nelson and James B. Saxe},
 title = {Simplify: a theorem prover for program checking},
 journal = JACM,
 volume = 52,
 number = 3,
 year = 2005,
 pages = {365--473},
 URL = {http://doi.acm.org/10.1145/1066100.1066102},
 publisher = {ACM Press},
 address = {New York, NY, USA},
}

@TechReport{Detlefs-etal98,
  author =	 {David L. Detlefs and K. Rustan M. Leino and Greg
                  Nelson and James B. Saxe},
  title =	 {Extended Static Checking},
  institution =	 {Compaq Systems Research Center},
  year =	 1998,
  type =	 {SRC Research Report},
  number =	 159,
  address =	 {130 Lytton Ave., Palo Alto},
  month =	 dec,
  annote =	 {48 references.}
}

@TechReport{Deutsch-Taft80,
  Author =	 "L. Peter Deutsch and Edward A. Taft",
  Title =	 "Requirements for an Experimental Programming
                  Environment",
  Institution =	 "Xerox Palo Alto Research Centers",
  Year =	 1980,
  Month =	 jun,
  Number =	 "CSL-80-10",
  Annote =	 "List of features desired in a programming
                  language/system including strong type checking and
                  garbage collection. Rank ordering of priorities. 20
                  references."
}

@InProceedings{Devanbu-Fong-Stubblebine98,
  author =	 {Premkumar T. Devanbu and Philip W. L. Fong and
                  Stuart G. Stubblebine},
  title =	 {Techniques for Trusted Software Engineering},
  booktitle =	 {Proceedings of the 1998 International Conference on
                  Software Engineering: ICSE 98, Kyoto, Japan},
  year =	 1998,
  organization = IEEE,
  address =	 {Los Alamitos, California},
  month =	 apr,
  pages =	 {126-135},
  annote =	 {23 references.}
}

@Book{Deville90,
  Author =	 "Yves Deville",
  Title =	 "Logic Programming: Systematic Program Development",
  Publisher =	 "Addison-Wesley",
  Year =	 1990,
  Series =	 "International Logic Programming Series",
  Address =	 "Reading, Mass."
}

@TechReport{Dhara-Leavens01,
  Author =	 "Krishna Kishore Dhara and Gary T. Leavens ",
  Title =	 "Preventing Cross-Type Aliasing for More Practical
                  Reasoning",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "01-02a",
  Year =	 2001,
  Month =	 nov,
  Note =	 "Available from archives.cs.iastate.edu",
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR01-02/TR.pdf",
  Annote =	 "54 references."
}

@TechReport{Dhara-Leavens92,
  Author =	 "Krishna Kishore Dhara and Gary T. Leavens ",
  Title =	 "Subtyping for mutable types in object-oriented
                  programming languages",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "92-36",
  Year =	 1992,
  Month =	 nov,
  Note =	 "Available by anonymous ftp from ftp.cs.iastate.edu,
                  and by e-mail from almanac@cs.iastate.edu",
  Annote =	 "21 references."
}

@TechReport{Dhara-Leavens94,
  Author =	 "Krishna Kishore Dhara and Gary T. Leavens",
  Title =	 "Weak Behavioral Subtyping for Types with Mutable
                  Objects",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "94-21",
  Year =	 1994,
  Month =	 nov,
  Note =	 "Appears in Mathematical Foundations of Programming
                  Semantics, Eleventh Annual Conference, Preliminary
                  Proceedings, pages 269-290. Available by anonymous
                  ftp from ftp.cs.iastate.edu, and by e-mail from
                  almanac@cs.iastate.edu",
  Annote =	 "15 references."
}

@InProceedings{Dhara-Leavens95,
  Author =	 "Krishna Kishore Dhara and Gary T. Leavens ",
  title =	 "Weak Behavioral Subtyping for Types with Mutable
                  Objects",
  editor =	 "S. Brookes and M. Main and A. Melton and M. Mislove",
  booktitle =	 "Mathematical Foundations of Programming Semantics,
                  Eleventh Annual Conference",
  year =	 1995,
  Series =	 "Electronic Notes in Theoretical Computer Science",
  publisher =	 "Elsevier",
  Volume =	 1,
  note =	 "Available from
                  \url{http://www.sciencedirect.com/science/journal/15710661}",
  annote =	 "20 references."
}

@TechReport{Dhara-Leavens95b,
  Author =	 "Krishna Kishore Dhara and Gary T. Leavens",
  Title =	 "Forcing Behavioral Subtyping Through Specification
                  Inheritance",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "95-20c",
  Year =	 1997,
  Month =	 dec,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR95-20/TR.ps.gz",
  Note =	 "Also in Proceedings of the 18th International
                  Conference on Software Engineering, Berlin, Germany,
                  1996, pp. 258--267. Available by anonymous ftp from
                  ftp.cs.iastate.edu, and by e-mail from
                  almanac@cs.iastate.edu",
  Annote =	 "21 references."
}

@InProceedings{Dhara-Leavens95c,
  Author =	 "Krishna Kishore Dhara and Gary T. Leavens ",
  title =	 "Weak Behavioral Subtyping for Types with Mutable
                  Objects",
  editor =	 "S. Brookes and M. Main and A. Melton and M. Mislove",
  booktitle =	 "Mathematical Foundations of Programming Semantics,
                  Eleventh Annual Conference, Preliminary Proceedings",
  pages =	 "269-290",
  year =	 1995,
  publisher =	 "Elsevier",
  month =	 "March",
  note =	 "The final version is in {\it Electronic Notes in
                  Theoretical Computer Science}, volume 1, which is
                  on-line at
                  http://www.sciencedirect.com/science/journal/15710661",
  annote =	 "20 references."
}

@InProceedings{Dhara-Leavens96,
  Author =	 "Krishna Kishore Dhara and Gary T. Leavens",
  Title =	 "Forcing Behavioral Subtyping Through Specification
                  Inheritance",
  BookTitle =	 "Proceedings of the 18th International Conference on
                  Software Engineering, Berlin, Germany",
  Publisher =	 "IEEE Computer Society Press",
  Address =      "Los Alamitos, CA",
  Pages =	 "258-267",
  Year =	 1996,
  Month =	 mar,
  Note =	 "A corrected version is ISU CS TR \#95-20c,
                 \url{http://tinyurl.com/s2krg}.",
  URL =          {http://doi.ieeecomputersociety.org/10.1109/ICSE.1996.493421},
  Annote =	 "19 references."
}

@MastersThesis{Dhara92,
  Author =	 "Krishna Kishore Dhara",
  Title =	 "Subtyping among Mutable Types in Object-Oriented
                  Programming Languages",
  School =	 "Iowa State University",
  Month =	 may,
  Year =	 1992,
  Address =	 "Department of Computer Science, Ames, Iowa",
  Note =	 "Available by anonymous ftp from ftp.cs.iastate.edu
                  or by e-mail from almanac@cs.iastate.edu.",
  Annote =	 "Definition of legal subtype relationships for
                  mutable abstract data types."
}

@TechReport{Dhara97,
  author =	 {Krishna Kishore Dhara},
  title =	 {Behavioral Subtyping in Object-Oriented Languages},
  institution =	 {Department of Computer Science, Iowa State
                  University},
  year =	 1997,
  number =	 {TR97-09},
  address =	 {226 Atanasoff Hall, Ames IA 50011-1040},
  month =	 may,
  note =	 {The author's Ph.D. dissertation.}
}
%'

@InProceedings{Diaconescu-Goguen-Stefaneas91,
  author =	 {R. Diaconescu and J. Goguen and P. Stefaneas},
  title =	 {Logical support for modularization},
  booktitle =	 {Proceedings of a Workshop on Logical Frameworks},
  editor =	 {G. Huet and G. Plotkin},
  year =	 1991,
  month =	 may
}

@Article{Diaz-Pace-Campo01,
  Author =	 {J. Andr\'{e}s D\'{i}az Pace and Marcelo R. Campo},
  Title =	 "Analyzing the role of aspects in software design",
  Journal =	 CACM,
  Year =	 2001,
  Volume =	 44,
  Number =	 10,
  Month =	 oct,
  Pages =	 "66-73"
}

@InProceedings{Dick-Loubersac91,
  author =	 {J. Dick and J. Loubersac},
  title =	 {Integrating structured and formal methods: A visual
                  approach to {VDM}},
  booktitle =	 {Proceedings of the European Software Engineering
                  Conference},
  number =	 550,
  series =	 LNCS,
  year =	 1991,
  publisher =	 SV,
  address =	 NY
}

@Article{Diederich-Milton87,
  Author =	 "Jim Diederich and Jack Milton",
  Title =	 "Experimental Prototyping in Smalltalk-80",
  Journal =	 "IEEE Software",
  Volume =	 4,
  Number =	 3,
  Month =	 may,
  Year =	 1987,
  Pages =	 "40-49",
  Annote =	 "10 references."
}

@InProceedings{Dietl-Mueller04,
 author = {Werner Dietl and Peter M\"{u}ller},
 title = {Exceptions in Ownership Type Systems},
  editor =       {Erik Poll},
  booktitle="ECOOP Workshop FTfJP'2004 Formal Techniques for Java-like Programs",
  Month = jun,
  Year =  2004,
  Pages="49-54",
  URL = "http://www.cs.ru.nl/ftfjp/2004/ExceptionsInOwnershipTypeSystems.pdf"
}

@article{Dietl-Mueller05,
 author = {Werner Dietl and Peter M\"{u}ller},
 title = {Universes: Lightweight Ownership for {JML}},
 journal = JOT,
 month = oct,
 year = {2005},
 volume = 4,
 number = 8,
 pages = {5-32},
 URL = {http://www.jot.fm/issues/issue_2005_10/article1.pdf}
}

@Article{Digre98,
  author =	 {Tom Digre},
  title =	 {Business Object Component Architecture},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 5,
  month =	 sep,
  pages =	 {60-69},
  annote =	 {7 references.}
}

@Article{Dijkstra66,
  author =       "E. W. Dijkstra",
  title =        "The Structure of the {THE} Multi-programming System",
  journal =      CACM,
  volume =       9,
  number =       3,
  year =         1966,
  month =        may,
  annote =       "Design principles for correct programming systems",
}

@Article{Dijkstra68,
  Author =	 "E. W. Dijkstra",
  Title =	 "Go To Statement Considered Harmful",
  Journal =	 CACM,
  Year =	 1968,
  Volume =	 11,
  Number =	 3,
  Month =	 mar,
  URL =          {http://doi.acm.org/10.1145/362929.362947},
  Pages =	 "147-148",
  Annote =       {2 references.}
}

@article{Dijkstra68b,
  author = "Edsger W. Dijkstra",
  title = "A constructive approach to the problem of program correctness",
  journal = "BIT",
  volume = 8,
  year = 1968,
  pages = "174-186"
}

@InProceedings{Dijkstra69,
  Title =	 "Structured programming",
  Author =	 "E. W. Dijkstra",
  Organization = "NATO",
  BookTitle =	 "Second NATO Conference on Software Engineering
                  Techniques, Rome, Italy",
  Year =	 1969,
  Pages =	 "84-88"
}

@Article{Dijkstra72,
  Author =	 "E. W. Dijkstra",
  Title =	 "The Humble Programmer",
  Journal =	 CACM,
  Year =	 1972,
  Volume =	 15,
  Number =	 10,
  Month =	 oct,
  Pages =	 "859-886",
  Note =	 "Reprinted in {\em Programming Methodology, A
                  Collection of Articles by Members of IFIP WG2.3\/},
                  D. Gries (ed.), Springer-Verlag, 1978."
}

@Article{Dijkstra75,
  Author =	 "E. W. Dijkstra",
  Title =	 "Guarded Commands, Nondeterminancy and Formal
                  Derivation of Programs",
  Journal =	 CACM,
  Volume =	 18,
  Number =	 8,
  Month =	 aug,
  Year =	 1975,
  Pages =	 "453-457",
  Annote =	 "Weakest precondition semantics of the guarded
                  command language, which is introduced in this
                  paper. 2 references."
}

@Book{Dijkstra76,
  Author =	 "Edsger W. Dijkstra",
  Title =	 "A Discipline of Programming",
  Publisher =	 Prentice-Hall,
  Address =	 "Englewood Cliffs, N.J.",
  Year =	 1976,
  Annote =	 "Predicate transformers. Theorems about program
                  composition. Total correctness. Developing programs
                  and proofs."
}

@Book{Dijkstra90,
  Title =	 "Formal Development of Programs and Proofs",
  Editor =	 "E. W. Dijkstra",
  Year =	 1990,
  Publisher =	 Addison-Wesley,
  Series =	 "University of Texas at Austin Year of Programming
                  series",
  Annote =	 "18 articles by different authors"
}

@InCollection{Dijkstra93,
  Author =	 "Edsger W. Dijkstra",
  Title =	 "On the Economy of Doing Mathematics",
  BookTitle =	 "Mathematics of Program Construction, Second
                  International Conference, Oxford, U.K.",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "R.S. Bird and C.C. Morgan and J.C.P. Woodcock",
  Series =	 LNCS,
  Volume =	 669,
  Pages =	 "2-10",
  Address =	 NY,
  Month =	 "June/July",
  Annote =	 "0 references."
}
                  
@misc{Dill-etal22,
      title={Fast and Reliable Formal Verification of Smart Contracts with the Move Prover}, 
      author={David Dill and Wolfgang Grieskamp and Junkil Park and Shaz Qadeer and Meng Xu and Emma Zhong},
      year={2022},
      eprint={2110.08362},
      archivePrefix={arXiv},
      primaryClass={cs.PL},
      url="https://arxiv.org/abs/2110.08362"
}

@Book{Diller90,
  Author =	 "Antoni Diller",
  Title =	 "Z: An Introduction to Formal Methods",
  Publisher =	 "Wiley",
  Year =	 1990
}

% doi = {10.1145/2509136.2509511},                  
@inproceedings{Dillig-etal13,
author = {Isil Dillig and Thomas Dillig and Boyang Li and Ken McMillan},
title = {Inductive Invariant Generation via Abductive Inference},
year = {2013},
isbn = {9781450323741},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/2509136.2509511},
abstract = {This paper presents a new method for generating inductive loop invariants that are
expressible as boolean combinations of linear integer constraints. The key idea underlying
our technique is to perform a backtracking search that combines Hoare-style verification
condition generation with a logical abduction procedure based on quantifier elimination
to speculate candidate invariants. Starting with true, our method iteratively strengthens
loop invariants until they are inductive and strong enough to verify the program.
A key feature of our technique is that it is lazy: It only infers those invariants
that are necessary for verifying program correctness. Furthermore, our technique can
infer arbitrary boolean combinations (including disjunctions) of linear invariants.
We have implemented the proposed approach in a tool called HOLA. Our experiments demonstrate
that HOLA can infer interesting invariants that are beyond the reach of existing state-of-the-art
invariant generation tools.},
booktitle = {Proceedings of the 2013 ACM SIGPLAN International Conference on Object Oriented Programming Systems Languages and Applications},
pages = {443–456},
numpages = {14},
keywords = {invariant generation, static analysis, abductive inference},
location = {Indianapolis, Indiana, USA},
series = {OOPSLA '13}
}


@Article{Dingel-etal98,
  author =	 {J. Dingel and D. Garlan and S. Jha and D. Notkin},
  title =	 {Reasoning about implicit invocation},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 6,
  month =	 nov,
  pages =	 {209-221},
  note =	 {Proceedings of the ACM SIGSOFT Sixth Internatioal
                  Symposium on the Foundations of Software
                  Engineering},
  annote =	 {29 references.}
}

% doi = {10.1145/3338906.3338911},
@inproceedings{Distefano-Parkinson08,
  author    = {Dino Distefano and Matthew J. Parkinson},
  title     = {{jStar}: towards practical verification for {Java}},
  booktitle = {Object-Oriented Programming, Systems, Languages, and Applications (OOPSLA)},
  year      = {2008},
  pages     = {213-226},
  editor    = {Gail E. Harris},
  publisher = {ACM},
  address =   NY,
  URL = {http://doi.acm.org/10.1145/1449764.1449782}
}

@inproceedings{Dong-etal06,
 author = {J. S. Dong and P. Hao and X. Zhang and S. C. Qin},
 title = {HighSpec: a tool for building and checking OZTA models},
 booktitle = {ICSE '06: Proceedings of the 28th international conference on Software engineering},
 year = 2006,
 pages = {775-778},
 location = {Shanghai, China},
 doi = {http://doi.acm.org/10.1145/1134285.1134409},
 publisher = {ACM},
 address = {New York, NY, USA}
}

@Article{Dony-Purchase-Winder92,
  Author =	 "Christophe Dony and Jan Purchase and Russel Winder",
  Title =	 "Exception Handling in Object-Oriented Systems",
  Journal =	 "OOPS Messenger",
  Year =	 1992,
  Volume =	 3,
  Number =	 2,
  Month =	 apr,
  Pages =	 "17-30",
  Annote =	 "17 references."
}

@Article{Doong-Frankl94,
  author =	 {Roong-Ko Doong and Phyllis G. Frankl},
  title =	 {The {ASTOOT} Approach to Testing Object-Oriented
                  Programs},
  journal =	 TOSEM,
  year =	 1994,
  volume =	 3,
  number =	 2,
  pages =	 {101-130},
  month =	 apr,
  annote =	 {Tests based on algebraic specifications. Substantial
                  automation of testing. 31 references.}
}

@Book{Douglass03,
  author =	 "Bruce Powel Douglass",
  title =	 "Real-Time Design Patterns: Robust Scalable
                  Architecture for Real-Time Systems",
  publisher =	 "Addison-Wesley",
  address =	 "Boston",
  year =	 2003
}

@InProceedings{Dovland-etal08,
  author = 	 {Johan Dovland and Einar Broch Johnsen and Olaf Owe and Martin Steffen},
  title = 	 {Lazy Behavioral Subtyping},
  booktitle = {FM 2008: Formal Methods},
  pages = 	 {52-67},
  year = 	 2008,
  volume = 	 5014,
  series = 	 LNCS,
  address = 	 {Berlin},
  publisher = SV,
  URL = 	 {http://dx.doi.org/10.1007/978-3-540-68237-0_6}
}

@article{Dovland-etal10,
author = "Johan Dovland and Einar Broch Johnsen and Olaf Owe and Martin Steffen",
title = "Lazy behavioral subtyping ",
journal = "The Journal of Logic and Algebraic Programming ",
volume = "79",
number = "7",
pages = "578 - 607",
year = "2010",
note = "The 20th Nordic Workshop on Programming Theory (NWPT 2008) ",
issn = "1567-8326",
doi = "http://dx.doi.org/10.1016/j.jlap.2010.07.008",
url = "http://www.sciencedirect.com/science/article/pii/S156783261000038X",
}

@article{Dovland-etal11,
author = "Johan Dovland and Einar Broch Johnsen and Olaf Owe and Martin Steffen",
title = "Incremental reasoning with lazy behavioral subtyping for multiple inheritance ",
journal = "Science of Computer Programming ",
volume = "76",
number = "10",
pages = "915 - 941",
year = "2011",
note = "Integrated Formal Methods (iFM09) ",
issn = "0167-6423",
doi = "http://dx.doi.org/10.1016/j.scico.2010.09.006",
url = "http://www.sciencedirect.com/science/article/pii/S0167642310001723",
}

@InProceedings{Drossopoulou-Francalanza-Mueller08,
  author = 	 {Sophia Drossopoulou and Adrian Francalanza and Peter M\"{u}ller},
  title = 	 {A Unified Framework for Verification Techniques for Object Invariants},
  booktitle = {International Workshop on Foundations of Object-Oriented Languages (FOOL'08)},
  year = 	 2008,
  URL = {http://fool08.kuis.kyoto-u.ac.jp/drossopoulou.pdf},
  annote = 	 {37 references}
}
                  
@InProceedings{Drossopoulou-etal00,
  author =	 {Sophia Drossopoulou and Susan Eisenbach and Bart
                  Jacobs and Gary T. Leavens and Peter M{\"u}ller and
                  Arnd Poetzsch-Heffter},
  title =	 {Formal Techniques for {J}ava Programs},
  booktitle =	 {Object-Oriented Technology. {ECOOP} 2000 Workshop
                  Reader},
  year =	 2000,
  editor =	 {Jacques Malenfant and Sabine Moisan and Ana Moreira},
  series =	 LNCS,
  volume =	 1964,
  publisher =	 SV,
  pages =	 {41-54},
  URL = {https://tinyurl.com/kn954nm8}
}

@Proceedings{Drossopoulou-etal00b,
  editor =	 {Sophia Drossopoulou and Susan Eisenbach and Bart
                  Jacobs and Gary T. Leavens and Peter M{\"u}ller and
                  Arnd Poetzsch-Heffter},
  title =	 {Formal Techniques for {Java} Programs},
  year =	 2000,
  organization = {Technical Report~269, Fernuniversit{\"a}t Hagen},
  note =	 {Available from
                  \url{www.informatik.fernuni-hagen.de/pi5/publications.html}.}
}

% DOI = {10.1007/3-540-44555-2_4},
@InProceedings{Drossopoulou-etal02,
  author =	 {Sophia Drossopoulou and Susan Eisenbach and Gary
                  T. Leavens and Arnd Poetzsch-Heffter and Erik Poll},
  title =	 {Formal Techniques for {J}ava-like Programs},
  booktitle =	 {Object-Oriented Technology. {ECOOP} 2002 Workshop
                  Reader},
  year =	 2002,
  editor =	 {Juan Hernandez and Ana Moreira},
  series =	 LNCS,
  volume =	 2548,
  publisher =	 SV,
  pages =	 {203-210},
  annote =	 "4 references."
}

@inproceedings{Drossopoulou-etal08,
 author = {S. Drossopoulou and A. Francalanza and P. M{\"u}ller and A. J. Summers},
 title = {A Unified Framework for Verification Techniques for Object Invariants},
 booktitle = {European Conference on Object-Oriented Programming (ECOOP)},
 year = 2008,
 editor = {J. Vitek},
 series = {Lecture Notes in Computer Science},
 publisher = {Springer-Verlag},
 address = "Berlin",
 pages = "412-437",
 URL = {http://dx.doi.org/10.1007/978-3-540-70592-5_18}
}

@Article{Duce-Fielding87,
  Author =	 "D. A. Duce and E. V. Fielding",
  Title =	 "Formal Specification --- A Comparison of Two
                  Techniques",
  Journal =	 "The Computer Journal",
  Year =	 1987,
  Volume =	 30,
  Number =	 4,
  Annote =	 "Compares VDM and OBJ on a single problem. Useful
                  tutorial."
}

@inProceedings{Dufour-etal04,
	Author = {Bruno Dufour and Christopher Goard and Laurie Hendren and Oege de Moor and Ganesh Sittampalam and Clark Verbrugge},
	Title = {Measuring the Dynamic Behavior of AspectJ Programs},
	Crossref = {OOPSLA04},
	Pages = {150-169},
	Annote = {The paper presents the results of several dynamic metrics for AspectJ programs.  They also describe the methodology.  They collected AspectJ benchmark code "in the wild".  They modified ajc to annotate classes with information needed by the dynamic analysis tool used---*J.  They also describe abc (the AspectBench compiler), which implements some of the optimizations suggested by their analysis.}
}

@InCollection{Duke-Duke90a,
  Author =	 "D. Duke and R. Duke",
  Title =	 "Towards a Semantics for {Object-Z}",
  BookTitle =	 "VDM '90: VDM and Z --- Formal Methods in Software
                  Development, Third International Symposium of VDM
                  Europe, Kiel, FRG",
  Month =	 apr,
  Year =	 1990,
  Publisher =	 SV,
  Series =	 LNCS,
  Editor =	 "D. Bj{\o}rner and C. A. R. Hoare and H. Langmaack",
  Volume =	 428,
  Pages =	 "244-261",
  Annote =	 "Meta-circular definition, concentrates on class
                  histories."
}

@InProceedings{Duke-Duke90b,
  Author =	 "D. Duke and R. Duke",
  Title =	 "Aspects of Object-Oriented Formal Specification",
  BookTitle =	 "ASWEC '90, Sydney, Australia",
  Month =	 may,
  Year =	 1990,
  Pages =	 "?"
}

@Techreport{Duncan-Holzle98,
  Author =	 {Andrew Duncan and Urs Holzle},
  Title =	 {Adding Contracts to {Java} with {Handshake}},
  Institution =	 {Department of Computer Science, University of
                  California},
  Year =	 {1998},
  Month =	 dec,
  Address =	 {Santa Barbara, CA},
  Number =	 {TRCS98-32}
}

@InProceedings{Dunstan-etal99,
  author =       "Martin N. Dunstan and Tom Kelsey and Ursula Martin and
                 Steve Linton",
  title =        "Formal Methods for Extensions to {CAS}",
  editor =       "Jeanette M. Wing and Jim Woodcock and Jim Davies",
  booktitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  series =	 LNCS,
  publisher =	 SV,
  number =	 1709,
  year =	 1999,
  pages =        "1758-1777",
  annote =       "A Larch-style language for computer algebra.  32 references.",
}

@inproceedings{Durieux-etal19,
author = {Thomas Durieux and Fernanda Madeiral and Matias Martinez and Rui Abreu},
title = {Empirical Review of {Java} Program Repair Tools: A Large-Scale Experiment on 2,141 Bugs and 23,551 Repair Attempts},
year = 2019,
isbn = 9781450355728,
publisher = ACM,
address = NY,
url = {https://doi.org/10.1145/3338906.3338911},
abstract = {In the past decade, research on test-suite-based automatic program repair has grown significantly. Each year, new approaches and implementations are featured in major software engineering venues. However, most of those approaches are evaluated on a single benchmark of bugs, which are also rarely reproduced by other researchers. In this paper, we present a large-scale experiment using 11 Java test-suite-based repair tools and 2,141 bugs from 5 benchmarks. Our goal is to have a better understanding of the current state of automatic program repair tools on a large diversity of benchmarks. Our investigation is guided by the hypothesis that the repairability of repair tools might not be generalized across different benchmarks. We found that the 11 tools 1) are able to generate patches for 21\% of the bugs from the 5 benchmarks, and 2) have better performance on Defects4J compared to other benchmarks, by generating patches for 47\% of the bugs from Defects4J compared to 10-30\% of bugs from the other benchmarks. Our experiment comprises 23,551 repair attempts, which we used to find causes of non-patch generation. These causes are reported in this paper, which can help repair tool designers to improve their approaches and tools.},
booktitle = {Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering},
pages = {302–313},
numpages = 12,
keywords = {Automatic program repair, benchmark overfitting, patch generation},
location = {Tallinn, Estonia},
series = {ESEC/FSE 2019}
}

@Article{Dutertre-Stavridou97,
  author =	 "Bruno Dutertre and Victoria Stavridou",
  title =	 "Formal Requirements Analysis of an Avionics Control
                  System",
  journal =	 IEEETSE,
  pages =	 "267-278",
  month =	 may,
  year =	 1997,
  volume =	 23,
  number =	 5,
  annote =	 "Uses PVS to specify a real-time system. 28
                  references."
}

@InProceedings{Duval98,
  author =	 {Gr\'{e}gory Duval},
  title =	 {Specification and Verification of an Object Request
                  Broker},
  booktitle =	 {Proceedings of the 1998 International Conference on
                  Software Engineering: ICSE 98, Kyoto, Japan},
  year =	 1998,
  organization = IEEE,
  address =	 {Los Alamitos, California},
  month =	 apr,
  pages =	 {43-52},
  annote =	 {Uses Promela. 19 references.}
}

@InProceedings{Dwyer-Avrunin-Corbett98,
     AUTHOR = {Matthew B. Dwyer and George S. Avrunin and James C. Corbett},
     TITLE = {Property Specification Patterns for Finite-state Verification},
     booktitle = "Proceedings of the Second Workshop on Formal Methods in Software Practice",
     pages = "7-15",
     month = mar,
     year = 1998
}

@InProceedings{Dwyer-Avrunin-Corbett99,
  author =	"Matthew B. Dwyer and George S. Avrunin and James C. Corbett",
  title =	"Patterns in Property Specifications for Finite-state Verification",
  booktitle =	"Proceedings of the 21st International Conference on
		 Software Engineering",
  year = 	1999,
  pages =	"411-421",
  publisher =	ACM,
  month =	may,
  address =     NY
}

@article{Dwyer-etal04,
  author = "Matthew B. Dwyer and John Hatcliff and Robby and Venkatesh R. Prasad",
  title = "Exploiting Object Escape and Locking Information in Partial Order Reduction for Concurrent Object-Oriented Programs",
  journal = "Formal Methods in System Design",
  publisher = {Kluwer Academic Publishers},
  year = 2004,
  month = "September--November",
  volume = 25,
  pages = {199-240},
  number = "2--3"
}

@Article{Dybjer90,
  Author =	 "Peter Dybjer",
  Title =	 "Comparing Integrated and External Logics of
                  Functional Programs",
  Journal =	 SCP,
  Volume =	 14,
  Number =	 1,
  Month =	 jun,
  Year =	 1990,
  Pages =	 "59-79",
  Annote =	 "29 references."
}

@Article{Edwards-Weide97,
  author =	 {Stephen H. Edwards and Bruce W. Weide},
  title =	 {{WISR8}: 8th Annual Workshop on Sofware Reuse
                  Summary and Working Group Reports},
  journal =	 SIGSOFT,
  year =	 1997,
  volume =	 22,
  number =	 5,
  month =	 sep,
  pages =	 {17-32},
  annote =	 {22 references.}
}

@Article{Edwards-etal04,
  author =	 {Stephen H. Edwards and Murali Sitaraman and Bruce
                  W. Weide and Joseph Hollingsworth},
  title =	 {Contract-Checking Wrappers for {C++} Components},
  journal =	 IEEETSE,
  volume =	 30,
  number =	 11,
  month =	 nov,
  pages =	 {794-810},
  year =	 2004
}

@Article{Edwards-etal94,
  author =	 {Stephen H. Edwards and Wayne D. Heym and Timothy
                  J. Long and Murali Sitaraman and Bruce W. Weide},
  title =	 {Part {II}: Specifying Components in {RESOLVE}},
  journal =	 SIGSOFT,
  year =	 1994,
  volume =	 19,
  number =	 4,
  month =	 oct,
  pages =	 {29-39}
}

@InProceedings{Edwards-etal98,
  author =	 {Stephen H. Edwards and Gulam Shakir and Murali
                  Sitaraman and Bruce W. Weide and Joseph
                  Hollingsworth},
  title =	 {A framework for detecting interface violations in
                  component-based software},
  booktitle =	 {Proceedings of the Fifth International Conference on
                  Software Reuse},
  year =	 1998,
  publisher =	 "IEEE Computer Society Press",
  month =	 jun,
  pages =	 {46-55}
}

@InProceedings{Edwards96,
  author =	 {Stephen H. Edwards},
  title =	 "Representation Inheritance: A Safe Form of ``White
                  Box'' Code Inheritance",
  booktitle =	 {Fourth International Conference on Software Reuse},
  year =	 1996,
  publisher =	 "IEEE Computer Society Press",
  month =	 apr,
  pages =	 {195-204}
}

@Article{Edwards97,
  author =	 {Stephen Edwards},
  title =	 {Representation Inheritance: A Safe Form of ``White
                  Box'' Code Inheritance},
  journal =	 IEEETSE,
  year =	 1997,
  volume =	 23,
  number =	 2,
  month =	 feb,
  pages =	 {83-92},
  annote =	 {19 references.}
}

journal = 	 SIGSOFT,
  year = 	 1994,
  volume =	 19,
  number =	 4,
  month =	 oct,
  pages =	 {29-39}
}
@Article{Edwards99,
  author =	 {Stephen H. Edwards},
  title =	 {The State of Reuse: Perceptions of the Reuse
                  Community},
  journal =	 SIGSOFT,
  year =	 1999,
  volume =	 24,
  number =	 3,
  month =	 may,
  pages =	 {32-36},
  annote =	 {5 references.}
}

@Book{Eeles-Sims98,
  author =	 {Peter Eeles and Oliver Sims},
  title =	 {Building Business Objects},
  publisher =	 {John Wiley \& Sons},
  year =	 1998
}

@Article{Eggert90,
  Author =	 "Paul Eggert",
  Title =	 "Toward Special-Purpose Program Verification",
  Journal =	 SIGSOFT,
  Year =	 1990,
  Volume =	 15,
  Number =	 4,
  Month =	 sep,
  Pages =	 "25-29",
  Note =	 "Proceedings of the ACM SIGSOFT: International
                  Workshop on Formal Methods in Software Development,
                  Mark Moriconi (editor).",
  Annote =	 "20 references."
}

@TechReport{Egle95,
  author =	 {David M. Egle},
  title =	 {Evaluating {Larch/C++} as a Specification Language:
                  A Case Study Using the Microsoft Foundation Class
                  Library},
  institution =	 {Department of Computer Science, Iowa State
                  University},
  year =	 1995,
  number =	 {95-17},
  address =	 {Ames, Iowa 50011},
  month =	 jul,
  note =	 {Available from \url{http://www.cs.iastate.edu}.},
}

@InCollection{Ehrich-Denker-Sernadas93,
  Author =	 "KH. D. Ehrich and G. Denker and A. Sernadas",
  Title =	 "Constructing Systems as Object Communities",
  Journal =	 LNCS,
  Number =	 668,
  Publisher =	 SV,
  Address =	 NY,
  Editor =	 "M. C. Gaudel and J. P. Jouannaud",
  Year =	 1993,
  Booktitle =	 "TAPSOFT '93: Theory and Practice of Software
                  Development. 4th International Joint Conference
                  CAAP/FASE",
  Pages =	 "453-467",
  Annote =	 "50 references"
}

@InCollection{Ehrich-Gogolla-Sernadas91,
  Author =	 "Hans-Dieter Ehrich and Martin Gogolla and Amilcar Sernadas",
  Title =	 "Objects and Their Specification",
  BookTitle =	 "Recent Trends in Data Type Specification",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "M. Bidot and C. Choppy",
  Series =	 LNCS,
  Volume =	 655,
  Pages =	 "40-65",
  Address =	 NY,
  Annote =	 "Many references."
}

@InCollection{Ehrich-Goguen-Sernadas91,
  Author =	 "H.-D. Ehrich and J. A. Goguen and A. Sernadas",
  Title =	 "A Categorial Theory of Objects as Observed
                  Processes",
  BookTitle =	 "Foundations of Object-Oriented Languages, REX
                  School/Workshop, Noordwijkerhout, The Netherlands,
                  May/June 1990",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "J. W. de Bakker and W. P. de Roever and
                  G. Rozenberg",
  Series =	 LNCS,
  Volume =	 489,
  Pages =	 "203-228",
  Address =	 NY,
  Annote =	 "38 references."
}
                  
@InCollection{Ehrich78,
  Author =	 "H. D. Ehrich",
  Title =	 "Extensions and Implementations of Abstract Data Type
                  Specications",
  BookTitle =	 "Mathematical Foundations of Computer Science",
  Series =	 LNCS,
  Volume =	 64,
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1978,
  Pages =	 "155-164"
}

@InCollection{Ehrig-Jimenez-Orejas93,
  Author =	 "H. Ehrig and R. M. Jimenez and F. Orejas",
  Title =	 "Compositionality Results for Different Types of
                  Parameterization and parameter passing in
                  Speicfication Languages",
  Journal =	 LNCS,
  Number =	 668,
  Publisher =	 SV,
  Address =	 NY,
  Editor =	 "M. C. Gaudel and J. P. Jouannaud",
  Year =	 1993,
  Booktitle =	 "TAPSOFT '93: Theory and Practice of Software
                  Development. 4th International Joint Conference
                  CAAP/FASE",
  Pages =	 "31-45",
  Annote =	 "25 references"
}

@Article{Ehrig-Kreowski83,
  Author =	 "H. Ehrig and H.-J. Kreowski",
  Title =	 "Algebraic Implementation of Abstract Data Types",
  Journal =	 "Theoretical Computer Science",
  Volume =	 27,
  Number =	 3,
  Month =	 dec,
  Year =	 1983,
  Pages =	 "255-286",
  Annote =	 "Theory of parameterized implementations. 30
                  references."
}

@Book{Ehrig-Mahr85,
  Author =	 "Hartmut Ehrig and Bernd Mahr",
  Title =	 "Fundamentals of Algebraic Specification 1: Equations
                  and Initial Semantics",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1985,
  Series =	 "EATCS Monographs on Theoretical Computer Science",
  Volume =	 6,
  Annote =	 "Excellent presentation of the fundamental results in
                  equational algebraic specifications. The
                  specification language ACT-ONE. Over 100
                  references."
}

@Book{Ehrig-Mahr90,
  Author =	 "Hartmut Ehrig and Bernd Mahr",
  Title =	 "Fundamentals of Algebraic Specification 2: Module
                  Specifications and Constraints",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1990,
  Series =	 "EATCS Monographs on Theoretical Computer Science",
  Volume =	 21,
  Annote =	 "Over 100 references."
}

@Article{Ehrig-etal82,
  Author =	 "H. Ehrig and H.-J. Kreowski and B. Mahr and
                  P. Padawitz",
  Title =	 "Algebraic Implementation of Abstract Data Types",
  Journal =	 "Theoretical Computer Science",
  Volume =	 20,
  Number =	 3,
  Month =	 jul,
  Year =	 1982,
  Pages =	 "209-263",
  Annote =	 "Theory of algebraic implementations. Reviews
                  algebraic specifications. 45 references."
}

@InCollection{Ehrig-etal95,
  author =	 "H.-D. Ehrig and others",
  title =	 "{KORSO} Reference Languages Concepts and Application
                  Domains",
  crossref =	 "Broy-Jaehnichen95",
  pages =	 "150-172",
  annote =	 "Many references."
}

@Article{Eisenbach-Leavens01,
  author =	 {Susan Eisenbach and Gary T. Leavens},
  title =	 {Special Issue: formal techniques for {Java} programs},
  journal =	 {Concurrency and Computation: Practice and Experience},
  year =	 2001,
  volume =	 13,
  number =	 13,
  pages =        {1121-1123}
}

@InCollection{Eisenbach-etal04,
  author = 	 {Susan Eisenbach and Gary T. Leavens and Peter M\"{u}ller and Arnd Poetzsch-Heffter and Erik Poll},
  title = 	 {Formal Techniques for {Java}-Like Programs},
  booktitle = 	 {Object-Oriented Technology ECOOP 2003 Workshop Reader},
  pages =	 {62-71},
  publisher =	 SV,
  year =	 2004,
  editor =	 {Frank Buschmann and Alejandro P. Buschmann and Mariano A. Cilia},
  volume =	 3013,
  series =	 LNCS,
  address =	 NY,
  annote =	 {6 references.}
}

@Article{Elmstrom-Lassen-Andersen93,
  author =	 "Ren\'{e} Elmstr{\o}m and Poul B{\o}gh Lassen and
                  Michael Andersen",
  title =	 "An Executable Subset of {VDM-SL} in an {SA/RT}
                  Framework",
  journal =	 "Real-Time Systems",
  year =	 1993,
  volume =	 5,
  pages =	 "197-211",
  annote =	 "The executable specification language IPTES Meta-IV,
                  which is based on VDM-SL. 15 references."
}

@Article{Elmstrom-Lintulampi-Pezze93,
  author =	 "Ren\'{e} Elmstr{\o}m and Raino Lintulampi and Mauro
                  Pezz\'{e}",
  title =	 "Giving Semantics to {SA/RT} by Means of {High-Level
                  Timed Petri Nets}",
  journal =	 "Real-Time Systems",
  year =	 1993,
  volume =	 5,
  pages =	 "249-271",
  annote =	 "From the IPTES project. 12 references."
}

@TechReport{Elva-Leavens12,
  author = 	 {Rochelle Elva and Gary T. Leavens},
  title = 	 {{JSCTracker}: A Semantic Clone Detection Tool for {Java} Code},
  institution =  {Computer Science, University of Central Florida},
  year = 	 2012,
  number = 	 {CS-TR-12-04},
  address = 	 {Orlando, Florida},
  month = 	 mar,
  annote = 	 {27 references.}
}

@InProceedings{Elva-Leavens12a,
  author = 	 {Rochelle Elva and Gary T. Leavens},
  title = 	 {Semantic Clone Detection using method {IOE}-behavior},
  booktitle = {6th International Workshop on Software Clones (IWSC), Zurich},
  year = 	 2012,
  pages = 	 {80-81},
  month = 	 jun,
  publisher = IEEE,
  URL = {http://dx.doi.org/10.1109/IWSC.2012.6227874},
  annote = 	 {8 references.}
}

@TechReport{Elva-Leavens12b,
  author = 	 {Rochelle Elva and Gary T. Leavens},
  title = 	 {{JSCTracker}: JSCTracker: A Tool and Algorithm for Semantic Method Clone Detection Using Method IOE-Behavior},
  institution =  {Computer Science, University of Central Florida},
  year = 	 2012,
  number = 	 {CS-TR-12-07},
  address = 	 {Orlando, Florida},
  month = 	 oct,
  annote = 	 {11 references.}
}

@TechReport{Elva13,
  author = 	 {Rochelle Elva},
  title = 	 {Detecting Semantic Method Clones in {Java} Code Using Method {IOE-behavior}},
  institution =  {Computer Science, University of Central Florida},
  year = 	 2013,
  number = 	 {CS-TR-13-08},
  address = 	 {Orlando, Florida},
  month = 	 jul,
  URL =          {\url{http://www.eecs.ucf.edu/~leavens/tech-reports/UCF/CS-TR-13-08/TR.pdf}},
  annote = 	 {54 references.}
}

@InCollection{Emerson90,
  author = 	 {E. Allen Emerson},
  title = 	 {Temporal and Modal Logic},
  booktitle = 	 {Handbook of Theoretical Computer Science},
  pages = 	 {995-1072},
  publisher = MITP,
  year = 	 1990,
  editor = 	 {J. van Leeuwen},
  volume = 	 {B},
  chapter = 	 16,
  address = 	 {Cambridge, Mass.},
  annote = 	 {129 references.}
}

@InCollection{Enberg-Granning-Lamport93,
  Author =	 "Urban Enberg and Peter Granning and Leslie Lamport",
  Title =	 "Mechanical Verification of Concurrent systems with
                  TLA",
  Journal =	 LNCS,
  Number =	 663,
  Publisher =	 SV,
  Address =	 NY,
  Editor =	 "G. V. Bochmann and D. K. Probst",
  Year =	 1993,
  Booktitle =	 "Computer Aided Verification. 4th Annual workshop,
                  CAV '92",
  Pages =	 "44-55",
  Annote =	 "7 references"
}

@inproceedings{Engels-Groenewegen00,
 author = {Gregor Engels and Luuk Groenewegen},
 title = {Object-oriented modeling: a roadmap},
 booktitle = {ICSE '00: Proceedings of the Conference on The Future of Software Engineering},
 year = {2000},
 pages = {103--116},
 location = {Limerick, Ireland},
 doi = {http://doi.acm.org/10.1145/336512.336541},
 publisher = {ACM},
 address = {New York, NY, USA}
}

@InProceedings{Engler-etal00,
  title =	"Checking System Rules Using System-Specific,
		 Programmer-Written Compiler Extensions",
  author =	"Dawson R. Engler and Benjamin Chelf and Andy Chou and
		 Seth Hallem",
  year = 	"2000",
  booktitle =	"Proc. 4th Symp. OS Design and Int'l (OSDI 2000)",
  Publisher =   ACM,
  pages =	"1-16"
}
                  
@InProceedings{Engler05,
  title =	"Static Analysis Versus Model Checking for Bug Finding",
  author =	"Dawson R. Engler",
  year = 	"2005",
  booktitle =	"CONCUR 2005 --- Concurrency Theory: 16th International Conference",
  pages =	"1",
  publisher =   SV,
  series =      LNCS,
  volume =      3653,
  editor = "Martin Abadi and Luca de Alfaro",
  URL =  	"http://dx.doi.org/10.1007/11539452_1",
}

@TechReport{Eriksen-Prehn91,
  Author =	 "Kirsten Eriksen and Soren Prehn",
  Title =	 "{RAISE} Overview",
  Institution =	 "Computer Resources International A/S",
  Year =	 1991,
  Number =	 "RAISE/CRI/DOC/9/V5",
  Address =	 "Denmark",
  Month =	 oct,
  Annote =	 "17 references."
}

@Article{Ernst-Hookway-Ogden94,
  Author =	 "G. W. Ernst and R. J. Hookway and W. F. Ogden",
  Title =	 "Modular Verification of Data Abstraction with Shared
                  Realizations",
  Journal =	 IEEETSE,
  Year =	 1994,
  Volume =	 20,
  Number =	 4,
  Month =	 apr,
  Pages =	 "288-307",
  Annote =	 "50 references."
}

@Article{Ernst-Navlakha-Ogden82,
  Author =	 "George W. Ernst and J. K. Navlakha and W. F. Ogden",
  Title =	 "Verification of Programs with Procedure-Type
                  Parameters",
  Journal =	 "Acta Informatica",
  Year =	 1982,
  Volume =	 18,
  Number =	 2,
  Month =	 nov,
  Pages =	 "149-169"
}

@InProceedings{Ernst-etal00,
  author =	 "Michael Ernst and Adam Czeisler and William
                  G. Griswold and David Notkin",
  title =        "Quickly Detecting Relevant Program Invariants",
  booktitle =    {Proceedings of the 22nd International Conference on
                 Software Engineering},
  month =        jun,
  publisher =    "ACM Press",
  address =      NY,
  year =         2000,
  pages =        {449-458},
  annote =       {9 references.}
}

@Article{Ernst-etal01,
  author =	 "Michael Ernst and Jake Cockrell and William
                  G. Griswold and David Notkin",
  title =	 "Dynamically Discovering Likely Program Invariants to
                  Support Program Evolution",
  journal =	 IEEETSE,
  pages =	 "99-123",
  month =	 feb,
  year =	 2001,
  volume =	 27,
  number =	 2,
  URL = {http://doi.ieeecomputersociety.org/10.1109/32.908957},
  annote =      "88 references."
}

@article{Ernst-etal07,
title = {The {Daikon} system for dynamic detection of likely invariants},
journal = {Science of Computer Programming},
volume = 69,
number = 1,
pages = {35-45},
year = 2007,
note = {Special issue on Experimental Software and Toolkits},
issn = {0167-6423},
doi = {https://doi.org/10.1016/j.scico.2007.01.015},
url = {https://www.sciencedirect.com/science/article/pii/S016764230700161X},
author = {Michael D. Ernst and Jeff H. Perkins and Philip J. Guo and Stephen McCamant and Carlos Pacheco and Matthew S. Tschantz and Chen Xiao},
keywords = {Daikon, Dynamic analysis, Dynamic invariant detection, Inductive logic programming, Inference, Invariant, Likely invariant, Program understanding, Specification, Specification mining},
abstract = {Daikon is an implementation of dynamic detection of likely invariants; that is, the Daikon invariant detector reports likely program invariants. An invariant is a property that holds at a certain point or points in a program; these are often used in assert statements, documentation, and formal specifications. Examples include being constant (x=a), non-zero (x≠0), being in a range (a≤x≤b), linear relationships (y=ax+b), ordering (x≤y), functions from a library (x=fn(y)), containment (x∈y), sortedness (xissorted), and many more. Users can extend Daikon to check for additional invariants. Dynamic invariant detection runs a program, observes the values that the program computes, and then reports properties that were true over the observed executions. Dynamic invariant detection is a machine learning technique that can be applied to arbitrary data. Daikon can detect invariants in C, C++, Java, and Perl programs, and in record-structured data sources; it is easy to extend Daikon to other applications. Invariants can be useful in program understanding and a host of other applications. Daikon’s output has been used for generating test cases, predicting incompatibilities in component integration, automating theorem proving, repairing inconsistent data structures, and checking the validity of data streams, among other tasks. Daikon is freely available in source and binary form, along with extensive documentation, at http://pag.csail.mit.edu/daikon/.},
annote="40 references."
}

@Misc{Ernst-etal21,
  author = 	 {Michael Ernst and others},
  title =        {Daikon website},
  URL =          {https://plse.cs.washington.edu/daikon/},
  note = 	 {Accessed September 2021}
}

@Article{Ernst-etal91,
  Author =	 "G. W. Ernst and R. J. Hookway and J. A. Menegay and
                  W. F. Ofgen",
  Title =	 "Modular Verification of {Ada} Generics",
  Journal =	 "Computer Languages",
  Year =	 1991,
  Volume =	 16,
  Number =	 "3/4",
  Pages =	 "259-280"
}

@InProceedings{Ernst-etal99,
  author =	 "Michael Ernst and Jake Cockrell and William
                  G. Griswold and David Notkin",
  title =	 "Dynamically Discovering Likely Program Invariants to
                  Support Program Evolution",
  pages =	 "213-225",
  booktitle =	 "Proceedings of the 1999 International Conference on
                  Software Engineering ({ICSE}'99)",
  ISBN =	 "1-58113-074-0",
  month =	 may,
  publisher =	 ACM,
  address =	 "New York",
  year =	 "1999",
}

@InProceedings{Ernst03,
  author =	 {Michael D. Ernst},
  title =	 {Static and dynamic analysis: Synergy and duality},
  booktitle =	 {WODA 2003: ICSE Workshop on Dynamic Analysis,
                  Portland, OR},
  pages =	 {24-27},
  year =	 2003,
  month =	 may,
  publisher =    "Jonathan Cook",
  address =      "New Mexico State University",
  url = {http://www.cs.nmsu.edu/~jcook/woda2003/papers/Ernst.pdf}
}

@Article{Esterbrook-etal98,
  author =	 {Steve Esterbrook and Robyn Lutz and Richarrd
                  Covington and John Kelly and Yoko Ampo and David
                  Hamilton},
  title =	 {Experiences Using Lightweight Formal Methods for
                  Requirements Modeling},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 1,
  month =	 jan,
  pages =	 {4-14},
  annote =	 {Three case studies. Lightweight formal methods
                  complimented existing practices. 27 references.}
}

@InProceedings{Evans-etal94,
  author =	"David Evans and John Guttag and Jim Horning and Yang
		 Meng Tan",
  title =	"{LCLint}: {A} Tool for Using Specifications to Check
		 Code",
  booktitle =	"Proceedings of the Second ACM SIGSOFT Symposium on the
		 Foundations of Software Engineering",
  month =	"6--9 " # dec,
  year = 	"1994",
  pages =	"87--96",
  location =	"New Orleans, USA"
}

@Article{Evans96,
  author =	 "David Evans",
  title =	 "Static Detection of Dynamic Memory Errors",
  journal =	 SIGPLAN,
  year =	 1996,
  volume =	 31,
  number =	 5,
  month =	 may,
  pages =	 {44-53},
  note =	 {Proceedings of the 1996 ACM SIGPLAN Conference on
                  Programming Language Design and Implementation
                  (PLDI).},
  URL =
                  "ftp://larch.lcs.mit.edu/pub/Larch/lclint/pldi96.ps.gz",
  annote =	 {11 references.}
}

@Unpublished{Evans96b,
  Author =	 "David Evans",
  Title =	 "{LCLint} User's Guide, Version 2.1",
  Note =
                  {http://larch-www.lcs.mit.edu:8001/larch/lclint/guide/},
  Month =	 apr,
  Year =	 1996
}

@Article{Fagan86,
  Author =	 "Michael E. Fagan",
  Title =	 "Advances in Software Inspections",
  Journal =	 IEEETSE,
  Volume =	 "SE-12",
  Number =	 7,
  Month =	 jul,
  Year =	 1986,
  Annote =	 "Benefits and process of inspections. 11 references."
}

@inproceedings{Fahndrich-Leino03b,
 author    = {Manuel F{\"a}hndrich and K. Rustan M. Leino},
 title     = {Heap monotonic typestates},
 booktitle = {ECOOP International Workshop on Aliasing, Confinement and Ownershi
p (IWACO 2003)},
 year      = 2003,
 publisher = {K.U. Leuven},
 address   = {Leuven},
 url       = {\url{http://www.cs.kuleuven.be/~dave/iwaco/final/05-Fahndrich.pdf}},
}

@incollection{Fahndrich-Logozzo11,
  author={Manuel F\"{a}hndrich and Francesco Logozzo},
  title={Static Contract Checking with Abstract Interpretation},
year={2011},
isbn={978-3-642-18069-9},
booktitle={Formal Verification of Object-Oriented Software},
volume={6528},
series={Lecture Notes in Computer Science},
editor={Beckert, Bernhard and Marché, Claude},
doi={10.1007/978-3-642-18070-5_2},
url={http://dx.doi.org/10.1007/978-3-642-18070-5_2},
publisher=SV,
pages={10-30}
}

@InProceedings{Fahndrich-Xia07,
  author = {Manuel F{\"a}hndrich and Songtao Xia},
  title = {Establishing object invariants with delayed types},
  booktitle =    {Proceedings of the 22nd Annual ACM SIGPLAN
                  Conference on Object-Oriented Programming, Systems,
                  Languages, and Applications, OOPSLA 2007},
  year =         {2007},
  editor =       {Richard P. Gabriel and David F. Bacon and Cristina
                  Videira Lopes and Guy L. {Steele Jr.}},
  month =        oct,
  publisher =    {ACM},
  address =      NY,
  pages =        {337-350},
}

@TechReport{Farres-Casals89,
  Author =	 "Jordi Farr\`{e}s-Casals",
  Title =	 "Proving Correctness of Constructor Implemenations",
  Institution =	 "Laboratory for Foundations of Computer Science,
                  Department of Computer Science, University of
                  Edinburgh",
  Address =	 "Edinburgh, EH9 3JZ",
  Number =	 "ECS-LFCS-89-72 (also CSR-286-89)",
  Month =	 jan,
  Year =	 1989,
  Annote =	 "Correctness proofs in Sannella and Tarlecki's
                  framework. 16 references."
}

@Inproceedings{Faulkner-Storey02,
	author 		= {Alastair Faulkner and Neil Storey},
	title 		= {Data: An often-ignored component of safety-related systems},
	booktitle = {Proceedings of the MOD Equipment Assurance Symposium (ESAS02)},
	year 			= {2002},
	location 	= {Bristol, UK},
	publisher = {MOD},
	address 	= {Bristol, UK}
}

@Book{Favre03,
  editor =	 {Linda Favre},
  title = 	 {UML and the Unified Process},
  publisher = 	 {IRM Press},
  year = 	 2003,
  address =	 {Hershey, PA}
}

@Article{Fayad-Hamu-Brugali00,
  author =       "Mohamed E. Fayad and David S. Hamu and Davide Brugali",
  title =        "Enterprise frameworks characteristics, criteria, and
                 challanges",
  journal =      CACM,
  volume =       43,
  number =       10,
  pages =        "39-46",
  month =        oct,
  year =         2000,
  URL =          "http://www.acm.org/pubs/citations/journals/cacm/2000-43-10/p39-fayad/",
  annote =     "Describes role of enduring business themes.  12 references."
}

@Book{Fayad-Johnson99,
  author =	 {M. E. Fayad and R. Johnson},
  title = 	 {Domain-Specific Application Frameworks: Experience by Industry},
  publisher = 	 {Wiley},
  year = 	 1999,
  address =	 NY
}

@Article{Fayad02,
  author = 	 {Mohamed E. Fayad},
  title = 	 {How to Deal with Software Stability},
  journal = 	 CACM,
  year = 	 2002,
  volume =	 45,
  number =	 4,
  pages =	 {109-112},
  month =	 apr,
  annote =	 {Heuristics for determining enduring business themes and business objects. 3 references.}
}

@InCollection{Feather93,
  Author =	 "Martin Feather",
  Title =	 "Behavior-oriented specification in Gist",
  BookTitle =	 "Formal Program Development",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Bernhard Moeller and Helmut Partsch and Steve
                  Schuman",
  Series =	 LNCS,
  Volume =	 755,
  Pages =	 "89-122",
  Address =	 NY,
  Month =	 jul,
  Annote =	 "36 references."
}

@Article{Feather98,
  author =	 {Martin S. Feather},
  title =	 {Rapid Application of Lightweight Formal Methods for
                  Consistency Analyses},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 11,
  month =	 nov,
  pages =	 {949-959},
  annote =	 {13 references.}
}

@Book{Feijs-Jonkers-Middelburg94,
  author =	 "L. M. G. Feijs and H. B. M. Jonkers and
                  C. A. Middelburg",
  title =	 "Notations for Software Design",
  publisher =	 SV,
  address =	 "London",
  year =	 "1994",
  ISBN =	 "3-540-19902-0",
  series =	 "FACIT Series",
  annote =	 "Uses COLD-1. 67 references."
}

@Book{Feijs-Jonkers92,
  Author =	 "L. M. G. Feijs and H. B. M. Jonkers",
  Title =	 "Formal Specification and Design",
  Publisher =	 "Cambridge University Press",
  Year =	 1992,
  Volume =	 35,
  Series =	 "Cambridge Tracts in Theoretical Computer Science",
  Address =	 "Cambridge, UK",
  Annote =	 "The wide-spectrum language COLD. 58 references."
}

@Book{Feijs93,
  author =	 {Loe Feijs},
  title =	 {A formalization of design methods: a
                  $\lambda$-calculus approach to systems design with
                  an application to text editing},
  publisher =	 {Ellis Horwood},
  year =	 1993,
  series =	 {Computers and their Applications},
  address =	 {Chicheter, UK}
}

@Article{Felder-Ghezzi-Pezze93,
  author =	 "Miguel Felder and Carlo Ghezzi and Mauro Pezz\'{e}",
  title =	 "{High-Level Timed Petri Nets} as a Kernel for
                  Executable Specifications",
  journal =	 "Real-Time Systems",
  year =	 1993,
  volume =	 5,
  pages =	 "235-248",
  annote =	 "The IPTES environment kernel. 13 references."
}

@InCollection{Feldman-Wild92,
  Author =	 "G. Feldman and J. Wild",
  Title =	 "The DECspec Project: Tools for Larch/C",
  Editor =	 "Ursala Martin and Jeannette M. Wing",
  BookTitle =	 "First International Workshop on Larch, Dedham 1992",
  Publisher =	 SV,
  Year =	 1992,
  Pages =	 "98-103",
  Annote =	 "13 references"
}

@Book{Felleisen-etal01,
  author =	 {Matthias Felleisen and Robert Bruce Findler and Matthew Flatt and Shriram Krishnamurthi},
  title = 	 {How to Design Programs},
  publisher = 	 MITP,
  year = 	 2001,
  annote =	 {Introductory programming text.}
}

@InProceedings{Fencott-Lockyer-Taylor92,
  Author =	 "P. C. Fencott and M. A. Lockyer and P. Taylor",
  Title =	 "Experiences in integrating structured and formal
                  notations for real-time systems",
  BookTitle =	 "The Methods Integration Workshop",
  Publisher =	 SV,
  Year =	 1992
}

@inproceedings{Feng-etal06,
 author = {Xinyu Feng and Zhong Shao and Alexander Vaynberg and Sen Xiang and Zhaozhong Ni},
 title = {Modular verification of assembly code with stack-based control abstractions},
 booktitle = {Proceedings of the ACM SIGPLAN 2006 Conference on Programming Language Design and Implementation},
 month = jun,
 year = 2006,
 pages = {401--414},
 publisher = {ACM},
 address = NY,
 URL = {http://doi.acm.org/10.1145/1133981.1134028}
}

@InCollection{Ferdinand-etal01,
  Author =	 "C. Ferdinand and R. Heckmann and M. Langenbach
                  and F. Martin and M. Schmidt and H. Theiling and
                  S. Thesing and R. Wilhelm",
  Title =	 "Reliable and precise {WCET} determination for a real-life
                  processor",
  BookTitle =	 "Proc. First International Workshop on Embedded 
                  Software (EMSOFT 2001)",
  Publisher =	 SV,
  Year =	 2001,
  Series =	 LNCS,
  Volume =	 2211,
  Pages =	 "469-485"
}

@Article{Fetzer88,
  Author =	 "James H. Fetzer",
  Title =	 "Program Verification: The Very Idea",
  Journal =	 CACM,
  Volume =	 31,
  Number =	 9,
  Month =	 sep,
  Year =	 1988,
  Pages =	 "1048-1063",
  Annote =	 "Algorithms can be verified absolutely. Programs can
                  only be verified relative to the abstract machine
                  they run on. 37 references"
}

@InCollection{Fiadeiro-Costa94,
  Author =	 "J. L. Fiadeiro and J. F. Costa",
  Title =	 "Institutions for Behavioral Specification",
  BookTitle =	 "Recent Trends in Datatype Specification",
  Publisher =	 SV,
  Year =	 1994,
  Editor =	 "Egidio Astesiano and Gianna Reggio and Andrzej
                  Tarlecki",
  Series =	 LNCS,
  Volume =	 906,
  Pages =	 "273-289",
  Address =	 NY,
  Annote =	 "25 references."
}

@InCollection{Fiadeiro-Maibaum91,
  Author =	 "J. Fiadeiro and T. Maibaum",
  Title =	 "Describing, Structuring and Implementing Objects",
  BookTitle =	 "Foundations of Object-Oriented Languages, REX
                  School/Workshop, Noordwijkerhout, The Netherlands,
                  May/June 1990",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "J. W. de Bakker and W. P. de Roever and
                  G. Rozenberg",
  Series =	 LNCS,
  Volume =	 489,
  Pages =	 "274-310",
  Address =	 NY,
  Annote =	 "52 references."
}

@Article{Fichman-Kemerer92,
  Author =	 "Robert G. Fichman and Chris F. Kemerer",
  Title =	 "Object-Oriented and Conventional Analysis and Design
                  Methodologies",
  Journal =	 "Computer",
  Year =	 1992,
  Volume =	 25,
  Number =	 10,
  Month =	 oct,
  Pages =	 "22-39",
  Annote =	 "22 references."
}

@TechReport{Fickas-Nagarajan88,
  Author =	 "Stephen Fickas and P. Nagarajan",
  Title =	 "Critiquing a Software Specification",
  Institution =	 "Computer Science Department, University of Oregon",
  Address =	 "Eugene, Oregon",
  Number =	 "88-01",
  Month =	 jan,
  Year =	 1988,
  Annote =	 "A knowledge-based system that criticizes
                  specifications. 21 references."
}

@Article{Fidge-Kearney-Utting97,
  author =	 {Colin Fidge and Peter Kearney and Mark Utting},
  title =	 {A Formal Method for Building Concurrent Real-Time
                  Software},
  journal =	 {IEEE Software},
  year =	 1997,
  volume =	 14,
  number =	 2,
  month =	 mar,
  pages =	 {99-106},
  annote =	 {14 references.}
}

@Article{Fiedler89,
  Author =	 "S. P. Fiedler",
  Title =	 "Object-Oriented Unit Testing",
  Journal =	 "HP Journal",
  Volume =	 36,
  Number =	 4,
  Year =	 1989,
  Month =	 apr
}

@InProceedings{Fierz99,
  author =       {Hugo Fierz},
  title =        "The {CIP} Method: Component- and Model-Based Construction of Embedded Systems",
  booktitle =    "Software Engineering -- ESEC/FSE '99",
  month =        nov,
  year =         "1999",
  editor =       "Oscar Nierstrasz and Michel Lemoine",
  volume =       "1687",
  series =       LNCS,
  publisher =    SV,
  pages =        {375-392},
  note =         {Also ACM SIGSOFT {\em Software Engineering Notes},
                  volume 24, number 6.},
  annote =       {A method designed for embedded systems.  Uses formal reactive models, based on state machines, for behavioral specification.  16 references.}
}

@inproceedings{Filliatre-Marche04,
  author    = {Jean-Christophe Filli{\^a}tre and Claude March{\'e}},
  title     = {Multi-prover Verification of {C} Programs.},
  booktitle = {Formal Methods and Software Engineering, 6th International
               Conference on Formal Engineering Methods, ICFEM 2004},
  series    = LNCS,
  volume    = 3308,
  year      = 2004,
  publisher = SV,
  address   = {Berlin},
  URL =	{http://www.springerlink.com/content/ejxv14xdjf5676u5},
  pages     = "15-29"
}

@inproceedings{Filliatre-Marche07,
  author    = {Jean-Christophe Filli{\^a}tre and Claude March{\'e}},
  title     = {The {Why/Krakatoa/Caduceus} Platform for Deductive Program Verification},
  booktitle = {Computer Aided Verification, 19th International Conference},
  year      = 2007,
  series    = LNCS,
  volume    = 4590,
  publisher = SV,
  address =   NY,
  pages     = {173--177}
}

@inproceedings{Filliatre-Paskevich13,
  author = {Jean-Christophe Filli\^atre and Andrei Paskevich},
  title = {Why3 --- Where Programs Meet Provers},
  booktitle = {Proceedings of the 22nd European Symposium on Programming},
  month = mar,
  year = 2013,
  volume = {7792},
  series = {Lecture Notes in Computer Science},
  publisher = {Springer},
  editor = {Matthias Felleisen and Philippa Gardner},
  pages = {125--128},
  url = {http://hal.inria.fr/hal-00789533},
  topics = {team,lri},
  keywords = {Why3},
  type_publi = {icolcomlec},
}

@TECHREPORT{Filliatre03,
  AUTHOR = {Jean-Christophe Filli{\^a}tre},
  TITLE = {{Why}: a multi-language multi-prover verification tool},
  INSTITUTION = {LRI, Universit\'e Paris Sud},
  TYPE = {Research Report},
  NUMBER = 1366,
  MONTH = mar,
  YEAR = 2003
}

@InProceedings{Filman-Havelund02,
  Author =	 {Robert E. Filman and Klaus Havelund},
  Title =	 {Source-Code Instrumentation and Quantification of
                  Events},
  Pages =	 "45-49",
  BookTitle =	 {FOAL 2002 Proceedings: Foundations of
                  Aspect-Oriented Languages Workshop at AOSD 2002},
  year =	 2002,
  Editor =	 {Gary T. Leavens and Ron Cytron},
  Organization = {Department of Computer Science, Iowa State
                  University},
  Series =	 {Technical Report},
  number =	 {02-06},
  month =	 apr,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR02-06/TR.pdf"
}

@InProceedings{Filman-Havelund03,
  Author =	 {Robert E. Filman and Klaus Havelund},
  Title =	 {The Effect of {AOP} on Software Engineering, with Particular Attention to {OIF} and Event Quantification},
  BookTitle =	 {SPLAT '03},
  year =	 2003,
  month =	 mar,
  note =         {\url{http://tinyurl.com/2euk95}}
}

@article{Filman-etal02,
	Author = {Robert E. Filman and Stuart Barrett and Diana D. Lee and Ted Linden},
	Title = {Inserting ilities by controlling communications},
	Journal = CACM,
	Number = {1},
	Pages = {116-122},
	Publisher = {ACM Press},
	Volume = {45},
	Year = {2002},
	Annote = {The paper claims that many cross-cutting concerns (what they call "ilitiies": like reliability, availability, responsiveness, performance, security, and manageability) can be managed by intercepting communications among components and operating on the contents of those communications.}
}

@Book{Filman-etal05,
  editor =	 {Robert E. Filman and Tzilla Elrad and Siobh\'{a}n Clarke and Mehmet Ak\c{s}it},
  title = 	 {Aspect-Oriented Software Development},
  publisher = 	 {Addison-Wesley},
  year = 	 2005
}

@Techreport{Findler-Felleisen00,
  Author =	 {Robert Bruce Findler and Matthias Felleisen},
  Title =	 {Behavioral Interface Contracts for {Java}},
  Institution =	 {Department of Computer Science, Rice University},
  Year =	 {2000},
  Month =	 aug,
  Address =	 {Houston, TX},
  Number =	 {CS TR00-366}
}

@InProceedings{Findler-Felleisen01,
  Author =	 {Robert Bruce Findler and Matthias Felleisen},
  Title =	 {Contract Soundness for Object-Oriented Languages},
  Booktitle =	 {OOPSLA '01 Conference Proceedings, Object-Oriented
                  Programming, Systems, Languages, and Applications,
                  October 14-18, 2001, Tampa Bay, Florida, USA},
  Year =	 2001,
  Month =	 oct,
  publisher =    ACM,
  address =      NY,
  Pages =	 {1-15}
}

@InProceedings{Findler-Felleisen02,
  Author =	 {Robert Bruce Findler and Matthias Felleisen},
  Title =	 {Contracts for higher-order functions},
  Booktitle =	 {Proceedings of ACM SIGPLAN International Conference
                  on Functional Programming},
  pages = {48-59},
  year = 2002,
  month = oct,
  publisher = ACM,
  address = NY
}
                  

@Techreport{Findler-Latendresse-Felleisen01,
  Author =	 {Robert Bruce Findler and Mario Latendresse and
                  Matthias Felleisen},
  Title =	 {Object-Oriented Programming Languages Need
                  Well-Founded Contracts},
  Institution =	 {Department of Computer Science, Rice University},
  Year =	 {2001},
  Address =	 {Houston, TX},
  Number =	 {CS TR01-372}
}

@InProceedings{Findler-Latendresse-Felleisen01a,
 author = {Robert Bruce Findler and Mario Latendresse and Matthias Felleisen},
 title = {Behavioral contracts and behavioral subtyping},
 booktitle = {Proceedings of the 8th European software engineering conference held jointly with 9th ACM SIGSOFT international symposium on Foundations of software engineering},
 series = {ESEC/FSE-9},
 year = {2001},
 isbn = {1-58113-390-1},
 location = {Vienna, Austria},
 pages = {229--236},
 numpages = {8},
 url = {http://doi.acm.org/10.1145/503209.503240},
 doi = {http://doi.acm.org/10.1145/503209.503240},
 acmid = {503240},
 publisher = {ACM},
 address = {New York, NY, USA},
}

@Article{Finkelstein-etal94,
  author =	 {Anthony C. W. Finkelstein and Dov Gabbay and Anthony
                  Hunter and Jeff Kramer and Bashar Nuseibeh},
  title =	 {Inconsistency Handling in Multiperspective
                  Specifications},
  journal =	 IEEETSE,
  year =	 1994,
  volume =	 20,
  number =	 8,
  month =	 aug,
  pages =	 {569-578},
  annote =	 {40 references.}
}
                  
@Article{Finney96,
  author =	 "Kate Finney",
  title =	 "Mathematical Notation in Formal Specification: Too
                  Difficult for the Masses?",
  journal =	 IEEETSE,
  year =	 1996,
  volume =	 22,
  number =	 2,
  pages =	 "158-159",
  month =	 feb,
  annote =	 "A preliminary experiment indicating that the
                  symbolic notation in Z specifications may make them
                  hard to read. 8 references."
} 

@article{Fischer-Schumann03,
   author = "B. Fischer and J. Schumann",
   title = "Generating Data Analysis Programs from Statistical Models",
   journal = "Journal of Functional Programming",
   volume = 13,
   number = 3,
   pages = "483-508",
   year = 2003
}

@Article{Fischer87,
  Author =	 "Gerhard Fischer",
  Title =	 "Cognitive View of Reuse and Redesign",
  Journal =	 "IEEE Software",
  Volume =	 4,
  Number =	 4,
  Month =	 jul,
  Year =	 1987,
  Pages =	 "60-72",
  Annote =	 "Tools based on Objtalk and WLisp. 10 references."
}

@TechReport{Fisher-Barringer86,
  Author =	 "Michael Fisher and Howard Barringer",
  Title =	 "Program Logics -- A Short Survey",
  Institution =	 "Department of Computer Science, University of Manchester",
  Address =	 "Manchester M13 9PL, England",
  Number =	 "UMCS-86-11-1",
  Month =	 nov,
  Year =	 1986,
  Note =	 "Revised June 1987",
  Annote =	 "About a hundred references."
}

@TechReport{Fisher87,
  Author =	 "Michael Fisher",
  Title =	 "Temporal Logics for Abstract Semantics",
  Institution =	 "Department of Computer Science, University of
                  Manchester",
  Address =	 "Manchester M13 9PL, England",
  Number =	 "UMCS-86-12-4",
  Year =	 1987,
  Note =	 "The Author's Ph. D. dissertation",
  Annote =	 "About a hundred references."
}

@Book{Fitting-Gries90,
  Editor =	 "Melvin Fitting and David Gries",
  Title =	 "First-order logic and automated theorem proving",
  Publisher =	 SV,
  Year =	 1990,
  Series =	 "Texts and monographs in computer science.",
  Address =	 NY
}

@TechReport{Fitzgerald-Jones90,
  Author =	 "John S. Fitzgerald and Cliff B. Jones",
  Title =	 "Modularizing the Formal Description of a Database
                  System",
  Institution =	 "Department of Computer Science, University of
                  Manchester",
  Address =	 "Manchester M13 9PL, England",
  Month =	 jan,
  Year =	 1990,
  Number =	 "UMCS-90-1-1",
  Annote =	 "20 references."
}

@Book{Fitzgerald-Larsen98,
  author =	 {John Fitzgerald and Peter Gorm Larsen},
  title =	 {Modelling Systems: Practical Tools in Software
                  Development},
  publisher =	 {Cambridge},
  year =	 1998,
  address =	 {Cambridge, UK},
  annote =	 {Uses VDM-SL. 16 references.}
}

@Book{Fitzgerald-etal05,
  author = 	 {J. S. Fitzgerald and P. G. Larsen and P. Mukherjee and N. Plat and M. Verhoef},
  title = 	 {Validated Designs for Object-Oriented Systems},
  publisher = 	 SV,
  year = 	 2005,
  address = 	 {London}
}

@InCollection{Fitzgerald08,
  author = 	 {John Fitzgerald},
  title = 	 {The Typed Logic of Partial Functions and the {Vienna Development Method}},
  crossref =  {Bjorner-Henson08},
  pages = 	 {453-487},
  annote = 	 {51 references.}
}

@inproceedings{Flanagan-Godefroid05,
 author = {Cormac Flanagan and Patrice Godefroid},
 title = {Dynamic Partial-order Reduction for Model Checking Software},
 booktitle = {Proceedings of the 32nd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages},
 series = {POPL '05},
 year = 2005,
 isbn = {1-58113-830-X},
 location = {Long Beach, California, USA},
 pages = {110-121},
 numpages = 12,
 url = {http://doi.acm.org/10.1145/1040305.1040315},
 doi = {10.1145/1040305.1040315},
 acmid = 1040315,
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {partial-order reduction, software model checking},
}

@InProceedings{Flanagan-Leino01,
  author =	 {Cormac Flanagan and K. Rustan M. Leino},
  title =	 {Houdini, an annotation assistant for {ESC/Java}},
  booktitle =    "FME 2001: Formal Methods for Increasing Software
                 Productivity",
  volume =	 2021,
  series =	 LNCS,
  editor =       {Jos\'{e} Nuno Oliveira and Pamela Zave},
  publisher =	 SV,
  month =        mar,
  year =	 2001,
  URL =          {http://www.springerlink.com/content/nxukfdgg7623q3a9},
  pages =	 {500-517}
}

@InProceedings{Flanagan-etal02,
  author =	 "Cormac Flanagan and K. Rustan M. Leino and Mark
                  Lillibridge and Greg Nelson and James B. Saxe and
                  Raymie Stata",
  title =	 "Extended static checking for {Java}",
  pages =	 "234-245",
  booktitle =	 "Proceedings of the {ACM} {SIGPLAN} 2002 Conference
                  on Programming Language Design and Implementation
                  ({PLDI}'02)",
  month =	 jun,
  series =	 "SIGPLAN",
  volume =	 "37(5)",
  publisher =	 ACM,
  address =	 NY,
  year =	 2002,
  URL =          {http://doi.acm.org/10.1145/512529.512558},
  annote =	 "50 references."
} 

@InProceedings{Flanagan06,
  author =	 "Cormac Flanagan",
  title =	 "Hybrid Type Checking",
  booktitle =	 "Proceedings of the 33th {ACM} {SIGPLAN}-{SIGACT}
                  Symposium on Principles of Programming Languages
                  ({POPL} 06)",
  pages =        "245-256",
  month =	 jan,
  series =	 SIGPLAN,
  volume =	 "41, 1",
  publisher =	 "ACM Press",
  address =	 "New York",
  year =	 2006,
  annote =     "45 references."
}

@TechReport{Flon-Cooprider82,
  Author =	 "Lawrence Flon and Lee W. Cooprider",
  Title =	 "Metaprogramming --- Prospects for the Practical
                  Reuse of Software",
  Institution =	 "Computer Science Department, University of Southern
                  California",
  Address =	 "Los Angeles, Calif.",
  Number =	 "TR-112",
  Year =	 1982,
  Month =	 jun,
  Annote =	 "12 references."
}

@InCollection{Florijn-Meijers-vanWinsen97,
  author =	 {Gert Florijn and Marco Meijers and Pieter van
                  Winsen},
  title =	 {Tool Support for Object-Oriented Patterns},
  booktitle =	 {ECOOP '97 --- Object-Oriented Programming 11th
                  European Conference, Jyv\"{a}skyl\"{a}, Finland},
  publisher =	 SV,
  year =	 1997,
  editor =	 {Mehmet Ak\c{s}it and Satoshi Matsuoka},
  volume =	 1241,
  series =	 LNCS,
  address =	 NY,
  month =	 jun,
  pages =	 {472-495},
  annote =	 {8 references.}
}

@Article{Floyd67,
  Author =	 "R. W. Floyd",
  Title =	 "Assigning Meanings to Programs",
  Journal =	 "Proceedings Symposium on Applied Mathematics",
  Publisher =	 "American Mathematical Society",
  Address =	 "New York",
  Volume =	 19,
  Pages =	 "19-31",
  Year =	 1967
}

@Article{Fong-Cameron98,
  author =	 {Philip W. L. Fong Fong and Robert D. Cameron},
  title =	 {Proof Linking: An Architecture for Modular
                  Verification of Dynamically-Linked Mobile Code},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 6,
  month =	 nov,
  pages =	 {222-230},
  note =	 {Proceedings of the ACM SIGSOFT Sixth Internatioal
                  Symposium on the Foundations of Software
                  Engineering},
  annote =	 {19 references.}
}

@InProceedings{Forax-Duris-Roussel00,
  Author =	 {R\'{e}mi Forax and Etienne Duris and Gilles Roussel},
  Title =	 {{Java} Multi-Method Framework},
  BookTitle =	 {International Conference on Technology of
                  Object-Oriented Languages and Systems (TOOLS '00),
                  Sydney, Australia},
  Publisher =	 {IEEE Computer Society Press},
  address =	 {Los Alamitos, California},
  Month =	 nov,
  Year =	 2000
}

@Book{Fowler99,
  author =	 "Martin Fowler",
  title =	 "Refactoring: Improving the Design of Existing Code",
  publisher =	 "Addison-Wesley",
  ISBN =	 "0201485672",
  year =	 1999,
  month =	 aug
}

@Article{Frakes-Isoda94,
  author =	 {William Frakes and Sadahiro Isoda},
  title =	 {Success Factors for Systematic Reuse},
  journal =	 {IEEE Software},
  year =	 1994,
  volume =	 11,
  number =	 5,
  month =	 sep,
  pages =	 {15-19},
  annote =	 {More than 12 references.}
}

@Article{Frakes-Terry96,
  author =	 {William Frakes and Carol Terry},
  title =	 "Software Reuse: Metrics and Models",
  journal =	 ACMCS,
  volume =	 28,
  number =	 2,
  pages =	 "415-435",
  month =	 jun,
  year =	 1996,
  annote =	 "40 references."
}

@Article{France-Bruel-Larrondo-Petrie97,
  author =	 {R. B. France and J.-M. Bruel and
                  M. M. Larrondo-Petrie},
  title =	 {An Integrated Object-Oriented and Formal Model
                  Environment},
  journal =	 JOOP,
  year =	 1997,
  volume =	 10,
  number =	 7,
  month =	 nov,
  pages =	 {25-34},
  annote =	 {15 references.}
}

@InProceedings{France-Larrondo-Petrie94,
  author =	 "Robert B. France and Maria M. Larrondo-Petrie",
  title =	 "From Structured Analysis to Formal Specifications:
                  State of the Theory",
  pages =	 "249-256",
  booktitle =	 "Proceedings of the ACM Computer Science Conference,
                  Phoenix, AZ",
  year =	 1994,
  organization = "ACM",
  month =	 mar,
  annote =	 "15 references."
}

@InCollection{France-Larrondo-Petrie95,
  author =	 "Robert B. France and Maria M. Larrondo-Petrie",
  title =	 "A Two-Dimensional View of Integrated Formal and
                  Informal Specifications Techniques",
  editor =	 "Jonathan P. Bowen and Michael G. Hinchey",
  Series =	 LNCS,
  Volume =	 967,
  pages =	 "434-448",
  booktitle =	 "ZUM '95: The Z Formal Specification Notation, 9th
                  International Conference of Z Users, Limerick,
                  Ireland",
  month =	 sep,
  year =	 1995,
  publisher =	 SV,
  annote =	 "17 references."
}

@TechReport{France-etal93,
  Author =	 "R. B. France and T. B. Horton and
                  M.M. Larrondo-Petrie and S. Reeves",
  Title =	 "Towards Process Support for Rigorous Structured
                  Analysis",
  Institution =	 "Florida Atlantic University",
  Year =	 1993,
  Number =	 "TR-CSE-93-45",
  Address =	 "Department of Computer Science and Engineering,
                  Florida Atlantic University, Boca Raton, FL
                  33431-0991",
  Month =	 sep,
  Annote =	 "5 references."
}

@Article{France92,
  Author =	 "Robert B. France",
  Title =	 "Semantically Extended Data Flow Diagrams: A Formal
                  Specification Tool",
  Journal =	 IEEETSE,
  Year =	 1992,
  Volume =	 18,
  Number =	 4,
  Month =	 apr,
  Pages =	 "329-346",
  Annote =	 "Method for associating a DFD with a formal
                  specification. Formal part based on algebraic
                  specifications. 24 references."
}

@Article{France93,
  Author =	 "R. B. France",
  Title =	 " A predicative basis for structured analysis
                  specification tools",
  Journal =	 "Information and Software Technology",
  Year =	 1993,
  Volume =	 35,
  Number =	 2,
  Month =	 feb,
  Pages =	 "67-77",
  Annote =	 "14 references."
}

@Article{Francez77,
  Author =	 "Nissim Francez",
  Title =	 "A Case For A Forward Predicate Transformer",
  Journal =	 "Information Processing Letters",
  Year =	 1977,
  Volume =	 6,
  Number =	 6,
  Month =	 dec,
  Pages =	 "196-198",
  Annote =	 "3 references."
}

@Book{Francez92,
  Title =	 "Program Verification",
  Author =	 "Nissim Francez",
  Publisher =	 Addison-Wesley,
  Address =	 "Cambridge, UK",
  Year =	 1992,
  Annote =	 "173 references."
}

@InProceedings{Franch97,
  author =	 {Xavier Franch},
  title =	 {The Convenience for a Notation to Express
                  Non-Functional Charateristics of Software Compoents},
  booktitle =	 {Foundations of Component-Based Systems Workshop},
  editor =	 {Gary T. Leavens and Murali Sitaraman},
  year =	 1997,
  month =	 sep,
  pages =	 {101-110},
  note =	 {Available from
                  http://www.cs.iastate.edu/\verb|~|leavens/FoCBS.},
  annote =	 {22 references.}
}

@Article{Frankl-Iakounenko98,
  author =	 {Phyllis G. Frankl and Oleg Iakounenko},
  title =	 {Further Empirical Studies of Test Effectiveness},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 6,
  month =	 nov,
  pages =	 {153-162},
  note =	 {Proceedings of the ACM SIGSOFT Sixth Internatioal
                  Symposium on the Foundations of Software
                  Engineering},
  annote =	 {11 references.}
}

@inproceedings{Fraser-Arcuri11,
author = {Gordon Fraser and Andrea Arcuri},
title = {{EvoSuite}: Automatic Test Suite Generation for Object-Oriented Software},
year = {2011},
isbn = {9781450304436},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/2025113.2025179},
doi = {10.1145/2025113.2025179},
abstract = {To find defects in software, one needs test cases that execute the software systematically, and oracles that assess the correctness of the observed behavior when running these test cases. This paper presents EvoSuite, a tool that automatically generates test cases with assertions for classes written in Java code. To achieve this, EvoSuite applies a novel hybrid approach that generates and optimizes whole test suites towards satisfying a coverage criterion. For the produced test suites, EvoSuite suggests possible oracles by adding small and effective sets of assertions that concisely summarize the current behavior; these assertions allow the developer to detect deviations from expected behavior, and to capture the current behavior in order to protect against future defects breaking this behavior.},
booktitle = {Proceedings of the 19th ACM SIGSOFT Symposium and the 13th European Conference on Foundations of Software Engineering},
pages = {416–419},
numpages = {4},
keywords = {assertion generation, search based soft- ware testing, test case generation},
location = {Szeged, Hungary},
series = {ESEC/FSE '11}
}

@Article{Fraser-Kumar-Vaishnavi91,
  Author =	 "M. D. Fraser and K. Kumar and V. K. Vaishnavi",
  Title =	 "Informal and Foraml Requirements Specification
                  Languages: Bridging the Gap",
  Journal =	 IEEETSE,
  Year =	 1991,
  Volume =	 17,
  Number =	 5,
  Month =	 may,
  Pages =	 "454-466",
  Annote =	 "45 references."
}

@Article{Fraser-Kumar-Vaishnavi94,
  Author =	 "M. D. Fraser and K. Kumar and V. K. Vaishnavi",
  Title =	 "Strategies for Incorporating Formal Specifications
                  in Software Development",
  Journal =	 CACM,
  Year =	 1994,
  Volume =	 37,
  Number =	 10,
  Month =	 oct,
  Pages =	 "74-86",
  Annote =	 "Survey of formal, semiformal, and informal
                  specification techniques, and processes for using
                  formal methods. Good discussion of related work. 25
                  references."
}

@TechReport{Fraser-Lamb88,
  Author =	 "Bruce P. Fraser and David Alex Lamb",
  Title =	 "An Annotated Bibliography on User Interface Design",
  Institution =	 "Department of Computing and Information Science,
                  Queen's University at Kingston",
  Address =	 "Kingston, Ontario, Canada",
  Month =	 jan,
  Year =	 1988,
  Type =	 "External Technical Report",
  Number =	 "88-214",
  Annote =	 "Coverage up to May 1987. Around a hundred
                  references."
}

@Book{Freeman-Lewis80,
  Editor =	 "Herbert Freeman and Philip M. Lewis II",
  Title =	 "Software Engineering",
  Publisher =	 "Academic Press, Inc.",
  Address =	 NY,
  Year =	 1980
}

@Article{Freitag-Margaria-Steffen94,
  Author =	 "Burkhard Freitag and Tiziana Margaria and Berhard
                  Steffen",
  Title =	 "A Pragmatic Approach to Software Synthesis",
  Journal =	 SIGPLAN,
  Year =	 1994,
  Volume =	 29,
  Number =	 8,
  Month =	 aug,
  Pages =	 "46-58",
  Annote =	 "19 references."
}

@InProceedings{Freitas-Cavalcanti-Woodcock06,
  author = 	 {Leo Freitas and Ana Cavalcanti and Jim Woodcock},
  title = 	 {Taking Our Own Medicine: Applying the Refinement Calculus to State-Rich Refinement Model Checking},
  booktitle =	 {Formal Methods and Software Engineering: 8th International Conference on Formal Engineering Methods (ICFEM)},
  pages =	 {697-716},
  year =	 2006,
  editor =	 {Zhiming Liu and He Jifeng},
  volume =	 4260,
  series =	 LNCS,
  address =	 NY,
  month =	 nov,
  publisher =	 SV,
  annote =	 {231 references.}
}

@InProceedings{Frick-Neumann-Zimrmann96,
  author =	 {A. Frick, W. Neumann, and W. Zimmermann},
  title =	 {A Method for the Construction of Robust Class
                  Hierarchies},
  booktitle =	 {WOON '96},
  year =	 1996
}

@InProceedings{Frick-Neumann-Zimrmann97,
  author =	 {A. Frick, W. Neumann, and W. Zimmermann},
  title =	 {Generation of Robust Class Hierarchies},
  booktitle =	 {TOOLS 23 - Technology of Object-Oriented
                  Programming},
  year =	 1997,
  pages =	 {282-291}
}

@InProceedings{Frick-Zimmer-Zimrmann95,
  author =	 {A. Frick, W. Zimmer, and W. Zimmermann},
  title =	 {On the Design of Reliable Libraries},
  booktitle =	 {TOOLS 17 - Technology of Object-Oriented
                  Programming},
  year =	 1995,
  pages =	 {13-23}
}

@InProceedings{Froehlich-Larsen96,
  author =	 {Brigette Fr\"ohlich and Peter Gorm Larsen},
  title =	 "Combining {VDM-SL} Specifications with {C++} Code",
  editor =	 "Marie-Claude Gaudel and James Woodcock",
  volume =	 1051,
  series =	 LNCS,
  pages =	 "179-194",
  booktitle =	 "FME '96: Industrial Benefit and Advances in Formal
                  Methods",
  year =	 1996,
  publisher =	 SV,
  address =	 NY,
  month =	 mar,
  annote =	 "28 references."
}

@InProceedings{Froehlich-Link00,
  author =	 {Peter Fr\"{o}hlich and Johannes Link},
  title =        {Automated Test Case Generation from Dynamic Models},
  editor =       {Elisa Bertino},
  booktitle =    {ECOOP 2000 -- Object-Oriented Programming 14th European Conference},
  series =       LNCS,
  volume =       1850,
  year =         2000,
  pages =        {472-491},
  annote =       {Uses use cases to derive tests.  21 references.}
}

@Inproceedings{Froehlich-etal97,
 author = {Gary Froehlich and H. James Hoover and Ling Liu and Paul Sorenson},
 title = {Hooking into object-oriented application frameworks},
 booktitle = {ICSE '97: Proceedings of the 19th International Conference on
Software Engineering},
 year = {1997},
 isbn = {0-89791-914-9},
 pages = {491-501},
 location = {Boston, Massachusetts, United States},
 doi = {http://doi.acm.org/10.1145/253228.253432},
 publisher = ACM,
 address = {New York, NY, USA},
 }

@article{Fuchs92,
  author =	 {Norbert E. Fuchs},
  title =	 {Specifications are (preferably) executable},
  journal =	 {Software Engineering Journal},
  year =	 {1992},
  month =	 sep,
  volume =	 {7},
  number =	 {5},
  pages =	 {323-334},
  annote =	 {41 references.}
}

@InProceedings{Futatsugi-etal85,
  Author =	 "Kokichi Futatsugi and Joseph A. Goguen and
                  Jean-Pierre Jouannaud and Jose Meseguer",
  Title =	 "Principles of {OBJ2}",
  BookTitle =	 "Conference Record of the Twelfth Annual ACM
                  Symposium on Principles of Programming Languages",
  Year =	 1985,
  Pages =	 "52-66",
  Organization = ACM,
  Month =	 jan,
  Annote =	 "42 references."
}

@TechReport{GAO04,
  author =	 {United States Government Accounting Office},
  title =	 {Defense Acquisitions: Stronger Management Practices Are Needed to Improve {DOD}'s Software-Intensive Weapon Acquisitions},
  URL = {\url{http://www.gao.gov/new.items/d04393.pdf}},
  month =	 mar,
  number = {GAO-04-393},
  year =	 2004,
  institution =  {GAO},
  address =	 {Washington, D.C.},
}

@Book{Gabriel96,
  author =	 {Richard Gabriel},
  title =	 {Patterns of Software: Tales from the Software
                  Community},
  publisher =	 {Oxford University Press},
  year =	 1996,
  address =	 NY,
  annote =	 "Many references."
}

@Article{Gabrielian-Franklin91,
  Author =	 "Armen Gabrielian and Matthew K. Franklin",
  Title =	 "Mulitlevel specification of Real-Time Systems",
  Journal =	 CACM,
  Year =	 1991,
  Volume =	 "34",
  Number =	 "5",
  Month =	 may,
  Pages =	 "50-60",
  Annote =	 "15 references."
}

@Article{Gallagher-Narasimhan97,
  author =	 {Matthew J. Gallagher and V. Lakshmi Narasimhan},
  title =	 {{ADTEST}: A Test Data Generation Suite for Ada
                  Software Systems},
  journal =	 IEEETSE,
  year =	 1997,
  volume =	 23,
  number =	 8,
  month =	 aug,
  pages =	 {473-484},
  annote =	 {15 references.}
}

@InCollection{Gamma-etal93,
  Author =	 "E. Gamma and R. Helm and R. E. Johnson and
                  J. Vlissides",
  Title =	 "Design Patterns: Abstraction and Reuse of
                  Object-Oriented Design",
  BookTitle =	 "ECOOP '93 - Object-Oriented Programming 7th European
                  Conference, Germany, July 1993. Proceedings",
  Publisher =	 SV,
  Address =	 NY,
  Editor =	 "Oscar M. Nierstrasz",
  Series =	 LNCS,
  Year =	 1993,
  Number =	 707,
  Pages =	 "406-431",
  Annote =	 "32 references"
}

@Book{Gamma-etal95,
  Author =	 "Erich Gamma and Richard Helm and Ralph Johnson and
                  John Vlissides",
  Title =	 "Design Patterns: Elements of Reusable
                  Object-Oriented Software",
  Publisher =	 "Addison-Wesley",
  Address =	 "Reading, Mass.",
  Year =	 1995,
  Annote =	 "Over 50 references."
}

@Book{Gane-Sarson78,
  author =	 "C. Gane and E. Sarson",
  title =	 "Structured Systems Analysis: tools and techniques",
  publisher =	 "Prentice-Hall",
  year =	 1978
}

@InCollection{Gangopadhyay-Mitra93,
  Author =	 "Dipayan Gangopadhyay and Subrata Mitra",
  Title =	 "ObjChart: Tangible Specification of Reactive Object
                  Behaviour",
  Journal =	 LNCS,
  Publisher =	 SV,
  Address =	 NY,
  Editor =	 "Oscar M. Nierstrasz",
  Number =	 707,
  Year =     1993,
  Booktitle =	 "ECOOP '93 - Object-Oriented Programming 7th European
                  Conference",
  Pages =	 "432-457",
  Annote =	 "20 references"
}

@Article{Gannon-Hamlet-Mills87,
  Author =	 "John D. Gannon and Richard G. Hamlet and Harlan
                  D. Mills",
  Title =	 "Theory of Modules",
  Journal =	 IEEETSE,
  Volume =	 "SE-13",
  Number =	 7,
  Month =	 jul,
  Year =	 1987,
  Pages =	 "820-829",
  Annote =	 "The functional method of program proof. Concrete and
                  abstract domains are sets of states (mappings from
                  variables to values). 8 references."
}

@Book{Gannon-Purtilo-Zelkowitz94,
  author =	 "John D. Gannon and James M. Purtilo and Marvin
                  V. Zelkowitz",
  title =	 "Software Specification: A Comparison of Formal
                  Methods",
  publisher =	 "Ablex Publishing Co.",
  year =	 1994,
  address =	 "355 Chestnut Street, Norwood, NJ 07648",
  annote =	 "Also includes predicate transformer and denotational
                  semantics. 64 references."
}

@InCollection{Gardiner-Martin-Moore93,
  Author =	 "Paul Gardiner and Clare Martin and Oege de Moor",
  Title =	 "An Algebraic Construction of Predicate Transformers",
  BookTitle =	 "Mathematics of Program Construction, Second
                  International Conference, Oxford, U.K.",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "R.S. Bird and C.C. Morgan and J.C.P. Woodcock",
  Series =	 LNCS,
  Volume =	 669,
  Pages =	 "100-121",
  Address =	 NY,
  Month =	 "June/July",
  Annote =	 "27 references."
}

@InCollection{Gardiner-Morgan91,
  author =	 {P. H. B. Gardiner and Caroll Morgan},
  title =	 {Data Refinement of Predicate Transformers},
  booktitle =	 {On the Refinement Calculus},
  Publisher =	 SV,
  Year =	 1994,
  Editor =	 "Carroll Morgan and Trevor Vickers",
  Series =	 "Formal approaches of computing and information
                  technology series",
  Address =	 NY,
  Annote =	 "62 references.",
  Crossref =	 {Morgan-Vickers94},
  Pages =	 {71-84}
}

@InCollection{Gardiner-Morgan92,
  author =	 {P. H. B. Gardiner and Caroll Morgan},
  title =	 {A Single Complete Rule for Data Refinement},
  booktitle =	 {On the Refinement Calculus},
  Publisher =	 SV,
  Year =	 1994,
  Editor =	 "Carroll Morgan and Trevor Vickers",
  Series =	 "Formal approaches of computing and information
                  technology series",
  Address =	 NY,
  Annote =	 "62 references.",
  Crossref =	 {Morgan-Vickers94},
  Pages =	 {111-126}
}

@Article{Garlan-Gulch-Tomayko97,
  author =	 {David Garlan and David P. Gulch and James
                  E. Tomayko},
  title =	 {Agents of Change: Educating Software Engineering
                  Leaders},
  journal =	 {Computer},
  year =	 1997,
  volume =	 30,
  number =	 11,
  month =	 nov,
  pages =	 {59-65},
  annote =	 {CMU's MS in SE program. 8 references.}
}

@Article{Garlan-Kaiser-Notkin92,
  Author =	 "David Garlan and Gail E. Kaiser and David Notkin",
  Title =	 "Usign Tool Abstraction to Compose Systems",
  Journal =	 "Computer",
  Year =	 1992,
  Volume =	 25,
  Number =	 6,
  Month =	 jun,
  Pages =	 "30-38",
  Annote =	 "7 references."
}

@InCollection{Garlan-Monroe-Wile00,
  Author =	 "David Garlan and Robert T. Monroe and David Wile",
  Title =	 "Acme: Architectural Description of Component-Based
                  Systems",
  BookTitle =	 {Foundations of Component-Based Systems},
  Editor =	 {Gary T. Leavens and Murali Sitaraman},
  Year =	 2000,
  Publisher =	 {Cambridge University Press},
  Address =	 NY,
  ISBN =	 {0-521-77164-1},
  Chapter =	 3,
  Pages =	 "47-67",
  Annote =	 "26 references."
}

@InProceedings{Garlan-Notkin91,
  title =	 "Formalizing Design Spaces: Implicit Invocation Mechanisms",
  author =	 "D. Garlan and D. Notkin",
  booktitle =	 "VDM 91: Formal Software Development Methods 4th
                  International Symposium of VDM Europe
                  Noordwijkerhout, The Netherlands, Volume 1:
                  Conference Contributions",
  pages =	 "31-44",
  year =	 "1991",
  month =	 oct,
  editor =	 "S. Prehn and W. J. Toetenel",
  series =	 LNCS,
  publisher =	 SV,
  volume =	 "551"
}

@Article{Garlan90,
  Author =	 "David Garlan",
  Title =	 "The Role of Formal Reusable Frameworks",
  Journal =	 SIGSOFT,
  Year =	 1990,
  Volume =	 15,
  Number =	 4,
  Month =	 sep,
  Pages =	 "42-44",
  Note =	 "Proceedings of the ACM SIGSOFT: International
                  Workshop on Formal Methods in Software Development,
                  Mark Moriconi (editor).",
  Annote =	 "7 references."
}

@Article{Garland-Guttag-Horning90,
  Author =	 "Stephen J. Garland and John V. Guttag and James
                  J. Horning",
  Title =	 "Debugging {Larch Shared Language} Specifications",
  Journal =	 IEEETSE,
  Volume =	 16,
  Number =	 6,
  Month =	 sep,
  Year =	 1990,
  Pages =	 "1044-1057",
  Annote =	 "19 references."
}

@TechReport{Garland-Guttag-Horning90b,
  Author =	 "Stephen J. Garland and John V. Guttag and James
                  J. Horning",
  Title =	 "Debugging Larch Shared Language Specifications",
  Institution =	 DECSRC,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Month =	 jul,
  Year =	 1990,
  Number =	 60,
  Note =	 "Revised and expanded from paper presented at the
                  April 1990 IFIP TC2/WG2.2/WG2.3 Working Conference
                  on Programming Concepts and Methods, Elsevier, 1990",
  Annote =	 "19 references."
}

@InProceedings{Garland-Guttag88,
  Author =	 "Stephen J. Garland and John V. Guttag",
  Title =	 "Inductive Methods for Reasoning about Abstract Data
                  Types",
  BookTitle =	 "Conference Record of the Fifteenth Annual ACM
                  Symposium on Principles of Programming Languages,
                  San Diego, Calif.",
  Organization = ACM,
  Month =	 jan,
  Year =	 1988,
  Pages =	 "219-228",
  Annote =	 "Questions the utility of inductionless induction. 25
                  references."
}

@TechReport{Garland-Guttag91,
  Author =	 "Stephen J. Garland and John V. Guttag",
  Title =	 "A Guide to LP, The Larch Prover",
  Institution =	 DECSRC,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Month =	 dec,
  Year =	 1991,
  Number =	 82,
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "32 references."
}

@unpublished{Garrigue00,
	Author = {Jacques Garrigue},
	Note = {In \emph{Workshop on Foundations of Software Engineering, Sassaguri, Japan}. Available from \url{http://wwwfun.kurims.kyoto-u.ac.jp/~garrigue/papers/fose2000.html}},
	Title = {Code reuse through polymorphic variants},
	Url = {http://wwwfun.kurims.kyoto-u.ac.jp/~garrigue/papers/fose2000.html},
	Year = {2000}
}

@InProceedings{Gates-etal01,
  author =	 {A. Q. Gates and S. Roach and O. Mondragon and
                  N. Delgado},
  title =	 {{DynaMICs}: Comprehensive Support for Run-Time
                  Monitoring},
  BookTitle =	 {Workshop on Runtime Verification held in conjunction
                  with the 13th Conference on Computer Aided
                  Verification, CAV'01},
  year =	 2001,
  Note =	 {Published in {\em Electronic Notes in Theoretical
                  Computer Science}, K. Havelund and G. Rosu (eds.),
                  55(2), 2001. Available from \url{www.sciencedirect.com}.}
}

@Article{Gazzola-Micucci-Mariani17,
  title={Automatic software repair: A survey},
  author={Luca Gazzola and Daniela Micucci and Leonardo Mariani},
  journal={IEEE Transactions on Software Engineering},
  volume=45,
  number=1,
  pages={34--67},
  year=2017,
  publisher={IEEE}
}

@Book{Gehani-McGettrick86,
  Editor =	 "N. Gehani and A.D. McGettrick",
  Title =	 "Software specification techniques",
  Publisher =	 "Addison-Wesley",
  Year =	 1986,
  Annote =	 "Dated collection of 21 papers on formal
                  specification."
}

@Article{Geller78,
  Author =	 "Matthew Geller",
  Title =	 "Test Data as an Aid in Proving Program Correctness",
  Journal =	 CACM,
  Year =	 1978,
  Volume =	 21,
  Number =	 5,
  Month =	 may,
  Pages =	 "368-375",
  Annote =	 "Divides input into classes such that, if some member
                  of each class gives a correct answer when tested,
                  then every member of that class gives the correct
                  answer. 20 references."
}

@TechReport{George-Bruun94,
  Author =	 "Chris George and Peter Michael Bruun",
  Title =	 "Proposed Changes to RSL",
  Institution =	 "Computer Resources Internation A/S",
  Year =	 1994,
  Address =	 "Bregneroedvej 144, P. O. Box 173, Dk-3460 Birkeroed,
                  Denmark",
  Month =	 apr,
  Annote =	 "0 references."
}

@InCollection{George-Haxthausen08,
  author = 	 {Chris George and Anne E. Haxthausen},
  title = 	 {The Logic of the {RAISE} Specification Language},
  crossref =  {Bjorner-Henson08},
  pages = 	 {349-399},
  annote = 	 {43 references.}
}

@TechReport{George-Prehn91,
  Author =	 "Chris George and Soren Prehn",
  Title =	 "The {RAISE} Justification Handbook (Draft)",
  Institution =	 "Computer Resources International A/S",
  Year =	 1991,
  Number =	 "LACOS/CRI/DOC/7/V2",
  Address =	 "Denmark",
  Month =	 nov,
  Annote =	 "Formal proof rules to be used in RAISE
                  justifications."
}

@TechReport{George-etal91,
  Author =	 "Chris George and Peter Haff and Klaus Havelund and
                  Anne E. Haxthausen and Robert Milne and Claus Bendix
                  Nielsen and Soren Prehn and Kim Ritter Wagner",
  Title =	 "The {RAISE} Specification Language",
  Institution =	 "Computer Resources International A/S",
  Year =	 1991,
  Number =	 "CRI/RAISE/DOC/1/v3",
  Address =	 "Denmark",
  Month =	 nov,
  Note =	 "To appear as a book, published by Prentice-Hall.",
  Annote =	 "52 references."
}

@TechReport{George91,
  Author =	 "Chris George",
  Title =	 "The {RAISE} Specification Language: A Tutorial",
  Institution =	 "Computer Resources International A/S",
  Year =	 1991,
  Number =	 "LACOS/CRI/CWG/24/V1",
  Address =	 "Denmark",
  Month =	 aug,
  Note =	 "To appear in VDM '91",
  Annote =	 "4 references."
}

@TechReport{George94,
  Author =	 "Chris George",
  Title =	 "Adopted changes to RSL",
  Institution =	 "Computer Resources Internation A/S",
  Year =	 1994,
  Address =	 "Bregneroedvej 144, P. O. Box 173, Dk-3460 Birkeroed,
                  Denmark",
  Month =	 apr,
  Annote =	 "0 references."
}

@Article{Gerhart-Craigen-Ralston94,
  Author =	 "Susan Gerhart and Dan Craigen and Ted Ralston",
  Title =	 "Experiance with Formal Methods in Critical Systems",
  Journal =	 "IEEE Software",
  Volume =	 11,
  Number =	 1,
  Month =	 jan,
  Year =     1994,
  Pages =	 "21-28",
  Annote =	 "7 references"
}

@TechReport{German-Clarke-Halpern88,
  Author =	 "Steven M. German and Edmund M. Clarke and Joseph
                  Y. Halpern",
  Title =	 "Reasoning about Procedures as Parameters in the
                  Language L4",
  Institution =	 "GTE Laboratories, Inc.",
  Address =	 "Waltham, Mass.",
  Month =	 oct,
  Year =	 1988,
  Note =	 "To appear in {\em Information and Computation}",
  Annote =	 "25 references."
}

@InProceedings{German78,
  author =	 "Steven M. German",
  title =	 "Automating Proofs of the Absence of Common Runtime
                  Errors",
  pages =	 "105-118",
  booktitle =	 "Conference record of the Fifth Annual ACM Symposium
                  on Principles of Programming Languages",
  year =	 1978,
  publisher = ACM,
  address =      NY,
  month =	 jan,
  annote =	 "18 references."
}

@misc{Gerogiou-Gleiss-Kovacs20,
      title={Trace Logic for Inductive Loop Reasoning}, 
      author={Pamina Georgiou and Bernhard Gleiss and Laura Kovács},
      year={2020},
      eprint={2008.01387},
      archivePrefix={arXiv},
      primaryClass={cs.LO},
      url={https://arxiv.org/abs/2008.01387}
}

@InCollection{Ghezzi-Felder-Bellettini93,
  Author =	 "C. Ghezzi and M. Felder and C. Bellettini",
  Title =	 "Real-Time Systems: A Survey of Approaches to Formal
                  Specification and Verification",
  Journal =	 LNCS,
  Number =	 717,
  Editor =	 "Ian Sommerville and Manfred Paul",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1993,
  Booktitle =	 "Software Engineering= ESEC '93. 4th European
                  Software Engineering Conference",
  Page =	 "11-36",
  Annote =	 "33 references"
}

@Book{Ghezzi-Jazayeri-Mandrioli03,
  author =	 {Carlo Ghezzi and Mehdi Jazayeri and Dino Mandrioli},
  title =	 {Fundamentals of Software Engineering},
  publisher =	 {Prentice Hall},
  year =	 2003,
  edition =	 {Second edition},
  annote =	 {Many references.}
}

@InProceedings{Ghezzi-Kemmerer91a,
  Author =	 "Carlo Ghezzi and Richard A. Kemmerer",
  Title =	 "{ASTRAL}: an Assertion Language for Specifying
                  Realtime Systems",
  BookTitle =	 "Third European Software Engineering Conference,
                  Milano, Italy",
  Year =	 1991,
  Month =	 oct
}

@InProceedings{Ghezzi-Kemmerer91b,
  Author =	 "Carlo Ghezzi and Richard A. Kemmerer",
  Title =	 "Executing Formal Specifications: the {ASTRAL} to
                  {TRIO} Approach",
  BookTitle =	 "Symposium on Testing, Analysis, and Verification,
                  Victoria, British Columbia",
  Year =	 1991,
  Month =	 oct,
  Pages =	 "112-119",
  Annote =	 "21 references."
}

@Inproceedings{Ghezzi-Monga02,
	Author = {Carlo Ghezzi and Mattia Monga},
	Title = {Fostering Component Evolution with {C\#} Attributes},
	Booktitle = {Proceedings of the International Workshop on Principles of Software Evolution},
	Pages = {22--28},
	Year = {2002},
	Address = {Orlando, Florida},
	Publisher = ACM
}

@Article{Ghezzi-etal91,
  Author =	 "Carlo Ghezzi and Dino Mandrioli and Sandro Morasca
                  and Mauro Pezze",
  Title =	 "A Unified {High-Level Petri Net} Formalism for
                  Time-Cricical Systems",
  Journal =	 IEEETSE,
  Year =	 1991,
  Volume =	 17,
  Number =	 2,
  Month =	 feb,
  Pages =	 "160-172",
  Annote =	 "36 references."
}

@InCollection{Giarratana-Gimona-Montanari76,
  Author =	 "V. Giarratana and F. Gimona and U. Montanari",
  Title =	 "Observability Concepts in Abstract Data Type
                  Specifications",
  BookTitle =	 "Mathematical Foundations of Computer Science 1976,
                  Proceedings 5th Symposium, Gdansk",
  Month =	 sep,
  Year =	 1976,
  Pages =	 "576-587",
  Editor =	 "A. Mazurkiewicz",
  Series =	 LNCS,
  Volume =	 45,
  Publisher =	 SV,
  Address =	 NY,
  Annote =	 "12 references."
}

@InCollection{Gibson-etal00,
  Author =	 "David S. Gibson and Bruce W. Weide and Scott M. Pike
                  and Stephen H. Edwards",
  Title =	 "Toward a Normative Theory for Component-Based System
                  Design",
  BookTitle =	 {Foundations of Component-Based Systems},
  Editor =	 {Gary T. Leavens and Murali Sitaraman},
  Year =	 2000,
  Publisher =	 {Cambridge University Press},
  Address =	 NY,
  ISBN =	 {0-521-77164-1},
  Chapter =	 10,
  Pages =	 "211-230",
  Annote =	 "36 references."
}

@Article{Gibson91,
  Author =	 "Elizabeth A. Gibson",
  Title =	 "Flattening the learning curve: educating
                  object-oriented developers",
  Journal =	 JOOP,
  Year =	 1991,
  Volume =	 3,
  Number =	 6,
  Month =	 feb,
  Pages =	 "24-29",
  Annote =	 "8 references."
}

@Article{Giddings84,
  Author =	 "Richard V. Giddings",
  Title =	 "Accommodating Uncertainty in Software Design",
  Journal =	 CACM,
  Volume =	 27,
  Number =	 5,
  Month =	 may,
  Year =	 1984,
  Pages =	 "428-434",
  Annote =	 "Domain dependent software and
                  methodology. Prototyping as necessary for most
                  applications where domain is not precisely
                  known. Reusable components identified by formally
                  modeling universe of discourse for the
                  application. Cost-effectiveness of software
                  environments. Nested development cycles. 9
                  references."
}

@Article{Gilb85,
  Author =	 "Tom Gilb",
  Title =	 {Evolutionary Delivery versus the "Waterfall Model"},
  Journal =	 SIGSOFT,
  Month =	 jul,
  Year =	 1985,
  Volume =	 10,
  Number =	 3,
  Pages =	 "49-61",
  Annote =	 "Argues that the smallest possible increments be
                  delivered frequently to customers so that the
                  designers can get feedback. 16 references."
}

@Book{Gilmore-Winder-Detienne94,
  Author =	 "Divid J. Gilmore and Russel L. Winder and Francoise
                  Detienne",
  Title =	 "User-Centered Requirements for Software Engineering
                  Environments",
  Publisher =	 SV,
  Year =	 1994,
  Editor =	 "Divid J. Gilmore and Russel L. Winder and Francoise
                  Detienne",
  Volume =	 123,
  Series =	 "NATO ASI Series",
  Address =	 NY,
  Annote =	 "Hundreds of references."
}

@InProceedings{Giorgetti-Groslambert06,
  author = 	 {Alain Giorgettia nd Julien Groslambert},
  title = 	 {JAG: {JML} Annotation Generation for Verifying Temporal Properties},
  booktitle =    {Fundamental Approaches to Software Engineering},
  pages = 	 {373-376},
  year = 	 2006,
  volume = 	 3922,
  series = 	 LNCS,
  location = 	 {Vienna, Austria},
  month = 	 mar,
  publisher = SV
}

@article{Giorgetti-etal08,
author = {Alain Giorgetti and Julien Groslambert and Jacques Julliand and Olga Kouchnarenko},
title = {Verification of class liveness properties with {Java Modeling Language}},
journal = {IET Software},
volume = 2,
number = 6,
pages = {500--514},
publisher = {IET},
url = {http://link.aip.org/link/?SEN/2/500/1},
doi = {http://dx.doi.org/10.1049/iet-sen:20080008},
month = dec,
year = 2008,
}

@Article{Glass80,
  Author =	 "Robert L. Glass",
  Title =	 "Real-Time: The 'Lost World' of Software Debugging
                  and Testing",
  Journal =	 CACM,
  Year =	 1980,
  Volume =	 23,
  Number =	 5,
  Month =	 may,
  Pages =	 "264-271",
  Annote =	 "15 references."
}

@inproceedings{Gligoric-etal10,
author = {Milos Gligoric and Tihomir Gvero and Vilas Jagannath and Sarfraz Khurshid and Viktor Kuncak and Darko Marinov},
title = {Test Generation through Programming in {UDITA}},
year = {2010},
isbn = {9781605587196},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/1806799.1806835},
doi = {10.1145/1806799.1806835},
abstract = {We present an approach for describing tests using non-deterministic test generation programs. To write such programs, we introduce UDITA, a Java-based language with non-deterministic choice operators and an interface for generating linked structures. We also describe new algorithms that generate concrete tests by efficiently exploring the space of all executions of non-deterministic UDITA programs.We implemented our approach and incorporated it into the official, publicly available repository of Java PathFinder (JPF), a popular tool for verifying Java programs. We evaluate our technique by generating tests for data structures, refactoring engines, and JPF itself. Our experiments show that test generation using UDITA is faster and leads to test descriptions that are easier to write than in previous frameworks. Moreover, the novel execution mechanism of UDITA is essential for making test generation feasible. Using UDITA, we have discovered a number of bugs in Eclipse, NetBeans, Sun javac, and JPF.},
booktitle = {Proceedings of the 32nd ACM/IEEE International Conference on Software Engineering - Volume 1},
pages = {225–234},
numpages = {10},
keywords = {UDITA, test programs, Pex, Java PathFinder, test predicates, test generation, test filtering, automated testing},
location = {Cape Town, South Africa},
series = {ICSE '10},
annote="42 references."
}

@Article{Gnaedig-Kirchner90,
  Author =	 "Isabelle Gnaedig and Helene Kirchner",
  Title =	 "Equational Completion in Order-Sorted Algebras",
  Journal =	 TCS,
  Year =	 1990,
  Volume =	 72,
  Number =	 "2,3",
  Month =	 may,
  Pages =	 "169-202"
}

@Article{Go-Shiatori99,
  author =	 {Kentaro Go and Norio Shiatori},
  title =	 {A Decomposition of a Formal Specification: An
                  Improved Constraint-Oriented Method},
  journal =	 IEEETSE,
  year =	 1999,
  volume =	 mar,
  number =	 25,
  month =	 2,
  pages =	 {258-273},
  annote =	 {17 references.}
}

@InProceedings{Godefroid-Klarlund05,
  title =	"Software Model Checking: Searching for Computations in
		 the Abstract or the Concrete",
  author =	"Patrice Godefroid and Nils Klarlund",
  booktitle =	"Integrated Formal Methods, 5th International
		 Conference, {IFM} 2005, Eindhoven, The Netherlands,
		 November 29 - December 2, 2005, Proceedings",
  publisher =	SV,
  year = 	2005,
  volume =	3771,
  editor =	"Judi Romijn and Graeme Smith and Jaco van de Pol",
  ISBN = 	"3-540-30492-4",
  pages =	"20-32",
  series =	LNCS,
  URL =  	"http://dx.doi.org/10.1007/11589976_3",
}

@article{Godefroid05,
 author = {Godefroid, Patrice},
 title = {Software Model Checking: The {VeriSoft} Approach},
 journal = {Form. Methods Syst. Des.},
 issue_date = {March 2005},
 volume = 26,
 number = 2,
 month = mar,
 year = 2005,
 issn = {0925-9856},
 pages = {77-101},
 numpages = 25,
 url = {http://dx.doi.org/10.1007/s10703-005-1489-x},
 doi = {10.1007/s10703-005-1489-x},
 acmid = 1084674,
 publisher = {Kluwer Academic Publishers},
 address = {Hingham, MA, USA},
 keywords = {program verification, software model checking, systematic testing},
}

@Article{Godin-etal98,
  author =	 {Robert Godin and Hafedh Mili and Guy W. Mineau and
                  Rokia Missaoui and Amina Arfi and Thuy-Tien Chau},
  title =	 {Design of Class Hierarchies Based on Concept
                  (Galois) Lattices},
  journal =	 TAPOS,
  year =	 1998,
  volume =	 4,
  number =	 2,
  pages =	 {117-134},
  annote =	 {44 references.}
} 

@article{Goel-Gupta-Wasan08,
  title={{COTT}--a testability framework for object-oriented software testing},
  author={A. Goel and S.C. Gupta and S.K. Wasan},
  journal={International Journal of Electrical and Computer Engineering},
  volume={3},
  number={1},
  pages={44-51},
  year={2008},
  annote={27 references.}
}

@InCollection{Goerdt87,
  Author =	 "Andreas Goerdt",
  Title =	 "Hoare Logic for Lambda-Terms as Basis of Hoare Logic
                  for Imperative Languages",
  BookTitle =	 "Symposium on Logic in Computer Science, Ithaca, NY",
  Publisher =	 IEEE,
  Year =	 1987,
  Pages =	 "293-299",
  Month =	 jun,
  Annote =	 "17 references."
}

@InCollection{Gogolla-etal95,
  author =	 "M. Gogolla and S. Conrad and G. Denker and R. Herzig
                  and N. Vlachantonis and H. Ehrig",
  title =	 "{TROLL} {\it light} --- The Language and its
                  Development Environment",
  pages =	 "205-220",
  annote =	 "An object-oriented specification language that uses
                  SPECTRUM for its mathematical vocabulary. 19
                  references.",
  editor =	 {Manfred Broy and Stefan J\"{a}hnichen},
  booktitle =	 "{KORSO}: Methods, Languages and Tools for the
                  Construction of Correct Software",
  Publisher =	 SV,
  address =	 NY,
  Series =	 LNCS,
  Volume =	 1009,
  Year =	 1995
}

@InCollection{Goguen-Burstall84,
  Author =	 "J. A. Goguen and R. M. Burstall",
  Title =	 "Introducing Institutions",
  BookTitle =	 "Logics of Programs: Workshop, Carnegie Mellon
                  University, June 1983",
  Editor =	 "Edmund Clarke and Dexter Kozen",
  Year =	 1984,
  Pages =	 "221-256",
  Publisher =	 SV,
  Address =	 NY,
  Series =	 LNCS,
  Volume =	 164,
  Annote =	 "Institutions generalize the notion of a logical
                  system. If interface declarations can be glued
                  together then theories can also be glued
                  together. Conditions on when a theorem prover for
                  one system can be validly used for
                  another. Institutions that admit free models can be
                  extended to institutions whose theories may include
                  constraints such as hierarchy or generating
                  constraints. 56 references."
}

@Article{Goguen-Burstall92,
  author =	 "Joseph A. Goguen and Rod M. Burstall",
  title =	 "Institutions: Abstract Model Theory for
                  Specification and Programming",
  journal =	 JACM,
  month =	 jan,
  year =	 1992,
  volume =	 39,
  number =	 1,
  pages =	 "95-146",
  annote =	 "107 references."
}

@Book{Goguen-Malcolm96,
  author =	 "J. A. Goguen and G. Malcolm",
  title =	 "Algebraic Semantics of Imperative Programs",
  publisher =	 "MIT Press",
  address =	 "Cambridge, MA",
  year =	 "1996",
  ISBN =	 "0-262-07172-X",
  annote =	 "56 references."
}

@Article{Goguen-Malcom00,
  title =        "A Hidden Agenda",
  author =       "Joseph Goguen and Grant Malcolm",
  journal =      TCS,
  volume =       245,
  number =       1,
  pages =        "55-101",
  month =        aug,
  year =         2000,
  URL =          "http://www.cs.ucsd.edu/users/goguen/pps/ha.ps"
}

@Article{Goguen-Malcom99,
  title =        "A Hidden Agenda",
  author =       "Joseph Goguen and Grant Malcolm",
  journal =      "Mathematical Structures in Computer Science",
  volume =       9,
  number =       3,
  pages =        "287-319",
  month =        jun,
  year =         1999,
  URL =          "http://www.cs.ucsd.edu/users/goguen/pps/coind.ps"
}

@InCollection{Goguen-Meseguer82,
  Title =	 "Universal Realization, Persistent Interconnection
                  and Implementation of Abstract Modules",
  Author =	 "Joseph Goguen and Jos\'e Meseguer",
  Year =	 1982,
  BookTitle =	 "Proceedings, 9th International Conference on
                  Automata, Languages and Programming, Aarhus,
                  Denmark",
  Pages =	 "265-281",
  Editor =	 "M. Nielsen and E.M. Schmidt",
  Publisher =	 SV,
  Address =	 NY,
  Series =	 "Lecture Notes in Computer Science",
  Volume =	 140
}

@TechReport{Goguen-Meseguer87b,
  Author =	 "Joseph A. Goguen and Jose Meseguer",
  Title =	 "Order-Sorted Algebra Solves the
                  Constructor-Selector, Multiple Representation and
                  Coercion Problems",
  Institution =	 "Center for the Study of Language and Information",
  Month =	 mar,
  Year =	 1987,
  Number =	 "CSLI-87-92",
  Note =	 "Appears in Second Annual Symposium on Logic in
                  Computer Science, Ithaca, NY, June, 1987, pages
                  18-29",
  Annote =	 "12 references."
}

@InCollection{Goguen-Meseguer87c,
  Author =	 "Joseph A. Goguen and Jose Meseguer",
  Title =	 "Order-Sorted Algebra Solves the
                  Constructor-Selector, Multiple Representation and
                  Coercion Problems",
  BookTitle =	 "Symposium on Logic in Computer Science, Ithaca, NY",
  Publisher =	 IEEE,
  Year =	 1987,
  Pages =	 "18-29",
  Month =	 jun,
  Annote =	 "Basics of order-sorted universal algebra. 12
                  references."
}

@TechReport{Goguen-Meseguer89,
  Author =	 "Joseph A. Goguen and Jose Meseguer",
  Title =	 "Order-Sorted Algebra {I}: Equational Deduction for
                  Multiple Inheritance, Overloading, Exceptions, and
                  Partial Operations",
  Institution =	 "Computer Science Laboratory, SRI International",
  Month =	 jul,
  Year =	 1989,
  Number =	 "SRI-CSL-89-10",
  Annote =	 "81 references."
}

@Article{Goguen-Moriconi87,
  Author =	 "Joseph Goguen and Mark Moriconi",
  Title =	 "Formalization in Programming Environments",
  Journal =	 "Computer",
  Volume =	 20,
  Number =	 11,
  Month =	 nov,
  Year =	 1987,
  Pages =	 "55-64",
  Annote =	 "Survey. 79 references."
}

@InProceedings{Goguen-Rosu99,
  author =       "Joseph Goguen and Grigore Ro{\c{s}}u",
  title =        "Hiding More of Hidden Algebra",
  editor =       "Jeanette M. Wing and Jim Woodcock and Jim Davies",
  booktitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  series =	 LNCS,
  publisher =	 SV,
  number =	 1709,
  year =	 1999,
  pages =        "1704-1719",
  annote =       "Hidden algebra with multiple hidden arguments, variations on behavioral equivalence, built-in types, nondeterminism, and concurrency.  21 references.",
}

@InProceedings{Goguen-Tardo79,
  Author =	 "J. A. Goguen and Joseph J. Tardo",
  Title =	 "An Introduction to OBJ: A Language for Writing and
                  Testing Formal Algebraic Program Specifications",
  BookTitle =	 "Proceedings Specifications of Reliable Software,
                  Cambridge, Mass.",
  Organization = IEEE,
  Month =	 apr,
  Year =	 1979,
  Pages =	 "170-189",
  Annote =	 "An interpreted data type specification language. 51
                  references."
}

@InCollection{Goguen-Thatcher-Wagner78,
  Author =	 "J. A. Goguen and J. W. Thatcher and E. G. Wagner",
  Title =	 "An Initial Algebra Approach to the Specification,
                  Correctness and Implementation of Abstract Data
                  Types",
  BookTitle =	 "Current Trends in Programming Methodology",
  Publisher =	 Prentice-Hall,
  Address =	 "Englewood Cliffs, N.J.",
  Year =	 1978,
  Volume =	 4,
  Editor =	 "Raymond T. Yeh",
  Pages =	 "80-149",
  Annote =	 "Algebraic specifications of abstract data
                  types. This is the so-called ADJ paper."
}

@InCollection{Goguen-Tracz00,
  Author =	 "Joseph A. Goguen and Will Tracz",
  Title =	 "An Implementation-Oriented Semantics for Module
                  Composition",
  BookTitle =	 {Foundations of Component-Based Systems},
  Editor =	 {Gary T. Leavens and Murali Sitaraman},
  Year =	 2000,
  Publisher =	 {Cambridge University Press},
  Address =	 NY,
  ISBN =	 {0-521-77164-1},
  Chapter =	 11,
  Pages =	 "231-263",
  Annote =	 "29 references."
}

@Article{Goguen-etal77,
  Author =	 "J. A. Goguen and J. W. Thatcher and E. G. Wagner and
                  J. B. Wright",
  Title =	 "Initial Algebra Semantics and Continuous Algebras",
  Journal =	 JACM,
  Year =	 1977,
  Volume =	 24,
  URL = {http://doi.acm.org/10.1145/321992.321997},
  Pages =	 "68-95"
}

@InCollection{Goguen-etal87,
  Author =	 "J. Goguen and C. Kirchner and A. Megrelis and
                  J. Meseguer and T. Winkler",
  Title =	 "An Introduction to OBJ3",
  BookTitle =	 "Conditional Term Rewriting Systems, 1st
                  International workshop, Orsay, France",
  Editor =	 "S. Kaplan and J.-P. Jouannaud",
  Month =	 jul,
  Year =	 1987,
  Series =	 LNCS,
  Volume =	 308,
  Publisher =	 SV,
  Address =	 NY,
  Pages =	 "258-263"
}

@TechReport{Goguen-etal89,
  Author =	 "Joseph A. Goguen and Jose Meseguer and Sany Lienwand
                  and Timothy Winkler and Hitoshi Aida",
  Title =	 "The Rewrite Rule Machine Project",
  Institution =	 "Computer Science Laboratory, SRI International",
  Month =	 mar,
  Year =	 1989,
  Number =	 "SRI-CSL-89-6",
  Annote =	 "12 references."
}

@InBook{Goguen-etal92,
  Author =	 "Joseph A. Goguen and Timothy Winkler and Jose
                  Meseguer and Kokichi Futatsugi and Jean-Pierre
                  Jouannaud",
  Title =	 "Applications of Algebraic Specification Using OBJ",
  Chapter =	 "Introducing OBJ",
  Publisher =	 "Cambridge University Press",
  Year =	 1992,
  Editor =	 "J. A. Goguen and D. Coleman and R. Gallimore"
}

@Article{Goguen73,
  Author =	 "Joseph A. Goguen",
  Title =	 "Realization is Universal",
  Journal =	 "Math. Systems Theory",
  Year =	 1973,
  Volume =	 6,
  Number =	 4,
  Pages =	 "359-374",
  Annote =	 "13 references."
}

@Article{Goguen84,
  Author =	 "Joseph A. Goguen",
  Title =	 "Parameterized Programming",
  Journal =	 IEEETSE,
  Volume =	 "SE-10",
  Number =	 5,
  Month =	 sep,
  Year =	 1984,
  Pages =	 "528-543",
  Annote =	 "Parameterization mecahanisms in OBJ. Theories,
                  views, and module extensions. 50 references."
}

@Article{Goguen86,
  Author =	 "Joseph A. Goguen",
  Title =	 "Reusing and Interconnecting Software Components",
  Journal =	 "IEEE Computer",
  Volume =	 19,
  Number =	 2,
  Month =	 feb,
  Year =	 1986,
  Pages =	 "16-28",
  Annote =	 "42 references."
}

@TechReport{Goguen88b,
  Author =	 "Joseph A. Goguen",
  Title =	 "OBJ as a Theorem Prover",
  Institution =	 "Computer Science Laboratory, SRI International",
  Number =	 "SRI-CSl-88-4R2",
  Month =	 aug,
  Year =	 "1988",
  Annote =	 "45 references."
}

@Article{Goldberg-Abell-Leibs97,
  author =	 {Adele Goldberg and Steven T. Abell and David Leibs},
  title =	 {The {LearningWorks} Development and Delivery
                  Frameworks},
  journal =	 CACM,
  year =	 1997,
  volume =	 40,
  number =	 10,
  month =	 oct,
  pages =	 {78-81},
  annote =	 {5 references.}
}

@Article{Goldberg86,
  Author =	 "A. T. Goldberg",
  Title =	 "Knowledge-Based Programming: A Survey of Program
                  Design and Construction Techniques",
  Journal =	 IEEETSE,
  Volume =	 12,
  Number =	 7,
  Year =	 1986,
  Pages =	 "752-768"
}

@Article{Goldberg87,
  Author =	 "Adele Goldberg",
  Title =	 "Programmer as Reader",
  Journal =	 "IEEE Software",
  Volume =	 4,
  Number =	 5,
  Month =	 sep,
  Year =	 1987,
  Pages =	 "62-70",
  Annote =	 "How Smalltalk-80 helps readability. 12 comprehension
                  questions. 10 references."
}

@TechReport{Goldstein-Bobrow80b,
  Author =	 "I. Goldstein and D. Bobrow",
  Title =	 "A Layered Approach of Software Design",
  Institution =	 "Xerox PARC",
  Number =	 "CSL-80-5",
  Year =	 1980,
  Month =	 dec
}

@Article{Goldstein05,
  author = 	 {Harry Goldstein},
  title = 	 {Who Killed the Virtual Case File},
  journal = 	 {IEEE Spectrum},
  year = 	 2005,
  volume =	 42,
  number =	 9,
  pages =	 {24-35},
  month =	 sep,
  annote =	 {No references.}
}

@InProceedings{Gomez-Liu02,
  author =	 "Gustavo G{\'o}mez and Yanhong A. Liu",
  title =	 "Automatic Time-Bound Analysis for a Higher-Order
                  Language",
  pages =	 "75-86",
  editor =	 "Cindy Norris and Jr. James B. Fenwick",
  booktitle =	 "Proceedings of the 2002 {ACM} {SIGPLAN} Workshop on
                  Partial Evaluation and Semantics-Based Program
                  Manipulation ({PEPM}-02)",
  month =	 jan # " ~14--15",
  series =	 "ACM SIGPLAN Notices",
  volume =	 "37, 3",
  publisher =	 "ACM Press",
  address =	 "New York",
  year =	 "2002"
}


@InCollection{Goodenough77,
  Author =	 "J. B. Goodenough",
  Title =	 "Towards a Theory of Testing Data Section Criteria",
  BookTitle =	 "Current Trends in Programming Technology",
  Publisher =	 "Prentice Hall",
  Year =	 1977,
  Address =	 "Englewood Cliffs, NJ"
}

@InProceedings{Gordon-Rees96,
  author =	 {Andrew Gordon and Gareth Rees},
  title =	 {Bisimilarity for a first-order calculus of objects
                  with subtyping},
  booktitle =	 {Conference Record of the 23rd ACM Symposium on
                  Principles of Programming Languages, St. Petersburg
                  Beach, Florida},
  pages =	 {386-395},
  year =	 1996,
  month =	 jan,
  organization = ACM
}

@TechReport{Gorelick75,
  author =	"G. A. Gorelick",
  title =	"A Complete Axiomatic System For Proving Assertions
		 about Recursive and Non-Recursive Programs",
  institution =  "University of Toronto",
  number =	75,
  year = 	1975
}

@Article{Gotlieb-Botella-Rueher98,
  author =	 {Arnaud Gotlieb and Bernard Botella and Michel
                  Rueher},
  title =	 {Automatic Test Data Generation using Constraint
                  Solving Techniques},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 2,
  month =	 mar,
  pages =	 {53-62},
  note =	 {ISSTA 98: Proceedings of the ACM SIGSOFT
                  Internatioal Symposium on Software Testing and
                  Analysis},
  annote =	 {24 references.}
}

@TechReport{Gough-Barringer87,
  Author =	 "Graham D. Gough and Howard Barringer",
  Title =	 "A Semantics Driven Temporal Verification System",
  Institution =	 "Department of Computer Science, University of
                  Manchester",
  Address =	 "Manchester M13 9PL, England",
  Number =	 "UMCS-87-12-5",
  Year =	 1987,
  Note =	 "To appear in ESOP '88",
  Annote =	 "SMG, a generic state machine generator that
                  interfaces to temporal logic checkers. 21
                  references."
}

@Article{Gould-Lewis85,
  Author =	 "John D. Gould and Clayton Lewis",
  Title =	 "Designing for Usability: Key Principles and What
                  Designers Think",
  Journal =	 CACM,
  Volume =	 28,
  Number =	 3,
  Month =	 mar,
  Year =	 1985,
  Pages =	 "300-311",
  Annote =	 "Principles for design of user interfaces: early
                  focus on users and tasks, empirical measurement and
                  iterative design. Discussion of why these are not
                  obvious and exactly what they mean. An example of
                  their use in designing IBM's ADS system. 36
                  references."
}

@TechReport{Graham88,
  Author =	 "T. C. Nicholas Graham",
  Title =	 "Conceptual View of Data Structures as a Programming
                  Aid",
  Institution =	 "Department of Computing and Information Science,
                  Queen's University at Kingston",
  Address =	 "Kingston, Ontario, Canada",
  Month =	 aug,
  Year =	 1988,
  Number =	 "88-225",
  Annote =	 "Model of program output. The Weasel environment. 50
                  references."
}

@Book{Grand98,
  author =	 {Mark Grand},
  title =	 {Patterns in Java: A Catalog of Reusable Design
                  Patterns Illustrated with UML},
  publisher =	 {Wiley},
  year =	 1998,
  volume =	 {Volume 1},
  annote =	 {9 references. Includes CD-ROM}
}

@Book{Grand99,
  author =	 {Mark Grand},
  title =	 {Patterns in Java: A Catalog of Reusable Design
                  Patterns Illustrated with UML},
  publisher =	 {Wiley},
  year =	 1998,
  volume =	 {Volume 2},
  annote =	 {14 references. Includes CD-ROM}
}

@InProceedings{Graube89,
  author =	 "N. Graube",
  title =	 "Metaclass Compatibility",
  booktitle =	 "Proceedings of {OOPSLA '89} Conference on
                  Object-oriented Programming Systems, Languages and
                  Applications",
  pages =	 "305-315",
  month =	 oct,
  year =	 1989,
  note =	 "{\em ACM SIGPLAN Notices}, volume 24, number 10.",
  URL =          {http://doi.acm.org/10.1145/74877.74909}
}

@article{Gravell-Henderson96,
  author =	 {Andrew Gravell and Peter Henderson},
  title =	 {Executing formal specifications need not be harmful},
  journal =	 {Software Engineering Journal},
  year =	 {1996},
  month =	 mar,
  volume =	 {11},
  number =	 {2},
  pages =	 {104-110}
}

@Proceedings{Gray-Boehm-Davis96,
  title =	 {Empirical Studies of Programmers},
  booktitle =	 {Empirical Studies of Programmers},
  year =	 1996,
  editor =	 {Wayne D. Gray and Deborah A. Boehm-Davis},
  publisher =	 {Alex Publishing Corp.},
  address =	 {Norwood, NJ, USA},
  annote =	 {Papers from the 1996 Workshop on Empirical Studies
                  of Programmers.}
}

@Article{Gray-etal-01,
  Author =	 "Jeff Gray and Ted Bapty and Sandeep Neema and James
                  Tuck",
  Title =	 "Handling crosscutting constraints in domain-specific
                  modeling",
  Journal =	 CACM,
  Year =	 2001,
  Volume =	 44,
  Number =	 10,
  Month =	 oct,
  Pages =	 "87-93"
}

@inproceedings{Gray-etal03,
  Author =	 {Jeff Gray and Ted Bapty and Sandeep Neema and
                  Douglas C. Schmidt and Aniruddha Gokhale and
                  Balachandran Natarajan},
  Booktitle =	 {Proceedings of the second international conference
                  on Generative programming and component engineering},
  Isbn =	 {3-540-20102-5},
  Local-Url =
                  {file://localhost/Users/cclifton/Documents/OthersPapersAndTalks/p151-gray.pdf},
  Location =	 {Erfurt, Germany},
  Pages =	 {151-168},
  Publisher =	 SV,
  Address =      NY,
  Title =	 {An approach for supporting aspect-oriented domain
                  modeling},
  Year =	 {2003}
}

@InCollection{Gray87,
  Author =	 "John W. Gray",
  Title =	 "The Category of Sketches as a Model for Algebraic
                  Semantics",
  BookTitle =	 "Categories in Computer Science and Logic, Boulder,
                  Colo.",
  Editor =	 "John W. Gray and Andre Scedrov",
  Year =	 1987,
  Series =	 "Contemporary Mathematics",
  Volume =	 92,
  Publisher = "American Mathematical Society",
  Address =	 "Providence, R.I.",
  Pages =	 "109-135",
  Annote =	 "15 references."
}

@Article{Gray87b,
  Author =	 "D. Gray",
  Title =	 "A Pedagogical Verification Condition Generator",
  Journal =	 "The Computer Journal",
  Volume =	 30,
  Number =	 3,
  Year =	 1987,
  Pages =	 "239 - 248"
}

@InProceedings{Greenberg-Pierce-Weirich10,
  author = {Michael Greenberg and Benjamin C. Pierce and Stephanie Weirich},
  title = {Contracts Made Manifest},
  booktitle = POPL,
  year = 2010,
  isbn = {978-1-60558-479-9},
  pages = {353-364},
  location = {Madrid, Spain},
  doi = {http://doi.acm.org/10.1145/1706299.1706341},
  publisher = ACM,
  address = NY,
  annote = {16 references.}
}

@Article{Greenhouse-Halloran-Scherlis05,
  title =	"Observations on the assured evolution of concurrent
		 Java programs",
  author =	"Aaron Greenhouse and T. J. Halloran and William L. Scherlis",
  journal =	"Sci. Comput. Program",
  year = 	"2005",
  number =	"3",
  volume =	"58",
  pages =	"384-411",
  URL =  	"http://dx.doi.org/10.1016/j.scico.2005.03.002",
}


@TechReport{Greenhouse03,
  author = 	 {Aaron Greenhouse},
  title = 	 {A Programmer-Oriented Approach to Safe Concurrency},
  institution =  CMU,
  year = 	 2003,
  number =	 {CMU-CS-03-135},
  address =	 {Pittsburgh, PA},
  month =	 may,
  annote =	 {The author's Ph.D. thesis.  Many references.},
  URL = {http://reports-archive.adm.cs.cmu.edu/anon/2003/CMU-CS-03-135.pdf}
}

@Article{Greif-Meyer81,
  Author =	 "Irene Greif and Albert R. Meyer",
  Title =	 "Specifying the Semantics of {\bf while} Programs: A
                  Tutorial and a Critique of a Paper by Hoare and
                  Lauer",
  Journal =	 TOPLAS,
  Year =	 1981,
  Volume =	 3,
  Number =	 4,
  Month =	 oct,
  Pages =	 "484-507",
  Annote =	 "22 references."
}

@Article{Greiter82,
  Title =	 "A Data Type Theory",
  Author =	 "Gebhard Greiter",
  Journal =	 SIGPLAN,
  Volume =	 17,
  Number =	 5,
  Month =	 may,
  Year =	 1982,
  Pages =	 "47-53",
  Annote =	 "Mathematical model for data type including
                  treatments of error handling. Distinguishes types
                  from implementations. 3 references."
}

@Article{Greiter83,
  Author =	 "Gebh. Greiter",
  Title =	 "Comparing two Definitions for the Notion ``Data
                  Type''",
  Journal =	 SIGPLAN,
  Year =	 1983,
  Volume =	 18,
  Number =	 7,
  Month =	 jul,
  Pages =	 "45-49",
  Annote =	 "Consistency of algebraic specifications. 4
                  references."
}

@Article{Gries-Levin80,
  author =	 {D. Gries and G. Levin},
  title =	 {Assignment and the Procedure Call Proof Rules},
  journal =	 {TOPLAS},
  year =	 1980,
  volume =	 2,
  number =	 4,
  pages =	 {564-579}
}

@Article{Gries-Prins85,
  Author =	 "David Gries and Jan Prins",
  Title =	 "A New Notion of Encapsulation",
  Journal =	 SIGPLAN,
  Volume =	 20,
  Number =	 20,
  Month =	 jul,
  Year =	 1985,
  Note =	 "Proceedings of the ACM SIGPLAN 85 Symposium on
                  Language Issues in Programming Environments",
  Pages =	 "131-139",
  Annote =	 "Modules indicate how values (or variables) are
                  implemented. Idea allows programmers to program at
                  high level, use partial implementations of data
                  types. 6 references."
}

@Book{Gries-Schneider94,
  Author =	 "David Gries and Fred B. Schneider",
  Title =	 "A Logical Approach to Discrete Math",
  Publisher =	 SV,
  Year =	 1994,
  Series =	 "Texts and Monographs in Computer Science",
  Address =	 NY,
  Annote =	 "45 references."
}

@InCollection{Gries-Schneider95,
  author =	 {David Gries and Fred B. Schneider},
  title =	 {Avoiding the Undefined by Underspecification},
  booktitle =	 {Computer Science Today: Recent Trends and
                  Developments},
  publisher =	 SV,
  year =	 1995,
  editor =	 {Jan van Leeuwen},
  number =	 1000,
  series =	 LNCS,
  address =	 NY,
  pages =	 {366-373},
  annote =	 {9 references.}
}

@Book{Gries78,
  Editor =	 "David Gries",
  Title =	 "Programming Methodology, A Collection of Articles by
                  Members of IFIP WG2.3",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1978
}

@Book{Gries81,
  Author =	 "David Gries",
  Title =	 "The Science of Programming",
  Year =	 1981,
  Publisher =	 SV,
  Address =	 NY,
  Annote =	 "44 references."
}

@TechReport{Gries82,
  Author =	 "David Gries",
  Title =	 "The Science of Computer Programming Answer Book",
  Institution =	 "Dept. of Computer Science, Cornell, University",
  Year =	 1982,
  Number =	 "82-498",
  Month =	 jun,
  Annote =	 "Includes errata. 1 reference."
}

@Article{Griswold-etal06,
  author = 	 {William G. Griswold and Kevin Sullivan and Yuanyuan
                  Song and Macneil Shonle and Nishit Tewari and
                  Yuanfang Cai and Hridesh Rajan},
  title = 	 {Modular Software Design with Crosscutting Interfaces},
  journal = 	 {IEEE Software},
  pages =        {51-60},
  year = 	 2006,
  month = 	 "Jan/Feb",
  Annote =       {11 references.}
}

@InProceedings{Groslambert-Julliand-Kouchnarenko06,
  author = 	 {Julien Groslambert and Jacques Julliand and Olga Kouchnarenko},
  title = 	 {{JML-based} Verification of Liveness Properties on a Class},
  booktitle =	 {Fifth International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2006)},
  pages =	 {41-48},
  year =	 2006,
  month =	 nov,
  organization = ACM,
  URL = 	 {http://www.cs.iastate.edu/~leavens/SAVCBS/2006/papers/Groslambert-Julliand-Kouchnarenko.pdf}
}

@InProceedings{Groslambert07,
  author = 	 {Julien Groslambert},
  title = 	 {JAG Extension for Verifying {LTL} Properties on {B} Event Systems},
  booktitle =    {B 2007: Formal Specification and Development in B},
  pages = 	 {262-265},
  year = 	 2007,
  volume = 	 4355,
  series = 	 LNCS,
  month = 	 jan,
  publisher = SV
}

@article{Grossman-etal17,
author = {Shelly Grossman and Ittai Abraham and Guy Golan-Gueta and Yan Michalevsky and Noam Rinetzky and Mooly Sagiv and Yoni Zohar},
title = {Online Detection of Effectively Callback Free Objects with Applications to Smart Contracts},
year = 2017,
issue_date = {January 2018},
publisher = ACM,
address = NY,
volume = 2,
number = {POPL},
url = {https://doi.org/10.1145/3158136},
doi = {10.1145/3158136},
abstract = {Callbacks are essential in many programming environments, but drastically complicate program understanding and reasoning because they allow to mutate object's local states by external objects in unexpected fashions, thus breaking modularity. The famous DAO bug in the cryptocurrency framework Ethereum, employed callbacks to steal \$150M. We define the notion of Effectively Callback Free (ECF) objects in order to allow callbacks without preventing modular reasoning. An object is ECF in a given execution trace if there exists an equivalent execution trace without callbacks to this object. An object is ECF if it is ECF in every possible execution trace. We study the decidability of dynamically checking ECF in a given execution trace and statically checking if an object is ECF. We also show that dynamically checking ECF in Ethereum is feasible and can be done online. By running the history of all execution traces in Ethereum, we were able to verify that virtually all existing contract executions, excluding these of the DAO or of contracts with similar known vulnerabilities, are ECF. Finally, we show that ECF, whether it is verified dynamically or statically, enables modular reasoning about objects with encapsulated state.},
journal = {Proc. ACM Program. Lang.},
month = {dec},
articleno = 48,
numpages = 28,
keywords = {Modular reasoning, Smart contracts, Program analysis}
}

@InProceedings{Grothoff-Palsberg-Vitek01,
  Author =	 {Christian Grothoff and Jens Palsberg and Jan Vitek},
  Title =	 {Encapsulating Objects with Confined Types},
  Booktitle =	 {OOPSLA '01 Conference Proceedings, Object-Oriented
                  Programming, Systems, Languages, and Applications,
                  October 14-18, 2001, Tampa Bay, Florida, USA},
  Year =	 {2001},
  Month =	 oct,
  Pages =	 {241-255}
}

@Article{Grumberg-Long94,
  Author =	 "Orna Grumberg and David E. Long",
  Title =	 "Model Checking and Modular Verification",
  Journal =	 TOPLAS,
  Year =	 1994,
  Volume =	 16,
  Number =	 3,
  Month =	 may,
  Pages =	 "843-871",
  Annote =	 "31 references."
}

@InProceedings{Grundon-Hayes-Fidge98,
  author =	 {S. Grundon and I. Hayes and C. F. Fidge},
  title =	 {Timing Constraint Analysis},
  booktitle =	 {Proceedings of the 21st Australasian Computer
                  Science Conference, Singapore},
  pages =	 {575-586},
  year =	 1998,
  month =	 {January},
  publisher =	 SV
}

@Article{Grundy-Hosking-Mugridge98,
  author =	 {John Grundy and John Hosking and Warwick
                  B. Mugridge},
  title =	 {Inconsistency Management for Multiple-View Software
                  Development Environments},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 11,
  month =	 nov,
  pages =	 {960-981},
  annote =	 {74 references.}
}

@InCollection{Grundy93,
  Author =	 "J. Grundy",
  Title =	 "Predicative Programming---A Survey",
  BookTitle =	 "Formal Methods in Programming and Their
                  Applications",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Dines Bjoerner and Manfred Broy and Igor
                  V. Pottosin",
  Series =	 LNCS,
  Volume =	 735,
  Pages =	 "8-25",
  Month =	 jul,
  Annote =	 "18 references."
}

@Article{Guaspari-Marceau-Polak90,
  Author =	 "David Guaspari and Carla Marceau and Wolfgang Polak",
  Title =	 "Formal Verification of {Ada} Programs",
  Journal =	 IEEETSE,
  Volume =	 16,
  Number =	 9,
  Month =	 sep,
  Year =	 1990,
  Pages =	 "1058-1075",
  Annote =	 "Penelope verification editor and Larch/Ada. 35
                  references."
}

@InCollection{Guaspari-Marceau-Polak92,
  Author =	 "David Guaspari and Carla Marceau and Wolfgang Polak",
  Title =	 "Formal Verification of {Ada} Programs",
  Editor =	 "Ursala Martin and Jeannette M. Wing",
  BookTitle =	 "First International Workshop on Larch, Dedham 1992",
  Publisher =	 SV,
  address   =    NY,
  Year =	 1992,
  Pages =	 "104-141",
  Annote =	 "35 references"
}

@InCollection{Guaspari-Seagar-Stilerman95,
  author =	 {David Guaspari and Mike Seagar and Matt Stillerman},
  title =	 {Specifying the Kernel of a Secure Distributed
                  Operating System},
  booktitle =	 {Applications of Formal Methods},
  publisher =	 {Prentice Hall},
  year =	 1995,
  editor =	 {Michael G. Hinchey and Jonathan P. Bowen},
  series =	 {Prentice Hall International Series in Computer
                  Science},
  chapter =	 12,
  address =	 {London},
  pages =	 {285-306}
}

@TechReport{Guaspari89,
  Author =	 "David Guaspari",
  Title =	 "The semantics of two-tiered specifications. Part 1:
                  Modular programming.",
  Institution =	 "Odyssey Research Associates",
  Address =	 "301A Harris B. Dates Dr., Ithaca, NY 14850",
  Number =	 "17-14",
  Month =	 dec,
  Year =	 1989,
  Annote =	 "8 references."
}

@Misc{Guaspari93,
  Author =	 "David Guaspari",
  Title =	 "Dispatching Operations",
  Howpublished = "Received from author",
  Year =	 1993,
  Annote =	 "2 references."
}

@InProceedings{Gudmundson-Kiczales01,
  author = "Stephan Gudmundson and Gregor Kiczales",
  title = "Addressing Practical Software Development Issues in {AspectJ} with a Pointcut Interface",
  booktitle = "ECOOP 2001 Workshop on Advanced Separation of Concerns",
  year = "2001",
  url = "citeseer.ist.psu.edu/gudmundson01addressing.html"
}

@Book{Guessarian81,
  Author =	 "I. Guessarian",
  Title =	 "Algebraic Semantics",
  Publisher =	 SV,
  Year =	 1981,
  Volume =	 99,
  Series =	 LNCS,
  Address =	 NY
}

@Book{Gumb89,
  Author =	 "Raymond D. Gumb",
  Title =	 "Programming Logics: An introduction to verification
                  and semantics",
  Publisher =	 "Wiley",
  Address =	 NY,
  Year = 1989,
  Annote =	 "Annotated bibliography contains 79 references."
}

@Article{Gunter-Peled05,
  title =	"Model checking, testing and verification working together",
  author =	"Elsa L. Gunter and Doron Peled",
  journal =	FAC,
  year = 	2005,
  number =	2,
  volume =	17,
  pages =	"201-221",
  URL =  	"http://dx.doi.org/10.1007/s00165-005-0059-8",
}

@Article{Gunter96,
  author =	 {Carl A. Gunter},
  title =	 {Abstracting Dependencies between Software
                  Configuration Items},
  journal =	 SIGSOFT,
  year =	 1996,
  editor =	 {David Garlan},
  volume =	 21,
  number =	 6,
  month =	 nov,
  pages =	 {167-178},
  note =	 {SIGSOFT '96: Proceedings of the Fourth ACM SIGSOFT
                  Symposium on the Foundations of Software
                  Engineering, San Francisco, California},
  annote =	 {Production nets and their models. 16 references.}
}

@InCollection{Gunther-Schewe-Wetzel93,
  Author =	 "T. Gunther and Klaus-Dieter Schewe and Ingrid
                  Wetzel",
  Title =	 "On the Derivation of Executable Database Programs
                  from Formal Specifications",
  BookTitle =	 "Industrial-Strength Formal Methods, First
                  International Symposium of Formal Methods Europe,
                  Odense, Denmark",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "J.C.P. Woodcock and P.G. Larsen",
  Series =	 LNCS,
  Volume =	 670,
  Pages =	 "351-366",
  Address =	 NY,
  Month =	 apr,
  Annote =	 "14 references."
}

@Article{Gupta-Mathur-Soffa98,
  author =	 {Neelam Gupta and Aditya Mathur and Mary Lou Soffa},
  title =	 {Automated Test Data Generation Using an Iterative
                  Relaxation Method},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 6,
  month =	 nov,
  pages =	 {231-244},
  note =	 {Proceedings of the ACM SIGSOFT Sixth Internatioal
                  Symposium on the Foundations of Software
                  Engineering},
  annote =	 {15 references.}
}

@inproceedings{Gurski-Baker94,
  author =	 "M. Gurski and A. L. Baker",
  title =	 "Testing {SPECS-C++}: A First Step in Validating
                  Distributed Systems",
  booktitle =	 "Intellegent Information Management Systems",
  year =	 "1994",
  pages =	 "105-108",
  publisher =	 "The International Society for Mini and
                  Microcomputers - ISMM",
  address =	 "Anaheim"
}

@TechReport{Gurski01,
  author =	 {Marybeth Gurski},
  title =	 {The Class Validation System},
  institution =	 {Department of Computer Science, Iowa State
                  University},
  year =	 2001,
  number =	 {01-01},
  address =	 {Ames, Iowa 50011},
  month =	 feb,
  annote =	 {Available from \url{http://www.cs.iastate.edu}.}
}

@article{Gustafsson-Ermedahl07,
author = {Jan Gustafsson and Andreas Ermedahl},
title = {Experiences from Applying WCET Analysis in Industrial Settings},
journal ={Object-Oriented Real-Time Distributed Computing, IEEE International Symposium on},
volume = {0},
year = {2007},
isbn = {0-7695-2765-5},
pages = {382-392},
doi = {http://doi.ieeecomputersociety.org/10.1109/ISORC.2007.36},
publisher = {IEEE Computer Society},
address = {Los Alamitos, CA, USA},
}

@article{Gustafsson-Ermedahl97,
author = {Jan Gustafsson and Andreas Ermedahl},
title = {Automatic Derivation of Path and Loop Annotations in Object-Oriented Real-Time Programs},
journal ={Parallel and Distributed Real-Time Systems, Workshop},
volume = {0},
year = {1997},
isbn = {0-8186-8096-2},
pages = {257},
doi = {http://doi.ieeecomputersociety.org/10.1109/WPDRTS.1997.637989},
publisher = {IEEE Computer Society},
address = {Los Alamitos, CA, USA},
}

@article{Gustafsson-etal06,
author = {Jan Gustafsson and Andreas Ermedahl and Christer Sandberg and Bjorn Lisper},
title = {Automatic Derivation of Loop Bounds and Infeasible Paths for WCET Analysis Using Abstract Execution},
journal ={Real-Time Systems Symposium, IEEE International},
volume = {0},
year = {2006},
issn = {1052-8725},
pages = {57-66},
doi = {http://doi.ieeecomputersociety.org/10.1109/RTSS.2006.12},
publisher = {IEEE Computer Society},
address = {Los Alamitos, CA, USA},
}

@InProceedings{ Gustafsson02,
author = {Jan Gustafsson},
title = {Worst Case Execution Time Analysis of Object-Oriented Programs},
journal ={Seventh IEEE International Workshop on Object-Oriented Real-Time Dependable Systems (WORDS'02)},
year = {2002},
isbn = {0-7695-1576-2},
pages = {0071},
doi = {http://doi.ieeecomputersociety.org/10.1109/WORDS.2002.1000038},
publisher = {IEEE Computer Society},
address = {Los Alamitos, CA, USA},
}

@TechReport{Guttag-Horning-Modet90,
  Author =	 "John V. Guttag and James J. Horning and Andr\'{e}s
                  Modet",
  Title =	 "Report on the {Larch Shared Language}: Version 2.3",
  Institution =	 DECSRC,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Month =	 apr,
  Year =	 1990,
  Number =	 58,
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "19 references."
}

@Article{Guttag-Horning-Wing82,
  Author =	 "J. V. Guttag and J. J. Horning and J. M. Wing",
  Title =	 "Some Remarks on Putting Formal Specifications to
                  Productive Use",
  Journal =	 SCP,
  Volume =	 2,
  Number =	 1,
  Month =	 oct,
  Year =	 1982,
  Pages =	 "53-68"
}
@TechReport{Guttag-Horning-Wing85a,
  Author =	 "J. V. Guttag and J. J. Horning and J. M. Wing",
  Title =	 "{Larch} in Five Easy Pieces",
  Institution =	 DECSRC,
  Year =	 1985,
  Month =	 jul,
  Number =	 5,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "The five pieces are: the Larch family of
                  specification languages, the Larch shared language,
                  the Larch shared language reference manual, the
                  Larch shared language handbook, and writing Larch
                  interface language specifications. 65 references."
}

@Article{Guttag-Horning-Wing85b,
  Author =	 "John V. Guttag and James J. Horning and Jeannette
                  M. Wing",
  Title =	 "The {Larch} Family of Specification Languages",
  Journal =	 "IEEE Software",
  Year =	 1985,
  Month =	 sep,
  Volume =	 2,
  Number =	 5,
  Pages =	 "24-36"
}

@Article{Guttag-Horning78,
  Author =	 "J. Guttag and J. J. Horning",
  Title =	 "The Algebraic Specification of Abstract Data Types",
  Journal =	 "Acta Informatica",
  Year =	 1978,
  Volume =	 10,
  Number =	 1,
  URL = {http://dx.doi.org/10.1007/BF00260922},
  Pages =	 "27-52"
}

@InProceedings{Guttag-Horning80,
  Author =	 "J. Guttag and J. J. Horning",
  Title =	 "Formal Specification as a Design Tool",
  BookTitle =	 "Conference Record of the Seventh Annual ACM
                  Symposium on Principles of Programming Languages,
                  Las Vegas, Nevada",
  Organization = ACM,
  Year =	 1980,
  Month =	 jan,
  Pages =	 "251-261",
  Annote =	 "6 references."
}

@TechReport{Guttag-Horning83,
  Author =	 "J. V. Guttag and J. J. Horning",
  Title =	 "Preliminary Report on the {Larch Shared Language}",
  Institution =	 MITLCS,
  Year =	 1983,
  Month =	 oct,
  Number =	 307,
  Annote =	 "Specification language for abstract data types with
                  a inheritance-like structure. 14 references."
}

@Article{Guttag-Horning86a,
  Author =	 "J. V. Guttag and J. J. Horning",
  Title =	 "Report on the {L}arch {S}hared {L}anguage",
  Journal =	 SCP,
  Volume =	 6,
  Number =	 2,
  Month =	 mar,
  Year =	 1986,
  Pages =	 "103-134",
  Annote =	 "Definition of the specification language Larch. 17
                  references."
}

@Article{Guttag-Horning86b,
  Author =	 "J. V. Guttag and J. J. Horning",
  Title =	 "A {L}arch {S}hared {L}anguage Handbook",
  Journal =	 SCP,
  Volume =	 6,
  Number =	 2,
  Month =	 mar,
  Year =	 1986,
  Pages =	 "135-157",
  Annote =	 "Definitions of basic traits in Larch. 3 references."
}

@TechReport{Guttag-Horning91,
  Author =	 "J. V. Guttag and J. J. Horning",
  Title =	 "Introduction to {LCL}, A {Larch/C} Interface
                  Language",
  Institution =	 DECSRC,
  Year =	 1991,
  Number =	 74,
  Month =	 jul,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301",
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "5 references."
}

@InCollection{Guttag-Horning91b,
  Author =	 "J. V. Guttag and J. J. Horning",
  Title =	 "A Tutorial on {Larch} and {LCL}, a {Larch/C}
                  Interface Language",
  BookTitle =	 "VDM '91 Formal Software Development Methods 4th
                  International Symposium of VDM Europe
                  Noordwijkerhout, The Netherlands, Volume 2:
                  Tutorials",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "S. Prehn and W. J. Toetenel",
  Series =	 LNCS,
  Volume =	 552,
  Pages =	 "1-78",
  Address =	 NY,
  Month =	 oct,
  Annote =	 "Part 2 is an introduction to the Larch Shared
                  Language. 6 references."
}

@Book{Guttag-Horning93,
  Author =	 "John V. Guttag and James J. Horning and S. J. Garland
                  and K. D. Jones and A. Modet and J. M. Wing",
  Title =	 "{Larch}: Languages and Tools for Formal Specification",
  Publisher =	 SV,
  Year =	 1993,
  Address =	 NY,
  Annote =	 "99 references."
}

@Article{Guttag-Horowitz-Musser78,
  Author =	 "John V. Guttag and Ellis Horowitz and David
                  R. Musser",
  Title =	 "Abstract Data Types and Software Validation",
  Journal =	 CACM,
  Volume =	 21,
  Number =	 12,
  Month =	 dec,
  Year =	 1978,
  Pages =	 "1048-1064",
  Annote =	 "Use of algebraic axiomatizations in proofs and tools
                  to automate proofs. Data type induction. 25
                  references."
}

@Article{Guttag77,
  Author =	 "John Guttag",
  Title =	 "Abstract Data Types and the Development of Data
                  Structures",
  Journal =	 CACM,
  Month =	 jun,
  Year =	 1977,
  Volume =	 20,
  Number =	 6,
  Pages =	 "396-404",
  Annote =	 "Application of algebraic specifications for data
                  structures. 25 references."
}

@Article{Guttag80,
  Author =	 "John Guttag",
  Title =	 "Notes on Type Abstractions (Version 2)",
  Journal =	 IEEETSE,
  Volume =	 "SE-6",
  Number =	 1,
  Month =	 jan,
  Year =	 1980,
  Pages =	 "13-23",
  Note =	 "Version 1 in {\em Proceedings Specifications of
                  Reliable Software}, Cambridge, Mass., IEEE, April,
                  1979",
  Annote =	 "Axiomatic data type specifications. 22 references."
}

@InCollection{Guttag93,
  Author =	 "J. V. Guttag",
  Title =	 "Goldilocks and the Three Specifications",
  Series =	 LNCS,
  Number =	 668,
  Publisher =	 SV,
  Address =	 NY,
  Editor =	 "M. C. Gaudel and J. P. Jouannaud",
  Year =	 1993,
  BookTitle =	 "TAPSOFT '93: Theory and Practice of Software
                  Development. 4th International Joint Conference
                  CAAP/FASE France, April 1993. Proceedings.",
  Pages =	 "1-14",
  Annote =	 "9 references"
}

@Article{Habermann-Flon-Cooprider76,
  Author =	 "A. N. Habermann and Lawrence Flon and Lee Cooprider",
  Title =	 "Modularization and Hierarchy in a Family of
                  Operating Systems",
  Journal =	 CACM,
  Volume =	 19,
  Number =	 5,
  Year =	 1976,
  Month =	 may,
  Pages =	 "266-272",
  Annote =	 "Design philosophy for a family of operating
                  systems. Family members share software. Concepts of
                  module and level do not coincide in a hierarchy of
                  functions. 9 references."
}

@Article{Habermann-Notkin86,
  Author =	 "A. Nico Habermann and David Notkin",
  Title =	 "Gandalf: Software Development Environments",
  Journal =	 IEEETSE,
  Volume =	 "SE-12",
  Number =	 12,
  Month =	 dec,
  Year =	 1986,
  Pages =	 "1117-1127",
  Annote =	 "67 references."
}

@TechReport{Haddad-Hussain-Leavens10a,
  author = 	 {Ghaith Haddad and Faraz Hussain and Gary T. Leavens},
  title = 	 {The Design of {SafeJML}, a Specification Language for {SCJ} with Support for {WCET} Specification},
  institution =  {School of Electrical Engineering and Computer Science, 
University of Central Florida},
  year = 	 2010,
  number = 	 {CS-TR-10-06},
  address = 	 {Orlando, Florida},
  month = 	 jun,
  annote = 	 {38 references.}
}

@inproceedings{Haddad-Hussain-Leavens10b,
 author = {Ghaith Haddad and Faraz Hussain and Gary T. Leavens},
 title = {The design of {SafeJML}, a specification language for {SCJ} with support for {WCET} specification},
 booktitle = {Proceedings of the 8th International Workshop on Java Technologies for Real-Time and Embedded Systems},
 series = {JTRES '10},
 year = {2010},
 isbn = {978-1-4503-0122-0},
 location = {Prague, Czech Republic},
 pages = {155--163},
 url = {http://doi.acm.org/10.1145/1850771.1850793},
 doi = {http://doi.acm.org/10.1145/1850771.1850793},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {SafeJML, WCET, duration, java modeling language (JML), performance, safety critical Java (SCJ), timing behavior},
}
               
@TechReport{Haddad-Leavens08,
  author = 	 {Ghaith Haddad and Gary T. Leavens},
  title = 	 {Extensible Dynamic Analysis for {JML}: A Case Study with Loop Annotations},
  institution =  {School of Electrical Engineering and Computer Science, 
University of Central Florida},
  year = 	 2008,
  number = 	 {CS-TR-08-05},
  address = 	 {Orlando, Florida},
  month = 	 {April},
  annote = 	 {18 references.}
}
                  
@TechReport{Haddad-Leavens11,
  author = 	 {Ghaith Haddad and Gary T. Leavens},
  title = 	 {Specifying Subtypes in {SCJ} Programs},
  institution =  {Dept.\ of Electrical Engineering and Computer Science, University of Central Florida},
  year = 	 2011,
  number = 	 {CS-TR-11-04},
  address = 	 {Orlando, Florida},
  month = 	 {July},
  URL =          {http://http://www.eecs.ucf.edu/~leavens/tech-reports/UCF/CS-TR-11-04/TR.pdf},
  annote = 	 {35 references.}
}

@inproceedings{Haddad-Leavens11b,
 author = {Haddad, Ghaith and Leavens, Gary T.},
 title = {Specifying subtypes in {SCJ} programs},
 booktitle = {Proceedings of the 9th International Workshop on Java Technologies for Real-Time and Embedded Systems},
 series = {JTRES '11},
 year = {2011},
 isbn = {978-1-4503-0731-4},
 location = {York, United Kingdom},
 pages = {40--46},
 numpages = {7},
 url = {http://doi.acm.org/10.1145/2043910.2043917},
 doi = {http://doi.acm.org/10.1145/2043910.2043917},
 acmid = {2043917},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {Java modeling language (JML), SafeJML, WCET, duration, performance, safety critical Java (SCJ), timing behavior},
}
 
@article {Haddad-Leavens12,
author = {Ghaith Haddad and Gary T. Leavens},
title = {Specifying subtypes in {Safety Critical Java} programs},
journal = {Concurrency and Computation: Practice and Experience},
publisher = {John Wiley \& Sons, Ltd},
url = {http://dx.doi.org/10.1002/cpe.2930},
doi = {10.1002/cpe.2930},
pages = {n/a--n/a},
keywords = {SafeJML, Safety Critical Java (SCJ), Java Modeling Language (JML), timing behavior, duration, performance, WCET},
year = 2012,
}

@article {Haddad-Leavens13,
author = {Ghaith Haddad and Gary T. Leavens},
title = {Specifying subtypes in {Safety Critical Java} programs},
journal = {Concurrency and Computation: Practice and Experience},
publisher = {John Wiley \& Sons, Ltd},
url = {http://dx.doi.org/10.1002/cpe.2930},
doi = {10.1002/cpe.2930},
volume=25,
number=16,
pages = {2290-2306},
keywords = {SafeJML, Safety Critical Java (SCJ), Java Modeling Language (JML), timing behavior, duration, performance, WCET},
month = nov,                  
year = 2013,
}

@TechReport{Haddad12,
  author = 	 {Ghaith Haddad},
  title = 	 {Specification and Runtime Checking of Timing Constraints in Safety Critical Java},
  institution =  {Dept. of EECS, University of Central Florida},
  year = 	 2012,
  number = 	 {CS-TR-12-06},
  address = 	 {Orlando, Florida},
  month = 	 oct,
  annote = 	 {103 references.}
}

@MastersThesis{Haggard05,
	Author = {Westley Haggard},
	Title = {{nContract} -- Creating Configurable Run-Time Contract Verification for {.NET} Components},
	School = {Virginia Polytechnic Institute and State University},
	Month = mar,
	Year = {2005},
	Pages = {95},
	Annote = {23 References}
} 

@Article{Hajnal-Sorgacs98,
  author =	 {\'{A}kos Hajnal and Istv\'{a}n Sorg\'{a}cs},
  title =	 {An Applicable Test Data Generation Algorithm for
                  Domain Errors},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 2,
  month =	 mar,
  pages =	 {63-72},
  note =	 {ISSTA 98: Proceedings of the ACM SIGSOFT
                  Internatioal Symposium on Software Testing and
                  Analysis},
  annote =	 {15 references.}
}

@InProceedings{Hakonen-etal99,
  Author =	 {Harri Hakonen and Ville Lepp\"{a}nen and Timo Raita and 
                  Tapio Salakoski and Jukka Teuhola},
  Title =	 {Improving Object Integrity and Preventing Side Effects 
                  via Deeply Immutable References},
  BookTitle =	 {Proceedings of Sixth Fenno-Ugric Symposium on Software 
                  Technology, FUSST'99},
  pages =	 {139-150},
  Year =	 {1999}
}

@Article{Hall-Chapman02,
  author = 	 {Anthony Hall and Roderick Chapman},
  title = 	 {Correctness by Construction: Developing a Commercial Secure System},
  journal = 	 {IEEE Software},
  year = 	 2002,
  volume =       19,
  nubmer =       1,
  pages = 	 {18-25},
  month = 	 {jan},
  annote = 	 {12 references.}
}

@INPROCEEDINGS{Hall-Isaac92,
author={A. Hall and D. Isaac}, 
title={Formal methods in a real air traffic control project}, 
booktitle={Software in Air Traffic Control Systems - The Future, {IEE} Colloquium on}, 
year={1992}, 
month=jun, 
pages={7/1-7/4}
}


@Article{Hall90,
  Author =	 "Anthony Hall",
  Title =	 "Seven Myths of Formal Methods",
  Journal =	 "IEEE Software",
  Volume =	 7,
  Number =	 5,
  Month =	 sep,
  Year =	 1990,
  Pages =	 "11-19",
  Annote =	 "10 references."
}

@Article{Hall96,
  author =	"Anthony Hall",
  title =	"Using Formal Methods to Develop an {ATC} Information System",
  journal =	"IEEE Software",
  volume =	13,
  number =	2,
  pages =	"66-76",
  month =	mar,
  year = 	1996
}

@Article{Hallstrom-Soundarajan02,
  author = 	 {Jason Hallstrom and Neelam Soundarajan},
  title = 	 {Incremental Development Using Object Oriented Frameworks: A Case Study},
  journal = 	 JOT,
  year = 	 2002,
  volume =	 1,
  number =	 3,
  pages =	 {189-205},
  month =	 aug,
  URL = 	 {http://www.jot.fm/issues/issue_2002_08/article11},
  annote =	 {10 references.}
}

@InProceedings{Hallstrom-Soundarajan08,
  author = 	 {Jason Hallstrom and Neelam Soundarajan},
  title = {Formalizing Design Patterns: A Comprehensive Contract for Composite},
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {77-82},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  annote = 	 {14 references.},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/Hallstrom-Soundarajan.pdf}
}

@InProceedings{Hamie02,
  author = 	 {Ali Hamie},
  title = 	 {Towards Verifying Java Realizations of OCL-Constrained Design  Models Using JML},
  booktitle =	 {6th IASTED International Conference on Software Engineering and Applications},
  year =	 2002,
  URL = 	 {http://www.cmis.brighton.ac.uk/staff/aah1/home_files/Publications/SEA2002.pdf}
}

@InCollection{Hamilton-Zeldin79,
  Author =	 "M. Hamilton and S. Zeldin",
  Title =	 "Discussion of An Appraisal of Program
                  Specifications",
  BookTitle =	 "Research Directions in Software Technology",
  Editor =	 "Peter Wegner",
  Publisher =	 MITP,
  Address =	 "Cambridge, Mass.",
  Year =	 1979,
  Pages =	 "376-380",
  Annote =	 "10 references."
}

@InProceedings{Hamilton92,
  Author =	 "V. Hamilton",
  Title =	 "Experience of combining {Y}ourdon and {V}{D}{M}",
  BookTitle =	 "Proceedings of the Methods Integration Workshop",
  Publisher =	 SV,
  Year =	 1992
}

@Article{Hamlet77,
  Author =	 {R. G. Hamlet},
  Title =	 {Testing Programs with the Aid of a Compiler},
  Journal =	 IEEETSE,
  Year =	 1977,
  Volume =	 {3},
  Number =	 {4},
  Month =	 jul,
  Pages =	 {279-290}
}

% doi = {10.1145/3360592},
@article{Hamza-Voirol-Kuncak19,
author = {Jad Hamza and Nicolas Voirol and Viktor Kun\v{c}ak},
title = {{System FR}: Formalized Foundations for the {Stainless} Verifier},
year = 2019,
issue_date = {October 2019},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
volume = 3,
number = {OOPSLA},
url = {https://doi.org/10.1145/3360592},
abstract = {We present the design, implementation, and foundation of a verifier for higher-order functional programs with generics and recursive data types. Our system supports proving safety and termination using preconditions, postconditions and assertions. It supports writing proof hints using assertions and recursive calls. To formalize the soundness of the system we introduce System FR, a calculus supporting System F polymorphism, dependent refinement types, and recursive types (including recursion through contravariant positions of function types). Through the use of sized types, System FR supports reasoning about termination of lazy data structures such as streams. We formalize a reducibility argument using the Coq proof assistant and prove the soundness of a type-checker with respect to call-by-value semantics, ensuring type safety and normalization for typeable programs. Our program verifier is implemented as an alternative verification-condition generator for the Stainless tool, which relies on the Inox SMT-based solver backend for automation. We demonstrate the efficiency of our approach by verifying a collection of higher-order functional programs comprising around 14000 lines of polymorphic higher-order Scala code, including graph search algorithms, basic number theory, monad laws, functional data structures, and assignments from popular Functional Programming MOOCs.},
journal = {Proc. ACM Program. Lang.},
month = oct,
articleno = 166,
numpages = 30,
keywords = {System F, dependent types, recursive types, software verification, SMT},
annote="62 references."
}

@InProceedings{Hannemann-Kiczales02,
  author =	 "Jan Hannemann and Gregor Kiczales",
  title =	 "Design pattern implementation in {Java} and
                  {AspectJ}",
  pages =	 "161-173",
  editor =	 "Cindy Norris and Jr. James B. Fenwick",
  booktitle =	 "Proceedings of the 17th {ACM} conference on
                  Object-oriented programming, systems, languages, and
                  applications ({OOPSLA}-02)",
  month =	 nov # " ~4--8",
  series =	 "ACM SIGPLAN Notices",
  volume =	 "37, 11",
  publisher =	 "ACM Press",
  address =	 "New York",
  year =	 "2002"
}

@InCollection{Hansen08,
  author = 	 {Michael R. Hansen},
  title = 	 {Duration Calculus},
  crossref =  {Bjorner-Henson08},
  pages = 	 {299-347},
  annote = 	 {152 references.}
}

@Article{Harel-Kahana92,
  Author =	 "David Harel and Chaim-Arie Kahana",
  Title =	 "On Statecharts with Overlapping",
  Journal =	 TOSEM,
  Year =	 1992,
  Volume =	 1,
  Number =	 4,
  Month =	 oct,
  Pages =	 "399-421",
  Annote =	 "13 references."
}

@Article{Harel-Kupferman02,
  author =	 {David Harel and Orna Kupferman},
  title =	 {On Object Systems and Behavioral Inheritance},
  journal =	 IEEETSE,
  year =	 2002,
  volume =	 28,
  number =	 9,
  pages =	 {889-903},
  month =	 sep,
  annote =	 {26 references.}
}

@book{Harel-Tiuryn-Kozen00,
 author = {David Harel and Jerzy Tiuryn and Dexter Kozen},
 title = {Dynamic Logic},
 year = {2000},
 isbn = {0262082896},
 publisher = {MIT Press},
 address = {Cambridge, MA, USA},
}

@InProceedings{Harel-etal87,
  author =	 "D. Harel and A. Pnueli and J. P. Schmidt and
                  R. Sherman",
  title =	 "On the Formal Semantics of Statecharts",
  booktitle =	 "IEEE Symposium on Logic in Computer Science",
  pages =	 "54-64",
  year =	 "1987"
}

@Article{Harel-etal90,
  Author =	 "David Harel and Hagi Lachover and Amnon Naamad and
                  Amir Pnueli and Michal Politi and Rivi Sherman and
                  Aharon Shtull-trauring and Mark Trakhtenbrot",
  Title =	 "STATEMATE: A working Environment for the Development
                  of Complex Reactive Systems",
  Journal =	 IEEETSE,
  Year =	 1990,
  Volume =	 16,
  Number =	 4,
  Month =	 apr,
  Pages =	 "403-413",
  Annote =	 "22 references."
} 

@Article{Harel87,
  Author =	 "David Harel",
  Title =	 "Statecharts: A Visual Formalism for Complex Systems",
  Journal =	 SCP,
  Year =	 1987,
  Volume =	 8,
  Number =	 3,
  Month =	 jun,
  Pages =	 "231-274"
}

@Article{Harel92,
  Author =	 "David Harel",
  Title =	 "Biting the Silver Bullet",
  Journal =	 "Computer",
  Year =	 1992,
  Volume =	 21,
  Number =	 1,
  Month =	 jan,
  Pages =	 "8-20",
  Annote =	 "A vanillia approach to systems design, based on an
                  analogy to a conventional programming language. That
                  is the designer should have ability to execute and
                  debug designs. Visual elements are also
                  important. 20 references."
}

@inproceedings{Harman07,
 author = {Mark Harman},
 title = {Automated Test Data Generation using Search Based Software Engineering},
 booktitle = {AST '07: Proceedings of the Second International Workshop on Automation of Software Test},
 year = {2007},
 isbn = {0-7695-2971-2},
 pages = {2},
 doi = {http://dx.doi.org/10.1109/AST.2007.4},
 publisher = {IEEE Computer Society},
 address = {Washington, DC, USA}
}

@inproceedings{Harman07a,
 author = {Mark Harman},
 title = {The Current State and Future of Search Based Software Engineering},
 booktitle = {FOSE '07: 2007 Future of Software Engineering},
 year = {2007},
 isbn = {0-7695-2829-5},
 pages = {342--357},
 doi = {http://dx.doi.org/10.1109/FOSE.2007.29},
 publisher = {IEEE Computer Society},
 address = {Washington, DC, USA}
}
                  
@Article{Harms-Weide91,
  author =	 {Douglas E. Harms and Bruce W. Weide},
  title =	 {Copying and Swapping: Influences on the Design of
                  Reusable Software Components},
  journal =	 IEEETSE,
  year =	 1991,
  volume =	 17,
  number =	 5,
  month =	 may,
  pages =	 {424-435},
  annote =	 {Part of the rationale for RESOLVE. 23 references.}
}

@InProceedings{Harrison-Ossher93,
  author =	 "William Harrison and Harold Ossher",
  title =	 "Subject-Oriented Programming (A Critique of Pure
                  Objects)",
  booktitle =    {OOPSLA '93: Proceedings of the eighth annual conference 
                    on Object-oriented programming, systems, languages, and
                    applications},
  publisher =	 ACM,
  address =	 NY,
  year =	 1993,
  editor =	 "Andreas Paepcke",
  volume =	 "28(10)",
  series =	 SIGPLAN,
  pages =	 "411-428",
  month =	 oct,
  annote =	 "Subjectivity. 24 references."
}
                  
@Book{Harrison-Thimbleby90,
  Author =	 "Michael Harrison and Harold Thimbleby",
  Title =	 "Formal Methods in Human-Computer Interaction",
  Series =	 "Cambridge Series on Human-Computer Interaction",
  Publisher =	 "Cambridge University Press",
  Address =	 NY,
  Year =	 1990,
  Annote =	 "214 references."
}

@InProceedings{Harrison86,
  Author =	 "William Harrison",
  Title =	 "A Program Development Environment for Programming by
                  Refinement and Reuse",
  BookTitle =	 "Nineteenth Annual Hawii International Conference on
                  System Sciences",
  Year =	 1986,
  Organization = "University of Hawii, ACM, IEEE",
  Pages =	 "459-469",
  Annote =	 "RPDE project. 24 references."
}

@Book{Harry96,
  author =	 {Andrew Harry},
  title =	 {Formal Methods Fact File: {VDM and Z}},
  publisher =	 {Wiley},
  year =	 1996,
  address =	 NY,
  annote =	 {4 references.}
}

@book{Hatcher-Loughran03,
	Author = {Erik Hatcher and Steve Loughran},
	Address = {Greenwich, CT},
	Publisher = {Manning},
	Title = {Java Development with {Ant}},
	Year = {2003}
}

@InProceedings{Hatcliff-etal03,
author = {John Hatcliff and Xinghua Deng and Matthew B. Dwyer and
Georg Jung and Venkatesh Prasad Ranganath},
title = {Cadena: An Integrated Development, Analysis, and Verification
Environment for Component-based Systems},
booktitle = {International Conference on Software Engineering (ICSE)},
year = {2003},
issn = {0270-5257},
pages = {160},
doi = {http://doi.ieeecomputersociety.org/10.1109/ICSE.2003.1201197},
publisher = {IEEE Computer Society},
address = {Los Alamitos, CA, USA}
}

@TechReport{Hatcliff-etal09,
  author = 	 {John Hatcliff and Gary T. Leavens and K. Rustan M. Leino and Peter M\"{u}ller and Matthew Parkinson},
  title = 	 {Behavioral Interface Specification Languages},
  institution =  {University of Central Florida, School of EECS},
  year = 	 2009,
  number = 	 {CS-TR-09-01},
  address = 	 {Orlando, FL},
  month = 	 mar,
  url = {\url{http://www.eecs.ucf.edu/~leavens/tech-reports/UCF/CS-TR-09-01/TR.pdf}}
}

@TechReport{Hatcliff-etal10,
  author = 	 {John Hatcliff and Gary T. Leavens and K. Rustan M. Leino and Peter M\"{u}ller and Matthew Parkinson},
  title = 	 {Behavioral Interface Specification Languages},
  institution =  {University of Central Florida, School of EECS},
  year = 	 2010,
  number = 	 {CS-TR-09-01a},
  address = 	 {Orlando, FL},
  month = 	 oct,
  url = {\url{http://www.eecs.ucf.edu/~leavens/tech-reports/UCF/CS-TR-09-01/TR.pdf}}
}

@Article{Hatcliff-etal12,
 author = 	 {John Hatcliff and Gary T. Leavens and K. Rustan M. Leino and Peter M\"{u}ller and Matthew Parkinson},
 title = 	 {Behavioral Interface Specification Languages},
 journal =      ACMCS,
 volume = 44,
 number = 3,
 month = jun,
 year = 2012,
 pages = {16:1--16:58},
 url = {http://doi.acm.org/10.1145/2187671.2187678},
 doi = {10.1145/2187671.2187678},
 publisher = ACM,
 address = NY
} 
                  
@Book{Hatley-Pirbhai87,
  Author =	 "D. J. Hatley and I. Pirbhai",
  Title =	 "Strategies for Real-Time System Specification",
  Publisher =	 "Dorset House",
  Year =	 1987,
  Address =	 NY
}

@Article{Hatton97,
  author =	 {Les Hatton},
  title =	 {N-Version Design Versus One Good Version},
  journal =	 {IEEE Software},
  year =	 1997,
  volume =	 14,
  number =	 6,
  month =	 nov,
  pages =	 {71-76},
  annote =	 {Suggests that n-version development is
                  preferable. 12 references.}
}

@Article{Hatton98,
  author =	 {Les Hatton},
  title =	 {Does {OO} Sync with How We Think?},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 3,
  month =	 may,
  pages =	 {46-54},
  annote =	 {No, in a study an OO C++ implementation had a
                  ``poorer defect density'' and took longer to debug
                  than an equivalent non-OO system in C. The problem
                  seems partly attributable to inheritance. 13
                  references.}
}

@Article{Havelund-Pressburger00,
  author = 	 {Klaus Havelund and Thomas Pressburger},
  title = 	 {Model Checking {Java} Programs Using {Java PathFinder}},
  journal = 	 {International Journal on Software Tools 
                  for Technology Transfer},
  volume =       2,
  number =       4,
  month =        apr,
  year = 	 {2000},
  publisher =    SV
}

@InProceedings{Havelund-Rosu01,
  author =	 "Klaus Havelund and Grigore Rosu",
  title =	 "Monitoring {Java} Programs with {Java PathExplorer}",
  BookTitle =	 "Workshop on Runtime Verification held in conjunction
                  with the 13th Conference on Computer Aided
                  Verification, CAV'01",
  year =	 "2001",
  Note =	 "Published in {\em Electronic Notes in Theoretical
                  Computer Science}, K. Havelund and G. Rosu (eds.),
                  55(2), 2001. Available from \url{www.sciencedirect.com}."
}

@InProceedings{Havelund-Rosu01b,
  author =	 "Klaus Havelund and Grigore Rosu",
  title =	 "{Java PathExplorer} --- A runtime verification tool",
  BookTitle =	 "Proceedings 6th International Symposium on
                  Artificial Intelligence, Robotics and Automation in
                  Space, ISAIRAS'01, Montreal, Canada, June 18--22,
                  2001.",
  year =	 "2001"
}

@TechReport{Haxthausen92,
  Author =	 "Anne Elisabeth Haxthausen",
  Title =	 "{RAISE} Language and Method Evolution",
  Institution =	 "Computer Resources International A/S",
  Year =	 1994,
  Address =	 "Bregneroedvej 144, P. O. Box 173, DK-3460 Birkeroed,
                  Denmark",
  Month =	 jan,
  Annote =	 "0 references."
}

@TechReport{Hayes-Coleman-Bear89,
  Author =	 "Fiona Hayes and Derek Coleman and S. Bear",
  Title =	 "Introducing ObjectCharts or How to Use Statecharts
                  in Object Oriented Design",
  Institution =	 "Information Management Lab, Hewlett Packard
                  Laboratories",
  Type =	 "Technical Memo",
  Number =	 "?",
  Month =	 nov,
  Year =	 1989,
  Annote =	 "6 references."
}

@Article{Hayes-Coleman-Bear92,
  Author =	 "Fiona Hayes and Derek Coleman and S. Bear",
  Title =	 "Introducing ObjectCharts or How to Use Statecharts
                  in Object Oriented Design",
  Journal =	 IEEETSE,
  Volume =	 18,
  Number =	 1,
  Month =	 jan,
  Year =	 1992,
  Pages =	 "9-18",
  Annote =	 "16 references."
}

@inproceedings{Hayes-Jackson-Jones03,
  author    = {Ian J. Hayes and Michael Jackson and Cliff B. Jones},
  title     = {Determining the Specification of a Control System from that
               of its Environment},
  booktitle = {FME},
  year      = {2003},
  pages     = {154-169},
  crossref  = {FME03},
}

@Article{Hayes-Jones-Nicholls94,
  Author =	 "I.J. Hayes and C.B. Jones and J.E. Nicholls",
  Title =	 "Understanding the Differences Between {VDM} and {Z}",
  Journal =	 "Software Engineering Notes",
  Year =	 1994,
  Volume =	 19,
  Number =	 3,
  Month =	 jul,
  Pages =	 "69-74",
  Annote =	 "14 references."
}

@article{Hayes-Jones89,
  author =	 {Ian J. Hayes and Cliff B. Jones},
  title =	 {Specifications are not (necessarily) executable},
  journal =	 {Software Engineering Journal},
  year =	 {1989},
  month =	 nov,
  volume =	 {4},
  number =	 {6},
  pages =	 {330-338},
  annote =	 {20 references. See also Fuchs92, Specifications are
                  (preferably) executable.}
}

@TechReport{Hayes-Jones89a,
  Author =	 "Ian J. Hayes and Cliff B. Jones",
  Title =	 "Specifications are not (necessarily) executable",
  Institution =	 "Department of Computer Science, University of
                  Manchester",
  Address =	 "Manchester M13 9PL, England",
  Month =	 dec,
  Year =	 1989,
  Number =	 "UMCS-90-12-1",
  Annote =	 "20 references."
}

@Article{Hayes-Utting01,
  author =	 "Ian J. Hayes and Mark Utting",
  title =	 "A sequential real-time refinement calculus",
  journal =	 "Acta Informatica",
  volume =	 "37",
  number =	 "6",
  pages =	 "385-448",
  year =	 2001
}

@InProceedings{Hayes00,
  author =	 "Ian J. Hayes",
  title =	 "Real-Time Program Refinement Using Auxiliary
                  Variables",
  booktitle =	 "Formal Techniques in Real-Time and Fault-Tolerant
                  Systems",
  editor =	 "M. Joseph",
  series =	 LNCS,
  volume =	 1926,
  pages =	 "170-184",
  publisher =	 SV,
  year =	 2000
}

@Article{Hayes02,
  author =	 "Ian J. Hayes",
  title =	 "Reasoning about Real-time Repetitions: Terminating
                  and Nonterminating",
  journal =	 SCP,
  volume =	 "43",
  number =	 "2-3",
  pages =	 "161-192",
  year =	 "2002",
  month =	 "May-June"
}

@Book{Hayes87,
  Editor =	 "I. Hayes",
  Title =	 "Specification Case Studies",
  Publisher =	 Prentice-Hall,
  Series =	 "International Series in Computer Science",
  Year =	 1987,
  Annote =	 "Introduces the Z specification language."
}

@Book{Hayes93,
  Editor =	 "I. Hayes",
  Title =	 "Specification Case Studies",
  Publisher =	 Prentice-Hall,
  Series =	 "International Series in Computer Science",
  Address =      "London",
  Year =	 1993,
  Edition =	 "Second",
  Annote =	 "Introduces the Z specification language."
}

@Book{Headington-Riley94,
  author =	 {M. R. Headington and D.D. Riley},
  title =	 {Data Abstraction and Structures Using {C++}},
  publisher =	 {Heath},
  year =	 1994
}

@InProceedings{Heaven-Russo08,
  author = {William Heaven and Alessandra Russo},
  title = {Using Analysis Patterns to Uncover Specification Errors},
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {35-42},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  annote = 	 {18 references.},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/Heaven-Russo.pdf}
}

@Article{Hecker99,
  author =	 {Frank Hecker},
  title =	 {Setting Up Shop: The Business of Open-Source
                  Software},
  journal =	 {IEEE Software},
  year =	 1999,
  volume =	 16,
  number =	 1,
  month =	 jan,
  pages =	 {45-51}
}

@PhdThesis{Hegazy89,
  author = 	 {W. A. Hegazy},
  title = 	 {The Requirements of Testing a Class of Reusable Software Modules},
  school = 	 {Ohio State University},
  year = 	 1989,
}

@InProceedings{Hehner-Bravell99,
  author =       "Eric C. R. Hehner and Andrew M. Gravell",
  title =        "Refinement Semantics and Loop Rules",
  editor =       "Jeanette M. Wing and Jim Woodcock and Jim Davies",
  booktitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  series =	 LNCS,
  publisher =	 SV,
  number =	 1709,
  year =	 1999,
  pages =        "1497-1510",
  annote =       "Rules for while-loops, for-loops, and variations.  9 references.",
}

@Article{Hehner-Gupta-Malton86,
  Author =	 "Eric C. Hehner and Lorene E. Gupta and Andrew
                  J. Malton",
  Title =	 "?",
  Journal =	 "Acta Informatica",
  Volume =	 23,
  Number =	 5,
  Month =	 sep,
  Year =	 1986,
  Pages =	 "487-505"
}

@Misc{Hehner05,
  author =	 {Eric C. R. Hehner},
  title =	 {Specified Blocks},
  howpublished = {Verified Software: Theories, Tools, Experiments
                  (VSTTE)},
  month =	 oct,
  year =	 2005,
  annote =	 {4 references},
  note = {\url{http://tinyurl.com/2a7kf2}},
  URL = {http://vstte.inf.ethz.ch/Files/hehner.pdf}
}

@incollection{Hehner89,
  author    = "Eric C. R. Hehner",
  title     = "Termination is timing",
  pages     = "36-47",
  booktitle = "Mathematics of Program Construction",
  editor    = "Jan L. A. van de Snepscheut",
  series    = LNCS,
  publisher = SV,
  address   = {Berlin},
  volume    = 375,
  year      = 1989
}

@Book{Hehner93,
  Author =	 "Eric C. R. Hehner",
  Title =	 "A Practical Theory of Programming",
  Publisher =	 SV,
  Address =      NY,
  Series =	 "Texts and Monographs in Computer Science",
  Year =	 1993,
  Annote =	 "60 references",
  note =         "Available from \url{http://www.cs.utoronto.ca/~hehner/aPToP}."
}

@Article{Hehner98,
  author =	 {Eric C. R. Hehner},
  title =	 {Formalization of Time and Space},
  journal =	 {Formal Aspects of Computing},
  year =	 1998,
  volume =	 10,
  pages =	 {290-306}
}

@Article{Hehner99,
  author =	 {Eric C. R. Hehner},
  title =	 {Specifications, programs, and total correctness},
  journal =	 {Science of Computer Programming},
  year =	 1999,
  volume =	 34,
  pages =	 {191-205},
  annote =	 {Argues that a formal specification is a boolean
                  expression, that a program is a formal
                  specification, and that total correctness is worse
                  than partial correctness plus time. 20 references.}
}

@InProceedings{Heimdahl-Leveson95,
  author =	 "Mats P. E. Heimdahl and Nancy G. Leveson",
  title =	 "Completeness and Consistency Analysis of State-Based
                  Requirements",
  pages =	 "3--14",
  booktitle =	 "Proceedings of the~17th~International Conference on
                  Software Engineering",
  year =	 "1995",
  publisher =	 "ACM Press",
  month =	 apr
}

@inproceedings{Heimdahl-Whalen-Thompson03,
 author = {Mats P. E. Heimdahl and Michael W. Whalen and Jeffrey M. Thompson},
 title = {{NIMBUS}: A Tool for Specification Centered Development},
 booktitle = {RE '03: Proceedings of the 11th IEEE International Conference on Requirements Engineering},
 year = 2003,
 pages = 349,
 publisher = {IEEE Computer Society},
 address = {Washington, DC, USA}
}

@inproceedings{Heimdahl07,
 author = {Mats P. E. Heimdahl},
 title = {Safety and Software Intensive Systems: Challenges Old and New},
 booktitle = {FOSE '07: 2007 Future of Software Engineering},
 year = {2007},
 isbn = {0-7695-2829-5},
 pages = {137--152},
 doi = {http://dx.doi.org/10.1109/FOSE.2007.18},
 publisher = {IEEE Computer Society},
 address = {Washington, DC, USA},
}

@InProceedings{Heitmeyer-Jeffords07,
  author = 	 {Constance L. Heitmeyer and Ralph D. Jeffords},
  title = 	 {Applying a Formal Requirements Method to Three {NASA} Systems: Lessons Learned},
  booktitle = {Proceedings of the 2007 IEEE Aerospace Conference},
  year = 	 2007,
  month = 	 {mar},
  publisher =	 {IEEE Computer Society Press},
  address =	 {Los Alamitos, California},
  URL = 	 {http://chacs.nrl.navy.mil/publications/CHACS/2007/2007heitmeyer-IEEEAero.pdf}
}
                  
@InProceedings{Heitmeyer-etal07,
  author = 	 {Constance Heitmeyer and Ralph Jeffords and Ramesh Bharadwaj and Myla Archer},
  title = 	 {RE Theory Meets Software Practice: Lessons from the Software Development Trenches},
  booktitle = {15th IEEE International Requirements Engineering Conference, 2007 (RE '07)}, 
  pages = 	 {265-268},
  year = 	 2007,
  month = 	 oct,
  publisher =    {IEEE},
  address =	 {Los Alamitos, California},
  URL =          {http://chacs.nrl.navy.mil/publications/CHACS/2007/2007heitmeyer-RE07.pdf}
}

@Article{Heitmeyer-etal98,
  author =	 {Constance Heitmeyer and James {Kirby, Jr.} and Bruce
                  Labaw and Myla Archer and Ramesh Bharadwaj},
  title =	 {Using Abstraction and Model Checking to Detect
                  Safety Violations in Requirements Specifications},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 11,
  month =	 nov,
  pages =	 {927-948},
  annote =	 {66 references.}
}

@Article{Helm-Holland-Gangopadhyay90,
  Author =	 "R. Helm and I. Holland and D. Gangopadhyay",
  Title =	 "Contracts: Specifying Behavioral Compositions in
                  Object-Oriented System",
  Journal =	 SIGPLAN,
  Year =	 1990,
  Volume =	 25,
  Number =	 10,
  Month =	 oct,
  Pages =	 "169-180",
  Note =	 "{\em OOPSLA ECOOP '90 Proceedings}, N. Meyrowitz
                  (editor).",
  Annote =	 "26 references."
}
                  
@incollection{Hemer-Hayes-Strooper01,
  author={David Hemer and Ian Hayes and Paul Strooper},
  title={Refinement Calculus for Logic Programming in Isabelle/HOL},
year={2001},
isbn={978-3-540-42525-0},
booktitle={Theorem Proving in Higher Order Logics},
volume={2152},
series={Lecture Notes in Computer Science},
editor={Boulton, RichardJ. and Jackson, PaulB.},
doi={10.1007/3-540-44755-5_18},
url={http://dx.doi.org/10.1007/3-540-44755-5_18},
publisher=SV,
pages={249-260},
}
                  
@Article{Henninger94,
  author =	 {Scott Henninger},
  title =	 {Using Iterative Refinement to Find Reusable
                  Software},
  journal =	 {IEEE Software},
  year =	 1994,
  volume =	 11,
  number =	 5,
  month =	 sep,
  pages =	 {48-59},
  annote =	 {11 references.}
}

@article{ Henties-etal09,
  author =       "Thomas Henties and James J. Hunt and Doug Locke and Kelvin Nilsen and Martin Schoeberl and Jan Vitek",
  title =        "Java for Safety-Critical Applications",
  journal =      "2nd International Workshop on the Certification of Safety-Critical Software Controlled Systems (SafeCert 2009)",
  year =         "2009",
  month =        "Mar."
}

@InCollection{Henziger-Manna-Pneuli92,
  Author =	 "T. A. Henziger and Z. Manna and A. Pneuli",
  Title =	 "Temporal Proof Methodologies for Real-Time Systems",
  BookTitle =	 "Real-Time Systems: Abstractions, Languages, and
                  Design Methodologies",
  Publisher =	 "IEEE Computer Society Press",
  Year =	 1992,
  Editor =	 "Krishna M. Kavi",
  Pages =	 "145-158",
  Address =	 "Los Alamitos, California",
  Month =	 oct,
  Annote =	 "14 references."
}

@Article{Herlihy-Wing90,
  Author =	 "Maurice P. Herlihy and Jeannette M. Wing",
  Title =	 "Linerizability: A Correctness Condition for Atomic
                  Objects",
  Journal =	 TOPLAS,
  Volume =	 12,
  Number =	 3,
  Month =	 jul,
  Year =	 1990,
  Pages =	 "463-492",
  Annote =	 "Correctness condition that exploits the semantics of
                  abstract types. 46 references."
}

@Article{Hermenegildo-etal05,
  author =       {Manuel V. Hermenegildo and Germ{\'a}n Puebla and
                  Francisco Bueno and Pedro L{\'o}pez-Garc{\'\i}a},
  title =        {Integrated program debugging, verification, and
                  optimization using abstract interpretation (and the
                  {Ciao} system preprocessor)},
  journal =      {Sci. Comput. Program.},
  year =         2005,
  volume =       58,
  number =       {1-2},
  pages =        {115-140}
}

@InCollection{Hesselink-Reinds93,
  Author =	 "W. H. Hesselink and R. Reinds",
  Title =	 "Temporal Preconditions of Recursive Procedures",
  Journal =	 LNCS,
  Number =	 666,
  Editor =	 "J. W. de Baker and W. P. de Rover and G. Rozenberg",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1993,
  Booktitle =	 "Semantics: Foundations and Applications REX
                  Workshop",
  Page =	 "236-260",
  Annote =	 "13 references"
}

@Article{Hesselink88,
  Author =	 "Wim H. Heselink",
  Title =	 "A Mathematical Approach to Nondeterminism in Data
                  Types",
  Journal =	 "TOPLAS",
  Volume =	 10,
  Number =	 1,
  Month =	 jan,
  Year =	 1988,
  Pages =	 "87-117",
  Annote =	 "Model theory for nondeterministic data
                  types. Unfocused signatures. Accumulated arrows are
                  finite programs. Morphisms and strict
                  morphisms. Relations and universal
                  models. Extraction equivalence versus observable
                  equivalence. Notion of an implementation. 18
                  references."
}

@Article{Hesselink89,
  Author =	 "Wim H. Heselink",
  Title =	 "Predicate-Transformer Semantics of General
                  Recursion",
  Journal =	 "Acta Informatica",
  Year =	 1989,
  Volume =	 26,
  Number =	 4,
  Month =	 feb,
  Pages =	 "309-322"
}

@Book{Hesselink92,
  Author =	 "Wim H. Hesselink",
  Title =	 "Programs, Recursion, and Unbounded Choice",
  Publisher =	 "Cambridge University Press",
  Year =	 1992,
  Volume =	 27,
  Series =	 "Cambridge Tracts in Theoretical Computer Science",
  Address =	 NY,
  Annote =	 "Predicate transformation calculus semantics of
                  sequential programs including repetition, recursion,
                  and unbounded nondeterminancy. 50 references."
}

@Article{Hester-Parnas-Utter81,
  Author =	 "S. D. Hester and D. L. Parnas and D. F. Utter",
  Title =	 "Using Documentation as a Software Design Medium",
  Journal =	 BSTJ,
  Volume =	 60,
  Number =	 8,
  Month =	 oct,
  Year =	 1981,
  Pages =	 "1941-1977",
  Annote =	 "Design method based on separation of concerns and
                  information hiding. Structuring of design
                  documents. Expected changes explicitly noted. 16
                  references."
}

@PhdThesis{Heym95,
  author =	 {Wayne D. Heym},
  title =	 {Computer Program Verification: Improvements for
                  Human Reasoning},
  school =	 {The Ohio State University},
  year =	 1995,
  address =	 {Columbus, OH},
  URL =
                  {http://www.cis.ohio-state.edu/rsrg/documents/95HeymDissertation.pdf}
}

@Article{Hierons-etal09,
  author = 	 {Robert M. Hierons and Krill Bogdanov and Jonathan P. Bowen and Rance Claveland and John Derrick and Jeremy Dick and Marian Gherorghe and Mark Harman and Kalpesh Kapoor and Paul Krause and gerald L\"{u}ttgen and Anthony J. H. Simmons and Sergiy Vilkomir and Mrtin R. Woodward and Hussain Zedan},
  title = 	 {Using Formal Specifications to Support Testing},
  journal = 	 ACMCS,
  year = 	 2009,
  volume = 	 41,
  number = 	 2,
  pages = 	 {9:1--9:76},
  month = 	 feb,
  annote = 	 {Many references.}
}

@article{Higashino-Bochmann94,
  Author =	 {Teruo Higashino and Gregor v. Bochmann},
  Title =	 {Automatic Analysis and Test Case Derivation for a
                  Restricted Class of {LOTOS} Expressions with Data
                  Parameters},
  Journal =	 IEEETSE,
  Year =	 1994,
  Volume =	 20,
  Number =	 1,
  Month =	 jan,
  Pages =	 {29--42}
}

@inproceedings{Hill-Pollock-Vijay-Shanker07,
author = {Emily Hill and Lori Pollock and K. Vijay-Shanker},
title = {Exploring the Neighborhood with {Dora} to Expedite Software Maintenance},
booktitle = {22nd IEEE/ACM International Conference on Automated Software Engineering (ASE)},
publisher = {IEEE/ACM},
month = nov,
year = 2007
}

@Article{Hill72,
  Author =	 "I. D. Hill",
  Title =	 "Wouldn't it be nice if we could write computer
                  programs in ordinary English---or would it?",
  Journal =	 "The Computer Bulletin",
  Year =	 "1972",
  Volume =	 16,
  Number =	 6,
  Month =	 jun,
  Pages =	 "306-312"
}

@Book{Hinchey-Bowen95,
  editor =	 "Michael G. Hinchey and Jonathan P. Bowen",
  title =	 "Applications of Formal Methods",
  booktitle =	 "Applications of Formal Methods",
  publisher =	 "Prentice Hall International Series in Computer
                  Science",
  year =	 "1995",
  url =		 "http://www.cl.cam.ac.uk/users/mgh1001/afm-book.html",
  ISBN =	 "0-13-366949-1",
  annote =	 "A collection on industrial examples of the use of
                  formal methods. Many references."
}

@InCollection{Hinchey-Bowen95a,
  author =	 "Michael G. Hinchey and Jonathan P. Bowen",
  title =	 {Applications of Formal Methods {FAQ}},
  booktitle =	 {Applications of Formal Methods},
  publisher =	 {Prentice Hall},
  year =	 1995,
  editor =	 {Michael G. Hinchey and Jonathan P. Bowen},
  series =	 {Prentice Hall International Series in Computer
                  Science},
  chapter =	 1,
  address =	 {London},
  pages =	 {1-15}
}

@InCollection{Hintermeier-Kirchner-Kirchner94,
  Author =	 "Claus Hintermeier and Claude Kirchner and Helene
                  Kirchner",
  Title =	 "Sort Inheritance for Order-Sorted Equational
                  Presentations",
  BookTitle =	 "Recent Trends in Datatype Specification",
  Publisher =	 SV,
  Year =	 1994,
  Editor =	 "Egidio Astesiano and Gianna Reggio and Andrzej
                  Tarlecki",
  Series =	 LNCS,
  Volume =	 906,
  Pages =	 "319-335",
  Address =	 NY,
  Annote =	 "22 references."
}

@Book{Hoare-He98,
  author = "C. A. R. Hoare and Jifeng He",
  title = "Unifying Theories of Programming",
  publisher = "Prentice-Hall International",
  year = 1998,
  address = "Englewood Cliffs, NJ"
}

@InCollection{Hoare-Jifeng99,
  author =	 {C. A. R. Hoare and He Jifeng},
  title =	 {A Trace Model for Pointers and Objects},
  booktitle =	 {ECOOP '99 --- Object-Oriented Programming 13th
                  European Conference, Lisbon Portugal},
  publisher =	 SV,
  year =	 1999,
  editor =	 {Rachid Guerraoui},
  volume =	 1628,
  series =	 LNCS,
  address =	 NY,
  month =	 jun,
  pages =	 {1-17},
  annote =	 {16 references.}
}

@Unpublished{Hoare-Misra-Shankar05,
  author = 	 {Tony Hoare and Jayadev Misra and N. Shankar},
  title = 	 {The {IFIP} Working Conference on Verified Software: Theories, Tools, Experiments},
  note = 	 {\url{http://tinyurl.com/nrhdl}},
  month =	 oct,
  year =	 2005,
  annote =	 {Checked July 2006.}
}
                  
@misc{Hoare-etal07,
	AUTHOR={Tony Hoare and Gary T. Leavens and Jayadev Misra and Natarajan Shankar},
	TITLE={The Verified Software Initiative: A Manifesto},
	HOWPUBLISHED={\url{http://qpq.csl.sri.com/vsr/manifesto.pdf}},
	YEAR={2007}
}

@article{Hoare-etal09,
    address = {New York, NY, USA},
    author = {C. A. R. Hoare and Jayadev Misra and Gary T. Leavens and Natarajan Shankar},
    issn = {0360-0300},
    journal = ACMCS,
    number = 4,
    pages = {22:1-22:8},
    publisher = ACM,
    title = {The Verified Software Initiative: A Manifesto},
    url = {http://dx.doi.org/10.1145/1592434.1592439},
    volume = 41,
    month = oct,
    year = 2009
}

@Article{Hoare-etal87,
  Author =	 "C. A. R. Hoare and I. J. Hayes and He Jifeng and
                  C. C. Morgan and A. W. Roscoe and J. W. Sanders and
                  I. H. Sorensen and J. M. Spivey and B. A. Sufrin",
  Title =	 "Laws of Programming",
  Journal =	 CACM,
  Volume =	 30,
  Number =	 8,
  Month =	 aug,
  Year =	 1987,
  Pages =	 "672-686",
  Note =	 "See corrections in the September 1987 CACM.",
  Annote =	 "Algebraic laws for Dijkstra's language. 13
                  references."
}

@Article{Hoare03,
  author =       "Tony Hoare",
  title =        "The Verifying Compiler: {A} Grand Challenge for
                 Computing Research",
  journal =      JACM,
  volume =       50,
  number =       1,
  pages =        "63-69",
  month =        jan,
  year =         2003,
  URL = {http://doi.acm.org/10.1145/602382.602403},
  annote =       "4 references."
}

@inproceedings{Hoare05,
  author = "C. A. R. Hoare",
  title = "The Verifying Compiler, a Grand Challenge for Computing Research",
              
  booktitle = "Verification, Model Checking, and Abstract Interpretation,
               6th International Conference, VMCAI 2005",
  publisher = SV,
  series = LNCS,
  volume = 3385,
  month = jan,
  year = 2005,
  pages = 78,
  address = "Berlin"
}

@Article{Hoare69,
  Author =	 "C. A. R. Hoare",
  Title =	 "An Axiomatic Basis for Computer Programming",
  Journal =	 CACM,
  Volume =	 12,
  Number =	 10,
  Month =	 oct,
  Year =	 1969,
  Pages =	 "576--580,583",
  URL = {http://doi.acm.org/10.1145/363235.363259},
  Annote =	 "Axiomatic semantics introduced, partial correctness,
                  proofs of correctness. 9 references."
}

@Article{Hoare71,
  Author =	 "C.A.R. Hoare",
  Title =	 "Proof of a Program: Find",
  Journal =	 CACM,
  Year =	 1971,
  Volume =	 14,
  Number =	 1,
  Month =	 jan,
  Pages =	 "39-45"
}

@inproceedings{Hoare71a,
     author = {C. A. R. Hoare},
     title = {Procedures and Parameters: An Axiomatic Approach},
     booktitle = {Symposium on Semantics of Algorithmic Languages},
     editor = {E. Engeler},
     publisher = SV,
     address = {Berlin},
     year = 1971
}

@Article{Hoare72a,
  Author =	 "C. A. R. Hoare",
  Title =	 "Proof of correctness of data representations",
  Journal =	 "Acta Informatica",
  Volume =	 1,
  Number =	 4,
  Year =	 1972,
  Pages =	 "271-281",
  URL = {http://dx.doi.org/10.1007/BF00289507},
  Annote =	 "8 references."
}

@InCollection{Hoare72b,
  Author =	 "C. A. R. Hoare",
  Title =	 "Notes on data structuring",
  BookTitle =	 "Structured Programming",
  Editor =	 "O.-J. Dahl and E. W. Dijkstra and C. A. R. Hoare",
  Publisher =	 "Academic Press, Inc.",
  Address =	 NY,
  Year =	 1972,
  Pages =	 "83-174",
  Annote =	 "7 references."
}

@Article{Hoare78b,
  Author =	 "C. A. R. Hoare",
  Title =	 "Some Properties of Predicate Transformers",
  Journal =	 JACM,
  Year =	 1978,
  Volume =	 25,
  Number =	 3,
  Month =	 jul,
  Pages =	 "461-480",
  Annote =	 "14 references."
}

@Article{Hoare86,
  Author =	 "C. A. R. Hoare",
  Title =	 "Mathematics of Programming",
  Journal =	 "BYTE",
  Year =	 1986,
  Month =	 aug,
  Pages =	 "115-126"
}

@Article{Hoare87,
  Author =	 "C. A. R. Hoare",
  Title =	 "An Overview of Some Formal Methods for Program
                  Design",
  Journal =	 "Computer",
  Year =	 1987,
  Month =	 sep,
  Annote =	 "Very good tutorial on formal specifications."
}

@InProceedings{Hoare96,
  author =	 "C. A. R. Hoare",
  title =	 "How Did Software Get So Reliable Without Proof?",
  editor =	 "Marie-Claude Gaudel and James Woodcock",
  volume =	 1051,
  series =	 LNCS,
  pages =	 "1-17",
  booktitle =	 "FME '96: Industrial Benefit and Advances in Formal
                  Methods",
  year =	 1996,
  publisher =	 SV,
  address =	 NY,
  month =	 mar,
  annote =	 "A discussion of the role formal methods and proof
                  play in making software reliable, and what people
                  really do."
}

@InProceedings{Hoare99,
  author =       "Hoare",
  title =        "Theories of Programming: Top-Down and Bottom-Up
                 Meeting in the Middle",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  BookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1708,
  Pages =	 "1-27",
  annote =       "7 references."
}

@Book{Hoc-etal90,
  Author =	 "J. M. Hoc and T. R. G. Green and R. Samurcay and
                  D. J. Gilmore",
  Title =	 "Psychology of Programming",
  Publisher =	 "Academic Press",
  Year =	 1990,
  Series =	 "Computers and People Series",
  Address =	 "San Diego, Calif.",
  Annote =	 "ISBN 0-12-350772-3. A collection of papers on
                  various topics, inccluding language design and
                  acquisition of programming and expert programming
                  skills. Many references."
}

@article{Hochreiner-etal14,
author = {Christoph Hochreiner and Peter Fr\uml{u}hwirt and Zhendong Ma and Peter Kieseberg and Sebastian Schrittwieser and Edgar R. Weippl},
title = {Genie in a {Model}? {Why} {Model} {Driven} {Security} will not secure your {Web} {Application}},
volume = 5,
number = 3,
journal = {Journal of Wireless Mobile Networks, Ubiquituous Computing, and Dependable Applications},
year = 2014,
pages = {44--62},
file = {jowua-v5n3-4.pdf:files/74/jowua-v5n3-4.pdf:application/pdf}
}

@InProceedings{Hoder-Kovacs-Voronkov11,
author="Kry{\v{s}}tof Hoder and Laura Kov{\'a}cs and Andrei Voronkov",
editor="Parosh Aziz Abdulla and Leino, K. Rustan M.",
title="Invariant Generation in {Vampire}",
booktitle="Tools and Algorithms for the Construction and Analysis of Systems",
year="2011",
publisher="Springer Berlin Heidelberg",
address="Berlin, Heidelberg",
pages="60--64",
abstract="This paper describes a loop invariant generator implemented in the theorem prover Vampire. It is based on the symbol elimination method proposed by two authors of this paper. The generator accepts a program written in a subset of C, finds loops in it, analyses the loops, generates and outputs invariants. It also uses a special consequence removal mode added to Vampire to remove invariants implied by other invariants. The generator is implemented as a standalone tool, thus no knowledge of theorem proving is required from its users.",
isbn="978-3-642-19835-9"
}

@Book{Hoffman-Krieg93,
  Author =	 "Berthold Hoffman and Bernd Krieg-Bruckner",
  Title =	 "Program Development by Specification and
                  Transformation: the PROSPECTRA Methodology, Language
                  Family, and System",
  Publisher =	 SV,
  Year =	 1993,
  Series =	 "Lecture Notes in Computer Science",
  Address =	 NY,
  Annote =	 "ISBN 3-540-56733-X, 160 references"
}

@Article{Hoffman-Strooper95,
  author =	 {Daniel Hoffman and Paul Strooper},
  title =	 {The testgraph methodology},
  journal =	 JOOP,
  year =	 1995,
  volume =	 8,
  number =	 7,
  pages =	 {35-41},
  month =	 {Nov./Dec.},
  annote =	 {19 references.}
}
               

@InProceedings{Hofmann-Jost03,
  author =       "Martin Hofmann and Steffen Jost",
  title =        "Static prediction of heap space usage for first-order
                 functional programs",
  pages =        "185--197",
  ISSN =         "0362-1340",
  editor =       "Cindy Norris and {Jr.} James B. Fenwick",
  booktitle =    "Proceedings of the 30th {ACM} {SIGPLAN}-{SIGACT}
                 symposium on Principles of programming languages
                 ({POPL}-03)",
  month =        jan # " ~15--17",
  series =       "ACM SIGPLAN Notices",
  volume =       "38, 1",
  publisher =    "ACM Press",
  address =      "New York",
  year =         "2003",
}

@Article{Hofmann-etal98,
  author =	 {Martin Hofmann and Wolfgang Naraschewski and Martin
                  Steffen and Terry Stroup},
  title =	 {Inheritance of Proofs},
  journal =	 TAPOS,
  year =	 1998,
  volume =	 4,
  number =	 1,
  pages =	 {51-69},
  annote =	 {A type theory for object-oriented languages in which
                  the object types encode behavior. Subtyping is thus
                  behavioral subtyping. 55 references.}
}

@Article{Hofstdede-vanderWeide92,
  author =	 "A. H. M. ter Hofstdede and T. P. van der Weide",
  title =	 "Formalization of tehniques: chopping down the
                  methodology jungle",
  journal =	 "Information and Software Technology",
  year =	 1992,
  volume =	 34,
  number =	 1,
  pages =	 "57-65",
  month =	 jan,
  annote =	 "Advocates formalization of informal methods instead
                  of inventing new ones. Example of formalization of
                  NAIM in the Predictor model. 27 references."
}

@Article{Hogg-etal92,
  Author =	 "John Hogg and Doug Lea and Alan Wills and Dennis
                  deChampeaux and Richard Holt",
  Title =	 "The {Geneva Convention} on the Treatment of Object
                  Aliasing",
  Journal =	 "OOPS Messenger",
  Year =	 1992,
  Volume =	 3,
  Number =	 2,
  Month =	 apr,
  Pages =	 "11-16",
  Annote =	 "12 references."
}

@InProceedings{Hogg91a,
  author =	 "John Hogg",
  title =	 "Islands: Aliasing Protection in Object-Oriented
                  Languages",
  booktitle =	 "Proceedings of the {OOPSLA}~'91 Conference on
                  Object-oriented Programming Systems, Languages and
                  Applications",
  pages =	 "271--285",
  month =	 nov,
  year =	 "1991",
  keywords =	 "olit oopsla91",
  note =	 "Published as ACM SIGPLAN Notices, volume 26, number
                  11",
}

@InCollection{Holland92,
  Author =	 "Ian M. Holland",
  Title =	 "Specifying Reusable Components Using Contracts",
  BookTitle =	 "ECOOP '92, European Conference on Object-Oriented
                  Programming, Utrecht, The Netherlands",
  Publisher =	 SV,
  Year =	 1992,
  Editor =	 "Ole Lehrmann Madsen",
  Series =	 LNCS,
  Address =	 NY,
  Volume =	 615,
  Pages =	 "287-308",
  Annote =	 "27 references"
}

@PhdThesis{Hollingsworth92,
  Author =	 "Joseph Eugene Hollingsworth",
  Title =	 "Software Component Design-for-Reuse: A
                  Language-Independent Discipline Applied to Ada",
  School =	 "The Ohio State University",
  Year =	 1992,
  Address =	 "Columbus,OH",
  Annote =	 "50 references."
}

@Article{Holloway-Krogh-Guia97,
  author = 	 {L. E. Holloway and B. H. Krogh and A. Giua},
  title = 	 {A Survey of Petri Net Methods for Controlled Discrete Event Systems},
  journal = 	 {Discrete Event Dynamic Systems},
  year = 	 1997,
  volume = 	 7,
  number = 	 2,
  pages = 	 {151-190},
  month = 	 apr,
  URL = 	 {http://dx.doi.org/10.1023/A:1008271916548}
}

@Article{Holzman97,
  Author =	 "Gerard J. Holzmann",
  title =	 "The Model Checker {SPIN}",
  journal =	 IEEETSE,
  pages =	 "279-295",
  month =	 may,
  year =	 1997,
  volume =	 23,
  number =	 5,
  annote =	 "82 references."
}

@InProceedings{Holzmann01,
  author =       "Gerard J. Holzmann",
  title =        "Economics of Software Verification",
  editor =       "{ACM}",
  booktitle =    "{ACM} {SIGPLAN} -- {SIGSOFT} Workshop on Program
                 Analysis for Software Tools and Engineering: {PASTE}'01",
  publisher =    "ACM Press",
  address =      NY,
  pages =        "54-61",
  year =         "2001",
  annote =       "14 references."
}

@Book{Holzmann91,
  Author =	 "Gerard J. Holzmann",
  Title =	 "Design and validation of computer protocols",
  Publisher =	 "Prentice-Hall",
  Year =	 1991,
  Address =	 "Englewood Cliffs, NJ",
  Annote =	 "PROMELA"
}

@InProceedings{Hooman-Kuiper-Zhou91,
  author =	 "J. Hooman and R. Kuiper and P. Zhou",
  title =	 "A Compositional Proof System for Real-Time Systems
                  Based on Explicit Clock Temporal Logic",
  pages =	 "110--119",
  editor =	 "Jean-Pierre Finance",
  booktitle =	 "Proceedings of the 6th International Workshop on
                  Software Specification and Design",
  address =	 "Como, Italy",
  month =	 oct,
  year =	 1991,
  publisher =	 "IEEE Computer Society Press"
}

@InCollection{Hooman-deRoever86,
  author =	"J. Hooman and W.-P. de Roever",
  title =	"The quest goes on: a survey of proof systems for
		 partial correctness of {CSP}",
  pages =	"343-395",
  editor =	"W.-P. de Roever J. W. de Bakker and G. Rozenberg",
  booktitle =	"Current trends in concurrency : overviews and
		 tutorials",
  year = 	1986,
  series =	LNCS,
  volume =	224,
  publisher =	SV
}

@Article{Hooman91,
  author =	 "J. Hooman",
  title =	 "Specification and Compositional Verification of
                  Real-Time Systems",
  journal =	 "Lecture Notes in Computer Science",
  volume =	 "558",
  year =	 "1991"
}

@InProceedings{Hooman92,
  author =	 "J. Hooman",
  title =	 "Compositional Verification of Real--Time Systerns
                  Using Extended Hoare Triples",
  pages =	 "252--290",
  editor =	 "J. W. de Bakker and C. Huizing and W. P. de Roever
                  and G. Rozenberg",
  booktitle =	 "Proceedings of Real-Time: Theory in Practice",
  month =	 jun,
  series =	 LNCS,
  volume =	 "600",
  publisher =	 SV,
  address =	 "Berlin, Germany",
  year =	 "1992",
}

@Book{Horebeek-Lewi89,
  Author =	 "I. V. Horebeek and J. Lewi",
  Title =	 "Algebraic Specifications in Software Engineering: An
                  Introduction",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1989,
  Note =	 "ISBN 3-540-51626-3, 0-387-51626-3"
}

@Book{Horstmann04,
  author =	 {Cay Horstmann},
  title = 	 {Object-Oriented Design \& Patterns},
  publisher = 	 {Wiley},
  year = 	 2004,
  address =	 {Hoboken, NJ}
}

@Article{Horwitz-Teitelbaum86,
  Author =	 "Susan Horwitz and Tim Teitelbaum",
  Title =	 "Generating Editing Environments Based on Relations
                  and Attributes",
  Journal =	 TOPLAS,
  Volume =	 8,
  Number =	 4,
  Month =	 oct,
  Year =	 1986,
  Pages =	 "577-608",
  Annote =	 "27 references."
}

@Article{Houston-King91,
  author =	"I. Houston and S. King",
  title =	"{CICS} project report: experiences and results from
		 the use of {Z} in {IBM}",
  journal =	"VDM'91: Formal Software Development Methods, Volume 1",
  volume =	551,
  pages =	"588-603",
  year = 	1991
}

@PhdThesis{Hovemeyer05,
  title =	"Simple and Effective Static Analysis to Find Bugs",
  author =	"David Hovemeyer",
  year = 	"2005",
  month =	jul,
  school =      "University of Maryland",
  URL =  	"http://hdl.handle.net/1903/2901"
}

@book{Howard-LeBlanc-Viega09,
author = {Michael Howard and David LeBlanc and John Viega},
title = {24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them},
year = 2009,
publisher = {McGraw-Hill, Inc.},
address = {USA},
edition = 1
}

@Article{Howden-Wieand94,
  Author =	 "W.E. Howden and B. Wieand",
  Title =	 "QDA-A Method For Systematic Informal Program
                  Analysis",
  Journal =	 "IEEE Transactions on Software Engineering",
  Year =	 1994,
  Volume =	 20,
  Number =	 6,
  Month =	 jun,
  Pages =	 "445-462",
  Annote =	 "30 references."
}

@article{Hu-Bernat-Wellings02,
author = {Erik Yu-Shing Hu and Guillem Bernat and Andy Wellings},
title = {A Static Timing Analysis Environment Using Java Architecture for Safety Critical Real-Time Systems},
journal ={Object-Oriented Real-Time Dependable Systems, IEEE International Workshop on},
volume = {0},
isbn = {0-7695-1576-2},
year = {2002},
pages = {0077},
doi = {http://doi.ieeecomputersociety.org/10.1109/WORDS.2002.1000039},
publisher = {IEEE Computer Society},
address = {Los Alamitos, CA, USA},
}

@INPROCEEDINGS{Hu-Bernat-Wellings02a, 
author={Hu, E.Y.-S. and Bernat, G. and Wellings, A.}, 
booktitle={Object-Oriented Real-Time Distributed Computing, 2002. (ISORC 2002). Proceedings. Fifth IEEE International Symposium on}, 
title={Addressing dynamic dispatching issues in WCET analysis for object-oriented hard real-time systems}, 
year={2002}, 
month={}, 
volume={}, 
number={}, 
pages={109 -116}, 
keywords={dynamic binding;dynamic dispatching;dynamic loading;minimum annotations;object-oriented hard real-time systems;object-oriented programming languages;worst-case execution timing analysis;Java;object-oriented programming;real-time systems;timing;}, 
doi={10.1109/ISORC.2002.1003667}, 
ISSN={},}

@incollection {Hu-Wellings-Guillem04,
   author = {Hu, Erik and Wellings, Andy and Bernat, Guillem},
   affiliation = {Real-Time Systems Research Group, Department of Computer Science, University of York, York, YO105DD UK},
   title = {{XRTJ}: An Extensible Distributed High-Integrity Real-Time Java Environment},
   booktitle = {Real-Time and Embedded Computing Systems and Applications},
   series = {Lecture Notes in Computer Science},
   editor = {Chen, Jing and Hong, Seongsoo},
   publisher = {Springer Berlin / Heidelberg},
   isbn = {978-3-540-21974-3},
   keyword = {Computer Science},
   pages = {208-228},
   volume = {2968},
   url = {http://dx.doi.org/10.1007/978-3-540-24686-2_13},
   year = {2004}
}

@Article{Huang-Ravishankar98,
  author =	 {Yen-Min Huang and Chinya V. Ravishankar},
  title =	 {Constructive Protocol Specification Using {Cicero}},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 4,
  month =	 apr,
  pages =	 {252-267},
  annote =	 {43 references.}
}

@Article{Huang98,
  author =	 {Riri Huang},
  title =	 {Formalizing Hierarchical Object-Oriented Design
                  Method},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 5,
  month =	 sep,
  pages =	 {82-88},
  annote =	 {10 references.}
}

@InProceedings{Hubbers-Oostdijk-Poll03,
  author = 	 {Engelbert Hubbers and Martijn Oostdijk and Erik Poll},
  title = 	 {From Finite State Machines to Provably Correct {JavaCard} Applets},
  booktitle =	 {Workshop of IFIP WG 11.2 - Small Systems Security},
  year =	 2003,
  organization = "IFIP",
  URL = {http://www.cs.ru.nl/~erikpoll/publications/sec03.pdf}
}

@InProceedings{Hubbers-Oostdijk-Poll04,
  author = 	 {Engelbert Hubbers and Martijn Oostdijk and Erik Poll},
  title = 	 {Implementing a Formally Verifiable Security Protocol in {Java Card}},
  booktitle =	 {Proceedings of SPC'2003, First International Conference on
    Security in Pervasive Computing, Boppard, Germany},
  pages =	 {213-226},
  year =	 2004,
  volume =	 2802,
  series =	 LNCS,
  publisher =	 SV,
  URL = {http://www.cs.ru.nl/~erikpoll/publications/boppardkeyx.pdf}
}

@InProceedings{Hubbers-Poll04,
  author = 	 {Engelbert Hubbers and Erik Poll},
  title = 	 {Reasoning about Card Tears and Transactions in {Java Card}},
  booktitle =	 {FASE'04 (Fundamental Approaches to Software Engineering, Barcelona},
  pages =	 {114-128},
  year =	 2004,
  volume =	 2984,
  series =	 LNCS,
  month =	 mar,
  publisher =	 SV,
  URL = {http://www.cs.ru.nl/~erikpoll/publications/transactions.pdf}
}

@InCollection{Huber-Jensen-Shapiro90,
  Author =	 "Peter Huber and Kurt Jensen and Robert M. Shapiro",
  Title =	 "Hierarchies in {Coloured Petri Nets}",
  BookTitle =	 "Advances in Petra nets 1990",
  Publisher =	 SV,
  Year =	 1990,
  Editor =	 "G. Rosenberg",
  Series =	 LNCS,
  Volume =	 483,
  Address =	 NY,
  Annote =	 "28 references."
}

@InProceedings{Huisman-Jacobs00,
  author =	 "Marieke Huisman and Bart Jacobs",
  title =	 "Java Program Verification via a {Hoare} Logic with
                  Abrupt Termination",
  booktitle =	 "Fundamental Approaches to Software Engineering (FASE
                  2000)",
  series =	 LNCS,
  editor =	 "T. Maibaum",
  volume =	 1783,
  pages =	 "284-303",
  year =	 2000,
  publisher =	 SV,
  address = {Berlin},
  URL = {http://www.springerlink.com/content/fkrbjn1vg56ra052}
}

@TechReport{Huisman-Jacobs99,
  author =	 {Marieke Huisman and Bart Jacobs},
  title =	 {Java Program Verification via a {Hoare} Logic with
                  Abrupt Termination},
  institution =	 {University of Nijmegen, Computing Science Institute},
  year =	 1999,
  number =	 {CSI-R9912},
  address =	 {Nijmegen, The Netherlands},
  month =	 jun,
  annote =	 {24 references.}
}

@inproceedings{Huisman-Tamlet09,
   author =       {Marieke Huisman and Alejandro Tamalet},
   title =        {A formal connection between security automata and {JML} annotations},
   year =         {2009},
   booktitle =    "Fundamental Approaches to Sofware Engineering (FASE)",
   publisher =    SV,
   address =      "Berlin",
   series =       LNCS,
   volume =       5503,
   pages =        {340-354},
   pdf =          {http://wwwhome.ewi.utwente.nl/~marieke/fase09.pdf}
}

@PhdThesis{Huisman01,
  author =	 {Marieke Huisman},
  title =	 {Reasoning about {Java} Programs in higher order logic with {PVS} and {Isabelle}},
  school =	 {University of Nijmegen, Holland},
  year =	 2001,
  type =	 {IPA Dissertation Series, 2001-03},
  month =	 feb,
  URL =          {ftp://ftp-sop.inria.fr/lemme/Marieke.Huisman/thesis.ps.gz}
}

@inproceedings{Huisman09,
author =         "Marieke Huisman",
title =          "On the Interplay between the Semantics of {Java's} Finally Clauses and the {JML} Run-Time Checker",
booktitle =      "Formal Techniques for Java-like Programs",
editor =         "A. Banerjee",
year =           2009,
publisher =      {ACM},
keywords =       {mobius, WP3},
pdf =            {http://wwwhome.ewi.utwente.nl/~marieke/ftfjp09.pdf}
}

@InProceedings{Huizing-Kuiper00,
  author = 	 {K. Huizing and R. Kuiper},
  title = 	 {Verification of Object-Oriented Programs Using Class Invariants},
  booktitle = 	 {Fundamental Approaches to Software Engineering},
  year =	 2000,
  editor =	 {Maibaum, E.},
  volume =	 1783,
  series =	 LNCS,
  pages =	 {208--221},
  publisher =	 SV
}

@Book{Humphrey95,
  author =	 "Watts S. Humphrey",
  title =	 "A Discipline for Software Engineering",
  publisher =	 "Ad{\-d}i{\-s}on-Wes{\-l}ey",
  address =	 "Reading, MA, USA",
  year =	 "1995",
  ISBN =	 "0-201-54610-8",
  LCCN =	 "QA76.758 .H857 1995",
  series =	 "SEI series in software engineering",
  keywords =	 "software engineering",
  annote =	 "Some references."
}

@Article{Humphrey96,
  author =	 "Watts S. Humphrey",
  title =	 "Using a Defined and Measured Personal Software
                  Process",
  journal =	 "IEEE Software",
  year =	 1996,
  volume =	 13,
  number =	 3,
  pages =	 "77-88",
  month =	 may,
  annote =	 "The PSP. 9 references."
}

@InProceedings{Hung-Zucker91,
  Author =	 "Hing-Kai Hung and Jeffery I. Zucker",
  Title =	 "Semantics of Pointers, Referencing and Dereferencing
                  with Intensional Logic",
  BookTitle =	 "Proceedings of the Sixth Annual Symposium on Logic
                  in Computer Science",
  Year =	 1991,
  Pages =	 "127-136",
  Organization = "IEEE Computer Society",
  Address =	 "10662 Los Vaqueros Circle, P.O. Box 3014, Los
                  Alamitos, CA 90720-1264",
  Month =	 jul,
  Annote =	 "25 references."
}

@InProceedings{Hunt-Sitaraman04,
  Author =	 "J. Hunt and M. Sitaraman",
  Title =	 "Enhancements: Enabling Flexible Feature and Implementation
                  Selection",
  BookTitle =	 "Proceedings of the Eighth International Conference on 
                  Software Reuse, Madrid, Spain, July",
  Year =	 2004,
  Pages =	 "86--100",
  Publisher =	 SV
}

@InCollection{Hursch94,
  Author =	 "Walter L. Hursch",
  Title =	 "Should Superclasses be Abstract?",
  BookTitle =	 "Object-Oriented Programming 8th European Conference,
                  ECOOP '94 Bologna, Italy, Proceedings",
  Publisher =	 SV,
  Year =	 1994,
  Editor =	 "Mario Tokoro and Remo Pareschi",
  Series =	 LNCS,
  Volume =	 821,
  Pages =	 "12-31",
  Address =	 NY,
  Month =	 jul,
  Annote =	 "30 references."
}

@TechReport{Hussain-Leavens10a,
  author = 	 {Faraz Hussain and Gary T. Leavens},
  title = 	 {temporaljmlc: A {JML} Runtime Assertion Checker Extension for Specification and Checking of Temporal Properties},
  institution =  {UCF, Dept. of EECS},
  year = 	 2010,
  number = 	 {CS-TR-10-08},
  address = 	 {Orlando, Florida},
  month = 	 {jul},
  annote = 	 {25 references.}
}

@InProceedings{Hussain-Leavens10,
	author={Faraz Hussain and Gary T. Leavens},
	booktitle={2010 8th IEEE International Conference on Software Engineering and Formal Methods}, 
	title={temporaljmlc: A {JML} Runtime Assertion Checker Extension for Specification and Checking of Temporal Properties}, 
	year=2010,
	pages={63-72},
	publisher=IEEE,
	address="Los Altos",
	doi={10.1109/SEFM.2010.15}
}

@Mastersthesis{Hussain09,
  author =	 {Faraz Hussain},
  title =	 {Enhancing a behavioral interface specification language with temporal logic features},
  school =	 {Department of Computer Science, Iowa State University},
  year =	 2009,
  address =      {Ames, IA 50011},
  month =	 Apr,
  URL = {http://archives.cs.iastate.edu/documents/disk0/00/00/06/52/index.html}
}

@Book{Huth-Ryan00,
  author =	 {Michael R. A. Huth and Mark D. Ryan},
  title =	 {Logic in Computer Science: Modelling and reasoning
                  about systems},
  publisher =	 {Cambridge University Press},
  year =	 2000,
  address =	 {Cambridge, UK},
  annote =	 {56 references.}
}

@Book{Hutt94,
  author =	 "Andrew T. F. Hutt",
  title =	 "Object Analysis and Design: Comparison of Methods",
  publisher =	 "John Wiley \& Sons, Inc.",
  year =	 1994,
  address =	 NY,
  annote =	 "A few key references."
}

@Misc{ISO-LOTOS89,
  Author =	 "International Standards Organization",
  Title =	 "LOTOS --- a formal description technique based on
                  the temporal ordering of observational behaviour",
  HowPublished = "ISO IS 8807",
  Year =	 1989
}

@Misc{ISO-VDM96,
  Author =	 "International Standards Organization",
  Title =	 "Information technology -- Programming languages,
                  their environments and system software interfaces --
                  {Vienna Development Method} -- Specification
                  Language -- Part 1: Base language",
  HowPublished = "ISO/IEC 13817-1",
  Month =	 dec,
  Year =	 1996
}

@InCollection{Iida-Futatsugi-Diaconescu98,
  author =	 {Shusaku Iida and Kokichi Futatsugi and R\u{a}zvan
                  Diaconescu},
  title =	 {Component Based Algebraic Specifications},
  booktitle =	 {Seventh OOPSLA Workshop on Behavioral Specifications
                  of OO Business and System Specifications},
  publisher =	 {Technical University of Munich, Institut f\"{u}r
                  Informatik},
  month =	 aug,
  year =	 1998,
  editor =	 {Hiam Kilov and Bernhard Rumpe and Ian Simmonds},
  number =	 {TUM-I9820},
  series =	 {Technical Report},
  pages =	 {167-182},
  note =	 {Cafe OBJ. 18 references.}
}

@Book{Ince88,
  Author =	 "D. Ince",
  Title =	 "An Introduction to Discrete Mathematics and Formal
                  System Specification",
  Publisher =	 "Oxford University Press",
  Year =	 1988
}

@Misc{Interface21Spring08,
	author 				= {{Interface21}},
	title 				= {{Spring Framework}},
	year 					= {2008},
	howpublished 	= {From 
	                      \url{http://www.springframework.org/}
	                      (Date retrieved: March 19, 2008)}
}

@InCollection{Ishikawa-Tokuda-Mercer92,
  Author =	 "Y. Ishikawa and H. Tokuda and C.W. Mercer",
  Title =	 "Object-Oriented Real-Time Language Design:
                  Constructs for Timing Constraints",
  BookTitle =	 "Real-Time Systems: Abstractions, Languages, and
                  Design Methodologies",
  Publisher =	 "IEEE Computer Society Press",
  Year =	 1992,
  Editor =	 "Krishna M. Kavi",
  Pages =	 "498-526",
  Address =	 "Los Alamitos, California",
  Month =	 oct,
  Annote =	 "13 references."
}

@inproceedings{Ishtiaq-OHearn01,
 author = {Samin S. Ishtiaq and Peter W. O'Hearn},
 title = {{BI} as an assertion language for mutable data structures},
 booktitle = {Proceedings of the 28th ACM SIGPLAN-SIGACT symposium on Principles of programming languages},
 series = {POPL '01},
 year = {2001},
 isbn = {1-58113-336-7},
 location = {London, United Kingdom},
 pages = {14--26},
 numpages = {13},
 url = {http://doi.acm.org/10.1145/360204.375719},
 acmid = {375719},
 publisher = {ACM},
 address = {New York, NY, USA},
}

@Article{Jaaksi98,
  author =	 {Ari Jaaksi},
  title =	 {A Method for Your First Object-Oriented Project},
  journal =	 JOOP,
  year =	 1998,
  volume =	 10,
  number =	 8,
  month =	 jan,
  pages =	 {17-25},
  annote =	 {18 references.}
}

% doi = {10.1145/360204.375719},
@Book{Jackey-etal08,
  author = 	 {Jonathan Jacky and Margus Veanes and Colin Campbell and Wolfram Schulte},
  title = 	 {Model-Based Software Testing and Analysis with {C\#}},
  publisher = 	 {Cambridge University Press},
  year = 	 2008,
  address = 	 {Cambridge},
  annote = 	 {Many references.}
} 

@Article{Jackson-Damon96,
  author =	 {Daniel Jackson and Craig A. Damon},
  title =	 "Elements of Style: Analyzing a Software Design
                  Feature with a Counterexample Detector",
  journal =	 IEEETSE,
  year =	 1996,
  volume =	 22,
  number =	 7,
  month =	 jul,
  pages =	 {484-495},
  annote =	 {37 references.}
}

@Article{Jackson-Jha-Damon98,
  Author =	 "Daniel Jackson and Somesh Jha and Craig A. Damon",
  Title =	 "Isomorph-Free Model Enumeration: A New Method for
                  Checking Relational Specifications",
  journal =	 TOPLAS,
  year =	 1998,
  volume =	 20,
  number =	 2,
  month =	 mar,
  pages =	 {302-343},
  annote =	 {55 references.}
}

@inproceedings{Jackson-Rinard00,
 author = {Daniel Jackson and Martin Rinard},
 title = {Software Analysis: A Roadmap},
 booktitle = {ICSE '00: Proceedings of the Conference on The Future of Software Engineering},
 year = {2000},
 pages = {133--145},
 location = {Limerick, Ireland},
 doi = {http://doi.acm.org/10.1145/336512.336545},
 publisher = {ACM},
 address = {New York, NY, USA}
}

@InProceedings{Jackson-Rollins94,
  Author =	 "Daniel Jackson and Eugene Rollins",
  Title =	 "A New Model of Program Dependences for Reverse Engineering",
  BookTitle =	 "Proceedings of the 1994 SIGSOFT Conf. on 
                  Foundations of Software Engineering",
  year =          1994,
  publisher =     ACM,
  address =       NY
}
                  
@InProceedings{Jackson-Vaziri00,
  author =	 {Daniel Jackson and Mandana Vaziri},
  title =	 {Finding Bugs with a Constraint Solver},
  booktitle =	 {International Symposium on Software Testing and
                  Analysis, Portland, OR},
  year =	 2000,
  month =	 aug,
  URL =
                  {http://sdg.lcs.mit.edu/~dnj/publications/issta00.pdf}
}

@Book{Jackson01,
  author =	 {Michael Jackson},
  title =	 {Problem Frames},
  publisher =	 {ACM Press},
  year =	 2001,
  annote =	 {Many references.}
}
                  
@Article{Jackson02,
  author =	 {Daniel Jackson},
  title =	 {Alloy: A Lightweight Object Modeling Notation},
  journal =	 TOSEM,
  year =	 2002,
  volume =	 11,
  number =	 2,
  month =	 apr,
  pages =	 {256--290}
}

@Book{Jackson06,
  author =	 {Daniel Jackson},
  title = 	 {Software Abstractions: Logic, Language, and Analysis},
  publisher = 	 MITP,
  year = 	 2006,
  address =	 {Cambridge, Mass.},
  annote =	 {Many examples in Alloy, and has an Alloy reference. 76 references.}
}

@Book{Jackson75,
  author =       "Michael A. Jackson",
  title =        "Principles of Program Design",
  publisher =    "Academic Press",
  address =      "London",
  year =         "1975",
  ISBN =         "0-12-379050-6"
}

@InProceedings{Jackson78,
  Author =	 "M. A. Jackson",
  Title =	 "Information Systems: Modelling, Sequencing and
                  Transformations",
  BookTitle =	 "3rd International Conference on Software
                  Engineering",
  Organization = IEEE,
  Year =	 1978,
  Pages =	 "72-81",
  Annote =	 "Model systems as network of sequential processes
                  communicating by serial data
                  streams. Transformations for uniprocessors. 10
                  references."
}

@InBook{Jackson84,
  author =	 "M. I.\ Jackson",
  editor =	 "T.\ Anderson",
  title =	 "Software -- Requirements, Specification and Testing",
  chapter =	 "7. Pragmatic Aspects of Formal Specification",
  pages =	 "64--74",
  publisher =	 "Blackwell Scientific Publications",
  year =	 "1984",
  month =	 apr
}

@TechReport{Jackson88,
  Author =	 "Daniel Jackson",
  Title =	 "Composing Data \& Process Descriptions in the Design
                  of Software Systems",
  Institution =	 MITLCS,
  Number =	 "TR-419",
  Month =	 may,
  Year =	 1988,
  Annote =	 "26 references."
}

@InProceedings{Jackson93,
  Author =	 "Daniel Jackson",
  Title =	 "Analysis with Aspect",
  Booktitle =	 "Proceedings of the 1993 international symposium on
                  Software testing and analysis",
  Year =	 1993,
  Publisher =	 ACM,
  Address =	 "New York",
  Annote =	 "ACM order number 59493. 13 references."
}

@Article{Jackson95,
  author =	 "Daniel Jackson",
  title =	 "Structuring {Z} Specifications with Views",
  journal =	 TOSEM,
  year =	 1995,
  volume =	 4,
  number =	 4,
  pages =	 "365-389",
  month =	 oct,
  annote =	 "Views allow one to describe a state space from
                  different perspecitves. Notes that Z does not have
                  real preconditions, only guards (enabling
                  conditions). 30 references."
}

@Book{Jackson95b,
  author =	 {Michael Jackson},
  title =	 {Software Requirements and Specification: a lexicon
                  of practice, principles and prejudices},
  publisher =	 {Addison-Wesley},
  year =	 1995,
  address =	 {Wokhingham, England},
  annote =	 {Many references.}
}

@Article{Jackson98,
  author =	 {Daniel Jackson},
  title =	 {An Intermediate Design Language and its Analysis},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 6,
  month =	 nov,
  pages =	 {121-130},
  note =	 {Proceedings of the ACM SIGSOFT Sixth Internatioal
                  Symposium on the Foundations of Software
                  Engineering},
  annote =	 {The language Nitpick/NP. 22 references.}
}

@Article{Jackson98b,
  author =	 {Michael Jackson},
  title =	 {Will There Ever Be Software Engineering?},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 1,
  month =	 jan,
  pages =	 {36-39},
  annote =	 {Software developers must specialize by requirement
                  and product. 2 references.}
}

@InCollection{Jacobs-Kiniry-Warnier03,
  author =	 {Bart Jacobs and Joseph Kiniry and M. Warnier},
  title =	 {{Java} Program Verification Challenges},
  booktitle =	 {FMCO 2002: Formal Methods for Component Objects,
                  Proceedings},
  year =	 2003,
  Editor =	 {Frank S. de Boer and Marcello M. Bonsangue and
                  Susanne Graf and Willem-Paul de Roever},
  series =	 LNCS,
  Volume =	 2852,
  pages =	 "202-219",
  Publisher =	 SV,
  Address =	 "Berlin",
  Annote =	 "25 references."
}

@inproceedings{Jacobs-Leino-Schulte04,
  author = "Bart Jacobs and K. Rustan M. Leino and Wolfram Schulte",
  title = "Verification of Multithreaded Object-Oriented Programs with Invariants",
  booktitle = "SAVCBS 2004: Specification and Verification of Component Based Systems",
  location = "Newport Beach, California USA",
  publisher = "ACM Press",
  year = 2004,
  pages = "2-9",
  URL = {http://www.cs.iastate.edu/~leavens/SAVCBS/2004/papers/Jacobs-Leino-Schulte.pdf}
}

@Misc{Jacobs-Meijer-Poll01,
  author =	 {Bart Jacobs and Hans Meijer and Erik Poll},
  title =	 {{VerifiCard}: A {European} Project for Smart Card Verification},
  howpublished = {Newsletter 5 of the Dutch Association for Theoretical Computer Science (NVTI)},
  year =	 2001,
  URL = 	 {https://repository.ubn.ru.nl/bitstream/handle/2066/130369/130369.pdf}
}

@inproceedings{Jacobs-Mueller-Piessens07,
 author = {B. Jacobs and P. M\"uller and F. Piessens},
 title = {Sound reasoning about unchecked exceptions},
 booktitle = {Software Engineering and Formal Methods (SEFM)},
 year = 2007,
 publisher = IEEE,
 editor = {M. Hinchey and T. Margaria},
 address = {Los Alamitos, CA},
 pages = {113--122},
 URL = {http://dx.doi.org/10.1109/SEFM.2007.36}
}

% URL = {http://www.cs.ru.nl/~erikpoll/publications/nvti_verificard.ps.gz},
@Article{Jacobs-Oostdijk-Warnier04,
  author = 	 {Bart Jacobs and Martijn Oostdijk and Martin Warnier},
  title = 	 {Source Code Verification of a Secure Payment Applet},
  journal = 	 {Journal of Logic and Algebraic Programming},
  year = 	 2004,
  volume =	 58,
  number =	 {1--2},
  pages =	 {107-120},
  month =	 {January--March},
  URL = 	 {http://www.sciencedirect.com/science/article/B6W8D-49YH88V-5/2/896c053cb97df29d0fd52ad69d601576}
}

@InProceedings{Jacobs-Piessens06,
  author =	 {Bart Jacobs and Frank Piessens},
  title = 	 {Verification of Programs with Inspector Methods},
  booktitle =	 {Workshop on Formal Techniques for Java-like Programs (FTfJP)},
  year =	 2006,
  month =	 jul,
  URL = 	 {http://www.disi.unige.it/person/AnconaD/FTfJP06/paper09.pdf},
  annote =       {9 references.}
}

@TechReport{Jacobs-Piessens08,
  author = 	 {Bart Jacobs and Frank Piessens},
  title = 	 {The {VeriFast} program verifier},
  institution =  {Department of Computer Science, Katholieke Universiteit Leuven},
  year = 	 2008,
  number = 	 {CW-520}
}

@TechReport{Jacobs-Poll00,
  author =	 {Bart Jacobs and Erik Poll},
  title =	 {A Logic for the Java Modeling Language {JML}},
  institution =	 {University of Nijmegen, Computing Science Institute},
  year =	 2000,
  number =	 {CSI-R0018},
  address =	 {Teornooiveld 1, 655 Nijmegen, The Netherlands},
  month =	 nov,
  annote =	 {25 references.}
}

@InCollection{Jacobs-Poll01,
  Author =	 {Bart Jacobs and Eric Poll},
  Title =	 {A Logic for the {Java} Modeling Language {JML}},
  Year =	 2001,
  Pages =	 {284-299},
  Booktitle =	 {Fundamental Approaches to Software Engineering
                  (FASE'2001), Genova, Italy, 2001},
  Publisher =	 SV,
  Series =	 LNCS,
  Volume =	 {2029},
  URL = {http://www.springerlink.com/content/17ul9mb1y0ja42eb}
}

@TechReport{Jacobs-Poll03,
  Author =	 {Bart Jacobs and Eric Poll},
  Title =	 {{Java} Program Verification at {Nijmegen}:
                  Developments and Perspective},
  Year =	 2003,
  institution =	 {Computing Science Institute, University of Nijmegen},
  number =	 {NIII-R0318},
  URL =
                  {http://www.cs.kun.nl/research/reports/full/NIII-R0318.ps.gz}
}
% URL = {http://www.cs.kun.nl/~erikpoll/publications/jmllogic.html}


@InProceedings{Jacobs-Smans-Piessens08,
  author = 	 {Bart Jacobs and Jan Smans and Frank Piessens},
  title = {Verifying the Composite Pattern using Separation Logic},
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {83-88},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  annote = 	 {4 references.},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/Jacobs-Smans-Piessens.pdf}
}

@InProceedings{Jacobs-etal05,
  author = 	 {Bart Jacobs and Erik Meijer and Frank Piessens and Wolfram Schulte},
  title = 	 {Iterators Revisited: Proof Rules and Implementation},
  booktitle =	 {7th Workshop on Formal Techniques for Java-like Programs (FTfJP)},
  year =	 2005,
  month =	 jul,
  URL = 	 {http://www.cs.ru.nl/ftfjp/2005/Jacobs.pdf}
}

@InProceedings{Jacobs-etal05a,
  author =       {Bart Jacobs and K. Rustan M. Leino and Frank
                  Piessens and Wolfram Schulte},
  booktitle =    {IEEE International Conference on Software Engineering (SEFM 2005)},
  title =        {Safe concurrency for aggregate objects with invariants},
  year =         2005,
  publisher =    {IEEE Computer Society},
  pages =        {137-147}
}

@article{Jacobs-etal08,
 author = {Bart Jacobs and Frank Piessens and Jan Smans and K. Rustan M. Leino and Wolfram Schulte},
 title = {A programming model for concurrent object-oriented programs},
 journal = TOPLAS,
 volume = {31},
 number = {1},
 year = {2008},
 pages = {1--48},
 publisher = {ACM},
 address = {New York, NY, USA},
 URL = {http://doi.acm.org/10.1145/1452044.1452045}
}

@InProceedings{Jacobs-etal98,
  author =	 {Bart Jacobs and Joachim van den Berg and Marieke
                  Huisman and Martijn van Berkum and Ulrich Hensel and
                  Hendrik Tews},
  title =	 {Reasoning about {Java} Classes (Preliminary Report)},
  BookTitle =	 "OOPSLA '98 Conference Proceedings",
  Series =	 SIGPLAN,
  Volume =	 "33(10)",
  Month =	 oct,
  Year =	 1998,
  organization = ACM,
  pages =	 {329-340},
  annote =	 {The LOOP tool, which is based on PVS, can be used to
                  prove some properties of Java classes. 26
                  references.}
}

@InProceedings{Jacobs-etal99,
  author =	 {B. Jacobs and G. T. Leavens and P. M{\"u}ller and
                  A. Poetzsch-Heffter},
  title =	 {Formal Techniques for {J}ava Programs},
  booktitle =	 {Object-Oriented Technology. {ECOOP}'99 Workshop
                  Reader},
  year =	 1999,
  editor =	 {A. Moreira and D. Demeyer},
  series =	 LNCS,
  volume =	 1743,
  publisher =	 SV,
  note =	 {Available from
                  \url{www.informatik.fernuni-hagen.de/pi5/publications.html}},
  URL =
                  {http://www.informatik.fernuni-hagen.de/pi5/publications.html}
}

@Article{Jacobs04,
  AUTHOR =	 "Bart Jacobs",
  TITLE =	 "Weakest pre-condition reasoning for {Java} programs
                  with {JML} Annotations",
  JOURNAL =	 "Journal of Logic and Algebraic Programming",
  PUBLISHER =	 "Elsevier",
  pages =	 "61--88",
  volume =	 58,
  number =       "1--2",
  month =        "Jan.--Mar.",
  URL = {http://dx.doi.org/10.1016/j.jlap.2003.07.005},
  YEAR =	 2004,
  Annote =       {31 references.}
}

@InCollection{Jacobs96a,
  author =	 "Bart P. F Jacobs",
  title =	 "Automata and behaviours in categories of processes",
  booktitle =	 "120",
  pages =	 "14",
  publisher =	 "Centrum voor Wiskunde en Informatica (CWI)",
  address =	 "ISSN 0169-118X",
  month =	 feb # " 27",
  year =	 "1996",
  keywords =	 "automaton, behaviour, realization, process,
                  replication.",
  url =		 "http://www.cwi.nl/pub/CWIreports/AP/CS-R9607.ps.Z",
  abstract =	 "An early result of Goguen describes the fundamental
                  adjunction between categories of deterministic
                  automata and their behaviours. Our first step is to
                  redefine (morphisms in) these categories of automata
                  and behaviours so that a restriction in Goguen's
                  approach can be avoided. Subsequently we give a
                  coalgebraic analysis of this behaviour-realization
                  adjunction; it yields a second generalization to
                  other types of (not only deterministic) automata
                  (and their behaviours). We further show that our
                  (redefined) categories of automata and behaviours
                  support elementary process combinators like
                  renaming, restriction, parallel composition,
                  replication and feedback (some of which also occur,
                  for example, in the $\pi$-calculus). One of the main
                  contributions is that replication $!P$ is defined
                  for an automaton $P$ such that $!P$ is the terminal
                  coalgebra $!P \stackrel{\cong}{\rightarrow} P \| !P$
                  of the functor $P \| (-)$ ``compose with $P$''. The
                  behaviour functor from automata to their behaviours
                  preserves these process combinators, so that the
                  behaviour of a complex automaton can be understood
                  from the behaviour of its components.",
  note =	 "CS-R9607"
}

@Article{Jacobs96b,
  author =	 "B. Jacobs",
  title =	 "Coalgebraic Specifications and Models of
                  Deterministic Hybrid Systems",
  journal =	 "Lecture Notes in Computer Science",
  volume =	 "1101",
  pages =	 "520--535",
  year =	 "1996",
  url =		 "http://www.cwi.nl/pub/CWIreports/AP/CS-R9609.ps.Z"
}

@InProceedings{Jacobs96c,
  author =	 "Bart Jacobs",
  editor =	 "P. Cointe",
  title =	 "Inheritance and Cofree Constructions",
  booktitle =	 "Proceedings ECOOP '96",
  series =	 "LNCS 1098",
  pages =	 "210--231",
  publisher =	 SV,
  address =	 "Linz, Austria",
  month =	 jul,
  year =	 "1996",
  keywords =	 "olit ecoop96",
  URL =		 "http://www.cwi.nl/pub/CWIreports/AP/CS-R9564.ps.Z"
}

@InCollection{Jacobs96d,
  author =	 "Bart P. F. Jacobs",
  title =	 "Objects and classes, coalgebraically",
  editor =	 "B. Freitag and C. B. Jones and C. Lengauer and
                  H.J. Schek",
  booktitle =	 "Object-Orientation with Parallelism and Persistence",
  pages =	 "83-103",
  publisher =	 "Kluwer Academic Publishers",
  address =	 "Boston",
  year =	 "1996",
  keywords =	 "object, class, (terminal) coalgebraic,
                  specification, bisimulation.",
  url =		 "http://www.cwi.nl/pub/CWIreports/AP/CS-R9536.ps.Z",
  abstract =	 "The coalgebraic perspective on objects and classes
                  in object-oriented programming is elaborated:
                  objects consist of a (unique) identifier, a local
                  state, and a collection of methods described as a
                  coalgebra; classes are coalgebraic (behavioural)
                  specifications of objects. The creation of a ``new''
                  object of a class is described in terms of the
                  terminal coalgebra satisfying the specification. We
                  present a notion of ``totally specified'' class,
                  which leads to particularly simple terminal
                  coalgebras. We further describe local and global
                  operational semantics for objects. Associated with
                  the local operational semantics is a notion of
                  bisimulation (for objects belonging to the same
                  class), expressing observational
                  indistinguishability."
}

@InCollection{Jacobs97,
  Author =	 "Bart Jacobs",
  Title =	 "Behavior-Refinement of Coalgebraic Specifications
                  with Coinductive Correctness Proofs",
  BookTitle =	 "{TAPSOFT '97}: Theory and Practice of Software
                  Development, 7th International Joint Conference
                  {CAAP/FASE}, Lille, France",
  Publisher =	 SV,
  Year =	 1997,
  Editor =	 "Michel Bidoit and Max Dauchet",
  Series =	 LNCS,
  Volume =	 1214,
  Pages =	 "787-802",
  Address =	 NY,
  Annote =	 "25 references."
}

@Book{Jacobson-Booch-Rumbaugh99,
  author =	 {Ivar Jacobson and Grady Booch and James Rumbaugh},
  title =	 {The Unified Software Development Process},
  publisher =	 {Addison Wesley Longman},
  year =	 1999,
  series =	 {Object Technology Series},
  address =	 {Reading, Mass.}
}

@Book{Jacobson-Griss-Jonsson97,
  author =	 {Ivar Jacobson and Martin Griss and Patrik Jonsson},
  title =	 {Software Reuse : Architecture Process and
                  Organization for Business Success},
  publisher =	 {Addison-Wesley},
  year =	 1997
}

@Book{Jacobson-Ng05,
  author =	 {Ivar Jacobson and Pan-Wei Ng},
  title = 	 {Aspect-Oriented Software Development with Use Cases},
  publisher = 	 {Addison-Wesley},
  year = 	 2005,
  annote =	 {41 references.}
}

@Article{Jaffe-etal91,
  Author =	 "Matthew S. Jaffe and Nancy G. Leveson and Mats
                  P. E. Heimdahl and Bonnie E. Melhart",
  Title =	 "Software Requirements Analysis for Real-Time
                  Process-Control Systems",
  Journal =	 IEEETSE,
  Year =	 1991,
  Volume =	 17,
  Number =	 3,
  Month =	 mar,
  Pages =	 "241-258",
  Annote =	 "27 references."
}

@Article{Jahanian-Mok86,
  author = 	 {F. Jahanian and A. K. Mok},
  title = 	 {Safety analysis of timing properties in real-time systems},
  journal = 	 IEEETSE,
  year = 	 1986,
  volume = 	 12,
  number = 	 9,
  pages = 	 {890-904}
}

@Book{Jalote91,
  author =	 "Pankaj Jalote",
  title =	 "An Integrated Approach to Software Engineering",
  publisher =	 SV,
  year =	 1991,
  address =	 NY,
  annote =	 "Many references."
}

@Article{Jalote92,
  Author =	 {Pankaj Jalote},
  Title =	 {Specification and testing of abstract data types},
  Journal =	 {Computing Languages},
  Volume =	 17,
  Number =	 1,
  Year =	 1992,
  Pages =	 {75--82},
  Publisher =	 {Pergamon Press},
}

@Book{Jalote97,
  author =	 "Pankaj Jalote",
  title =	 "An Integrated Approach to Software Engineering",
  publisher =	 SV,
  year =	 1997,
  address =	 NY,
  edition =	 "Second",
  annote =	 "Many references."
}

@InProceedings{James-etal08,
  author = 	 {Perry R. James and Patrice Chalin and Leveda Giannas and George Karabotsos},
  title = 	 {Distributed Multi-threaded Verification of {Java} Programs},
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {3-10},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  annote = 	 {20 references.},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/James-etal.pdf}
}

@InProceedings{Janota-Grigore-Moskal07,
  author = {Mikol\'{a}s Janota and Radu Grigore and Michal Moskal},
  title = 	 {Reachability Analysis for Annotated Code},
  booktitle =	 {Sixth International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2007)},
  pages =	 {23-30},
  year =	 2007,
  month =	 sep,
  organization = ACM,
  URL = 	 {http://www.cs.iastate.edu/~leavens/SAVCBS/2007/papers/Janota-Grigore-Moskal.pdf}
}

@Proceedings{Jazayeri-Schauer97,
  title =	 {Software Engineering --- ESCE/FSE '97: 6th European
                  Software Engineering Conference Held Jointly with
                  the 5th ACM SIGSOFT Symposium on the Foundations of
                  Software Engineering Zurich, Switzerland, September
                  1997},
  booktitle =	 {Software Engineering --- ESCE/FSE '97: 6th European
                  Software Engineering Conference Held Jointly with
                  the 5th ACM SIGSOFT Symposium on the Foundations of
                  Software Engineering Zurich, Switzerland, September
                  1997},
  year =	 1997,
  editor =	 {Mehdi Jazayeri and Helmut Schauer},
  volume =	 1301,
  series =	 LNCS,
  publisher =	 SV,
  address =	 NY
}

@Article{Jeffords-Heitmeyer98,
  author =	 {Ralph Jeffords and Constance Heitmeyer},
  title =	 {Automatic Generation of State Invariants from
                  Requirements Specifications},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 6,
  month =	 nov,
  pages =	 {56-69},
  note =	 {Proceedings of the ACM SIGSOFT Sixth Internatioal
                  Symposium on the Foundations of Software
                  Engineering},
  annote =	 {Generated from SCR requirements specifications. 34
                  references.}
}
                  
@InProceedings{Jeffreson-Kamin86,
  Author =	 "Stanley Jefferson and Samuel Kamin",
  Title =	 "Executable specifications with quantifiers in the
                  fase system",
  BookTitle =	 "Conference record of the Thirteenth Annual ACM
                  SIGPLAN-SIGACT Symposium on Principles of
                  Programming Languages, St. Petersburg Beach,
                  Florida",
  Year =	 1986,
  Organization = ACM,
  Month =	 jan,
  Pages =	 "318-326"
}

@InCollection{Jeng-Cheng93,
  Author =	 "J. J. cheng and B. H. C. Cheng",
  Title =	 "Using Formal Methods to construct a Software
                  Component Library",
  Journal =	 LNCS,
  Number =	 717,
  Editor =	 "Ian SommrVille and Manfred Paul",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1993,
  Booktitle =	 "Software Engineering= ESEC '93. 4th European
                  Software Engineering Conference",
  Page =	 "397-417",
  Annote =	 "34 references"
}

@Article{Jennings-Carre89,
  author =	"T. J. Jennings and B. A. Carr\'{e}",
  title =	"A Subset of Ada for Formal Verification ({SPARK})",
  journal =	"Ada User",
  volume =	9,
  number =	"Supplement",
  pages =	"121-126",
  year = 	"1989"
}

@Article{Jennings01,
  author = 	 {Nicholas R. Jennings},
  title = 	 {An Agent-Based Approach for Building Complex Software Systems},
  journal = 	 CACM,
  year = 	 2001,
  volume =	 44,
  number =	 4,
  pages =	 {35-41},
  month =	 apr,
  annote =	 {11 references}
}

@InCollection{Jensen90a,
  Author =	 "Kurt Jensen",
  Title =	 "{Coloured Petri Nets}: A High Level Language for
                  System Analysis and Design",
  BookTitle =	 "Advances in Petri Nets 1990",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "G. Rozenberg",
  Series =	 LNCS,
  Volume =	 483,
  Note =	 "Also a technical report from the CS Dept, Aarhus
                  University, DAIMI PB-338, Nov. 1990",
  Annote =	 "64 references."
}

@TechReport{Jensen90b,
  Author =	 "Kurt Jensen",
  Title =	 "Application and Theory of {Colored Petri Nets},
                  Reference List",
  Institution =	 "Meta Software and Aarhus University",
  Year =	 1990,
  Month =	 may,
  Annote =	 "37 references."
}

@Book{Jia03,
  author =	 {Xiaoping Jia},
  title = 	 {Object-Oriented Software Development Using Java},
  publisher = 	 {Addison-Wesley},
  year = 	 2003,
  address =	 {Boston},
  annote =	 {A few references in each chapter.}
}

@Misc{Jim05,
  author = 	 {Trevor Jim},
  title = 	 {Yakker: A parser generator for network protocol messages},
  howpublished = {PDF of talk},
  month = 	 nov,
  year = 	 2005,
  note = 	 {\url{http://www2.research.att.com/~trevor/talks/yakker-njpls.pdf}}}

@Article{Johnson-etal89,
  Author =	 "Jeff Johnson and Teresa L. Roberts and William
                  Verplank and David C. Smith and Charles H. Irby and
                  Marian Beard and Kevin Mackey",
  Title =	 "The Xerox Star: A Retrospective",
  Journal =	 "Computer",
  Volume =	 22,
  Number =	 9,
  Month =	 sep,
  Year =	 1989,
  Pages =	 "11-28",
  Annote =	 "Discussion of design issues, user-interface. 9
                  references, plus some additional readings."
}

@Article{Johnson92,
  Author =	 "Ralph E. Johnson",
  Title =	 "Documenting Frameworks using Patterns",
  Journal =	 SIGPLAN,
  Volume =	 27,
  Number =	 10,
  Month =	 oct,
  Year =	 1992,
  Pages =	 "63-76",
  Note =	 "{\em OOPSLA '92 Proceedings}, Andreas Paepcke
                  (editor).",
  Annote =	 "13 references."
}

@Article{Johnson97,
  author =	 {Ralph E. Johnson},
  title =	 {Frameworks = (Components + Patterns)},
  journal =	 CACM,
  year =	 1997,
  volume =	 40,
  number =	 10,
  month =	 oct,
  pages =	 {39-42},
  annote =	 {12 references.}
}

@Article{Jones-Middelburg94,
  author =	 "Cliff B.\ Jones and Kees Middelburg",
  title =	 "A Typed Logic of Partial Functions Reconstructed
                  Classically",
  journal =	 "Acta Informatica",
  volume =	 "31",
  number =	 "5",
  pages =	 "399-430",
  year =	 "1994",
  annote =	 "This paper gives a comprehensive description of the
                  typed version of the logic LPF which is basic to
                  formal specification and verified design in VDM. It
                  provides an overview of the extensions needed to
                  deal with recursively defined functions, the data
                  types used in VDM, ect. and it examines some of them
                  in detail. It is shown how this non-classical logic
                  - and the extensions - can be reconstructed
                  classically by embeddings into classical infinitary
                  logic.",
}

@Article{Jones-Schwarz80,
  Author =	 "A. K. Jones and P. Schwarz",
  Title =	 "Experience Using Multiprocessor Systems--A Status
                  Report",
  Journal =	 ACMCS,
  Volume =	 12,
  Year =	 1980,
  Pages =	 "121-165"
}

@Book{Jones-Shaw90,
  Author =	 "Cliff B. Jones and Roger C. Shaw",
  Title =	 "Case Studies in Systematic Software Development",
  Publisher =	 "Prentice-Hall",
  Year =	 1990,
  Series =	 "International Series in Computer Science",
  Address =	 "Englewood Cliffs, NJ"
}

@Book{Jones-etal91,
  title =	 "{\sl mural}: A Formal Development Support System",
  author =	 "C. B. Jones and K. D. Jones and P. A. Lindsay and
                  R. Moore",
  publisher =	 SV,
  year =	 "1991",
  Annote =	 "ISBN 3-540-19651-X"
}

@article{Jones01d,
        author =        "C. B. Jones",
        title =         "The Transition from {VDL} to {VDM}",
        journal =       "Journal of Universal Computer Science",
        volume =        7,
        number =        8,
        pages =         "631-640",
        year =          2001
}

@Article{Jones03,
  Author =       {Cliff B. Jones},
  Title =        {The Early Search for Tractable Ways of Reasoning About Programs},
  Journal =      {IEEE Annals of the History of Computing},
  Volume =       25,
  Number =       2,
  Pages =        {26-49},
  Year =         2003
}

@Article{Jones06,
  author = {Cliff B. Jones},
  title = {Reasoning about partial functions in the formal development of programs},
  journal = ENTCS,
  volume = 145,
  month = jan,
  year = 2006,
  pages = {3-25},
}

@Article{Jones79,
  Author =	 "Cliff B. Jones",
  Title =	 "Constructing a Theory of a Data Structure as an Aid
                  to Program Development",
  Journal =	 "Acta Informatica",
  Volume =	 11,
  Number =	 2,
  Pages =	 "119-137",
  Year =	 1979,
  Annote =	 "22 references."
}

@Book{Jones80,
  Author =	 "Cliff B. Jones",
  Title =	 "Software development : a rigorous approach",
  Publisher =	 Prentice-Hall,
  Series =	 "International Series in Computer Science",
  Address =	 "Englewood Cliffs, N.J.",
  Year =	 1980
}
                  
@article{Jones83,
  author    = {Cliff B. Jones},
  title     = {Tentative Steps Toward a Development Method for Interfering
               Programs},
  journal   = TOPLAS,
  volume    = 5,
  number    = 4,
  year      = 1983,
  pages     = {596-619}
}

@TechReport{Jones86,
  Author =	 "Cliff B. Jones",
  Title =	 "Program Specification and Verification in {VDM}",
  Institution =	 "Department of Computer Science, University of
                  Manchester",
  Address =	 "Manchester M13 9PL, England",
  Number =	 "UMCS-86-10-5",
  Month =	 nov,
  Year =	 1986,
  Annote =	 "49 references."
}

@Book{Jones86b,
  Author =	 "Cliff B. Jones",
  Title =	 "Systematic software development using {VDM}",
  Publisher =	 Prentice-Hall,
  Series =	 "International Series in Computer Science",
  Address =	 "Englewood Cliffs, N.J.",
  Year =	 1986
}

@TechReport{Jones87,
  Author =	 "Cliff B. Jones",
  Title =	 "Teaching Notes for Systematic Software Development
                  Using {VDM}",
  Institution =	 "Department of Computer Science, University of
                  Manchester",
  Address =	 "Manchester M13 9PL, England",
  Month =	 dec,
  Year =	 1987,
  Number =	 "UMCS-87-12-9",
  Annote =	 "160 references."
}

@Book{Jones90,
  Author =	 "Cliff B. Jones",
  Title =	 "Systematic Software Development Using {VDM}",
  Publisher =	 "Prentice Hall",
  Series =	 "International Series in Computer Science",
  Address =	 "Englewood Cliffs, N.J.",
  Edition =	 "Second",
  Year =	 1990
}

@TechReport{Jones91,
  Author =	 "Kevin D. Jones",
  Title =	 "{LM3}: A {Larch} Interface Language for {Modula-3}:
                  A Definition and Introduction: Version 1.0",
  Institution =	 DECSRC,
  Year =	 1991,
  Number =	 72,
  Month =	 jun,
  Address =	 "130 Lytton Avenue Palo Alto, CA 94301",
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "13 references."
}

@Book{Jones91c,
  Author =	 "Capers Jones",
  Title =	 "Applied Software Measurement: Assuring Productivity
                  and Quality",
  Publisher =	 "McGraw-Hill",
  Address =	 NY,
  Year =	 1991,
  Note =	 "ISBN 0-07-032813-7"
}

@InCollection{Jones92,
  Author =	 "K. D. Jones",
  Title =	 "A Semantics for Larch/Modula-3 Interface Language",
  Editor =	 "Ursala Martin and Jeannette M. Wing",
  BookTitle =	 "First International Workshop on Larch, Dedham 1992",
  Publisher =	 SV,
  Year =	 1992,
  Pages =	 "142-158",
  Annote =	 "10 references"
}

@TechReport{Jones92b,
  Author =	 "C. B. Jones",
  Title =	 "An Object-Based Design Method for Concurrent Programs",
  Institution =	 "Department of Computer Science, University of Manchester",
  Year =	 1992,
  Number =	 "UMCS-92-12-1",
  Address =	 "Manchester M13 9PL, England",
  Annote =	 "78 references."
}

@InCollection{Jones93,
  Author =	 "C.B. Jones",
  Title =	 "Reasoning about Interference in an Object-Based Design Method",
  BookTitle =	 "Industrial-Strength Formal Methods, First
                  International Symposium of Formal Methods Europe,
                  Odense, Denmark",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "J.C.P. Woodcock and P.G. Larsen",
  Series =	 LNCS,
  Volume =	 670,
  Pages =	 "1-18",
  Address =	 NY,
  Month =	 apr,
  Annote =	 "48 references."
}

@article{Jones95e,
  author =	 "Cliff B. Jones",
  title =	 "Partial functions and logics: A warning",
  journal =	 IPL,
  volume =	 54,
  number =	 2,
  pages =	 "65--67",
  year =	 1995
}

@InProceedings{Jones99,
  author =	 {R. Jones},
  title =	 {Preface},
  booktitle =	 {Proceedings of the International Symposium on Memory
                  Management},
  pages =	 {iv-v},
  year =	 1999,
  series =	 {ACM SIGPLAN Notices},
  month =	 mar # " 34"
}

@InProceedings{Jones99a,
  author =       "Cliff B. Jones",
  title =        "Scientific Decisions which Characterize {VDM}",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  BookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1708,
  Pages =	 "28-47",
  annote =       "77 references."
}

@InCollection{Jonkers00,
  Author =	 "H. B. M. Jonkers",
  Title =	 "ISpec: Towards Practical and Sound Interface 
                  Specifications",
  BookTitle =	 "Integrated Formal Methods, Second International 
                  Conference, IFM 2000, Dagstuhl Castle, Germany, 
                  November 1-3, 2000",
  Publisher =	 SV,
  Year =	 2000,
  Editor =	 "W. Grieskamp and T. Santen and B. Stoddart",
  Series =	 LNCS,
  Volume =	 1945,
  Pages =	 "116--135",
  Month =	 nov
}

@InProceedings{Jonkers01,
  Author =	 "H. B. M. Jonkers",
  Title =	 "Interface-Centric Architecture Descriptions",
  BookTitle =	 "Working IEEE/IFIP Conference on Software 
                  Architecture (WICSA'01), August 28 - 31, 2001, 
                  Amsterdam, The Netherlands",
  Publisher =	 "IEEE",
  Year =	 2001,
  Pages =	 "113--124",
  Month =	 aug
}

@InCollection{Jonkers91,
  Author =	 "H. B. M. Jonkers",
  Title =	 "Upgrading the pre- and postcondition technique",
  BookTitle =	 "VDM '91 Formal Software Development Methods 4th
                  International Symposium of VDM Europe
                  Noordwijkerhout, The Netherlands, Volume 1:
                  Conference Contributions",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "S. Prehn and W. J. Toetenel",
  Series =	 LNCS,
  Volume =	 551,
  Pages =	 "428-456",
  Address =	 NY,
  Month =	 oct,
  Annote =	 "12 references."
}

@Article{Jonsson94,
  Author =	 "Bengt Jonsson",
  Title =	 "Compositional Specification and Verification of
                  Distributed Systems",
  Journal =	 TOPLAS,
  Year =	 1994,
  Volume =	 16,
  Number =	 2,
  Month =	 mar,
  Pages =	 "259-303",
  Annote =	 "43 references."
}

@incollection{Joshi97,
  author = "Rajeev Joshi",
  title = "Extended Static Checking of programs with cyclic dependencies",
  section = 4,
  booktitle = "1997 SRC Summer Intern Projects",
  editor = "James Mason",
  publisher = "Digital Equipment Corporation Systems Research Center",
  address = "Palo Alto, California",                  
  series = "Technical Note 1997-028",
  year = 1997
}

@InCollection{Jouannaud91,
  Author =	 "Jean-Pierre Jouannaud",
  Title =	 "Executable Higher-order Algebraic Specifications",
  BookTitle =	 "STACS 91, 8th Annual Symposium on Theoretical
                  Aspects of Computer Science, Hamburg, Germany",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "C. Choffrut and M. Jantzen",
  Series =	 LNCS,
  Volume =	 480,
  Pages =	 "16-25",
  Address =	 NY,
  Month =	 feb
}

@Book{Juan-Tsai02,
  author =	 {Eric Y. T. Juan and Jeffrey J. P. Tsai},
  title = 	 {Compostional Verification  of Concurrent and Real-Time Systems},
  publisher = 	 {Kluwer},
  year = 	 2002,
}

@Book{Juerjens05,
  author = 	 {Jan J\"{u}rjens},
  title = 	 {Secure Systems Development with {UML}},
  publisher = 	 SV,
  year = 	 2005,
  address = 	 {Berlin},
  URL = {http://www.springer.com/us/book/9783540007012}
}

@InCollection{Jungclaus-Saake-Sernadas91,
  Author =	 "R. Jungclaus and G. Saake and C. Sernadas",
  Title =	 "Formal Specification of Object Systems",
  BookTitle =	 "TAPSOFT '91, Proceedings of the International Joint
                  Conference on Theory and Practice of Software
                  Development, Brighton, UK, Volume 2, Advances in
                  Distributed Computing (ADC) and Colloquium on
                  Combining Paradigms for Software Development
                  (CCPSD)",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "S. Abramsky and T. S. E. Maibaum",
  Series =	 LNCS,
  Volume =	 494,
  Pages =	 "60-82",
  Address =	 NY,
  Month =	 apr
}

@Book{Kaasgaard00,
  editor =	 {Klaus Kaasgaard},
  title =	 {Software Design and Usability},
  publisher =	 {Copenhagen Business School Press},
  year =	 2000,
}

@TechReport{Kahr-Sannella-Tarlecki95,
  author =	 "Stefan Kahrs, Donald Sannella and Andrzej Tarlecki",
  title =	 "The definition of {Extended ML}: a gentle
                  introduction",
  institution =	 "Laboratory for Foundations of Computer Science,
                  University of Edinburgh",
  year =	 1995,
  number =	 "ECS-LFCS-95-322",
  month =	 oct,
  note =	 "To appear in {\it Theoretical Computer Science}",
  URL =		 "http://www.dcs.ed.ac.uk/%7Edts/eml/gentle-tcs.ps",
  annote =	 "50 references"
}

@Book{Kaldewau90,
  Author =	 "Anne Kaldewau",
  Title =	 "Programming: the derivation of algorithms",
  Publisher =	 "Prentice-Hall",
  Year =	 1990,
  Series =	 "International Series in Computer Science",
  Address =	 "Englewood Cliffs, NJ"
}

@InProceedings{Kaleeswaran-etal20,
author="Arut Prakash Kaleeswaran and Arne Nordmann and Thomas Vogel and Lars Grunske",
editor="Marc Zeller and Kai H{\"o}fig",
title="Counterexample Interpretation for Contract-Based Design",
booktitle="Model-Based Safety and Assessment",
year="2020",
publisher="Springer International Publishing",
address="Cham",
pages="99--114",
abstract="Contract-based design (CBD) is an emerging paradigm for complex systems, specifying the input-output behavior of a component by defining what the component guarantees, provided its environment satisfies the given assumptions. Under certain circumstances, it is possible to verify the decomposition of contracts to conclude the correctness of the top-level system requirements. Verification is performed by using model checkers. If the decomposition of the contract is found to be incorrect, a model checker generates a counterexample. However, the challenging task is to understand the counterexample, which usually is lengthy, cryptic, and verbose. In this paper, we propose an approach to derive an understandable error explanation for counterexamples in CBD. In addition, we highlight the erroneous variables and erroneous states in the counterexample, which reduces the effort to identify errors. Therefore, our approach supports error comprehension of the original counterexample. Our approach is evaluated based on two industrial use cases, the Bosch Electronic Power Steering (EPS) and a redundant sensor system.",
isbn="978-3-030-58920-2",
annote="33 references."
}

@Article{Kamath-Smith92,
  Author =	 "Y. Kamath and J. Smith",
  Title =	 "Experiences in C++ and O-O Design",
  Journal =	 "Journal of Object-Oriented Programming",
  Volume =	 5,
  Year =	 1992,
  Pages =	 "23-28",
  Annote =	 "7 references."
}

@Unpublished{Kamin-Kraus93,
  Author =	 "Samuel Kamin and Tim Kraus",
  Title =	 "Executable Specifications of C++ Classes",
  Month =	 oct,
  Year =	 1993,
  Note =	 "submitted for publication (obtained from the
                  authors)",
  Annote =	 "30 references."
}

@InProceedings{Kamin80,
  Author =	 "S. Kamin",
  Title =	 "Final Data Type Specifications: A New Data Type
                  Specifications Method",
  BookTitle =	 "Conference Record of the Seventh Annual ACM
                  Symposium on Principles of Programming Languages,
                  Las Vegas, Nevada",
  Organization = "Association of Computing Machinery",
  Year =	 1980,
  Month =	 jan,
  Pages =	 "131-138"
}

@Article{Kamin85,
  Author =	 "S. Kamin",
  Title =	 "Final Data Types and Their Specifications",
  Journal =	 TOPLAS,
  Volume =	 5,
  Number =	 1,
  Month =	 jan,
  Year =	 1983,
  Pages =	 "97-121"
}

@InProceedings{Kaplan-Deutsch91,
  Author =	 "S. Kaplan and G. Deutsch",
  Title =	 "Algebraic Semantics of Real-Time Process
                  Specifications",
  BookTitle =	 "Proceedings of the Second International Conference
                  on Algebraic Methodology and Software Technology",
  Year =	 1991,
  Pages =	 "67-81",
  Organization = "The University of Iowa, Department of Computer
                  Science",
  Address =	 "Iowa City, Iowa",
  Month =	 may,
  Annote =	 "17 references."
}

@TechReport{Kapur-Mandayam80,
  Author =	 "Deepak Kapur and Srivas Mandayam",
  Title =	 "Expressiveness of the Operation Set of a Data
                  Abstraction",
  Institution =	 MITLCS,
  Type =	 "Computation Structures Group Memo",
  Number =	 "179-1",
  Month =	 jan,
  Year =	 1980,
  Note =	 "A condensed version apears in the Conference Record
                  of the Seventh Annual ACM Symposium on Principles of
                  Programming Languages.",
  Annote =	 "Expressive completeness and expressive richness of
                  operation sets. 18 references."
}

@TechReport{Kapur-Zhang89,
  Author =	 "Deepak Kapur and Hantao Zhang",
  Title =	 "RRL: Rewrite Rule Laboratory User's Manual",
  Institution =	 "Department of Computer Science, The University of
                  Iowa",
  Address =	 "Iowa City, Iowa",
  Number =	 "89-03",
  Month =	 may,
  Year =	 1989,
  Annote =	 "52 references."
}

@TechReport{Kapur80,
  Author =	 "Deepak Kapur",
  Title =	 "Towards a Theory for Abstract Data Types",
  Institution =	 MITLCS,
  Year =	 1980,
  Number =	 "TR-237",
  Month =	 may,
  Annote =	 "Algebraic and behavioral approach to data type
                  definitions. Hierarchical specification language. 77
                  references."
}

@InProceedings{Karabotsos-etal08,
  author = 	 {George Karabotsos and Patrice Chalin and Perry R. James and Leveda Giannas},
  title = 	 {Total Correctness of Recursive Functions using {JML4 FSPV}},
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {19-26},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  annote = 	 {22 references.},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/Karabotsos-etal.pdf}
}

@Article{Karaorman-Abercrombie05,
  author = 	 {Murat Karaorman and Parker Abercrombie},
  title = 	 {{jContractor}: Introducing Design-by-Contract to {Java} Using Reflective Bytecode Instrumentation},
  journal = 	 {Formal Methods in System Design},
  year = 	 2005,
  volume =	 27,
  number =	 3,
  pages =	 {275-312},
  month =	 nov,
  DOI = 	 {http://dx.doi.org/10.1007/s10703-005-3400-1}
}

@InCollection{Karaorman-Holzle-Bruno99,
  Author =	 {Murat Karaorman and Urs Holzle and John Bruno},
  Title =	 {{jContractor}: A Reflective {Java} Library to Support Design By Contract},
  BookTitle =	 {Meta-Level Architectures and Reflection, Second
                  International Conference on Reflection '99,
                  Saint-Malo, France, July 19--21, 1999, Proceedings},
  Publisher =	 SV,
  Year =	 1999,
  Month =	 jul,
  Editor =	 {Pierre Cointe},
  Series =	 LNCS,
  Volume =	 1616,
  Pages =	 {175--196}
}

@PhdThesis{Kassios06,
  author = 	 {Ioannis T. Kassios},
  title = 	 {A Theory of Object-Oriented Refinement},
  school = 	 {University of Toronto},
  year = 	 2006,
  note =	 {To appear.}
}

@InProceedings{Kassios06a,
  author = 	 {Ioannis T. Kassios},
  title = 	 {Dynamic Frames: Support for Framing, Dependencies and Sharing without Restrictions},
  booktitle = {Formal Methods (FM)},
  pages = 	 {268-283},
  year = 	 2006,
  editor = 	 {J. Misra, T. Nipkow, E. Sekerinski},
  volume = 	 4085,
  series = 	 LNCS,
  publisher = SV,
  address = {Berlin}
}

@article{Kassios11,
 author = {Ioannis T. Kassios},
 title = {The dynamic frames theory},
 journal = FAC,
 volume = 23,
 number = 3,
 month = may,
 year = 2011,
 issn = {0934-5043},
 pages = {267-288},
 url = {http://dx.doi.org/10.1007/s00165-010-0152-5},
 doi = {10.1007/s00165-010-0152-5},
 publisher = {Springer-Verlag},
 address = {London, UK, UK},
 keywords = {Specification languages},
}

@TechReport{Kassios-Mueller11,
  author={Kassios, Ioannis T and M{\"u}ller, Peter},
  title={Modular specification and verification of delegation with SMT solvers},
  journal={Technical Report},
  volume=711,
  year=2011,
  URL={https://doi.org/10.3929/ethz-a-006903018},
  numpages=34,
  institution={ETH Zurich},
  annote={30 references.}
}

@InProceedings{Katara-Katz03,
  author =	 {Mika Katara and Shmuel Katz},
  title =	 {Architectural Views of Aspects},
  booktitle =	 {AOSD},
  year =	 {2003},
  pages =	 {1--10},
  address =	 {Boston},
  annote =	 {Summary: The paper describes a concept of aspect
                  design by identifying common concerns for aspects
                  and factoring these out as sub-aspects. The concept
                  is evaluated at the design level and extensions to
                  UML are presented that allow the modeling of
                  aspects, sub-aspects, and their
                  interaction. Translating these models into actual
                  code is left as future work.},
}

@Article{Katrib-Coira97,
  author =	 {Miguel Katrib and Jes\'{u}s Coira},
  title =	 {Improving {Eiffel} Assertions Using Quantified Iterators},
  journal =	 JOOP,
  year =	 1997,
  volume =	 10,
  number =	 7,
  month =	 nov,
  pages =	 {35-43},
  annote =	 {Adds quantifiers to Eiffel. 11 references.}
}

@Article{Katrib-Ledesma-Paneque03,
	Author 	= {Miguel Katrib and Erich Ledesma and Leonardo Paneque},
	Title 	= {Including Assertions in {.NET} Assemblies},
	Journal = {.NET Developer's Journal},
	Volume 	= {1},
	Number 	= {9},
	Month 	= sep,
	Year 		= {2003},
	Url 		= {http://dotnet.sys-con.com/read/38959.htm},
}

@inproceedings{Katz-Gil99,
  author =	 {Shmuel Katz and Yossi Gil},
  title =	 {Aspects and superimpositions},
  booktitle =	 {Int'l Workshop on Aspect-Oriented Programming (ECOOP
                  1999)},
  month =	 jun,
  year =	 1999,
  location =	 {Lisbon},
  url =
                  {http://trese.cs.utwente.nl/aop-ecoop99/papers/katz.pdf}
}

@inproceedings{Katz-Grumberg02,
 author = {Shmuel Katz and Orna Grumberg},
 title = {A Framework for Translating Models and Specifications},
 booktitle = {IFM '02: Proceedings of the Third International Conference on Integrated Formal Methods},
 year = {2002},
 pages = {145--164},
 publisher = SV,
 address = {London, UK},
}

@InProceedings{Katz-Katz09,
  author = 	 {Emilia Katz and Shumel Katz},
  title = 	 {Modular Verification of Strongly Invasive Aspects},
  booktitle = {FOAL '09: Proceedings of the Eighth Workshop on Foundations of Aspect-Oriented Languages},
  pages = 	 {7-16},
  year = 	 2009,
  URL = 	 {\url{http://www.eecs.ucf.edu/~leavens/FOAL/papers-2009/Katz-Katz.pdf}},
  publisher = {ACM}}

@article{Katz06,
	Author = {Shmuel Katz},
	Journal = {Transactions on Aspect-Oriented Software Development},
	Title = {Aspect Categories and Classes of Temporal Properties},
        Series = LNCS,
	Volume = 3880,
	Year = 2006
}

@Article{Katzenelson79,
  Author =	 "J. Katzenelson",
  Title =	 "Clusters and Dialogues for Set Implementations",
  Journal =	 IEEETSE,
  Year =	 1979,
  Month =	 may,
  Volume =	 "SE-5",
  Number =	 3,
  Pages =	 "256-275"
}

@Article{Kaufmann-Moore97,
  author =	 {Matt Kaufmann and J S. Moore},
  title =	 {An Industrial Strength Theorem Prover for a Logic
                  Based on {Common Lisp}},
  journal =	 IEEETSE,
  year =	 1997,
  volume =	 23,
  number =	 4,
  month =	 apr,
  pages =	 {203-213},
  annote =	 {ACL2 is a successor to the Boyer-Moore prover. 42
                  references.}
}

@Article{Keidar-etal02,
  author =	 {Idit Keidar and Roger Khazan and Nancy Lynch and
                  Alex Shvartsman},
  title =	 {An Inheritance-Based Technique for Building
                  Simulation Proofs Incrementally},
  journal =	 TOSEM,
  year =	 2002,
  volume =	 11,
  number =	 1,
  pages =	 {1-29},
  month =	 jan
}

@InProceedings{Keller-Schauer98,
  author =	 {Rudolf K. Keller and Reinhard Schauer},
  title =	 {Design Components: Towards Software Composition at
                  the Design Level},
  booktitle =	 {Proceedings of the 1998 International Conference on
                  Software Engineering: ICSE 98, Kyoto, Japan},
  year =	 1998,
  organization = IEEE,
  address =	 {Los Alamitos, California},
  month =	 apr,
  pages =	 {302-311},
  annote =	 {25 references.}
}

@Book{Keller-Shumate92,
  author =	 "Marilyn Keller and Ken Shumate",
  title =	 "Software Specification and Design, {A} Disciplined
                  Approach for Real-Time Systems",
  publisher =	 "John Wiley \& Sons",
  year =	 "1992",
  annote =	 "63 references."
}

@InProceedings{Kellomaki-Mikkonen00,
  author =       {Pertti Kellom\"{a}ki and Tommi Mikkonen},
  title =        {Design Templates for Collective Behavior},
  editor =       {Elisa Bertino},
  booktitle =    {ECOOP 2000 -- Object-Oriented Programming 14th European Conference},
  series =       LNCS,
  volume =       1850,
  year =         2000,
  pages =        {277-295},
  annote =       {23 references.}
}

@InProceedings{Kellomaki02,
  Author =	 {Pertti Kellom\"{a}ki},
  Title =	 {A Formal Basis for Aspect-Oriented Specification
                  with Superposition},
  Pages =	 "27-32",
  BookTitle =	 {FOAL 2002 Proceedings: Foundations of
                  Aspect-Oriented Languages Workshop at AOSD 2002},
  year =	 2002,
  Editor =	 {Gary T. Leavens and Ron Cytron},
  Organization = {Department of Computer Science, Iowa State
                  University},
  Series =	 {Technical Report},
  number =	 {02-06},
  month =	 apr,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR02-06/TR.pdf"
}

@Article{Kemerer98,
  author =	 {Chris F. Kemerer},
  title =	 {Progress, Obstacles, and Opportunities in Software
                  Engineering Economics},
  journal =	 CACM,
  year =	 1998,
  volume =	 41,
  number =	 8,
  month =	 aug,
  pages =	 {63-66},
  annote =	 {12 references.}
}

@InProceedings{Kent-Maung95,
  Author =     {S. Kent and I. Maung},
  Title =      {{Quantified Assertions in Eiffel}},
  Month =      {November},
  Year =       {1995},
  Pages =      {349-364},
  Booktitle =  {Proceedings of TOOLS Pacific 95 (TOOLS 18)},
  Publisher =  {Prentice Hall},
  URL =        {http://www.cs.ukc.ac.uk/pubs/1995/802}
}

@InProceedings{Kent97,
  author =	 {Stuart Kent},
  title =	 {Constraint Diagrams: Visualizing Invariants in
                  Object-Oriented Models},
  BookTitle =	 "Conference Proceedings of OOPSLA '97, Atlanta",
  Series =	 SIGPLAN,
  Volume =	 "32(10)",
  Month =	 oct,
  Year =	 1997,
  organization = ACM,
  pages =	 {327-341},
  annote =	 {18 references.}
}

@Book{Kernighan-Pike84,
  Author =	 "Brian W. Kernighan and Rob Pike",
  Title =	 "The UNIX Programming Environment",
  Publisher =	 "Prentice-Hall",
  Year =	 1984,
  Series =	 "Prentice-Hall Software Series",
  Address =	 "Englewood Cliffs, NJ",
  Annote =	 "0 references but bibliographic notes at end of each
                  chapter."
}

@Book{Kernighan-Pike99,
  Author =	 "Brian W. Kernighan and Rob Pike",
  Title =	 "The Practice of Programming",
  Publisher =	 "Addison-Wesley",
  Year =	 1999,
  Series =	 "Addison-Wesley Professional Computing Series",
  Address =	 "Englewood Cliffs, NJ",
  Annote =	 "0 references but there is a supplementary reading
                  section at the end of each chapter."
} 

@Book{Kernighan-Plauger76,
  Author =	 "Brian W. Kernighan and P. J. Plauger",
  Title =	 "Software Tools",
  Publisher =	 "Addison-Wesley",
  Year =	 1976,
  Address =	 "Reading, MA",
  Annote =	 "0 references but bibliographic notes at end of each
                  chapter."
}

@Book{Kernighan-Plauger78,
  Author =	 "Brian W. Kernighan and P. J. Plauger",
  Title =	 "The Elements of Programming Style",
  Publisher =	 "McGraw-Hill",
  Year =	 1978,
  Address =	 NY,
  Edition =	 "Second",
  Annote =	 "5 references."
}

@Misc{Key-Project21,
  key = 	 {Key Project},
  title = 	 {The {KeY} Project},
  URL =          {https://www.key-project.org},
  note = 	 {Visited Sept. 2021.}
}

@Article{Khairunnesa-etal23,
  author = 	 {Samantha Syeda Khairunnesa and Shibbir Ahmed and Sayem Mohammad Imtiaz and Hridesh Rajan and Gary T. Leavens},
  title = 	 {What kinds of contracts do {ML} {APIs} need?},
  journal = 	 {Empirical Software Engineering},
  year = 	 2023,
  URL = {https://doi.org/10.1007/s10664-023-10320-z},
  volume = 	 28,
  number = 	 6,
  pages = 	 {142-179}
}

@TechReport{Khanolkar-Leavens06,
  author = 	 {Neeraj Khanolkar and Gary T. Leavens},
  title = 	 {Executable Documentation of Template-Hook Interactions in Frameworks using JML},
  institution =	 "Department of Computer Science, Iowa State
                  University",
  year = 	 2006,
  number =	 {06-18},
  address =	 {Ames, Iowa},
  month =	 jun,
  annote =	 {18 references.},
  URL =          {ftp://ftp.cs.iastate.edu/pub/techreports/TR06-18/TR.pdf}
}

@InProceedings{Khatchadourian-Dovland-Soundarajan08,
	author = {Raffi Khatchadourian and Johan Dovland and Neelam Soundarajan},
	title = {Enforcing Behavioral Constraints in Evolving Aspect-Oriented Programs},
	booktitle = {FOAL '08: Proceedings of the Seventh Workshop on Foundations of Aspect-Oriented Languages},
	year = {2008},
        month = apr,
	pages = {19-28},
	publisher = {ACM Press},
	address = {New York, NY, USA},
        doi = {http://doi.acm.org/10.1145/1394496.1394499},
        URL = {\url{http://www.eecs.ucf.edu/~leavens/FOAL/papers-2008/Khatchadourian-Dovland-Soundarajan.pdf}},
        annote = {35 references.}
}

@InProceedings{Khatchadourian-Soundarajan07,
	author = {Raffi Khatchadourian and Neelam Soundarajan},
	title = {Rely-guarantee approach to reasoning about aspect-oriented
		programs},
	booktitle = {SPLAT '07: Proceedings of the 5th workshop on Engineering
		properties of languages and aspect technologies},
	year = {2007},
	isbn = {1-59593-656-1},
	pages = {5},
	location = {Vancouver, British Columbia, Canada},
	doi = {http://doi.acm.org/10.1145/1233843.1233848},
	publisher = {ACM Press},
	address = {New York, NY, USA},
}

@InCollection{Khosla-Maibaum87,
  author =	 "S. Khosla and T. S. E. Maibaum",
  title =	 "The Prescription and Description of State Based
                  Systems",
  booktitle =	 "Temporal Logic in Specification",
  publisher =	 SV,
  year =	 1987,
  editor =	 "B. Banieqbal and H. Barringer and A. Pnueli",
  volume =	 398,
  series =	 LNCS,
  pages =	 "243-294"
}

@InProceedings{Khurshid-Marinov-Jackson02,
  author =	 {Sarfraz Khurshid and Darko Marinov and Daniel
                  Jackson},
  title =	 {An Analyzable Annotation Language},
  booktitle =	 {Proceedings of OOPSLA '02 Conference on
                  Object-Oriented Programming, Languages, Systems, and
                  Applications},
  volume =	 "37(11)",
  series =	 {SIGPLAN Notices},
  year =	 2002,
  publisher =	 ACM,
  address =	 NY,
  month =	 nov,
  pages =	 {231--245},
  annote =	 "36 references."
}

@Article{Kiczales-Lamping92,
  Author =	 "Gregor Kiczales and John Lamping",
  Title =	 "Issues in the Design and Documentation of Class
                  Libraries",
  Journal =	 SIGPLAN,
  Volume =	 27,
  Number =	 10,
  Month =	 oct,
  Year =	 1992,
  Pages =	 "435-451",
  Note =	 "{\em OOPSLA '92 Proceedings}, Andreas Paepcke
                  (editor).",
  Annote =	 "13 refrences."
}

@inproceedings{Kiczales-Mezini05,
  author    = {Gregor Kiczales and Mira Mezini},
  title     = {Separation of Concerns with Procedures, Annotations, Advice and Pointcuts.},
  booktitle = {{ECOOP} 2005},
  pages     = {195-213}
}

@inproceedings{Kiczales-Mezini05a,
   Author = {Gregor Kiczales and Mira Mezini},
   Title = {Aspect-Oriented Programming and Modular Reasoning},
   Booktitle = {Proc. of the 27th International Conference on Software Engineering},
   Pages = {49-58},
   Organization = {ACM},
   Year = {2005}
}

@Unpublished{Kiczales03,
  author =	 {Gregor Kiczales},
  title =	 {The Fun has Just Begun},
  note =	 {AOSD'03 Keynote Address, available from
                  \url{http://www.cs.ubc.ca/~gregor}},
  year =	 {2003},
  keywords =	 {kiczales-aosd-2003.ppt}
}
                  
@InCollection{Kiczales93,
  Author =	 "Gregor Kiczales",
  Title =	 "Traces (A Cut at the ``Make Isn't Generic''
                  Problem)",
  BookTitle =	 "Object Technologies for Advanced Software",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Shojiro Nishio and Akinori Yonezawa",
  Series =	 LNCS,
  Volume =	 742,
  Pages =	 "27-42",
  Month =	 aug,
  Annote =	 "16 references."
}

@Article{Kiczales96,
  author =	 {Gregor Kiczales},
  title =	 {Beyond the Black Box: Open Implementation},
  journal =	 {IEEE Software},
  year =	 1996,
  volume =	 13,
  number =	 1,
  month =	 jan,
  pages =	 {8-11}
}

@Article{Kifer-Wu93,
  Author =	 "Michael Kifer and James Wu",
  Title =	 "A Logic for Programming with Complex Objects",
  Journal =	 "Journal of Computer and System Sciences",
  Volume =	 47,
  Year =	 1993,
  Pages =	 "77-120",
  Annote =	 "35 refrences."
}

@Book{Kilov-Harvey96,
  editor =	 {Haim Kilov and William Harvey},
  title =	 {Object-Oriented Behavioral Specifications},
  booktitle =	 {Object-Oriented Behavioral Specifications},
  publisher =	 {Kluwer Academic Publishers},
  year =	 1996,
  series =	 {Kluwer International Series in Engineering and
                  Computer Science},
  address =	 {Boston},
  annote =	 {Many references.}
}

@Article{Kilov94,
  Author =	 "H. Kilov",
  Title =	 "Formal Methods and Standards",
  Journal =	 "Software Engineering Notes ",
  Year =	 1994,
  Volume =	 19,
  Number =	 3,
  Month =	 jul,
  Pages =	 40,
  Annote =	 "1 reference."
}

@InProceedings{Kim-etal02,
  author =	 "Moonjoo Kim and Insup Lee and Usa Sammapun and
                  Jangwoo Shin and Oleg Sokolsky",
  title =	 "Monitoring, Checking, and Steering of Real-Time
                  Systems",
  BookTitle =	 "2nd International Workshop on Run-time Verification,
                  RV '02, Paris, France, July 23, 2001",
  year =	 "2002",
  Note =	 "Published in {\em Electronic Notes in Theoretical
                  Computer Science}, 70(2), 2002. Available from
                  \url{www.sciencedirect.com}."
}

@inproceedings{Kim-etal09,
author = {Taekgoo Kim and Kevin Bierhoff and Jonathan Aldrich and Sungwon Kang},
title = {Typestate Protocol Specification in {JML}},
year = 2009,
isbn = 9781605586809,
publisher = ACM,
address = NY,
url = {https://doi.org/10.1145/1596486.1596490},
abstract = {The Java Modeling Language (JML) is a language for specifying the behavior of Java
source code. However, it can describe the protocols of Java classes and interfaces
only implicitly. Typestate protocol specification is a more direct, lightweight and
abstract way of documenting usage protocols for object-oriented programs. In this
paper, we propose a technique for incorporating the typestate concept into JML for
specifying protocols of Java classes and interfaces, based on our previous research
on typestate protocol specifications [4]. This paper presents a set of formal translation
rules for encoding typestate protocol specifications into pre/post-condition specifications.
It shows how typestate protocol specifications can be mixed with pre/post-condition
specifications and how violations of code contracts in inheritance can be handled.
Finally, our proposed technique is demonstrated within the Java/JML environment to
show its effectiveness.},
booktitle = {Proceedings of the 8th International Workshop on Specification and Verification of Component-Based Systems},
pages = {11–18},
numpages = 8,
keywords = {jml, usage protocol, behavioral subtyping, typestate},
location = {Amsterdam, The Netherlands},
series = {SAVCBS '09}
}

@InProceedings{King-etal99,
  author =       "Steve King and Jonathan Hammond and Rod Chapman and
                 Andy Pryor",
  title =        "The Value of Verification: Positive Experience of
                 Industrial Proof",
  editor =       "Jeanette M. Wing and Jim Woodcock and Jim Davies",
  booktitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  series =	 LNCS,
  publisher =	 SV,
  number =	 1709,
  year =	 1999,
  pages =        "1527-1545",
  annote =       "Used Z and SPARK subset of Ada.  Lots of proof.  Compares proof and testing.  28 references.",
  address =      "Berlin"
}

% doi = {10.1145/1596486.1596490},
@InProceedings{Kiniry-Chalin-Hurlin05,
  author = 	 {Joseph Kiniry and Patrice Chalin and Cl\'{e}ment Hurlin},
  title = 	 {Integrating Static Checking and Interactive Verification: Supporting Multiple Theories and Provers in Verification},
  year =	 2005,
  booktitle =	 {Verified Software: Theories, Tools, Experiments, Zurich, Switzerland},
  month =	 oct,
  organization = {IFIP Working Group 2.3},
  note =	 {To appear.}
}

@InProceedings{Kiniry-Cok04,
  author = "David R. Cok and Joseph R. Kiniry",
  title = "{ESC/Java2}: Uniting {ESC/Java} and {JML}: Progress and
                  issues in building and using {ESC/Java2}, including
                  a case study involving the use of the tool to
                  verify portions of an {Internet} voting tally system",
  booktitle = "Construction and Analysis of Safe,
               Secure, and Interoperable Smart devices (CASSIS 2004)",
  editor = "Gilles Barthe and Lilian Burdy and Marieke Huisman and Jean-Louis Lanet and Traian Muntean",
  year = 2005,
  pages = "108-128",
  series = LNCS,
  publisher = SV,
  URL ={http://dx.doi.org/10.1007/b105030},
  volume = 3362
}

@InProceedings{Kiniry-Cok05,
  author = "David R. Cok and Joseph R. Kiniry",
  title = "{ESC/Java2}: Uniting {ESC/Java} and {JML}: Progress and
                  issues in building and using {ESC/Java2}, including
                  a case study involving the use of the tool to
                  verify portions of an {Internet} voting tally system",
  booktitle = "Construction and Analysis of Safe,
               Secure, and Interoperable Smart devices (CASSIS 2004)",
  editor = "Gilles Barthe and Lilian Burdy and Marieke Huisman and Jean-Louis Lanet and Traian Muntean",
  year = 2005,
  pages = "108-128",
  series = LNCS,
  publisher = SV,
  URL ={http://dx.doi.org/10.1007/b105030},
  volume = 3362
}

@InProceedings{Kiniry-Morkan-Denby06,
  author = 	 {Joseph Kiniry and Alan E. Morkan and Barry Denby},
  title = 	 {Soundness and Completeness Warnings in {ESC/Java2}},
  booktitle =	 {Fifth International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2006)},
  pages =	 {19-24},
  year =	 2006,
  month =	 nov,
  organization = ACM,
  URL = 	 {http://www.cs.iastate.edu/~leavens/SAVCBS/2006/papers/Kiniry-Morkan-Denby.pdf}
}

@InProceedings{Kiniry-Poll03,
  author = "Joseph Kiniry and Erik Poll",
  title = "Opportunities and challenges for formal specification of {Java} programs",
  booktitle = "Trusted Components Workshop",
  address = "Prato, Italy",
  month = jan,
  year = 2003,
  URL = {http://www.cs.ru.nl/~erikpoll/publications/prato.pdf},
  annote = {11 references.}
}

% The entry Kiniry-Cok04 is deprecated, use Cok-Kiniry05 instead.
@incollection{Kiniry-Zimmerman-Hyland12,
     author={Joseph R. Kiniry and Daniel M. Zimmerman and Ralph Hyland},
     title={Testing Library Specifications by Verifying Conformance Tests},
      booktitle={Tests and Proofs},
year=2012,
volume=7305,
series=LNCS,
editor={Achim D. Brucker and Jacques Julliand},
url={http://dx.doi.org/10.1007/978-3-642-30473-6_6},
publisher=SV,
address={Heidelberg, Germany},
pages={51-66}
}

@InProceedings{Kiniry-etal06,
  author = 	 {Joseph R. Kiniry and Alan Morkan and Dermot Cochran and Fintan Fairmichael and Patrice Chalin and Martijn Oostdijk and Engelbert Hubbers},
  title = 	 {The KOA Remote Voting System: A Summary of Work To Date},
  booktitle =	 {Proceedings of Trustworthy Global Computing (TGC)},
  year =	 2006,
  note =	 {To appear}
}

@Misc{Kiniry04,
  author =	 {Joe Kiniry},
  title =	 {Electronic and Internet Voting in The Netherlands},
  howpublished = {\url{http://secure.ucd.ie/~kiniry/papers/NL_Voting.html}},
  month =	 jun,
  year =	 2004
}

@InProceedings{Kirschenbaum-etal08,
  author = 	 {Jason Kirschenbaum and Bruce Adcock and Derek Bronish and Paolo Bucci and Bruce Weide},
  title = 	 {Using Isabelle Theories to Help Verify Code That Uses Abstract Data Types},
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {67-74},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/Kirschenbaum-etal.pdf}
}

@TechReport{Klarlund90,
  Author =	 "Nils Klarlund",
  Title =	 "Progress Measures and Finite Arguments for Infinite
                  Computations",
  Institution =	 "Department of Computer Science, Cornell University",
  Address =	 "Ithaca, New York",
  Number =	 "90-1153",
  Month =	 sep,
  Year =	 1990,
  Annote =	 "Progress measures for specification and verification
                  of problems involving nondeterminism, fairness, and
                  liveness properties. 52 references."
}

@incollection{Klebanov-etal11,
author={Vladimir Klebanov and Peter M\"{u}ller and Natarajan Shankar and Gary T. Leavens and Valentin W\"{u}stholz and Eyad Alkassar and Rob Arthan and Derek Bronish and Rod Chapman and Ernie Cohen and Mark Hillebrand and Bart Jacobs and K .Rustan M. Leino and Rosemary Monahan and Frank Piessens and Nadia Polikarpova and Tom Ridge and Jan Smans and Stephan Tobies and Thomas Tuerk and Mattias Ulbrich and Benjamin Weiss},
year={2011},
isbn={978-3-642-21436-3},
booktitle={FM 2011: Formal Methods},
volume={6664},
series=LNCS,
editor={Michael Butler and Wolfram Schulte},
title={The 1st Verified Software Competition: Experience Report},
url={http://dx.doi.org/10.1007/978-3-642-21437-0_14},
publisher={Springer Berlin Heidelberg},
pages={154-168},
annote={14 references}
}

@article{Klein-etal10,
 author = {Gerwin Klein and June Andronick and Kevin Elphinstone and Gernot Heiser and David Cock and Philip Derrin and Dhammika Elkaduwe and Kai Engelhardt and Rafal Kolanski and Michael Norrish and Thomas Sewell and Harvey Tuch and Simon Winwood},
 title = {{seL4}: Formal Verification of an Operating-system Kernel},
 journal = CACM,
 volume = 53,
 number = 6,
 month = jun,
 year = 2010,
 pages = {107-115},
 numpages = 9,
 url = {http://doi.acm.org/10.1145/1743546.1743574},
 doi = {10.1145/1743546.1743574},
 publisher = ACM,
 address = NY,
}

@Book{Kleppe-Warmer-Bast03,
  author =	 {Anneke Kleppe and Jos Warmer and Wim Bast},
  title = 	 {MDA Explained: The Model Driven Architecture---Practice and Promise},
  publisher = 	 {Addison-Wesley},
  year = 	 2003
}

@article{Kleymann99,
  author={Thomas Kleymann},
  title={Hoare Logic and Auxiliary Variables},
  journal=FAC,
  year=1999,
  pages={541-566},
  volume=11
}

@InCollection{Kligerman-Stoyenko92,
  Author =	 "E. Kligerman and A.D. Stoyenko",
  Title =	 "Real-Time {Euclid}: A language for Reliable Real-Time
                  Systems",
  BookTitle =	 "Real-Time Systems: Abstractions, Languages, and
                  Design Methodologies",
  Publisher =	 "IEEE Computer Society Press",
  Year =	 1992,
  Editor =	 "Krishna M. Kavi",
  Pages =	 "455-463",
  Address =	 "Los Alamitos, California",
  Month =	 oct,
  Annote =	 "20 references."
}

@InCollection{Klop90,
  Author =	 "Jan Willem Klop",
  Title =	 "Term Rewriting systems: from Church-Rosser to
                  Knuth-Bendix and beyond",
  BookTitle =	 "17th International Colloquium on Automata,
                  Languages, and Programming (ICALP), Warwick,
                  England",
  Publisher =	 SV,
  Year =	 1990,
  Editor =	 "M. S. Paterson",
  Series =	 LNCS,
  Pages =	 "350-369",
  Address =	 NY,
  Month =	 jul
}

@Article{Kniesel-Theisen01,
  author =	 "Gunter Kniesel and Dirk Theisen",
  title =	 "JAC --- Acess right based encapsulation for {Java}",
  journal =	 "Software --- Practice and Experience",
  volume =	 31,
  number =	 6,
  pages =	 "555--576",
  year =	 2001
}

@Inproceedings{Knight-Strunk-Greenwell-Wasson04,
	author 		= {John C. Knight and Elisabeth A. Strunk and William S. Greenwell and Kimberly S. Wasson},
	title 		= {Specification and Analysis of Data for Safety-Critical Systems},
	editor 		= {N. Welch and A. Boyer},
	booktitle = {22nd International System Safety Conference},
	year 			= {2004},
	location 	= {Providence, RI, USA},
	publisher = {International Systems Safety Society}
}

@Book{Knuckles-Yuen05,
  author =	 {Craig Knuckles and David Yuen},
  title = 	 {Web Applications: Concepts \& Real World Design},
  publisher = 	 {Wiley},
  year = 	 2005
}

@Article{Knuth74,
  Title =	 "Structured Programming with Goto Statements",
  Author =	 "D. E. Knuth",
  Journal =	 ACMCS,
  Year =	 1974,
  Month =	 dec,
  Volume =	 6,
  Number =	 4,
  Pages =	 "261-301"
}

@InCollection{Kondoh00,
  author =	 {Hidetaka Kondoh},
  title =	 {What is `Mathematicalness' in Sofware Engineering
                  --- Towards Precision Software Engineering ---},
  booktitle =	 {Fundamental Approaches to Software Engineering},
  pages =	 {163-177},
  publisher =	 SV,
  year =	 2000,
  editor =	 {T. Maibaum},
  volume =	 1783,
  series =	 LNCS,
  address =	 {Berlin},
  annote =	 {Advocates languages that allow programmers to think
                  and specify in higher-level chunks. 21 references.}
}

@article{Konikowska-Bialasik99,
    author = "Beata Konikowska and Marcin Bialasik",
    title = "Reasoning with first order nondeterministic specifications",
    journal = "Acta Informatica",
    volume = 36,
    number = 5,
    pages = "375-403",
    year = 1999
}

@Article{Konikowska-Tarlecki-Blikle91,
  author =	 "B. Konikowska and A. Tarlecki and A. Blikle",
  title =	 "A three-valued logic for software specification and
                  validation",
  journal =	 "Fundamenta Informaticae",
  year =	 1991,
  volume =	 "XIV",
  pages =	 "411-453"
}

@inproceedings{Konrad-Cheng05,
 author = {Sascha Konrad and Betty H. C. Cheng},
 title = {Real-time specification patterns},
 booktitle = {ICSE '05: Proceedings of the 27th international conference on Software engineering},
 year = {2005},
 pages = {372-381},
 location = {St. Louis, MO, USA},
 doi = {http://doi.acm.org/10.1145/1062455.1062526},
 publisher = ACM,
 address = NY
}

@Article{Korel-Al-Yami98,
  author =	 {Bogdan Korel and Ali M. Al-Yami},
  title =	 {Automated Regression Test Generation},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 2,
  month =	 mar,
  pages =	 {143-152},
  note =	 {ISSTA 98: Proceedings of the ACM SIGSOFT
                  International Symposium on Software Testing and
                  Analysis},
  annote =	 {26 references.}
}

@Article{Korson-McGregor90,
  Author =	 "Tim Korson and John D. McGregor",
  Title =	 "Understanding Object-Oriented: A Unifying Paradigm",
  Journal =	 CACM,
  Year =	 1990,
  Volume =	 33,
  Number =	 9,
  Month =	 sep,
  Pages =	 "40-60",
  Annote =	 "29 references."
}

@InProceedings{Kosiuczenko09,
  title =	"On the Implementation of @pre",
  author =	"Piotr Kosiuczenko",
  booktitle =	"FASE",
  booktitle =	"Fundamental Approaches to Software Engineering, 12th
		 International Conference, {FASE} 2009, Held as Part of
		 the Joint European Conferences on Theory and Practice
		 of Software, {ETAPS} 2009, York, {UK}, March 22-29,
		 2009. Proceedings",
  publisher =	"Springer",
  year = 	"2009",
  volume =	"5503",
  editor =	"Marsha Chechik and Martin Wirsing",
  ISBN = 	"978-3-642-00592-3",
  pages =	"246-261",
  series =	LNCS,
  URL =  	"http://dx.doi.org/10.1007/978-3-642-00593-0",
}

@Article{Kowaltowski77,
  Author =	 "T. Kowaltowski",
  Title =	 "Axiomatic approach to side effects and general
                  jumps",
  Journal =	 "Acta Informatica",
  Year =	 1977,
  Volume =	 7,
  Pages =	 "357-360"
}

@Book{Koymans92,
  Author =	 "Ron Koymans",
  Title =	 "Specifying Message Passing and Time-Critical Systems
                  with Temporal Logic",
  Series =	 "Lecture Notes in Computer Science",
  Number =	 651,
  Publisher =	 SV,
  Year = 1992,
  Address =	 "Berlin Heidelberg",
  Annote =	 "115 references"
}

@Article{Kozacynski-Booch98,
  author =	 {Wojtek Kozacynski and Grady Booch},
  title =	 {Component-Based Software Engineering},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 5,
  month =	 sep,
  pages =	 {34-36},
  annote =	 {Guest editor's introduction with some suggestions
                  for further reading.}
}

@InCollection{Kozen-Tiuryn90,
  Author =	 "Dexter Kozen and J. Tiuryn",
  Booktitle =	 "Handbook of Theoretical Computer Science",
  Title =	 "Logics of Programs",
  Chapter =	 14,
  Publisher =	 MITP,
  Year =	 1990,
  Editor =	 "J. van Leewen",
  Pages =	 "789-840",
  Volume =	 "B: Formal Models and Semantics",
  Address =	 NY,
  Annote =	 "Discussion of dynamic logic. 172 references."
}

@Book{Kramer-Magee06,
author		= {Jeff Kramer and Jeff Magee},
title		= {Concurrency: State Models \& Java Programs, 2nd Edition},
series		= {Worldwide Series in Computer Science},
publisher	= Wiley,
address         = "Hoboken, NJ",
month		= apr,
year		= 2006,
url		= {http://pubs.doc.ic.ac.uk/concurrency-models-java-2nd-ed/}
}

@InProceedings{Kramer98,
  Author =	 {Reto Kramer},
  Title =	 {{iContract} -- The {Java}$^{TM}$ Design by Contract$^{TM}$ Tool},
  BookTitle =	 {TOOLS 26: Technology of Object-Oriented Languages
                  and Systems},
  Publisher =	 {IEEE Computer Society Press},
  Month =        aug,
  Year =	 1998,
  URL = {http://doi.ieeecomputersociety.org/10.1109/TOOLS.1998.711021},
  Pages =	 {295-307}
}
                  
@Book{Kratochvil-McGibbon03,
  author =	 {Milan Kratochvil and Barry McGibbon},
  title = 	 {UML Xtra-Light: How to Specify Your Software Requirements},
  publisher = 	 {Cambridge},
  year = 	 2003,
  address =	 {Cambridge, UK},
  annote =	 {10 references.}
}

@TechReport{Kraus87,
  Author =	 "Timothy Kraus",
  Title =	 "The FASE3 System for Executable Data Type
                  Specification",
  Institution =	 "Computer Science Department, Univ. of Illinois at
                  Urbana-Champaign",
  Year =	 1987,
  Number =	 "UIUCDCS-R-87-1405",
  Month =	 dec
}

@InProceedings{Krause-Wahls06,
  author = 	 {Ben Krause and Tim Wahls},
  title = 	 {jmle: A Tool for Executing {JML} Specifications via Constraint Programming},
  booktitle =	 {Formal Methods for Industrial Critical Systems (FMICS '06)},
  pages =	 {293-296},
  year =	 2006,
  editor =	 {L. Brim},
  volume =	 4346,
  series =	 LNCS,
  address =	 NY,
  publisher =	 SV,
  URL = 	 {http://users.dickinson.edu/~wahlst/papers/tool.pdf}
}

@InProceedings{Krishnamurthi-Felleisen-Friedman98,
  author =	 {Shriram Krishnamurthi and Matthias Felleisen and
                  Daniel P. Friedman},
  title =	 {Synthesizing Ojbect-Oriented and Functional Design
                  to Promote Re-use},
  year =	 1998,
  booktitle =	 {ECOOP '98---Object-Oriented Programming, 
                    12th European Conference, Brussels, Belgium, Proceedings},
  editor = {Eric Jul},
  series =	 LNCS,
  volume =	 1445,
  pages =	 {91-113},
  publisher =	 SV,
  address =	 NY,
  annote =	 {Uses virtual constuctors to make the visitor pattern
                  more amenable to extension. 33 references.}
}

@Article{Krishnamurthi-Felleisen98,
  author =	 {Shriram Krishnamurthi and Matthias Felleisen},
  title =	 {Toward a Formal Theory of Extensible Software},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 6,
  month =	 nov,
  pages =	 {88-98},
  note =	 {Proceedings of the ACM SIGSOFT Sixth Internatioal
                  Symposium on the Foundations of Software
                  Engineering},
  annote =	 {Allowing clients to customize software without
                  access to the source. Forces abstraction and
                  delegation. 32 references.}
}

@inproceedings{Krishnamurthi-Fisler-Greenberg04,
	Author = {Krishnamurthi, Shriram and Fisler, Kathleen and Greenberg, Micahel},
	Title = {Verifying Aspect Advice Modularly},
	Crossref = {FSE-04},
	Pages = {137-146}
}

@InProceedings{Krishnaswami-Birkedal-Aldrich07,
  author =	 {Neelakantan Krishnaswami and Lars Birkedal and Jonathan Aldrich},
  title = 	 {Modular Verification of the Subject-Observer Pattern via Higher-Order Separation Logic},
  booktitle =	 {Workshop on Formal Techniques for Java-like Programs (FTfJP)},
  year =	 2007,
  month =	 jul,
  URL = 	 {http://cs.nju.edu.cn/boyland/ftjp/paper_12.pdf},
  annote =       {16 references.}
}

@InProceedings{Krone-Ogden-Sitaraman01,
  author =	 {Joan Krone and William F. Ogden and Murali Sitaraman},
  title =	 {Modular Verification of Performance Correctness},
  booktitle = 	 {ACM OOPSLA Workshop on Specification and Verification
                  of Component-Based Systems (SAVCBS)},
  year =	 2001,
  pages =        {60--67},
  annote =       {21 references.},
  URL =          {http://www.eecs.ucf.edu/~leavens/SAVCBS/2001/papers-2001/krone-ogden-sitaraman.pdf}
}

@TechReport{Krone-Ogden-Sitaraman03,
  author =	 {Joan Krone and William F. Ogden and Murali
                  Sitaraman},
  title =	 {Modular Verification of Performance Constraints},
  institution =	 {Department of Computer Science, Clemson University},
  year =	 2003,
  number =	 {RSRG-03-04},
  address =	 {Clemson, SC 29634-0974},
  month =	 may,
  URL =
                  {http://www.cs.clemson.edu/~resolve/reports/RSRG-03-04.pdf}
}

@TechReport{Krone-Ogden-Sitaraman03a,
  author =	 {Joan Krone and William F. Ogden and Murali
                  Sitaraman},
  title =	 {{OO} Big {O}},
  institution =	 {Department of Computer Science, Clemson University},
  year =	 2003,
  number =	 {RSRG-03-06},
  address =	 {Clemson, SC 29634-0974},
  month =	 sep,
  URL =
                  {http://www.cs.clemson.edu/~resolve/reports/RSRG-03-06.pdf}
}

@TechReport{Krone-Ogden-Sitaraman04,
  author =	 {Joan Krone and William F. Ogden and Murali Sitaraman},
  title =	 {Profiles: A Compositional Mechanism for Performance Specification},
  institution =	 {Department of Computer Science, Clemson University},
  year =	 2004,
  number =	 {RSRG-04-03},
  address =	 {Clemson, SC 29634-0974},
  month =	 jun,
  Note =         {Invited as one of the best papers from the SAVCBS Workshop
                  series and under consideration for Formal Aspects of Computing,
                  Springer-Verlag},
  URL =
                  {http://www.cs.clemson.edu/~resolve/reports/RSRG-04-03.pdf}
}

@Article{Krueger92,
  Author =	 "Charles W. Krueger",
  Title =	 "Software Reuse",
  Journal =	 ACMCS,
  Year =	 1992,
  Volume =	 24,
  Number =	 2,
  Month =	 jun,
  Pages =	 "131-183",
  Annote =	 "105 references."
}

@Book{Krzysztof-Olderog91,
  Author =	 "R. A. Krzysztof and {Ernst-Rudiger} Olderog",
  Title =	 "Verification of Sequential and Concurrent Programs",
  Publisher =	 SV,
  Year =	 1991,
  Series =	 "Texts and Monographs in Computer Science",
  Address =	 NY
}

@Book{Kubiak-Rudzinski-Sokolowski91,
  Author =	 "Ryszard Kubiak and Roman Rudzinski and Stefan
                  Sokolowski",
  Title =	 "An Introduction to Programming with Specifications:
                  A Mathematical Approach",
  Publisher =	 "Academic Press",
  Year =	 1991,
  Volume =	 35,
  Series =	 "A.P.I.C.",
  Address =	 NY,
  Annote =	 "Introduction to Computer Science for mathematically
                  minded people. Some introduction to Standard ML
                  towards the end. 34 references."
}

@InCollection{Kuehne99,
  author =	 {Thomas K\"{u}hne},
  title =	 {Internal Iteration Externalized},
  booktitle =	 {ECOOP '99 --- Object-Oriented Programming 13th
                  European Conference, Lisbon Portugal},
  publisher =	 SV,
  year =	 1999,
  editor =	 {Rachid Guerraoui},
  volume =	 1628,
  series =	 LNCS,
  address =	 NY,
  month =	 jun,
  pages =	 {329-350},
  annote =	 {38 references.}
}

@TechReport{Kulczycki-etal02,
  Author =	 {Gregory W. Kulczycki and Murali Sitaraman and
                  William F. Ogden and Bruce W. Weide and Gary T. Leavens},
  Title =	 "Reasoning about Procedure Calls with Repeated
                  Arguments and the Reference-Value Distinction",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "02-13",
  Year =	 2002,
  Month =	 dec,
  Annote =	 "Call by swapping compared with other mechanisms. 50
                  references."
}

@TechReport{Kulczycki-etal03,
  Author =	 {Gregory W. Kulczycki and Murali Sitaraman and
                  William F. Ogden and Gary T. Leavens},
  Title =	 "Reasoning about Procedure Calls with Repeated
                  Arguments and the Reference-Value Distinction",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "02-13a",
  Year =	 2003,
  Month =	 dec,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR02-13/TR.pdf",
  Annote =	 "Three approaches to avoiding aliasing due to
                  repeated arguments. 63 references."
}

@TechReport{Kulczycki-etal03a,
  Author =	 {Gregory W. Kulczycki and Murali Sitaraman and
                  William F. Ogden and Joseph E. Hollingsworth},
  Title =	 "Component Technology for Pointers: Why and How",
  Institution =	 "Department of Computer Science, Clemson University",
  Address =	 "Clemson, SC, 29634",
  Number =	 "RSRG-03-03",
  Year =	 2003,
  Month =	 apr,
  URL =
                  "http://www.cs.clemson.edu/~resolve/reports/RSRG-03-03.pdf"
}

@PhdThesis{Kulczycki04,
  author =	 {Gregory W. Kulczycki},
  title =	 {Direct Reasoning},
  school =	 {Clemson University},
  year =	 2004,
  month =	 may,
  note =	 {To appear.}
}

@Unpublished{Kung89,
  Author =	 "Chenho Kung",
  Title =	 "Process Inteface Modeling and Consistency Checking",
  Note =	 "To appear in JSS",
  Annote =	 "9 references",
  Month =	 sep,
  Year =	 1989
}

@TechReport{Ladkin89,
  Author =	 "Peter B. Ladkin",
  Title =	 "The Possibility of an Executable Specification
                  Language",
  Institution =	 "International Computer Science Institute",
  Address =	 "1947 Center St., Suite 600, Berkeley, Calif. 94704",
  Number =	 "TR-89-040",
  Month =	 jul,
  Year =	 1989,
  Annote =	 "40 references."
}

@InProceedings{Lahiri-Qadeer06,
  author =    {Shuvendu K. Lahiri and Shaz Qadeer},
  title =     {Verifying properties of well-founded linked lists},
  booktitle = {Proceedings of the 33rd ACM SIGPLAN-SIGACT Symposium on
                  Principles of Programming Languages, POPL 2006},
  publisher = {ACM},
  address =   NY,
  month =     jan,
  year =      2006,
  pages =     {115-126},
  URL = {http://doi.acm.org/10.1145/1111037.1111048}
}

@Article{Lakhneche-Hooman95,
  title =	 "Metric temporal logic with durations",
  author =	 "Yassine Lakhneche and Josez Hooman",
  journal =	 "Theoretical Computer Science",
  pages =	 "169--199",
  month =	 "6~" # feb,
  year =	 "1995",
  volume =	 "138",
  number =	 "1"
}

@inproceedings{Lam-Rinard03,
	Author = {Patrick Lam and Martin Rinard},
	Title = {A Type System and Analysis for the Automatic Extraction and Enforcement of Design Information},
	Crossref = {ecoop03},
	Pages = {273-302}
}

@Article{Lamb90,
  Author =	 "D. A. Lamb",
  Title =	 "Specification of Iterators",
  Journal =	 IEEETSE,
  Year =	 1990,
  Volume =	 16,
  Number =	 12,
  Month =	 dec,
  Pages =	 "1352-1360",
  Annote =	 "9 references."
}

@InProceedings{Lamping-Abadi94,
  author =	 "John Lamping and Mart{\'i}n Abadi",
  editor =	 "M. Tokoro and R. Pareschi",
  title =	 "Methods as Assertions",
  booktitle =	 "Proceedings ECOOP '94",
  series =	 "LNCS 821",
  pages =	 "60--80",
  publisher =	 SV,
  address =	 "Bologna, Italy",
  month =	 jul,
  year =	 "1994",
  keywords =	 "olit ecoop94"
}

@Article{Lamping-Abadi95,
  author =	 {John Lamping and Mart{\'i}n Abadi},
  title =	 {Methods as Assertions},
  journal =	 {Theory and Practice of Object Systems},
  year =	 1995,
  volume =	 1,
  number =	 1,
  pages =	 {5-18},
  annote =	 {18 references.}
}

@Article{Lamping93,
  Author =	 "John Lamping",
  Title =	 "Typing the Specialization Interface",
  Journal =	 SIGPLAN,
  Volume =	 28,
  Number =	 10,
  Month =	 oct,
  Year =	 1993,
  Pages =	 "201-214",
  Note =	 "{\em OOPSLA '93 Proceedings}, Andreas Paepcke
                  (editor).",
  Annote =	 "12 refrences."
}

@InCollection{Lamping94,
  Author =	 "John Lamping",
  Title =	 "Methods as Assertions",
  BookTitle =	 "Object-Oriented Programming 8th European Conference,
                  ECOOP '94 Bologna, Italy, Proceedings",
  Publisher =	 SV,
  Year =	 1994,
  Editor =	 "Mario Tokoro and Remo Pareschi",
  Series =	 LNCS,
  Volume =	 821,
  Pages =	 "60-80",
  Address =	 NY,
  Month =	 jul,
  Annote =	 "18 references."
}

@Article{Lamport90,
  Author =	 "Leslie Lamport",
  Title =	 "{\em win\/} and {\em sin\/}: Predicate Transformers
                  for Concurrency",
  Journal =	 TOPLAS,
  Volume =	 12,
  Number =	 3,
  Month =	 jul,
  Year =	 1990,
  Pages =	 "306-428",
  Annote =	 "Weakest invariant and strongest invariant
                  transformers for reasoning about concurrent programs
                  for which the grain of atomicity is unspecified. 14
                  references."
}

@TechReport{Lamport91,
  Author =	 "Leslie Lamport",
  Title =	 "The Temporal Logic of Actions",
  Institution =	 DECSRC,
  Year =	 1991,
  Number =	 79,
  Month =	 dec,
  Address =	 "130 Lytton Avenue Palo Alto, CA 94301",
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "A logic for specifying and reasoning about
                  concurrent systems. 23 references."
}

@Article{Lamport94,
  Author =	 "Leslie Lamport",
  Title =	 "The Temporal Logic of Actions",
  Journal =	 TOPLAS,
  Year =	 1994,
  Volume =	 16,
  Number =	 3,
  Month =	 may,
  Pages =	 "872-923",
  Annote =	 "34 references."
}

@InProceedings{Landi-Ryder91,
  Author =	 "William Landi and Barbara G. Ryder",
  Title =	 "Pointer-induced Aliasing: A Problem Classification",
  BookTitle =	 "Conference Record of the Eighteenth Annual ACM
                  Symposium on Principles of Programming Languages,
                  Orlando",
  Organization = ACM,
  Month =	 jan,
  Year =	 1991,
  Pages =	 "93-103",
  Annote =	 "22 references."
}

@InCollection{Langmaack83,
  author =	 {H. Langmaack},
  title =	 {Aspects of Programs with Finite Modes},
  booktitle =	 {Foundations of Computation Theory},
  publisher =	 SV,
  year =	 1983,
  editor =	 {M. Karpinski},
  number =	 158,
  series =	 LNCS,
  address =	 NY,
  pages =	 {241-254},
  annote =	 {Discusses transforming a program with side-effects
                  in expressions to one in which only simple side
                  effect statements are used (no nested expressions).}
}

@InCollection{Langmaack85,
  Author =	 "H. Langmaack",
  Title =	 "A New Transformational Approach to Partial
                  Correctness Proof Calculi for Algol 68-like Programs
                  with Finite Modes and Simple Side Effects",
  BookTitle =	 "Topics in the Theory of Computation",
  Editor =	 "Marek Karpinski and Jan van Leeuwen",
  Publisher =	 "Elsevier North-Holland, Inc.",
  Series =	 "Annals of Discrete Mathematics",
  Number =	 24,
  Address =	 NY,
  Year =	 1985,
  Pages =	 "73-102",
  Annote =	 "20 references."
}

@InCollection{Lano-Haughton92,
  Author =	 "K. Lano and H. Haughton",
  Title =	 "Reasoning and Refinement in Object-Oriented
                  Specification Languages",
  BookTitle =	 "ECOOP '92, European Conference on Object-Oriented
                  Programming, Utrecht, The Netherlands",
  Publisher =	 SV,
  Year =	 1992,
  Editor =	 "Ole Lehrmann Madsen",
  Series =	 LNCS,
  Address =	 NY,
  Volume =	 615,
  Pages =	 "78-97",
  Annote =	 "32 references"
}

@InCollection{Lano-Haughton94b,
  author =	 "K. Lano and H. Haughton",
  title =	 "Specifying a Concept-recognition system in {Z++}",
  booktitle =	 "Object-Oriented Specification Case Studies",
  publisher =	 "Prentice-Hall",
  year =	 1994,
  editor =	 "Kevin Lano and Howard Haughton",
  series =	 "The Object-Oriented Series",
  chapter =	 7,
  Crossref =	 "Lano-Haughton94",
  pages =	 "137-157",
  address =	 NY
}

@InCollection{Lano-etal00,
  Author =	 "Kevin Lano and Juan Bicarregui and Tom Maibaum and
                  Jose Fiadeiro",
  Title =	 "Composition of Reactive System Components",
  BookTitle =	 {Foundations of Component-Based Systems},
  Editor =	 {Gary T. Leavens and Murali Sitaraman},
  Year =	 2000,
  Publisher =	 {Cambridge University Press},
  Address =	 NY,
  ISBN =	 {0-521-77164-1},
  Chapter =	 12,
  Pages =	 "267-283",
  Annote =	 "15 references."
}

@InCollection{Lano92,
  Author =	 "Kevin C. Lano",
  Title =	 "{Z++}",
  Editor =	 "Susan Stepney and Rosalind Barden and David Cooper",
  BookTitle =	 "Object Orientation in {Z}",
  Publisher =	 SV,
  Year =	 1992,
  Address =	 "Cambridge CB2 1LQ, UK",
  Series =	 "Workshops in Computing",
  Crossref =	 "Stepney-Barden-Cooper92",
  Pages =	 "106-112"
}

@Book{Lano96,
  author =	 "Kevin Lano",
  title =	 "The {B} Language and Method: {A} guide to Practical
                  Formal Development",
  publisher =	 SV,
  address =	 "London, UK",
  year =	 "1996",
  Series =	 "Formal Appoaches to Computing and Information
                  Technology",
  ISBN =	 "3-540-76033-4",
  annote =	 "{B} is a formal approach to software specification
                  and development based on the {Z} specification
                  language. 66 references.",
}

@Article{Lano96b,
  author =	 {Kevin Lano},
  title =	 {Enhancing Object-Oriented Methods with Formal
                  Notations},
  journal =	 TAPOS,
  year =	 1996,
  volume =	 2,
  number =	 4,
  pages =	 {247-268},
  annote =	 {31 references.}
}

@InCollection{Laorakpong-Saeki93,
  Author =	 "Amarit Laorakpong and Motoshi Saeki",
  Title =	 "Object-Oriented Formal Specification Development
                  using VDM",
  BookTitle =	 "Object Technologies for Advanced Software",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Shojiro Nishio and Akinori Yonezawa",
  Series =	 LNCS,
  Volume =	 742,
  Pages =	 "529-543",
  Month =	 aug,
  Annote =	 "26 references."
}

@Book{Laplante04,
  author =	 {Phillip A. Laplante},
  title = 	 {Real-Time Systems Design and Analysis},
  publisher = 	 {IEEE Press and Wiley-Interscience},
  year = 	 2004,
  edition =	 {Third edition},
  annote =	 {Many references.}
}

@TechReport{Laprie90,
  author =	"{J.C. Laprie}",
  title =	"Dependability: Basic Concepts and Associated Terminology",
  institution =  "PDCS",
  month =	may,
  number =	31,
  year = 	1990
}

@Book{Larman02,
  author =	 {Craig Larman},
  title =	 {Applying {UML} and Patterns: An Introduction to
                  Object-Oriented Analysis and Design and the Unified
                  Process},
  publisher =	 {Prentice Hall PTR},
  year =	 2002,
  edition =	 {Second edition},
  address =	 {Upper Saddle River, NJ},
  annote =	 {19 recommended readings.}
}

@Book{Larman05,
  author =	 {Craig Larman},
  title =	 {Applying {UML} and Patterns: An Introduction to
                  Object-Oriented Analysis and Design and Iterative Development},
  publisher =	 {Prentice Hall PTR},
  year =	 2002,
  edition =	 {Third edition},
  address =	 {Upper Saddle River, NJ},
  annote =	 {Several refrences.}
}

@Book{Larman98,
  author =	 {Craig Larman},
  title =	 {Applying UML and Patterns},
  publisher =	 {Prentice Hall PTR},
  year =	 1998,
  address =	 {Upper Saddle River, NJ},
  annote =	 {19 recommended readings.}
}

@InProceedings{Larochelle-etal03,
  author = 	 {David Larochelle and Karl Scheidt and Kevin Sullivan and Yuan Wei and Joel Winstead and Anthony Wood},
  title = 	 {Join Point Encapsulation},
  booktitle =	 {SPLAT '03},
  year =	 2003,
  month =	 mar,
  note =	 {\url{http://tinyurl.com/26onl4}}
}

@InProceedings{Larraz-etal13,
author="Daniel Larraz and Enric Rodr{\'i}guez-Carbonell and Albert Rubio",
editor="Roberto Giacobazzi and Josh Berdine and Isabella Mastroeni",
title="{SMT-Based} Array Invariant Generation",
booktitle="Verification, Model Checking, and Abstract Interpretation",
year="2013",
publisher="Springer Berlin Heidelberg",
address="Berlin, Heidelberg",
pages="169--188",
abstract="This paper presents a constraint-based method for generating universally quantified loop invariants over array and scalar variables. Constraints are solved by means of an SMT solver, thus leveraging recent advances in SMT solving for the theory of non-linear arithmetic. The method has been implemented in a prototype program analyzer, and a wide sample of examples illustrating its power is shown.",
isbn="978-3-642-35873-9"
}

@Article{Larsen-Fitzgerald-Brookes96,
  author =	 "Peter Gorm Larsen and John Fitzgerald and Tom
                  Brookes",
  title =	 "Applying Formal Specification in Industry",
  journal =	 "IEEE Software",
  year =	 1996,
  volume =	 13,
  number =	 3,
  pages =	 "48-56",
  month =	 may,
  annote =	 "A case-study using VDM-SL. No significant cost or
                  time overhead, helped improve understanding,
                  preventing errors, allows gradual integration, most
                  benefits are in early development stages, formal
                  techniques usable after 1 week training if experts
                  available, need industrial-strength tools. 15
                  references."
}

@article{Larsen-Pettersson-Yi97,
  author = 	 {Kim G.\ Larsen and Paul Pettersson and Wang Yi},
  title = 	 {{{\sc Uppaal}\ in a Nutshell}},
  journal = 	 {Int.\ Journal on Software Tools for Technology Transfer},
  publisher =    SV,
  address =      "Berlin",
  volume =       1,
  number =       {1-2},
  pages =        {134-152},
  month =        Oct,
  year = 	 1997
}

@Article{Larsen-Plat-Toetenel94,
  author =	 "Peter Gorm Larsen and Nico Plat and Hans Toetenel",
  title =	 "A Formal Semantics of Data Flow Diagrams",
  journal =	 "Formal aspects of Computing",
  year =	 1994,
  volume =	 6,
  number =	 6,
  pages =	 "586-606",
  month =	 dec
}

@InProceedings{Larsen-etal91,
  Author =	 "Peter Gorm Larsen and Jan van Katwijk and Nico Plat
                  and Kees Pronk and Hans Toetenel",
  Title =	 "{SVDM}: {A}n integrated combination of {SA} and
                  {VDM}",
  BookTitle =	 "Methods Integration Conference",
  Publisher =	 SV,
  Year =	 1991,
  Month =	 sep
}

@InProceedings{Larsen-etal91b,
  Author =	 "Peter Gorm Larsen and Jan van Katwijk and Nico Plat
                  and Kees Pronk and Hans Toetenel",
  Title =	 "Towards an Integrated Combination of {SA} and {VDM}",
  Booktitle =	 "Structured Analysis and Formal Methods",
  Year =	 1991,
  Month =	 jun,
  Note =	 "ftp://ftp.ifad.dk/pub/papers/savdm.ps.gz"
}

@InProceedings{Larsson-Alexandersson05,
  author = 	 {Daniel Larsson and Ruben Alexandersson},
  title = 	 {Formal Verification of Fault Tolerance Aspects},
  booktitle =	 {ISSRE 2005 Supplementary Proceedings},
  pages =	 {4-17--4-18},
  year =	 2005
}

@InProceedings{Larsson-Mostowski03,
  author = 	 {Daniel Larsson and Wojciech Mostowski},
  title = 	 {Specifying {Java Card API} in {OCL}},
  booktitle =	 {OCL 2.0 Workshop at UML 2003},
  pages =	 {3-19},
  year =	 2004,
  editor =	 {Peter H. Schmitt},
  volume =	 {102C},
  series =	 ENTCS,
  month =	 nov,
  publisher =	 {Elsevier},
  URL =          {http://www.cs.chalmers.se/~danla/ocl2003.pdf},
  annote =       {20 references.}
}

@Article{Larus-etal04,
  author =	{James R. Larus and Thomas Ball and Manuvir Das and
                 Robert DeLine and Manuel F\"{a}hndrich and 
                 Jon Pincus and Sriram K. Rajamani and Ramanathan Venkatapathy},
  title =	"Righting Software",
  journal =	"IEEE Software",
  volume =	"21",
  year = 	"2004",
  pages =       "92-100"
}

@TechReport{Lau-Prestwich88,
  Author =	 "K. K. Lau and S. D. Prestwich",
  Title =	 "Synthesis of Recursive Logic Procedures by Top-down
                  Folding",
  Institution =	 "Department of Computer Science, University of
                  Manchester",
  Address =	 "Manchester M13 9PL, England",
  Number =	 "UMCS-88-2-1",
  Year =	 1988,
  Annote =	 "13 references."
}

@InProceedings{Lauer-Satterthwaite79,
  Title =	 "The Impact of Mesa on System Design",
  Author =	 "H. C. Lauer and E. H. Satterthwaite",
  BookTitle =	 "Fourth International Conference on Software
                  Engineering",
  Organization = IEEE,
  Year =	 1979,
  Pages =	 "174-181"
}

@InProceedings{Le-etal16,
  title={Enhancing automated program repair with deductive verification},
  author={Xuan-Bach D. Le and Quang Loc Le and David Lo and Claire Le Goues},
  booktitle={2016 IEEE International Conference on Software Maintenance and Evolution (ICSME)},
  pages={428--432},
  year=2016,
  organization={IEEE}
}

@article{LeGoues-Pradel-Roychoudhury19,
  title={Automated program repair},
  author={Claire Le Goues and Michael Pradel and Abhik Roychoudhury},
  journal={Communications of the ACM},
  volume={62},
  number={12},
  pages={56--65},
  year={2019},
  publisher=ACM,
  address=NY
}

@Article{LeJacq91,
  Author =	 "Jean Peirre LeJacq",
  Title =	 "Function preconditions in object oriented software",
  Journal =	 SIGPLAN,
  Year =	 1991,
  Volume =	 26,
  Number =	 10,
  Month =	 oct,
  Pages =	 "13-18",
  Annote =	 "Example of using instance operations (member
                  functions) in C++ code in assertions. The example
                  shows clearly the confusion created by using program
                  operations in assertions and then concluding
                  subtyping relationships on the basis of what seem to
                  be valid implications. 10 references."
}

@InCollection{Lea-Marlowe95,
  Author =	 "Doug Lea and Jos Marlowe",
  Title =	 "Interface-Based Protocol Specification of Open
                  Systems using {PSL}",
  Series =	 LNCS,
  Publisher =	 SV,
  Address =	 NY,
  Editor =	 "Walter Olthoff",
  Number =	 952,
  Booktitle =	 "ECOOP '95 - Object-Oriented Programming 9th European
                  Conference",
  Pages =	 "374-398",
  Year =	 1995,
  Annote =	 "68 references."
}

@Unpublished{Lea91,
  Author =	 "Doug Lea",
  Title =	 "Position paper ECOOP Object-Oriented Methods
                  Workshop",
  Note =	 "Obtained from the author",
  Annote =	 "0 references."
}

@Unpublished{Lea93,
  Author =	 "Doug Lea",
  Title =	 "Run-Time Type Information and Class Design",
  Note =	 "Obtained from the author",
  Annote =	 "6 references.",
  Year =	 1993
}

@TechReport{Leavens-Baker-Ruby01,
  Author =	 "Gary T. Leavens and Albert L. Baker and Clyde Ruby",
  Title =	 "Preliminary Design of {JML}: A Behavioral Interface
                  Specification Language for {Java}",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 2001,
  Number =	 "98-06q",
  Month =	 dec,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR98-06/TR.ps.gz",
  Annote =	 "57 references.",
  Note =         "This is an obsolete version."
}

@TechReport{Leavens-Baker-Ruby02,
  Author =	 "Gary T. Leavens and Albert L. Baker and Clyde Ruby",
  Title =	 "Preliminary Design of {JML}: A Behavioral Interface
                  Specification Language for {Java}",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 2002,
  Number =	 "98-06t",
  Month =	 jun,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR98-06/TR.ps.gz",
  Annote =	 "57 references.",
  Note =         "This is an obsolete version."
}

@TechReport{Leavens-Baker-Ruby03,
  Author =	 "Gary T. Leavens and Albert L. Baker and Clyde Ruby",
  Title =	 "Preliminary Design of {JML}: A Behavioral Interface
                  Specification Language for {Java}",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 2003,
  Number =	 "98-06v",
  Month =	 may,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR98-06/TR.ps.gz",
  Annote =	 "57 references.",
  Note =         "This is an obsolete version."
}

@TechReport{Leavens-Baker-Ruby04,
  Author =	 "Gary T. Leavens and Albert L. Baker and Clyde Ruby",
  Title =	 "Preliminary Design of {JML}: A Behavioral Interface
                  Specification Language for {Java}",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 2004,
  Number =	 "98-06z",
  Month =	 dec,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR98-06/TR.ps.gz",
  Annote =	 "79 references.",
  Note =         "This is an obsolete version."
}

@TechReport{Leavens-Baker-Ruby05,
  Author =	 "Gary T. Leavens and Albert L. Baker and Clyde Ruby",
  Title =	 "Preliminary Design of {JML}: A Behavioral Interface
                  Specification Language for {Java}",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 2005,
  Number =	 "98-06-rev28",
  Month =	 jul,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR98-06/TR.ps.gz",
  Annote =	 "79 references.",
  Note =         "This is an obsolete version."
}

@Article{Leavens-Baker-Ruby06,
  Author =	 "Gary T. Leavens and Albert L. Baker and Clyde Ruby",
  Title =	 "Preliminary Design of {JML}: A Behavioral Interface Specification Language for {Java}",
  journal = SIGSOFT,
  volume = 31,
  number = 3,
  month = mar,
  year = 2006,
  pages = {1-38},
  URL = {http://doi.acm.org/10.1145/1127878.1127884},
  publisher = ACM,
  address = NY
}

@TechReport{Leavens-Baker-Ruby06a,
  Author =	 "Gary T. Leavens and Albert L. Baker and Clyde Ruby",
  Title =	 "Preliminary Design of {JML}: A Behavioral Interface
                  Specification Language for {Java}",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 2006,
  Number =	 "98-06-rev29",
  Month =	 jan,
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR98-06/TR.pdf",
  Annote =	 "79 references.",
  Note =	 "Also \emph{ACM SIGSOFT Software Engineering Notes}, 31(3):1-38, March 2006."
}

@InProceedings{Leavens-Baker-Ruby98,
  author =	 {Gary T. Leavens and Albert L. Baker and Clyde Ruby},
  title =	 {{JML}: a {Java Modeling Language}},
  booktitle =	 {Formal Underpinnings of Java Workshop (at OOPSLA
                  '98)},
  year =	 1998,
  month =	 oct,
  note =	 {{\tt
                  http://www-dse.doc.ic.ac.uk/{\char'176}sue/oopsla/cfp.html}}
}

@InCollection{Leavens-Baker-Ruby99b,
  Author =	 "Gary T. Leavens and Albert L. Baker and Clyde Ruby",
  Title =	 "{JML}: A Notation for Detailed Design",
  BookTitle =	 "Behavioral Specifications of Businesses and Systems",
  Editor =	 "Haim Kilov and Bernhard Rumpe and Ian Simmonds",
  Year =	 1999,
  Publisher =	 "Kluwer Academic Publishers",
  Address =	 "Boston",
  Pages =	 "175-188",
  Annote =	 "36 references."
}

@InProceedings{Leavens-Baker99,
  Author =	 "Gary T. Leavens and Albert L. Baker",
  Title =	 "Enhancing the Pre- and Postcondition Technique for
                  More Expressive Specifications",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  BookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1709,
  Pages =	 "1087-1106",
  URL =          "\url{http://dx.doi.org/10.1007/3-540-48118-4_8}",
  Annote =	 "37 references."
}

@TechReport{Leavens-Baker99a,
  Author =	 "Gary T. Leavens and Albert L. Baker",
  Title =	 "Enhancing the Pre- and Postcondition Technique for
                  More Expressive Specifications",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 1999,
  Number =	 "97-19b",
  Month =	 jun,
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR97-19/TR.ps.gz",
  Annote =	 "37 references.",
  Note =	 "Appears in FM'99, Springer-Verlag, LNCS volume 1709,
                  pages 1087--1106, 1999."
}

@TechReport{Leavens-Cheon-Cok05,
  Author =	 "Gary T. Leavens and Yoonsik Cheon and David R. Cok",
  Title =	 "Demonstration of {JML} Tools",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Address =	 "226 Atanasoff Hall, Ames IA 50011",
  Year =	 2005,
  Number =	 "05-13",
  Month =	 apr,
  Note =	 "Available by anonymous ftp from ftp.cs.iastate.edu.",
  URL = 	 {ftp://ftp.cs.iastate.edu/pub/techreports/TR05-13/TR.pdf},
  Annote =	 "14 references."
}

@Unpublished{Leavens-Cheon05,
  Author =	 "Gary T. Leavens and Yoonsik Cheon",
  Title =	 "Design by Contract with {JML}",
  Year =	 2005,
  Note =	 "Draft, available from jmlspecs.org.",
  URL =          "http://www.jmlspecs.org/jmldbc.pdf",
  Annote =	 "12 references."
}

@TechReport{Leavens-Cheon92a,
  Author =	 "Gary T. Leavens and Yoonsik Cheon",
  Title =	 "Preliminary Design of {Larch/C++}",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Address =	 "226 Atanasoff Hall, Ames IA 50011",
  Year =	 1992,
  Number =	 "92-16",
  Month =	 may,
  Note =	 "Presented at the First International Workshop on
                  Larch, Dedham, Mass., July, 1992. Available by
                  anonymous ftp from ftp.cs.iastate.edu or by e-mail
                  from almanac@cs.iastate.edu.",
  Annote =	 "26 references."
}

@InCollection{Leavens-Cheon92b,
  Author =	 "Gary T. Leavens and Yoonsik Cheon",
  Title =	 "Preliminary Design of {Larch/C++}",
  BookTitle =	 "Proceedings of the First International Workshop on
                  Larch, July, 1992",
  Publisher =	 SV,
  Editor =	 "U. Martin and J. Wing",
  Series =	 "Workshops in Computing",
  Pages =	 "159-184",
  Address =	 NY,
  Year =	 1993,
  Annote =	 "26 references."
}

@TechReport{Leavens-Cheon93b,
  Author =	 "Gary T. Leavens and Yoonsik Cheon",
  Title =	 "Extending {CORBA IDL} to Specify Behavior with
                  {Larch}",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 1993,
  Number =	 "93-20",
  Month =	 aug,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR93-20/TR.txt",
  Note =	 "Presented at the OOPSLA '93 Workshop:
                  ``Specification of Behavioral Semantics in OO
                  Information Modeling''. Available by anonymous ftp
                  from ftp.cs.iastate.edu or by e-mail from
                  almanac@cs.iastate.edu.",
  Annote =	 "Discusses Larch/CORBA. 6 references."
}

@TechReport{Leavens-Cheon94d,
  Author =	 "Gary T. Leavens and Yoonsik Cheon",
  Title =	 "Overview and Specification of the Built-in Types in
                  {Little Smalltalk}",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 1994,
  Number =	 "91-22a",
  Address =	 "226 Atanasoff Hall, Ames IA 50011",
  Month =	 feb,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR91-22/TR.ps.Z",
  Note =	 "Available by anonymous ftp from ftp.cs.iastate.edu,
                  and by e-mail from almanac@cs.iastate.edu."
}

@InProceedings{Leavens-Clifton05a,
  author = 	 {Gary T. Leavens and Curtis Clifton},
  title = 	 {Lessons from the {JML} Project},
  year =	 2008,
  booktitle =	 {Verified Software: Theories, Tools, Experiments, Zurich, Switzerland},
  editor =       {Bertrand Meyer and Jim Woodcock},
  publisher =    SV,
  volume =       4171,
  series =       LNCS,
  pages =        "134-143",
  URL = 	 {https://tinyurl.com/5rckhcep},
  Annote =	 "30 references."
}

@TechReport{Leavens-Clifton05b,
  author = 	 {Gary T. Leavens and Curtis Clifton},
  title = 	 {Lessons from the {JML} Project},
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "05-12a",
  Year =	 2005,
  Month =	 jul,
  Note =	 "Available by anonymous ftp from ftp.cs.iastate.edu.",
  URL = 	 {ftp://ftp.cs.iastate.edu/pub/techreports/TR05-12/TR.pdf},
  Annote =	 "30 references."
}

% DOI = {10.1007/978-3-540-69149-5_15},
@InCollection{Leavens-Dhara00,
  author =	 {Gary T. Leavens and Krishna Kishore Dhara},
  title =	 {Concepts of Behavioral Subtyping and a Sketch of
                  Their Extension to Component-Based Systems},
  booktitle =	 {Foundations of Component-Based Systems},
  publisher =	 {Cambridge University Press},
  address =      "Cambridge, UK",
  year =	 2000,
  editor =	 {Gary T. Leavens and Murali Sitaraman},
  chapter =	 6,
  pages =	 {113-135},
  URL =
                  {http://www.cs.iastate.edu/~leavens/FoCBS-book/06-leavens-dhara.pdf},
  annote =	 {A survey of behavioral subtyping. 79 references.}
}

@InProceedings{Leavens-Kiniry-Poll07,
  author = 	 {Gary T. Leavens and Joseph R. Kiniry and Erik Poll},
  title = 	 {A {JML} Tutorial: Modular Specification and Verification of Functional Behavior for {Java}},
  booktitle =	 {Computer Aided Verification 2007},
  pages =	 37,
  year =	 2007,
  editor =	 {Werner Damm and Holger Hermanns},
  volume =	 4590,
  series =	 LNCS,
  address =	 {Berlin},
  month =	 jul,
  publisher =	 SV,
  doi =          {http://dx.doi.org/10.1007/978-3-540-73368-3_6},
  annote =	 {3 references.}
}

@TechReport{Leavens-Leino-Mueller06,
  author = 	 {Gary T. Leavens and K. Rustan M. Leino and Peter M{\"u}ller},
  title = 	 {Specification and verification challenges for sequential object-oriented programs},
  institution =  {Department of Computer Science, Iowa State University},
  year = 	 2006,
  number =	 {06-14a},
  address =	 {Ames, Iowa},
  month =	 aug,
  annote =	 {122 references.},
  note =         {In {\em Formal Aspects of Computing}, 19(2):159--189.},
  URL = {ftp://ftp.cs.iastate.edu/pub/techreports/TR06-14/TR.pdf}
}

@Article{Leavens-Leino-Mueller07,
  author = 	 {Gary T. Leavens and K. Rustan M. Leino and Peter M{\"u}ller},
  title = 	 {Specification and verification challenges for sequential object-oriented programs},
  journal =      FAC,
  volume =       19,
  number =       2,
  pages =        {159-189},
  month =        jun,
  year = 	 2007,
  publisher =    SV,
  annote =	 {122 references.},
  URL = {http://dx.doi.org/10.1007/s00165-007-0026-7}
}

@TechReport{Leavens-Mueller06,
  author = 	 {Gary T. Leavens and Peter M{\"u}ller},
  title = 	 {Information Hiding and Visibility in Interface Specifications},
  institution =  {Department of Computer Science, Iowa State University},
  year = 	 2006,
  number =	 {06-28},
  address =	 {Ames, Iowa},
  month =	 sep,
  annote =	 {32 references},
  note =         {In ICSE 2007, pages 385-395.},
  URL = {ftp://ftp.cs.iastate.edu/pub/techreports/TR06-28/TR.pdf}
}

@InProceedings{Leavens-Mueller07,
  author = 	 {Gary T. Leavens and Peter M{\"u}ller},
  title = 	 {Information Hiding and Visibility in Interface Specifications},
  booktitle =	 {International Conference on Software Engineering (ICSE)},
  pages =	 {385-395},
  year =	 2007,
  month =	 may,
  publisher =    IEEE,
  address =      {Los Alamitos, California},
  annote =	 {32 references.},
  URL =          {http://dx.doi.org/10.1109/ICSE.2007.44}
}

@TechReport{Leavens-Naumann-Rosenberg06,
  author = 	 {Gary T. Leavens and David A. Naumann and Stan Rosenberg},
  title = 	 {Preliminary Definition of {Core JML}},
  Institution =	 "Stevens Institute of Technology",
  type =         "CS Report",
  number =	 "2006-07",
  year = 	 2006,
  month =	 sep,
  annote =	 {11 references.},
  URL =          {http://www.cs.stevens.edu/~naumann/publications/SIT-TR-2006-07.pdf}
}

@TechReport{Leavens-Naumann06,
  author = 	 {Gary T. Leavens and David A. Naumann},
  title = 	 {Behavioral Subtyping, Specification Inheritance, and Modular Reasoning},
  Institution =	 "Department of Computer Science, Iowa State University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "06-20b",
  year = 	 2006,
  month =	 sep,
  annote =	 {50 references.},
  URL =          {ftp://ftp.cs.iastate.edu/pub/techreports/TR06-20/TR.pdf}
}

@TechReport{Leavens-Naumann06a,
  author = 	 {Gary T. Leavens and David A. Naumann},
  title = 	 {Behavioral Subtyping is Equivalent to Modular Reasoning for Object-oriented Programs},
  Institution =	 "Department of Computer Science, Iowa State University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "06-36",
  year = 	 2006,
  month =	 dec,
  annote =	 {68 references.},
  URL =          {ftp://ftp.cs.iastate.edu/pub/techreports/TR06-36/TR.pdf}
}

@TechReport{Leavens-Naumann13,
  author = 	 {Gary T. Leavens and David A. Naumann},
  title = 	 {Behavioral Subtyping, Specification Inheritance, and Modular Reasoning},
  Institution =	 "Computer Science, University of Central Florida",
  Address =	 "Orlando, FL, 32816",
  Number =	 "CS-TR-13-03",
  year = 	 2013,
  month =	 jun,
  annote =	 {81 references.},
  URL =          {http://www.eecs.ucf.edu/~leavens/tech-reports/UCF/CS-TR-13-03/TR.pdf}
}

@article{Leavens-Naumann15,
 author = {Gary T. Leavens and David A. Naumann},
 title = {Behavioral Subtyping, Specification Inheritance, and Modular Reasoning},
 journal = {TOPLAS},
 volume = 37,
 number = 4,
 month = aug,
 year = 2015,
 pages = {13:1--13:88},
 articleno = 13,
 numpages = 88,
 url = {http://doi.acm.org/10.1145/2766446},
 doi = {10.1145/2766446},
 publisher = {ACM},
 address = NY,
 annote = {85 references.}
}

@InProceedings{Leavens-Naumann18,
author="Gary T. Leavens and David A. Naumann",
editor="Jonathan P. Bowen and Zhiming Liu and Zili Zhang",
title="An Illustrated Guide to the Model Theory of Supertype Abstraction and Behavioral Subtyping",
booktitle="Engineering Trustworthy Software Systems",
year="2018",
publisher="Springer International Publishing",
address="Cham",
pages="39--88",
isbn="978-3-030-02928-9"
}

@Article{Leavens-Nierstrasz-Sitaraman98,
  author =	 {Gary T. Leavens and Oscar Nierstrasz and Murali
                  Sitaraman},
  title =	 {1997 Workshop on Foundations of Component-Based
                  Systems},
  year =	 1998,
  month =	 jan,
  journal =	 SIGSOFT,
  volume =	 23,
  number =	 1,
  pages =	 "38-41",
  annote =	 "8 references."
}

@Article{Leavens-Pigozzi00,
  Author =	 "Gary T. Leavens and Don Pigozzi",
  Title =	 "A Complete Algebraic Characterization of Behavioral
                  Subtyping",
  Journal =	 "Acta Informatica",
  Year =	 2000,
  Volume =	 36,
  number =       8,
  month =        mar,
  Pages =	 "617-663",
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR96-15/TR.ps.gz",
  Annote =	 "27 references.",
  doi = {http://dx.doi.org/10.1007/s002360050168}
} 

@TechReport{Leavens-Pigozzi02,
  Author =	 "Gary T. Leavens and Don Pigozzi",
  Title =	 "Equational Reasoning with Subtypes",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Year =	 2002,
  Number =	 "02-07",
  Address =	 "Ames, Iowa, 50011",
  Month =	 jul,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR02-07/TR.ps.gz",
  Annote =	 "38 references."
}

@TechReport{Leavens-Pigozzi91,
  Author =	 "Gary T. Leavens and Don Pigozzi",
  Title =	 "Typed Homomorphic Relations Extended with Subtypes",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Year =	 1991,
  Number =	 "91-14",
  Address =	 "Ames, Iowa, 50011",
  Month =	 jun,
  Note =	 "Appears in the proceedings of {\em Mathematical
                  Foundations of Programming Semantics '91},
                  Springer-Verlag, Lecture Notes in Computer Science,
                  volume 598, pages 144-167, 1992.",
  Annote =	 "17 references."
}

@InCollection{Leavens-Pigozzi92,
  Author =	 "Gary T. Leavens and Don Pigozzi",
  Title =	 "Typed Homomorphic Relations Extended with Subtypes",
  BookTitle =	 "Mathematical Foundations of Programming Semantics
                  '91",
  Publisher =	 SV,
  Year =	 1992,
  Editor =	 "Stephen Brookes",
  Series =	 LNCS,
  Volume =	 598,
  Pages =	 "144-167",
  Address =	 NY,
  Annote =	 "17 references.",
  URL =          "\url{http://dx.doi.org/10.1007/3-540-55511-0_7}"
}

@TechReport{Leavens-Pigozzi96a,
  Author =	 "Gary T. Leavens and Don Pigozzi",
  Title =	 "The Behavior-Realization Adjunction and Generalized
                  Homomorphic Relations",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "94-18b",
  Month =	 jul,
  Year =	 1996,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR94-18/TR.ps.Z",
  Note =	 "Appears in {\it Theoretical Computer Science},
                  177:183-216, 1977."
}

@TechReport{Leavens-Pigozzi96b,
  Author =	 "Gary T. Leavens and Don Pigozzi",
  Title =	 "An Exact Algebraic Characterization of Behavioral
                  Subtyping",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "96-15",
  Month =	 nov,
  Year =	 1996,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR96-15/TR.ps.Z",
  Note =	 "Available by anonymous ftp from
                  \url{ftp.cs.iastate.edu}, and by e-mail from
                  almanac@cs.iastate.edu"
}

@Article{Leavens-Pigozzi97,
  Author =	 "Gary T. Leavens and Don Pigozzi",
  Title =	 "The behavior-realization adjunction and generalized
                  homomorphic relations",
  Journal =	 TCS,
  Volume =	 177,
  Year =	 1997,
  Pages =	 "183-216",
  URL =          "http://dx.doi.org/10.1016/S0304-3975(97)87172-1",
  Annote =	 "25 references."
}

@TechReport{Leavens-Pigozzi99a,
  Author =	 "Gary T. Leavens and Don Pigozzi",
  Title =	 "A Complete Algebraic Characterization of Behavioral Subtyping",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "96-15a",
  Month =	 nov,
  Year =	 1999,
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR96-15/TR.ps.gz",
  Note =	 "In {\em Acta Informatica}, 36:617-663, 2000."
}

@TechReport{Leavens-Ruby97,
  Author =	 "Gary T. Leavens and Clyde Ruby",
  Title =	 "Specification Facets for More Precise, Focused
                  Documentation",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "97-04",
  Month =	 jan,
  Year =	 1997,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR97-04/TR.ps.gz",
  Note =	 "Available by anonymous ftp from
                  \url{ftp.cs.iastate.edu}, and by e-mail from
                  almanac@cs.iastate.edu"
}

@Book{Leavens-Sitaraman00,
  title =	 {Foundations of Component-Based Systems},
  year =	 2000,
  editor =	 {Gary T. Leavens and Murali Sitaraman},
  publisher =	 {Cambridge University Press},
  address =	 NY,
  ISBN =	 {0-521-77164-1}
}

@Proceedings{Leavens-Sitaraman97,
  title =	 {Foundations of Component-Based Systems Workshop},
  year =	 1997,
  editor =	 {Gary T. Leavens and Murali Sitaraman},
  month =	 sep,
  note =	 {Available from
                  \url{http://www.cs.iastate.edu/~leavens/FoCBS}.}
}

@TechReport{Leavens-Wahls-Baker96,
  Author =	 "Gary T. Leavens and Tim Wahls and Albert L. Baker",
  Title =	 "Formal Semantics for Structured Analysis Style Data
                  Flow Diagram Specification Languages",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 1996,
  Number =	 "96-16",
  Month =	 dec,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR96-16/TR.ps.Z",
  Note =	 "Available by anonymous ftp from
                  \url{ftp.cs.iastate.edu} or by e-mail from
                  almanac@cs.iastate.edu.",
  Annote =	 "47 references."
}

@InProceedings{Leavens-Wahls-Baker99,
  author =	 {Gary T. Leavens and Tim Wahls and Albert L. Baker},
  title =	 {Formal Semantics for SA Style Data Flow Diagram Specification Languages},
  booktitle =	 {ACM SAC'99 -- 1999 ACM Symposium on Applied
                  Computing, San Antonio, Texas},
  year =	 1999,
  organization = ACM,
  pages =	 {526-532},
  URL =          "http://doi.acm.org/10.1145/298151.298433",
}

@InProceedings{Leavens-Weihl90,
  Author =	 "Gary T. Leavens and William E. Weihl",
  Title =	 "Reasoning about Object-oriented Programs that use
                  Subtypes (extended abstract)",
  BookTitle =	 "{OOPSLA ECOOP '90 Proceedings}",
  Editor =	 "N. Meyrowitz",
  Series =	 SIGPLAN,
  Volume =	 "25(10)",
  Month =	 oct,
  Year =	 1990,
  Pages =	 "212-223",
  Organization = ACM,
  Annote =	 "26 references.",
  URL =          "http://doi.acm.org/10.1145/97945.97970"
}

@TechReport{Leavens-Weihl93,
  Author =	 "Gary T. Leavens and William E. Weihl",
  Title =	 "Subtyping, Modular Specification, and Modular
                  Verification for Applicative Object-Oriented
                  Programs",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "92-28d",
  Month =	 aug,
  Year =	 1994,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR92-28/TR.ps.Z",
  Note =	 "Full version of a paper in {\em Acta Informatica},
                  volume 32, number 8, pages 705--778. Available by
                  anonymous ftp from \url{ftp.cs.iastate.edu}, and by
                  e-mail from almanac@cs.iastate.edu",
  Annote =	 "The journal version of the first author's thesis."
}

@Article{Leavens-Weihl95,
  author =	 {Gary T. Leavens and William E. Weihl},
  title =	 {Specification and Verification of Object-Oriented
                  Programs Using Supertype Abstraction},
  journal =	 {Acta Informatica},
  year =	 1995,
  volume =	 32,
  number =	 8,
  month =	 nov,
  pages =	 {705-778},
  URL =          {http://dx.doi.org/10.1007/BF01178658}
}

@TechReport{Leavens-Wing97,
  Author =	 "Gary T. Leavens and Jeannette M. Wing",
  Title =	 "Protective Interface Specifications",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 1997,
  Number =	 "96-04d",
  Month =	 sep,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR96-04/TR.ps.gz",
  Note =	 "In Michel Bidoit and Max Dauchet (editors), TAPSOFT
                  '97: Theory and Practice of Software Development,
                  7th International Joint Conference CAAP/FASE, Lille,
                  France. Volume 1214 of Lecture Notes in Computer
                  Science, Springer-Verlag, 1997, pages
                  520-534. Available by anonymous ftp from
                  \url{ftp.cs.iastate.edu}.",
  Annote =	 "29 references."
}

@InCollection{Leavens-Wing97a,
  Author =	 "Gary T. Leavens and Jeannette M. Wing",
  Title =	 "Protective Interface Specifications",
  BookTitle =	 "{TAPSOFT '97}: Theory and Practice of Software
                  Development, 7th International Joint Conference
                  {CAAP/FASE}, Lille, France",
  Publisher =	 SV,
  Year =	 1997,
  Editor =	 "Michel Bidoit and Max Dauchet",
  Series =	 LNCS,
  Volume =	 1214,
  Pages =	 "520-534",
  Address =	 NY,
  Annote =	 "29 references.",
  URL =          "http://dx.doi.org/10.1007/BFb0030623"
}

@Article{Leavens-Wing98,
  author =	 {Gary T. Leavens and Jeannette M. Wing},
  title =	 {Protective Interface Specifications},
  journal =	 {Formal Aspects of Computing},
  year =	 1998,
  volume =	 10,
  number =       1,
  month =        jan,
  pages =	 {59-75},
  annote =	 {30 references.},
  url =          {http://dx.doi.org/10.1007/PL00003926}
}

@InProceedings{Leavens-etal00,
  Author =	 "Gary T. Leavens and K. Rustan M. Leino and Erik Poll
                  and Clyde Ruby and Bart Jacobs",
  Title =	 "{JML}: notations and tools supporting detailed
                  design in {Java}",
  BookTitle =	 "OOPSLA 2000 Companion, Minneapolis, Minnesota",
  Year =	 2000,
  Month =	 oct,
  Pages =	 "105-106",
  Organization = ACM,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR00-15/TR.ps.gz",
  Annote =	 "Abstract of an OOPSLA 2000 poster. 14 references."
}

@TechReport{Leavens-etal00a,
  Author =	 "Gary T. Leavens and K. Rustan M. Leino and Erik Poll
                  and Clyde Ruby and Bart Jacobs",
  Title =	 "{JML}: notations and tools supporting detailed
                  design in {Java}",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 2000,
  Number =	 "00-15",
  Month =	 aug,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR00-15/TR.ps.gz",
  Note =	 "Appears in OOPSLA '00 Companion, pp. 105--106",
  Annote =	 "Abstract of an OOPSLA 2000 poster. 14 references."
}

@InProceedings{Leavens-etal01,
  author =	 {Gary T. Leavens and Sophia Drossopoulou and Susan
                  Eisenbach and Arnd Poetzsch-Heffter and Erik Poll},
  title =	 {Formal Techniques for {J}ava Programs},
  booktitle =	 {Object-Oriented Technology. {ECOOP} 2001 Workshop
                  Reader},
  year =	 2001,
  editor =	 {A. Frohner},
  series =	 LNCS,
  volume =	 2323,
  publisher =	 SV,
  pages =	 {30-40}
}

@Unpublished{Leavens-etal03,
  Author =	 {Gary T. Leavens and Erik Poll and Curtis Clifton and
                  Yoonsik Cheon and Clyde Ruby and David R. Cok and
                  Joseph Kiniry},
  Title =	 {JML Reference Manual},
  Month =	 apr,
  Year =	 2003,
  Note =	 {Department of Computer Science, Iowa State
                  University. Available from
                  {\url{http://www.jmlspecs.org}}}
}

@InCollection{Leavens-etal03a,
  Author =	 {Gary T. Leavens and Yoonsik Cheon and Curtis Clifton
                  and Clyde Ruby and David R. Cok},
  Title =	 {How the Design of {JML} Accommodates Both Runtime
                  Assertion Checking and Formal Verification},
  BookTitle =	 {Formal Methods for Components and Objects: First
                  International Symposium, FMCO 2002, Lieden, The
                  Netherlands, November 2002, Revised Lectures},
  Year =	 2003,
  Editor =	 {Frank S. de Boer and Marcello M. Bonsangue and
                  Susanne Graf and Willem-Paul de Roever},
  Series =	 LNCS,
  Volume =	 2852,
  Publisher =	 SV,
  Pages =        "262-284",
  Address =	 "Berlin",
  URL =          "http://dx.doi.org/10.1007/b14033",
  Annote =	 "81 references."
}

@TechReport{Leavens-etal03b,
  Author =	 {Gary T. Leavens and Yoonsik Cheon and Curtis Clifton
                  and Clyde Ruby and David R. Cok},
  Title =	 {How the Design of {JML} Accommodates Both Runtime
                  Assertion Checking and Formal Verification},
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Year =	 2003,
  Number =	 "03-04",
  Address =	 "Ames, Iowa, 50011",
  Month =	 mar,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR03-04/TR.pdf",
  Note =	 "To appear in {\it Science of Computer Programming}, 2005.
                  An earlier version was published in FMCO 2002 
                  proceedings, LNCS 2852, 2003.",
  Annote =	 "81 references."
}

@Unpublished{Leavens-etal04a,
  Author =	 {Gary T. Leavens and Erik Poll and Curtis Clifton and
                  Yoonsik Cheon and Clyde Ruby and David R. Cok and
                  Joseph Kiniry},
  Title =	 {JML Reference Manual},
  Month =	 dec,
  Year =	 2004,
  Note =	 {Department of Computer Science, Iowa State
                  University. Available from
                  {\url{http://www.jmlspecs.org}}}
}

@Article{Leavens-etal05,
  Author =	 {Gary T. Leavens and Yoonsik Cheon and Curtis Clifton
                  and Clyde Ruby and David R. Cok},
  Title =	 {How the Design of {JML} Accommodates Both Runtime
                  Assertion Checking and Formal Verification},
  Journal =	 {Science of Computer Programming},
  Year =	 2005,
  Month =        mar,
  Volume =       55,
  Number =       {1-3},
  Publisher =	 {Elsevier},
  Pages =        {185-208},
  URL =          {http://dx.doi.org/10.1016/j.scico.2004.05.015}
}

@Unpublished{Leavens-etal05a,
  Author =	 {Gary T. Leavens and Erik Poll and Curtis Clifton and
                  Yoonsik Cheon and Clyde Ruby and David R. Cok and
                  Peter M\"{u}ller and Joseph Kiniry},
  Title =	 {{JML} Reference Manual},
  Month =	 jul,
  Year =	 2005,
  Note =	 {Department of Computer Science, Iowa State
                  University. Available from
                  {\url{http://www.jmlspecs.org}}}
}

@Unpublished{Leavens-etal06,
  Author =	 {Gary T. Leavens and Erik Poll and Curtis Clifton and
                  Yoonsik Cheon and Clyde Ruby and David R. Cok and
                  Peter M\"{u}ller and Joseph Kiniry and Patrice Chalin},
  Title =	 {{JML} Reference Manual},
  Month =	 aug,
  Year =	 2006,
  Note =	 {Department of Computer Science, Iowa State
                  University. Available from
                  {\url{http://www.jmlspecs.org}}}
}

@InProceedings{Leavens-etal06a,
  author = 	 {Gary T. Leavens and Jean-Raymond Abrial and Don Batory and Michael Butler and
Alessandro Coglio and Kathi Fisler and Eric Hehner and Cliff Jones and Dale Miller and
Simon Peyton-Jones and Murali Sitaraman and Douglas R. Smith and Aaron Stump},
  title = 	 {Roadmap for Enhanced Languages and Methods to Aid Verification},
  booktitle =	 {Fifth International Conference on Generative Programming and Component Engineering (GPCE)},
  pages =	 {221-235},
  year =	 2006,
  month =	 oct,
  organization = ACM,
  URL = {http://doi.acm.org/10.1145/1173706.1173740},
  annote =	 {A VSTTE committee roadmap. 146 references.}
}

@TechReport{Leavens-etal06b,
  author = 	 {Gary T. Leavens and Jean-Raymond Abrial and Don Batory and Michael Butler and
Alessandro Coglio and Kathi Fisler and Eric Hehner and Cliff Jones and Dale Miller and
Simon Peyton-Jones and Murali Sitaraman and Douglas R. Smith and Aaron Stump},
  title = 	 {Roadmap for Enhanced Languages and Methods to Aid Verification},
  institution =  {Iowa State University, Department of Computer Science},
  year = 	 2006,
  number =	 {06-21},
  address =	 {Ames, IA},
  month =	 jul,
  annote =	 {A VSTTE committee roadmap. 146 references.},
  note =         {In Proceedings of {\em GPCE'06}, pages 221--235.},
  URL =          {ftp://ftp.cs.iastate.edu/pub/techreports/TR06-21/TR.pdf}
}

@Unpublished{Leavens-etal07,
  Author =	 {Gary T. Leavens and Erik Poll and Curtis Clifton and
                  Yoonsik Cheon and Clyde Ruby and David R. Cok and
                  Peter M\"{u}ller and Joseph Kiniry and Patrice Chalin},
  Title =	 {{JML Reference Manual}},
  Month =	 oct,
  Year =	 2007,
  Note =	 {Available from \url{http://www.jmlspecs.org}}
}

@Unpublished{Leavens-etal08,
  Author =	 {Gary T. Leavens and Erik Poll and Curtis Clifton and
                  Yoonsik Cheon and Clyde Ruby and David R. Cok and
                  Peter M\"{u}ller and Joseph Kiniry and Patrice Chalin
                  and Daniel M. Zimmerman},
  Title =	 {{JML Reference Manual}},
  Month =	 may,
  Year =	 2008,
  Note =	 {Available from \url{http://www.jmlspecs.org}}
}

@Unpublished{Leavens-etal09,
  Author =	 {Gary T. Leavens and Erik Poll and Curtis Clifton and
                  Yoonsik Cheon and Clyde Ruby and David R. Cok and
                  Peter M\"{u}ller and Joseph Kiniry and Patrice Chalin
                  and Daniel M. Zimmerman},
  Title =	 {{JML Reference Manual}},
  Month =	 sep,
  Year =	 2009,
  Note =	 {Available from \url{http://www.jmlspecs.org}}
}

@Inbook{Leavens-etal16,
author="Gary T. Leavens and David Naumann and Hridesh Rajan and Tomoyuki Aotani",
editor="Tiziana Margaria and Bernhard Steffen",
title="Specifying and Verifying Advanced Control Features",
bookTitle="Leveraging Applications of Formal Methods, Verification and Validation: Discussion, Dissemination, Applications: 7th International Symposium, ISoLA 2016, Imperial, Corfu, Greece, October 10-14, 2016, Proceedings, Part II",
year="2016",
publisher=Springer,
address="Cham",
pages="80--96",
doi="10.1007/978-3-319-47169-3_7",
url="http://dx.doi.org/10.1007/978-3-319-47169-3_7"
}

@TechReport{Leavens-etal96,
  Author =	 "Gary T. Leavens and Tim Wahls and Albert L. Baker
                  and Kari Lyle",
  Title =	 "An Operational Semantics of Firing Rules for
                  Structured Analysis Style Data Flow Diagrams",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 1996,
  Number =	 "93-28d",
  Month =	 jul,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR93-28/TR.ps.Z",
  Note =	 "Available by anonymous ftp from
                  \url{ftp.cs.iastate.edu} or by e-mail from
                  almanac@cs.iastate.edu.",
  Annote =	 "43 references."
}

@Article{Leavens00,
  author =	 {Gary T. Leavens},
  title =	 {Formal Methods for Multimethod Software Components},
  journal =	 {Software Engineering Notes},
  year =	 2000,
  volume =	 25,
  number =	 1,
  pages =	 {62-63},
  month =	 jan
}
                  
@InProceedings{Leavens04,
  author = 	 {Gary T. Leavens},
  title = 	 {{JML} Framed!},
  booktitle =	 {2004 ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering (PASTE'04)},
  pages =	 1,
  year =	 2004,
  month =	 jun,
  organization = ACM,
  annote =	 {Invited talk abstract.}
}

@TechReport{Leavens06,
  Author =	 "Gary T. Leavens",
  Title =	 "Following the Grammar",
  Month =	 jan,
  Year =	 2006,
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "05-02a",
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR05-02/TR.pdf",
  Note =	 "Available by anonymous ftp from ftp.cs.iastate.edu.",
  Annote =	 "8 references."
}


@Article{Leavens06a,
  author = 	 {Gary T. Leavens},
  title = 	 {Not a Number of Floating Point Problems},
  journal = 	 JOT,
  year = 	 2006,
  volume =	 5,
  number =	 2,
  pages =	 {75-83},
  month =	 {March-April},
  note =	 {\url{http://www.jot.fm/issues/issues_2006_03/column8}}
}

@InProceedings{Leavens06b,
  author = 	 {Gary T. Leavens},
  title = 	 {{JML's} Rich, Inherited Specifications for Behavioral Subtypes},
  booktitle =	 {Formal Methods and Software Engineering: 8th International Conference on Formal Engineering Methods (ICFEM)},
  pages =	 {2-34},
  year =	 2006,
  editor =	 {Zhiming Liu and He Jifeng},
  volume =	 4260,
  series =	 LNCS,
  address =	 NY,
  month =	 nov,
  publisher =	 SV,
  URL = {http://dx.doi.org/10.1007/11901433},
  annote =	 {81 references.}
}

@TechReport{Leavens06c,
  author = 	 {Gary T. Leavens},
  title = 	 {{JML's} Rich, Inherited Specifications for Behavioral Subtypes},
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "06-22",
  year = 	 2006,
  month =	 aug,
  annote =	 {81 references.},
  note =         {Also in the proceedings of {\em ICFEM'06}, LNCS vol 4260, pages 2-34.},
  URL =          {ftp://ftp.cs.iastate.edu/pub/techreports/TR06-22/TR.pdf}
}

@TechReport{Leavens07,
  Author =	 "Gary T. Leavens",
  Title =	 "Following the Grammar",
  Month =	 nov,
  Year =	 2007,
  Institution =	 "School of EECS, University of Central Florida",
  Address =	 "Orlando, FL, 32816-2362",
  Number =	 "CS-TR-07-10b",
  URL =          "http://www.eecs.ucf.edu/~leavens/COP4020/docs/follow-grammar.pdf",
  Annote =	 "9 references."
}

@inproceedings{Leavens07a,
 author = {Gary T. Leavens},
 title = {Tutorial on {JML}, the {Java Modeling Language}},
 booktitle = {ASE '07: Proceedings of the 22nd IEEE/ACM International Conference on Automated Software Engineering},
 year = 2007,
 pages = 573,
 location = {Atlanta, Georgia, USA},
 doi = {http://doi.acm.org/10.1145/1321631.1321747},
 publisher = {ACM},
 address = {New York, NY, USA},
}

@TechReport{Leavens09,
  Author =	 "Gary T. Leavens",
  Title =	 "Following the Grammar",
  Month =	 oct,
  Year =	 2009,
  Institution =	 "School of EECS, University of Central Florida",
  Address =	 "Orlando, FL, 32816-2362",
  Number =	 "CS-TR-07-10c",
  URL =          "http://www.eecs.ucf.edu/~leavens/COP4020/docs/follow-grammar.pdf",
  Annote =	 "9 references."
}

@InProceedings{Leavens10,
  author = 	 {Gary T. Leavens},
  title = 	 {The Future of Library Specification},
  booktitle = {Proceedings of the {FSE/SDP} workshop on Future of software engineering research},
  year = 	 2010,
  month = 	 nov,
  location = {Santa Fe, New Mexico, USA},
  pages = {211-216},
  url = {http://doi.acm.org/10.1145/1882362.1882407},
  doi = {http://doi.acm.org/10.1145/1882362.1882407},
  organization = ACM,
  annote = {19 references.}
}

@TechReport{Leavens10a,
  author = 	 {Gary T. Leavens},
  title = 	 {The Future of Library Specification},
  institution =  {Dept. of EECS, University of Central Florida},
  year = 	 2010,
  number = 	 {CS-TR-10-09},
  Address =	 "Orlando, FL, 32816-2362",
  month = 	 aug,
  URL =          "http://www.eecs.ucf.edu/~leavens/tech-reports/UCF/CS-TR-10-09/TR.pdf",
  annote = 	 {19 references.}
}

@TechReport{Leavens13,
  Author =	 "Gary T. Leavens",
  Title =	 "Following the Grammar with {Haskell}",
  Month =	 jan,
  Year =	 2013,
  Institution =	 "Dept. of EECS, University of Central Florida",
  Address =	 "Orlando, FL, 32816-2362",
  Number =	 "CS-TR-13-01",
  URL =          "http://www.eecs.ucf.edu/~leavens/COP4020/docs/follow-grammar-haskell.pdf",
  Annote =	 "9 references."
}

@PhDThesis{Leavens88,
  Author =	 "Gary Todd Leavens",
  Title =	 "Verifying Object-Oriented Programs that use
                  Subtypes",
  Month =	 dec,
  Year =	 1988,
  School =	 MIT,
  Note =	 "Published as MIT/LCS/TR-439 in February 1989.",
  Annote =	 "44 references."
}

@TechReport{Leavens89,
  Author =	 "Gary Todd Leavens",
  Title =	 "Verifying Object-Oriented Programs that use
                  Subtypes",
  Month =	 feb,
  Year =	 1989,
  Institution =	 MITLCS,
  Number =	 439,
  Note =	 "The author's Ph.D. thesis.",
  Annote =	 "44 references."
}

@TechReport{Leavens90,
  Author =	 "Gary T. Leavens",
  Title =	 "Modular Verification of Object-Oriented Programs
                  with Subtypes",
  Month =	 jul,
  Year =	 1990,
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "90-09",
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR90-09/TR.ps.Z",
  Note =	 "Available by anonymous ftp from
                  \url{ftp.cs.iastate.edu}, and by e-mail from
                  almanac@cs.iastate.edu",
  Annote =	 "Revised thesis. 74 references."
}

@Article{Leavens91,
  Author =	 "Gary T. Leavens",
  Title =	 "Modular Specification and Verification of Object-Oriented Programs",
  Journal =	 "IEEE Software",
  Year =	 1991,
  Volume =	 8,
  Number =	 4,
  Month =	 jul,
  Pages =	 "72-80",
  URL =          {http://dx.doi.org/10.1109/52.300040},
  Annote =	 "8 references."
}

@TechReport{Leavens93b,
  Author =	 "Gary T. Leavens",
  Title =	 "Inheritance of Interface Specifications (Extended
                  Abstract)",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 1993,
  Number =	 "93-23",
  Month =	 sep,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR93-23/TR.ps.Z",
  Note =	 "Appears in the Workshop on Interface Definition
                  Languages, WIDL '94. Available by anonymous ftp from
                  \url{ftp.cs.iastate.edu} or by e-mail from
                  almanac@cs.iastate.edu.",
  Annote =	 "28 references."
}

@InProceedings{Leavens94a,
  Author =	 "Gary T. Leavens",
  Title =	 "Inheritance of Interface Specifications (Extended
                  Abstract)",
  BookTitle =	 "Proceedings of the Workshop on Interface Definition
                  Languages",
  Series =	 SIGPLAN,
  Year =	 1994,
  Volume =	 "29(8)",
  Pages =	 "129-138",
  Month =	 aug,
  Annote =	 "28 references."
}

@Article{Leavens94d,
  author =	 "Gary T. Leavens",
  title =	 "Programs, Recursion and Unbounded Choice by Wim Hesselink",
  journal =	 "SIAM Review",
  year =	 1994,
  volume =	 36,
  number =	 1,
  pages =	 "131-133",
  month =	 mar
}

@InCollection{Leavens96b,
  author =	 "Gary T. Leavens",
  title =	 "An Overview of {Larch/C++}: Behavioral
                  Specifications for {C++} Modules",
  booktitle =	 "Specification of Behavioral Semantics in
                  Object-Oriented Information Modeling",
  publisher =	 "Kluwer Academic Publishers",
  year =	 1996,
  address =	 "Boston",
  editor =	 "Haim Kilov and William Harvey",
  chapter =	 8,
  pages =	 "121-142",
  annote =	 "52 references.",
  note =	 "An extended version is TR \#96-01d, Department of
                  Computer Science, Iowa State University, Ames, Iowa,
                  50011"
}

@Unpublished{Leavens97c,
  Author =	 "Gary T. Leavens",
  Title =	 "{Larch/C++ Reference Manual}",
  URL =		 "ftp://ftp.cs.iastate.edu/pub/larchc++/lcpp.ps.gz",
  Note =	 "Version 5.14. Available in
                  \url{ftp://ftp.cs.iastate.edu/pub/larchc++/lcpp.ps.gz}
                  or on the World Wide Web at the URL
                  \url{http://www.cs.iastate.edu/~leavens/larchc++.html}",
  Annote =	 "Definitive reference on Larch/C++. Many references.",
  Month =	 oct,
  Year =	 1997
}

@TechReport{Leavens97d,
  author =	 "Gary T. Leavens",
  title =	 "An Overview of {Larch/C++}: Behavioral
                  Specifications for {C++} Modules",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  note =	 "Revised version of Haim Kilov and William Harvey,
                  {\it Specification of Behavioral Semantics in
                  Object-Oriented Information Modeling}, chapter 8,
                  pages 121--142. Kluwer Academic Publishers, Boston,
                  1996.",
  annote =	 "52 references.",
  Year =	 1997,
  Number =	 "96-01d",
  Month =	 jul,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR96-01/TR.ps.gz",
}

@Unpublished{Leavens99,
  Author =	 "Gary T. Leavens",
  Title =	 "{Larch/C++ Reference Manual}",
  URL =		 "ftp://ftp.cs.iastate.edu/pub/larchc++/lcpp.ps.gz",
  Note =	 "Version 5.41. Available in
                  \url{ftp://ftp.cs.iastate.edu/pub/larchc++/lcpp.ps.gz}
                  or on the World Wide Web at the URL
                  \url{http://www.cs.iastate.edu/~leavens/larchc++.html}",
  Annote =	 "Definitive reference on Larch/C++. Many references.",
  Month =	 apr,
  Year =	 1999
}

@InCollection{Leavens99a,
  author =	 {Gary T. Leavens},
  title =	 {Abstract Data Types},
  editor =	 {John G. Webster},
  booktitle =	 {Wiley Encyclopedia of Electrical and Electronics
                  Engineering},
  publisher =	 {John Wiley \& Sons, Inc.},
  year =	 1999,
  volume =	 1,
  pages =	 {4-14},
  URL =
                  "http://www.wiley.com/products/subject/engineering/webster/WEBSTER_PG4-25_A1.pdf",
  annote =	 {23 references.}
}

@Unpublished{Leavens:LarchFAQ,
  Author =	 "Gary T. Leavens",
  Title =	 "{Larch} Frequently Asked Questions",
  Note =	 "Version 1.110. Available in
                  \url{http://www.cs.iastate.edu/~leavens/larch-faq.html}",
  Annote =	 "Beginner's guide to Larch, LSL, LP. Many
                  references.",
  Month =	 may,
  Year =	 2000,
  URL =		 "http://www.cs.iastate.edu/~leavens/larch-faq.html"
}

@Unpublished{Leavens:MathTraits,
  author =	 {Gary T. Leavens},
  title =	 "{LSL} Math Traits",
  note =
                  {\url{http://www.cs.iastate.edu/~leavens/Math-traits.html}},
  year =	 1996,
  month =	 {Jan}
}

@InProceedings{Ledru-etal04,
  author = 	 {Yves Ledru and Lydie du Bousquet and Olivier Maury and Pierre Bontron},
  title = 	 {Filtering {TOBIAS} combinatorial test suites},
  booktitle =	 {Proceedings of ETAPS/FASE'04 -- Fundamental Approaches to Software Engineering},
  pages =	 {281-294},
  year =	 2004,
  volume =	 2984,
  series =	 LNCS,
  address =	 NY,
  publisher =	 SV,
  URL = 	 {http://www-lsr.imag.fr/Les.Personnes/Yves.Ledru/Publications/LedruFASE04.pdf}
}

@InProceedings{Ledru96,
  author =	 {Yves Ledru},
  title =	 {Complementing Semi-Formal Specifications in {Z}},
  booktitle =	 {11th Knowledge-Based Software Engineering
                  Conference},
  year =	 1996,
  annote =	 "Systematically (could be automatically) translates
                  entity-relationship data model into Z schemas. Uses
                  Z for functions also. Formalization of the
                  specification (specifically the function
                  preconditions) helped to identify exceptional cases
                  that required changes to the specification."
}

@InCollection{Lee-Gehlot92,
  Author =	 "I. Lee and V. Gehlot",
  Title =	 "Language Constructs for Distributed Real-Time
                  Programming",
  BookTitle =	 "Real-Time Systems: Abstractions, Languages, and
                  Design Methodologies",
  Publisher =	 "IEEE Computer Society Press",
  Year =	 1992,
  Editor =	 "Krishna M. Kavi",
  Pages =	 "478-487",
  Address =	 "Los Alamitos, California",
  Month =	 oct,
  Annote =	 "26 references."
}

@Article{Lee-Litecky97,
  author =	 {Nam-Yong Lee and Charles R. Litecky},
  title =	 {An Empirical Study of Software Reuse with Special
                  Attention to Ada},
  journal =	 IEEETSE,
  year =	 1997,
  volume =	 23,
  number =	 9,
  month =	 sep,
  pages =	 {537-549},
  annote =	 {91 references.}
}

@Book{Lee-Tepfenhart01,
  author =	 {Richard C. Lee and Wiliam M. Tepfenhart},
  title =	 {UML and C++: A Practical Guide to Object-Oriented
                  Development Second Edition},
  publisher =	 {Prentice Hall},
  year =	 2001
}

@Book{Lee-Tepfenhart02,
  author =	 {Richard C. Lee and Wiliam M. Tepfenhart},
  title =	 {Practical Object-Oriented Development with UML and Java},
  publisher =	 {Prentice Hall},
  year =	 2002,
  annote =       "53 references."
}

@Article{Lee-etal88,
  Author =	 "Peter Lee and Frank Pfenning and Gene Rollins and
                  William Scherlis",
  Title =	 "The Ergo Support System: An Integrated Set of Tools
                  for Prototyping Integrated Environments",
  Journal =	 SIGSOFT,
  Volume =	 13,
  Number =	 5,
  Month =	 nov,
  Year =	 1988,
  Pages =	 "25-34",
  Note =	 "Proceedings of the ACM SIGSOFT/SIGPLAN Software
                  Engineering Symposium on Practical Software
                  Development Environments",
  Annote =	 "Prototyping formal methods. 30 references."
}

@Article{Lehman80,
  Author =	 "Meir M. Lehman",
  Title =	 "Programs, Life Cycles and Laws of Software
                  Evolution",
  Journal =	 "Proceedings of the IEEE",
  Volume =	 68,
  Number =	 9,
  Month =	 sep,
  Year =	 1980,
  Pages =	 "1060-1076",
  Annote =	 "Sources of evolutionary pressure in programs. Life
                  cycle processes. Laws of program evolution. Change
                  cannot be eliminated, but it must be made less
                  expensive. Maintain alterability. Performance,
                  capability and quality cannot be built into the
                  first version of a program, they must be achieved by
                  evolution. Problem is how to do this in a
                  cost-effective and timely way. Correctness as a
                  whole for real-world problem solving and embedded
                  software is not generally well specified, but such
                  programs should be partitioned into parts which are
                  fully specified and proven correct. Making programs
                  live longer is cost effective and lifetime is
                  determined during formative period. Laws are:
                  continuous change, increasing complexity (entropy),
                  self-regulating evolution, invariant work rate,
                  conservation of familiarity. 92 references."
}

@inproceedings{Lehner-Mueller10,
 author = {H. Lehner and P. M\"uller},
 title = {Efficient Runtime Assertion Checking of Assignable Clauses with Datagroups},
 editor = {D. Rosenblum and G. Taentzer},
 booktitle = {Fundamental Approaches to Software Engineering (FASE)},
 publisher = {Springer-Verlag},
 series = {Lecture Notes in Computer Science},
 volume = {6013},
 year = {2010},
 pages = {338--352},
 URL = {http://www.springerlink.com/content/1jqj3086l8734p37/}
}

@phdthesis{Lehner11,
 author = {H. Lehner},
 title = {A Formal Definition of {JML} in {Coq} and its Application to Runtime Assertion Checking},
 school = {ETH Zurich, Switzerland},
 year = {2011},
 URL = "http://jmlcoq.info"
}

@InProceedings{Lehoczky-Sha-Ding89,
  author = 	 {J. Lehoczky and L. Sha and Y. Ding},
  title = 	 {The Rate Monotonic Scheduling Algorithm: Exact Characterization and Average Case Behavior},
  booktitle =	 {Proceedings, Real-Time Systems Symposium, Santa Monica, California},
  pages =	 {166-171},
  year =	 1989,
  month =	 dec,
  organization = {IEEE}
}

@Misc{Leino-Ford-Cok21,
  author = 	 {K. Rustan M. Leino and Richard L. Ford and David R. Cok},
  title = 	 {Dafny Reference Manual},
  howpublished = {https://github.com/dafny-lang/dafny/blob/master/docs/DafnyRef/out/DafnyRef.pdf},
  month = 	 {Jul},
  year = 	 2021,
  annote =       {35 references.}
}

@Article{Leino-Manohar99,
  author = 	 {K. Rustan M. Leino and Rajit Manohar},
  title = 	 {Joining specification statements},
  journal = 	 TCS,
  year = 	 1999,
  volume =	 216,
  number =	 {1-2},
  pages =	 {375-394},
  month =	 mar,
  annote =       "16 references."
}

@inproceedings{Leino-Middelkoop09,
  author    = {K. Rustan M. Leino and Ronald Middelkoop},
  title     = {Proving Consistency of Pure Methods and Model Fields},
  booktitle = {FASE 2009},
  year = 2009,
  publisher = SV,
  address = "Berlin",
  note = {To appear}
}

@InProceedings{Leino-Monahan07,
  author =	 {K. Rustan M. Leino and Rosemary Monahan},
  title = 	 {Automatic verification of textbook programs that use comprehensions},
  booktitle =	 {Workshop on Formal Techniques for Java-like Programs (FTfJP)},
  year =	 2007,
  month =	 jul,
  URL = 	 {http://cs.nju.edu.cn/boyland/ftjp/paper_13.pdf},
  annote =       {10 references.}
}

@inproceedings{Leino-Monahan09,
author = {Leino, K. Rustan M. and Monahan, Rosemary},
title = {Reasoning about Comprehensions with First-Order {SMT} Solvers},
year = {2009},
isbn = {9781605581668},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/1529282.1529411},
abstract = {This paper presents a technique for translating common comprehension expressions (sum,
count, product, min, and max) into verification conditions that can be tackled by
two off-the-shelf first-order SMT solvers. Since a first-order SMT solver does not
directly support the bound variables that occur in comprehension expressions, the
challenge is to provide a sound axiomatisation that is strong enough to prove interesting
programs and, furthermore, that can be used automatically by the SMT solver. The technique
has been implemented in the Spec# program verifier. The paper also reports on the
experience of using Spec# to verify several challenging programming examples drawn
from a textbook by Dijkstra and Feijen.},
booktitle = {Proceedings of the 2009 ACM Symposium on Applied Computing},
pages = {615–622},
numpages = {8},
keywords = {quantifiers, Spec#, matching triggers, SMT solvers},
location = {Honolulu, Hawaii},
series = {SAC '09}
}

@InProceedings{Leino-Monahan10,
 author = {K. Rustan M. Leino and Rosemary Monahan},
 title = {{Dafny} Meets The Verification Benchmarks Challenge},
 booktitle = {Proceedings of the Third international conference on Verified software: theories, tools, experiments},
 series = LNCS,
 volume = 6217,
 year = 2010,
 location = {Edinburgh, UK},
 pages = {112-126},
 url = {\url{http://dx.doi.org/10.1007/978-3-642-15057-9_8}},
 publisher = SV,
 address = {Berlin},
 annote = {12 references.}
}

@inproceedings{Leino-Mueller-Wallenburg08,
 author = {K. Rustan M. Leino and Peter M\"{u}ller and Angela Wallenburg},
 title = {Flexible Immutability with Frozen Objects},
 booktitle = {Verified Software: Theories, Tools, and Experiments (VSTTE)},
 editor = {N. Shankar and Jim Woodcock},
 year = 2008,
 series = LNCS,
 volume = 5295,
 pages = {192-208},
 publisher = SV,
 address = {Berlin},
  URL = {http://dx.doi.org/10.1007/978-3-540-87873-5_17}
}

% doi = {10.1145/1529282.1529411},
@inproceedings{Leino-Mueller04,
 author = {K. Rustan M. Leino and Peter M\"{u}ller},
 title = {Object Invariants in Dynamic Contexts},
 booktitle = {European Conference on Object-Oriented Programming (ECOOP)},
 month = jun,
 year = 2004,
 editor = {Martin Odersky},
 series = LNCS,
 volume = 3086,
 publisher = SV,
 address = {Berlin},
 URL = {http://www.springerlink.com/content/ttfnjg36yq64pah8},
 pages = {491-516}
}

@techreport{Leino-Mueller04a,
 author = {K. Rustan M. Leino and Peter M\"{u}ller},
 title = {Modular verification of global module invariants in object-oriented programs},
 institution = {ETH Z\"{u}rich},
 year = {2004},
 number = {459},
 note = {\url{www.inf.ethz.ch/research/publications/techreports/show?serial=459&lang=en}}
}

@inproceedings{Leino-Mueller05,
 author = {K. Rustan M. Leino and Peter M\"{u}ller},
 title = {Modular verification of static class invariants},
 booktitle = {Formal Methods (FM)},
 month = jul,
 year = 2005,
 editor = {John Fitzgerald and Ian J. Hayes and Andrzej Tarlecki},
 series = LNCS,
 volume = 3582,
 pages = {26-42},
 URL = {https://tinyurl.com/4xfc2989},
 publisher = SV
}

@inproceedings{Leino-Mueller06,
 author = {K. Rustan M. Leino and Peter M\"uller},
 title = {A verification methodology for model fields},
 booktitle = {European Symposium on Programming (ESOP)},
 editor = {Peter Sestoft},
 month = mar,
 year = 2006,
 series = LNCS,
 volume = 3924,
 publisher = SV,
 address = NY,
 pages = {115-130},
 DOI = {http://dx.doi.org/10.1007/11693024_9},
 URL = {http://tinyurl.com/pzll8}
}

@InProceedings{Leino-Mueller08,
  author =    {K. Rustan M. Leino and Peter M\"uller},
  title =     {Verification of equivalent-results methods},
  booktitle = {Programming Languages and Systems, 17th European Symposium on Programming (ESOP)},
  editor =    {Sophia Drossopoulou},
  series =    LNCS,
  volume =    4960,
  publisher = SV,
  address =   {Berlin},
  month =     mar # "--" # apr,
  year =      2008,
  pages =     {307-321},
  URL = {http//dx.doi.org/10.1007/978-3-540-78739-6_24}
}

% DOI = {10.1007/11526841_4},
@InProceedings{Leino-Mueller09,
  author =    {K. Rustan M. Leino and Peter M\"uller},
  title =     {A Basis for Verifying Multi-threaded Programs},
  booktitle = {Programming Languages and Systems, 18th European Symposium on Programming, ESOP 2009},
  editor =    {Giuseppe Castagna},
  series =    LNCS,
  volume =    5502,
  publisher = SV,
  address =   {Berlin},
  month =     mar,
  year =      2009,
  pages =     {378-393}
}

@TechReport{Leino-Nelson-Saxe00,
  author =	 {K. Rustan M. Leino and Greg Nelson and James
                  B. Saxe},
  title =	 {{ESC/Java} User's Manual},
  institution =	 {Compaq Systems Research Center},
  year =	 2000,
  type =	 {Technical Note},
  month =	 oct
}

@TechReport{Leino-Nelson00,
  author =	 {K. Rustan M. Leino and Greg Nelson},
  title =	 {Data abstraction and information hiding},
  institution =	 {Compaq Systems Research Center},
  year =	 2000,
  type =	 {Technical Report},
  number =	 160,
  note =	 "To appear in TOPLAS",
  address =	 {130 Lytton Avenue Palo Alto, CA 94301}
}

@Article{Leino-Nelson02,
  author =	 {K. Rustan M. Leino and Greg Nelson},
  title =	 {Data abstraction and information hiding},
  journal =	 TOPLAS,
  year =	 2002,
  volume =	 24,
  number =	 5,
  pages =	 {491--553},
  month =	 sep,
  URL = {http://doi.acm.org/10.1145/570886.570888},
  annote =	 {37 references.}
}

@InProceedings{Leino-Poetzsch-Heffter-Zhou02,
  author =	 "K. Rustan M. Leino and Arnd Poetzsch-Heffter and
                  Yunhong Zhou",
  title =	 "Using Data Groups to Specify and Check Side Effects",
  pages =	 "246--257",
  booktitle =	 "Proceedings of the {ACM} {SIGPLAN} 2002 Conference
                  on Programming Language Design and Implementation
                  ({PLDI}'02)",
  month =	 jun,
  series =	 SIGPLAN,
  volume =	 "37(5)",
  publisher =	 ACM,
  address =	 NY,
  year =	 2002,
  URL = {http://doi.acm.org/10.1145/512529.512559},
  annote =	 "Specifying statically checking the side effects of
                  methods in a modular way, with only annotations for
                  specifying data groups, inclusions, and modifies
                  lists. Pivot uniqueness and owner exclusion
                  restrictions. 34 references."
}

@InProceedings{Leino-Rummer10,
author={K. Rustan M. Leino and Philipp R\"{u}mmer},
year=2010,
booktitle={Tools and Algorithms for the Construction and Analysis of Systems},
volume=6015,
series=LNCS,
editor={Javier Esparza and Rupak Majumdar},
doi={10.1007/978-3-642-12002-2_26},
title={A Polymorphic Intermediate Verification Language: Design and Logical Encoding},
url={http://dx.doi.org/10.1007/978-3-642-12002-2_26},
publisher=SV,
address={Berlin},
pages={312-327}
}

@InProceedings{Leino-Saxe-Stata99,
  author = "K. Rustan M. Leino and James B. Saxe and Raymie Stata",
  title = "Checking {Java} programs via guarded commands",
  editor = "Bart Jacobs and Gary T. Leavens and Peter M{\"u}ller and
            Arnd Poetzsch-Heffter",
  series = "Technical Report~251",
  booktitle = "Formal Techniques for {Java} Programs (FTfJP)",
  month = may,
  year = 1999,
  publisher = "FernUniversit{\"a}t Hagen",
  address = {Hagen, Germany},
  note = "Also available as Technical Note 1999-002,
	  Compaq Systems Research Center."
}

@TechReport{Leino-Saxe-Stata99a,
  author =	 {K. Rustan M. Leino and James B. Saxe and Raymie Stata},
  title =	 {Checking {Java} programs via guarded commands},
  institution =	 {Compaq Systems Research Center},
  year =	 1999,
  type =	 {Technical Note},
  number =	 {1999-002},
  address =	 {Palo Alto, CA},
  month =	 may,
  url =          {http://gatekeeper.dec.com/pub/DEC/SRC/technical-notes/abstracts/src-tn-1999-002.html}
}

@InProceedings{Leino-Schulte04,
  author = "K. Rustan M. Leino and Wolfram Schulte",
  title = "Exception safety for {C\#}",
  booktitle = "SEFM 2004---Second International Conference on Software Engineering and Formal Methods",
  editor = "Jorge R. Cuellar and Zhiming Liu",
  publisher = "IEEE",
  address = "Los Alamitos, California",
  month = sep,
  year = 2004,
  pages = "218-227"
}

@InCollection{Leino-Schulte07,
  author = {K. Rustan M. Leino and Wolfram Schulte},
  title = {A verifying compiler for a multi-threaded object-oriented language},
  booktitle = {Summer School Marktoberdorf 2006: Software System
                  Reliability and Security},
  series = {NATO ASI Series F},
  publisher = {IOS Press},
  address = {Amsterdam},
  year = 2007,
  Annote = {Discusses Spec\#.}
}

@inproceedings{Leino-Schulte07b,
  author    = {K. Rustan M. Leino and Wolfram Schulte},
  title     = {Using History Invariants to Verify Observers},
  year      = 2007,
  pages     = {80-94},
  editor    = {Rocco De Nicola},
  booktitle = {Programming Languages and Systems (ESOP)},
  publisher = SV,
  series    = LNCS,
  address   = {Berlin},
  volume    = {4421}
}

@Article{Leino-Stata99,
  author =	 {K. Rustan M. Leino and Raymie Stata},
  title =	 {Virginity: A contribution to the specification of
                  object-oriented software},
  journal =	 {Information Processing Letters},
  year =	 1999,
  volume =	 70,
  number =	 2,
  pages =	 {99-105},
  month =	 apr
}

@InProceedings{Leino-Wallenburg08,
  author = {K. Rustan M. Leino and Angela Wallenburg},
  title = {Class-local object invariants},
  booktitle = {First India Software Engineering Conference ({ISEC} 2008)},
  month = feb,
  year = 2008,
  publisher = {ACM},
  address = NY
}

@Misc{Leino-etal21,
  author = 	 {K. Rustan M. Leino and others},
  title = 	 {Dafny github site},
  howpublished = {https://github.com/dafny-lang/dafny},
  note = 	 {Accessed September 2021}
}

@article{Leino05,
author={K. Rustan M. Leino},
title =	{Efficient Weakest Preconditions},
journal = IPL,
volume = 93,
number = 6,
year = 2005,
pages = {281-288}
}
                  
@Misc{Leino08,
  author = {K. Rustan M. Leino},
  title = {This is {B}oogie 2},
  howpublished = {Manuscript KRML 178},
  year = 2008,
  note = "Available at \url{http://research.microsoft.com/~leino/papers.html}",
}

@unpublished{Leino09,
  author = {K. Rustan M. Leino},
  title = {Specification and verification of object-oriented software},
  note = {Lecture notes from Marktoberdorf Internation Summer School, available at
         \url{http://research.microsoft.com/en-us/um/people/leino/papers/krml190.pdf}},
  year = {2008},
  url = {http://research.microsoft.com/en-us/um/people/leino/papers/krml190.pdf}
}

@InProceedings{Leino10,
  author =       {K. Rustan M. Leino},
  title = {{D}afny: An Automatic Program Verifier for Functional Correctness},
  booktitle =    {Logic for Programming, Artificial Intelligence, and
                  Reasoning, 16th International Conference, LPAR-16},
  year =         {2010},
  series =       LNCS,
  volume =       6355,
  publisher =    SV,
  pages =        {348-370},
  location =     {Darkar, Senegal},
  annote =       {52 references.},
  address =      {Berlin}
}

@PhdThesis{Leino95,
  author =	 {K. Rustan M. Leino},
  title =	 {Toward Reliable Modular Programs},
  school =	 {California Institute of Technology},
  year =	 1995,
  note =	 {Available as Technical Report Caltech-CS-TR-95-03.},
  URL = {\url{http://caltechcstr.library.caltech.edu/234/00/95-03.ps}}
}

@TechReport{Leino95a,
  author =	 {K. Rustan M. Leino},
  title =	 {A myth in the modular specification of programs},
  institution =	 DECSRC,
  year =	 1995,
  number =	 {KRML 63},
  address =	 {130 Lytton Avenue Palo Alto, CA 94301},
  month =	 nov,
  note =	 {Obtain from the author, at leino@microsoft.com}
}

@InProceedings{Leino97,
Author = {K. Rustan M. Leino},
Title =  {Ecstatic: An object-oriented programming language with an axiomatic semantics},
BookTitle = {Fourth International Workshop on Foundations of
                  Object-Oriented Languages (FOOL)},
Editor = {Pierce, Benjamin},
month = jan,
Year = 1997,
Note = {Available from: \url{http://www.cis.upenn.edu/~bcpierce/FOOL/}.}
}

@InProceedings{Leino98,
  author =	 {K. Rustan M. Leino},
  title =	 {Data groups: Specifying the modification of extended
                  state},
  BookTitle =	 "OOPSLA '98 Conference Proceedings",
  Series =	 SIGPLAN,
  Volume =	 "33(10)",
  Month =	 oct,
  Year =	 1998,
  publisher =    ACM,
  address =      NY,
  pages =	 {144-153},
  URL = {http://doi.acm.org/10.1145/286936.286953},
  annote =	 {Specification of frame conditions for methods in
                  classes. 29 references.}
}

@Article{Leino98b,
  author = 	 {K. Rustan M. Leino},
  title = 	 {Recursive Object Types in a Logic of Object-Oriented Programs},
  journal = 	 {Nordic Journal of Computing},
  year = 	 1998,
  volume =	 5,
  number =	 4,
  pages =	 {330-360},
  month =	 {Winter}
}

@Article{Lejter-Meyers-Reiss92,
  Author =	 "Moises Lejter and Scott Meyers and Steven P. Reiss",
  Title =	 "Support for Maintaining Object-Oriented Programs",
  Journal =	 IEEETSE,
  Volume =	 18,
  Number =	 12,
  Month =	 dec,
  Year =	 1992,
  Pages =	 "1045-1052",
  Annote =	 "21 references."
}

@Book{Lerman93,
  Author =	 "Steven R. Lerman",
  Title =	 "Problem Solving and Computation for Scientists and
                  Engineers",
  Publisher =	 "Prentice Hall",
  Year =	 1993,
  Address =	 "Englewood Cliffs, New Jersey",
  Annote =	 "21 references"
}

@Techreport{Lerner91,
  Author =	 "Richard Allen Lerner",
  Title =	 "Specifying Objects of Concurrent Systems",
  Institution =	 CMU,
  Year =	 1991,
  Type =	 "Ph.D. Thesis",
  Number =	 "CMU-CS-91-131",
  Month =	 may
}

@inproceedings{Leroy06,
  author    = {Xavier Leroy},
  title     = {Formal certification of a compiler back-end or: programming a compiler with a proof assistant},
  year      = {2006},
  pages     = {42-54},
  editor    = {J. Gregory Morrisett and
               Simon L. Peyton Jones},
  booktitle     = {Principles of Programming Languages (POPL)},
  publisher = ACM,
  address = NY,
  URL = {http://doi.acm.org/10.1145/1111037.1111042}
}

@TechReport{Leszczylowski-Bieman88a,
  Author =	 "Jacek Leszczylowski and James M. Bieman",
  Title =	 "Growing Executable Specifications Using PROSPER",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Number =	 "88-1",
  Month =	 jan,
  Year =	 1988,
  Annote =	 "19 references."
}

@TechReport{Leszczylowski-Bieman88b,
  Author =	 "Jacek Leszczylowski and James M. Bieman",
  Title =	 "PROSPER: A Language for Specification by
                  Prototyping",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Number =	 "88-18",
  Month =	 sep,
  Year =	 1988,
  Note =	 "To appear in {\em Computer Languages}",
  Annote =	 "37 references."
}

@Book{Lethbridge-Laganiere01,
  author =	 {Timothy C. Lethbridge and Robert Lagani\`{e}re},
  title = 	 {Object-Oriented Software Engineering},
  publisher = 	 {McGraw-Hill Education},
  year = 	 2001,
  address =	 {Berkshire, England},
  annote =	 {Some references in the text.}
}

@inproceedings{Letier-vanLamsweerde02,
 author = {Emmanuel Letier and Axel van Lamsweerde},
 title = {Deriving operational software specifications from system goals},
 booktitle = {SIGSOFT '02/FSE-10: Proceedings of the 10th ACM SIGSOFT symposium on Foundations of software engineering},
 year = {2002},
 isbn = {1-58113-514-9},
 pages = {119--128},
 location = {Charleston, South Carolina, USA},
 doi = {http://doi.acm.org/10.1145/587051.587070},
 publisher = {ACM},
 address = {New York, NY, USA}
}

@Article{Leveson-Cha-Shimeall91,
  Author =	 "Nancy Leveson and Stephen Cha and Timothy Shimeall",
  Title =	 "Safety Verification of Ada Programs Using Software
                  Fault Trees",
  Journal =	 "IEEE Software",
  Year =	 1991,
  Volume =	 8,
  Number =	 4,
  Month =	 jul,
  Pages =	 "48-60",
  Annote =	 "9 references."
}

@InProceedings{Leveson-Heimdahl-Resse99,
  author =       {Nancy G. Leveson and Mats P. E. Heimdahl and Jon Damon Reese},
  title =        "Designing Specification Languages for Process Control
                 Systems: Lessons Learned and Steps to the Future",
  booktitle =    "Software Engineering -- ESEC/FSE '99",
  month =        nov,
  year =         "1999",
  editor =       "Oscar Nierstrasz and Michel Lemoine",
  volume =       "1687",
  series =       LNCS,
  publisher =    SV,
  address =      "Berlin",
  pages =        {127-145},
  note =         {Also ACM SIGSOFT {\em Software Engineering Notes},
                  volume 24, number 6.},
  annote =       {Lessons from RSML.  Design of SpecTRM-RL.  14 references.}
}

@Article{Leveson86,
  Author =	 "Nancy G. Leveson",
  Title =	 "Software Safety: What, Why, and How",
  Journal =	 ACMCS,
  Volume =	 18,
  Number =	 2,
  Month =	 jun,
  Year =	 1986,
  Pages =	 "125-163",
  Annote =	 "Surveys the state of research into software
                  safety. 118 references. Bibliography includes 28
                  further references."
}

@Book{Leveson95,
  author =	 {Nancy Leveson},
  title =	 {Safeware : System Safety and Computers},
  publisher =	 {Addison-Wesley Pub Co.},
  year =	 1995,
  address =	 {Reading, Mass.}
}

@InCollection{Lewerentz-etal95,
  author =	 {C. Lewerentz and Th. Lindner and A. R\"{u}ping and
                  E. Sekerinski},
  title =	 "On Object-Oriented Design and Verification",
  crossref =	 "Broy-Jaehnichen95",
  pages =	 "92-111",
  year =	 1995,
  series =	 LNCS,
  volume =	 1009,
  annote =	 "Behavioral subtyping in the refinement calculus. 32
                  references."
}

@InCollection{Lewington90,
  Author =	 "Lewington",
  Title =	 "Towards Constructive Program Derivation in {VDM}",
  BookTitle =	 "Foundations of Software Technology and Computer
                  Science, Tenth Conference, Bangalore, India",
  Publisher =	 SV,
  Year =	 1990,
  Editor =	 "K. V. Nori and C. E. Veni Madhavan",
  Series =	 LNCS,
  Volume =	 472,
  Pages =	 "115-132",
  Address =	 NY,
  Month =	 dec
}

@InProceedings{Lewis-etal91,
  author =	 "John A. Lewis and Sallie M. Henry and Dennis
                  G. Kafura and Robert S. Schulman",
  title =	 "An Empirical Study of the Object-Oriented Paradigm
                  and Software Reuse",
  editor =	 "Andreas Paepcke",
  booktitle =	 "{OOPSLA}~'91 Conference Proceedings: Object-Oriented
                  Programming Systems, Languages, and Applications",
  year =	 "1991",
  publisher =	 "ACM Press",
  pages =	 "184-196",
  url =
                  "http://www.acm.org/pubs/articles/proceedings/oops/117954/p184-lewis/p184-lewis.pdf",
  note =	 {Published as ACM SIGPLAN Notices, volume 26, number
                  11},
  annote =	 "10 references."
}

@Article{Lieberherr-Holland-Riel88,
  Author =	 "K. Lieberherr and I. Holland and A. Riel",
  Title =	 "Object-Oriented Programming: An Objective Sense of
                  Style",
  Journal =	 SIGPLAN,
  Volume =	 23,
  Number =	 11,
  Month =	 nov,
  Year =	 1989,
  Pages =	 "323-334",
  Note =	 "OOPSLA '88 Conference Proceedings, Norman Meyrowitz
                  (editor), October 1987, San Diego, Calif.",
  Annote =	 "18 references."
}

@Article{Lieberherr-Holland89,
  Author =	 "Karl J. Lieberherr and Ian M. Holland",
  Title =	 "Assuring Good Style for Object-Oriented Programs",
  Journal =	 "IEEE Software",
  Volume =	 6,
  Number =	 5,
  Month =	 sep,
  Year =	 1989,
  Pages =	 "38-48",
  Annote =	 "The law of Demeter. Each method can only send
                  messages to argument objects, to self, and to
                  instance variables. 10 references."
}

@article{Lieberherr-Lorenz-Ovlinger03a,
	Author = {Karl Lieberherr and David H. Lorenz and Johan Ovlinger},
	Address = {Oxford, UK},
	Journal = {The Computer Journal},
	Organization = {British Computer Society},
	Pages = {542-565},
	Publisher = {Oxford University Press},
	Title = {Aspectual Collaborations: Combining Modules and Aspects},
	Volume = {46(5)},
	Year = {2003}
}

@Article{Lieberherr-Xiao93,
  Author =	 "Karl J. Lieberherr and C. Xiao",
  Title =	 "Object Oriented Software evolution",
  Journal =	 "IEEETSE",
  Volume =	 19,
  Number =	 4,
  Month =	 apr,
  Year =	 1993,
  Pages =	 "313-343",
  Annote =	 "48 references."
}

@Book{Lieberherr96,
  author =	 "Karl J. Lieberherr",
  title =	 "Adaptive Object-Oriented Software: The Demeter
                  Method with Propagation Patterns",
  publisher =	 "PWS Publishing Company",
  year =	 1996,
  address =	 "Boston",
  Note =	 "Available from
                  \url{http://www.ccs.neu.edu/research/demeter/biblio/dem-book.html}"
}

@Article{Lientz83,
  Author =	 "Bennet P. Lientz",
  Title =	 "Issues in Software Maintenance",
  Journal =	 ACMCS,
  Volume =	 15,
  Number =	 3,
  Month =	 sep,
  Year =	 1983,
  Pages =	 "271-278",
  Annote =	 "Identifies problem areas by surveying
                  practitioners. Biggest problems are documentation
                  quality, demand for enhancements and extensions,
                  competing demands for maintenance personnel time,
                  meeting scheduled deadlines and turnover in user
                  organizations. Enhancements consume 60% of resources
                  in maintenance, 40% for bug fixing. 10 references."
}

@Book{Lightfoot91,
  Author =	 "Lightfoot",
  Title =	 "Formal Specification using {Z}",
  Publisher =	 "MacMillan",
  Year =	 1991
}

@Article{Lim-etal95,
  title =	 "An Accurate Worst Case Timing Analysis for {RISC}
                  Processors",
  author =	 "Sung-Soo Lim and Young Hyun Bae and Gyu Tae Jang and
                  Byung-Do Rhee and Sang Lyul Min and Chang Yun Park
                  and Heonshik Shin and Kunsoo Park and Soo-Mook Moon
                  and Chong Sang Kim",
  pages =	 "593-604",
  journal =	 IEEETSE,
  year =	 "1995",
  volume =	 "21",
  month =	 jul,
  number =	 7
}

@MastersThesis{Lin01,
  author = 	 {Hung-Yu Lin},
  title = 	 {Executing Quantified Expressions in the JML Run-time Assertion Checker},
  school = 	 {The Pennsylvania State University, Capital College},
  year = 	 2001,
  month =	 aug,
  URL = 	 {http://emp3.hbg.psu.edu/theses/available/etd-10252001-100812/unrestricted/2001pLin_H.pdf}
}

@Article{Lin93,
  Author =	 "Huimin Lin",
  Title =	 "Procedural Implementation of Algebraic
                  Specifications",
  Journal =	 TOPLAS,
  Volume =	 15,
  Number =	 5,
  Month =	 nov,
  Year =	 1993,
  Pages =	 "876-895",
  Annote =	 "20 refernces"
}

@article{Lindner06,
 author = {Felix "FX" Lindner},
 title = {Software security is software reliability},
 journal = CACM,
 volume = 49,
 number = 6,
 year = 2006,
 pages = {57-61},
 doi = {http://doi.acm.org/10.1145/1132469.1132502},
 publisher = ACM,
 address = NY,
 annote = {9 references.}
}

@Article{Lindsay88,
  author = 	 {Peter A. Lindsay},
  title = 	 {A survey of mechanical support for formal reasoning},
  journal = 	 {Software Engineering Journal},
  year = 	 1988,
  volume = 	 3,
  number = 	 1,
  pages = 	 {3-27},
  month = 	 {jan}}

@InCollection{Liskov-Berzins79,
  Author =	 "Barbara H. Liskov and Valdis Berzins",
  Title =	 "An Appraisal of Program Specifications",
  BookTitle =	 "Research Directions in Software Technology",
  Editor =	 "Peter Wegner",
  Publisher =	 MITP,
  Address =	 "Cambridge, Mass.",
  Year =	 1979,
  Pages =	 "276-301",
  Annote =	 "Review and evaluation of formal specification
                  techniques. 54 references."
}

@Book{Liskov-Guttag01,
  Author =	 "Barbara Liskov and John Guttag",
  Title =	 "Program Development in Java",
  Year =	 2001,
  Publisher =	 MITP,
  Address =	 "Cambridge, Mass.",
  Annote =	 "Abstraction and Specification."
}

@Book{Liskov-Guttag86,
  Author =	 "Barbara Liskov and John Guttag",
  Title =	 "Abstraction and Specification in Program
                  Development",
  Year =	 1986,
  Publisher =	 MITP,
  Address =	 "Cambridge, Mass.",
  Annote =	 "Program design. CLU used as a vehicle and defined."
}

@Article{Liskov-Weihl86,
  Author =	 "Barbara Liskov and William Weihl",
  Title =	 "Specifications of Distributed Programs",
  Journal =	 "Distributed Computing",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1986,
  Volume =	 1,
  Pages =	 "102-118",
  Annote =	 "22 references."
}

@Unpublished{Liskov-Wing92,
  Author =	 "Barbara Liskov and Jeannette Wing",
  Title =	 "A Semantic Notion of Subtyping",
  Note =	 "Obtained from the authors.",
  Month =	 aug,
  Year =	 1992
}

@TechReport{Liskov-Wing92b,
  Author =	 "Barbara Liskov and Jeannette M. Wing",
  Title =	 "Family Values: A Semantic Notion of Subtyping",
  Institution =	 MITLCS,
  Number =	 562,
  Month =	 dec,
  Year =	 1992,
  Annote =	 "26 references."
}

@InCollection{Liskov-Wing93,
  Author =	 "Barbara Liskov and Jeannette M. Wing",
  Title =	 "A New Definition of the Subtype Relation",
  BookTitle =	 "ECOOP '93 --- Object-Oriented Programming, 7th
                  European Conference, Kaiserslautern, Germany",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Oscar M. Nierstrasz",
  Series =	 LNCS,
  Volume =	 707,
  Pages =	 "118-141",
  Address =	 NY,
  Month =	 jul,
  Annote =	 "The discussion on page 138 of the work of Leavens
                  and Weihl is wrong: Leavens and Weihl do not map
                  supertype values down to subtype values. 25
                  references."
}

@Article{Liskov-Wing93b,
  Author =	 "Barbara Liskov and Jeannette M. Wing",
  Title =	 "Specifications and Their Use in Defining Subtypes",
  Journal =	 SIGPLAN,
  Volume =	 28,
  Number =	 10,
  Month =	 oct,
  Year =	 1993,
  Pages =	 "16-28",
  Note =	 "{\em OOPSLA '93 Proceedings}, Andreas Paepcke
                  (editor).",
  Annote =	 "27 references."
}

@TechReport{Liskov-Wing93c,
  Author =	 "Barbara Liskov and Jeannette M. Wing",
  Title =	 "A New Definition of the Subtype Relation",
  Institution =	 MITLCS,
  Type =	 "Programming Methodology Group Memo",
  Number =	 76,
  Month =	 may,
  Year =	 1993,
  Note =	 "To appear in the proceedings of ECOOP '93.",
  Annote =	 "25 references."
}

@Article{Liskov-Wing93d,
  Author =	 "Barbara Liskov and Jeannette Wing",
  Title =	 "Corrigenda to ECOOP '93 Paper",
  Journal =	 SIGPLAN,
  Year =	 1993,
  Volume =	 29,
  Number =	 4,
  Month =	 apr,
  Pages =	 4
}

@Article{Liskov-Wing94,
  author =	 "Barbara H. Liskov and Jeannette M. Wing",
  title =	 "A Behavioral Notion of Subtyping",
  journal =	 TOPLAS,
  year =	 1994,
  volume =	 16,
  number =	 6,
  pages =	 "1811-1841",
  month =	 nov,
  URL = {http://doi.acm.org/10.1145/197320.197383},
  annote =	 "37 references."
}

@Article{Liskov-Zilles75,
  Author =	 "Liskov, Barbara H. and Zilles, Stephen N.",
  Title =	 "Specification Techniques for Data Abstraction",
  Journal =	 "Transactions on Software Engineering",
  Month =	 "March",
  Year =	 1975,
  Volume =	 1,
  Number =	 1
}

@InCollection{Liskov-Zilles77,
  Author =	 "B. Liskov and S. N. Zilles",
  Title =	 "An Introduction to Formal Specifications of Data
                  Abstractions",
  BookTitle =	 "Current Trends in Programming Methodology",
  Publisher =	 Prentice-Hall,
  Address =	 "Englewood Cliffs, N.J.",
  Year =	 1977,
  Volume =	 1,
  Editor =	 "Raymond T. Yeh",
  Pages =	 "1-32",
  Note =	 {Revised version of ``Specification Techniques for
                  Data Abstractions'', IEEE Transactions on Software
                  Engineering, SE-1(1), March, 1975, pages 7-19.},
  Annote =	 "Importance of formal specifications and a survey of
                  specification techniques."
}

@InProceedings{Liskov72,
  Title =	 "A Design Methodology for Reliable Software Systems",
  Author =	 "B. H. Liskov",
  BookTitle =	 "1972 Fall Joint Computer Conference",
  Organization = AFIPS,
  Year =	 1972,
  Pages =	 "191-199"
}

@InCollection{Liskov80,
  Author =	 "Barbara Liskov",
  Title =	 "Modular Program Construction Using Abstraction",
  BookTitle =	 "Abstract Software Specifications, 1979 Copenhagen
                  Winter School Proceedings",
  Year =	 1980,
  Series =	 LNCS,
  Editor =	 "D. Bj{\o}rner",
  Publisher =	 SV,
  Address =	 NY,
  Volume =	 86,
  Pages =	 "354-389",
  Annote =	 "A methodology for modular decomposition based on
                  recognition of useful abstractions. Module
                  dependency graph, informal specifications. 11
                  references."
}

% doi = {https://doi.org/10.1016/j.jss.2020.110817},
@article{Liu-etal21,
title = {A critical review on the evaluation of automated program repair systems},
journal = {Journal of Systems and Software},
volume = {171},
pages = {110817},
year = {2021},
issn = {0164-1212},
url = {https://www.sciencedirect.com/science/article/pii/S0164121220302156},
author = {Kui Liu and Li Li and Anil Koyuncu and Dongsun Kim and Zhe Liu and Jacques Klein and Tegawendé F. Bissyandé},
keywords = {Automated program repair, Evaluation, Assessment, Metrics},
abstract = {Automated Program Repair (APR) has attracted significant attention from software engineering research and practice communities in the last decade. Several teams have recorded promising performance in fixing real bugs and there is a race in the literature to fix as many bugs as possible from established benchmarks. Gradually, repair performance of APR tools in the literature has gone from being evaluated with a metric on the number of generated plausible patches to the number of correct patches. This evolution is necessary after a study highlighting the overfitting issue in test suite-based automatic patch generation. Simultaneously, some researchers are also insisting on providing time cost in the repair scenario as a metric for comparing state-of-the-art systems. In this paper, we discuss how the latest evaluation metrics of APR systems could be biased. Since design decisions (both in approach and evaluation setup) are not always fully disclosed, the impact on repair performance is unknown and computed metrics are often misleading. To reduce notable biases of design decisions in program repair approaches, we conduct a critical review on the evaluation of patch generation systems and propose eight evaluation metrics for fairly assessing the performance of APR tools. Eventually, we show with experimental data on 11 baseline program repair systems that the proposed metrics allow to highlight some caveats in the literature. We expect wide adoption of these metrics in the community to contribute to boosting the development of practical, and reliably performable program repair tools.}
}

@InProceedings{Liu-Gomez98,
  author =	 "Yanhong A. Liu and Gustavo Gomez",
  title =	 "Automatic Accurate Time-Bound Analysis for
                  High-Level Languages",
  booktitle =    "ACM SIGPLAN Workshop on Languages, Compilers, and Tools for Embedded Systems",
  series =	 LNCS,
  publisher =    SV,
  volume =	 "1474",
  pages =	 "31ff",
  year =	 1998,
  URL =
                  "http://link.springer-ny.com/link/service/series/0558/papers/1474/14740031.pdf",
}

@Article{Liu-etal98,
  author =	 {Shaoying Liu and A. Jeff Offutt and Chris Ho-Stuart
                  and Yong Sun and Mitsuru Ohba},
  title =	 {{SOFL}: A Formal Engineering Methodology for
                  Industrial Applications},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 1,
  month =	 jan,
  pages =	 {24-45},
  annote =	 {36 references.}
}

@incollection{Lloyd-Juergens09,
author = {John Lloyd and Jan J\"{u}rjens},
title = {Security {Analysis} of a {Biometric} {Authentication} {System} {Using} {UMLsec} and {JML}},
series = LNCS,
isbn = {978-3-642-04424-3 978-3-642-04425-0},
url = {http://link.springer.com.ezproxy.net.ucf.edu/chapter/10.1007/978-3-642-04425-0_7},
number = 5795,
booktitle = {Model {Driven} {Engineering} {Languages} and {Systems}},
publisher = SV,
editor = {Andy Sch\"{u}rr and Bran Selic},
month = oct,
year = 2009,
note = {DOI: 10.1007/978-3-642-04425-0\_7},
pages = {77-91}
}

@Book{Loeckx-Ehrich-Wolf96,
  author =	 {Jacques Loeckx and Hans-Dieter Ehrich and Markus
                  Wolf},
  title =	 {Specification of Abstract Data Types},
  publisher =	 {John Wiley \& Sons Ltd and B. G. Teubner},
  year =	 1996,
  address =	 NY,
  annote =	 {Many references.}
}

@Book{Loeckx-Sieber87,
  Author =	 "Jacques Loeckx and Kurt Sieber",
  Title =	 "The Foundations of Program Verification (Second
                  edition)",
  Publisher =	 Wiley,
  Year =	 1987,
  Address =	 NY,
  Annote =	 "121 references."
}
                 
@InProceedings{Loeckx85,
  author =	 "J. Loeckx",
  title =	 "The algorithmic specification method of abstract
                  data types: an overview",
  pages =	 "194--200",
  ISBN =	 "3-540-16444-8",
  editor =	 "W. Bibel and K. P. Jantke",
  booktitle =	 "Proceedings of the International Spring School on
                  Mathematical Methods of Specification and Synthesis
                  of Software Systems '85",
  address =	 "Wendisch-Rietz, GDR",
  month =	 apr,
  year =	 "1985",
  series =	 LNCS,
  volume =	 "215",
  publisher =	 SV
}

@Article{Loeckx87,
  Author =	 "Jacques Loeckx",
  Title =	 "Algorithmic Specifications: A Constructive
                  Specification Method for Abstract Data Types",
  Journal =	 TOPLAS,
  Volume =	 9,
  Number =	 4,
  Month =	 oct,
  Year =	 1987,
  Pages =	 "646-685",
  Annote =	 "Specification method and logic. A first-order logic
                  for strict partial functions. 60 references."
}

@InProceedings{Lopez-Herrejon-Batory05,
  Author =	 {Roberto E. Lopez-Herrejon and Don Batory},
  Title =	 {Improving Incremental Development in {AspectJ} by Bounding Quantification},
  BookTitle =	 {SPLAT '05},
  year =	 2005,
  month =	 mar,
  note =         {\url{http://tinyurl.com/25shp3}}
}

@InProceedings{Lorenz97,
  author =	 {David H. Lorenz},
  title =	 {Tiling Design Patterns---A Case Study Using the
                  Interpreter Pattern},
  BookTitle =	 "Conference Proceedings of OOPSLA '97, Atlanta",
  Series =	 SIGPLAN,
  Volume =	 "32(10)",
  Month =	 oct,
  Year =	 1997,
  organization = ACM,
  pages =	 {206-217},
  annote =	 {38 references.}
}

@Article{Loveman77,
  Author =	 "Loveman, D. B.",
  Title =	 "Program Improvement by Source-to-Source
                  Transformation",
  Journal =	 JACM,
  Year =	 1977,
  Month =	 jan,
  Volume =	 24,
  Number =	 1,
  Pages =	 "121-145"
}

@PhDThesis{Low74,
  Title =	 "Automatic Coding: Choice of Data Structures",
  Author =	 "J. R. Low",
  School =	 "Stanford University",
  Year =	 1974
}

@InCollection{Lowe-etal91,
  Author =	 "M. Lowe and H. Ehrig and W. Fey and D. Jacobs",
  Title =	 "On the Relationahip between Algebraic Module
                  Specifications and Program Modules",
  BookTitle =	 "TAPSOFT '91, Proceedings of the International Joint
                  Conference on Theory and Practice of Software
                  Development, Brighton, UK, Volume 2, Advances in
                  Distributed Computing (ADC) and Colloquium on
                  Combining Paradigms for Software Development
                  (CCPSD)",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "S. Abramsky and T. S. E. Maibaum",
  Series =	 LNCS,
  Volume =	 494,
  Pages =	 "83-98",
  Address =	 NY,
  Month =	 apr
}

@inproceedings{Lu-Potter-Xue07,
  author    = {Yi Lu and John Potter and Jingling Xue},
  title     = {Validity Invariants and Effects},
  booktitle = {European Conference on Object-Oriented Programming (ECOOP)},
  year      = {2007},
  pages     = {202-226},
  editor    = {Erik Ernst},
  publisher = SV,
  address = {Berlin},
  series    = LNCS,
  volume    = {4609},
  URL = {http://dx.doi.org/10.1007/978-3-540-73589-2_11}
}

@InProceedings{Lu-Potter06,
  author =	 {Yi Lu and John Potter},
  title =	 {Protecting Representation with Effect Encapsulation},
  booktitle =	 POPL,
  year =	 2006,
  pages =	 {359-371},
  annote =       {33 references.}
}

@Article{Lubars86,
  Author =	 "Mitchell D. Lubars",
  Title =	 "Code Reusability in the Large versus Code
                  Reusability in the Small",
  Journal =	 SIGSOFT,
  Volume =	 11,
  Number =	 1,
  Month =	 jan,
  Year =	 1986,
  Pages =	 "21-28",
  Annote =	 "Interesting discussion of code reuse. Distinguishes
                  the reuse of code by a related program, in the
                  small, from reuse of generic modules, in the
                  large. Argues that neither kind of reuse will have a
                  large impact until they can be combined. 12
                  references."
}

@PhdThesis{Lucas97,
  author =	 {Carine Lucas},
  title =	 {Documenting Reuse and Evolution with Reuse
                  Contracts},
  school =	 {Vrije Universiteit Brussel},
  year =	 1997,
  address =	 {Brussels, Belgium},
  month =	 sep,
  annote =	 {116 references.}
}

@Article{Luckham-Sankar-Takahashi91,
  author =	 {David C. Luckham and Sriram Sankar and Shuzo
                  Takahashi},
  title =	 {Two-Dimensional Pinpointing: Debugging with Formal
                  Specifications},
  journal =	 {IEEE Software},
  year =	 1991,
  volume =	 8,
  number =	 1,
  month =	 jan,
  pages =	 {74-84},
  annote =	 {4 references.}
}

@Article{Luckham-Suzuki79,
  Author =	 "David Luckham and Norihisa Suzuki",
  Title =	 "Verification of Array, Record, and Pointer
                  Operations in {Pascal}",
  Journal =	 TOPLAS,
  Year =	 1979,
  Volume =	 1,
  Number =	 2,
  Month =	 oct,
  Pages =	 "226-244",
  Annote =	 "Verification of complex data
                  structures. Reachability. 21 references."
}

@InCollection{Luckham-Vera-Meldal00,
  Author =	 "David C. Luckham and James Vera and Sigurd Meldal",
  Title =	 "Key Concepts in Architecture Definition Languages",
  BookTitle =	 {Foundations of Component-Based Systems},
  Editor =	 {Gary T. Leavens and Murali Sitaraman},
  Year =	 2000,
  Publisher =	 {Cambridge University Press},
  Address =	 NY,
  ISBN =	 {0-521-77164-1},
  Chapter =	 2,
  Pages =	 "23-45",
  Annote =	 "28 references."
}

@article{Luckham-Vera95,
 author = {David C. Luckham and James Vera},
 title = {An Event-Based Architecture Definition Language},
 journal = IEEETSE,
 volume = 21,
 number = 9,
 year = 1995,
 pages = {717-734}
}
                  
@InCollection{Luckham-etal86,
  Author =	 "D. C. Luckham and D. P. Helmbold and S. Meldal and
                  D. L. Bryan and M. A. Haberler",
  Title =	 "Task sequencing language for specifying distributed
                  {A}da systems",
  BookTitle =	 "System Development and Ada",
  Editor =	 "A. N. Haberman and U. Montanari",
  Series =	 LNCS,
  Volume =	 275,
  Pages =	 "249-305",
  Publisher =	 SV,
  Address =	 NY,
  Month =	 may,
  Year =	 1986
}

@Book{Luckham-etal87,
  Author =	 {David Luckham and Friedrich W. von Henke and Bernd
                  Krieg-Br\"{u}ckner and Olaf Owe},
  Title =	 "{ANNA} - A Language for Annotating {Ada} Programs",
  Series =	 LNCS,
  Volume =	 260,
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1987
}

@Article{Luckham-vonHenke85,
  Author =	 {David Luckham and Friedrich W. von Henke},
  Title =	 "An Overview of {Anna} --- A Specification Language for {Ada}",
  Journal =	 "IEEE Software",
  Volume =	 2,
  Number =	 2,
  Month =	 mar,
  Year =	 1985,
  Pages =	 "9-23"
}

@Book{Luckham90,
  Author =	 "David Luckham",
  Title =	 "Programming with Specifications: An Introduction to
                  Anna, A Language for Specifying Ada Programs",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1990,
  Series =	 "Texts and Monographs in Computer Science",
  Annote =	 "Many references."
}

@InCollection{Lumpe-Achermann-Nierstrasz00,
  Author =	 "Markus Lumpe and Franz Achermann and Oscar
                  Nierstrasz",
  Title =	 "A Formal Language for Composition",
  BookTitle =	 {Foundations of Component-Based Systems},
  Editor =	 {Gary T. Leavens and Murali Sitaraman},
  Year =	 2000,
  Publisher =	 {Cambridge University Press},
  Address =	 NY,
  ISBN =	 {0-521-77164-1},
  Chapter =	 4,
  Pages =	 "69-90",
  Annote =	 "30 references."
}

@Article{Luqi-Berzins-Yeh88,
  Author =	 "Luqi and V. Berzins and R. Yeh",
  Title =	 "A Prototyping Language for Real-Time Software",
  Journal =	 IEEETSE,
  Year =	 1988,
  Volume =	 "SE-14",
  Number =	 10,
  Month =	 oct,
  Pages =	 "1409-1423",
  Annote =	 "PSDL is an enhanced DFD."
}

@Article{Luqi-Goguen97,
  author =	 {Luqi and Joseph A. Goguen},
  title =	 {Formal Methods: Promises and Problems},
  journal =	 {IEEE Software},
  year =	 1997,
  volume =	 14,
  number =	 1,
  month =	 jan,
  pages =	 {73-85},
  annote =	 {19 references.}
}

@InProceedings{Ly-etal20,
author="Dara Ly and Nikolai Kosmatov and Fr{\'e}d{\'e}ric Loulergue and Julien Signoles",
editor="Wolfgang Ahrendt and Heike Wehrheim",
title="Verified Runtime Assertion Checking for Memory Properties",
booktitle="Tests and Proofs",
year="2020",
publisher="Springer International Publishing",
address="Cham",
pages="100--121",
abstract="Runtime Assertion Checking (RAC) for expressive specification languages is a non-trivial verification task, that becomes even more complex for memory-related properties of imperative languages with dynamic memory allocation. It is important to ensure the soundness of RAC verdicts, in particular when RAC reports the absence of failures for execution traces. This paper presents a formalization of a program transformation technique for RAC of memory properties for a representative language with memory operations. It includes an observation memory model that is essential to record and monitor memory-related properties. We prove the soundness of RAC verdicts with regard to the semantics of this language.",
isbn="978-3-030-50995-8",
annote="33 references."
}


@MastersThesis{Lyle92,
  Author =	 "Kari Ann Lyle",
  Title =	 "Refinement in Data Flow Diagrams",
  School =	 "Iowa State University",
  Year =	 1992,
  Address =	 "Ames, Iowa 50011",
  Month =	 jul,
  Annote =	 "9 references."
}

@inproceedings{Lyu00,
 author = {Michael R. Lyu},
 title = {Software Reliability Engineering: A Roadmap},
 booktitle = {FOSE '07: 2007 Future of Software Engineering},
 year = {2007},
 pages = {153--170},
 doi = {http://dx.doi.org/10.1109/FOSE.2007.24},
 publisher = {IEEE Computer Society},
 address = {Washington, DC, USA}
}

@Article{MacEwen-Martin81,
  Author =	 "Glenn H. MacEwen and T. Patrick Martin",
  Title =	 "Abstraction Hierarchies in Top-Down Design",
  Journal =	 "The Journal of Systems and Software",
  Volume =	 2,
  Number =	 3,
  Month =	 sep,
  Pages =	 "213-224",
  Year =	 1981,
  Annote =	 "Use of data and procedural abstractions in top-down
                  design. 32 references."
}

@Book{Maciaszek01,
  author =	 {Leszek A. Maciaszek},
  title =	 {Requirements Analysis and System Design},
  publisher =	 {Addison-Wesley},
  year =	 2001,
  annote =	 {Many references}
}

@InCollection{Maddux93,
  author =	 "Roger D. Maddux",
  title =	 "Relation Algebras for Reasoning about Time and
                  Space",
  booktitle =	 "Algebraic Methodology and Software Technology (AMAST
                  '93)",
  publisher =	 SV,
  year =	 1993,
  editor =	 "M. Nivat and C Rattray and T. Rus and G. Scollo",
  series =	 "Workshops in Computing",
  pages =	 "27-44",
  address =	 NY,
  annote =	 "45 references."
}

@InCollection{Magee-Kramer05,
  author = 	 {Jeff Magee and Jeff Kramer},
  title = 	 {Model-Based Design of Concurrent Programs},
  booktitle = 	 {Communicating Sequential Processes: The First 25 Years},
  pages = 	 {211-219},
  publisher =    SV,
  address =      "Berlin",
  series =       LNCS,
  volume =       3525,
  year = 	 2005,
  URL =          {http://dx.doi.org/10.1007/11423348_11}
}

@InProceedings{Mahony-Dong98,
  author =	 {Brendan Mahony and Jin Song Dong},
  title =	 {Blending {Object-Z} and {Timed CSP}: An Introduction
                  to {TCOZ}},
  booktitle =	 {Proceedings of the 1998 International Conference on
                  Software Engineering: ICSE 98, Kyoto, Japan},
  year =	 1998,
  organization = IEEE,
  address =	 {Los Alamitos, California},
  month =	 apr,
  pages =	 {95-104},
  annote =	 {18 references.}
}                  

@PhdThesis{Mahony92,
  author =	 {B. P. Mahony},
  title =	 {The Specification and Refinement of Timed Processes},
  school =	 {University of Queensland},
  year =	 1992
}

@TechReport{Maibaum-Fiadeiro-Sadler90,
  author =	 {T. Maibaum and J. Fiadeiro and M. Sadler},
  title =	 {Stepwise program development in $\pi$-institutions},
  institution =	 {Imperial College of Science, Technology and
                  Medicine, Department of Computing},
  year =	 1990
}

@InCollection{Maibaum-Sadler85,
  author =	 {T. Maibaum and M. Sadler},
  title =	 {Axiomatising specification theory},
  booktitle =	 {Recent Trends in Data Type Specification},
  publisher =	 SV,
  year =	 1985,
  editor =	 {H.-J. Kreowski},
  number =	 116,
  address =	 NY,
  series =	 {Informatik-Facberichte},
  pages =	 {171-177}
}

@inproceedings{Maibaum00,
 author = {Tom Maibaum},
 title = {Mathematical Foundations of Software Engineering: A Roadmap},
 booktitle = {ICSE '00: Proceedings of the Conference on The Future of Software Engineering},
 year = {2000},
 pages = {161-172},
 location = {Limerick, Ireland},
 publisher = {ACM},
 address = {New York, NY, USA},
 doi = {http://doi.acm.org/10.1145/336512.336548}
}

@techreport{Manasse-Nelson84,
  author    = "M. S. Manasse and C. G. Nelson",
  title     = "Correct compilation of control structures",
  institution="AT\&T Bell Laboratories",
  month     = sep,
  year      = 1984
}

@InProceedings{Manca-Salibra-Scollo89,
  Author =	 "V. Manca and A. Salibra and G. Scollo",
  Title =	 "On the Nature of {TELLUS} (a Typed Equational Logic
                  Look over Uniform Specification)",
  BookTitle =	 "International Symposium on Mathematical Foundations
                  of Computer Science, Rytro, Poland",
  Month =	 aug,
  Year =	 1989,
  Publisher =	 SV,
  Annote =	 "Unifying equational initiality with type assignment
                  to provide better treatment of partial functions in
                  equational specs."
}

@Book{Manes92,
  Author =	 "Ernest G. Manes",
  Title =	 "Predicate Transformer Semantics",
  Publisher =	 "Cambridge University Press",
  Year =	 1992,
  Series =	 "Cambridge tracts in theoretical computer science,
                  v.33",
  Address =	 NY
}

@Book{Manna-Pnueli92,
  Author =	 "Zohar Manna and Amir Pnueli",
  Title =	 "The Temporal Logic of Reactive and Concurrent
                  Systems",
  Publisher =	 SV,
  Year =	 1992,
  Address =	 NY,
  Annote =	 "Many references."
}

@Article{Manna-Waldinger78,
  Author =	 "Zohar Manna and Richard Waldinger",
  Title =	 "The Logic of Computer Programming",
  Journal =	 IEEETSE,
  Year =	 1978,
  Volume =	 "SE-4",
  Number =	 3,
  Month =	 may,
  Pages =	 "199-229",
  Annote =	 "87 references."
}

@Article{Manna-Waldinger78a,
  Author =	 "Zohar Manna and Richard Waldinger",
  Title =	 "Is 'Sometime' Sometimes Better that 'Always'?
                  Intermittent Assertions in Proving Program
                  Correctness",
  Journal =	 CACM,
  Year =	 1978,
  Volume =	 21,
  Number =	 2,
  Month =	 feb,
  Pages =	 "159-172",
  Annote =	 "18 references."
}

@Article{Manna-Waldinger79,
  Author =	 "Z. Manna and R. Waldinger",
  Title =	 "Synthesis: Dreams => Programs",
  Journal =	 IEEETSE,
  Year =	 1979,
  Month =	 jul,
  Volume =	 "SE-5",
  Number =	 4,
  Pages =	 "294-328"
}

@Article{Manna-Waldinger80,
  Author =	 "Zohar Manna and Richard Waldinger",
  Title =	 "A Deductive Approach to Program Synthesis",
  Journal =	 TOPLAS,
  Year =	 1980,
  Month =	 jan,
  Volume =	 2,
  Number =	 1,
  Pages =	 "90-121",
  Annote =	 "Systematic derivation of program from
                  specification. Deductive approach using
                  transformation rules, unification, and induction to
                  drive its theorem proving method. 14 references."
}

@Article{Manna-Waldinger81,
  Author =	 "Z. Manna and R. Waldinger",
  Title =	 "Problematic Features of programming Languages: A
                  Situational-Calculus Approach",
  Journal =	 "Acta Informatica",
  Year =	 1981,
  Volume =	 16,
  Pages =	 "371-426"
}

@Article{Manna-Waldinger92,
  Author =	 "Zohar Manna and Richard Waldinger",
  Title =	 "Fundamentals of Deductive Program Synthesis",
  Journal =	 IEEETSE,
  Year =	 1992,
  Volume =	 18,
  Number =	 8,
  Month =	 aug,
  Pages =	 "674-704",
  Annote =	 "Good article, on deduction tableaus. 47 references."
}

@Book{Manna-Waldinger93,
  Author =	 "Zohar Manna and Richard Waldinger",
  Title =	 "The Deductive Foundations of Computer Programming",
  Publisher =	 "Addison-Wesley",
  Year =	 1993,
  Address =	 NY,
  Annote =	 "A one volume version of ``The Logical Basis for
                  Computer Programming.'' Annotated bibliography."
}

@techreport{Marceau94,
  author = "Carla Marceau",
  title = "Penelope Reference Manual, Version 3-3",
  institution = "Odyssey Research Associates, Inc.",
  address = "301 Dates Drive, Ithaca, NY 14850-1326, U.S.A.",
  number = "TM-94-0040",
  month = jul,
  year = 1994
}

@article{Marche-Paulin-Mohring-Urbain04,
  author    = {Claude March{\'e} and Christine Paulin-Mohring and
               Xavier Urbain},
  title     = {The {KRAKATOA} tool for certification of {JAVA}/{JAVACARD} programs annotated in {JML}},
  journal = "Journal of Logic and Algebraic Programming",
  volume    = {58},
  number    = {1-2},
  month = jan # "--" # mar,
  year      = {2004},
  pages     = {89-106},
  URL = {http://dx.doi.org/10.1016/j.jlap.2003.07.006}
}

@InProceedings{Marche-Paulin-Mohring05,
  author =    {Claude March{\'e} and Christine Paulin-Mohring},
  title =     {Reasoning about {J}ava programs with aliasing and frame conditions},
  booktitle = {Theorem Proving in Higher Order Logics, 18th
                  International Conference, TPHOLs 2005},
  pages =     {179-194},
  year =      2005,
  editor =    {Joe Hurd and Thomas F. Melham},
  volume =    3603,
  series =    LNCS,
  month =     aug,
  publisher = SV,
  address = {Berlin}
}

@Inproceedings{Maret-Rubel-Beney99,
	author 		= {Pierre Maret and Paul Rubel and Jean Beney},
	title 		= {Multimedia Information Interchange: Web Forms Meet Data Servers},
	booktitle = {1999 IEEE International Conference on Multimedia Computing and Systems},
	volume 		= {02},
	year 			= {1999},
	issn 			= {1530-2032},
	pages 		= {499},
	doi 			= {http://doi.ieeecomputersociety.org/10.1109/MMCS.1999.778522},
	publisher = {IEEE Computer Society},
	address 	= {Los Alamitos, CA, USA}
}

@TechReport{Markland98,
  Author =	 "Matthew W. Markland",
  Title =	 "Design and Implementation of the {Larch/C++} Type
                  System",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "226 Atanasoff Hall, Ames, IA 50011-1040",
  Month =	 jun,
  Year =	 1998,
  Number =	 "98-05",
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR98-05/TR.ps.gz",
  Note =	 "Available by anonymous ftp from
                  \url{ftp.cs.iastate.edu} or by e-mail from
                  almanac@cs.iastate.edu.",
  Annote =	 "14 references."
}

@TechReport{Marshall86,
  Author =	 "Lynn S. Marshall",
  Title =	 "A Formal Description Method for User Interfaces",
  Institution =	 "Department of Computer Science, University of
                  Manchester",
  Address =	 "Manchester M13 9PL, England",
  Number =	 "UMCS-87-1-2",
  Month =	 oct,
  Year =	 1986,
  Note =	 "The author's Ph.D. dissertation.",
  Annote =	 "Hybrid of transition-state diagrams and abstract
                  model specs. Over a hundred references."
}

@Proceedings{Martin-Wing93,
  Title =	 "Proceedings of the First International Workshop on
                  Larch, July, 1992",
  Publisher =	 SV,
  Editor =	 "U. Martin and J. Wing",
  Series =	 "Workshops in Computing",
  Address =	 NY,
  Year =	 1993
}

@Book{Martin03,
  author =	 {Robert Cecil Martin},
  title = 	 {Agile Software Development: Principles, Patterns, and Practices},
  publisher = 	 {Prentice Hall},
  year = 	 2003,
}

@InCollection{Martin92,
  Author =	 "T. Martin",
  Title =	 "Realtime Programming Language PEARL - Concepts and
                  Characteristics",
  BookTitle =	 "Real-Time Systems: Abstractions, Languages, and
                  Design Methodologies",
  Publisher =	 "IEEE Computer Society Press",
  Year =	 1992,
  Editor =	 "Krishna M. Kavi",
  Pages =	 "439-444",
  Address =	 "Los Alamitos, California",
  Month =	 oct,
  Annote =	 "0 references."
}

@article{Martin96,
  author =	 {Mike A. Martin},
  title =	 {Effective Use of Assertions in {C++}},
  journal =	 SIGPLAN,
  year =	 {1996},
  month =	 nov,
  volume =	 {31},
  number =	 {11},
  pages =	 {28-32},
  annote =	 {refer to Rosenblum95, Winkler-Kauer97, Curcio98}
}

@InCollection{Martin98b,
  author =	 {Robert C. Martin},
  title =	 {Acyclic Visitor},
  booktitle =	 {Pattern Languages of Program Design 3},
  publisher =	 {Addison-Wesley Publishing Co.},
  address =	 {Reading, MA},
  year =	 1998,
  editor =	 {Robert C. Martin and Dirk Riehle and Frank
                  Buschmann},
  pages =	 {93-104}
}

@InProceedings{Mason-Talcott89,
  Author =	 "Ian A. Mason and Carolyn Talcott",
  Title =	 "Axiomatizing Operational Equivalence in the presence
                  of Side Effects",
  BookTitle =	 "Fourth Annual Symposium on Logic in Computer
                  Science, Pacific Grove, California",
  Organization = IEEE,
  Month =	 jun,
  Year =	 1989,
  Pages =	 "284-293",
  Annote =	 "Reasoning about programs with side effects. 15
                  references."
}

@InCollection{Mason-Talcott90,
  Author =	 "Ian Mason and Carolyn Talcott",
  Title =	 "Reasoning about programs with effects",
  BookTitle =	 "Programming Language Implementation and Logic
                  Programming: International Workshop PLILP '90
                  Proceedings",
  Publisher =	 SV,
  Year =	 1990,
  Editor =	 "P. Deransart and J. Maluszynski",
  Series =	 LNCS,
  Volume =	 456,
  Pages =	 "189-203",
  Month =	 aug,
  Annote =	 "13 references."
}

@book{Massol-OBrien05a,
	Author = {Vincent Massol and Timothy M. O'Brien},
	Title = {{Maven}: A Developer's Notebook},
	Publisher = {O'Reilly},
	Address = {Sebastopol, CA},
	Year = {2005}
}

@unpublished{Matisse03,
  author    = {{Matisse Partners}},
  title     = {Matisse: Methodologies and technologies for industrial strength systems engineering},
  year      = 2003,
  note = {\url{http://www.matisse.qinetiq.com/}}
}

@Article{Matsuura-Kuruma-Honiden97,
  Author =	 "Saeko Matsuura and Hironobu Kuruma and Shinichi
                  Honiden",
  title =	 "{EVA}: A Flexible Programming Method for Evolving
                  Systems",
  journal =	 IEEETSE,
  pages =	 "296-313",
  month =	 may,
  year =	 1997,
  volume =	 23,
  number =	 5,
  annote =	 "27 references."
}

@InProceedings{Maung-Howse-Mitchel94,
  Author =	 "I. Maung and J. R. Howse and R. J. Mitchell",
  Title =	 "Towards a Formalization of
                  Programming-by-Difference",
  booktitle =	 "{FME '94}: Industrial Benefits of Formal Methods",
  publisher =	 SV,
  year =	 1995,
  editor =	 "Maurice Naftalin and Tim Denvir and Miquel Bertran",
  volume =	 873,
  series =	 LNCS,
  pages =	 "134-153",
  address =	 NY,
  annote =	 "26 references."
}

@InProceedings{Maung-Howse93,
  Author =	 {I. Maung and J. R. Howse},
  Title =	 {Introducing {Hyper-Z} -- A New Approach to Object
                  Orientation in {Z}},
  Crossref =	 "Bowen-Nicholls93",
  Pages =	 "149-165"
}

@Article{Maurer00,
  author = 	 {Peter M. Maurer},
  title = 	 {Components: What If They Gave a Revolution and Nobody Came?},
  journal = 	 {Computer},
  year = 	 2000,
  volume =	 33,
  number =	 6,
  pages =	 {20-34},
  month =	 jun,
  annote =	 {Mostly discusses Visual Basic. 3 references.}
}

@Book{Maurer03,
  author =	 {Peter Maurer},
  title = 	 {Component-Level Programming},
  publisher = 	 {Prentice-Hall},
  year = 	 2003,
  address =	 {Upper Saddle River, NJ}
}

@article{McBride-McKinna04,
  author="C. McBride and J. McKinna",
  title={The View from the Left},
  journal="Journal of Functional Programming",
  year=2004,
  volume=14,
  number=1
}

@Book{McConnell93,
  author = {Steve McConnell},
  title = {Code Complete: A practical handbook of software construction},
  publisher = {Microsoft Press},
  address = {Buffalo, NY},
  year = 1993
}
@Article{McCullough92,
  Author =	 "Paul McCullough",
  Title =	 "Reuse: Truth or Fiction",
  Journal =	 SIGPLAN,
  Volume =	 27,
  Number =	 10,
  Month =	 oct,
  Year =	 1992,
  Pages =	 "44",
  Note =	 "{\em OOPSLA '92 Proceedings}, Andreas Paepcke
                  (editor)."
}

@TechReport{McCurley89,
  Author =	 "E. Robert McCurley",
  Title =	 "Auxiliary Variables in Partial Correctness
                  Programming Logics",
  Institution =	 "School of Information and Computer Science, Georgia
                  Institute of Technology",
  Month =	 nov,
  Year =	 1989,
  Number =	 "GIT-ICS-89/44",
  Annote =	 "Unsoundness of the rule for eliminating auxiliary
                  variables in the Owicki-Gries logic for partial
                  correctness of parallel programs. 9 references."
}

@Book{McGettrick82,
  author =	 {A. D. McGettrick},
  title =	 {Program Verification using Ada},
  publisher =	 {Cambridge University Press},
  year =	 1982,
  number =	 13,
  series =	 {Cambridge Computer Science Texts},
  address =	 {Cambridge, UK},
  annote =	 {Many references.}
}

@Article{Mead-Carter97,
  author =	 {Nancy Mead and David Carter and Michael Lutz},
  title =	 {The State of Software Engineering Education and
                  Training},
  journal =	 {IEEE Software},
  year =	 1997,
  volume =	 14,
  number =	 6,
  month =	 nov,
  pages =	 {22-25},
  annote =	 {Introduction to special issue.}
}

@Book{Mead-Shende02,
  author =	 {Jerud J. Mead and Anil M. Shende},
  title = 	 {A Guide to Persuasive Programming in Java},
  publisher = 	 {Franklin, Beedle \& Associates, Inc},
  year = 	 2002,
  annote =	 {Persuasion means writing assertions that convince the reader of a program's correctness.}
}

@InProceedings{Mechtaev-Yi-Roychoudhury16,
author={Sergey Mechtaev and Jooyong Yi and Abhik Roychoudhury},
booktitle={2016 IEEE/ACM 38th International Conference on Software Engineering (ICSE)},
title={Angelix: Scalable Multiline Program Patch Synthesis via Symbolic Analysis},
year={2016},
publisher=IEEE,
address="Los Altos",
pages={691-701},
doi={10.1145/2884781.2884807}
}

@Book{Meertens86,
  Editor =	 "L. G. L. T Meertens",
  Title =	 "Program Specification and Transformation",
  Publisher =	 "North-Holland",
  Year =	 1987
}

@Article{Mehta-Nipkow05,
  Author =	 "Farhad Mehta and Tobias Nipkow",
  Title =	 "Proving pointer programs in higher-order logic",
  Journal =	 "Information and Computation",
  Volume =	 159,
  Pages =	 "200-227",
  Month =	 may,
  Year =	 2005,
  Annote =       "20 references."
}

@inproceedings{Meijer-Poll01,
  author =	 {H. Meijer and E. Poll},
  title =	 {Towards a full formal specification of the {Java
                  Card API}},
  editor =	 {I. Attali and T. Jensen},
  booktitle =	 {Smart Card Programming and Security},
  month =	 {September},
  series =	 LNCS,
  publisher =	 SV,
  year =	 {2001},
  number =	 {2140},
  pages =	 {165-178},
}

@InCollection{Meira-Cavalcanti-Santos94,
  author =	 "Silvio Lemos Meira and Ana L\'{u}cia C. Cavalcanti
                  and Cassio Souza Santos",
  title =	 "The {Unix} Filing System: A {MooZ} Specification",
  booktitle =	 "Object-Oriented Specification Case Studies",
  publisher =	 "Prentice-Hall",
  year =	 1994,
  editor =	 "Kevin Lano and Howard Haughton",
  series =	 "The Object-Oriented Series",
  chapter =	 4,
  Crossref =	 "Lano-Haughton94",
  pages =	 "80-109",
  address =	 NY
}

@InCollection{Meira-Cavalcanti92,
  author =	 "Silvio Lemos Meira and Ana L\'{u}cia C. Cavalcanti",
  title =	 "{MooZ} Case Studies",
  Editor =	 "Susan Stepney and Rosalind Barden and David Cooper",
  BookTitle =	 "Object Orientation in {Z}",
  Publisher =	 SV,
  Year =	 1992,
  Address =	 "Cambridge CB2 1LQ, UK",
  Series =	 "Workshops in Computing",
  Crossref =	 "Stepney-Barden-Cooper92",
  Pages =	 "37-58"
}

@Book{Mellor-etal04,
  author =	 {Stephen J. Mellor and Kendall Scott and Axel Uhl and Dirk Weise},
  title = 	 {MDA Distilled: Principles of Model-Driven Architecture},
  publisher = 	 {Addison-Wesley},
  year = 	 2004,
  address =	 "Boston",
  annote =	 {14 references}
}

@TechReport{Melton-etal88,
  Author =	 "Austin C. Melton and Albert L. Baker and James
                  M. Bieman and David M Gustafson",
  Title =	 "A Mathematical Perspective for Software Measures
                  Research",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Number =	 "88-5",
  Month =	 jan,
  Year =	 1988,
  Annote =	 "46 references."
}

@Article{Melton-etal90,
  Author =	 "Austin C. Melton and David M Gustafson and James
                  M. Bieman and Albert L. Baker ",
  Title =	 "A Mathematical Perspective for Software Measures
                  Research",
  Journal =	 "Software Engineering Journal",
  Volume =	 5,
  Number =	 5,
  Month =	 sep,
  Year =	 1990,
  Pages =	 "246-254"
}

@TechReport{Mertens-etal02,
  Author =	 {Kristof Mertens and Nele Smeets and Marko van Dooren
                  and Jan Fockx and Eric Steegmans},
  Title =	 {A New Semantics for {JML} Signals Clauses},
  Institution =	 {Katholieke Universiteit Leuven},
  Year =	 2002,
  Number =	 {CW 343},
  Month =	 jun,
  Address =	 {Celestijnenlaan 200A - B-3001 Heverlee, Belgium},
  Url =
                  {http://www.cs.kuleuven.ac.be/publicaties/rapporten/cw/CW343.abs.html}
}

@Book{Merx-Norman07,
  author =	 {Georges G. Merx and Ronald J. Norman},
  title = 	 {Unified Software Engineering with Java},
  publisher = 	 {Pearson Education Inc.},
  year = 	 2007
}

@InCollection{Meseguer-Goguen85,
  Title =	 "Initiality, Induction and Computability",
  Author =	 "Jos\'e Meseguer and Joseph Goguen",
  BookTitle =	 "Algebraic Methods in Semantics",
  Editor =	 "Maurice Nivat and John Reynolds",
  Publisher =	 "Cambridge University Press",
  Address =	 "Cambridge",
  Year =	 1985,
  Pages =	 "459-541"
}

@Unpublished{Meseguer-Talcott98,
  author = 	 {Jose Meseguer and Carolyn Talcott},
  title = 	 {Achieving Formal Interoperability},
  note = 	 {\url{http://www-formal.stanford.edu/clt/InterOp/98seke.txt}},
  month =	 jun,
  year =	 1998
}

@Article{Metayer-Nicolas-Ridoux98,
  author =	 {Daniel M\'{e}tayer and Val\'{e}rie-Anne Nicolas and
                  Oliver Ridoux},
  title =	 {Exploring the Software Development Trilogy},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 6,
  month =	 nov,
  pages =	 {75-81},
  annote =	 {Automated test generation based on machine learning
                  techniques. 17 references.}
}

@InCollection{Meusel-Czarnecki-Koepf97,
  author =	 {Matthias Meusel and Krzysztof Czarnecki and Wolfgang
                  K\"{o}pf},
  title =	 {A Model for Structuring User Documentation of
                  Object-Oriented Frameworks using Patterns and
                  Hypertext},
  booktitle =	 {ECOOP '97 --- Object-Oriented Programming 11th
                  European Conference, Jyv\"{a}skyl\"{a}, Finland},
  publisher =	 SV,
  year =	 1997,
  editor =	 {Mehmet Ak\c{s}it and Satoshi Matsuoka},
  volume =	 1241,
  series =	 LNCS,
  address =	 NY,
  month =	 jun,
  pages =	 {496-510},
  annote =	 {34 references.}
}

@Article{Meyer-Arnout06,
  author = 	 {Bertrand Meyer and Karine Arnout},
  title = 	 {Componentization: The {Visitor} Example},
  journal = 	 {Computer},
  year = 	 2006,
  volume =	 39,
  number =	 7,
  pages =	 {23-30},
  month =	 jul,
  annote =	 {11 references.}
}

@inproceedings{Meyer-Poetzsch-Heffter00,
  Author =       {J. Meyer and A. Poetzsch-Heffter},
  Title =        {An Architecture for interactive Program Provers},
  BookTitle =    {Tools and Algorithms for the Construction and
                  Analysis of Systems},
  Editor =       {S. Graf and M. Schwartzbach},
  Series =       LNCS,
  Publisher =    SV,
  Volume =       1785,
  Pages =        {63-77},
  annote =       {Main reference for the JIVE verification system.},
  Year =         2000
}

@InBook{Meyer-Wieringa93a,
  author =	 "John-Jules Ch. Meyer and Roel J. Wieringa",
  title =	 "Deontic Logic: A Concise Overview",
  chapter =	 1,
  crossref =	 "Meyer-Wieringa93",
  pages =	 "3-16",
  annote =	 "Historical survey. Many references."
}

@InBook{Meyer-Wieringa93b,
  author =	 "Roel J. Wieringa and John-Jules Ch. Meyer",
  title =	 "Applications of Deontic Logic in Computer Science: A
                  Concise Overview",
  chapter =	 2,
  crossref =	 "Meyer-Wieringa93",
  pages =	 "17-40",
  annote =	 "Many references."
}

@Article{Meyer85,
  Author =	 "B. Meyer",
  Title =	 "On Formalism in Specification",
  Journal =	 "IEEE Software",
  Month =	 jan,
  Year =	 1985,
  Pages =	 "6-26"
}

@Article{Meyer90b,
  Author =	 "Bertrand Meyer",
  Title =	 "Lessons from the Design of the Eiffel Libraries",
  Journal =	 CACM,
  Year =	 1990,
  Volume =	 33,
  Number =	 9,
  Month =	 sep,
  Pages =	 "69-88",
  Annote =	 "20 references."
}

@Article{Meyer92a,
  Author =	 "Bertrand Meyer",
  Title =	 "Applying `Design by Contract'",
  Journal =	 "Computer",
  Year =	 1992,
  Volume =	 25,
  Number =	 10,
  Month =	 oct,
  Pages =	 "40-51",
  Annote =	 "10 references."
}

@Article{Meyer98,
  author =	 {Bertrand Meyer},
  title =	 {Prelude to a Theory of Void},
  journal =	 JOOP,
  year =	 1998,
  volume =	 11,
  number =	 7,
  month =	 nov,
  pages =	 {36-48},
  annote =	 {How to avoid null pointer dereferences. No
                  references.}
}

@inproceedings{Meyers-Reiss92,
 author = {Scott Meyers and Steven P. Reiss},
 title = {An empirical study of multiple-view software development},
 booktitle = {SDE 5: Proceedings of the fifth ACM SIGSOFT symposium on
 Software development environments},
 year = {1992},
 isbn = {0-89791-554-2},
 pages = {47--57},
 location = {Tyson's Corner, Virginia, United States},
 doi = {http://doi.acm.org/10.1145/142868.142913},
 publisher = {ACM},
 address = {New York, NY, USA},
}

@Book{Meyers75,
  Author =	 "G. J. Meyers",
  Title =	 "Reliable Software Through Composite Design",
  Publisher =	 "Petrocelli/Charter",
  Year =	 1975
}

@InProceedings{Mezini-Lieberherr98,
  author =	 {Mira Mezini and Karl Lieberherr},
  title =	 {Adaptive Plug-and-Play Components for Evolutionary
                  Software Development},
  BookTitle =	 "OOPSLA '98 Conference Proceedings",
  Series =	 SIGPLAN,
  Volume =	 "33(10)",
  Month =	 oct,
  Year =	 1998,
  organization = ACM,
  pages =	 {97-116},
  annote =	 {31 references.}
}

@inproceedings{Mezini-Ostermann02,
	Author = {Mira Mezini and Klaus Ostermann},
	Title = {Integrating independent components with on-demand remodularization},
	Crossref = {OOPSLA02},
	Pages = {52-67},
	Annote = {http://doi.acm.org/10.1145/582419.582426 1-58113-471-1}
}

@inproceedings{Mezini-Ostermann03,
 author = {Mira Mezini and Klaus Ostermann},
 title = {Conquering aspects with {Caesar}},
 booktitle = {AOSD 03},
 pages = {90-99},
 location = {Boston, Massachusetts}
}
                  
@InProceedings{Mezini-Ostermann04,
	Author = {Mira Mezini and Klaus Ostermann},
	Title = {Variability Management with Function Oriented Programming and Aspects},
	Crossref = {FSE-04},
	Pages = {137--146}
}

@Article{Mezini97,
  author =	 {Mira Mezini},
  title =	 {Maintaining The Consistency and Behavior of Class
                  Libraries During their Evolution},
  Journal =	 SIGPLAN,
  volume =	 32,
  number =	 10,
  month =	 oct,
  year =	 1997,
  publisher =	 ACM,
  pages =	 {1-21},
  note =	 "{\em Conference Proceedings of OOPSLA '97}.",
  annote =	 {25 references.}
}

@inproceedings{Middelkoop-etal05,
  author =       "Ronald Middelkoop and Cornelis Huizing and Ruurd
                  Kuiper and Erik Luit",
  title =        "Cooperation-Based Invariants for {OO} Languages",
  booktitle =    "Proceedings of the International Workshop on Formal
                  Aspects of Component Software ({FACS'05})",
  year =         2005
}

@InProceedings{Mikhajlov-Sekerinski-Laibinis99,
  author =	 {Leonid Mikhajlov and Emil Sekerinski and Linus
                  Laibinis},
  title =	 {Developing Components in the Presence of
                  Re-entrance},
  editor =	 {Jeannette M. Wing and Jim Woodcock and Jim Davies},
  booktitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  series =	 LNCS,
  publisher =	 SV,
  pages =	 {1301-1320},
  number =	 1709,
  year =	 1999,
  annote =       "19 references."
}

@InProceedings{Mikhajlov-Sekerinski98,
  author =	 "Leonid Mikhajlov and Emil Sekerinski",
  title =	 "A Study of the Fragile Base Class Problem",
  booktitle =	 "ECOOP '98 --- Object-Oriented Programming, 12th
                  European Conference, Brussels, Proceedings",
  publisher =	 SV,
  editor =	 "Eric Jul",
  month =	 jul,
  series =	 LNCS,
  volume =	 1445,
  year =	 1998,
  pages =	 "355--382",
  annote =	 "32 references.",
  URL =          {http://dx.doi.org/10.1007/BFb0054099}
}

@InProceedings{Mikhajlova-Sekerinski97,
  author =	 {Anna Mikhajlova and Emil Sekerinski},
  title =	 {Class refinement and interface refinement in
                  object-oriented programs},
  booktitle =	 {FME '97: Industrial Applications and Stengthened
                  Foundations of Formal Metohds},
  editor =	 {John Fitzgerald and Cliff B. Jones and Peter Lucas},
  volume =	 1313,
  series =	 LNCS,
  year =	 1997,
  publisher =	 SV,
  address =	 {NY},
  pages =	 {82-101}
}

@InProceedings{Mikhajlova98,
  Author =	 "Anna Mikhajlova",
  Title =	 "Refinement of Generic Classes as Semantics of
                  Correct Polymorphic Reuse",
  BookTitle =	 "Proceedings of the International Refinement
                  Workshop, and Formal Methods Pacific {(IRW/FMP'98)}",
  Year =	 1998,
  Series =	 "Springer Series in Discrete Mathematics and
                  Theoretical Computer Science",
  Publisher =	 SV,
  Pages =	 "266-285",
  Address =	 NY,
  Month =	 "Jul"
}

@InProceedings{Mikhajlova98b,
  Author =	 "Anna Mikhajlova",
  Title =	 "Consistent Extension of Components in Presence of
                  Explicit Invariants",
  EDITOR =	 "Wolfgang Weck and Jan Bosch and Clemens Szyperski",
  YEAR =	 1998,
  MONTH =	 jul,
  BOOKTITLE =	 "Third International Workshop on Component-Oriented
                  Programming (WCOP'98) held in conjunction with
                  ECOOP'98",
  PUBLISHER =	 "{TUCS} General Publication Series, No. 10",
  ISBN =	 "952-12-0284-X"
}

@InProceedings{Mikkonen98,
  author =	 {Tommi Mikkonen},
  title =	 {Formalizing Design Patterns},
  booktitle =	 {Proceedings of the 1998 International Conference on
                  Software Engineering: ICSE 98, Kyoto, Japan},
  year =	 1998,
  organization = IEEE,
  address =	 {Los Alamitos, California},
  month =	 apr,
  pages =	 {115-124},
  annote =	 {The DisCo method. 17 references.}
}

@Article{Mili-Desharnais-Gagne86,
  Author =	 "Ali Mili and Jules Desharnais and Jean Raymond
                  Gagne",
  Title =	 "Formal Models of Stepwise Refinement of Programs",
  Journal =	 ACMCS,
  Volume =	 18,
  Number =	 3,
  Month =	 sep,
  Year =	 1986,
  Pages =	 "231-276",
  Annote =	 "Comparison of three specification and decomposition
                  techniques: pairs of Floyd-Hoare assertions,
                  functions mapping admissible input states to correct
                  final states as used by Mills, and relations
                  containing the input/output pairs considered
                  correct. 53 references."
}

@Book{Mili-Desharnais-Mili94,
  author =	 "Ali Mili and Jules Desharnais and Fatma Mili",
  title =	 "Computer Program Construction",
  publisher =	 "Oxford University Press",
  year =	 1994,
  address =	 NY,
  annote =	 "Relations as a basic tool. Does not use the general
                  model. 83 references."
}

@Article{Mills-Dyer-Linger87,
  Author =	 "Harlan D. Mills and Michael Dyer and Richard Linger",
  Title =	 "Cleanroom Software Engineering",
  Journal =	 "IEEE Software",
  Volume =	 4,
  Number =	 5,
  Month =	 sep,
  Year =	 1987,
  Pages =	 "19-25",
  Annote =	 "Defect prevention using human mathematical
                  verification. Statstical certification. 10
                  references."
}

@InProceedings{Mills71,
  Title =	 "Top Down Programming in Large Systems",
  Author =	 "H. D. Mills",
  BookTitle =	 "Debugging Techniques in Large Systems",
  Editor =	 "R. Rustin",
  Organization = "Courant Computer Science Symposium 1",
  Year =	 1971,
  Pages =	 "41-55",
  Publisher =	 Prentice-Hall,
  Address =	 "Englewood Cliffs, N.J."
}

@InCollection{Mills73a,
  Author =	 "H. D. Mills",
  Title =	 "The Complexity of Programs",
  BookTitle =	 "Program Test Methods",
  Editor =	 "W. C. Hetzel",
  Year =	 1973,
  Publisher =	 Prentice-Hall,
  Address =	 "Englewood Cliffs, N.J."
}

@InProceedings{Mills73b,
  Author =	 "H. D. Mills",
  Title =	 "On the Development of Large Reliable Programs",
  BookTitle =	 "Proceedings of the IEEE Symposium on Computer
                  Software Reliability",
  Organization = IEEE,
  Year =	 1973,
  Pages =	 "155-159"
}

@InProceedings{Mills75,
  Title =	 "How to Write Correct Programs and Know It",
  Author =	 "H. D. Mills.",
  BookTitle =	 "Proceedings of the International Conference on
                  Reliable Software",
  Organization = SIGPLAN,
  Year =	 1975,
  Month =	 jun,
  Pages =	 "363-370"
}

@Article{Mills86,
  Author =	 "Harlan D. Mills",
  Title =	 "Structured Programming: Retrospect and Prospect",
  Journal =	 "IEEE Software",
  Volume =	 3,
  Number =	 6,
  Month =	 nov,
  Year =	 1986,
  Pages =	 "58-66",
  Annote =	 "Review of the history and fundamentals of structured
                  programming. The structure theorem, the top-down
                  corollary, correctness and verification. Functional
                  verification. 15 references."
}

@Article{Mills88,
  Author =	 "Harlan D. Mills",
  Title =	 "Stepwise Refinement and Verification in
                  Box-Structured Systems",
  Journal =	 "IEEE Computer",
  Volume =	 21,
  Number =	 6,
  Month =	 jun,
  Year =	 1988,
  Pages =	 "23-36",
  Annote =	 "8 references."
}

@TechReport{Milne90,
  Author =	 "Robert Milne",
  Title =	 "The proof theory for the {RAISE} specification
                  language",
  Institution =	 "STC/STL",
  Year =	 1990,
  Number =	 "RAISE/STC/REM/12/V3",
  Address =	 "Harlow, UK",
  Month =	 nov,
  Annote =	 "3 references."
}

@Article{Minsky-Pal97,
  author =	 {Naftaly H. Minsky and Partha Pratim Pal},
  title =	 {Law-Governed Regularities in Object Systems. Part 2:
                  A Concrete Implementation},
  journal =	 TAPOS,
  year =	 1997,
  volume =	 3,
  number =	 2,
  pages =	 {87-101},
  annote =	 {The Darwin-E environment. 21 references.}
}

@InProceedings{Minsky-Rozenshtein89,
  author =	 "Naftaly H. Minsky and David Rozenshtein",
  title =	 "A Law-Based Approach to Object-Oriented Programming",
  booktitle =	 "Proceedings of {OOPSLA '87}, Conference on
                  Object-oriented Programming Systems, Languages and
                  Applications",
  pages =	 "482-493",
  month =	 dec,
  year =	 1987,
  note =	 "{\em ACM SIGPLAN Notices}, volume 22, number 12.",
  annote =	 "9 references."
}

@InProceedings{Minsky-Rozenshtein89a,
  author =	 "Naftaly H. Minsky and David Rozenshtein",
  title =	 "Controllable Delegation: An Exercise in Law-Governed
                  Systems",
  booktitle =	 "Proceedings of {OOPSLA '89} Conference on
                  Object-oriented Programming Systems, Languages and
                  Applications",
  pages =	 "371-380",
  month =	 oct,
  year =	 1989,
  note =	 "{\em ACM SIGPLAN Notices}, volume 24, number 10."
}

@Article{Minsky91a,
  author =	 "Naftaly H. Minsky",
  title =	 "Law-governed systems",
  journal =	 "IEE Software Engineering Journal",
  organization = "IEE",
  year =	 "1991",
  pages =	 "285--302",
  editor =	 "Nazim Madhavji and Wilhelm Sch{\"a}fer",
  month =	 sep,
  volume =	 "6",
  number =	 "5",
  keywords =	 "Law-governed systems, LGS"
}

@Article{Minsky91b,
  author =	 "N. H. Minsky",
  title =	 "The Imposition of Protocols over Open Distributed
                  Systems",
  pages =	 "183--195",
  journal =	 IEEETSE,
  volume =	 "17",
  number =	 "2",
  month =	 feb,
  year =	 "1991",
  publisher =	 "IEEE Computer Society",
  address =	 "Washington, DC"
}

@Article{Minsky96,
  author =	 {Naftaly H. Minsky},
  title =	 {Law-Governed Regularities in Object Systems. Part 1:
                  An Abstract Model},
  journal =	 TAPOS,
  year =	 1996,
  volume =	 2,
  number =	 4,
  pages =	 {283-301},
  annote =	 {37 references.}
}

@InProceedings{Minsky96b,
  author =	 {Naftaly H. Minsky},
  title =	 {Towards Alias-Free Pointers},
  booktitle =	 {ECOOP '96 -- Object-Oriented Programming: 10th
                  European Conference, Linz Austria},
  pages =	 {189-209},
  year =	 1996,
  editor =	 {Pierre Cointe},
  volume =	 1098,
  series =	 LNCS,
  address =	 {Berlin},
  month =	 jul,
  publisher =	 SV,
  annote =	 {11 references.}
}

@Unpublished{Miragliotta04,
  author = 	 {Marcello Miragliotta},
  title = 	 {Specification Model Library for the Interactive Program Prover \textsc{Jive}},
  note = 	 {Student project, ETH Zurich. Available from: \url{http://www.sct.inf.ethz.ch/projects/student_docs/Marcello_Miragliotta/Marcello_Miragliotta_paper.pdf}},
  year =	 2004
}

@Article{Miriyala-Harandi91,
  Author =	 "K. Miriyala and M. T. Harandi",
  Title =	 "Automatic Derivation of Formal Software
                  Specifications from Informal Descriptions",
  Journal =	 IEEETSE,
  Year =	 1991,
  Volume =	 17,
  Number =	 10,
  Month =	 oct,
  Pages =	 "1126-1142",
  Annote =	 "37 references."
}

@InProceedings{Mishali-Katz06,
  title =	"Using aspects to support the software process: {XP}
		 over Eclipse",
  author =	"Oren Mishali and Shmuel Katz",
  booktitle =	"Proceedings of the 5th International Conference on
		 Aspect-Oriented Software Development (AOSD)",
  location = 	"Bonn, Germany",
  publisher =	ACM,
  month =       mar,
  year = 	2006,
  editor =	"Robert E. Filman",
  pages =	"169-179",
  URL =  	"http://doi.acm.org/10.1145/1119655.1119678",
}

@Book{Mitchell-McKim02,
  author =	 {Richard Mitchell and Jim McKim},
  title =	 {Design by Contract by Example},
  publisher =	 {Addison-Wesley},
  year =	 2002,
  address =	 {Indianapolis, IN},
  annote =	 {20 references.}
}

@Article{Mitchell-Urban-McDonald87,
  Author =	 "Jeffrey Mitchell and Joseph E. Urban and Robert
                  McDonald",
  Title =	 "The Effect of Abstract Data Types on Program
                  Development",
  Journal =	 "IEEE Computer",
  Volume =	 20,
  Number =	 8,
  Month =	 aug,
  Year =	 1987,
  Pages =	 "85-88",
  Annote =	 "Experiment on novice programmers concludes that the
                  requirement of using abstract data types reduced
                  productivity and the efficiency of the finished
                  programs. 9 references."
}

@inproceedings{Mitra-Basu-Kumar07,
   author = {Saayan Mitra and Samik Basu and Ratnesh Kumar},
   title = {Local and On-the-fly Choreography-based Web Service Composition},
   booktitle = {IEEE/WIC/ACM International Conference on Web Intelligence},
   pages = {521-527},
   month = nov,
   year =  2007 
}

@InCollection{Mitra94,
  author =	 "Swapan Mitra",
  title =	 "Object-oriented Specification in {VDM++}",
  booktitle =	 "Object-Oriented Specification Case Studies",
  publisher =	 "Prentice-Hall",
  year =	 1994,
  editor =	 "Kevin Lano and Howard Haughton",
  series =	 "The Object-Oriented Series",
  chapter =	 6,
  Crossref =	 "Lano-Haughton94",
  pages =	 "130-136",
  address =	 NY
}

@InCollection{Mitsui-etal93,
  Author =	 "Kin'ichi Mitsui and Hiroaki Nakamura and Theodore
                  C. Law and Shahram Javey",
  Title =	 "Design of an Integrated and Extensible C++
                  Programming Environment",
  BookTitle =	 "Object Technologies for Advanced Software",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Shojiro Nishio and Akinori Yonezawa",
  Series =	 LNCS,
  Volume =	 742,
  Pages =	 "95-109",
  Month =	 aug,
  Annote =	 "18 references."
}

@InProceedings{Mockus-Fielding-Herbsleb00,
  author =       {Audris Mockus and Roy T. Fielding and James Herbsleb},
  title =        "A Case Study of Open Source Software Development: The {Apache} Server",
  booktitle =    {Proceedings of the 22nd International Conference on
                 Software Engineering},
  month =        jun,
  publisher =    "ACM Press",
  address =      NY,
  year =         2000,
  pages =        {263-272},
  annote =       {16 references.}
}

@Article{Mody92,
  Author =	 "R. P. Mody",
  Title =	 "Is Programming an Art?",
  Journal =	 "Software Engineering Notes",
  Volume =	 17,
  Number =	 4,
  Month =	 oct,
  Year =	 1992,
  Pages =	 "19-21",
  Annote =	 "5 references."
}

@InProceedings{Moeller05,
  AUTHOR = {Michael M\"{o}ller},
  TITLE = {Mapping Formal Specifications to Java Contracts},
  BOOKTITLE = {Proceedings of the 17th Nordic Workshop on Programming Theory},
  PUBLISHER = {University of Copenhagen, Denmark},
  PAGES = {100-102},
  YEAR = {2005},
  MONTH = oct,
  URL = {http://csd.informatik.uni-oldenburg.de/pub/Papers/mm05-nwpt.pdf}
}

@Article{Moeller85,
  Author =	 {B. M\"{o}ller},
  Title =	 "On the algebraic specification of infinite
                  objects---Ordered and continuous models of algebraic
                  types",
  Journal =	 "Acta Informatica",
  Year =	 1985,
  Volume =	 22,
  Pages =	 "537-578"
}

@TechReport{Moore88,
  Author =	 "J. Strother Moore",
  Title =	 "A Mechanically Verified Language Implementation",
  Institution =	 "Computational Logic, Inc.",
  Year =	 1988,
  Number =	 30,
  Address =	 "1717 W. 6th St., Suite 290, Austin TX"
}

@InCollection{Moreira-Clark94,
  Author =	 "Ana M. D. Moreira and Robert G. Clark",
  Title =	 "Combining Object-Oriented Analysis and Formal
                  Descriptions Techniques",
  BookTitle =	 "Object-Oriented Programming 8th European Conference,
                  ECOOP '94 Bologna, Italy, Proceedings",
  Publisher =	 SV,
  Year =	 1994,
  Editor =	 "Mario Tokoro and Remo Pareschi",
  Series =	 LNCS,
  Volume =	 821,
  Pages =	 "344-364",
  Address =	 NY,
  Month =	 jul,
  Annote =	 "22 references."
}

@Article{Morell90,
  Author =	 "Larry J. Morell",
  Title =	 "A Theory of Fault-Based Testing",
  Journal =	 IEEETSE,
  Year =	 1990,
  Volume =	 16,
  Number =	 8,
  Month =	 aug,
  Pages =	 "844-857",
  Annote =	 "32 references."
}

@Article{Morgan-Gardiner90,
  Author =	 "Carroll Morgan and P. H. B. Gardiner",
  Title =	 "Data Refinement by Calculation",
  Journal =	 "Acta Informatica",
  Year =	 1990,
  Volume =	 27,
  Number =	 6,
  Month =	 may,
  Pages =	 "481-503",
  Annote =	 "25 references."
}

@Article{Morgan88,
  title =	 "Procedures, Parameters and Abstraction: separate
                  concerns",
  author =	 "Carroll Morgan",
  journal =	 SCP,
  volume =	 11,
  number =	 1,
  month =	 oct,
  year =	 1988,
  note =	 {Reprinted in the book {\it On the Refinement
                  Calculus}.}
}

@Book{Morgan90,
  Author =	 "Carroll Morgan",
  Title =	 "Programming from Specifications",
  Publisher =	 "Prentice Hall International",
  Address =	 "Hempstead, UK",
  Year =	 1990,
  Annote =	 "32 references."
}

@InCollection{Morgan93,
  Author =	 "Carroll Morgan",
  Title =	 "The refinement calculus, and literate development",
  BookTitle =	 "Formal Program Development",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Bernhard Moeller and Helmut Partsch and Steve
                  Schuman",
  Series =	 LNCS,
  Volume =	 755,
  Pages =	 "161-182",
  Address =	 NY,
  Month =	 jul,
  Annote =	 "13 references."
}

@Book{Morgan94,
  Author =	 "Carroll Morgan",
  Title =	 "Programming from Specifications: Second Edition",
  Publisher =	 "Prentice Hall International",
  Address =	 "Hempstead, UK",
  Year =	 1994,
  Annote =	 "44 references.",
  URL = {http://www.cs.ox.ac.uk/publications/books/PfS/}
}

@InCollection{Morgan94b,
  author =	 {Caroll Morgan},
  title =	 {Procedures, Parameters and Abstraction: separate
                  concerns},
  booktitle =	 {On the Refinement Calculus},
  Publisher =	 SV,
  Year =	 1994,
  Editor =	 "Carroll Morgan and Trevor Vickers",
  Series =	 "Formal approaches of computing and information
                  technology series",
  Address =	 NY,
  Annote =	 "62 references.",
  Crossref =	 {Morgan-Vickers94},
  Pages =	 "47-58"
}

@Article{Moriconi-Hare86,
  Author =	 "Mark Moriconi and Dwight F. Hare",
  Title =	 "The PegaSys System: Pictures as Formal Documentation
                  of Large Programs",
  Journal =	 TOPLAS,
  Volume =	 8,
  Number =	 4,
  Month =	 oct,
  Year =	 1986,
  Pages =	 "524-546",
  Annote =	 "22 references."
}

@Article{Morris87,
  title =	 "A Theoretical Basis for Stepwise Refinement and the
                  Programming Calculus",
  author =	 "Joseph M. Morris",
  pages =	 "287--306",
  journal =	 SCP,
  month =	 dec,
  year =	 1987,
  volume =	 9,
  number =	 3
}

@Article{Morris89,
  Author =	 "Joseph M. Morris",
  Title =	 "Laws of Data Refinement",
  Journal =	 "Acta Informatica",
  Year =	 1989,
  Volume =	 26,
  Number =	 4,
  Month =	 feb,
  Pages =	 "287-308",
  Annote =	 "11 references."
}

@Article{Moss92,
  Author =	 "J. Eliot B. Moss",
  Title =	 "Working with Persistent Objects: To Swizzle or Not
                  to Swizzle",
  Journal =	 IEEETSE,
  Year =	 1992,
  Volume =	 18,
  Number =	 8,
  Month =	 aug,
  Pages =	 "657-673",
  Annote =	 "57 references."
}

@InCollection{Mossakowski-etal08,
  author = 	 {Till Mossakowski and Anne E. Haxthausen and Donald Sanella and Andrezj Tarlecki},
  title = 	 {\textsc{Casl} --- the {Common Algebraic Specification Language}},
  crossref =  {Bjorner-Henson08},
  pages = 	 {241-298},
  annote = 	 {67 references.}
}

@inproceedings{Moura-Bjorner08,
  author    = {Leonardo de Moura and Nikolaj Bj{\o}rner},
  title     = {Z3: An Efficient {SMT} Solver},
  year      = 2008,
  pages     = {337--340},
  booktitle = {Tools and Algorithms for the Construction and Analysis (TACAS)},
  publisher = SV,
  address   = {Berlin},
  series    = LNCS,
  volume    = 4963,
  URL = {http://dx.doi.org/10.1007/978-3-540-78800-3_24}
}

@Article{Mrdalj90,
  Author =	 "Stevan Mrdalj",
  Title =	 "Bibliography of Object-Oriented System Development",
  Journal =	 SIGSOFT,
  Year =	 1990,
  Volume =	 15,
  Number =	 5,
  Month =	 oct,
  Pages =	 "60-63",
  Annote =	 "83 references."
}



@TechReport{Mueller-Poetzsch-Heffter-Leavens01,
  Author =	 {Peter M\"{u}ller and Arnd Poetzsch-Heffter and Gary
                  T. Leavens},
  Title =	 "Modular Specification of Frame Properties in {JML}",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "01-03",
  Year =	 2001,
  Month =	 apr,
  Note =	 "In Formal Techniques for Java Programs
                  2001 workshop at ECOOP 2001. Also available from
                  \url{archives.cs.iastate.edu}.",
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR01-03/TR.pdf",
  Annote =	 "18 references."
}

@TechReport{Mueller-Poetzsch-Heffter-Leavens02,
  Author =	 {Peter M\"{u}ller and Arnd Poetzsch-Heffter and Gary
                  T. Leavens},
  Title =	 "Modular Specification of Frame Properties in {JML}",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Address =	 "Ames, Iowa, 50011",
  Number =	 "02-02a",
  Year =	 2002,
  Month =	 oct,
  Note =	 "Final version appears in Concurrency and Computation: Practice and Experience, 15:117-154, 2003.",
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR02-02/TR.pdf",
  Annote =	 "31 references."
}

@Article{Mueller-Poetzsch-Heffter-Leavens03,
  Author =	 {Peter M\"{u}ller and Arnd Poetzsch-Heffter and Gary
                  T. Leavens},
  Title =	 "Modular Specification of Frame Properties in {JML}",
  Journal =	 "Concurrency and Computation: Practice and Experience",
  Volume =	 15,
  Number =       2,
  Month =        feb,
  Year =	 2003,
  Pages =	 "117-154",
  DOI =          {10.1002/cpe.713},
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR02-02/TR.pdf",
  Annote =	 "31 references."
}

@TechReport{Mueller-Poetzsch-Heffter-Leavens03a,
  Author =	 {Peter M\"{u}ller and Arnd Poetzsch-Heffter and Gary
                  T. Leavens},
  Title =	 "Modular Invariants for Object Structures",
  institution =	 {ETH Zurich},
  year =	 2003,
  number =	 424,
  month =	 oct,
  annote =	 {20 references},
  URL =
                 {ftp://ftp.inf.ethz.ch/pub/publications/tech-reports/4xx/424.pdf}
}

@TechReport{Mueller-Poetzsch-Heffter-Leavens05,
  Author =	 {Peter M\"{u}ller and Arnd Poetzsch-Heffter and Gary
                  T. Leavens},
  Title =	 "Modular Invariants for Layered Object Structures",
  institution =	 {ETH Zurich},
  year =	 2005,
  number =	 424,
  month =	 mar,
  annote =	 {20 references},
  URL =          {http://tinyurl.com/q55s5}
}

@Article{Mueller-Poetzsch-Heffter-Leavens06,
  Author =	 {Peter M\"{u}ller and Arnd Poetzsch-Heffter and Gary
                  T. Leavens},
  Title =	 "Modular Invariants for Layered Object Structures",
  journal = 	 SCP,
  volume =       62,
  number =       3,
  pages =        {253-286},
  month =        oct,
  year =	 2006,
  URL =          {http://dx.doi.org/10.1016/j.scico.2006.03.001}
}

@InCollection{Mueller-Poetzsch-Heffter00,
  author =	 {Peter M{\"u}ller and Arnd Poetzsch-Heffter},
  title =	 {Modular Specification and Verification Techniques
                  for Object-Oriented Software Components},
  booktitle =	 {Foundations of Component-Based Systems},
  publisher =	 {Cambridge University Press},
  year =	 2000,
  editor =	 {Gary T. Leavens and Murali Sitaraman},
  chapter =	 7,
  pages =	 {137-159},
  annote =	 {15 references.}
}

@InProceedings{Mueller-Poetzsch-Heffter00a,
  author =	 {P. M{\"u}ller and A. Poetzsch-Heffter},
  title =	 {A Type System for Controlling Representation
                  Exposure in {J}ava},
  booktitle =	 {Formal Techniques for {J}ava Programs},
  year =	 2000,
  editor =	 {S. Drossopoulou and S. Eisenbach and B. Jacobs
                  and G. T. Leavens and P. M{\"u}ller and
                  A. Poetzsch-Heffter},
  organization = {Technical Report~269, Fernuniversit{\"at} Hagen},
  note =	 {Available from
                  \url{http://tinyurl.com/j8esw}}
}

@TechReport{Mueller-Poetzsch-Heffter01a,
  author =	 {Peter M{\"u}ller and Arnd Poetzsch-Heffter},
  title =	 {Universes: A Type System for Alias and Dependency
                  Control},
  institution =	 {Fernuniversit\"at Hagen},
  year =	 2001,
  number =	 279,
  note =	 {Available from
                  \url{http://tinyurl.com/j8esw}}
}

@InProceedings{Mueller-Rudich07,
  author = 	 {Peter M\"{u}ller and Arsenii Rudich},
  title = 	 {Ownership Transfer in Universe Types},
  booktitle = {International Conference on Object-Oriented Programming, Systems, Languages and Applications (OOPSLA), Montreal, Canada},
  pages = 	 {461-478},
  year = 	 2007,
  month = 	 oct,
  organization = ACM,
  annote = 	 {42 references.}
}

@incollection{Mueller-Ruskiewicz09,
author={Peter M{\"u}ller and Joseph N. Ruskiewicz},
title={A Modular Verification Methodology for C# Delegates},
year={2009},
isbn={978-3-642-11446-5},
booktitle={Rigorous Methods for Software Construction and Analysis},
volume={5115},
series=LNCS,
editor={Jean-Raymond Abrial and Uwe Gl{\"a}sser},
doi={10.1007/978-3-642-11447-2_12},
url={http://dx.doi.org/10.1007/978-3-642-11447-2_12},
publisher=SV,
pages={187-203}
}

@PhDThesis{Mueller01a,
  author =	 {Peter M{\"u}ller},
  title =	 {Modular Specification and Verification of
                  Object-Oriented programs},
  school =	 {FernUniversit\"{a}t Hagen, Germany},
  month =	 mar,
  year =	 2001,
  annote =	 {Universe type system to control aliasing. Modular
                  treatment of frame conditions, static and dynamic
                  dependencies, and invariants. 207 references.},
  url =         {http://tinyurl.com/jtwot}
}

@Book{Mueller02,
  author =	 {Peter M{\"u}ller},
  title =	 {Modular Specification and Verification of
                  Object-Oriented Programs},
  Publisher =	 SV,
  Address =      "Berlin",
  Series =	 LNCS,
  Volume =	 2262,
  Year =	 2002,
  URL =          {http://tinyurl.com/jtwot}
}

@InProceedings{Mueller05,
  author =	 {Peter M{\"u}ller},
  title = 	 {Reasoning about Object Structures Using Ownership},
  year =	 2005,
  booktitle =	 {Verified Software: Theories, Tools, Experiments, Zurich, Switzerland},
  month =	 oct,
  organization = {IFIP Working Group 2.3},
  note =	 {To appear.}
}

@InProceedings{Mulet-Malenfant-Cointe95,
  author =	"Philippe Mulet and Jacques Malenfant and Pierre Cointe",
  title =	"Towards a Methodology for Explicit Composition of MetaObjects",
  year = 	"1995",
  organization = ACM,
  month =       oct,
  booktitle =	"OOPSLA",
  pages =	"316-330"
}

@Book{Mullin89,
  Author =	 "Mark Mullin",
  Title =	 "Object Oriented Program Design With Examples in
                  {C}++",
  Publisher =	 Addison-Wesley,
  Address =	 "Reading, Mass.",
  Year =	 1989
}

@InProceedings{Musser80a,
  Author =	 "D. R. Musser",
  Title =	 "Abstract Data Type Specifications in the Affirm
                  System",
  BookTitle =	 "IEEE Conference on the Specification of Reliable
                  Software",
  Organization = IEEE,
  Year =	 1979,
  Pages =	 "47-57"
}

@InProceedings{Musser80b,
  Author =	 "D. R. Musser",
  Title =	 "On Proving Inductive Properties of Abstract Data
                  Types",
  BookTitle =	 "Conference Record of the Seventh Annual ACM
                  Symposium on Principles of Programming Languages,
                  Las Vegas, Nevada",
  Organization = ACM,
  Year =	 1980,
  Pages =	 "154-162",
  Annote =	 "Full specification notion like sufficient
                  completeness. 29 references."
}

@InProceedings{Myagmar-Lee-Yurcik05,
  author = 	 {Suvda Myagmar and Adam J. Lee and William Yurcik},
  title = 	 {Threat modeling as a basis for security requirements},
  booktitle = {IEEE Symposium on requirements engineering for information security (SREIS)},
  year = 	 2005,
  volume = 	 2005,
  organization = {IEEE},
  URL={\url{https://people.cs.pitt.edu/~adamlee/pubs/2005/sreis-05.pdf}}
}

@Article{Myers92,
  Author =	 "Brad A. Myers",
  Title =	 "Demonstrational Interfaces: A Step Beyond Direct
                  Manipulation",
  Journal =	 "Computer",
  Year =	 1992,
  Volume =	 25,
  Number =	 8,
  Month =	 aug,
  Pages =	 "61-73",
  Annote =	 "12 references."
}

@article{Mylopoulos-Chung-Yu99,
author = {John Mylopoulos and Lawrence Chung and Eric Yu},
title = {From Object-Oriented to Goal-Oriented Requirements Analysis},
year = 1999,
issue_date = {Jan. 1999},
publisher = {Association for Computing Machinery},
address = NY,
volume = 42,
number = 1,
issn = {0001-0782},
url = {https://doi.org/10.1145/291469.293165},
journal = {Commun. ACM},
month = jan,
pages = {31–37},
numpages = 7
}

% doi = {10.1145/291469.293165},
@Proceedings{Najm-Stefani97,
  title =	 {Formal Methods for Open Object-Oriented Distributed
                  Systems},
  booktitle =	 {Formal Methods for Open Object-Oriented Distributed
                  Systems},
  year =	 1997,
  editor =	 {Elie Najm and Jean-Bernard Stefani},
  publisher =	 {Chapman \& Hall},
  address =	 {London},
  annote =	 {Proceedings of FMOODS '96}
}

@Article{Nakajima-Honda-Nakahara80,
  Author =	 "Reiji Nakajima and Michio Honda and Hayao Nakahara",
  Title =	 "Hierarchical Program Specification and Verification
                  --- a Many-sorted Logical Approach",
  Journal =	 "Acta Informatica",
  Volume =	 14,
  Number =	 2,
  Year =	 1980,
  Pages =	 "135-155",
  Annote =	 "IOTA allows one to build theories and write the
                  implementations. Validation of data and procedural
                  abstractions. Generalization of type
                  parameterization. 22 references."
}

@Book{Nakajima-Yuasa83,
  Editor =	 "R. Nakajima and T. Yuasa",
  Title =	 "The IOTA Programming System: A Modular Programming
                  Environment",
  Series =	 LNCS,
  Volume =	 160,
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1983,
  Annote =	 "51 references."
}

@inproceedings{Nankai-Song12,
author = {Nankai Pan and Eunjee Song},
title = {An Aspect-Oriented Testability Framework},
year = {2012},
isbn = {9781450314923},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/2401603.2401682},
abstract = {We can specify design constraints of a software system using a formal language such as Object Constraint Language (OCL). However, OCL is not executable and cannot be explicitly used as a testing method. So runtime constraint checking is needed to mitigate this problem. Checking design constraints at runtime can help to detect design drift. On the other hand, making a software testable is also hard since testing requires active involvement of programmers. Testable software introduces a quality characteristics of software artifact called testability. This paper mainly concentrates on improving observability, one of the major factors that determine testability of a software artifact. To avoid design drift and make software more testable, this paper proposes an aspect-oriented testability framework for object oriented software testing, which enables runtime constraint checking against implementation code and improves the testability of a software system. This framework completely takes the advantage of aspect-oriented programming (AOP) approaches and is totally modular and plug-and-playable.},
booktitle = {Proceedings of the 2012 ACM Research in Applied Computation Symposium},
pages = {356–363},
numpages = {8},
keywords = {testing, observability, AspectJ, AOP, testability, logging},
location = {San Antonio, Texas},
series = {RACS '12}
}

@InProceedings{Narayanan-Karsai06,
  author = 	 {Anantha Narayanan and Gabor Karsai},
  title = 	 {Towards Verifying Model Transformations},
  booktitle =	 {5th International Workshop on Graph Transformation and Visual Modeling Techniques, Vienna},
  pages =	 {185-194},
  year =	 2006,
  editor =	 {Roberto Bruni and D\'{a}niel Varr\'{o}},
  month =	 apr,
  URL = {http://www.inf.mit.bme.hu/GT-VMT2006/ProceedingsGTVMT2006.pdf},
  Annote =       {16 references.}
}

% doi = {10.1145/2401603.2401682},
@inproceedings{Naumann-Barnett04,
author={David A. Naumann and Mike Barnett},
title={Towards Imperative Modules: Reasoning about Invariants and Sharing of Mutable State (extended abstract)},
year=2004,
pages={313-323},
booktitle=LICS,
oldnote={available from \textrm{http://www.cs.stevens-tech.edu/\~{}naumann/tim.pdf}}
}

@article{Naumann-Barnett06,
author={David A. Naumann and Mike Barnett},
title={Towards Imperative Modules: Reasoning about Invariants and Sharing 
of Mutable State},
year=2006,
journal=TCS,
volume=365,
pages={143-168},
note={Extended version of \cite{Naumann-Barnett04}}
}

@article{Naumann01,
  Author =	 "David A. Naumann",
  Title =	 "Predicate Transformer Semantics of a Higher Order
                  Imperative Language with Record Subtypes",
  Journal =	 SCP,
  Volume =	 41,
  Number =	 1,
  Pages =	 "1-51",
  Year =	 2000,
  Annote =	 "Gives a predicate-transformer semantics for an
                  Oberon-like language with stored procedures
                  (variables and record fields of procedural types),
                  extensible record subtyping, and specification
                  constructs. The semantics is used to prove
                  procedure-call rules and some refinement laws which
                  have received attention in the literature on Algol."
}

@article{Naumann01a,
author = "David A. Naumann",
title = "Calculating Sharp Adaptation Rules",
journal = IPL,
volume = 77, 
pages = {201-208},
year = 2001
}

@article{Naumann02,
  Author =	 "David A. Naumann",
  Title =	 "Soundness of Data Refinement for a Higher Order
                  Imperative Language",
  Journal =	 TCS,
  volume = 278, 
  number = {1-2},
  pages = {271-301},
  year = 2002,
  Annote =	 "Shows that forward simulation is a sound proof
                  method for data refinement in an Oberon-like
                  language."
}

@InProceedings{Naumann05,
  author = 	 {David A. Naumann},
  title = 	 {Observational Purity and Encapsulation},
  booktitle =	 {Fundamental Aspects of Software Engineering (FASE)},
  pages =        {190-204},
  year =	 2005,
  series =LNCS,
  volume = 3442,
  publisher = SV,
  address = {Berlin},
  url= "http://www.cs.stevens.edu/~naumann/publications/obspureWeb.pdf",
  annote = {Best Software Science Paper by the European Association of Software
        Sciences and Technology at the European Joint Conferences on Theory and
        Practice of Software (ETAPS) 2005.}
}

@inproceedings{Naumann05a,
author = {David A. Naumann},
title = {Assertion-based Encapsulation, Object invariants and Simulations},
year = 2005,
editor = {Frank S. de Boer and Marcello M. Bonsangue and Susanne Graf and Willem P. de Roever},
booktitle  = {Post-proceedings, Formal Methods for Components and Objects ({FMCO} 2004)},
series =LNCS,
pages={251-273},
volume = 3657,
publisher = SV,
address = {Berlin}
}

@inproceedings{Naumann05b,
author = {David A. Naumann},
title = {Verifying a Secure Information Flow Analyzer},
year = 2005,
booktitle = {18th International Conference on Theorem Proving in Higher Order Logics {TPHOLS}}, 
editor = {Joe Hurd and Tom Melham},
pages = {211-226},
SERIES = LNCS,
VOLUME = 3603,
publisher = SV,
address = {Berlin}
}

@inproceedings{Naumann06,
author = {David A. Naumann},
title = {From Coupling Relations to Mated Invariants for Secure Information 
Flow},
year = 2006,
booktitle={European Symposium on Research in Computer Security ({ESORICS})},
pages={279--296},
series=LNCS,
number=4189
}

@article{Naumann06a,
author = "David A. Naumann",
title = {Observational Purity and Encapsulation},
journal=TCS,
note={To appear; extended version of \cite{Naumann05}.},
url= "http://www.cs.stevens.edu/~naumann/publications/obspureTCS.pdf",
year = 2006
}

@article{Naumann06b,
title={On Assertion-Based Encapsulation for Object Invariants and Simulations},
author= {David A. Naumann},
journal={Formal Aspects of Computing},
year=2006,
note={Special issue: Applicable Research on Formal Verification and Development, to appear.}
}

@article{Naumann06c,
author = "David A. Naumann",
title = {Data refinement, call by value, and higher order programs},
journal=FAC,
note={To appear.},
url= "https://guinness.cs.stevens-tech.edu/~naumann/publications/drho.pdf",
year = 2006
}

@article{Naumann07,
author = "David A. Naumann",
title = {Observational Purity and Encapsulation},
journal=TCS,
year = 2007,
volume=376,
number=3,
pages={205--224}
}

@InProceedings{Naumann94,
  author =	 "David A. Naumann",
  title =	 "Predicate transformer semantics of an Oberon-like language",
  booktitle =	 "Proceedings of the IFIP WG2.1/WG2.2/WG2.3 Working
                  Conference on Programming Concepts, Methods, and Calculi",
  where =	 "San Miniato, Italy",
  publisher =	 "Elsevier",
  year =	 1994,
  month =	 jun,
  pages =	 "467--487"
}

@Article{Neil-etal98,
  author =	 {Martin Neil and Gary Ostrolenk and Mary Tobin and
                  Mark Southworth},
  title =	 {Lessons from Using Z to Specify a Software Tool},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 1,
  month =	 jan,
  pages =	 {15-23},
  annote =	 {Unsuccessful application of formal methods. 13
                  references.}
}

@article{Nelson-Oppen79,
 author = {Greg Nelson and Derek C. Oppen},
 title = {Simplification by Cooperating Decision Procedures},
 journal = {ACM Trans. Program. Lang. Syst.},
 issue_date = {Oct. 1979},
 volume = {1},
 number = {2},
 month = oct,
 year = {1979},
 issn = {0164-0925},
 pages = {245--257},
 numpages = {13},
 url = {http://doi.acm.org/10.1145/357073.357079},
 doi = {10.1145/357073.357079},
 acmid = {357079},
 publisher = {ACM},
 address = NY
}

@inproceedings{Nelson83,
  author = "Greg Nelson",
  title = "Verifying Reachability Invariants of Linked Structures",
  booktitle = "Conference Record of the Tenth Annual ACM Symposium on
		  Principles of Programming Languages",
  publisher = "ACM",
  address = NY,
  month = jan,
  year = 1983,
  pages = "38-47",
  URL = {http://doi.acm.org/10.1145/567067.567073}
}

@Article{Nelson89,
  Author =	 "Greg Nelson",
  Title =	 "A Generalization of {Dijkstra's} Calculus",
  Journal =	 TOPLAS,
  Volume =	 11,
  Number =	 4,
  Month =	 oct,
  Year =	 1989,
  Pages =	 "517-561",
  Annote =	 "28 references."
} 

@Article{Netinant-Elrad-Fayad-01,
  Author =	 "Paniti Netinant and Tzilla Elrad and Mohamed
                  E. Fayad",
  Title =	 "A layered approach to building open aspect-oriented
                  systems: a framework for the design of on-demand
                  system demodularization",
  Journal =	 CACM,
  Year =	 2001,
  Volume =	 44,
  Number =	 10,
  Month =	 oct,
  Pages =	 "83--85"
}

@InProceedings{Neto-Muniz-Silva05,
  author = 	 {J. J. Neto and P. S. Muniz Silva},
  title = 	 {An Adaptive Framework for the Design of Software Specification Languages},
  booktitle =	 {Proceedings of International Conference on Adaptive and Natural Computing Algorithms (ICANNGA)},
  year =	 2005,
  month =	 mar,
  URL = 	 {\url{http://www.pcs.usp.br/~lta/artigos/icannga_2005_neto_muniz.pdf}}
}

@Article{Newman82,
  Author =	 "P. S. Newman",
  Title =	 "Towards an Integrated Development Environment",
  Journal =	 "IBM Systems Journal",
  Volume =	 21,
  Number =	 1,
  Year =	 1982,
  Pages =	 "81-107",
  Annote =	 "Systems development environment. Need for
                  environment integration. Integration requires
                  fundamental reworking of approaches, not superficial
                  connections. Very high level languages. 60
                  references."
}

@InProceedings{Nguyen-etal13,
author={Hoang Duong Thien Nguyen and Dawei Qi and Abhik Roychoudhury and Satish Chandra},
booktitle={2013 35th International Conference on Software Engineering (ICSE)},
title={SemFix: Program repair via semantic analysis},
year={2013},
publisher=IEEE,
address="Los Altos",
pages={772-781},
doi={10.1109/ICSE.2013.6606623},
annote="27 references."
}

@InCollection{Nickl-Wirsing93,
  Author =	 "F. Nickl and M. Wirsing",
  Title =	 "A Formal Approach to Requirements Engineering",
  BookTitle =	 "Formal Methods in Programming and Their
                  Applications",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Dines Bjoerner and Manfred Broy and Igor
                  V. Pottosin",
  Series =	 LNCS,
  Volume =	 735,
  Pages =	 "312-334",
  Month =	 jul,
  Annote =	 "21 references."
}

@InProceedings{Nielsen-etal88,
  Author =	 "Mogens Nielsen and Klaus Havelund and Kim Ritter
                  Wagner and Chris George",
  Title =	 "The {RAISE} Language, Method and Tools",
  BookTitle =	 "VDM '88",
  Year =	 1988,
  Pages =	 "376-405"
}

@Article{Nielsen-etal89,
  Author =	 "Mogens Nielsen and Klaus Havelund and Kim Ritter
                  Wagner and Chris George",
  Title =	 "The {RAISE} Language, Method and Tools",
  Journal =	 "Formal Aspects of computing",
  Volume =	 1,
  Number =	 1,
  Month =	 "Jan-Mar",
  Year =	 1989,
  Pages =	 "85-114"
}

@Article{Nielsen92,
  Author =	 "Jakob Nielsen",
  Title =	 "The usability Engineering Life Cycle",
  Journal =	 "Computer",
  Year =	 1992,
  Volume =	 25,
  Number =	 3,
  Month =	 mar,
  Pages =	 "12-22",
  Annote =	 "12 references."
}

@InCollection{Nierstrasz-Tsichritzis89,
  Author =	 "O. M. Nierstrasz and D. C. Tsichritzis",
  Title =	 "Integerated Office Systems",
  Editor =	 "Won Kim and Frederick H. Lochovsky",
  BookTitle =	 "Object-Oriented Concepts, Databases, and
                  Applications",
  Publisher =	 Addison-Wesley,
  Address =	 "Reading, Mass.",
  Year =	 1989,
  Chapter =	 9,
  Pages =	 "199-212",
  Annote =	 "33 references"
}

@Book{Nierstrasz-Tsichritzis95,
  editor =	 {Oscar Nierstrasz and Dennis Tsichritzis},
  title =	 {Object-Oriented Software Composition},
  booktitle =	 {Object-Oriented Software Composition},
  publisher =	 {Prentice-Hall},
  address =	 {Hemel Hempstead, Hertfordshire, UK},
  year =	 1995,
  series =	 {The Object-Oriented Series}
}

@incollection{Nieto03,
year={2003},
isbn={978-3-540-00886-6},
booktitle={Programming Languages and Systems},
volume={2618},
series={Lecture Notes in Computer Science},
editor={Pierpaolo Degano},
doi={10.1007/3-540-36575-3_24},
title={The Rely-Guarantee Method in Isabelle/HOL},
url={http://dx.doi.org/10.1007/3-540-36575-3_24},
publisher={Springer Berlin Heidelberg},
author={Leonor Prensa Nieto},
pages={348-362},
}

@InProceedings{Nilizadeh-Leavens-Pasareanu21,
author="Amirfarhad Nilizadeh and Gary T. Leavens and Corina S. P{\u{a}}s{\u{a}}reanu",
editor={Fr{\'e}d{\'e}ric Loulergue and Franz Wotawa},
title="Using a Guided Fuzzer and Preconditions to Achieve Branch Coverage with Valid Inputs",
booktitle="Tests and Proofs",
year="2021",
publisher="Springer International Publishing",
address="Cham",
pages="72-84",
url = {https://tinyurl.com/4xzxxrn2},
abstract="Software is widely used in critical systems. Thus, it is important that developers can quickly find semantic bugs with testing; however, semantic bugs can only be revealed by tests that use valid inputs. Guided fuzzers can create input tests that cover all branches; however, they may not necessarily cover all branches with valid inputs. Therefore, the problem is how to guide a fuzzer to cover all branches in a program with only valid inputs. We perform a study of an idea that guarantees that all inputs generated by a guided fuzzer that reach the program under test are valid using formal specifications and runtime assertion checking. Our results show that this idea improves the feedback given to a guided fuzzer.",
isbn="978-3-030-79379-1",
annote="67 references."
}

% doi={10.1109/ISSRE52982.2021.00032}
@INPROCEEDINGS{Nilizadeh-etal21ce,
  author={Amirfarhad Nilizadeh and Marlon Calvo and Gary T. Leavens and Xuan-Bach D. Le},
  booktitle={2021 IEEE 32nd International Symposium on Software Reliability Engineering (ISSRE)}, 
  title={More Reliable Test Suites for Dynamic APR by using Counterexamples}, 
  year={2021},
  pages={208-219},
  publisher={IEEE},
  address="Los Altos",
  url={https://doi.org/10.1109/ISSRE52982.2021.00032},
  annote="95 references."
}
                  
@InProceedings{Nilizadeh-etal21exploring,
  author={Amirfarhad Nilizadeh and Gary T. Leavens and Xuan-Bach D. Le and Corina S. P{\u{a}}s{\u{a}}reanu and David R. Cok},
  booktitle={2021 14th IEEE Conference on Software Testing, Verification and Validation (ICST)}, 
  title={Exploring True Test Overfitting in Dynamic Automated Program Repair using Formal Methods}, 
  year={2021},
  pages={229-240},
  publisher=IEEE,
  address="Los Altos",
  url = {https://tinyurl.com/bn3ecw98},
  annote={84 references.}
}

@InCollection{Nimmer-Ernst01,
  author =	 {Jeremy W. Nimmer and Michael D. Ernst},
  title =	 {Static verification of dynamically detected program
                  invariants: Integrating {Daikon} and {ESC/Java}},
  booktitle =	 {Proceedings of RV'01, First Workshop on Runtime
                  Verification},
  month =	 jul,
  year =	 2001,
  publisher =	 "Elsevier",
  URL =          "http://dx.doi.org/10.1016/S1571-0661(04)00256-7"
}

% doi={10.1109/ICST49551.2021.00033},
@Book{Nino-Hosch05,
  author =	 {Jaime Ni\~{n}o and Frederick A. Hosch},
  title = 	 {An Introduction to Programming and Object Oriented Design Using Java 1.5},
  publisher = 	 {Wiley},
  year = 	 2005,
  address =	 {Hoboken, NJ},
  edition =	 {Second},
  note =	 {With CD-ROM},
  annote =	 {20 references.}
}

% DOI={10.1007/978-3-030-79379-1_5},
@InProceedings{Nipkow-Oheimb-Pusch00,
	author = {Tobias Nipkow and David von Oheimb and Cornelia Pusch},
	title = {{$\mu$Java}: Embedding a Programming Language in a Theorem Prover},
	booktitle = {Foundations of Secure Computation},
        series= {NATO Science Series F: Computer and Systems Sciences},
        volume = {175},
	year = {2000},
	publisher = {IOS Press},
	editor = {Friedrich L. Bauer and Ralf Steinbr{\"u}ggen},
	URL = {http://isabelle.in.tum.de/Bali/papers/MOD99.html},
	pages = {117--144}
}

@Book{Nipkow-Paulson-Menzel02,
  author =	 {Tobias Nipkow and Lawrence Paulson and Markus Menzel},
  title = 	 {{Isabelle/HOL} --- A Proof Assistant for Higher-Order Logic},
  publisher = 	 SV,
  year = 	 2002,
  volume =	 2283,
  series =	 LNCS,
  URL = {http://www.in.tum.de/~nipkow/LNCS2283/}
}

@Article{Nipkow86,
  Author =	 "Tobias Nipkow",
  Title =	 "Non-deterministic Data Types: Models and
                  Implementations",
  Journal =	 "Acta Informatica",
  Volume =	 22,
  Number =	 16,
  Pages =	 "629-661",
  Month =	 mar,
  Year =	 1986,
  Annote =	 "34 references."
}

@PhDThesis{Nipkow87,
  Author =	 "Tobias Nipkow",
  Title =	 "Behavioural Implementation Concepts for
                  Nondeterministic Data Types",
  School =	 "University of Manchester",
  Month =	 may,
  Year =	 1987,
  Annote =	 "97 references."
}

@InCollection{Nipkow89,
  Author =	 "T. Nipkow",
  Title =	 "Formal Verification of Data Type Refinement ---
                  Theory and Practice",
  BookTitle =	 "Stepwise Refinement of Distributed Systems, Models,
                  Formalisms, Correctness, REX Workshop, Mook, The
                  Netherlands",
  Month =	 "May/June",
  Year =	 1989,
  Publisher =	 "Spring-Verlag",
  Series =	 LNCS,
  Volume =	 430,
  Editor =	 "J. W. de Bakker and W.-P. de Roever and
                  G. Rozenberg",
  Pages =	 "561-591"
}

@Article{Nishida-etal91,
  Author =	 "Fujio Nishida and Shinobu Takamatsu and Yoneharu
                  Fujita and Tadaaki Tani",
  Title =	 "Semi-Automatic Program Construction From
                  Specifications Using Library Modules",
  Journal =	 IEEETSE,
  Year =	 1991,
  Volume =	 17,
  Number =	 9,
  Month =	 sep,
  Pages =	 "853-871",
  Annote =	 "Users write specifications, modify and rearrange
                  them so that the specifications can be refined with
                  the aid of library modules. 30 references."
}

@Book{Nissanke99,
  author =	 {Nimal Nissanke},
  title =	 {Formal Specification: Techniques and Applications},
  publisher =	 SV,
  year =	 1999,
  address =	 NY,
  annote =	 {68 references}
}

@InProceedings{Noble-Vitek-Potter98,
  author =	 {James Noble and Jan Vitek and John Potter},
  title =	 {Flexible Alias Protection},
  BookTitle =	 {ECOOP '98 -- Object-Oriented Programming, 12th
                  European Conference, Brussels, Belgium},
  Editor =	 "Eric Jul",
  Series =	 LNCS,
  Volume =	 1445,
  Month =	 jul,
  Year =	 1998,
  publisher =	 SV,
  pages =	 {158-185}
}

@Article{Nord-Lee-Scherlis90,
  Author =	 "Robert L. Nord and Peter Lee and William
                  L. Scherlis",
  Title =	 "Formal Manipulation and Modular Software Systems",
  Journal =	 SIGSOFT,
  Year =	 1990,
  Volume =	 15,
  Number =	 4,
  Month =	 sep,
  Pages =	 "90-99",
  Note =	 "Proceedings of the ACM SIGSOFT: International
                  Workshop on Formal Methods in Software Development,
                  Mark Moriconi (editor).",
  Annote =	 "23 references."
}

@InCollection{Nordberg98,
  author =	 {Martin E. Nordberg},
  title =	 {Default and Extrinsic Visitor},
  booktitle =	 {Pattern Languages of Program Design 3},
  publisher =	 {Addison-Wesley Publishing Co.},
  address =	 {Reading, MA},
  year =	 1998,
  editor =	 {Robert C. Martin and Dirk Riehle and Frank
                  Buschmann},
  pages =	 {105--123}
}

@InCollection{Norvell-Hehner93,
  Author =	 "Theodore S. Norvell and Eric C.R. Hehner",
  Title =	 "Logical Specification for Functional Programs",
  BookTitle =	 "Mathematics of Program Construction, Second
                  International Conference, Oxford, U.K.",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "R.S. Bird and C.C. Morgan and J.C.P. Woodcock",
  Series =	 LNCS,
  Volume =	 669,
  Pages =	 "269-290",
  Address =	 NY,
  Month =	 "June/July",
  Annote =	 "20 references."
}

@inproceedings{Notkin-etal93,
 author = {David Notkin and David Garlan and William G. Griswold and
Kevin J. Sullivan},
 title = {Adding Implicit Invocation to Languages: Three Approaches},
 booktitle = {Proceedings of the First JSSST International Symposium
on Object Technologies for Advanced Software},
 year = {1993},
 isbn = {3-540-57342-9},
 pages = {489--510},
 publisher = SV,
 address = {London, UK},
}

@InProceedings{Nunes-etal06,
  author = 	 {Isabel Nunes and Ant\'{o}nia Lopes and Vasco Vasconcelos and Jo\~{a}o Abreu and and Lu{\'\i}s S. Reis},
  title = 	 {Checking the Conformance of Java Classes Against Algebraic Specifications},
  booktitle =	 {Formal Methods and Software Engineering: 8th International Conference on Formal Engineering Methods (ICFEM)},
  pages =	 {494-513},
  year =	 2006,
  editor =	 {Zhiming Liu and He Jifeng},
  volume =	 4260,
  series =	 LNCS,
  address =	 NY,
  month =	 nov,
  publisher =	 SV,
  annote =	 {21 references.}
}

@Misc{OCL,
  author =	 {OMG},
  title =	 {Object Constraint Language Specification, Version 2.0},
  howpublished = {\url{http://tinyurl.com/k7rfm}},
  month =	 may,
  year =	 2006
}

@inproceedings{OHearn-Yang-Reynolds04,
 title={Separation and Information Hiding}, 
 author={Peter W. O'Hearn and Hongseok Yang and John C. Reynolds},
 booktitle=POPL,
 location = {Venice, Italy},
 editor = {Neil D. Jones and Xavier Leroy},
 month = jan,
 year=2004,
 pages={268-280},
 doi = {http://doi.acm.org/10.1145/964001.964024},
 publisher = ACM,
 address = NY
}

@article{OHearn07,
 author = {Peter W. O'Hearn},
 title = {Resources, concurrency, and local reasoning},
 journal = TCS,
 volume = 375,
 number = {1-3},
 year = 2007,
 issn = {0304-3975},
 pages = {271--307},
 doi = {http://dx.doi.org/10.1016/j.tcs.2006.12.035},
 publisher = {Elsevier Science Publishers Ltd.},
 address = {Essex, UK},
}

@Misc{OMGMDA,
  author =	 {Object Management Group},
  title =	 {{OMG} Model Driven Architecture},
  howpublished = {\url{http://www.omg.org/mda/}},
  month =	 may,
  year =	 2006
}
                  
@InCollection{Odenthal-Quibeldey-Cirkel97,
  author =	 {Georg Odenthal and Klaus Quibeldey-Cirkel},
  title =	 {Using Patterns for Design and Documentation},
  booktitle =	 {ECOOP '97 --- Object-Oriented Programming 11th
                  European Conference, Jyv\"{a}skyl\"{a}, Finland},
  publisher =	 SV,
  year =	 1997,
  editor =	 {Mehmet Ak\c{s}it and Satoshi Matsuoka},
  volume =	 1241,
  series =	 LNCS,
  address =	 NY,
  month =	 jun,
  pages =	 {511-529},
  annote =	 {27 references.}
}

@Article{Ogden-etal94,
  author =	 {William F. Ogden and Murali Sitaraman and Bruce
                  W. Weide and Stuart H. Zweben},
  title =	 {Part {I}: The {RESOLVE} Framework and Discipline ---
                  A Research Synopsis},
  journal =	 SIGSOFT,
  year =	 1994,
  volume =	 19,
  number =	 4,
  month =	 oct,
  pages =	 {23-28}
}

@inproceedings{Oheimb-Nipkow02, 
author = {David von Oheimb and Tobias Nipkow}, 
title = {Hoare Logic for {NanoJava}: Auxiliary Variables, Side Effects and Virtual Methods revisited}, 
booktitle = {Formal Methods -- Getting {IT} Right (FME'02)}, 
editor = {Lars-Henrik Eriksson and Peter Alexander Lindsay}, 
conference = {International Symposium of Formal Methods Europe}, 
year = 2002, 
publisher = SV,
series = LNCS, 
volume = {2391}, 
URL = {http://www.springerlink.com/content/bp1vtfr9ha3kl3t5},
pages = {89-105}
}

@PhDThesis{Oheimb01,
  author =	 {David von Oheimb},
  title =	 {Analyzing {Java} in {Isabelle/HOL}: Formalization,
                  Type Safety and {Hoare} Logic},
  school =	 {Technische Universit\"{a}t M\"{u}nchen},
  year =	 2001,
  url =		 {http://www4.in.tum.de/~oheimb/diss/},
  annote =	 {Proved sound and complete Hoare Logic for a subset
                  of sequential Java.}
}

@Article{Oheimb01a,
  author =	 {David von Oheimb},
  title =	 {Hoare logic for {Java} in {Isabelle/HOL}},
  Journal =	 "Concurrency and Computation: Practice and Experience",
  year =	 2001,
  volume =	 13,
  number =	 13,
  URL =          {http://dx.doi.org/10.1002/cpe.598},
  pages =        {1173-1214}
}

@InCollection{Olderog-Rossig93,
  Author =	 "E. R. Olderog and S. Rossig",
  Title =	 "A Case Study in Transformational Design of
                  Concurrent Systems",
  Journal =	 LNCS,
  Number =	 668,
  Publisher =	 SV,
  Address =	 NY,
  Editor =	 "M. C. Gaudel and J. P. Jouannaud",
  Year =	 1993,
  Booktitle =	 "TAPSOFT '93: Theory and Practice of Software
                  Development. 4th International Joint Conference
                  CAAP/FASE",
  Pages =	 "90-104",
  Annote =	 "25 references"
}

@article{Olderog08,
 author = {Ernst-R\"{u}diger Olderog},
 title = {Automatic Verification of Combined Specifications: An Overview},
 journal = {Electron. Notes Theor. Comput. Sci.},
 volume = 207,
 year = 2008,
 pages = {3-16},
 doi = {http://dx.doi.org/10.1016/j.entcs.2008.03.082},
 publisher = {Elsevier Science Publishers B. V.},
 address = {Amsterdam, The Netherlands},
}

@Article{Olderog83,
  Author =	 {{Ernst-R\"{u}diger} Olderog},
  Title =	 "On the notion of expressiveness and the rule of adaptation",
  Journal =	 TCS,
  Volume =	 24,
  Pages =	 "337-347",
  Year =	 1983
}

@TechReport{Olender-Bieman91,
  Author =	 "Kurt M. Olender and James M. Bieman",
  Title =	 "Generating Sequencing Constraints From Algebraic
                  Specifications",
  Institution =	 "Department of Computer Science, Colorado State
                  University",
  Year =	 1991,
  Number =	 "CS-91-104",
  Address =	 "Fort Collins, Colo.",
  Month =	 mar,
  Annote =	 "22 references."
}

@Article{Olsson-etal91,
  Author =	 "Ronald A. Olsson and Richard H. Crawford and
                  W. Wilson Ho and Christopher E. Wee",
  Title =	 "Sequential Debugging at a High Level of Abstraction",
  Journal =	 "IEEE Software",
  Year =	 1991,
  Volume =	 8,
  Number =	 3,
  Month =	 may,
  Pages =	 "27-36",
  Annote =	 "6 references."
}

@PhdThesis{Opdyke92,
  author =	 {William Opdyke},
  title =	 {Refactoring Object-Oriented Frameworks},
  school =	 {University of Illinois at Urbana-Champaign},
  year =	 1992,
  URL =
                  {ftp://st.cs.uiuc.edu/pub/papers/refactoring/opdyke-thesis.ps.Z}
}

@InCollection{Orejas-Navarro-Sanchez91,
  Author =	 "Fernando Orejas and Marisa Navarro and Ana S\'{a}nchez",
  Title =	 "Implementation and Behavioural Equivalence: A Survey",
  BookTitle =	 "Recent Trends in Data Type Specification",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "M. Bidot and C. Choppy",
  Series =	 LNCS,
  Volume =	 655,
  Pages =	 "93-125",
  Address =	 NY,
  Annote =	 "Many references."
}

@Book{Orfali-Harkey-Edwards95,
  author =	 {Robert Orfali and Dan Harkey and Jeri Edwards},
  title =	 {The Essential Distributed Objects Survival Guide},
  publisher =	 {John Wiley \& Sons},
  year =	 1995
}

@Book{Orfali-Harkey-Edwards97,
  author =	 {Robert Orfali and Dan Harkey and Jeri Edwards},
  title =	 {Instant {CORBA}},
  publisher =	 {John Wiley \& Sons},
  year =	 1997
}

@Book{Orfali-Harkey98,
  author =	 {Robert Orfali and Dan Harkey},
  title =	 {Client/Server Programming with {Java} and {CORBA}},
  publisher =	 {John Wiley \& Sons},
  year =	 1998,
  edition =	 {Second Editon}
}

@InProceedings{Oriat05,
  author = 	 {Catherine Oriat},
  title = 	 {Jartege: A Tool for Random Generation of Unit Tests for Java Classes},
  booktitle =	 {First International Conference on the 
    Quality of Software Architectures, QoSA 2005 and
    Second International Workshop on Software Quality, SOQUA 2005},
  pages =	 {242-256},
  year =	 2005,
  volume =	 3712,
  series =	 LNCS,
  address =	 NY,
  month =	 sep,
  publisher =	 SV
}

@Article{Oshana98,
  author =	 {Robert Oshana},
  title =	 {Tailoring {Cleanroom} for Industrial Use},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 6,
  month =	 nov,
  pages =	 {46-55},
  annote =	 {15 references.}
}

@PhDThesis{Oskarsson82,
  Author =	 {\"{O}sten Oskarsson},
  Title =	 "Mechanisms of Modifiability in Large Software
                  Systems",
  School =	 {Software Systems Research Center, Link\"{o}ping
                  University, S-581 83 Link\"{o}ping, Sweden},
  Year =	 1982,
  Note =	 {Link\"{o}ping Studies in Science and Technology,
                  Dissertations, Number 77},
  Annote =	 "Relation between modifiability and modularization,
                  measures of scattering of changes among modules
                  caused by various kinds of change. Stability,
                  extensibility, observability and simplicity are
                  conjectured to aid modifiability. Case study of a
                  release of a large telephone switching system. The
                  following factors helped modifiability: prepared
                  changes modules for external interfaces, indirection
                  through data for some functions, general modules for
                  important abstractions, encapsulated service
                  functions and some application specific
                  paradigms. The following factors hindered
                  modifiability: features which were implemented in
                  multiple modules, or with multiple alternate
                  implementations, features spread among several
                  modules, implementation of decisions in wrong
                  places, changing hardware, data localized in less
                  than general modules, indirect communication, and
                  unnecessary software limits. Trade-offs among these
                  concerns and other goals. 58 references."
}

@InProceedings{Ossher06,
  Author =	 {Harold Ossher},
  Title =	 {Confirmed Join Points},
  BookTitle =	 {SPLAT '05},
  year =	 2005,
  month =	 mar,
  note =         {\url{http://tinyurl.com/2xzffu}}
}

@Article{Osterweil96,
  author =	 "Leon Osterweil and others",
  title =	 "Strategic Directions in Software Quality",
  journal =	 ACMCS,
  volume =	 28,
  number =	 4,
  pages =	 "727-737",
  month =	 dec,
  year =	 1996,
  annote =	 "25 references."
}

@InCollection{Ostroff92,
  Author =	 "J.S. Ostroff",
  Title =	 "Formal Methods for the Specification and Design of
                  Real-Time Safety Critical Systems",
  BookTitle =	 "Real-Time Systems: Abstractions, Languages, and
                  Design Methodologies",
  Publisher =	 "IEEE Computer Society Press",
  Year =	 1992,
  Editor =	 "Krishna M. Kavi",
  Pages =	 "60-87",
  Address =	 "Los Alamitos, California",
  Month =	 oct,
  Annote =	 "144 references."
}

@Article{Ostroff99,
  author =       "Jonathan S. Ostroff",
  title =        "Composition and Refinement of Discrete Real-Time Systems",
  journal =      TOSEM,
  publisher =    "ACM Press",
  year =         1999,
  volume =       8,
  month =        jan,
  number =       1,
  pages =        "1--48"
}

@inproceedings{Ouaknine-Worrell05,
 author = {Jo\"{e}l Ouaknine and James Worrell},
 title = {On the Decidability of Metric Temporal Logic},
 booktitle = {LICS '05: Proceedings of the 20th Annual IEEE Symposium on Logic in Computer Science},
 year = {2005},
 pages = {188-197},
 doi = {http://dx.doi.org/10.1109/LICS.2005.33},
 publisher = {IEEE Computer Society},
 address = {Washington, DC, USA}
}

@phdthesis{Ovlinger03a,
	Author = {Johan Ovlinger},
	Title = {Modular Programming with Aspectual Collaborations},
	School = {Northeastern University},
	Year = {2003}
}

@inproceedings{Owre-Rushby-Shankar92,
  title={{PVS}: A prototype verification system},
  author={Sam Owre and John M. Rushby and Natarajan Shankar},
  booktitle={International Conference on Automated Deduction},
  pages={748-752},
  year=1992,
  organization={Springer}
}

@Article{Owre-etal95,
  author =	 "Sam Owre and John Rushby and Natarajan Shankar and
                  Friedrich von Henke",
  title =	 "Formal Verification for Fault-Tolerant
                  Architectures: Prolegomena to the Design of {PVS}",
  journal =	 IEEETSE,
  year =	 1995,
  volume =	 21,
  number =	 2,
  pages =	 "107-125",
  month =	 feb,
  annote =	 "84 references."
}

@Misc{PITAC05,
  author =	 {President's Information Technology Advisory Committee},
  title =	 {Cybersecurity: A Crisis of Prioritization},
  howpublished = {\url{http://www.nitrd.gov/pitac/reports/20050301_cybersecurity/cybersecurity.pdf}},
  month =	 feb,
  year =	 2005
}

@Misc{PITAC99,
  author =	 {President's Information Technology Advisory Committee},
  title =	 {Information Technology Research: Investing in Our Future},
  howpublished = {\url{http://www.nitrd.gov/pitac/report/}},
  month =	 feb,
  year =	 1999
}

@InCollection{Pacheo-Ernst05,
  author = 	 {Carlos Pacheo and Michael Ernst},
  title = 	 {Eclat: Automatic generation and classification of test inputs},
  booktitle =	 {ECOOP 2005 --- Object-Oriented Programming 19th
                  European Conference, Glasgow, UK},
  pages =	 {504-527},
  year =	 2005,
  editor =	 {Andrew P. Black},
  volume =	 3586,
  series =	 LNCS,
  address =	 {Berlin},
  month =	 jul,
  publisher =	 SV
}

@inproceedings{Pacheco-Ernst07,
author = {Carlos Pacheco and Michael D. Ernst},
title = {Randoop: Feedback-Directed Random Testing for {Java}},
year = {2007},
isbn = {9781595938657},
publisher = ACM,
address = NY,
url = {https://doi.org/10.1145/1297846.1297902},
doi = {10.1145/1297846.1297902},
abstract = {R<scp>ANDOOP</scp> for Java generates unit tests for Java code using feedback-directed random test generation. Below we describe R<scp>ANDOOP</scp>'s input, output, and test generation algorithm. We also give an overview of RANDOOP's annotation-based interface for specifying configuration parameters that affect R<scp>ANDOOP</scp>'s behavior and output.},
booktitle = {Companion to the 22nd ACM SIGPLAN Conference on Object-Oriented Programming Systems and Applications Companion},
pages = {815–816},
numpages = {2},
keywords = {random testing, Java, automatic test generation},
location = {Montreal, Quebec, Canada},
series = {OOPSLA '07}
}

@TechReport{Paech-Rumpe94,
  Author =	 "Barabara Paech and Berhard Rumpe",
  Title =	 "A new Concept of Refinement used for Behavior
                  Modelling with Automata",
  Institution =	 "Institut fur Informatik",
  Year =	 1994,
  Number =	 "TUM-I9413",
  Address =	 "Technische Universitat Munchen, D-80290 Munchen",
  Month =	 may,
  Annote =	 "14 references."
}

@InProceedings{Paech-Rumpe95,
  Author =	 "Barabara Paech and Berhard Rumpe",
  Title =	 "A new Concept of Refinement used for Behavior
                  Modelling with Automata",
  booktitle =	 "{FME '94}: Industrial Benefits of Formal Methods",
  publisher =	 SV,
  year =	 1995,
  editor =	 "Maurice Naftalin and Tim Denvir and Miquel Bertran",
  volume =	 873,
  series =	 LNCS,
  pages =	 "154-174",
  address =	 NY,
  annote =	 "14 references."
}


@InProceedings{Paige-Ostroff99,
  title =        "Developing {BON} as an Industrial-Strength Formal
                 Method",
  author =       "Richard F. Paige and Jonathan S. Ostroff",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  BookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1708,
  pages =        "834-853",
  annote =       "Argues that BON is better suited to formal methods than UML. 23 references."
}

@Article{Paige-etal02,
  author = 	 {Richard Paige and Liliya Kaminskaya and Jonathan Ostroff and Jason Lancaric},
  title = 	 {{BON-CASE}: An Extensible {CASE} Tool for Formal Specification and Reasoning},
  journal = 	 JOT,
  year = 	 2002,
  volume =	 1,
  number =	 3,
  pages =	 {77-96},
  URL =          {http://www.jot.fm/issues/issue_2002_08/article5}
}

@Article{Paige86,
  Author =	 "Robert Paige",
  Title =	 "Programming with Invariants",
  Journal =	 "IEEE Software",
  Month =	 jan,
  Year =	 1986,
  Pages =	 "56-69",
  Annote =	 "Examples in extended SETL. 12+36 references."
}

@Article{Palasinska-Pigozzi95,
  author =	 {K. Pa{\l}asi\'{n}ska and D. Pigozzi},
  title =	 {Gentzen-Style Axiomatizations in Equational Logic},
  journal =	 {Algebra Universalis},
  year =	 1995,
  volume =	 34,
  pages =	 {128-143}
}

@TechReport{Palasinska-Pigozzi95b,
  author =	 {K. Pa{\l}asi\'{n}ska and D. Pigozzi},
  title =	 {Implication in Abstract Algebraic Logic},
  institution =	 {Centre de Recerca Matematica},
  address =	 {Barcelona, Spain},
  year =	 1995,
  month =	 dec,
  type =	 {preprint},
  number =	 "311"
}

@inproceedings{Palsberg-Jay98,
  author =	 "Jens Palsberg and C. Barry Jay",
  title =	 "The Essence of the Visitor Pattern",
  booktitle =	 "Proc. 22nd {IEEE} Int. Computer Software and
                  Applications Conf., {COMPSAC}, Vienna, Austria",
  publisher =	 IEEE,
  address =	 {Los Alamitos, California},
  month =	 aug,
  pages =	 "9--15",
  year =	 "1998",
  url =		 "citeseer.nj.nec.com/palsberg97essence.html"
}

@InCollection{Palsberg92,
  Author =	 "Jens Palsberg",
  Title =	 "A Provably Correct Compiler Generator",
  BookTitle =	 "ESOP '92, 4th European Symposium on Programming,
                  Rennes, France, February 1992, Proceedings",
  Publisher =	 SV,
  Year =	 1992,
  Editor =	 "Bernd Krieg-Bruckner",
  Series =	 LNCS,
  Address =	 NY,
  Volume =	 582,
  Pages =	 "418-434",
  Annote =	 "65 references"
}

@Article{Palsberg97,
  author =	 {Jens Palsberg},
  title =	 {Class-Graph Inference for Adaptive Programs},
  journal =	 TAPOS,
  year =	 1997,
  volume =	 3,
  number =	 2,
  pages =	 {75-85},
  annote =	 {25 references.}
}

@Article{Panzl78,
  Author =	 {D.J. Panzl},
  Title =	 {Automatic Software Test Driver},
  Journal =	 {IEEE Computer},
  Year =	 1978,
  Month =	 apr,
  Pages =	 {44--50}
}

@Unpublished{ParasoftJcontract03,
  author =	 "{Parasoft Corporation}",
  title =	 {Using Design by Contract\textsuperscript{TM} to
                  Automate {Java}\textsuperscript{TM} Software and
                  Component Testing},
  note =	 {Available from
                  \url{http://www.parasoft.com/jsp/products/tech_papers.jsp?product=Jcontract},
                  as of Feb.~2003},
}

@Unpublished{ParasoftJtest03,
  author =	 "{Parasoft Corporation}",
  title =	 {Automatic {Java}\textsuperscript{TM} Software and
                  Component Testing: Using {Jtest} to Automate Unit
                  Testing and Coding Standard Enforcement},
  note =	 {Available from
                  \url{http://www.parasoft.com/jsp/products/tech_papers.jsp?product=Jtest},
                  as of Feb.~2003},
}

@Article{Parikh85,
  Author =	 "Girish Parikh",
  Title =	 "Discovering the World of Software Maintenance:
                  Selected Readings",
  Journal =	 SIGSOFT,
  Volume =	 10,
  Number =	 5,
  Month =	 oct,
  Year =	 1985,
  Pages =	 "79-88",
  Annote =	 "Annotated and graded bibliography with 47
                  references."
}

@Article{Parissis-Ouabdesselam96,
  author =	 {Ioannis Parissis and Farid Ouabdesselam},
  title =	 {Specification-based Testing of Synchronous Software},
  journal =	 SIGSOFT,
  year =	 1996,
  editor =	 {David Garlan},
  volume =	 21,
  number =	 6,
  month =	 nov,
  pages =	 {127-134},
  note =	 {SIGSOFT '96: Proceedings of the Fourth ACM SIGSOFT
                  Symposium on the Foundations of Software
                  Engineering, San Francisco, California},
  annote =	 {25 references.}
}

@Book{Parker93,
  author =	 "Alan Parker",
  title =	 "Algorithms and Data Structures in {C++}",
  publisher =	 "CRC Press",
  year =	 1993,
  address =	 "Boca Raton, LA"
}

@InCollection{Parkin-Wichman93,
  Author =	 "Graeme I. Parkin and Brian Wichmann",
  Title =	 "Conformity Clause for VDM-SL",
  BookTitle =	 "Industrial-Strength Formal Methods, First
                  International Symposium of Formal Methods Europe,
                  Odense, Denmark",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "J.C.P. Woodcock and P.G. Larsen",
  Series =	 LNCS,
  Volume =	 670,
  Pages =	 "501-520",
  Address =	 NY,
  Month =	 apr,
  Annote =	 "27 references."
}

@inproceedings{Parkinson-Bierman05,
 author = {Matthew Parkinson and Gavin Bierman},
 title = {Separation logic and abstraction},
 booktitle = POPL,
 editor = {Jens Palsberg and Mart\'{\i}n Abadi},
 month = jan,
 year = 2005,
 pages = {247-258},
 URL = {http://doi.acm.org/10.1145/1040305.1040326},
 publisher = ACM,
 address = NY
 }

@inproceedings{Parkinson-Bierman08,
 author = {Matthew Parkinson and Gavin Bierman},
 title = {Separation Logic, Abstraction and Inheritance},
 booktitle = POPL,
 editor = {Philip Wadler},
 month = jan,
 year = 2008,
 pages = {75-86},
 publisher = ACM,
 address = NY,
 annote={30 references.}
}

@inproceedings{Parkinson-Bornat-Calcagno06,
 author = {Matthew Parkinson and Richard Bornat and Cristiano Calcagno},
 title = {Variables as Resource in {Hoare} Logics},
 booktitle = {21th IEEE Symposium on Logic in Computer Science (LICS)},
 month = aug,
 year = 2006,
 pages = {137--146},
 publisher = IEEE,
 address = {Washington, DC, USA},
 URL={http://dx.doi.org/10.1109/LICS.2006.52}
}

@article{Parkinson-Summers12,
author = {Matthew Parkinson and Alexander J. Summers},
title = {The Relationship Between Separation Logic and Implicit Dynamic Frames},
year = {2012},
month = jan,
abstract = {Separation logic is a concise method for specifying programs that manipulate dynamically allocated storage. Partially inspired by separation logic, Implicit Dynamic Frames has recently been proposed, aiming at first-order tool support. In this paper, we precisely connect the semantics of these two logics. We define a logic whose syntax subsumes both that of a standard separation logic, and that of implicit dynamic frames as sub-syntaxes. We define a total heap semantics for our logic, and, for the separation logic subsyntax, prove it equivalent the standard partial heaps model. In order to define a semantics which works uniformly for both subsyntaxes, we define the novel concept of a minimal state extension, which provides a different (but equivalent) definition of the semantics of separation logic implication and magic wand connectives, while also giving a suitable semantics for these connectives in implicit dynamic frames. We show that our resulting semantics agrees with the existing definition of weakest pre-condition semantics for the implicit dynamic frames fragment. Finally, we show that we can encode the separation logic fragment of our logic into the implicit dynamic frames fragment, preserving semantics. For the connectives typically supported by tools, this shows that separation logic can be faithfully encoded in a first-order automatic verification tool (Chalice).},
url = {https://doi.org/10.2168/LMCS-8(3:1)2012},
journal = {Logical Methods in Computer Science},
volume = {8},
number = {3},
pages = {1-54},
annote = {19 references.}
}
                  
@TechReport{Parkinson05,
  author =	 {Matthew J. Parkinson},
  title =	 {Local Reasoning for {Java}},
  institution =	 {University of Cambridge Computer Laboratory},
  year =	 2005,
  number =	 654,
  month =	 nov,
  note = {The author's Ph.D.\ dissertation.},
  URL = {http://www.cl.cam.ac.uk/TechReports/UCAM-CL-TR-654.pdf}
}

@InProceedings{Parkinson07,
  author = 	 {Matthew Parkinson},
  title = 	 {Class Invariants: The end of the road?},
  booktitle = {Proceedings of the $n$th International Workshop on Aliasing, Confinement and Ownership in Object-oriented Programming (IWACO)},
  year = 	 2007,
  editor = 	 {Tobias Wrigstad},
  pages = 	 {9-10},
  month = 	 {jul},
  URL = 	 {https://people.dsv.su.se/~tobias/iwaco/proceedings-complete.pdf},
  annote =       {10 references.}
}

@Article{Parnas-Madey-Iglewski94,
  author =	 "David Lorge Parnas and Jan Madey and Michal
                  Iglewski",
  title =	 "Precise Documentation of Well-Structured Programs",
  journal =	 "IEEE Transactions on Software Engineering",
  year =	 "1994",
  volume =	 "20",
  number =	 "12",
  pages =	 "948--976",
  month =	 dec
}

@TechReport{Parnas-Madey91,
  author =	 "D. L. Parnas and J. Madey",
  title =	 "Functional documentation for computer systems
                  engineering",
  type =	 "CRL Report",
  number =	 "No.\ 237, Version 2",
  institution =	 "TRIO, Communications Research Laboratory",
  address =	 "Faculty of Engineering, McMaster University,
                  Hamilton, Ontario, Canada L8S 4K1",
  month =	 sep,
  year =	 1991
}

@Article{Parnas-Madey95,
  title =	 "Functional documents for computer systems",
  author =	 "David Lorge Parnas and Jan Madey",
  pages =	 "41--61",
  journal =	 SCP,
  month =	 oct,
  year =	 1995,
  volume =	 25,
  number =	 1
}

@Article{Parnas-Siewiorek75,
  Author =	 "D. L. Parnas and D. P. Siewiorek",
  Title =	 "Transparency in the Design of Hierarchically
                  Structured Systems",
  Journal =	 CACM,
  Volume =	 18,
  Year =	 1975,
  Number =	 7,
  Month =	 jul,
  Pages =	 "401-408",
  Annote =	 "Design of hierarchically structured systems. Method
                  for evaluating the cost of requiring programmers to
                  work with an abstraction on a real machine. 18
                  references."
}

@TechReport{Parnas-Smith-Pearce88,
  Author =	 "David L. Parnas and David G. Smith and Trevor
                  Pearce",
  Title =	 "Making Formal Software Documentation More Practical
                  A Progress Report",
  Month =	 nov,
  Year =	 1988,
  Number =	 "88-236",
  Institution =	 "Department of Computing and Information Science,
                  Queen's University at Kingston",
  Address =	 "Kingston, Ontario, Canada",
  Annote =	 "21 references."
}

@TechReport{Parnas-Wang89,
  Author =	 "David Lorge Parnas and Yabo Wang",
  Title =	 "The Trace Assertion Method of Module Interface
                  Specification",
  Month =	 oct,
  Year =	 1989,
  Number =	 "89-261",
  Institution =	 "Department of Computing and Information Science,
                  Queen's University at Kingston",
  Address =	 "Kingston, Ontario, Canada",
  Annote =	 "Reference and summary of the trace assertion
                  method. 18 references."
}

@InProceedings{Parnas71,
  Title =	 "Information Distribution Aspects of Design
                  Methodology",
  Author =	 "D. L. Parnas",
  BookTitle =	 "Proceedings of IFIP Congress 71",
  Organization = IFIP,
  Year =	 1971,
  Pages =	 "339-344"
}

@Article{Parnas72a,
  Author =	 "D. L. Parnas",
  Title =	 "A Technique for the Specification of Software
                  Modules with Examples",
  Journal =	 CACM,
  Volume =	 15,
  Year =	 1972,
  Number =	 5,
  Month =	 may,
  Pages =	 "330-336",
  Annote =	 "Complete but not overly constrained specifications
                  are stressed. 6 references."
}

@Article{Parnas72b,
  Title =	 "On the Criteria to be Used in Decomposing Systems
                  into Modules",
  Author =	 "D. L. Parnas",
  Journal =	 CACM,
  Year =	 1972,
  Month =	 dec,
  Volume =	 15,
  Number =	 12,
  Pages =	 "1053-1058"
}

@InCollection{Parnas75,
  Author =	 "D. L. Parnas",
  Title =	 "Software Engineering or Methods for the Multi-Person
                  construction of Multi-Version Programs",
  BookTitle =	 "Programming Methodology, 4th Informatik Symposium,
                  IBM Germany, Wildbad, 25-27 September, 1974",
  Series =	 LNCS,
  Editor =	 "Clemens E. Hackl",
  Publisher =	 SV,
  Address =	 NY,
  Volume =	 23,
  Year =	 1975,
  Pages =	 "225-235",
  Annote =	 "Overview of methods to achieve desired
                  properties. Limitations of information hiding for
                  efficiency. 13 references."
}

@Article{Parnas76,
  Author =	 "David L. Parnas",
  Title =	 "On the Design and Development of Program Families",
  Journal =	 "IEEE Transactions on Software Engineering",
  Volume =	 "SE-2",
  Year =	 1976,
  Number =	 1,
  Month =	 mar,
  Pages =	 "1-9",
  Annote =	 "Development of a whole set of programs. 16
                  references."
}

@Article{Parnas79a,
  Author =	 "D. L. Parnas",
  Title =	 "Designing Software for Ease of Expansion and
                  Contraction",
  Journal =	 IEEETSE,
  Volume =	 "SE-5",
  Year =	 1979,
  Number =	 2,
  Month =	 mar,
  Pages =	 "128-138",
  Annote =	 "Focuses on design of software that can be subseted
                  and expanded. Families of programs sharing subsets
                  of modules. Loops in the 'uses' relation should be
                  avoided. Minimal program subset and minimal
                  increments. Virtual machines, modules, uses
                  relation. Criteria for letting a module use another
                  module. Example. 21 references."
}

@InCollection{Parnas79b,
  Author =	 "David L. Parnas",
  Title =	 "The Role of Program Specifications",
  BookTitle =	 "Research Directions in Software Technology",
  Editor =	 "Peter Wegner",
  Publisher =	 MITP,
  Address =	 "Cambridge, Mass.",
  Year =	 1979,
  Pages =	 "364-370",
  Annote =	 "Requirements and design specifications should not be
                  distinguished. Use of informal specifications is
                  better than formal ones. Abstract specifications
                  always better than operational specs. 11
                  references."
}

@Article{Parnas93,
  Author =	 "D. L. Parnas",
  Title =	 "Predicate Logic for Software Engineering",
  Journal =	 IEEETSE,
  Volume =	 19,
  Year =	 1993,
  Number =	 9,
  Month =	 sep,
  Pages =	 "856-862",
  Annote =	 "Logic that deals with partial functions. 9 references."
}

@Article{Partsch-Steinbruggen83,
  Author =	 {H. Partsch and R. Steinbr\"{u}ggen},
  Title =	 "Program Transformation Systems",
  Journal =	 "Computing Surveys",
  Volume =	 15,
  Number =	 3,
  Month =	 sep,
  Year =	 1983,
  Pages =	 "199-236",
  Annote =	 "Comprehensive survey of current research
                  efforts. 184 references."
}

@Book{Partsch90,
  Author =	 "Helmut A. Partsch",
  Title =	 "Specification and transformation of programs: a
                  formal approach to software development",
  Publisher =	 SV,
  Year =	 "1990",
  Series =	 "Texts and Monographs in Computer Science",
  Address =	 NY
}

@InCollection{Partsch93,
  Author =	 "Helmut Partsch",
  Title =	 "Formal problem specification on an algebraic basisi",
  BookTitle =	 "Formal Program Development",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Bernhard Moeller and Helmut Partsch and Steve
                  Schuman",
  Series =	 LNCS,
  Volume =	 755,
  Pages =	 "183-224",
  Address =	 NY,
  Month =	 jul,
  Annote =	 "42 references."
}

@Article{Paulo-Masiero-deOliveira99,
  author =	 {Fabiano Borges Paulo and Paulo Cesar Masiero and
                  Maria Cristina Fierreira de Oliveira},
  title =	 {Hypercharts: Extended Statecharts to Support
                  Hypermedia Specification},
  journal =	 IEEETSE,
  year =	 1999,
  volume =	 25,
  number =	 1,
  month =	 jan,
  pages =	 {33-49},
  annote =	 {18 references.}
}

@Book{Paulson87,
  author =       "Lawrence C. Paulson",
  title =        "Logic and Computations: Interactive Proof with
                  Cambridge {LCF}",
  publisher =    "Cambridge University Press",
  year =         "1987",
  Series =       "Cambridge Tracts in Theoretical Computer 
                  Science, Volume 2"
}

@InProceedings{Paulson90,
  author =	 "Lawrence C. Paulson",
  title =	 "Isabelle: The next seven hundred theorem provers",
  booktitle =	 "Proceedings of the 9th International Conference on
                  Automated Deduction",
  editor =	 "M. Stickel",
  location =     "Kaiserslautern, West Germany",
  series =	 LNCS,
  publisher =	 SV,
  address =	 "Berlin",
  volume =	 449,
  year =	 1990,
  pages =	 "772-773"
}

@Book{Paulson94,
  author =	 "Lawrence C. Paulson",
  title =	 "Isabelle: {A} Generic Theorem Prover",
  publisher =	 SV,
  Series =	 LNCS,
  Volume =	 828,
  year =	 "1994",
  keywords =	 "Isabelle"
}

@InProceedings{Pavlova-etal04,
  author = 	 {M. Pavlova and G. Barthe and L. Burdy and Marieke Huisman and J.-L. Lanet},
  title = 	 {Enforcing High-Level Security Properties For Applets},
  booktitle =	 {CARDIS'04},
  pages =	 {1-16},
  year =	 2004,
  editor =	 {J.-J. Quisquater and P. Paradinas and Y. Deswarte and A. A. El Kalam},
  publisher =	 {Kluwer},
  URL = 	 {ftp://ftp-sop.inria.fr/everest/Marieke.Huisman/cardis.pdf}
}

@inproceedings{Pearce22,
author = {David J. Pearce},
title = {Language Design Meets Verifying Compilers (Keynote)},
year = {2022},
isbn = {9781450399203},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3564719.3570917},
doi = {10.1145/3564719.3570917},
abstract = {The dream of developing compilers that automatically verify whether or not programs meet their specifications remains an ongoing challenge. Such "verifying compilers" are (finally) on the verge of entering mainstream software development. This is partly due to advancements made over the last few decades, but also to the increasingly significant and complex role software plays in the modern world. As computer scientists, we should encourage this transition and help relegate many forms of software error to the history books. One way of increasing adoption is to design languages around these tools which look, on the surface, like regular programming languages. That is, to seamlessly integrate specification and verification and offer something that, for the everyday programmer, appears as nothing more than glorified type checking. This requires, amongst other things, careful consideration as to which language features mesh well with verification, and which do not. The design space here is interesting and subtle, but has been largely overlooked. In this talk, I will attempt to shed light on this murky area by contrasting the choices made in two existing languages: Dafny and Whiley.},
booktitle = {Proceedings of the 21st ACM SIGPLAN International Conference on Generative Programming: Concepts and Experiences},
pages = {1–4},
numpages = {4},
keywords = {Verifying Compilers, Formal Methods},
location = {Auckland, New Zealand},
series = {GPCE 2022}
}

@InProceedings{Pearce-Groves13,
author="David J. Pearce and Lindsay Groves",
editor="Martin Erwig and Richard F. Paige and Eric Van Wyk",
title="Whiley: A Platform for Research in Software Verification",
booktitle="Software Language Engineering",
year="2013",
publisher="Springer International Publishing",
address="Cham",
pages="238--248",
abstract="An ongoing challenge for computer science is the development of a tool which automatically verifies programs meet their specifications, and are free from runtime errors such as divide-by-zero, array out-of-bounds and null dereferences. Several impressive systems have been developed to this end, such as ESC/Java and Spec{\#}, which build on existing programming languages (e.g. Java, C{\#}). However, there remains a need for an open research platform in this area. We have developed the Whiley programming language, and its accompanying verifying compiler, as an open platform for research. Whiley has been designed from the ground up to simplify the verification process. In this paper, we introduce the Whiley language and it accompanying verifying compiler tool.",
isbn="978-3-319-02654-1",
url = "https://tinyurl.com/235y2x6c"
}

% DOI = "10.1007/978-3-642-19861-8_7",
@InProceedings{Pearce11,
author="David J. Pearce",
editor="Jens, Knoop",
title="JPure: A Modular Purity System for {Java}",
booktitle="Compiler Construction",
year="2011",
publisher="Springer Berlin Heidelberg",
address="Berlin, Heidelberg",
pages="104--123",
abstract="Purity Analysis is the problem of determining whether or not a method may have side-effects. This has applications in automatic parallelisation, extended static checking, and more. We present a novel purity system for Java that employs purity annotations which can be checked modularly. This is done using a flow-sensitive, intraprocedural analysis. The system exploits two properties, called freshness and locality, to increase the range of methods that can be considered pure. JPure also includes an inference engine for annotating legacy code. We evaluate our system against several packages from the Java Standard Library. Our results indicate it is possible to uncover significant amounts of purity efficiently.",
isbn="978-3-642-19861-8"
}

@InProceedings{Peleg-Polikarpova20,
  author =	{Hila Peleg and Nadia Polikarpova},
  title =	{{Perfect Is the Enemy of Good: Best-Effort Program Synthesis}},
  booktitle =	{34th European Conference on Object-Oriented Programming (ECOOP 2020)},
  pages =	{2:1--2:30},
  series =	{Leibniz International Proceedings in Informatics (LIPIcs)},
  ISBN =	{978-3-95977-154-2},
  ISSN =	{1868-8969},
  year =	{2020},
  volume =	{166},
  editor =	{Robert Hirschfeld and Tobias Pape},
  publisher =	{Schloss Dagstuhl--Leibniz-Zentrum f{\"u}r Informatik},
  address =	{Dagstuhl, Germany},
  URL =		{https://drops.dagstuhl.de/opus/volltexte/2020/13159},
  URN =		{urn:nbn:de:0030-drops-131593},
  doi =		{10.4230/LIPIcs.ECOOP.2020.2},
  annote =	{Keywords: Program Synthesis, Programming by Example. 59 references.}
}

% DOI = 10.1007/978-3-319-02654-1_13
@InCollection{Penny-Holt-Godfrey91,
  Author =	 "David A. Penny and Richard C. Holt and Michael
                  W. Godfrey",
  Title =	 "Formal Specification in Metamorphic Programming",
  BookTitle =	 "VDM '91 Formal Software Development Methods 4th
                  International Symposium of VDM Europe
                  Noordwijkerhout, The Netherlands, Volume 1:
                  Conference Contributions",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "S. Prehn and W. J. Toetenel",
  Series =	 LNCS,
  Volume =	 551,
  Pages =	 "11-30",
  Address =	 NY,
  Month =	 oct,
  Annote =	 "Tries to minimize gaps between analysis,
                  specification, prototyping, implementation, and
                  tuning. Idea is that the outside view of the
                  software is a cocoon that doesn't change, and keeps
                  metamorphis inside. 26 references."
}


@InCollection{Pepper93,
  Author =	 "Peter Pepper",
  Title =	 "Program development in an algebraic setting",
  BookTitle =	 "Formal Program Development",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Bernhard Moeller and Helmut Partsch and Steve
                  Schuman",
  Series =	 LNCS,
  Volume =	 755,
  Pages =	 "225-262",
  Address =	 NY,
  Month =	 jul,
  Annote =	 "37 references."
}

@InProceedings{Perez-Cheon-Gates06,
  Author =	 {Angelica B. Perez and Yoonsik Cheon and Ann Q. Gates},
  Title =	 {Canica: An {IDE} for the {Java Modeling Language}},
  BookTitle =	 {Proceedings of the International 
                  Conference on Software Engineering and Applications,
                  November 13-15, 2006, Dallas, TX, USA},
  Year =	 2006,
  Pages =        {1952--1954},
  URL =          {http://www.cs.utep.edu/~cheon/techreport/tr06-36.pdf},
}

@TechReport{Perl-Weihl-Noble98,
  Author =	 "Sharon E. Perl and William E. Weihl and Brian Noble",
  Title =	 "Continuous Monitoring and Performance Specification",
  institution =	 DECSRC,
  Year =	 1998,
  number =	 153,
  Address =	 "130 Lytton Avenue, Palo Alto, CA 94301"
}

@InProceedings{Perl-Weihl93,
  Author =	 "Sharon E. Perl and William E. Weihl",
  Title =	 "Performance Assertion Checking",
  BookTitle =	 "14th ACM Symposium on Operating Systems Principles",
  Location =     "Asheville, NC",                  
  Month =        dec,
  Year =	 1993,
  Pages =	 "134-145",
  Publisher =    ACM,
  Address =      NY,
  url =          {http://doi.acm.org/10.1145/168619.168630}
}

@Article{Perry-Kaiser90,
  Author =	 "D. E. Perry and G. E. Kaiser",
  Title =	 "Adequate Testing and Object-Oriented Programming",
  Journal =	 JOOP,
  Volume =	 2,
  Number =	 5,
  Pages =	 "13-19",
  Year =	 1990,
  Month =	 "Jan/Feb"
}

@InProceedings{Perry89,
  author =	 "D. E. Perry",
  title =	 "The {Inscape} Environment",
  booktitle =	 "Proceedings of the~11th~International Conference on
                  Software Engineering",
  pages =	 "2--12",
  month =	 may,
  year =	 "1989",
  abstract =	 "The Inscape Environment is an integrated software
                  development environment for building large software
                  systems by large groups of developers. It provides
                  tools that are knowledgeable about the process of
                  system construction and evolution and that work in
                  symbiosis with the system builders and
                  evolvers. These tools are integrated around the
                  constructive use of formal module interface
                  specifications. The author first discusses the
                  problems that Inscape addresses, outlines his
                  research strategies and approaches to solving these
                  problems, and summarizes the contributions of the
                  Inscape Environment. He then discusses the major
                  aspects of the Inscape Environment: the
                  specification language, system construction, system
                  evolution, use and reuse, and validation. The author
                  illustrates these various components with examples
                  and discussions.",
}

@InProceedings{Perry89a,
  author =	 "Dewayne E. Perry",
  title =	 "An Overview of the {Inscape} environment",
  booktitle =	 "Proceedings of the International Workshop on
                  Environments",
  year =	 "1989",
  editor =	 "Fred Long",
  pages =	 "131--135",
  address =	 "Chinon, France",
  organization = "Lecture Notes in Computer Science Nr. 467",
  publisher =	 SV,
  month =	 sep,
}

@InProceedings{Peters-Parnas94,
  Author =	 {Dennis Peters and David L. Parnas},
  Title =	 {Generating a Test Oracle from Program Documentation},
  Year =	 1994,
  Month =	 aug,
  Pages =	 {58--65},
  Booktitle =	 {Proceedings of {ISSTA 94}, Seattle, Washington,
                  August, 1994},
  Publisher =	 {ACM Press}
}

@Article{Peters-Parnas98,
  author =	 {Dennis K. Peters and David Lorge Parnas},
  title =	 {Using Test Oracles Generated from Program
                  Documentation},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 3,
  pages =	 {161-173},
  month =	 mar,
  annote =	 {LD-relations and tabular forms of specification. 37
                  references.}
}

@InProceedings{Petre-Winder88,
  Author =	 "M. Petre and R. L. Winder",
  Title =	 "Issues Governing the Suitability of Programming
                  Languages for Programming Tasks",
  BookTitle =	 "People and Computers IV: Proceedings of HCI'88",
  Year =	 1988,
  Publisher =	 "Cambridge University Press",
  Address =	 "Cambridge"
}

@InCollection{Pettorossi-Proietti93,
  Author =	 "Alberto Pettorossi and Maurizio Proietti",
  Title =	 "Rules and Strategies for program transformation",
  BookTitle =	 "Formal Program Development",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Bernhard Moeller and Helmut Partsch and Steve
                  Schuman",
  Series =	 LNCS,
  Volume =	 755,
  Pages =	 "263-304",
  Address =	 NY,
  Month =	 jul,
  Annote =	 "84 references."
}

@Article{Pfleeger-etal97,
  author =	 {Shari Lawrence Pfleeger and Ross Jeffery and Bill
                  Curtis and Barbara Kitchenham},
  title =	 {Status Report on Software Measurement},
  journal =	 {IEEE Software},
  year =	 1997,
  volume =	 14,
  number =	 2,
  month =	 mar,
  pages =	 {33-43},
  annote =	 {Software metrics. More than 23 references.}
}

@Book{Pfleeger98,
  author =	 {Shari Lawrence Pfleeger},
  title =	 {Software Engineering: Theory and Practice},
  publisher =	 {Prentice-Hall},
  year =	 1998,
  address =	 {Upper Saddle River, NJ},
  annote =	 {Annotated bibliography with many references.}
}

@article{Pichler-Ostermann-Mezini03,
	Author = {Roman Pichler and Klaus Ostermann and Mira Mezini},
	Title = {On aspectualizing component models},
	Journal = SPandE,
	Number = {10},
	Pages = {957-974},
	Volume = {33},
	Year = {2003}
}

@inproceedings{Pierik-Boer05,
author={C. Pierik and F.S. de Boer},
title={On Behavioral Subtyping and Completeness},
booktitle={{ECOOP} Workshop on Formal Techniques for {Java}-like Programs},
URL={http://www.cs.ru.nl/ftfjp/2005/Pierik.pdf},
year=2005
}

@PhdThesis{Pierik06,
  author = {Cees Pierik},
  title = {Validation Techniques for Object-Oriented Proof Outlines},
  school = 	 {Universiteit Utrecht},
  year = 	 2006,
  URL = {http://igitur-archive.library.uu.nl/dissertations/2006-0502-200341/index.htm}
}

@phdthesis{Pike06,
 author = {Lee Pike},
 title = {Formal verification of time-triggered systems},
 year = 2006,
 publisher = {Indiana University},
 address = {Indianapolis, IN, USA},
}

@Article{Pillai-Nair97,
  author =	 {Krishnakumar Pillai and V. S. Suhumaran Nair},
  title =	 {A Model for Software Development Effort and Cost
                  Estimation},
  journal =	 IEEETSE,
  year =	 1997,
  volume =	 23,
  number =	 8,
  month =	 aug,
  pages =	 {485-497},
  annote =	 {17 references.}
}

@InCollection{Pinci-Shapiro90,
  Author =	 "Valerio O. Pinci and Robert M. Shapiro",
  Title =	 "An Integrated Software Development Methodology Based
                  on {Hierarchical Colored Petri Nets}",
  BookTitle =	 "Advances in Petra nets 1990",
  Publisher =	 SV,
  Year =	 1990,
  Editor =	 "G. Rosenberg",
  Series =	 LNCS,
  Volume =	 483,
  Address =	 NY,
  Annote =	 "10 references."
}

@inproceedings{Pizlo-etal10,
 author = {Pizlo, Filip and Ziarek, Lukasz and Blanton, Ethan and Maj, Petr and Vitek, Jan},
 title = {High-level programming of embedded hard real-time devices},
 booktitle = {Proceedings of the 5th European conference on Computer systems},
 series = {EuroSys '10},
 year = {2010},
 isbn = {978-1-60558-577-2},
 location = {Paris, France},
 pages = {69--82},
 numpages = {14},
 url = {http://doi.acm.org/10.1145/1755913.1755922},
 doi = {http://doi.acm.org/10.1145/1755913.1755922},
 acmid = {1755922},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {java virtual machine, memory management, real-time systems},
}

@Article{Plat-Larsen92,
  Author =	 "Nico Plat and Peter Gorm Larsen",
  Title =	 "An Overview of the {ISO/VDM-SL} Standard",
  Journal =	 SIGPLAN,
  Year =	 1992,
  Volume =	 27,
  Number =	 8,
  Month =	 aug,
  Pages =	 "76-82",
  Annote =	 "16 references."
} 

@InCollection{Plat-vanKatwijk-Pronk91,
  Author =	 "N. Plat and J. van Katwijk and K. Pronk",
  Title =	 "A case for structured analysis/formal design",
  BookTitle =	 "{V}{D}{M} 91 - Formal Software Development Methods",
  Publisher =	 SV,
  Series =	 LNCS,
  Volume =	 551,
  Year =	 1991
}

@inproceedings{Plsek-etal10,
 author = {Plsek, Ales and Zhao, Lei and Sahin, Veysel H. and Tang, Daniel and Kalibera, Tomas and Vitek, Jan},
 title = "Developing Safety Critical Java applications with o{SCJ}/{L}0",
 booktitle = {JTRES '10: Proceedings of the 8th International Workshop on Java Technologies for Real-Time and Embedded Systems},
 year = {2010},
 isbn = {978-1-4503-0122-0},
 pages = {95--101},
 location = {Prague, Czech Republic},
 doi = {http://doi.acm.org/10.1145/1850771.1850786},
 publisher = {ACM},
 address = {New York, NY, USA},
 }

@article{Pnueli-Siegel-Singerman98,
    author = "A. Pnueli and M. Siegel and E. Singerman",
    title = "Translation Validation",
    journal = "Lecture Notes in Computer Science",
    volume = 1384,
    pages = "151-166",
    year = "1998",
    url = "citeseer.ist.psu.edu/article/pnueli98translation.html"
}
 
@InCollection{Pnueli86,
  Author =	 "A. Pnueli",
  Title =	 "Applications of Temporal Logic to the Specification
                  and Verification of Reactive Systems: A Survey of
                  Current Trends",
  BookTitle =	 "Current trends in Concurrency: Overviews and
                  Tutorials",
  Series =	 LNCS,
  Volume =	 224,
  Editor =	 "W.-P. de Roever and G. Rozenberg",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1986,
  Pages =	 "510-584",
  Annote =       "45 references."
}

@InCollection{Pnueli93,
  Author =	 "A. Pnueli",
  Title =	 "System Specification and Refinement in Temporal
                  Logic",
  booktitle = "Foundations of Software Technology and
		 Theoretical Computer Science",              
  Series =	 LNCS,
  Volume =	 652,
  Editor =	 "Rudrapatna Shyamasundar",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1993,
  Pages =	 "1-38",
  Annote =	 "30 references"
}

@Misc{Poetzsch-Heffter-Mueller-Schaefer06,
  author =	 {Arnd Poetzsch-Heffter and Peter M{\"u}ller and Jan Sch\"{a}fer},
  title =	 {The {Jive} Tool},
  howpublished = {\url{http://tinyurl.com/3cke34}},
  month =	 apr,
  year =	 2006,
  note =	 {Checked August 2, 2006.}
}

@InProceedings{Poetzsch-Heffter-Mueller99,
  author =	 { A. Poetzsch-Heffter and P. M{\"u}ller },
  title =	 { A Programming Logic for Sequential {J}ava },
  booktitle =	 { European Symposium on Programming ({ESOP}~'99) },
  editor =	 { S. D. Swierstra },
  series =	 LNCS,
  volume =	 1576,
  pages =	 {162-176},
  year =	 1999,
  publisher =	 SV,
  address   =    "Berlin",
  URL =          "http://tinyurl.com/krjle"
}

@InProceedings{Poetzsch-Heffter95,
  author =	 {Arnd Poetzsch-Heffter},
  title =	 {Interface Specifications for Program Modules
                  Supporting Selective Updates and Sharing and their
                  Use in Correctness Proofs},
  booktitle =	 {Softwaretechnik 95},
  editor =	 {G. Snelting},
  year =	 1995
}

@Misc{Poetzsch-Heffter97,
  Author =	 { Arnd Poetzsch-Heffter },
  Title =	 { Specification and Verification of Object-Oriented
                  Programs },
  HowPublished = { Habilitation thesis, Technical University of Munich
                  },
  Month =	 { January },
  Year =	 1997,
  URL =          {http://tinyurl.com/g7xgm}
}

@InProceedings{Polak81,
  Author =	 "Wolfgang Polak",
  Title =	 "Program Verification Based on Denotational
                  Semantics",
  BookTitle =	 "Conference Record of the Eighth ACM Symposium on
                  Principles of Programming Languages",
  Publisher =	 ACM,
  Month =	 jan,
  Year =	 1981,
  Pages =	 "149-158",
  Annote =	 "24 references."
}

@inproceedings{Poll-Berg-Jacobs00,
  author =	 {Erik Poll and Joachim van den Berg and Bart Jacobs},
  title =	 {{Specification of the \mbox{JavaCard} API in JML}},
  booktitle =	 {Smart Card Research and Advanced Application
                  Conference (CARDIS'2000)},
  publisher =	 {Kluwer Acad. Publ.},
  EDITOR =	 "J. Domingo-Ferrer and D. Chan and A. Watson",
  pages =	 "135--154",
  year =	 "2000"
}

@article{Poll-Berg-Jacobs01,
  author =	 {Erik Poll and Joachim van den Berg and Bart Jacobs},
  title =	 {{Formal specification of the {Java Card API} in
                  {JML}: the {APDU} class}},
  journal =	 {Computer Networks},
  publisher =	 {Elsevier Science},
  year =	 {2001},
  volume =	 {36},
  number =	 {4},
  pages =	 {407--421},
}

@inproceedings{Poll-Hartel-deJong02,
  author =	 {Erik Poll and Pieter Hartel and Eduard de Jong},
  title =	 {A {Java} Reference Model of Transacted Memory for
                  Smart Cards},
  booktitle =	 {Smart Card Research and Advanced Application
                  Conference (CARDIS'2002)},
  publisher =	 {USENIX},
  pages =	 "75--86",
  year =	 "2002"
}

@InProceedings{Poll00a,
  Author =	 "Erik Poll",
  Title =	 "A Coalgebraic Semantics of Subtyping",
  BookTitle =	 "Coalgebraic Methods in Computer Science (CMCS)",
  Editor =	 "H. Reichel",
  Publisher =	 "Elsevier, Amsterdam",
  Series =	 ENTCS,
  Number =	 "33",
  Year =	 2000
}

@InProceedings{Poll09,
author="Erik Poll",
editor="Jeremy Gibbons and Jos{\'e} Nuno Oliveira",
title="Teaching Program Specification and Verification Using {JML} and {ESC/Java2}",
booktitle="Teaching Formal Methods",
year="2009",
publisher="Springer",
address="Berlin, Heidelberg",
pages="92--104",
abstract="The paper summarises our experiences teaching formal program specification and verification using the specification language JML and the automated program verification tool ESC/Java2. This technology has proven to be mature and simple enough to introduce students to formal methods, even undergraduate students with no prior knowledge of formal methods and even only very basic knowledge of (Java) programming. However, there are some limitations on the kind of examples that can be comfortably tackled.",
isbn="978-3-642-04912-5"
}


@inproceedings{Poll98a,
   author = {Erik Poll},
   booktitle = {Foundations of Object-Oriented Languages (FOOL5)},
   title = {Behavioural Subtyping for a Type-Theoretic Model of Objects},
   year = {1998},
  place = "San Diego",
  url = {http://www.cs.ru.nl/~erikpoll/publications/fool5.ps.gz}
}

@Article{Ponder-Bush94,
  Author =	 "C. Ponder and B. Bush",
  Title =	 "Polymorphism Considered Harmful",
  Journal =	 "Software Engineering Notes",
  Year =	 1994,
  Volume =	 19,
  Number =	 2,
  Month =	 apr,
  Pages =	 "35-37",
  Annote =	 "3 references."
}

@incollection{Popeea-Chin07,
  author={Corneliu Popeea and Wei-Ngan Chin},
  title={Inferring Disjunctive Postconditions},
year={2007},
isbn={978-3-540-77504-1},
booktitle={Advances in Computer Science - ASIAN 2006. Secure Software and Related Issues},
volume={4435},
series={Lecture Notes in Computer Science},
editor={Okada, Mitsu and Satoh, Ichiro},
doi={10.1007/978-3-540-77505-8_26},
url={http://dx.doi.org/10.1007/978-3-540-77505-8_26},
publisher=SV,
pages={331-345}
}

@Article{Porat-Fertig95,
  author =	 {Sara Porat and Paul Fertig},
  title =	 {Class assertions in {C++}},
  journal =	 JOOP,
  year =	 1995,
  volume =	 8,
  number =	 2,
  month =	 may,
  pages =	 {30-37},
  annote =	 {Similar to Eiffel. 15 references.}
}

@Book{Potter-Sinclair-Till91,
  Author =	 "B. Potter and J. Sinclair and D. Till",
  Title =	 "An Introduction to Formal Specification and {Z}",
  Publisher =	 "Prentice-Hall",
  Year =	 1991
}

@inproceedings{Prasetya15,
author = {{I. S. Wishnu B.} Prasetya},
title = {T3i: A Tool for Generating and Querying Test Suites for Java},
year = {2015},
isbn = {9781450336758},
publisher = ACM,
address = NY,
url = {https://doi.org/10.1145/2786805.2803182},
doi = {10.1145/2786805.2803182},
abstract = { T3i is an automated unit-testing tool to test Java classes. To expose interactions T3i generates test-cases in the form of sequences of calls to the methods of the target class. What separates it from other testing tools is that it treats test suites as first class objects and allows users to e.g. combine, query, and filter them. With these operations, the user can construct a test suite with specific properties. Queries can be used to check correctness properties. Hoare triples, LTL formulas, and algebraic equations can be queried. T3i can be used interactively, thus facilitating more exploratory testing, as well as through a script. The familiar Java syntax can be used to control it, or alternatively one can use the much lighter Groovy syntax. },
booktitle = {Proceedings of the 2015 10th Joint Meeting on Foundations of Software Engineering},
pages = {950–953},
numpages = {4},
keywords = {automated unit testing, automated testing Java, automated testing Object Oriented programs},
location = {Bergamo, Italy},
series = {ESEC/FSE 2015},
annote="9 references."                  
}

@InProceedings{Pratt80,
  Author =	 "V. R. Pratt",
  Title =	 "On Specifying Verifiers",
  BookTitle =	 "Conference Record of the Seventh Annual ACM
                  Symposium on Principles of Programming Languages,
                  Las Vegas, Nevada",
  Organization = ACM,
  Month =	 jan,
  Year =	 1980,
  Pages =	 "106-116",
  Annote =	 "Reply to the De Millo, Lipton, Perlis paper. 11
                  references."
}

@ARTICLE{Prechelt00, 
author={Lutz Prechelt}, 
journal={Computer}, 
title={An empirical comparison of seven programming languages}, 
year={2000}, 
month={oct}, 
volume={33}, 
number={10}, 
pages={23 -29}, 
keywords={C language;C++;Java;Perl;Python;Rexx;Tcl;memory consumption;phone-code program;program language performance;program length;programming language comparison;runtime efficiency;software reliability;C language;C++ language;Java;Perl;authoring languages;programming;}, 
doi={10.1109/2.876288}, 
ISSN={0018-9162},}

@InCollection{Presicce-Pierantonio91,
  Author =	 "F. Parisi Presicce and A. Pierantonio",
  Title =	 "An Algebraic View of Inheritance and Subtyping in
                  Object Oriented Programming",
  BookTitle =	 "ESEC '91: 3rd European Software Engineering
                  Conference, Milan, Italy",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "A. van Lamsweerde and A. Fugetta",
  Series =	 LNCS,
  Volume =	 550,
  Pages =	 "364-379",
  Month =	 oct,
  Annote =	 "19 references."
}

@Book{Pressman05,
  Author =	 "Roger S. Pressman",
  Title =	 "Software Engineering: A Practitioner's Approach",
  Publisher =	 "McGraw-Hill",
  Year =	 2005,
  Address =	 NY,
  Edition =	 "Sixth Edition",
  Annote =       "Several references in each chapter."
}

@Book{Pressman86,
  Author =	 "R. S. Pressman",
  Title =	 "Software Engineering: A Practitioner's Approach",
  Publisher =	 "McGraw-Hill",
  Year =	 1986,
  Address =	 NY,
  Edition =	 "Second Edition"
}

@InProceedings{Pritchard77,
  Author =	 "P. Pritchard",
  Title =	 "Program Proving --- expression languages",
  BookTitle =	 "Information Processing 77",
  Year =	 1977,
  Pages =	 "727-731",
  Publisher =	 "North-Holland",
  Address =	 "Amsterdam"
}

@Article{Puente-etal93,
  author =	 "Juan A. de la Puente and Alejandro Alonso and
                  Gonzalo Le\'{o}n and Juan Carlos Due\~{n}as",
  title =	 "Distributed Execution of Specifications",
  journal =	 "Real-Time Systems",
  year =	 1993,
  volume =	 5,
  pages =	 "235-248",
  annote =	 "The IPTES environment's method of prototyping. 20
                  references."
}

@InProceedings{Pun-Winder89,
  Author =	 "Winnie W. Y. Pun and Russell L. Winder",
  Title =	 "A Design Method for Object-Oriented Programming",
  BookTitle =	 "{ECOOP'89}, European Conference on Object-Oriented
                  Programming, British Computer Society Workshop
                  Series",
  Editor =	 "Stephen Cook",
  Month =	 jul,
  Year =	 1989,
  Publisher =	 "Cambridge University Press",
  Pages =	 "225-240",
  Annote =	 "9 references."
}

@Article{Qian-Goldberg93,
  Author =	 "Xiaolei Qian and Allen Goldberg",
  Title =	 "Referential Opacity in Nondeterministic Data
                  Refinement",
  Journal =	 "ACM Letters on Programming Languages and Systems",
  Year =	 1993,
  Volume =	 2,
  Number =	 "1-4",
  Month =	 "March-December",
  Pages =	 "233-241",
  Annote =	 "13 references."
}

@Article{Quiros-Millan97,
  author =	 {Pedro de las Heras Quir\'{o}s and Jos\'{e} M. Olmo
                  Millan},
  title =	 {Inheritance Anomaly in {CORBA} Multithreaded
                  Environments},
  journal =	 TAPOS,
  year =	 1997,
  volume =	 3,
  number =	 1,
  pages =	 {45-54},
  annote =	 {27 references.}
}

@TechReport{RTI02,
  author = 	 {RTI},
  title = 	 {The Economic Impacts of Inadequate Infrastructure for Software Testing},
  institution =  {National Institute of Standards and Technology},
  year = 	 2002,
  type =	 {Planning Report},
  number =	 {02-3},
  address =	 {Gaithersburg, MD},
  month =	 may,
  URL =          {\url{http://www.nist.gov/director/prog-ofc/report02-3.pdf}}
}

@InProceedings{Rafsanjani-Colwill93,
  Author =	 "G-H. B. Rafsanjani and S. J. Colwill",
  Title =	 {From {Object-Z} to {C$^{++}$}: A Structural Mapping},
  Crossref =	 "Bowen-Nicholls93",
  Pages =	 "166-179"
}

@TechReport{Raghavan-Leavens01,
  Author =	 "Arun D. Raghavan and Gary T. Leavens",
  Title =	 "Desugaring {JML} Method Specifications",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 2001,
  Number =	 "00-03c",
  Month =	 aug,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR00-03/TR.ps.gz",
  Note =         "This is an obsolete version.",
  Annote =	 "18 references."
}

@TechReport{Raghavan-Leavens03,
  Author =	 "Arun D. Raghavan and Gary T. Leavens",
  Title =	 "Desugaring {JML} Method Specifications",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 2003,
  Number =	 "00-03d",
  Month =	 jul,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR00-03/TR.pdf",
  Note =         "This is an obsolete version.",
  Annote =	 "27 references."
}

@TechReport{Raghavan-Leavens05,
  Author =	 "Arun D. Raghavan and Gary T. Leavens",
  Title =	 "Desugaring {JML} Method Specifications",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 2005,
  Number =	 "00-03e",
  Month =	 may,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR00-03/TR.pdf",
  Annote =	 "31 references."
}

@TechReport{Raghavan00,
  Author =	 "Arun D. Raghavan",
  Title =	 "Design of a {JML} documentation generator",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 2000,
  Number =	 "00-12",
  Month =	 jul,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR00-12/TR.ps.gz",
  Annote =	 "JMLDoc. 16 references."
}

@InCollection{Raj-Levy89,
  Author =	 "Rajendra K. Raj and Henry M. Levy",
  Title =	 "A Compositional Model for Software Reuse",
  BookTitle =	 "{ECOOP'89}, European Conference on Object-Oriented
                  Programming, British Computer Society Workshop
                  Series",
  Editor =	 "Stephen Cook",
  Month =	 jul,
  Year =	 1989,
  Publisher =	 "Cambridge University Press",
  Pages =	 "3-24",
  Note =	 "Also TR 89-01-04, Department of Computer Science,
                  University of Washington",
  Annote =	 "Discussion of Emerald, which has type inheritance,
                  but not code inheritance. Other kinds of code
                  sharing. The Jade system for programming in the
                  large. 31 references."
}

@Techreport{Rajan-etal08,
  author =      {Hridesh Rajan and Jia Tao and Steve M. Shaner and Gary T. Leavens},
  title =       {Reconciling Trust and Modularity in Web Services},
  institution = {Department of Computer Science, Iowa State University},
  year =        {2008},
  number =      {08-07},
  month =       jul,
  URL =         {ftp://ftp.cs.iastate.edu/pub/techreports/TR08-07/TR.pdf},
  Annote =      {51 references}
}
                  
@InProceedings{Rajan-etal09,
  author =      {Hridesh Rajan and Jia Tao and Steve M. Shaner and Gary T. Leavens},
  title =     {Tisa: A Language Design and Modular Verification Technique for Temporal Policies in Web Services},
  booktitle = {Programming Languages and Systems, 18th European Symposium on Programming, ESOP 2009},
  editor =    {Giuseppe Castagna},
  series =    LNCS,
  volume =    5502,
  pages =     {333-347},
  publisher = SV,
  address =   {Berlin},
  month =     mar,
  year =      2009,
  URL =       {http://dx.doi.org/10.1007/978-3-642-00590-9_24}
}

@inproceedings{Rajan-etal11,
 author = {Hridesh Rajan and Gary T. Leavens and Robert Dyer and Mehdi Bagherzadeh},
 title = {Modularizing crosscutting concerns with Ptolemy},
 booktitle = {Proceedings of the tenth international conference on Aspect-oriented software development companion},
 series = {AOSD '11},
 year = {2011},
 isbn = {978-1-4503-0606-5},
 location = {Porto de Galinhas, Brazil},
 pages = {61--62},
 numpages = {2},
 url = {http://doi.acm.org/10.1145/1960314.1960332},
 doi = {http://doi.acm.org/10.1145/1960314.1960332},
 publisher = {ACM},
 address = {New York, NY, USA},
}

% DOI = 10.1109/ICSE.2015.339,
@inproceedings{Rajan-etal15,
author = {Hridesh Rajan and Tien N. Nguyen and Gary T. Leavens and Robert Dyer},
title = {Inferring Behavioral Specifications from Large-scale Repositories by Leveraging Collective Intelligence}, 
booktitle = {ICSE'15: The 37th International Conference on Software Engineering: NIER Track},
location = {Florence, Italy},
month = {May},
year = {2015},
pages = {579-582},
url = {https://tinyurl.com/jpemux34}
}


@Article{Ram-Dwivedi-Ongole98,
  author =	 {D. Janaki Ram and R. A. Dwivedi and Ramakrishna
                  Ongole},
  title =	 {An Implementation Mechanism for Design Patterns},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 5,
  month =	 sep,
  pages =	 {52-56},
  annote =	 {7 references.}
}

@Article{Ramesh98,
  author =	 {Balasubramaniam Ramesh},
  title =	 {Factors Influencing Requirements Traceability
                  Practice},
  journal =	 CACM,
  year =	 1998,
  volume =	 41,
  number =	 12,
  month =	 dec,
  pages =	 {37-44},
  annote =	 {Results from a survey. 12 references.}
}

@Book{Rann-Turner-Whitworth94,
  author =	 "David Rann and John Turner and Jenny Whitworth",
  title =	 "{Z}: {A} Beginner's Guide",
  publisher =	 "Chapman \& Hall",
  address =	 "London",
  ISBN =	 "0 412 55660 X",
  year =	 "1994",
  Annote =	 "A book for self-study"
}

@InProceedings{Ranzato-Rossi-Doria-Tapparo08,
  title =	"A Forward-Backward Abstraction Refinement Algorithm",
  author =	"Francesco Ranzato and Olivia Rossi-Doria and Francesco Tapparo",
  booktitle =	"Verification, Model Checking, and Abstract
		 Interpretation, 9th International Conference, {VMCAI}
		 2008, San Francisco, {USA}, January 7-9, 2008,
		 Proceedings",
  publisher =	SV,
  address =     {Berlin},
  year = 	2008,
  volume =	4905,
  editor =	"Francesco Logozzo and Doron Peled and Lenore D. Zuck",
  pages =	"248-262",
  series =	LNCS,
  URL =  	"http://dx.doi.org/10.1007/978-3-540-78163-9_22"
}

@inproceedings{Rashid-Chitchyan03,
  title =	 {Persistence as an aspect},
  author =	 {Awais Rashid and Ruzanna Chitchyan},
  crossref =	 {aosd03},
  pages =	 {120-129}
}

@Misc{ReasoningInc06,
  author =	 {Reasoning Inc.},
  title =	 {{Software Refinery}},
  note =	 {\url{http://www.reasoning.com/}},
  year =         2006,
  month =        mar
}

@TechReport{Rebelo-Leavens-Lima11,
  author = 	 {Henrique Reb\^{e}lo Gary T. Leavens and Ricardo Lima},
  title = 	 {Modular Enforcement of Supertype Abstraction and Information Hiding with Client-Side Checking},
  number = 	 {CS-TR-11-07a},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {Dept. of EECS, UCF},
  year = 	 2011,
  month = 	 dec,
  annote = 	 {32 references.},
  url =          {http://www.eecs.ucf.edu/~leavens/tech-reports/UCF/CS-TR-11-07/TR.pdf}
}

@TechReport{Rebelo-Leavens-Lima12,
  author = 	 {Henrique Reb\^{e}lo Gary T. Leavens and Ricardo Lima},
  title = 	 {Modular Enforcement of Supertype Abstraction and Information Hiding with Client-Side Checking},
  number = 	 {CS-TR-12-03},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {Dept. of EECS, UCF},
  year = 	 2012,
  month = 	 jan,
  annote = 	 {32 references.},
  url =          {http://www.eecs.ucf.edu/~leavens/tech-reports/UCF/CS-TR-12-03/TR.pdf}
}

@inproceedings{Rebelo-Leavens-Lima13,
 author = {Henrique Reb\^{e}lo and Gary T. Leavens and Ricardo Massa Lima},
 title = {Client-aware Checking and Information Hiding in Interface Specifications with {JML/Ajmlc}},
 booktitle = {Proceedings of the 2013 Companion Publication for Conference on Systems, Programming, \& Applications: Software for Humanity},
 series = {SPLASH '13},
 year = {2013},
 isbn = {978-1-4503-1995-9},
 location = {Indianapolis, Indiana, USA},
 pages = {11--12},
 numpages = {2},
 url = {http://doi.acm.org/10.1145/2508075.2514569},
 doi = {10.1145/2508075.2514569},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {design by contract, information hiding, interface specification languages, java modeling language (JML), runtime assertion checking},
}

@inproceedings{Rebelo-Leavens15,
 author = {Henrique Reb\^{e}lo and Gary T. Leavens},
 title = {Enforcing Information Hiding in Interface Specifications: A Client-aware Checking Approach},
 booktitle = {Companion Proceedings of the 14th International Conference on Modularity},
 series = {MODULARITY Companion 2015},
 year = {2015},
 location = {Fort Collins, CO, USA},
 pages = {47--51},
 numpages = {5},
 url = {http://doi.acm.org/10.1145/2735386.2736750},
 doi = {10.1145/2735386.2736750},
 acmid = {2736750},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {AspectJML language, Information hiding, JML language, interface specification languages, runtime assertion checking},
}
                  
@inproceedings{Rebelo-Leavens17,
 author = {Henrique Reb\^{e}lo and Gary T. Leavens},
 title = {Aspect-Oriented Programming Reloaded},
 booktitle = {Proceedings of the 21st Brazilian Symposium on Programming Languages},
 series = {SBLP 2017},
 year = 2017,
 isbn = {978-1-4503-5389-2},
 location = {Fortaleza, CE, Brazil},
 pages = {10:1--10:8},
 articleno = 10,
 numpages = 8,
 url = {http://doi.acm.org/10.1145/3125374.3125383},
 doi = {10.1145/3125374.3125383},
 acmid = 3125383,
 publisher = ACM,
 address = {New York, NY, USA},
 keywords = {Aspect-oriented programming, AspectJ, AspectJML, modularity},
}

@TechReport{Rebelo-Lima-Leavens11,
  author = 	 {Henrique Reb\^{e}lo and Ricardo Lima and Gary T. Leavens},
  title = 	 {Modular Contracts with Procedures, Annotations, Pointcuts and Advice},
  number = 	 {CS-TR-11-05},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {Dept. of EECS, UCF},
  year = 	 2011,
  month = 	 sep,
  annote = 	 {24 references.},
  note =         {To appear in SBLP'11.},
  url =          {http://www.eecs.ucf.edu/~leavens/tech-reports/UCF/CS-TR-11-05/TR.pdf}
}

@inproceedings{Rebelo-etal08,
 author = {Henrique Reb\^{e}lo and S\'{e}rgio Soares and Ricardo Lima and Leopoldo Ferreira and M\'{a}rcio Corn\'{e}lio},
 title = {Implementing {Java Modeling Language} contracts with {AspectJ}},
 booktitle = {SAC '08: Proceedings of the 2008 ACM symposium on Applied computing},
 year = {2008},
 pages = {228--233},
 location = {Fortaleza, Ceara, Brazil},
 doi = {http://doi.acm.org/10.1145/1363686.1363745},
 publisher = {ACM},
 address = {New York, NY, USA}
} 

@InProceedings{Rebelo-etal08a,
  author = {Henrique Reb\^{e}lo and S\'{e}rgio Soares and Ricardo Lima and Paulo Borba and M\'{a}rcio Corn\'{e}lio},
  title = {{JML} and Aspects: The Beneifts of Instrumenting {JML} Features with {AspectJ}},
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {11-18},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  annote = 	 {26 references.},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/Rebelo-Soares-Lima-Borba-Cornelio.pdf}
}

@InProceedings{Rebelo-etal09,
  author = 	 {Henrique Reb\^{e}lo and Ricardo Lima and M\'{a}rcio Corn\'{e}lio and Gary T. Leavens and Alexandre Mota and C\'{e}sar Oliveira},
  title = 	 {Optimizing JML Feature Compilation in Ajmlc Using Aspect-Oriented Refactorings},
  booktitle = 	 {XIII Brazilian Symposium on Programming Languages (SBLP)},
  publisher =    {Brazilian Computer Society},
  year = 	 2009,
  month = 	 aug,
  annote = 	 {25 references.},
  pages =        {117-130},
  url =          {http://www.eecs.ucf.edu/~leavens/tech-reports/UCF/CS-TR-09-05/TR.pdf}
} 

@TechReport{Rebelo-etal09a,
  author = 	 {Henrique Reb\^{e}lo and Ricardo Lima and M\'{a}rcio Corn\'{e}lio and Gary T. Leavens and Alexandre Mota and C\'{e}sar Oliveira},
  title = 	 {Optimizing JML Features Compilation in Ajmlc Using Aspect-Oriented Refactorings},
  number = 	 {CS-TR-09-05},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  year = 	 2009,
  month = 	 apr,
  annote = 	 {30 references.},
  note =         {To appear in SBLP'09.},
  url =          {http://www.eecs.ucf.edu/~leavens/tech-reports/UCF/CS-TR-09-05/TR.pdf}
} 

@TechReport{Rebelo-etal11,
  author = 	 {Henrique Reb\^{e}lo and Roberta Coelho and Ricardo Lima and Gary T. Leavens and Alexandre Mota and Fernando Castor},
  title = 	 {On the Interplay of Exception Handling and Design by Contract: An Aspect-Oriented Recovery Approach},
  number = 	 {CS-TR-11-02},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {Dept. of EECS, UCF},
  year = 	 2011,
  month = 	 apr,
  annote = 	 {21 references.},
  url =          {http://www.eecs.ucf.edu/~leavens/tech-reports/UCF/CS-TR-11-02/TR.pdf}
} 

@inproceedings{Rebelo-etal11a,
 author = {Henrique Reb\^{e}lo and Roberta Coelho and Ricardo Lima and Gary T. Leavens and Marieke Huisman and Alexandre Mota and Fernando Castor},
 title = {On the interplay of exception handling and design by contract: an aspect-oriented recovery approach},
 booktitle = {Proceedings of the 13th Workshop on Formal Techniques for Java-Like Programs},
 series = {FTfJP '11},
 year = {2011},
 isbn = {978-1-4503-0893-9},
 location = {Lancaster, United Kingdom},
 pages = {7:1--7:6},
 articleno = {7},
 numpages = {6},
 url = {http://doi.acm.org/10.1145/2076674.2076681},
 doi = {10.1145/2076674.2076681},
 acmid = {2076681},
 publisher = {ACM},
 address = {New York, NY, USA},
}

@Article{Rebelo-etal13,
  author = 	 {Henrique Reb\^{e}lo and Ricardo Lima and Gary T. Leavens and M\'{a}rcio Corn\'{e}lio and Alexandre Mota and Cesar Oliveira},
  title = 	 {Optimizing generated aspect-oriented assertion checking code for {JML} using program transformations: An empirical study},
  journal = 	 SCP,
  year = 	 2013,
  volume = 	 78,
  number = 	 8,
  pages = 	 {1137-1156},
  month = 	 aug,
  URL = 	 {http://dx.doi.org/10.1016/j.scico.2012.09.003}
}
    
@inproceedings{Rebelo-etal13a,
 author = {Henrique Rebelo and Gary T. Leavens and Ricardo Massa Ferreira Lima and Paulo Borba and M\'{a}rcio Ribeiro},
 title = {Modular Aspect-oriented Design Rule Enforcement with {XPIDRs}},
 booktitle = {Proceedings of the 12th Workshop on Foundations of Aspect-oriented Languages},
 series = {FOAL '13},
 year = {2013},
 isbn = {978-1-4503-1865-5},
 location = {Fukuoka, Japan},
 pages = {13--18},
 numpages = {6},
 url = {http://doi.acm.org/10.1145/2451598.2451603},
 doi = {10.1145/2451598.2451603},
 acmid = {2451603},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {AspectJ language, JML language, aspect-oriented programming, design rules, runtime assertion checking},
 annote = {19 references.}
}

@InProceedings{Rebelo-etal14,
 author = {Henrique Reb\^{e}lo and Gary T. Leavens and Mehdi Bagherzadeh and Hridesh Rajan and Ricardo Lima and Daniel M. Zimmerman and M\'{a}rcio Corn{\'e}lio and Thomas Th\"{u}m},
 title = {{AspectJML}: Modular Specification and Runtime Checking for Crosscutting Contracts},
 booktitle = {Proceedings of the 13th International Conference on Modularity},
 series = {MODULARITY '14},
 year = {2014},
 isbn = {978-1-4503-2772-5},
 location = {Lugano, Switzerland},
 pages = {157--168},
 numpages = {12},
 url = {http://doi.acm.org/10.1145/2577080.2577084},
 doi = {10.1145/2577080.2577084},
 acmid = {2577084},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {aspect-oriented programming, aspectj, aspectjml, crosscutting contracts, design by contract, jml},
}

@InProceedings{Rebelo-etal14a,
 author = {Henrique Reb\^{e}lo and Gary T. Leavens and Mehdi Bagherzadeh and Hridesh Rajan and Ricardo Lima and Daniel M. Zimmerman and M\'{a}rcio Corn{\'e}lio and Thomas Th\"{u}m},
 title = {Modularizing Crosscutting Contracts with {AspectJML}},
 booktitle = {Proceedings of the 13th International Conference on Modularity},
 series = {MODULARITY '14},
 year = {2014},
 isbn = {978-1-4503-2772-5},
 location = {Lugano, Switzerland},
 pages = {21--24},
 numpages = {4},
 url = {http://doi.acm.org/10.1145/2584469.2584476},
 doi = {10.1145/2584469.2584476},
 acmid = {2584476},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {aspect-oriented programming, aspectj, aspectjml, crosscutting contracts, design by contract, jml},
}

@Misc{Rebelo21,
  author = 	 {Henrique Reb\^{e}lo},
  title = 	 {{AspectJML} website},
  URL =          {https://www.cin.ufpe.br/~hemr/aspectjml/},
  year = 	 2021,
  note = 	 {Accessed September 2021.}
}

@Misc{RedHatHibernate08,
	author 				= {{Red Hat Middleware, LLC}},
	title 				= {Hibernate},
	year 					= {2008},
	howpublished 	= {From 
	                      \url{http://www.hibernate.org/}
	                      (Date retrieved: March 19, 2008)}
}

@Article{Reddy90,
  Author =	 "Uday S. Reddy",
  Title =	 "Formal Methods in Transformational Derivation of
                  Programs",
  Journal =	 SIGSOFT,
  Year =	 1990,
  Volume =	 15,
  Number =	 4,
  Month =	 sep,
  Pages =	 "104-114",
  Note =	 "Proceedings of the ACM SIGSOFT: International
                  Workshop on Formal Methods in Software Development,
                  Mark Moriconi (editor).",
  Annote =	 "30 references."
}

@PhdThesis{Reddy99,
  author =	 {A. L. N. Reddy},
  title =	 {Formalization of Storage Considerations in Software
                  Design},
  school =	 {West Virgina University},
  year =	 1999,
  address =	 {Morgantown, WV}
}

@Article{Reed-Yeh88,
  Author =	 "Joylyn Reed and Raymond T. Yeh",
  Title =	 "Specification and Verification of Liveness
                  Properties of Cyclic, Concurrent Processes",
  Journal =	 TOPLAS,
  Volume =	 10,
  Number =	 1,
  Month =	 jan,
  Year =	 1988,
  Pages =	 "156-177",
  Annote =	 "Specification and verification of concurrent,
                  distributed systems. 25 references."
}

@InProceedings{Reichgelt-Shadbolt90,
  Author =	 "Han Reichgelt and Nigel Shadbolt",
  Title =	 "A Specification Tool for Planning Systems",
  BookTitle =	 "Proceedings of the 9th European Conference on
                  Artificial Intelligence (ECAI-90), Stockholm,
                  Sweden",
  Year =	 "1990",
  Pages =	 "541-546",
  Annote =	 "25 references."
}

@Book{Rescher69,
  author =	 "N. Rescher",
  title =	 "Many-valued Logic",
  publisher =	 "McGraw-Hill",
  address =	 "New York",
  year =	 "1969"
}

@Misc{ResolveCorp08,
	Author 				= {{Resolve Corporation}},
	Title 				= {{eXtensible C\#}},
	Year 					= {2008},
	Howpublished 	= {From 
	                      \url{http://www.resolvecorp.com/products.aspx}
	                      (Date retrieved: March 19, 2008)}
}

@MastersThesis{Restivo85,
  Author =	 "James P. Restivo",
  Title =	 "Adding Type Information to the Argus Debugging
                  System",
  School =	 MIT,
  Month =	 may,
  Year =	 1985,
  Annote =	 "Describes the separation approach, where type
                  information is available to the debugger for type
                  checking but not to the program itself. 12
                  references."
}

@Article{Rettig91,
  Author =	 "Marc Rettig",
  Title =	 "Practical Programmer: Nobody Reads Documentation",
  Journal =	 CACM,
  Year =	 1991,
  Volume =	 34,
  Number =	 4,
  Month =	 jul,
  Pages =	 "19-24",
  Annote =	 "0 references."
}

@inproceedings{Reus03,
author={Bernhard Reus},
title={Modular Semantics and Logics of Classes},
booktitle = {Computer Science Logic ({CSL})},
year=2003,
pages={456--469},
editor = {Matthias Baaz and Johann A. Makowsky},
series  = LNCS,
volume = 2803
}

@Article{Rich-Feldman92,
  Author =	 "Charles Rich and Yishai A. Feldman",
  Title =	 "Seven Layers of Knowledge Representation and
                  Reasoning in Support of Software Development",
  Journal =	 IEEETSE,
  Year =	 1992,
  Volume =	 18,
  Number =	 6,
  Month =	 jun,
  Pages =	 "451-469",
  Annote =	 "35 references."
}

@Article{Rich-Shrobe78,
  Author =	 "C. Rich and H. L. Shrobe",
  Title =	 "Initial Report on a Lisp Programmer's Apprentice",
  Journal =	 IEEETSE,
  Year =	 1978,
  Month =	 jun,
  Volume =	 "SE-4",
  Number =	 6,
  Pages =	 "454-467"
}

@TechReport{Rich-Waters81,
  Author =	 "C. Rich and R. C. Waters",
  Title =	 "Abstraction, Inspection and Debugging in
                  Programming",
  Institution =	 MITAI,
  Number =	 634,
  Year =	 1981,
  Month =	 jun
}

@Book{Rich-Waters90,
  Author =	 "Charles Rich and Richard C. Waters",
  Title =	 "The Programmer's Apprentice",
  Publisher =	 Addison-Wesley,
  Address =	 NY,
  Year =	 1990,
  Series =	 "ACM Frontier Series",
  Annote =	 "158 references."
}

@InProceedings{Richardson94,
  Author =	 {Debra J. Richardson},
  Title =	 {{TAOS}: Testing with Analysis and Oracle Support},
  Year =	 1994,
  Month =	 aug,
  Pages =	 {138--152},
  Booktitle =	 {Proceedings of ISSTA 94, Seattle, Washington,
                  August, 1994},
  Publisher =	 {IEEE Computer Society},
  Address =	 {Los Alamitos, California}
}

@Book{Riddle-Fairley80,
  Editor =	 "W. E. Riddle and R. E. Fairley",
  Title =	 "Software Development Tools",
  Note =	 "Proceedings of a workshop held at Pingree Park,
                  Colorado in May 1979",
  Publisher =	 SV,
  Address =	 NY,
  Year =	 1980
}

@InProceedings{Riecke-Subrahmanyam93,
  Author =	 "Jon G. Riecke and Ramesh Subrahmanyam",
  Title =	 "Algebraic Reasoning and Completeness in Typed
                  Languages",
  BookTitle =	 " Conference record of the Twentieth Annual ACM
                  SIGPLAN-SIGACT Symposium on Principles of
                  Programming Languages, Charleston, South Carolina",
  Organization = ACM,
  Year =	 1993,
  Month =	 jan,
  Pages =	 "185-195",
  Annote =	 "17 references"
}

@InProceedings{Riehle97,
  author =	 {Riehle97},
  title =	 {Composite Design Patterns},
  BookTitle =	 "Conference Proceedings of OOPSLA '97, Atlanta",
  Series =	 SIGPLAN,
  Volume =	 "32(10)",
  Month =	 oct,
  Year =	 1997,
  organization = ACM,
  pages =	 {218-228},
  annote =	 {34 references.}
}

@MastersThesis{Rieken07,
	author 	= {Johannes Rieken},
	title 	= {Contract by Design for Java - Revised},
	year 		= {2007},
	school 	= {Universit\"{a}t Oldenburg}
}

@Book{Riel96,
  author =	 {Arthur J. Riel},
  title =	 {Object-Oriented Design Heuristics},
  publisher =	 {Addison-Wesley},
  year =	 1996
}

@inproceedings{Rinard-Salcianu-Bugrara04,
	Author = {Martin Rinard and Alexandur S{\u a}lcianu and Suhabe Bugrara},
	Crossref = {FSE-04},
	Pages = {147-158},
	Title = {A Classification System and Analysis for Aspect-Oriented Programs}
}

@InProceedings{Rival04,
  author =       {Xavier Rival},
  title =        {Symbolic transfer functions-based approaches to
                  certified compilation},
  booktitle =    {31st Symposium on Principles of Programming Languages},
  pages =        {1-13},
  year =         {2004},
  editor =       {Xavier Leroy},
  month =        jan,
  publisher =    {ACM},
}

@InProceedings{Roach-Gates01,
  author =	 "Steve Roach and Ann Q. Gates",
  title =	 "Synthesis of Runtime Constraint Monitoring Code",
  BookTitle =	 "Proceedings of the Second International Workshop on
                  Automated Program Analysis, Testing and Verification
                  in conjunction with the International Conference on
                  Software Engineering (ICSE 2001), Toronto, Canada,
                  May 13, 2001",
  Year =	 "2001"
}

@inproceedings{Robby-Dwyer-Hatcliff03,
  author = "Robby and Matthew B. Dwyer and John Hatcliff",
  title = "Bogor: An Extensible and Highly-Modular Model Checking Framework",
  booktitle = "Proceedings of the 9th European Software Engineering Conference held jointly with the 11th ACM SIGSOFT Symposium on the Foundations of Software Engineering",
  year = 2003,
  pages     = {267-276},
  publisher = ACM,
  volume = {28 number 5},
  series = {SIGSOFT Softw. Eng. Notes}
}

@InProceedings{Robby-Dwyer-Hatcliff06,
author = {Robby and Matthew B. Dwyer and John Hatcliff},
title = {Domain-specific Model Checking Using The {Bogor} Framework},
booktitle ={International Conference on Automated Software Engineering},
year = {2006},
issn = {1527-1366},
pages = {369-370},
doi = {http://doi.ieeecomputersociety.org/10.1109/ASE.2006.34},
publisher = {IEEE Computer Society},
address = {Los Alamitos, CA, USA}
}

@InProceedings{Robby-etal04,
  author    = "Robby and Edwin Rodr\'{i}guez and Matthew Dwyer and John Hatcliff",
  title     = {Checking Strong Specifications Using an Extensible Software Model Checking Framework},
  booktitle = {Proceedings of the 10th International Conference on Tools and
               Algorithms for the Construction and Analysis of Systems},
  publisher = SV,
  series    = LNCS,
  volume    = 2988,
  pages     = "404-420",
  year      = {2004},
  isbn      = {3-540-21299-X},
}

@Article{Robby-etal06,
  author    = "Robby and Edwin Rodr\'{i}guez and Matthew Dwyer and John Hatcliff",
  title     = {Checking {JML} Specifications Using an Extensible Software Model Checking Framework},
  journal = 	 {International Journal on Software Tools for Technology Transfer},
  year = 	 2006,
  note =	 {To appear}
}

  booktitle = {Proceedings of the 10th International Conference on Tools and
               Algorithms for the Construction and Analysis of Systems},
  publisher = SV,
  series    = LNCS,
  volume    = 2988,
  pages     = "404-420",
  year      = {2004},
  isbn      = {3-540-21299-X},
}

@Book{Robillard-Kruchten-dAstous03,
  author =	 {Pierre N. Robillard and Philippe Kruchten and Patrick d'Astous},
  title = 	 {Software Engineering Process with the {UPEDU}},
  publisher = 	 {Addison Wesley},
  year = 	 2003,
  address =	 {Boston},
  annote =	 {A few references in each chapter.}
}

@Article{Robinson-Levitt77,
  Author =	 "Lawrence Robinson and Karl N. Levitt",
  Title =	 "Proof Techniques for Hierarchically Structured
                  Programs",
  Journal =	 CACM,
  Volume =	 20,
  Number =	 4,
  Pages =	 "271-283",
  Month =	 apr,
  Year =	 1977,
  Annote =	 "Program represented as levels of abstractions. Help
                  for proofs of large programs. 44 references."
}

@Article{Robinson-etal75,
  Author =	 "J. Robinson and K. N. Levitt and P. G. Neumann and
                  A. R. Saxena",
  Title =	 "On attaining Reliable Software for a Secure
                  Operating System",
  Journal =	 SIGPLAN,
  Year =	 1975,
  Volume =	 10,
  Number =	 5,
  Month =	 may,
  Pages =	 "267-284",
  Note =	 "International Conference on Reliable Software"
}

@unpublished{Rodin06,
  author    = {{Rodin Partners}},
  title     = {Rodin: Rigorous open development environment for complex systems.},
  year      = 2006,
  note = {\url{http://rodin.cs.ncl.ac.uk/}}
}

@Article{Rodriguez-Dapena99,
  author =	 {Patricia Rodriguez-Dapena},
  title =	 {Software Safety Certification: A Multidomain
                  Problem},
  journal =	 {IEEE Software},
  year =	 1999,
  volume =	 16,
  number =	 4,
  month =	 jul,
  pages =	 {31-38},
  annote =	 {12 references.}
}

@TechReport{Rodriguez-etal04,
  author = 	 {Edwin Rodr\'{i}guez and Matthew B. Dwyer and Cormac Flanagan
                  and John Hatcliff and Gary T. Leavens and Robby},
  title = 	 {Extending Sequential Specification Techniques for
                  Modular Specification and Verification of Multi-Threaded Programs},
  institution =  {Kansas State University, Department of Computing and Information Sciences},
  year = 	 2004,
  number =	 {SAnToS-TR2004-10},
  month =	 dec,
  annote =	 {35 references.},
  note =         {To appear in \textit{ECOOP 2005}.},
  URL =          {http://spex.projects.cis.ksu.edu/papers/SAnToS-TR2004-10.pdf}
}

@InCollection{Rodriguez-etal05,
  author = 	 {Edwin Rodr\'{i}guez and Matthew B. Dwyer and Cormac Flanagan
                  and John Hatcliff and Gary T. Leavens and Robby},
  title = 	 {Extending {JML} for Modular Specification and Verification
                  of Multi-Threaded Programs},
  booktitle =	 {ECOOP 2005 --- Object-Oriented Programming 19th
                  European Conference, Glasgow, UK},
  pages =	 {551-576},
  year =	 2005,
  editor =	 {Andrew P. Black},
  volume =	 3586,
  series =	 LNCS,
  address =	 {Berlin},
  month =	 jul,
  publisher =	 SV,
  URL = {http://dx.doi.org/10.1007/11531142_24},
  annote =	 {39 references.}
}

@TechReport{Rodriguez-etal05a,
  author = 	 {Edwin Rodr\'{i}guez and Matthew B. Dwyer and Cormac Flanagan
                  and John Hatcliff and Gary T. Leavens and Robby},
  title = 	 {Extending {JML} for Modular Specification and Verification
                  of Multi-Threaded Programs},
  institution =  {Kansas State University, Department of Computing and Information Sciences},
  year = 	 2005,
  number =	 {SAnToS-TR2004-10},
  month =	 may,
  annote =	 {39 references.},
  note =         {Appears in \textit{ECOOP 2005}, LNCS vol 3686, pages 551--576.},
  URL =          {http://spex.projects.cis.ksu.edu/papers/SAnToS-TR2004-10.pdf}
}

@Unpublished{Rollins-Wing91,
  Author =	 "Eugene J. Rollins and Jeannette M. Wing",
  Title =	 "Specifications as Search Keys for Software
                  Libraries",
  Note =	 "To appear in the Proceedings of the International
                  Conference on Logic Programming, Paris, June 1991.",
  Annote =	 "20 references.",
  Month =	 jun,
  Year =	 1991
}

@inCollection{Roscoe94,
 author = {A. W. Roscoe},
 title = {Model-checking {CSP}},
 booktitle = {A classical mind: essays in honour of C. A. R. Hoare},
 year = {1994},
 pages = {353--378},
 publisher = {Prentice Hall International (UK) Ltd.},
 address = {Hertfordshire, UK},
}

@InCollection{Rose-Duke94,
  author =	 "Gordon Rose and Roger Duke",
  title =	 "An {Object-Z} Specification of a Mobile Phone
                  System",
  booktitle =	 "Object-Oriented Specification Case Studies",
  publisher =	 "Prentice-Hall",
  year =	 1994,
  editor =	 "Kevin Lano and Howard Haughton",
  series =	 "The Object-Oriented Series",
  chapter =	 5,
  Crossref =	 "Lano-Haughton94",
  pages =	 "110-129",
  address =	 NY
}

@InCollection{Rose92,
  Author =	 "Gordon Rose",
  Title =	 "Object-{Z}",
  Editor =	 "Susan Stepney and Rosalind Barden and David Cooper",
  BookTitle =	 "Object Orientation in Z",
  Publisher =	 SV,
  Year =	 1992,
  Address =	 "Cambridge CB2 1LQ, UK",
  Series =	 "Workshops in Computing",
  Crossref =	 "Stepney-Barden-Cooper92",
  Pages =	 "59-77"
}

@InProceedings{Rosenblum92,
  author =	 "D. S. Rosenblum",
  title =	 "Towards a Method of Programming with Assertions",
  booktitle =	 "Proceedings of the~14th~International Conference on
                  Software Engineering",
  pages =	 "92--104",
  month =	 may,
  year =	 "1992",
  abstract =	 "Embedded assertions have long been recognized as a
                  potentially powerful tool for automatic runtime
                  detection of software faults during debugging,
                  testing and maintenance. However, they have seen
                  little widespread use in practice because previous
                  assertion processing tools did not integrate easily
                  with existing programming environments, and it is
                  not well understood what kinds of assertions are
                  most effective at detecting software faults. The
                  author describes experience using an assertion
                  processing tool that was built to address the
                  concerns of ease-of-use and effectiveness. The tool
                  is called APP, an Annotation Pre-Processor for C
                  programs developed in UNIX-based development
                  environments. APP has been used to develop a number
                  of software systems over three years. Based on this
                  experience, the author presents a classification of
                  the assertions that were most effective at detecting
                  faults. While the assertions that are described
                  guard against many common kinds of faults and
                  errors, the very commonness of such faults
                  demonstrates the need for an explicit, high-level,
                  automatically checkable specification of required
                  behavior.",
}

@Article{Rosenblum95,
  author =	 "David S. Rosenblum",
  title =	 "A Practical Approach to Programming With Assertions",
  journal =	 IEEETSE,
  year =	 1995,
  volume =	 21,
  number =	 1,
  pages =	 "19-31",
  URL = {http://doi.ieeecomputersociety.org/10.1109/32.341844},
  month =	 jan
}

@InProceedings{Rossie98,
  author =	 {Jonathan G. {Rossie Jr.}},
  title =	 {Logical Observable Entities},
  BookTitle =	 "OOPSLA '98 Conference Proceedings",
  Series =	 SIGPLAN,
  Volume =	 "33(10)",
  Month =	 oct,
  Year =	 1998,
  organization = ACM,
  pages =	 {154-165},
  annote =	 {Subtyping for state machines. 42 references.}
}

@InProceedings{Roth-Schmidt04,
  author = 	 {Andreas Roth and Peter H. Schmidt},
  title = 	 {Ensuring Invariant Contracts for Modules in Java},
  editor =       {Erik Poll},
  booktitle="ECOOP Workshop FTfJP'2004 Formal Techniques for Java-like Programs",
  Month = jun,
  Year =  2004,
  Pages="93-102",
  note =  {\url{http://www.cs.ru.nl/ftfjp/2004/InvariantContracts.pdf}},
  annote = "21 references."
}

@TechReport{Roubik03,
  author = 	 {Arthur F. Roubik, Jr.},
  title = 	 {Applying the Common Criteria to the Certification & Accreditation of Department of Defense Unclassified Information Technology Systems},
  institution =  {SANS},
  year = 	 2003,
  type = 	 {white paper},
  number = 	 {version 1.4b},
  URL = {http://goo.gl/7StLJ4}
}
         
@InProceedings{Rouzaud99,
  author =       "Yann Rouzaud",
  title =        "Interpreting the {B}-Method in the refinement
                 calculus",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  BookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1708,
  pages =        "411-430",
  annote =       "Explains B method in refinement calculus terms.  26 references."
}

@Article{Royer-Alagic-Dillon07,
  author =	 {Mark Royer and Suad Alagi\'{c} and Dan Dillon},
  title = 	 {Reflective Constraint Management for Languages on Virtual Platforms},
  journal = 	 JOT,
  year = 	 2007,
  volume =       6,
  number =       10,
  pages = 	 {59-79},
  month = 	 {Nov.-Dec.},
  URL =          {http://www.jot.fm/issues/issue_2007_11/article1/},
  annote = 	 {27 references.}
}

@InProceedings{Ruby-Leavens00,
  Author =	 "Clyde Ruby and Gary T. Leavens",
  Title =	 "Safely Creating Correct Subclasses without Seeing
                  Superclass Code",
  BookTitle =	 "OOPSLA 2000 Conference on Object-Oriented
                  Programming, Systems, Languages, and Applications,
                  Minneapolis, Minnesota",
  Series =	 SIGPLAN,
  Volume =	 "35(10)",
  Month =	 oct,
  Year =	 2000,
  Pages =	 "208-228",
  publisher =    ACM,
  address =      NY,
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR00-05/TR.ps.gz",
  Annote =	 "39 references.",
  doi =          {http://doi.acm.org/10.1145/353171.353186}
}

@TechReport{Ruby-Leavens00a,
  Author =	 "Clyde Ruby and Gary T. Leavens",
  Title =	 "Safely Creating Correct Subclasses without Seeing
                  Superclass Code",
  Institution =	 "Iowa State University, Department of Computer
                  Science",
  Year =	 2000,
  Number =	 "00-05d",
  Month =	 jul,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR00-05/TR.ps.gz",
  Note =	 "Appears in OOPSLA 2000 Conference Proceedings,
                  pp. 208--228.",
  Annote =	 "39 references."
}

@TechReport{Ruby06,
  Author =	 "Clyde Dwain Ruby",
  Title =	 "Modular subclass verification: safely creating correct subclasses without superclass code",
  Institution =	 "Iowa State University, Department of Computer Science",
  Year =	 2006,
  Number =	 "06-34",
  Month =	 dec,
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR06-34/TR.pdf",
  Annote =	 "94 references."
}

@PhdThesis{Ruby06a,
  author = 	 {Clyde Dwain Ruby},
  title = 	 {Modular subclass verification: safely creating correct subclasses without superclass code},
  school = 	 {Iowa State University},
  year = 	 2006,
  address =	 {Ames, Iowa},
  annote =	 {94 references.}
}

@inproceedings{Rudich-Darvas-Mueller08,
 author = {Arsenii Rudich and {\'A}d{\'a}m Darvas and Peter M{\"u}ller},
 title = {Checking Well-Formedness of Pure-Method Specifications},
 booktitle = {Formal Methods},
 editor = {Jorge Cuéllar and T. S. E. Maibaum and Kaisa Sere},
 series = LNCS,
 volume = 5014,
 publisher = SV,
 address = {Berlin},
 year = 2008,
 pages = {68--83},
}

@Book{Rumbaugh-Jacobson-Booch99,
  author =	 {James Rumbaugh and Ivar Jacobson and Grady Booch},
  title =	 {The Unified Modeling Language Refrence Manual},
  publisher =	 {Addison Wesley Longman},
  year =	 1999,
  series =	 {Object Technology Series},
  address =	 {Reading, Mass.}
}

@Article{Rushby-Owre-Shankar98,
  author =	 {John Rushby and Sam Owre and Natarajan Shankar},
  title =	 {Integration of Sequential Scenarios},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 9,
  month =	 sep,
  pages =	 {709-720},
  annote =	 {31 references.}
}

@Techreport{Rushby-vonHenke-Owre91,
  Author =	 "John Rushby, Friedrich von Henke and Sam Owre",
  Title =	 "An Introduction to Formal Specification and
                  Verification Using EHDM",
  Institution =	 "SRI International",
  Month =	 feb,
  Year =	 1991,
  Number =	 "CSL-91-02",
  Annote =	 "28 references."
}
@Article{Rushby94,
  author =	 "J. Rushby",
  title =	 "Critical System Properties: Survey and Taxonomy",
  journal =	 "Reliability Engineering and System Safety",
  volume =	 43,
  number =	 2,
  pages =	 "189--219",
  year =	 1994
}

@InProceedings{Rushby99,
  title =        "Mechanized Formal Methods: Where Next?",
  author =       "John Rushby",
  booktitle =    "FM99: The World Congress in Formal Methods",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  LongBookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1708,
  pages =        "48-51",
  annote =       "Some research directions."
}

@Article{Russell-Strom-Yellin94,
  Author =	 "James R. Russell and Robert E. Strom and Daniel
                  M. Yellin",
  Title =	 "A Checkable Interface Language for Pointer-Based
                  Structures",
  Journal =	 SIGPLAN,
  Year =	 1994,
  Volume =	 29,
  Number =	 8,
  Month =	 aug,
  Pages =	 "59-73",
  Annote =	 "13 references."
}

@Unpublished{SUNAssert,
   Author    = {{Sun Microsystems, Inc.}},
   Title     = {A Simple Assertion Facility For the Java Programming Language},
   Institution = {Sun Microsystems, Inc.},
   Address   = {901 San Antonio Road, Palo Alto, California 94303 U.S.A.},
   Note      = {Available from 
                \url{http://java.sun.com/docs/books/jls/assert-spec.html}
                (Date retrieved: April 2, 2003)}
}

@Article{Sakkinen88b,
  Author =	 "Markku Sakkinen",
  Title =	 "Comments on ``the Law of Demeter'' and C++",
  Journal =	 SIGPLAN,
  Year =	 1988,
  Volume =	 23,
  Number =	 12,
  Month =	 dec,
  Pages =	 "38-44",
  Annote =	 "7 references."
}

@InProceedings{Salcianu-Rinard05,
  author = 	 {Alexandru Salcianu and Martin Rinard},
  title = 	 {Purity and Side Effect Analysis for {Java} Programs},
  booktitle =	 {Proceedings of the 6th International Conference
                  on Verification, Model Checking and Abstract Interpretation},
  year =	 2005,
  editor =       "Radhia Cousot",
  month =	 jan,
  pages =        {199-215},
  publisher =	 SV,
  address =      {Berlin},
  volume =	 3385,
  series =	 LNCS,
  url =          {http://dx.doi.org/10.1007/b105073}
}

@Book{Sametinger97,
  author =	 {Johannes Sametinger},
  title =	 {Software Engineering with Reusable Components},
  publisher =	 SV,
  year =	 1997,
  address =	 NY
}

@InCollection{Sanchez-Leavens13,
author={Jos\'{e} S\'{a}nchez and Gary T. Leavens},
title={Separating Obligations of Subjects and Handlers for More Flexible Event Type Verification},
year={2013},
isbn={978-3-642-39613-7},
booktitle={Software Composition},
volume={8088},
series={Lecture Notes in Computer Science},
editor={Walter Binder and Eric Bodden and Welf L\"{o}we},
doi={10.1007/978-3-642-39614-4_5},
url={http://dx.doi.org/10.1007/978-3-642-39614-4_5},
publisher={Springer-Verlag},
address={Berlin},
pages={65-80}
}

@inproceedings{Sanchez-Leavens14,
 author = {Jos{\'e} S\'{a}nchez and Gary T. Leavens},
 title = {Static Verification of {PtolemyRely} Programs Using {OpenJML}},
 booktitle = {Proceedings of the 13th Workshop on Foundations of Aspect-oriented Languages},
 series = {FOAL '14},
 year = {2014},
 isbn = {978-1-4503-2798-5},
 location = {Lugano, Switzerland},
 pages = {13-18},
 numpages = {6},
 url = {http://doi.acm.org/10.1145/2588548.2588550},
 doi = {10.1145/2588548.2588550},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {openjml, ptolemy language, ptolemyrely, static verification},
 annote = {14 references.}
}

@inproceedings{Sanchez-Leavens16,
 author = {Jos{\'e} S\'{a}nchez and Gary T. Leavens},
 title = {Reasoning Tradeoffs in Languages with Enhanced Modularity Features},
 booktitle = {Proceedings of the 15th International Conference on Modularity},
 series = {MODULARITY 2016},
 year = {2016},
 isbn = {978-1-4503-3995-7},
 location = {Malaga, Spain},
 pages = {13--24},
 numpages = {12},
 url = {http://doi.acm.org/10.1145/2889443.2889447},
 doi = {10.1145/2889443.2889447},
 acmid = {2889447},
 publisher = {ACM},
 address = NY,
 keywords = {Modular Verification, Reasoning Tradeoffs},
 annote = {37 references.}
}

@TechReport{Sanchez15,
  author = 	 {Jos\'{e} S\'{a}nchez},
  title = 	 {Reasoning Tradeoffs In Implicit Invocation And Aspect Oriented Languages},
  institution =  {Computer Science, University of Central Florida},
  year = 	 2015,
  number = 	 {CS-TR-15-02},
  address = 	 {Orlando, Florida},
  month = 	 apr,
  annote = 	 {62 references.}
}

@InProceedings{Sands95,
  Author =	 {David Sands},
  Title =	 "Total Correctness by Local Improvement in Program
                  Transformation",
  BookTitle =	 "Conference Record of POPL '95: 22nd Annual ACM
                  SIGPLAN-SIGACT Symposium on Principles of
                  Programming Languages, San Francisco, Calif.",
  Month =	 jan,
  Year =	 1995,
  Organization = ACM,
  Address =	 NY,
  Pages =	 "221-232",
  Annote =	 "Functional programming. 41 references."
}

@Article{Sangiorgi99,
  author =	 {Davide Sangiorgi},
  title =	 {Typed $\pi$-Calculus at Work: A Correctness Proof of
                  {Jones's} Parallelisation Transformation on
                  Concurrent Objects},
  journal =	 TAPOS,
  year =	 1999,
  volume =	 5,
  number =	 1,
  pages =	 {25-33},
  annote =	 {26 references.}
}

@article{Sankar-Hayes94,
  author =	 {Sriram Sankar and Roger Hayes},
  title =	 {{ADL}: An Interface Definition Language for
                  Specifying and Testing Software},
  journal =	 SIGPLAN,
  year =	 {1994},
  month =	 aug,
  volume =	 {29},
  number =	 {8},
  pages =	 {13--21},
  note =	 {Proceedings of the Workshop on Interface Definition
                  Language, Jeannette M. Wing (editor), Portland,
                  Oregon.}
}

@article{Sankar-Rosenblum-Neff85,
  author =	 {Sriram Sankar and David Rosenblum and Randall Neff},
  title =	 {An implementation of {Anna}},
  journal =	 {ACM SIGAda Ada Letters},
  year =	 {1985},
  month =	 {Sep/Oct},
  volume =	 {5},
  number =	 {2},
  pages =	 {285--296},
  note =	 {Proceedings of the 1985 annual ACM SIGAda
                  International Conference on Ada 1985 , Paris,
                  France}
}

@inproceedings{Sankaranarayanan-etal04,
author = {Sriram Sankaranarayanan and Henny B. and Manna, Zohar},
title = {Non-Linear Loop Invariant Generation Using Gr\"{o}Bner Bases},
year = {2004},
isbn = {158113729X},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/964001.964028},
doi = {10.1145/964001.964028},
abstract = {We present a new technique for the generation of non-linear (algebraic) invariants
of a program. Our technique uses the theory of ideals over polynomial rings to reduce
the non-linear invariant generation problem to a numerical constraint solving problem.
So far, the literature on invariant generation has been focussed on the construction
of linear invariants for linear programs. Consequently, there has been little progress
toward non-linear invariant generation. In this paper, we demonstrate a technique
that encodes the conditions for a given template assertion being an invariant into
a set of constraints, such that all the solutions to these constraints correspond
to non-linear (algebraic) loop invariants of the program. We discuss some trade-offs
between the completeness of the technique and the tractability of the constraint-solving
problem generated. The application of the technique is demonstrated on a few examples.},
booktitle = {Proceedings of the 31st ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages},
pages = {318–329},
numpages = {12},
keywords = {program analysis, Gr\"{o}bner bases, symbolic computation, ideals, constraint programming, verification, invariant generation},
location = {Venice, Italy},
series = {POPL '04}
}

@Article{Sannella-Sokolowski-Tarlecki92,
  Author =	 "Donald Sannella and Stefan Sokolowski and Andrzej
                  Tarlecki",
  Title =	 "Towards formal development of programs from
                  algebraic specifications: parameterisation
                  revisited.",
  Journal =	 "Acta Informatica",
  Year =	 1992,
  Volume =	 29,
  Number =	 8,
  Pages =	 "689-736"
}

@Article{Sannella-Tarlecki84,
  Author =	 "Donald Sannella and Andrzej Tarlecki",
  Title =	 "Specifications in an Arbitrary Institution",
  Journal =	 "Information and Computation",
  Volume =	 76,
  Number =	 "2/3",
  Month =	 "February/March",
  Year =	 1988,
  Pages =	 "165-210",
  Note =	 "A revised version of the paper that appeared in the
                  1984 Semantics of Data Types Symposium, LNCS 173,
                  pages 337--356.",
  Annote =	 "59 references."
}

@InCollection{Sannella-Tarlecki85a,
  Author =	 "Donald Sannella and Andrzej Tarlecki",
  Title =	 "On Observational Equivalence and Algebraic
                  Specification",
  BookTitle =	 "Mathematical Foundations of Software Development,
                  Proceedings of the International Joint Conference on
                  Theory and Practice of Software Development
                  (TAPSOFT), Berlin. Volume 1: Colloquium on Trees in
                  Algebra and Programming (CAAP '85)",
  Month =	 mar,
  Year =	 1985,
  Pages =	 "308-322",
  Editor =	 "Hartmut Ehrig and Christiane Floyd and Maurice Nivat
                  and James Thatcher",
  Series =	 LNCS,
  Volume =	 185,
  Publisher =	 SV,
  Address =	 NY,
  Annote =	 "38 references."
}

@InProceedings{Sannella-Tarlecki85b,
  Author =	 "Donald Sannella and Andrzej Tarlecki",
  Title =	 "Program Specification and Developemnt in Standard
                  ML",
  BookTitle =	 "Conference Record of the Twelveth ACM Symposium on
                  Principles of Programming Languages",
  Publisher =	 ACM,
  Month =	 jan,
  Year =	 1985,
  Pages =	 "67-77"
}

@Article{Sannella-Tarlecki87,
  Author =	 "Donald Sannella and Andrzej Tarlecki",
  Title =	 "On Observational Equivalence and Algebraic
                  Specification",
  Journal =	 JCSS,
  Volume =	 34,
  Number =	 "2/3",
  Month =	 "April/June",
  Year =	 1987,
  Pages =	 "150-178",
  Note =	 "An earlier version appeared in the TAPSOFT, CAAP '85
                  proceedings, Springer-Verlag LNCS volume 185, pages
                  308-322."
}

@TechReport{Sannella-Tarlecki89,
  Author =	 "Donald Sannella and Andrzej Tarlecki",
  Title =	 "Toward formal development of ML programs:
                  foundations and methodology (preliminary version)",
  Institution = "Laboratory for Foundations of Computer Science,
                  Department of Computer Science, University of
                  Edinburgh",
  Month =	 feb,
  Year =	 1989,
  Number =	 "ECS-LFCS-89-71 (also CSR-289-89)",
  Annote =	 "59 references."
}

@article{10.1145/3158138,
author = {Jos\'{e} Fragoso Santos and Petar Maksimovi\'{c} and Daiva Naud\v{z}i\={u}nienundefined and Thomas Wood and Philippa Gardner},
title = {{JaVerT: JavaScript} Verification Toolchain},
year = {2017},
issue_date = {January 2018},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
volume = {2},
number = {POPL},
url = {https://doi.org/10.1145/3158138},
doi = {10.1145/3158138},
abstract = {The dynamic nature of JavaScript and its complex semantics make it a difficult target for logic-based verification. We introduce JaVerT, a semi-automatic JavaScript Verification Toolchain, based on separation logic and aimed at the specialist developer wanting rich, mechanically verified specifications of critical JavaScript code. To specify JavaScript programs, we design abstractions that capture its key heap structures (for example, prototype chains and function closures), allowing the developer to write clear and succinct specifications with minimal knowledge of the JavaScript internals. To verify JavaScript programs, we develop JaVerT, a verification pipeline consisting of: JS-2-JSIL, a well-tested compiler from JavaScript to JSIL, an intermediate goto language capturing the fundamental dynamic features of JavaScript; JSIL Verify, a semi-automatic verification tool based on a sound JSIL separation logic; and verified axiomatic specifications of the JavaScript internal functions. Using JaVerT, we verify functional correctness properties of: data-structure libraries (key-value map, priority queue) written in an object-oriented style; operations on data structures such as binary search trees (BSTs) and lists; examples illustrating function closures; and test cases from the official ECMAScript test suite. The verification times suggest that reasoning about larger, more complex code using JaVerT is feasible.},
journal = {Proc. ACM Program. Lang.},
month = {dec},
articleno = {50},
numpages = {33},
keywords = {Frame inference, JavaScript verification, Dynamic language verification, Intermediate representations, Programming language design and implementation}
}

@TechReport{Sannella-Tarlecki91,
  Author =	 "Donald Sannella and Andrzej Tarlecki",
  Title =	 "Extended {ML}: Past, present and future",
  Institution = "Laboratory for Foundations of Computer Science,
                  Department of Computer Science, University of
                  Edinburgh",
  Month =	 feb,
  Year =	 1991,
  Number =	 "ECS-LFCS-91-138",
  Annote =	 "60 references."
}

@TechReport{Sannella88,
  Author =	 "Donald Sannella",
  Title =	 "A Survey of Formal Software Development Methods",
  Institution = "Laboratory for Foundations of Computer Science,
                  Department of Computer Science, University of
                  Edinburgh",
  Month =	 jul,
  Year =	 1988,
  Number =	 "ECS-LFCS-88-56",
  Annote =	 "76 references."
}

@TechReport{Sannella89,
  Author =	 "Donald Sannella",
  Title =	 "Formal program development in Extended {ML} for the
                  working programmer",
  Institution = "Laboratory for Foundations of Computer Science,
                  Department of Computer Science, University of
                  Edinburgh",
  Month =	 dec,
  Year =	 1989,
  Number =	 "ECS-LFCS-89-102",
  Annote =	 "24 references."
}

@TechReport{Saxe-etal91,
  Author =	 "James B. Saxe and Stephen J. Garland and John
                  V. Guttag and James J. Horning",
  Title =	 "Using Transformation and Verification in Circuit
                  Design",
  Institution =	 DECSRC,
  Year =	 1990,
  Number =	 78,
  Month =	 sep,
  Address =	 "130 Lytton Avenue Palo Alto, CA 94301",
  Note =	 "Order from src-report@src.dec.com",
  Annote =	 "10 references."
}

@Book{Schach05,
    AUTHOR = "Stephen R. Schach",
    TITLE = "Object-Oriented and Classical Software Engineering",
    publisher =  "McGraw-Hill",
    Address =    NY,
    year =   2005
}

@Book{Schach97,
  author =	 {Stephen R. Schach},
  title =	 {Software Engineering with Java},
  publisher =	 {Irwin},
  year =	 1997,
  address =	 {Chicago},
  annote =	 {Textbook. Many references.}
}

@incollection{Scharli-etal03,
author={Nathanael Schärli and Stéphane Ducasse and Oscar Nierstrasz and Andrew P. Black},
title={Traits: Composable Units of Behaviour},
pages={248-274},
year={2003},
isbn={978-3-540-40531-3},
booktitle={ECOOP 2003 – Object-Oriented Programming},
volume={2743},
series={Lecture Notes in Computer Science},
editor={Cardelli, Luca},
doi={10.1007/978-3-540-45070-2_12},
url={http://dx.doi.org/10.1007/978-3-540-45070-2_12},
publisher={Springer Berlin Heidelberg},
keywords={Inheritance; mixins; multiple inheritance; traits; reuse; Smalltalk},
}

@inproceedings{Schellhorn-Wehrheim-Derrick12,
 author = {Gerhard Schellhorn and Heike Wehrheim and John Derrick},
 title = {How to Prove Algorithms Linearisable},
 booktitle = {Proceedings of the 24th International Conference on Computer Aided Verification},
 series = {CAV'12},
 year = {2012},
 isbn = {978-3-642-31423-0},
 location = {Berkeley, CA},
 pages = {243--259},
 numpages = {17},
 doi = {10.1007/978-3-642-31424-7_21},
 acmid = {2362243},
 publisher = {Springer-Verlag},
 address = {Berlin, Heidelberg},
} 

@InProceedings{Scherlis-Scott83,
  Author =	 "W. L. Scherlis and D. Scott",
  Title =	 "First Steps Toward Inferential Programming",
  BookTitle =	 "Proceedings IFIPS 83, Paris",
  Year =	 1983,
  Pages =	 "199-212",
  Annote =	 "Good introduction to internal logics for reasoning."
}

@InProceedings{Scherlis81,
  Author =	 "William L. Scherlis",
  Title =	 "Program Improvement by Internal Specialization",
  BookTitle =	 "Conference Record of the Eighth ACM Symposium on
                  Principles of Programming Languages",
  Publisher =	 ACM,
  Month =	 jan,
  Year =	 1981,
  Pages =	 "41-49",
  Annote =	 "Program transformation with a generalized procedure
                  construct. 13 references."
}

@article{Schieder-Broy99,
  author =	 "Birgit Schieder and Manfred Broy",
  title =	 "Adapting Calculational Logic to the Undefined",
  journal =	 "The Computer Journal",
  volume =	 "5",
  number =	 "2",
  month =	 feb,
  pages =	 "73--81",
  year =	 "1999",
  url =		 "citeseer.nj.nec.com/schieder99adapting.html"
}

@Article{Schmidt-Zimmerman94,
  author =	 {H. Schmidt and W. Zimmerman},
  title =	 {A Complexity Calculus for Object-Oriented Programs},
  journal =	 {Journal of Object-Oriented Systems},
  year =	 1994,
  pages =	 {117-147}
}

@InProceedings{Schmidt01,
  author =	 {H. Schmidt},
  title =	 {Trusted Components --- Towards Automated Assembly
                  with Predictable Properties},
  booktitle =	 {Proceedings 4th ICSE Workshop on Component-Based
                  Software Engineering},
  year =	 2001,
  editor =	 {Ivica Crnkovic and Heinz Schmidt and Judith Stafford
                  and Kurt Wallnau},
  organization = {IEEE},
  URL =		 {http://www.sei.cmu.edu/pacc/CBSE4-Proceedings.html}
}

@inproceedings{Schmidt98,
author = {David A. Schmidt},
title = {Data Flow Analysis is Model Checking of Abstract Interpretations},
year = {1998},
isbn = {0897919793},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/268946.268950},
doi = {10.1145/268946.268950},
abstract = {This expository paper simplifies and clarifies Steffen's depiction of data flow analysis
(d.f.a.) as model checking: By employing abstract interpretation (a.i.) to generate
program traces and by utilizing Kozen's modal mu-calculus to express trace properties,
we express in simplest possible terms that a d.f.a. is a model check of a program's
a.i. trace. In particular, the classic flow equations for bit-vector-based d.f.a.s
reformat trivially into modal mu-Calculus formulas. A surprising consequence is that
two of the classical d.f.a.s are exposed as unsound; this problem is analyzed and
simply repaired. In the process of making the above discoveries, we clarify the relationship
between a.i. and d.f.a. in terms of the often-misunderstood notion of collecting semantics
and we highlight how the research areas of flow analysis, abstract interpretation,
and model checking have grown together.},
booktitle = {Proceedings of the 25th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages},
pages = {38–48},
numpages = {11},
location = {San Diego, California, USA},
series = {POPL '98}
}

@InBook{Schmitt20,
author="Peter H. Schmitt",
title="A Short History of {KeY}",
bookTitle="Deductive Software Verification: Future Perspectives: Reflections on the Occasion of 20 Years of {KeY}",
year="2020",
publisher="Springer International Publishing",
address="Cham",
pages="3--18",
abstract="This paper describes the story of the first nine years of the KeY project, its original goals, the people involved, its setbacks, but also its occasional failures and blind alleys. It is deliberately written in a more personal style, but tries to meet scientific standards of correctness and completeness.",
isbn="978-3-030-64354-6",
url="https://tinyurl.com/3xbrdwbr"
}

% editor="Wolfgang Ahrendt and Bernhard Beckert and Richard Bubel and Reiner H{\"a}hnle and Mattias Ulbrich",                  
% doi="10.1007/978-3-030-64354-6_1",
@Book{Schmuller04,
  author =	 {Joseph Schmuller},
  title = 	 {Teach Yourself UML in 24 Hours},
  publisher = 	 {SAMS},
  year = 	 2004,
  address =	 {Indianapolis, Indiana}
}

@book{Schneider04,
 author = {Klaus Schneider},
 title = {Verification of Reactive Systems: Formal Methods and Algorithms},
 year = {2004},
 isbn = {3540002960},
 publisher = SV,
 address = {Berlin},
 annote = {527 references.}
}

@InProceedings{Schoeller03,
  Author =	 "Bernd Schoeller",
  Title =	 "Strengthening {Eiffel} Contracts using Models",
  BookTitle =	 "Proceedings of the Workshop on Formal Aspects of
                  Component Software (FACS 2003), Pisa, Italy",
  Month =	 sep,
  Year =	 2003,
  Pages =	 "143--158",
  note =	 "{UNU/IIST} Report No. 284"
}

@TechReport{Schoett82,
  Author =	 "Oliver Schoett",
  Title =	 "A Theory of Program Modules, their Specifications
                  and Implementation (Extended Abstract)",
  Institution =	 "Department of Computer Science, University of
                  Edinburgh",
  Year =	 1982,
  Month =	 dec,
  Type =	 "Internal Report",
  Number =	 "CSR-155-83",
  Annote =	 "24 references."
}

@TechReport{Schoett85,
  Author =	 "Oliver Schoett",
  Title =	 "Behavioural Correctness of Data Representations",
  Institution =	 "Department of Computer Science, University of
                  Edinburgh",
  Year =	 1985,
  Month =	 apr,
  Type =	 "Internal Report",
  Number =	 "CSR-185-85",
  Annote =	 "16 references."
}

@TechReport{Schoett87,
  Author =	 "Oliver Schoett",
  Title =	 "Data Abstraction and the Correctness of Modular
                  Programming",
  Institution =	 "Department of Computer Science, University of
                  Edinburgh",
  Year =	 1987,
  Type =	 "Thesis",
  Number =	 "CST-42-87",
  Note =	 "also ECS-LFCS-87-19"
}

@Article{Schoett90,
  Author =	 "Oliver Schoett",
  Title =	 "Behavioural Correctness of Data Representations",
  Journal =	 SCP,
  Volume =	 14,
  Number =	 1,
  Month =	 jun,
  Year =	 1990,
  Pages =	 "43-57",
  Annote =	 "Two methods for proving the correctness of data
                  representations. Behavioural equivalence relations
                  and behavioural inclusion. Behavioural inclusion
                  allows one to show `partial' implementations. Using
                  relations as a more general technique than
                  abstraction functions. 23 references."
}

@InCollection{Schoett91,
  Author =	 "Oliver Schoett",
  Title =	 "An Observational Subset of First-Order Logic Cannot
                  Specify the Behavior of a Counter",
  BookTitle =	 "STACS 91 8th Annual Symposium on Theoretical Aspects
                  of Computer Science Hamburg, Germany, February 1991
                  Proceedings",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "C. Choffrut and M. Jantzen",
  Series =	 LNCS,
  Volume =	 480,
  Pages =	 "499-510",
  Address =	 NY,
  Annote =	 "15 references."
}

@InCollection{Scholefield-Zedan-Jifeng93,
  Author =	 "David Scholefield and Hussein Zedan and He Jifeng",
  Title =	 "A Categorical Interpretation of Landin's
                  Correspondence Principle",
  BookTitle =	 "Mathematical Foundations of Programming Semantics
                  9th International Conference, New Orleans, LA, USA,
                  Proceedings",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "S. Brookes and M. Main and A. Melton and M. Mislove
                  and D. Schmidt",
  Series =	 LNCS,
  Volume =	 802,
  Pages =	 "230-249",
  Address =	 NY,
  Month =	 apr,
  Annote =	 "11 references."
}
                  
@InProceedings{Schubert-ChrzaszczS06,
  author =       {Aleksy Schubert and Jacek Chrz\k{a}szcz},
  title =        {{ESC/Java2} as a Tool to Ensure Security in the Source Code
of Java Applications},
  booktitle =    {Software Engineering Techniques: Design for Quality},
  pages =        {337-348},
  year =         {2006},
  editor =       {Krzysztof Sacha},
  volume =       {227/2006},
  series =       {IFIP International Federation for Information Processing},
  publisher =    SV,
  URL =          {\url{http://www.mimuw.edu.pl/~alx/papers/passwords.pdf}}
}

@Book{Schulmeyer-Mackenzie00,
  author =	 {G. Gordon Schulmeyer and Garth R. Mackenzie},
  title = 	 {Verification \& Validation of Modern Software-Intensive Systems},
  publisher = 	 {Prentice-Hall PTR},
  year = 	 2000,
  address =	 "Upper Saddle River, NJ",
  annote =       "Several references in individual chapters."
}

@Book{Scott04,
  author =	 {Kendall Scott},
  title = 	 {Fast Track {UML} 2.0},
  publisher = 	 {Apress},
  year = 	 2004,
  address =	 "Berkeley, CA",
}

@Article{Seger-etal05,
  author = {Carl-Johan H. Seger and Robert B. Jones and
            John W. O'Leary and Tom Melham and Mark D. Aagaard
            and Clark Barrett and Don Syme},
  title = 	 {An Industrially Effective Environment for Formal Hardware Verification},
  journal = 	 {IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems},
  year = 	 2005,
  volume =	 24,
  number =	 9,
  pages =	 {1381-1405},
  month =	 sep,
  URL = 	 {http://www.comlab.ox.ac.uk/tom.melham/pub/Seger-2005-IEE.pdf}
}

@Article{Seiter-Palsberg-Lieberherr98,
  author =	 {Linda Seiter and Jens Palsberg and Karl
                  J. Lieberherr},
  title =	 {Evolution of Object Behavior Using Context
                  Relations},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 1,
  month =	 jan,
  pages =	 {79-92},
  annote =	 {Context relations model dynamic relationships, which
                  allow one to easily express several design
                  patterns. Extensions to the UML. Extension of
                  Java. Context relations can be seen as a replacement
                  for delegation. 37 references.}
}

@InProceedings{Sekerinski-Erasmy94,
  author =	 "Emil Sekerinski Francois Erasmy",
  editor =	 "M. Bertran and M. Naftalin and T. Denvir",
  title =	 "Stepwise Refinement of Control Software - {A} Case
                  Study Using {RAISE}",
  booktitle =	 "FME'94: Industrial Benefit of Formal Methods",
  publisher =	 SV,
  year =	 "1994",
  month =	 oct,
  pages =	 "547--566"
}

@InCollection{Sekerinski93,
  Author =	 "Emil Sekerinski",
  Title =	 "A Calculus for Predicative Programming",
  BookTitle =	 "Mathematics of Program Construction, Second
                  International Conference, Oxford, U.K.",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "R.S. Bird and C.C. Morgan and J.C.P. Woodcock",
  Series =	 LNCS,
  Volume =	 669,
  Pages =	 "302-322",
  Address =	 NY,
  Month =	 "June/July",
  Annote =	 "15 References."
}

@TechReport{Sekerinski96,
  author =	 "Emil Sekerinski",
  title =	 "Deriving Control Programs by Weakest Preconditions",
  institution =	 "TUCS - Turku Centre for Computer Science",
  number =	 "TUCS-TR-4",
  month =	 apr,
  year =	 "1996",
  url =
                  "http://www.tucs.abo.fi/publications/techreports/TR4.html",
  abstract =	 "A control program is understood as a reactive
                  component that maintains a continuous interaction
                  with its environment. A formal criterion for the
                  correctness of a control program is given. This
                  criterion can be applied in reverse for deriving a
                  control program from properties of the whole control
                  system. This is illustrated by an example of two
                  conveyor belts. The formal reasoning is based on the
                  weakest precondition calculus. Action systems are
                  used for modeling the control system."
}

@InProceedings{Semmens-Allen91,
  Author =	 "L. Semmens and P. Allen",
  Title =	 "Using {Y}ourdon and {Z}: An Approach to Formal
                  Specification",
  BookTitle =	 "{Z} User Workshop",
  Publisher =	 SV,
  Year =	 1991
}

@Article{Semmens-France-Docker92,
  Author =	 "L. Semmens and R. B. France and T. W. G. Docker",
  Title =	 "Integrated Structured Analysis and Formal
                  Specification Techniques",
  Journal =	 "The Computer Journal",
  Volume =	 35,
  Number =	 6,
  Year =	 1992
}

@InProceedings{Sen-Agha06,
author="Koushik Sen and Gul Agha",
editor="Thomas Ball and Robert B. Jones",
title="{CUTE} and {jCUTE}: Concolic Unit Testing and Explicit Path Model-Checking Tools",
bookTitle="Computer Aided Verification: 18th International Conference, CAV 2006, Seattle, WA, USA, August 17-20, 2006. Proceedings",
year=2006,
publisher=SV,
address="Berlin, Heidelberg",
pages="419-423",
isbn="978-3-540-37411-4",
doi="10.1007/11817963_38",
url="http://dx.doi.org/10.1007/11817963_38"
}
                  
@Book{Sessions97,
  author =	 {Roger Sessions},
  title =	 {{COM} and {DCOM}: Microsoft's Vision for Distributed
                  Objects},
  publisher =	 {John Wiley \& Son},
  year =	 1997
}

@Book{Shalloway-Trott,
  author =	 {Alan Shalloway and James R. Trott},
  title =	 {Design Patterns Explained},
  publisher =	 {Addison-Wesley},
  year =	 2002,
  series =	 {Software Patterns Series},
  annote =	 {Several recommendations for further study.}
}

@InProceedings{Shaner-Leavens-Naumann07,
  author = 	 {Steve M. Shaner and Gary T. Leavens and David A. Naumann},
  title = 	 {Modular Verification of Higher-Order Methods with Mandatory Calls Specified by Model Programs},
  booktitle = {International Conference on Object-Oriented Programming, Systems, Languages and Applications (OOPSLA), Montreal, Canada},
  pages = 	 {351-367},
  year = 	 2007,
  month = 	 oct,
  URL = 	 {http://doi.acm.org/10.1145/1297027.1297053},
  doi = 	 {http://doi.acm.org/10.1145/1297027.1297053},
  publisher = ACM,
  address = NY,
  annote = 	 {42 references.  Grey-box model programs in JML.}
}

@TechReport{Shaner-Leavens-Naumann07a,
  author = 	 {Steve M. Shaner and Gary T. Leavens and David A. Naumann},
  title = 	 {Modular Verification of Higher-Order Methods with Mandatory Calls Specified by Model Programs},
  institution =  {Iowa State University, Department of Computer Science},
  year = 	 2007,
  number =	 {07-04b},
  month =	 {jul},
  URL = 	 {ftp://ftp.cs.iastate.edu/pub/techreports/TR07-04/TR.pdf},
  annote =	 {42 references.},
  note =         {To appear in OOPSLA 2007.}
}

@InProceedings{Shaner-Rajan-Leavens08,
  author = {Steve Shaner and Hridesh Rajan and Gary T. Leavens},
  title = {Model Programs for Preserving Composite Invariants},
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {95-100},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  annote = 	 {16 references.},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/Shaner-Rajan-Leavens.pdf}
}

@TechReport{Shaner09,
  author =	 {Steve M. Shaner},
  title =	 {Modular verification of higher-order methods with mandatory calls specified by model programs},
  institution =	 {Department of Computer Science, Iowa State
                  University},
  year =	 2009,
  number =	 {09-16},
  address =	 {Ames, Iowa, 50011},
  month =	 jan,
  note =	 {The author's masters thesis},
  URL =
                  {ftp://ftp.cs.iastate.edu/pub/techreports/TR09-16/TR.pdf}
}

@TechReport{Shapiro-Pinci-Mameli90,
  Author =	 "Robert M. Shapiro and Valerio Pinci and Roberto
                  Mameli",
  Title =	 "Modeling a {NORAD} Command Post Using {SADT} and
                  {Colored Petri Nets}",
  Institution =	 "IDEF Users Group",
  Year =	 1990,
  Address =	 "Washington, DC",
  Month =	 may,
  Annote =	 "12 references."
}

@Article{Sharma-Aiken16,
  author = 	 {R. Sharma and A. Aiken},
  title = 	 {From invariant checking to invariant inference using randomized search},
  journal = 	 {Formal Methods in System Design},
  year = 	 2016,
  volume = 	 48,
  pages = 	 {235-256},
  URL = 	 {https://doi.org/10.1007/s10703-016-0248-5}
}

@inproceedings{Sharma-etal11,
author = {Rahul Sharma and Isil Dillig and Thomas Dillig and Alex Aiken},
title = {Simplifying Loop Invariant Generation Using Splitter Predicates},
year = {2011},
isbn = {9783642221095},
publisher = {Springer-Verlag},
address = {Berlin, Heidelberg},
abstract = {We present a novel static analysis technique that substantially improves the quality
of invariants inferred by standard loop invariant generation techniques. Our technique
decomposes multi-phase loops, which require disjunctive invariants, into a semantically
equivalent sequence of single-phase loops, each of which requires simple, conjunctive
invariants. We define splitter predicates which are used to identify phase transitions
in loops, and we present an algorithm to find useful splitter predicates that enable
the phase-reducing transformation. We show experimentally on a set of representative
benchmarks from the literature and real code examples that our technique substantially
increases the quality of invariants inferred by standard invariant generation techniques.
Our technique is conceptually simple, easy to implement, and can be integrated into
any automatic loop invariant generator.},
booktitle = {Proceedings of the 23rd International Conference on Computer Aided Verification},
pages = {703–719},
numpages = {17},
keywords = {invariant generation, decomposition of multi-phase loops, static analysis},
location = {Snowbird, UT},
series = {CAV'11}
}


@Book{Shaw-Garlan96,
  author =	 {Mary Shaw and David Garlan},
  title =	 {Software Architecture: Perspectives on an Emerging
                  Discipline},
  publisher =	 {Prentice-Hall},
  year =	 {1996}
}

@Book{Shaw01,
  author =	 {Alan Shaw},
  title =	 {Real-Time Systems and Software},
  publisher =	 {John Wiley \& Sons},
  year =	 2001,
  address =	 NY,
  annote =	 {Many references.}
}

@TechReport{Shaw79,
  author =	 "Mary Shaw",
  title =	 "A Formal System for Specifying and Verifying Program
                  Performance",
  institution =	 "Carnegie-Mellon University",
  month =	 jun,
  year =	 "1979",
}

@Article{Shaw89,
  title =	 "Reasoning About Time in Higher-Level Language
                  Software",
  author =	 "Alan C. Shaw",
  pages =	 "875--889",
  journal =	 "IEEE Transactions on Software Engineering",
  year =	 "1989",
  volume =	 "15",
  month =	 jul,
  number =	 7
}

@Article{Sheil81,
  Author =	 "B. A. Sheil",
  Title =	 "The Psychological Study of Programming",
  Journal =	 ACMCS,
  Volume =	 13,
  Number =	 1,
  Year =	 1981,
  Month =	 mar,
  Pages =	 "101-120",
  Annote =	 "Review of Gannon's results, concludes that most of
                  the benefits of a strongly typed language are in
                  providing data representations and that it does not
                  present a really strong case for strong typing. Good
                  analysis of the problems in Computer Science and
                  what needs to be learned and done to solve them. 42
                  references."
}

@inproceedings{Shimba-etal13,
author = {Hiroaki Shimba and Kentrao Hanada and Kozo Okano and Shinji Kusumoto},
title = {Bidirectional {Translation} between {OCL} and {JML} for {Round}-{Trip} {Engineering}},
volume = {2},
doi = {10.1109/APSEC.2013.111},
booktitle = {2013 20th {Asia}-{Pacific} {Software} {Engineering} {Conference} ({APSEC})},
month = dec,
year = {2013},
pages = {49-54}
}
@book{Shneiderman03,
 author = {Ben Shneiderman},
 title = {Leonardo's Laptop: Human Needs and the New Computing Technologies},
 year = {2003},
 isbn = {0262692996},
 publisher = MITP,
 address = {Cambridge, MA, USA}
}

@inproceedings{Shu-etal02,
 author = {Guoqiang Shu and Chao Li and Qing Wang and Mingshu Li},
 title = {Validating Objected-Oriented Prototype of Real-Time Systems with Timed Automata},
 booktitle = {RSP '02: Proceedings of the 13th IEEE International Workshop on Rapid System Prototyping (RSP'02)},
 year = 2002,
 pages = 99,
 publisher = {IEEE Computer Society},
 address = {Washington, DC, USA}
}

@Article{Siff-Reps96,
  author =	 {Michael Siff and Thomas Reps},
  title =	 {Program Generalization for Software Reuse From {C}
                  to {C++}},
  journal =	 SIGSOFT,
  year =	 1996,
  editor =	 {David Garlan},
  volume =	 21,
  number =	 6,
  month =	 nov,
  pages =	 {135-146},
  note =	 {SIGSOFT '96: Proceedings of the Fourth ACM SIGSOFT
                  Symposium on the Foundations of Software
                  Engineering, San Francisco, California},
  annote =	 {20 references.}
}

@article{Sihman-Katz03a,
	Author = {Marcelo Sihman and Shmuel Katz},
	Title = {Superimpositions and Aspect-Oriented Programming},
	Journal = {The Computer Journal},
	Number = {5},
	Page = {529-541},
	Volume = {46},
	Year = {2003}
}

@InCollection{Simmons-Graham98,
  author =	 {Anthony J. H. Simmons and Ian Graham},
  title =	 {37 Things that Don't Work in Object-Oriented
                  Moideling with {UML}},
  booktitle =	 {Second ECOOP Workshop on Precise Behavioral
                  Semantics (with an Emphasis on OO Business
                  Specifications)},
  publisher =	 {Technical University of Munich, Institut f\"{u}r
                  Informatik},
  year =	 1998,
  month =	 jun,
  editor =	 {Hiam Kilov and Bernhard Rumpe},
  number =	 {TUM-I9838},
  series =	 {Technical Report},
  pages =	 {209-232},
  note =	 {16 references.}
}

@Book{Singh-Stearns-Johnson02,
  author = {Inderjeet Singh and Beth Stearns and Mark Johnson},
  title = {Designing Enterprise Applications with the J2EE Platform, Second Edition},
  publisher = {Addison-Wesley Professional},
  year = 2002,
  month = jun,
  URL = {http://java.sun.com/blueprints/guidelines/designing_enterprise_applications_2e/titlepage.html}
}

@inproceedings{Singleton-Leavens14,
 author = {John L. Singleton and Gary T. Leavens},
 title = {Verily: A Web Framework for Creating More Reasonable Web Applications},
 booktitle = {Companion Proceedings of the 36th International Conference on Software Engineering},
 series = {ICSE Companion 2014},
 year = 2014,
 isbn = {978-1-4503-2768-8},
 location = {Hyderabad, India},
 pages = {560--563},
 numpages = 4,
 url = {http://doi.acm.org/10.1145/2591062.2591069},
 doi = {10.1145/2591062.2591069},
 acmid = 2591069,
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {Method Router Response, Model View Controller, Verily framework, web frameworks},
}

@InProceedings{Singleton-Leavens16,
  author = 	 {John L. Singleton and Gary T. Leavens},
  title = 	 {Spekl: A Layered System for Specification Authoring, Sharing, and Usage},
  booktitle = {1026 IEEE 17th International Conference on Information Reuse and Integration (IRI), Pittsburgh},
  year = 	 2016,
  pages = 	 {126-133},
  month = 	 jul,
  url = {http://dx.doi.org/10.1109/IRI.2016.24},
  doi = {10.1109/IRI.2016.24},
  annote = 	 {16 references.}
}

@InProceedings{Singleton-etal18,
  author = 	 {John L. Singleton and Gary T. Leavens and Hridesh Rajan and David Cok},
  title = 	 {Poster: An Algorithm and Tool to Infer Practical Postconditions},
  booktitle = {2018 ACM/IEEE 40th International Conference on Software Engineering: Companion Proceedings},
  year = 	 2018,
  pages = 	 {313-314},
  month = 	 {Jun},
  address = 	 {Gothenburg, Sweden},
  publisher = {ACM},
  URL = {https://doi.org/10.1145/3183440.3194986},
  annote = 	 {7 references.}
}

@Unpublished{Sitaraman-Weide-Ogden03,
  author =	 "Murali Sitaraman and Bruce W. Weide and William
                  F. Ogden",
  title =	 {Design, Specification, and Analysis of Software
                  Components},
  note =	 {CS 372 Course Notes, Clemson University},
  year =	 2003
}

@Article{Sitaraman-Weide-Ogden97,
  author =	 "Murali Sitaraman and Bruce W. Weide and William
                  F. Ogden",
  title =	 "On the Practical Need for Abstraction Relations to
                  Verify Abstract Data Type Representations",
  journal =	 IEEETSE,
  pages =	 "157--170",
  month =	 mar,
  year =	 1997,
  volume =	 23,
  number =	 3,
  annote =	 "26 references."
}

@Article{Sitaraman-Weide94,
  author =	 {Murali Sitaraman and Bruce W. Weide},
  title =	 {Special Feature: Component-Based Software Using
                  {RESOLVE}},
  journal =	 SIGSOFT,
  year =	 1994,
  volume =	 19,
  number =	 4,
  month =	 oct,
  pages =	 {21-22},
  annote =	 {Introduction to a series of articles on RESOLVE.}
}

@Article{Sitaraman-Welch-Harms93,
  author =	 "Murali Sitaraman and Lonnie R. Welch and Douglas
                  E. Harms",
  title =	 "On Specification of Reusable Software Components",
  journal =	 "International Journal of Software Engineering and
                  Knowledege Engineering",
  year =	 1993,
  volume =	 3,
  number =	 2,
  pages =	 "207-229",
  annote =	 "34 references."
}

@InProceedings{Sitaraman-etal00,
  author =	 "Murali Sitaraman and Steven Atkinson and Gregory
                  Kulczycki and Bruce W. Weide and Timothy J. Long and
                  Paolo Bucci and Scott Pike and Wayne Heym and Joseph
                  E. Hollingsworth",
  title =	 "Reasoning About Software-Component Behavior",
  BookTitle =	 "Software Reuse: Advances in Software Reusability
                  (Proceedings Sixth International Conference on
                  Software Reuse",
  editor =	 "W. B. Frakes",
  URL =
                  "http://www.cis.ohio-state.edu/~weide/rsrg/RSRG-instruction.html",
  year =	 2000,
  series =	 LNCS,
  publisher =	 SV,
  volume =	 1844,
  pages =	 "266-283"
}

@InProceedings{Sitaraman-etal01,
  author =	 "M. Sitaraman and G. Kulczycki and J. Krone and
                  W. F. Ogden and A. L. N. Reddy",
  title =	 "Performance Specifications of Software Components",
  pages =	 "3--10",
  booktitle =	 "Proceedings of the 2001 Symposium on Software
                  Reusability ({SSR}-01)",
  month =	 may # "~18--20",
  series =	 "SSR Record",
  volume =	 "26, 3",
  publisher =	 "ACM Press",
  address =	 "New York",
  year =	 "2001"
}

@InProceedings{Sitaraman-etal01a,
  author = 	 {Murali Sitaraman and Timothy J. Long and Bruce W. Weide and E. James Harner and Liqing Wang},
  title = 	 {A Formal Approach to Component-Based Software Engineering: Education and Evaluation},
  booktitle =	 {Twenty Third International Conference on Software Engineering},
  pages =	 {601-609},
  year =	 2001,
  organization = {IEEE},
  location =     {Toronto, Canada}
}

@TechReport{Sitaraman-etal03,
  author =	 {M. Sitaraman and D. P. Gandi and W. Kuechlin and
                  C. Sinz and B. W. Weide},
  title =	 {The Humane Bugfinder: Modular Static Analysis Using
                  a {SAT} Solver},
  institution =	 {Department of Computer Science, Clemson University},
  year =	 2003,
  number =	 {RSRG-03-05},
  address =	 {Clemson, SC},
  month =	 may,
  URL =
                  {http://www.cs.clemson.edu/~resolve/reports/RSRG-03-05.pdf}
}

@InProceedings{Sitaraman-etal04,
  author =	 "M. Sitaraman and D. P. Gandi and W. Kuechelin
                  and C. Sinz and B. W. Weide",
  title =	 "{DEET} for Component-Based Software",
  pages =	 "1--10",
  booktitle =	 "Proceedings of the Workshop on Specification 
                  and Verification of Component-Based Systems (SAVCB04)",
  year =	 "2004",
  note =         "Held in conjunction with ACM SIGSOFT/FSE, 
                  Newport Beach, CA, October 2004"
}

@InProceedings{Sitaraman01,
  author =	 {Murali Sitaraman},
  title =	 {Compositional Performance Reasoning},
  booktitle =	 {Proceedings 4th ICSE Workshop on Component-Based
                  Software Engineering},
  year =	 2001,
  editor =	 {Ivica Crnkovic and Heinz Schmidt and Judith Stafford
                  and Kurt Wallnau},
  organization = {IEEE},
  URL =		 {http://www.sei.cmu.edu/pacc/CBSE4-Proceedings.html}
}

@InProceedings{Sitaraman92,
  author =	 "M. Sitaraman",
  title =	 "A Class of Programming Language Mechanisms to
                  Facilitate Multiple Implementations of the Same
                  Specification",
  booktitle =	 "Proceedings: 4th International Conference on
                  Computer Languages",
  publisher =	 "IEEE Computer Society Press",
  ISBN =	 "0-8186-2587-2",
  year =	 "1992",
  pages =	 "272--281",
  annote =	 "incomplete",
}

@InProceedings{Sitaraman94,
  author =	 "Murali Sitaraman",
  title =	 "On Tight Performance Specification of
                  Object-Oriented Software Components",
  editor =	 "W. Frakes",
  booktitle =	 "Proceedings: 3rd International Conference on
                  Software Reuse",
  publisher =	 "IEEE Computer Society Press",
  year =	 "1994",
  pages =	 "149--157"
}

@Unpublished{Sitaraman97,
  author =	 "Murali Sitaraman",
  title =	 "Impact of Performance Considerations on Formal
                  Specification Design",
  Note =	 "To appear in Formal Aspects of Computing",
  year =	 1997
}

@phdthesis{Sites74,
   author = "Richard L. Sites",
   title = "Proving that Computer Programs Terminate Cleanly",
   school = "Stanford University",
   month = may,
   year = 1974,
   note = "Technical Report STAN-CS-74-418"
}

@TechReport{Sivaprasad95,
  author =	 "Gowri Sivaprasad",
  title =	 "{Larch/CORBA}: Specifying the Behavior of
                  {CORBA-IDL} Interfaces",
  institution =	 "Department of Computer Science, Iowa State
                  University",
  year =	 1995,
  number =	 "95-27a",
  address =	 "Ames, Iowa, 50011",
  month =	 dec,
  annote =	 "18 references."
}

@TechReport{Sjoegren-Crnkovic-Larsson02,
	author = {Andreas Sj\"{o}gren and Ivica Crnkovic and Magnus Larsson},
	title = {A Method for Support for Design By Contract on the {.NET} Platform},
	institution = {Department of Software Engineering, M\"{a}lardalen University},
	year = {2002}
}

@InProceedings{Skoglund02,
  author =	 "Mats Skoglund",
  editor =	 "H. Kirchner and C. Ringeissen",
  title =	 "Sharing Objects by Read-Only References",
  booktitle =	 "Proceedings of the 9th International Conference 
                  on Algebraic Methodology and Software Technology",
  series =	 "Lecture Notes in Computer Science",
  volume =	 2422,
  pages =	 "457-472",
  publisher =	 SV,
  address =	 NY,
  year =	 2002,
  Annote =	 "20 references."
}

@Article{Slabodkin98,
  author 	= {Gregory Slabodkin},
  title 	= {Software glitches leave {N}avy {S}mart {S}hip dead in the water},
  journal = {Government Computer News},
  year 		= {1998},
  url 		= {http://www.gcn.com/print/17_17/33727-1.html}
}

@InProceedings{Smans-Jacobs-Piessens08,
  author = {Jan Smans and Bart Jacobs and Frank Piessens},
  title = {Implicit Dynamic Frames},
  booktitle = {Formal Techniques for Java-like Programs (FTfJP 2008)},
  year = 2008,
  note = {Technical Report ICIS-R08013, Radboud University},
  editor =    {Marieke Huisman},
  pages =     {1-12},
  publisher = {Radboud University},
  address = {Nijmegen}
}

@inproceedings{Smans-Jacobs-Piessens08a,
  author    = {Jan Smans and Bart Jacobs and Frank Piessens},
  title     = {{VeriCool}: An Automatic Verifier for a Concurrent Object-Oriented
               Language},
  booktitle = {Formal Methods for Open Object-Based Distributed Systems (FMOODS)},
  year      = 2008,
  pages     = {220-239},
  editor    = {Gilles Barthe and Frank S. de Boer},
  publisher = SV,
  address = {Berlin},
  series    = LNCS,
  volume    = 5051
}

@inproceedings{Smans-Jacobs-Piessens09,
  author    = {Jan Smans and
               Bart Jacobs and
               Frank Piessens},
  title     = {Implicit Dynamic Frames: Combining Dynamic Frames and Separation
               Logic},
  year      = {2009},
  pages     = {148-172},
  editor    = {Sophia Drossopoulou},
  booktitle = {Object-Oriented Programming (ECOOP)},
  publisher = SV,
  series    = LNCS,
  address   = {Berlin},
  volume    = {5653}
}

@inproceedings{Smans-etal08,
author = {Jan Smans and Bart Jacobs and Frank Piessens and Wolfram Schulte},
title = {An automatic verifier for {Java-like} programs based on dynamic frames},
booktitle = {Fundamental Approaches to Software Engineering},
year = 2008,
month = apr,
volume = 4961,
pages = {261-275},
url = {https://lirias.kuleuven.be/handle/123456789/178243},
doi = {10.1007/978-3-540-78743-3\_19},
issn = {0302-9743},
series = LNCS,
publisher = SV,
address = {Berlin}
}

@Unpublished{Smith-Duke-King90,
  Author =	 "Graeme Smith and Roger Duke and Paul King",
  Title =	 "Formalization of Object-Oriented Concepts",
  Year =	 1990,
  Note =	 "Submitted to ECOOP/OOPSLA '90, obtained from Roger
                  Duke",
  Annote =	 "Concepts of an object being observationally
                  compatible with a type (obeys its spec) and being
                  operationally compatible (obeys its spec but may be
                  more deterministic). Histories and transitions. 22
                  references."
}

@InProceedings{Smith-etal08,
  author = 	 {Hampton Smith and Kim Roche and Murali Sitaraman and Joan Krone and William F. Ogden},
  title = {Integrating Math Units and Proof Checking for Specification and Verification},
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {59-66},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/Smith-Roche-Sitaraman-Krone-Ogden.pdf}
}

@inproceedings{Smith-etal15,
author = {Edward K. Smith and Earl T. Barr and Claire Le Goues and Yuriy Brun},
title = {Is the Cure Worse than the Disease? Overfitting in Automated Program Repair},
year = 2015,
isbn = 9781450336758,
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/2786805.2786825},
doi = {10.1145/2786805.2786825},
abstract = { Automated program repair has shown promise for reducing the significant manual effort debugging requires. This paper addresses a deficit of earlier evaluations of automated repair techniques caused by repairing programs and evaluating generated patches' correctness using the same set of tests. Since tests are an imperfect metric of program correctness, evaluations of this type do not discriminate between correct patches and patches that overfit the available tests and break untested but desired functionality. This paper evaluates two well-studied repair tools, GenProg and TrpAutoRepair, on a publicly available benchmark of bugs, each with a human-written patch. By evaluating patches using tests independent from those used during repair, we find that the tools are unlikely to improve the proportion of independent tests passed, and that the quality of the patches is proportional to the coverage of the test suite used during repair. For programs that pass most tests, the tools are as likely to break tests as to fix them. However, novice developers also overfit, and automated repair performs no worse than these developers. In addition to overfitting, we measure the effects of test suite coverage, test suite provenance, and starting program quality, as well as the difference in quality between novice-developer-written and tool-generated patches when quality is assessed with a test suite independent from the one used for patch generation. },
booktitle = {Proceedings of the 2015 10th Joint Meeting on Foundations of Software Engineering},
pages = {532–543},
numpages = 12,
keywords = {empirical evaluation, IntroClass, independent evaluation, TrpAutoRepair, GenProg, automated program repair},
location = {Bergamo, Italy},
series = {ESEC/FSE 2015},
annote="64 refeerences."
}

@InProceedings{Smith07,
  author = 	 {Douglas R. Smith},
  title = 	 {Requirement Enforcement by Transformation Automata},
  booktitle =	 {{FOAL} 2007: Proceedings of the Sixth Workshop on Foundations of Aspect-Oriented Languages Workshop at {AOSD} 2007},
  pages =	 {5-14},
  year =	 2007,
  editor =	 {Curtis Clifton and Gary T. Leavens and Mira Mezini},
  month =	 mar,
  publisher =	 ACM,
  URL = 	 {http://www.cs.iastate.edu/~leavens/FOAL/papers-2007/Smith.pdf}
}

@Book{Smith90,
  author =       "Connie U. Smith",
  title =        "Performance Engineering of Software Systems",
  publisher =    "Addison-Wesley Publishing Company",
  address =      "Reading, Mass.",
  year =         "1990"
}

@article{Smith90b,
  author = "Douglas R. Smith",
  title = "{KIDS} -- A Semi-Automatic Program Development System",
  year = 1990,
  journal = IEEETSE,
  volume = 16,
  number = 9,
  pages = "1024-1043",
  url = "citeseer.ist.psu.edu/article/smith90kids.html"
}

@Book{Smith91b,
  Author =	 "David N. Smith",
  Title =	 "Concepts of Object-Oriented Programming",
  Publisher =	 "McGraw-Hill",
  Year =	 1991,
  Address =	 NY,
  Annote =	 "23 referrences."
}

@Article{Smith92,
  Author =	 "Leslie S. Smith",
  Title =	 "A Framework for Neural Net Specification",
  Journal =	 IEEETSE,
  Year =	 1992,
  Volume =	 18,
  Number =	 7,
  Month =	 jul,
  Pages =	 "601-612",
  Annote =	 "19 references."
}

@PhdThesis{Smith92a,
  author = 	 {Graeme Paul Smith},
  title = 	 {An Object-Oriented Approach to Formal Specification},
  school = 	 {University of Queensland},
  year = 	 1992,
  month =	 oct,
  URL =          {\url{http://www.itee.uq.edu.au/~smith/papers/thesis.pdf}},
  annote =	 {Definition of Object-Z, describes inheritance and behavioral compatability}
}

@incollection{Smith99,
   author = "Douglas R. Smith",
   title = "Mechanizing the Development of Software",
   year = 1999,
   editor = "M. Broy and R. Steinbrueggen",
   booktitle = "Calculational System Design, Proceedings of the NATO 
                Advanced Study Institute",
   publisher = "IOS Press, Amsterdam",
   pages = "251-292"
}

@InProceedings{Snelting-Tip02,
  author =	 {Gregor Snelting and Frank Tip},
  title =	 {Semantics-Based Composition of Class Hierarchies},
  booktitle =	 {ECOOP 2002 --- Object-Oriented Programming, 16th
                  European Conference, M\'{a}alaga, Spain,
                  Proceedings},
  pages =	 {562-584},
  year =	 2002,
  editor =	 {Boris Magnusson},
  volume =	 2374,
  series =	 LNCS,
  address =	 {Berlin},
  month =	 jun,
  publisher =	 SV,
  annote =	 {24 references.}
}

@Article{Snelting-Tip98,
  author =	 {Gregor Snelting and Frank Tip},
  title =	 {Reengineering Class Hierarchies Using Concept
                  Analysis},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 6,
  month =	 nov,
  pages =	 {99-110},
  note =	 {Proceedings of the ACM SIGSOFT Sixth Internatioal
                  Symposium on the Foundations of Software
                  Engineering},
  annote =	 {28 references.}
}

@Article{Snoeck-Dedene98,
  author =	 {Monique Snoeck and Guido Dedene},
  title =	 {Existence Dependency: The Key to Semantic Integrity
                  Between Structural and Behavioral Aspects of Object
                  Types},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 4,
  month =	 apr,
  pages =	 {233-251},
  annote =	 {For use in conceptual modeling along with
                  generalization/specialization. 25 references.}
}

@Article{Snyder93,
  Author =	 "Alan Snyder",
  Title =	 "The Essence of Objects: Concepts and Terms",
  Journal =	 "IEEE Software",
  Year =	 1993,
  Month =	 jan,
  Volume =	 10,
  Number =	 1,
  Pages =	 "31-42",
  Annote =	 "1 reference."
}

@Book{Sommerville-Sawyer97,
  author =	 "Ian Sommerville and Pete Sawyer",
  title =	 "Requirements Engineering: A good practice guide",
  publisher =	 "Wiley",
  address =	 "Chichester",
  year =	 "1997",
  ISBN =	 "0-471-97444-7"
}

@Book{Sommerville96,
  author =	 "Ian Sommerville",
  title =	 "Software Engineering",
  publisher =	 "Addison-Wesley",
  year =	 "1996",
  edition =	 "Fifth Edition",
  address =      "Harlow, UK"
}

@Book{Soukup94,
  author =	 {Jiri, Soukup},
  title =	 {Taming C++: Pattern Classes and Persistence for
                  Large Projects},
  publisher =	 {Addison-Wesley},
  year =	 1994,
  address =	 {Reading, Mass.}
}

@InProceedings{Soundarajan-Fridella00,
  author =	 {Neelam Soundarajan and Stephen Fridella},
  title =	 {Behavioral subtyping and behavioral enrichment of
                  multimethods},
  booktitle =	 {Technology of Object Oriented Languages and Systems
                  34},
  editor =	 {Q. Li and D. Firesmth and R. Riehle and G. Pour and
                  B. Meyer},
  publisher =	 {IEEE Computer Society Press},
  year =	 {2000},
  pages =	 {105-114}
}

@InProceedings{Soundarajan-Fridella00b,
  author    = {Neelam Soundarajan and Stephen Fridella},
  title     = {Framework-Based Applications: 
               From Incremental Development to Incremental Reasoning},
  editor    = {William B. Frakes},
  booktitle = {Software Reuse: Advances in Software Reusability, 
               6th International Conference, ICSR-6, Vienna, Austria, 
               June 27-29, 2000, Proceedings},
  publisher = SV,
  series    = {Lecture Notes in Computer Science},
  volume    = {1844},
  year      = {2000},
  pages     = {100--116}
}

@InProceedings{Soundarajan-Fridella04,
  title =	"Incremental Reasoning for Object Oriented Systems",
  author =	"Neelam Soundarajan and Stephen Fridella",
  booktitle =	"From Object-Orientation to Formal Methods, Essays in
		 Memory of Ole-Johan Dahl",
  publisher =	SV,
  year = 	2004,
  volume =	2635,
  editor =	"Olaf Owe and Stein Krogdahl and Tom Lyche",
  pages =	"302-333",
  series =	LNCS,
  URL =  	"http://www.springerlink.com/content/n9uv7k2bha03l9ln"
}

@InProceedings{Soundarajan-Fridella98,
  author =	 {Neelam Soundarajan and Stephen Fridella},
  title =	 {Reasoning about Polymorphic Behavior},
  year =	 1998,
  booktitle =	 {Proceedings of TOOLS 26},
  editor =	 {Ege and Singh and Meyer and Riehle and Mitchell},
  publisher =	 {IEEE Computer Society Press},
  pages =	 {346-358}
}

@inproceedings{Soundarajan-Khatchadourian-Dovland07,
  Author = {Neelam Soundarajan and Raffi Khatchadourian and Johan Dovland},
  Title = {Reasoning about the Behavior of Aspect-Oriented Programs},
  Booktitle = {IASTED International Conference on Software Engineering and Applications},
  Keywords = {Aspect-oriented programs, Behavioral reasoning},
  Month = nov,
  Number = {591-099},
  Pages = {198--202},
  Url = {http://www.cse.ohio-state.edu/~khatchad/papers/sea07.pdf},
  Year = 2007
}

@Article{Soundarajan00,
  author =	"Neelam Soundarajan",
  title =	"Documenting framework behavior",
  journal =	ACMCS,
  volume =	32,
  number =	"1es",
  month =	mar,
  year = 	2000,
  URL = "\url{http://doi.acm.org/10.1145/351936.351950}"
}

@misc{Soundarajan99,
  author = "Neelam Soundarajan",
  title = "Understanding Frameworks",
  Month = jun,
  year = 1999
}

@InProceedings{Sousa-Garlan99,
  author =       "Joao Sousa and David",
  title =        "Formal Modeling of the Enterprise {JavaBeans} Component Integration Framework",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  BookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1709,
  pages =        "1281-1300",
  annote =       "Architectural model.  18 references."
}

@manual{Specware04,
   key = {Specware},
   title = "Specware System and documentation",
   year = "2004",
   organization = "Kestrel Development Corporation",
   note = "\url{http://www.specware.org/}"
}

@Article{Spitzen-Wegbreit75,
  Author =	 "J. Spitzen and B. Wegbreit",
  Title =	 "The Verification and Synthesis of Data Structures",
  Journal =	 "Acta Informatica",
  Year =	 1975,
  Volume =	 4,
  Pages =	 "127-144",
  Annote =	 "Generator induction."
}

@Book{Spivey88,
  Author =	 "J. M. Spivey",
  Title =	 "Understanding {Z}: a Specification Language and its
                  Formal Semantics",
  Publisher =	 "Cambridge University Press",
  Address =	 NY,
  Year =	 1988,
  Annote =	 "Meta-circular definition. 42 references."
}

@Book{Spivey89a,
  Author =	 "J. Michael Spivey",
  Title =	 "The {Z} Notation: A Reference Manual",
  Publisher =	 "Prentice-Hall",
  Series =	 "International Series in Computer Science",
  Year =	 "1989",
  Address =	 NY,
  Note =	 "ISBN 013983768X"
}

@Article{Spivey89b,
  Author =	 "J. Spivey",
  Title =	 "An Introduction to {Z} and Formal Specifications",
  Journal =	 "Software Engineering Journal",
  Year =	 1989,
  Month =	 jan,
  volume =       "4",
  number =       "1",
  pages =        "40--50",
}

@Article{Spivey90a,
  Author =	 "J. Michael Spivey",
  Title =	 "Specifying a Real-Time Kernel",
  Journal =	 "IEEE Software",
  Volume =	 7,
  Number =	 5,
  Month =	 sep,
  Year =	 1990,
  Pages =	 "21-28",
  Annote =	 "3 references."
}

@Book{Spivey92,
  Author =	 "J. Michael Spivey",
  Title =	 "The {Z} Notation: A Reference Manual",
  Publisher =	 "Prentice-Hall",
  Edition =	 "Second",
  Series =	 "International Series in Computer Science",
  Year =	 "1992",
  Address =	 NY,
  URL = {http://spivey.oriel.ox.ac.uk/mike/zrm/}
}

@InProceedings{Spoto-Poll03,
  author = 	 {Fausto Spoto and Erik Poll},
  title = 	 {Static Analysis for {JML}'s assignable Clauses},
  booktitle =	 {Proceedings of FOOL 10},
  year =	 2003,
  month =	 jan,
  URL = 	 {http://www.cs.ru.nl/~erikpoll/publications/fool10.pdf}
}

@TechReport{Sridhar-Hoare85,
  Author =	 "K. T. Sridhar and C. A. R. Hoare",
  Title =	 "{JSD} Expressed in {CSP}",
  Institution =	 "Oxford University Computing Laboratory, Programming
                  Research Group",
  Address =	 "Oxford OX1 3QD, England",
  Number =	 "PRG-51",
  Type =	 "Technical Monograph",
  Month =	 jul,
  Year =	 1985,
  Annote =	 "8 references."
}

@Article{Srinivasan99,
  author =	 {Savitha Srinivasan},
  title =	 {Design Patterns in Object-Oriented Frameworks},
  journal =	 {Computer},
  year =	 1999,
  volume =	 32,
  number =	 2,
  month =	 feb,
  pages =	 {24-32},
  annote =	 {12 references.}
}

@Article{Stal02,
  author =       "Michael Stal",
  title =        "Web Services: beyond component-based computing",
  journal =      CACM,
  volume =       45,
  number =       10,
  pages =        "71-76",
  month =        oct,
  year =         "2002",
  annote =       "2 references."
}

@TechReport{Standish-etal76a,
  Author =	 "T. A. Standish and A. Harriman and D. Kibler and
                  J. M. Neighbors",
  Title =	 "The Irvine Program Transformation Catalogue",
  Institution =	 "Dept. of Computer and Information Sciences,
                  U.C. Irvine",
  Year =	 1976,
  Month =	 jan
}

@InProceedings{Standish-etal76b,
  Author =	 "T. A. Standish and A. Harriman and D. Kibler and
                  J. M. Neighbors",
  Title =	 "Improving and refining programs by program
                  manipulation",
  BookTitle =	 "Proceedings of the 1976 ACM Annual Conference",
  Organization = ACM,
  Year =	 1976,
  Pages =	 "509-516"
}

@incollection{Staples99,
author={Mark Staples},
year={1999},
isbn={978-3-540-66463-5},
booktitle={Theorem Proving in Higher Order Logics},
volume={1690},
series={Lecture Notes in Computer Science},
editor={Bertot, Yves and Dowek, Gilles and ThÃ©ry, Laurent and Hirschowitz, AndrÃ© and Paulin, Christine},
doi={10.1007/3-540-48256-3_16},
title={Representing WP Semantics in Isabelle/ZF},
url={http://dx.doi.org/10.1007/3-540-48256-3_16},
publisher={Springer Berlin Heidelberg},
pages={239-254},
annote={Refinement calculus tool by a shallow embedding. Window optimization.}
}

@Article{Staringer94,
  author =	 {Werner Staringer},
  title =	 {Constructing Applications from Reusable Software},
  journal =	 {IEEE Software},
  year =	 1994,
  volume =	 11,
  number =	 5,
  month =	 sep,
  pages =	 {61-68},
  annote =	 {8 references.}
}

@Article{Stata-Guttag95,
  author =	 {Raymie Stata and John V. Guttag},
  title =	 {Modular Reasoning in the Presence of Subclassing},
  journal =	 SIGPLAN,
  volume =	 30,
  number =	 10,
  year =	 1995,
  publisher =	 ACM,
  month =	 oct,
  pages =	 {200-214},
  note =	 "{\em Proceedings of OOPSLA '95 Tenth Annual
                  Conference on Object-Oriented Programming Systems,
                  Languages, and Applications}",
  annote =	 {15 references.}
}

@TechReport{Stata97,
  author =	 "Raymie Stata",
  title =	 {Modularity in the Presence of Subclassing},
  institution =	 DECSRC,
  year =	 1997,
  number =	 145,
  address =	 {130 Lytton Avenue Palo Alto, CA 94301},
  month =	 apr,
  note =	 {Order from src-report@pa.dec.com or ftp from
                  gatekeeper.dec.com},
  annote =	 {57 references.}
}

@Article{Stavstrup92,
  author =	 {Bjorn Stavstrup},
  title =	 {A Proposal Regarding Invisible Logic for
                  Object-Oriented Languages},
  journal =	 {Journal of Object-Oriented Programming},
  year =	 1992,
  month =	 {March/April}
}

@TechReport{Steele81,
  Author =	 "Barbara Sue Kerns Steele",
  Title =	 "An Accountable Source-to-Source Transformation
                  System",
  Institution =	 MITAI,
  Number =	 "TR-636",
  Year =	 1981,
  Month =	 jun
}

@TechReport{Steffen-etal93,
  Author =	 "Bernhard Steffen and Tiziana Margaria and Burkhard
                  Freitag",
  Title =	 "Module Configuration by Minimal Model Construction",
  Institution =	 "University of Passau, Germany",
  Number =	 "MIP-9313",
  Year =	 1993,
  Month =	 dec,
  Annote =	 "19 refernces"
}

@Unpublished{Steimann-Pawlitzki07,
  author = 	 {Friedrich Steimann and Thomas Pawlitzki},
  title = 	 {Types and Modularity for Implicit Invocation with Implicit Announcement},
  note = 	 {Obtained from the first author.},
  month = 	 aug,
  year = 	 2007
}

@InProceedings{Steimann06,
  author = 	 {Friedrich Steimann},
  title = 	 {The Paradoxical Success of Aspect-Oriented Programming},
  booktitle =    {OOPSLA 2006: Proceedings of the 21st International Conference
                    on Object-oriented Programming Systems, Languages, and
                    Applications},
  year = 2006,
  publisher = ACM,
  address = NY,
  month = oct,
  series = SIGPLAN,
  location =	 {Portland, OR},
  pages =        "481-497"
}

@Book{Steinberg-Palmer04,
  author =	 {Daniel H. Steinberg and Daniel W. Palmer},
  title = 	 {Extreme Software Engineering: A Hands-On Approach},
  publisher = 	 {Pearson/Prentice Hall},
  year = 	 2004,
  annote =	 {28 references.}
}

@TechReport{Stepney-Cooper-Woodcock00,
  author = "Susan Stepney and David Cooper and Jim Woodcock",
  title = "An Electronic Purse: Specification, Refinement, and Proof",
  institution = "Oxford University Computing Laboratory",
  type = "Technical monograph",
  number = "PRG-126",
  month = jul,
  year = 2000,
  annote = "The Mondex case study."
}

@Article{Stevens-Myers-Constantine74,
  author =	 {W. P. Stevens and G. J. Myers and L. L. Constantine},
  title =	 {Structured Design},
  journal =	 {IBM Systems Journal},
  year =	 1974,
  volume =	 2,
  pages =	 {115-139}
}

@Book{Stewart84,
  Author =	 "George Stewart",
  Title =	 "The Apple Program Factory",
  Publisher =	 "Osborne McGraw-Hill",
  Year =	 1984,
  Address =	 "Berkeley, California"
}

@InProceedings{Steyaert-etal96,
  author =	 {Patrick Steyaert and Carine Lucas and Kim Mens and
                  Theo D'Hondt},
  title =	 {Reuse Contracts: Managing the Evolution of Reusable
                  Assets},
  booktitle =	 {OOPSLA '96 Conference on Object-Oriented Programming
                  Systems, Languages and Applications},
  year =	 1996,
  publisher =	 {ACM Press},
  month =	 oct,
  pages =	 {268-285},
  note =	 {ACM SIGPLAN Notices, Volume 31, Number 10},
  annote =	 {16 references}
}

@incollection{Stickel-etal94,
   author = "M. E. Stickel and R. Waldinger and M. Lowry and T. Pressburger and I. Underwood",
   title = "Deductive Composition of Astronomical Software from Subroutine Libraries",
   editor = "A. Bundy",
   booktitle =  "12th Conference on Automated Deduction",
   series = LNCS,
   volume = 814,
   publisher = SV,
   year = 1994
}

@InProceedings{Stocks-Carrington93,
  Author =	 {P. Stocks and D. Carrington},
  Title =	 {Test Template Framework: A Specification-based Test
                  Case Study},
  Year =	 1993,
  Month =	 jun,
  Pages =	 {11--18},
  Booktitle =	 {Proceedings of the 1993 International Symposium on
                  Software Testing and Analysis (ISSTA)},
  Publisher =	 {IEEE Computer Society},
}

@Article{Stocks-Carrington96,
  author =	 {Phil Stocks and David Carrington},
  title =	 {A Framework for Specification-Based Testing},
  journal =	 IEEETSE,
  year =	 1996,
  volume =	 22,
  number =	 11,
  month =	 nov,
  pages =	 {777-793},
  annote =	 {A formal method for defining and structuring
                  testing. Test templates. 41 references.}
}

@inproceedings{Stoerzer-Graf05a,
 author = {Maximilian Stoerzer and Juergen Graf},
 title = {Using Pointcut Delta Analysis to Support Evolution of Aspect-Oriented Software},
 booktitle = {ICSM '05},
 year = 2005,                   
 pages = {653-656}
}
                  
@InCollection{Stoyenko92,
  Author =	 "A.D. Stoyenko",
  Title =	 "The Evolution and State-of-the-Art of Real-Time
                  Languages",
  BookTitle =	 "Real-Time Systems: Abstractions, Languages, and
                  Design Methodologies",
  Publisher =	 "IEEE Computer Society Press",
  Year =	 1992,
  Editor =	 "Krishna M. Kavi",
  Pages =	 "394-416",
  Address =	 "Los Alamitos, California",
  Month =	 oct,
  Annote =	 "161 references."
}

@inproceedings{Strunk-Yin-Knight05,
 author = {Elisabeth A. Strunk and Xiang Yin and John C. Knight},
 title = {Echo: a practical approach to formal verification},
 booktitle = {FMICS '05: Proceedings of the 10th international workshop on Formal methods for industrial critical systems},
 year = {2005},
 isbn = {1-59593-148-1},
 pages = {44--53},
 location = {Lisbon, Portugal},
 doi = {http://doi.acm.org/10.1145/1081180.1081187},
 publisher = {ACM},
 address = {New York, NY, USA}
}

@InProceedings{Sudhir-Kulczycki-Vasudeo08,
  author = 	 {Arun Sudhir and Gregory Kulczycki and Jyotindra Vasudeo},
  title = {Component-Based Design in Tako: A Case Study},
  booktitle = {Seventh International Workshop on Specification and Verification of Component-Based Systems (SAVCBS 2008)},
  pages = 	 {51-58},
  year = 	 2008,
  number = 	 {CS-TR-08-07},
  series = 	 {Technical Report},
  address = 	 {4000 Central Florida Blvd., Orlando, Florida, 32816-2362},
  organization = {School of EECS, UCF},
  url =          {http://www.eecs.ucf.edu/SAVCBS/2008/papers/Sudhir-Kulczycki-Vasudeo.pdf}
}

@Article{Sullivan-Notkin90,
 author  = "Kevin J. Sullivan and David Notkin",
 title   = "Reconciling Environment Integration and Component Independence",
 journal = SIGSOFT,
 month   = dec,
 year    = 1990,
 volume  = 15,
 number  = 6,
 pages   = "22-33"
}

@Article{Sullivan-Notkin92,
  author =	 {Kevin J. Sullivan and David Notkin},
  title =	 {Reconciling Environment Integration and Software Evolution},
  journal =	 TOSEM,
  year =	 1992,
  volume =	 1,
  number =	 3,
  month =	 jul,
  pages =	 {229-268},
  annote =	 {Implicit invocation to promote component
                  independence. 34 references.}
}

@inproceedings{Sullivan-etal05a,
  Author = {Kevin Sullivan and William Griswold and Yuanyuan Song and Yuanfang Cai and Macneil Shonle and Nishit Tewari and Hridesh Rajan},
  Crossref = {FSE-05},
  Month = may,
  Title = {Information Hiding Interfaces for Aspect-Oriented Design},
  Year = {2005},
  Pages = {166-175},
  Annote = {XPIs.  25 references.}
}

@article{Sullivan-etal10,
 author = {Kevin Sullivan and William G. Griswold and Hridesh Rajan and Yuanyuan Song and Yuanfang Cai and Macneil Shonle and Nishit Tewari},
 title = {Modular aspect-oriented design with XPIs},
 journal = TOSEM,
 volume = 20,
 number = 2,
 month = sep,
 year = 2010,
 pages = {5:1--5:42},
 articleno = 5,
 numpages = 42,
 url = {http://doi.acm.org/10.1145/1824760.1824762},
 doi = {10.1145/1824760.1824762},
 publisher = ACM,
 address = NY,
 keywords = {Aspect-oriented programming, design rules, options},
}

@Article{Sullivan01,
  Author =	 "Gregory T. Sullivan",
  Title =	 "Aspect-oriented programming using reflection and
                  metaobject protocols",
  Journal =	 CACM,
  Year =	 2001,
  Volume =	 44,
  Number =	 10,
  Month =	 oct,
  Pages =	 "95--97",
  url =
                  "http://portal.acm.org/toc.cfm?id=383845&type=issue&coll=portal&dl=ACM&idx=J79&part=magazine&WantType=Magazines&title=CACM"
} 

@Misc{SunJSR17504,
	author 				= {{Sun Microsystems, Inc.}},
	title 				= {{JSR} 175: A Metadata Facility for the {Java} Programming Language},
	year 					= {2004},
	howpublished 	= {From 
	                      \url{http://jcp.org/en/jsr/detail?id=175}
	                      (Date retrieved: March 19, 2008)}
}

@Misc{SunJSR22007,
	author 				= {{Sun Microsystems, Inc.}},
	title 				= {{JSR} 220: Enterprise {JavaBeans} 3.0},
	year 					= {2007},
	howpublished 	= {From 
	                      \url{http://jcp.org/en/jsr/detail?id=220}
	                      (Date retrieved: March 19, 2008)}
}

@Misc{SunJSR30207,
	author 				= {{Sun Microsystems, Inc.}},
	title 				= {{JSR} 302: Safety critical Java technology},
	year 					= {2007},
	howpublished 	= {From
	                      \url{http://jcp.org/en/jsr/detail?id=302}
	                      (Date retrieved: March 19, 2008)}
}

@Misc{SunJSR30506,
	author 				= {{Sun Microsystems, Inc.}},
	title 				= {{JSR} 305: Annotations for Software Defect Detection},
	year 					= {2006},
	howpublished 	= {From
	                      \url{http://jcp.org/en/jsr/detail?id=305}
	                      (Date retrieved: March 19, 2008)}
}

@Misc{SunJSR30807,
	author 				= {{Sun Microsystems, Inc.}},
	title 				= {{JSR} 308: Annotations on Java Types},
	year 					= {2007},
	howpublished 	= {From 
	                      \url{http://jcp.org/en/jsr/detail?id=308}
	                      (Date retrieved: March 19, 2008)}
}

@Misc{SunJavaServerFaces07,
	author 				= {{Sun Microsystems, Inc.}},
	title 				= {{JavaServer Faces Technology}},
	year 					= {2007},
	howpublished 	= {From 
	                      \url{http://java.sun.com/javaee/javaserverfaces/}
	                      (Date retrieved: March 27, 2008)}
}

@inproceedings{Sutton-Rouvellou02,
  Author =	 {Stanley M. Sutton, Jr. and Isabelle Rouvellou},
  Booktitle =	 {AOSD 2002},
  Keywords =	 {Cosmos, concern-space modeling, aspect-oriented
                  software development, AOSD, multidimensional
                  separation of concerns, MDSOC, hyperspaces, software
                  information modeling},
  Local-Url =
                  {file://localhost/Users/cclifton/Documents/OthersPapersAndTalks/p127-sutton.pdf},
  Title =	 {Modeling of Software Concerns in Cosmos},
  Year =	 {2002}
}

@article{Svendsen-Birkedal-Parkinson10,
Abstract = {Recently, object-oriented languages, such as C ]> , have been extended with language features prevalent in most functional languages: parametric polymorphism and higher-order functions. In the OO world these are called generics and delegates, respectively. These features allow for greater code reuse and reduce the possibilities for runtime errors. However, the combination of these features pushes the language beyond current object-oriented verification techniques. In this paper, we address this by extending a higher-order separation logic with new assertions for reasoning about delegates and variables. We faithfully capture the semantics of C ]> delegates including their capture of the l-value of a variable, and that ˵stack″ variables can live beyond their ˵scope″. We demonstrate that our logic is sound and illustrate its use by specifying and verifying a series of interesting and challenging examples. [ABSTRACT FROM AUTHOR]},
Author = {Kasper Svendsen and Lars Birkedal and Matthew Parkinson},
Journal = {ECOOP 2010 - Object-oriented Programming},
Pages = {175},
Title = {Verifying Generics and Delegates.},
Year = {2010},
}
                  
@Article{Sweet85,
  Author =	 "Richard E. Sweet",
  Title =	 "The Mesa Programming Environment",
  Journal =	 SIGPLAN,
  Volume =	 20,
  Number =	 20,
  Month =	 jul,
  Year =	 1985,
  Note =	 "Proceedings of the ACM SIGPLAN 85 Symposium on
                  Language Issues in Programming Environments",
  Pages =	 "216-229",
  Annote =	 "Survey and retrospective evaluation of Mesa's
                  environment. 23 references."
}

@Article{Swinehart-Zellweger-Hagmann85,
  Author =	 "Daniel C. Swinehart and Polle T. Zellweger and
                  Robert B. Hagmann",
  Title =	 "The Structure of Cedar",
  Journal =	 SIGPLAN,
  Volume =	 20,
  Number =	 20,
  Month =	 jul,
  Year =	 1985,
  Note =	 "Proceedings of the ACM SIGPLAN 85 Symposium on
                  Language Issues in Programming Environments",
  Pages =	 "230-244",
  Annote =	 "Description of the Cedar environment, especially
                  layering of modules. Strong typing and explicit
                  interfaces help support the layered structure. Safe
                  storage, i.e. garbage collection helps
                  too. Comparison to Interlisp-D, Smalltalk-80, and
                  UNIX. 40 references."
}

@Article{Swinehart-etal86,
  Author =	 "Daniel C. Swinehart and Polle T. Zellweger and
                  Richard J. Beach and Robert B. Hagmann",
  Title =	 "A Structural View of the Cedar Programming
                  Environment",
  Journal =	 TOPLAS,
  Volume =	 8,
  Number =	 4,
  Month =	 oct,
  Year =	 1986,
  Pages =	 "419-490",
  Annote =	 "59 references."
}

@Article{Szczepanska91,
  Author =	 "Danuta Szczepanska",
  Title =	 "A Hoare-like verification system for a language with
                  an exception handling mechanism",
  Journal =	 TCS,
  Year =	 1991,
  Volume =	 80,
  Number =	 2,
  Month =	 mar,
  Pages =	 "319-335"
}

@InCollection{Szyperski-Pfister97,
  author =	 {C. Szyperski and C. Pfister},
  title =	 {Workshop on Component-Oriented Programming, Summary},
  booktitle =	 {Special Issues in Object-Oriented
                  Programming---{ECOOP} '96 Workshop Reader},
  publisher =	 {dpunkt Verlag},
  year =	 1997,
  editor =	 {M. M\"{u}hlh\"{a}user}
}

@InCollection{Szyperski00,
  Author =	 "Clemens Szyperski",
  Title =	 "Component Software and the Way Ahead",
  BookTitle =	 {Foundations of Component-Based Systems},
  Editor =	 {Gary T. Leavens and Murali Sitaraman},
  Year =	 2000,
  Publisher =	 {Cambridge University Press},
  Address =	 NY,
  ISBN =	 {0-521-77164-1},
  Pages =	 "1-20",
  Annote =	 "16 references."
}

@Book{Szyperski02,
  author =	 {Clemens Szyperski and Domiinik Gruntz and Stephan
                  Murer},
  title =	 {Component Software: Beyond Object-Oriented
                  Programming},
  publisher =	 {ACM Press and Addison-Wesley},
  year =	 2002,
  edition =	 "Second edition",
  address =	 NY,
  annote =	 "An excellent overview of component-based
                  programming. Many references."
}

@Book{Szyperski98,
  author =	 {Clemens Szyperski},
  title =	 {Component Software: Beyond Object-Oriented
                  Programming},
  publisher =	 {ACM Press and Addison-Wesley},
  year =	 1998,
  address =	 NY,
  annote =	 "An excellent overview of component-based
                  programming. Many references."
}

@Article{Talcott92,
  Author =	 "Carolyn Talcott",
  Title =	 "A Theory for program and data type specification",
  Journal =	 TCS,
  Volume =	 104,
  Number =	 1,
  Month =	 oct,
  Year =	 1992,
  Pages =	 "129-159"
}

@InProceedings{Tan-Edwards04,
  author = 	 {Roy Patrick Tan and Stephen H. Edwards},
  title = 	 {Experiences evaluating the effectiveness of {JML-JUnit} testing},
  booktitle =	 {Proceeedings of the 2004 Workshop on empirical research in 
    software testing},
  year =	 2004,
  volume =	 {29(5)},
  series =	 SIGSOFT,
  month =	 sep,
  organization = {ACM},
  URL = 	 {http://doi.acm.org/10.1145/1022494.1022545}
}

@InProceedings{Tan-etal12,
 author =       {Shin Hwei Tan and Darko Marinov and
                 Lin Tan and Gary T. Leavens},
 title =        {{@tComment}: Testing {Javadoc} Comments
                 to Detect Comment-Code Inconsistencies},
 booktitle =    PROC # "Fifth International Conference on Software Testing,
                Verification and Validation (ICST 2012)",
 pages =        {260--269},
 month =        apr,
 year =         2012,
 address =      {Montreal, Canada},
 url =          {http://doi.ieeecomputersociety.org/10.1109/ICST.2012.106}
}


@InCollection{Tan92,
  Author =	 "Y. M. Tan",
  Title =	 "Semantic Analysis of Larch Interface Specifications",
  Editor =	 "Ursala Martin and Jeannette M. Wing",
  BookTitle =	 "First International Workshop on Larch, Dedham 1992",
  Publisher =	 SV,
  Year =	 1992,
  Pages =	 "246-261",
  Annote =	 "16 references"
}

@Unpublished{Tan92b,
  Author =	 "Yang Meng Tan",
  Title =	 "Semantic Analysis of Formal Specifications",
  Note =	 "MIT EECS Ph.D. Thesis Proposal",
  Annote =	 "26 references.",
  Month =	 nov,
  Year =	 1992
}

@Article{Tan94,
  Author =	 "Yang Meng Tan",
  Title =	 "Interface Language for Supporting Programming
                  Styles",
  Journal =	 SIGPLAN,
  Year =	 1994,
  Volume =	 29,
  Number =	 8,
  Month =	 aug,
  Pages =	 "74-83",
  Note =	 "Proceedings of the Workshop on Interface Definition
                  Languages.",
  Annote =	 "13 references."
}

@TechReport{Tan94b,
  Author =	 "Yang Meng Tan",
  Title =	 "Formal Specification Techniques for Promoting
                  Software Modularity, Enhancing Documentation, and
                  Testing Specifications",
  Institution =	 MITLCS,
  Year =	 1994,
  Number =	 619,
  Address =	 "545 Technology Square, Cambridge, Mass.",
  Month =	 jun
}

@Book{Tan95,
  author =	 "Yang Meng Tan",
  title =	 {Formal Specification Techniques for Engineering
                  Modular C Programs},
  publisher =	 {Kluwer Academic Publishers},
  year =	 1995,
  volume =	 1,
  series =	 {Kluwer International Series in Software Engineering},
  address =	 {Boston}
}

@InCollection{Tarlton-Tarlton89,
  Author =	 "Mark A. Tarlton and P. Nong Tarlton",
  Title =	 "Pogo: A Declarative Representation System for
                  Graphics",
  Editor =	 "Won Kim and Frederick H. Lochovsky",
  BookTitle =	 "Object-Oriented Concepts, Databases, and
                  Applications",
  Publisher =	 Addison-Wesley,
  Address =	 "Reading, Mass.",
  Year =	 1989,
  Chapter =	 7,
  Pages =	 "151-176",
  Annote =	 "7 references"
}

@TechReport{Taylor-Rieken-Leavens08,
  author =	 {Kristina B. Taylor and Johannes Rieken and Gary T. Leavens},
  title =	 {Adapting the {Java Modeling Language (JML)} for {Java 5} Annotations},
  institution =	 "Department of Computer Science, Iowa State University",
  year =	 2008,
  number =	 "08-06",
  address =	 "226 Atanasoff Hall, Ames, Iowa 50011",
  month =	 apr,
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR08-06/TR.pdf",
  Annote =	 "13 references."
}
                  
@TechReport{Taylor08,
  author =	 {Kristina P. Boysen},
  title =	 {A Specification Language Design for the {Java Modeling Language (JML)} Using {Java 5} Annotations},
  institution =	 "Department of Computer Science, Iowa State University",
  year =	 2008,
  number =	 "08-03",
  address =	 "226 Atanasoff Hall, Ames, Iowa 50011",
  month =	 apr,
  URL =          "ftp://ftp.cs.iastate.edu/pub/techreports/TR08-03/TR.pdf",
  Annote =	 "39 references."
}

@Article{Terwilliger93,
  Author =	 "Robert B. Terwilliger",
  Title =	 "Towards Tools to Support the Gries/Djikstra Design
                  Process",
  Journal =	 SIGSOFT,
  Volume =	 18,
  Number =	 2,
  Month =	 apr,
  Year =	 1993,
  Pages =	 "50-59",
  Annote =	 "52 references"
}

@Article{Thatcher-Wagner-Wright82,
  Author =	 "J. W. Thatcher and E. G. Wagner and J. B. Wright",
  Title =	 "Data Type Specification: Parameterization and the
                  Power of Specification Techniques",
  Journal =	 TOPLAS,
  Volume =	 4,
  Number =	 4,
  Month =	 oct,
  Year =	 1982,
  Pages =	 "711-732",
  Annote =	 "Shows need for conditionals to augment the
                  equational approach to specification of abstract
                  types. Gives a formal basis for parameterized
                  types. 26 references."
}

@Article{Theiling-Ferdinand-Wilhelm00,
  Author =	 "H. Theiling and C. Ferdinand and R. Wilhelm",
  Title =	 "Fast and precise {WCET} prediction by separate
                  cache and path analyses",
  Journal =	 "Real-Time Systems",
  Volume =	 18,
  Number =	 "2/3",
  Month =	 may,
  Year =	 2000,
  Pages =	 "157--179"
}

@Book{Thimbleby90,
  Author =	 "Harold Thimbleby",
  Title =	 "User Interface Design",
  Publisher =	 "ACM Press, Addison-Wesley",
  Year =	 1990,
  Series =	 "Frontier Series",
  Address =	 "NY",
  Annote =	 "ISBN 0-201-41618-2. 72 references."
}

@InProceedings{Thompson-Heimdahl-Miller99,
  author =       {Jeffrey M. Thompson and Mats P. E. Heimdahl and Steven P. Miller},
  title =        "Specification-Based Prototyping for Embedded Systems",
  booktitle =    "Software Engineering -- ESEC/FSE '99",
  month =        nov,
  year =         "1999",
  editor =       "Oscar Nierstrasz and Michel Lemoine",
  volume =       "1687",
  series =       LNCS,
  publisher =    SV,
  pages =        {163-179},
  note =         {Also ACM SIGSOFT {\em Software Engineering Notes},
                  volume 24, number 6.},
  annote =       {26 references.}
}

@InProceedings{Thompson86,
  Author =	 "Thompson",
  Title =	 "Laws in Miranda",
  BookTitle =	 "ACM Conference on LISP and Functional Programming",
  Year =	 1986,
  Pages =	 "1-12",
  Organization = ACM,
  Month =	 aug,
  Annote =	 "13 references."
}

@Article{Thompson90,
  Author =	 "Simon Thompson",
  Title =	 "Lawful Functions and Program Verification in
                  Miranda",
  Journal =	 SCP,
  Volume =	 13,
  Number =	 "2-3",
  Month =	 may,
  Year =	 1990,
  Pages =	 "181-218",
  Annote =	 "A type with equations (an invariant) has an
                  associated free type (AFT) that is the same except
                  it has not equations. Problem is how to use
                  transformational reasoning about operators of types
                  with equations. Idea is to reason about the AFT
                  equationally. Use normalizer function as a retract
                  from AFT carrier to subset satisfying type's
                  invariant. To prove property of x:T, prove if for
                  (norm y), where y:AFT. Or if can show property holds
                  for AFT, then holds for the type. A function is
                  faithful if it preserves equivalence classes of the
                  normalizer. Equations for faithful functions can be
                  used regardless of the laws. If associated function
                  is not faithful, can sometimes find a faithful
                  representing function to reason with. 10
                  references."
}

@Misc{Thomschke07,
	author 				= {Sebastian Thomschke},
	title 				= {{OVal} -- The Object Validation Framework for {Java} 5 or Later},
	year 					= {2007},
	howpublished 	= {From
	                      \url{http://oval.sourceforge.net/}
	                      (Date retrieved: March 19, 2008)}
}

@InProceedings{Tillmann-Schulte05,
  author = 	 {Nikolai Tillmann and Wolfram Schulte},
  title = 	 {Parameterized Unit Tests with Unit Meister},
  booktitle = {ESEC/FSE'05},
  pages = 	 {241-244},
  year = 	 2005,
  address = 	 NY,
  month = 	 sep,
  organization = ACM,
  doi =          {http://doi.acm.org/10.1145/1081706.1081745},
  location =     {Lisbon, Portugal},
  annote = 	 {21 references.}
}

@Article{Tockey97,
  author =	 {Steve Tockey},
  title =	 {A Missing Link in Software Engineering},
  journal =	 {IEEE Software},
  year =	 1997,
  volume =	 14,
  number =	 6,
  month =	 nov,
  pages =	 {31-36},
  annote =	 {Engineering economy and other educational needs. 15
                  references.}
}

@inproceedings{Tourwe-Brichau-Gybels03,
 author = {Tom Tourw\'e and Johan Brichau and Kris Gybels},
 title = {On the Existence of the AOSD-Evolution Paradox},
 booktitle = {SPLAT '03},
 month = mar,
 year = 2003,
 location = {Boston}
}

@Article{Tracey-Clark-Mander98,
  author =	 {Nigel Tracey and John Clark and Keith Mander},
  title =	 {Automated Program Flaw Finding using Simulated
                  Annealing},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 2,
  month =	 mar,
  pages =	 {73-81},
  note =	 {ISSTA 98: Proceedings of the ACM SIGSOFT
                  Internatioal Symposium on Software Testing and
                  Analysis},
  annote =	 {22 references.}
}

@Book{Tracez95,
  author =	 {Will Tracez},
  title =	 {Confessions of a Used Program Salesman:
                  Institutionalizing Software Reuse},
  publisher =	 {Addison-Wesley},
  year =	 1995,
  address =	 {Reading, Mass.},
  annote =	 {Many references.}
}

@Article{Tran-Jorgensen-Larsen-Leavens17,
author="Peter W. V. Tran-J{\o}rgensen and Peter Gorm Larsen and Gary T. Leavens",
title="Automated translation of {VDM} to {JML}-annotated {Java}",
journal="International Journal on Software Tools for Technology Transfer",
year="2017",
pages="211-235",
volume=20,
number=2,
month=apr,
Annote="39 references.",
doi="10.1007/s10009-017-0448-3",
url="http://dx.doi.org/10.1007/s10009-017-0448-3"
}

@Book{Tremblay-Cheston03,
  author =	 "Jean-Paul Tremblay and Grant A. Cheston",
  title =	 "Data Structures and Software Development in an
                  Object-Oriented Domain",
  edition =	 "Java edition",
  publisher =	 "Prentice Hall",
  address =	 "Upper Saddle River, NJ",
  year =	 "2003",
  annote =	 "53 references."
}

@InProceedings{Trentelman-Huisman02,
  author = 	 {Kerry Trentelman and Marieke Huisman},
  title = 	 {Extending JML Specifications with Temporal Logic},
  booktitle =	 {AMAST '02: Proceedings of the 9th International Conference on
  Algebraic Methodology and Software Technology},
  pages =	 {334-348},
  year =	 2002,
  volume =	 2422,
  series =	 LNCS,
  address =	 NY,
  publisher =	 SV,
  URL = 	 {ftp://ftp-sop.inria.fr/lemme/Marieke.Huisman/amast02.ps.gz}
}

@Article{Tse-Pong89,
  Author =	 "T. H. Tse and L. Pong",
  Title =	 "Towards a Formal Foundation for {Demarco} Data Flow
                  Diagrams",
  Journal =	 "The Computer Journal",
  Year =	 1989,
  Volume =	 32,
  Number =	 1,
  Month =	 feb,
  Pages =	 "1-12",
  Annote =	 "36 references."
}

@Book{Tse91,
  Author =	 "T. H. Tse",
  Title =	 "A Unifying Framework for Structured Analysis and
                  Design Models",
  Publisher =	 "Cambridge Univerity Press",
  Year =	 1991,
  Volume =	 11,
  Series =	 "Cambridge Tracts in Theoretical Computer Science",
  Address =	 NY,
  Annote =	 "Algebraic description of the syntax of Yourdon
                  structure charts, DeMarco flow diagrams and Jackson
                  structure texts. Mappings between these. Over 100
                  references."
}

@InCollection{Tucker-Zucker91,
  Author =	 "J. V. Tucker and J. I. Zucker",
  Title =	 "Toward a General Theory of Computation and
                  Specification over Abstract Data Types",
  BookTitle =	 "Advances in Computing and Information ICCI '90,
                  International Conference on Computing and
                  Information, Niagara Falls, Canada, May 1990",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "S. G. Akl and F. Fiala and W. W. Koczkodaj",
  Series =	 LNCS,
  Volume =	 468,
  Pages =	 "129-133",
  Address =	 NY,
  Annote =	 "10 references."
}
@InProceedings{Turk-etal02,
  title =	"Model-Driven Approaches to Software Development",
  author =	"Daniel E. Turk and Robert B. France and Bernhard Rumpe
		 and Geri Georg",
  year = 	"2002",
  booktitle =	"OOIS Workshops",
  pages =	"229-230",
  URL =  	"http://link.springer.de/link/service/series/0558/bibs/2426/24260229.htm"
}

@InCollection{Turner82,
  Author =	 "D. A. Turner",
  Title =	 "Functional programming and proofs of program
                  correctness",
  BookTitle =	 "Tools and Notions for Program Construction",
  Editor =	 "D. Neel",
  Publisher =	 "Cambridge University Press",
  Address =	 NY,
  Year =	 1982
}

@Book{Turski-Maibaum87,
  Author =	 "Wladyslaw M. Turski and Thomas S. E. Maibaum",
  Title =	 "The Specification of Computer Programs",
  Publisher =	 "Addison-Wesley",
  Address =      "Reading, Mass.",
  Year =	 1987,
  Annote =       "50 references."
}

@InProceedings{Tyler-Soundarajan03,
  title =	"Black-Box Testing of Grey-Box Behavior",
  author =	"Benjamin Tyler and Neelam Soundarajan",
  publisher =	SV,
  year = 	"2003",
  volume =	"2931",
  editor    = {Alexandre Petrenko and Andreas Ulrich},
  booktitle = {Formal Approaches to Software Testing, Third International Workshop
               on Formal Approaches to Testing of Software, FATES 2003, Montreal,
               Quebec, Canada, October 6th},
  ISBN = 	"3-540-20894-1",
  pages =	"1-14",
  series =	LNCS,
  URL =  	"\url{http://springerlink.metapress.com/openurl.asp?genre=article&amp;issn=0302-9743&amp;volume=2931&amp;spage=1}"
}

@InProceedings{Unnikrishnan-Stoller-Liu01,
  author =       "Leena Unnikrishnan and Scott D. Stoller and Liu Liu",
  title =        "Automatic {Accurate Live Memory Analysis} for
                 {Garbage-Collected Languages}",
  booktitle =    "LCTES'01: The Workshop on Languages, Compilers and
                 Tools for Embedded Systems",
  series =       SIGPLAN,
  volume =       "36, 8",
  pages =        "102-111",
  month =        aug,
  year =         2001
}

@InProceedings{Utting-Fidge96,
  author =	 {M. Utting and C. J. Fidge},
  title =	 {A Real-Time Refinement Calculus that Changes Only
                  Time},
  booktitle =	 {Procs. 7th BCS/FACS Refinement Workshop},
  year =	 1996,
  month =	 jul,
  publisher =	 SV
}

@InCollection{Utting-Robinson92,
  Author =	 "Mark Utting and Ken Robinson",
  Title =	 "Modular Reasoning in an Object-Oriented Refinement
                  Calculus",
  BookTitle =	 "Mathematics of Program Construction, Second
                  International Conference, Oxford, U.K., June/July",
  Publisher =	 SV,
  Year =	 1992,
  Editor =	 "R. S. Bird and C. C. Morgan and J. C. P. Woodcock",
  Series =	 LNCS,
  Volume =	 669,
  Pages =	 "344-367",
  Address =	 NY,
  Annote =	 "25 references."
}

@PhdThesis{Utting92,
  Author =	 "Mark Utting",
  Title =	 "An Object-Oriented Refinement Calculus with Modular Reasoning",
  School =	 "University of New South Wales",
  Year =	 1992,
  Address =	 "Kensington, Australia",
  Note =	 "Draft of February 1992 obtained from the Author."
}

@InProceedings{Utting95,
  author =	 "Mark Utting",
  title =	 "Reasoning about Aliasing",
  pages =	 "195-211",
  booktitle =	 "Proceedings of the {Fourth Australasian Refinement Workshop (ARW-95)}",
  year =	 1995,
  publisher =	 "School of Computer Science and Engineering, The
                  University of New South Wales",
  month =	 apr,
  address =      {New South Wales},
  note =	 {Available from
                  \url{http://www.cs.waikato.ac.nz/~marku}}
}

@Article{Utting97,
  author =	 {Mark Utting},
  title =	 {Reasoning about Aliasing},
  journal =	 {Formal Aspecs of Computing},
  year =	 1997,
  volume =	 3,
  pages =	 {1-15}
}

@inproceedings{Vafeiadis-etal06,
 author = {Viktor Vafeiadis and Maurice Herlihy and Tony Hoare and Marc Shapiro},
 title = {Proving Correctness of Highly-concurrent Linearisable Objects},
 booktitle = {Proceedings of the Eleventh ACM SIGPLAN Symposium on Principles and Practice of Parallel Programming},
 series = {PPoPP '06},
 year = {2006},
 isbn = {1-59593-189-9},
 location = {New York, New York, USA},
 pages = {129--136},
 numpages = {8},
 doi = {10.1145/1122971.1122992},
 acmid = {1122992},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {concurrent programming, formal verification, linearisability, rely-guarantee reasoning, shared-memory concurrency},
}

@incollection{Vafeiadis10,
author={Viktor Vafeiadis},
title={Automatically Proving Linearizability},
year={2010},
isbn={978-3-642-14294-9},
booktitle={Computer Aided Verification},
volume={6174},
series={Lecture Notes in Computer Science},
editor={Touili, Tayssir and Cook, Byron and Jackson, Paul},
doi={10.1007/978-3-642-14295-6_40},
url={http://dx.doi.org/10.1007/978-3-642-14295-6_40},
publisher={Springer Berlin Heidelberg},
pages={450-464}
} 

@Book{Valenti02,
  editor =	 {Sal Valenti},
  title = 	 {Successful Software Reengineering},
  publisher = 	 {IRM Press},
  year = 	 2002,
  address =	 {Hershey, PA}
}

@Article{Valle-etal00,
  author = 	 {Bego\~{n}a Moros Valle and Joaqu\'{i}n Nicol\'{a}s Ros and Jes\'{u}s Garc\'{i}a MOlina and Jos\'{e} Ambrosio Toval \'{A}lvarez},
  title = 	 {Combining Formal Specifications with Design by Contract},
  journal = 	 JOOP,
  year = 	 2000,
  volume =	 12,
  number =	 9,
  pages =	 {16-21,46},
  month =	 feb,
  annote =	 {22 references.}
}

@Article{VanHilst-Notkin96,
  author =	 {Micheal VanHilst and David Notkin},
  title =	 {Decoupling Change from Design},
  journal =	 SIGSOFT,
  year =	 1996,
  editor =	 {David Garlan},
  volume =	 21,
  number =	 6,
  month =	 nov,
  pages =	 {58-69},
  note =	 {SIGSOFT '96: Proceedings of the Fourth ACM SIGSOFT
                  Symposium on the Foundations of Software
                  Engineering, San Francisco, California},
  annote =	 {Letting change be addressed at the submodule level,
                  while allowing high level modularization to address
                  other issues. 18 references.}
}

@Article{VanderLinden94,
  Author =	 "Frank J. VanderLinden",
  Title =	 "Formal methods: from object-based to
                  object-oriented",
  Journal =	 SIGPLAN,
  Year =	 1994,
  Volume =	 29,
  Number =	 7,
  Month =	 jul,
  Pages =	 "29-38",
  Annote =	 "14 references."
}

@InCollection{Vandevoorde92,
  Author =	 "M. T. Vandevoorde",
  Title =	 "Optimizing Programs with Partial Specifications",
  Editor =	 "Ursala Martin and Jeannette M. Wing",
  BookTitle =	 "First International Workshop on Larch, Dedham 1992",
  Publisher =	 SV,
  Year =	 1992,
  Pages =	 "262-281",
  Annote =	 "14 references"
}

@InCollection{Vandevoorde93,
  Author =	 "M. T. Vandervoode",
  Title =	 "Specifications can make the Programs run faster",
  Journal =	 LNCS,
  Number =	 668,
  Publisher =	 SV,
  Address =	 NY,
  Editor =	 "M. C. Gaudel and J. P. Jouannaud",
  Year =	 1993,
  Booktitle =	 "TAPSOFT '93: Theory and Practice of Software
                  Development. 4th International Joint Conference
                  CAAP/FASE",
  Pages =	 "215-229",
  Annote =	 "17 references"
}

@article{Vanfleet-etal05,
	author = {Mark Vanfleet and Jahn Luke and R. William Beckwith and Carol Taylor and Ben Calloni and Gordon Uchenick},
	journal = {CrossTalk: The Journal of Defense Software Engineering},
	month = {August},
	title = {{MILS}: Architecture for High-Assurance Embedded Computing},
	year = {2005},
        volume = 18,
        number = 8,
        pages = "12-16",
        publisher = "Department of Defense",
        URL = {http://www.stsc.hill.af.mil/crosstalk/2005/08/0508vanfleet_etal.html}
}

@Unpublished{Vaziri-Jackson99,
  author =	 "Mandana Vaziri and Daniel Jackson",
  title =	 "Some Shortcomings of {OCL}, the {O}bject
                  {C}onstraint {L}anguage of {UML}",
  note =	 "Response to {O}bject {M}anagement {G}roup's Request
                  for Information on {UML} 2.0,
                  \url{http://sdg.lcs.mit.edu/~dnj/pubs/omg.ps}",
  month =	 dec,
  year =	 1999
}

@InProceedings{Veanes-etal05,
  title =	"Online testing with model programs",
  author =	"Margus Veanes and Colin Campbell and Wolfram Schulte
		 and Nikolai Tillmann",
  year = 	"2005",
  editor =      "Michel Wermelinger and Harald Gall",
  booktitle =	"Proceedings of the 10th European Software Engineering
                 Conference held jointly with
                 13th ACM SIGSOFT International Symposium
                 on Foundations of Software Engineering",
  pages =	"273-282",
  organization = ACM,
  URL =  	"http://doi.acm.org/10.1145/1081706.1081751",
}

@TechReport{Veloso-Maibaum92,
  author =	 {P. Veloso and T. Maibaum},
  title =	 {On the modularisation theorem for logical
                  specifications},
  institution =	 {Imperial College of Science, Technology and
                  Medicine, Department of Computing},
  year =	 1992,
  type =	 {Research Report},
  number =	 {DoC 92/35},
  month =	 oct
}

@Article{Veloso93,
  author =	 {P. Veloso},
  title =	 {A new, simpler proof of the modularization theorem
                  for logical specifications},
  journal =	 {Journal Bulletin of the IGPL},
  year =	 1993,
  volume =	 1,
  pages =	 {3-12}
}

@TechReport{Venkatesh-Fischer89,
  Author =	 "G. A. Venkatesh and Charles N. Fischer",
  Title =	 "{SPARE}: Reference Manual",
  Institution =	 "Computer Sciences Department, University of
                  Wisconsin-Madison",
  Number =	 850,
  Month =	 jun,
  Year =	 1989,
  Annote =	 "Structured Program Analysis Refinement Environment
                  is a tool for rapid prototyping. 7 references."
}

@InProceedings{Verhoeven-Backhouse99,
  title =        "Interfacing Program Construction and Verification",
  author =       "Richard Verhoeven and Roland Backhouse",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  BookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1709,
  pages =        "1128-1146",
  annote =       "Uses PVS for verification.  22 references.",
}

@InProceedings{Vetter-Worley02,
  Author =	 "Jeffrey S. Vetter and Patrick H. Worley",
  Title =	 "Asserting Performance Expectations",
  BookTitle =	 "ACM/IEEE Conference on High Performance Networking
                  and Computing (SC02), Baltimore, MD, November 16-22,
                  2002",
  Year =	 2002,
  Pages =	 "1-13"
}

@Book{Viega-McGraw02,
  author =	"John Viega and Gary McGraw",
  title =	"Building Secure Software: How to Avoid Security Problems the Right Way",
  publisher =	Addison-Wesley,
  address =	"Indianoplis, IN",
  year = 	2002,
  annote =	"85 references."
}

@InProceedings{Viswanadha-Sankar96,
  author =	 {Sreenivasa Rao Viswanadha and Sriram Sankar},
  title =	 {Preliminary Design of {ADL/C++} --- A Specification
                  Language for {C++}},
  booktitle =	 {Second Conference on Object-Oriented Technologies
                  and Systems (COOTS), Toronto, Canada},
  year =	 1996,
  month =	 jun,
  note =	 "Obtained from
                  http://www.cs.albany.edu/\verb|~|sreeni/cootsfinal.ps"
}

@Article{Vitek-Bokowski01,
  author =	 "Jan Vitek and Boris Bokowski",
  title =	 "Confined types in {Java}",
  journal =	 "Software --- Practice and Experience",
  volume =	 31,
  number =	 6,
  pages =	 "507--532",
  year =	 2001
}

@InProceedings{Vitek-Bokowski99,
  author =	 "Jan Vitek and Boris Bokowski",
  title =	 "Confined Types",
  pages =	 "82-96",
  editor =	 "Loren Meissner",
  booktitle =	 "Proceeings of the 1999 {ACM} {SIGPLAN} Conference on
                  Object-Oriented Programming, Systems, Languages {\&}
                  Applications ({OOPSLA}`99)",
  month =	 nov,
  series =	 SIGPLAN,
  volume =	 "34(10)",
  publisher =	 "ACM Press",
  address =	 NY,
  year =	 "1999",
}

@Misc{Vitik-Plsek10,
  author =	 {Jan Vitek and Ales Plsek},
  title =	 {Open Safety-Critical Java},
  howpublished = {http://sss.cs.purdue.edu/projects/oscj/publications/Documents/oSCJ-Report.pdf},
  organization = {Purdue University},
  month = Jan,
  year = 2010,
  note = {Accessed September 30, 2021.}
}

@Article{Vlissides99,
  author =	 {John Vlissides},
  title =	 {Visitor in Frameworks},
  journal =	 {{C++} Report},
  year =	 1999,
  volume =	 11,
  number =	 10,
  pages =	 {40--46},
  month =	 "November/December"
}

@Article{Voas97,
  author =	 {Jeffrey Voas},
  title =	 {How Assertions Can Increase Test Effictiveness},
  journal =	 {IEEE Software},
  year =	 1997,
  volume =	 14,
  number =	 2,
  month =	 mar,
  pages =	 {118-119,122}
}

@Article{Voas98,
  author =	 {Jeffrey M. Voas},
  title =	 {Certifying Off-the-Shelf Software Components},
  journal =	 {Computer},
  year =	 1998,
  volume =	 31,
  number =	 6,
  month =	 jun,
  pages =	 {53-59},
  annote =	 {9 references.}
}

@Article{Voas99,
  author =	 {Jeffrey Voas},
  title =	 {Certifying Software for High-Assurance Environments},
  journal =	 {IEEE Software},
  year =	 1999,
  volume =	 16,
  number =	 4,
  month =	 jul,
  pages =	 {48-54},
  annote =	 {12 references.}
}

@unpublished{Voda03,
  author="P. Voda",
  title={What Can We Gain by Integrating a Language Processor 
        with a Theorem Prover},
  note="unpublished; available from the author's web site",
  year=2003
}

@InCollection{Wagner-Thatcher-Wright78,
  Author =	 "E. G. Wagner and J. W. Thatcher and J. B. Wright",
  Title =	 "Programming languages as mathematical objects",
  BookTitle =	 "Mathematical Foundations of Computer Science",
  Publisher =	 SV,
  Year =	 1978,
  Editor =	 "J. Winkowski",
  Series =	 LNCS,
  Volume =	 10,
  Pages =	 "84-101",
  Address =	 NY
}

@InCollection{Wagner-etal76,
  author =	 "Eric Wagner and Jesse Wright and Joseph Goguen and
                  James Thatcher",
  title =	 "Some Fundamentals of Order-Algebraic Semantics",
  booktitle =	 "Proceedings, Fifth Symposium on Mathematical
                  Foundations of Computer Science",
  editor =	 "Andrzej Mazurkiewicz",
  publisher =	 SV,
  year =	 "1976",
  location =	 "Gda\'nsk, Poland",
  volume =	 45,
  series =	 LNCS,
  pages =	 "153--168"
}

@MastersThesis{Wagner85,
  Author =	 "Richard Martin Wagner",
  Title =	 "Program Animation Tools and Techniques",
  School =	 MIT,
  Address =	 "Cambridge, Mass.",
  Year =	 1985,
  Month =	 nov,
  Annote =	 "All done in Smalltalk-80. 26 references."
}

@TechReport{Wahls-Baker-Leavens93,
  Author =	 "Tim Wahls and Albert L. Baker and Gary T. Leavens",
  Title =	 "An Executable Semantics for a Formalized Data Flow
                  Diagram Specification Language",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Year =	 1993,
  Number =	 "93-27",
  Address =	 "226 Atanasoff Hall, Ames, Iowa 50011",
  Month =	 nov,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR93-27/TR.ps.Z",
  Note =	 "Available by anonymous ftp from
                  \url{ftp.cs.iastate.edu} or by e-mail from
                  almanac@cs.iastate.edu.",
  Annote =	 "21 references."
}

@TechReport{Wahls-Baker-Leavens94,
  Author =	 "Tim Wahls and Albert L. Baker and Gary T. Leavens",
  Title =	 "The Direct Execution of {SPECS-C++}: A Model-Based Specification Language for {C++} Classes",
  Institution =	 "Department of Computer Science, Iowa State University",
  Year =	 1994,
  Number =	 "94-02b",
  Address =	 "226 Atanasoff Hall, Ames, Iowa 50011",
  Month =	 mar,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR94-02/TR.ps.Z",
  Annote =	 "36 references."
}

@Article{Wahls-Leavens-Baker00,
  author =	 "Tim Wahls and Gary T. Leavens and Albert L. Baker",
  title =	 "Executing Formal Specifications with Concurrent Constraint Programming",
  journal =	 "Automated Software Engineering",
  volume =	 7,
  number =	 4,
  month =	 dec,
  pages =	 "315-343",
  year =	 2000,
  URL =          "http://dx.doi.org/10.1023/A:1026554217992"
}

@TechReport{Wahls-Leavens-Baker00a,
  Author =	 "Tim Wahls and Gary T. Leavens and Albert L. Baker",
  Title =	 "Executing Formal Specifications with Constraint Programming",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Year =	 2000,
  Number =	 "97-12c",
  Address =	 "226 Atanasoff Hall, Ames, Iowa 50011",
  Month =	 jul,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR97-12/TR.ps.gz",
  Note =	 "To appear in {\em Automated Software Engineering},
                  volume 7, number 4, pp 315--343, December 2000."
}

@TechReport{Wahls-Leavens00,
  Author =	 "Tim Wahls and Gary T. Leavens",
  Title =	 "Formal Semantics and Soundness of an Algorithm for
                  Translating Model-based Specifications to Concurrent
                  Constraint Programs",
  Institution =	 "Department of Computer Science, Iowa State
                  University",
  Year =	 2000,
  Number =	 "00-02a",
  Address =	 "226 Atanasoff Hall, Ames, Iowa 50011",
  Month =	 aug,
  URL =
                  "ftp://ftp.cs.iastate.edu/pub/techreports/TR00-02/TR.ps.gz",
  Note =	 "Available by anonymous ftp from
                  \url{ftp.cs.iastate.edu} or by e-mail from
                  almanac@cs.iastate.edu."
}

@InProceedings{Wahls-Leavens01,
  Author =	 "Tim Wahls and Gary T. Leavens",
  Title =	 "Formal Semantics of an Algorithm for Translating
                  Model-based Specifications to Concurrent Constraint
                  Programs",
  booktitle =	 {Proceedings of the 16th ACM Symposium on Applied
                  Computing, Las Vegas, Nevada},
  pages =	 {567-575},
  year =	 2001,
  month =	 mar,
  organization = ACM,
  URL =          {http://doi.acm.org/10.1145/372202.372465}
}

@Article{Wakid-Kuhn-Wallace99,
  author =	 {Shukri A. Wakid and D. Richard Kuhn and Delores
                  R. Wallace},
  title =	 {Towards Credible IT Testing and Certification},
  journal =	 {IEEE Software},
  year =	 1999,
  volume =	 16,
  number =	 4,
  month =	 jul,
  pages =	 {39-47},
  annote =	 {7 references.}
}

@Book{Walden-Nerson95,
  Author =	 {Kim Walden and Jean-Marc Nerson},
  Title =	 {Seamless Object-Oriented Software Architecture,
                  Analysis and Design of Reliable Systems},
  Publisher =	 {Prentice Hall},
  Series =	 {The Object-Oriented Series},
  Year =	 {1995},
  Annote =	 {BON notation and method}
}

@article{Walicki-Broy95,
    author = "Micha{\l} Walicki and Manfred Broy",
    title = "Structured Specifications and Implementation of Nondeterministic
             Data Types",
    journal = "Nordic Journal of Computing",
    volume = 2,
    number = 3,
    month = "Fall",
    pages = "358-395",
    year = 1995
}

@Article{Walicki-Meldal97,
  author =	 {Micha{\l} Walicki and Sigurd Meldal},
  title =	 {Algebraic Approaches to Nondeterminism: An Overview},
  journal =	 ACMCS,
  year =	 1997,
  volume =	 29,
  number =	 1,
  month =	 mar,
  pages =	 {30-81},
  annote =	 {Many references.}
}

@InProceedings{Wampler06,
	Author 		= {Dean Wampler},
	Title 		= {{Contract4J} for Design by Contract in {Java}: Design Pattern-Like Protocols and Aspect Interfaces},
	Editor 		= {Yvonne Coady and David H. Lorenz and Olaf Spinczyk and Eric Wohlstadter},
	Booktitle = {Proceedings of the Fifth {AOSD} Workshop on Aspects, Components, and Patterns for Infrastructure Software},
	Publisher = {Published as University of Virginia Computer Science Technical Report \mbox{CS--2006--01}},
  Year 			= {2006},
  Pages 		= {27--30},
  Annote		= {13 References}
}

@Article{Wand79,
  Author =	 "Mitchell Wand",
  Title =	 "Final Algebra Semantics and Data Type Extensions",
  Journal =	 JCSS,
  Volume =	 19,
  Number =	 1,
  Month =	 aug,
  Year =	 1979,
  Pages =	 "27-44",
  URL = {http://dx.doi.org/10.1016/0022-0000(79)90011-4},
  Annote =	 "Final algebras in a category of extensions of some
                  base type. 24 references."
}

@InProceedings{Wang-etal06,
author="Chao Wang and Zijiang Yang and Franjo Ivan{\v{c}}i{\'{c}} and Aarti Gupta",
editor="Susanne Graf and Wenhui Zhang",
title="Whodunit? Causal Analysis for Counterexamples",
booktitle="Automated Technology for Verification and Analysis",
year="2006",
publisher="Springer",
address="Berlin, Heidelberg",
pages="82--95",
abstract="Although the counterexample returned by a model checker can help in reproducing the symptom related to a defect, a significant amount of effort is often required for the programmer to interpret it in order to locate the cause. In this paper, we provide an automated procedure to zoom in to potential software defects by analyzing a single concrete counterexample. Our analysis relies on extracting from the counterexample a syntactic-level proof of infeasibility, i.e., a minimal set of word-level predicates that contradict with each other. The procedure uses an efficient weakest pre-condition algorithm carried out on a single concrete execution path, which is significantly more scalable than other model checking based approaches. Unlike most of the existing methods, we do not need additional execution traces other than the buggy one. We use public-domain examples to demonstrate the effectiveness of our new algorithm.",
isbn="978-3-540-47238-4",
annote="26 references."
}

@Article{Wang-Musser97,
  Author =	 "Changqing Wang and David R. Musser",
  title =	 "Dynamic Verification of {C++} Generic Algorithms",
  journal =	 IEEETSE,
  pages =	 "314-323",
  month =	 may,
  year =	 1997,
  volume =	 23,
  number =	 5,
  annote =	 "32 references."
}

@Article{Ward-Fayad-Laitinen01,
  author = 	 {Robert P. Ward and Mohamed E. Fayad and Mauri Laitinen},
  title = 	 {Software process Improvement in the Small},
  journal = 	 CACM,
  year = 	 2001,
  volume =	 44,
  number =	 4,
  pages =	 {105-107},
  month =	 apr,
  annote =       "How processes should match a development's circumstances."
}

@Book{Ward-Mellor85a,
  Author =	 "Paul T. Ward and Stephen J. Mellor",
  Title =	 "Structured Development for Real-Time Systems",
  Publisher =	 "Yourdon, Inc.",
  Year =	 1985,
  Volume =	 "1: Introduction and Tools",
  Address =	 "Englewood Cliffs, New Jersey"
}

@Book{Ward-Mellor85b,
  Author =	 "Paul T. Ward and Stephen J. Mellor",
  Title =	 "Structured Development for Real-Time Systems",
  Publisher =	 "Yourdon, Inc.",
  Year =	 1985,
  Volume =	 "volume 2: Essential Modeling Techniques",
  Address =	 "Englewood Cliffs, New Jersey"
}

@Book{Ward-Mellor86,
  Author =	 "Paul T. Ward and Stephen J. Mellor",
  Title =	 "Structured Development for Real-Time Systems",
  Publisher =	 "Yourdon, Inc.",
  Year =	 1986,
  Volume =	 "volume 3: Implementation Modeling Techniques",
  Address =	 "Englewood Cliffs, New Jersey"
}

@Article{Ward86,
  Author =	 "Paul T. Ward",
  Title =	 "The Transformation Schema: An Extension of the Data
                  Flow Diagram to Represent Control and Timing",
  Journal =	 IEEETSE,
  Year =	 "1986",
  Volume =	 "SE-12",
  Number =	 2,
  Month =	 feb,
  Pages =	 "198-210",
  Annote =	 "11 references."
}

@InCollection{Ward92,
  Author =	 "S.A. Ward",
  Title =	 "An Approach to Real Time Computation",
  BookTitle =	 "Real-Time Systems: Abstractions, Languages, and
                  Design Methodologies",
  Publisher =	 "IEEE Computer Society Press",
  Year =	 1992,
  Editor =	 "Krishna M. Kavi",
  Pages =	 "430-438",
  Address =	 "Los Alamitos, California",
  Month =	 oct,
  Annote =	 "27 references."
}

@InCollection{Ward93,
  Author =	 "Nigel Ward",
  Title =	 "Adding Specification Constructors to the Refinement
                  Calculus",
  BookTitle =	 "Industrial-Strength Formal Methods, First
                  International Symposium of Formal Methods Europe,
                  Odense, Denmark",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "J.C.P. Woodcock and P.G. Larsen",
  Series =	 LNCS,
  Volume =	 670,
  Pages =	 "652-670",
  Address =	 NY,
  Month =	 apr,
  Annote =	 "12 references."
}

@Book{Warmer-Kleppe99,
  author =	 {Jos Warmer and Anneke Kleppe},
  title =	 {The Object Constraint Language: Precise Modeling
                  with UML},
  publisher =	 {Addison Wesley Longman},
  year =	 1999,
  address =	 {Reading, Mass.},
  annote =	 {The OCL. 18 references.}
}

@Article{Warmer-Kleppe99b,
  author =	 {Jos Warmer and Anneke Kleppe},
  title =	 {{OCL}: The Constraint Language of the {UML}},
  journal =	 JOOP,
  year =	 1999,
  volume =	 12,
  number =	 1,
  month =	 mar,
  pages =	 {10-13,28},
  annote =	 {3 references.}
}

@Article{Wasserman-Pircher90,
  Author =	 "Anthony J. Wasserman and Peter A. Pircher",
  Title =	 "The object-oriented structured design notation for
                  software design representation",
  Journal =	 "Computer",
  Year =	 1990,
  Volume =	 23,
  Number =	 3,
  Month =	 mar,
  Pages =	 "50-63"
}

@Article{Waters82,
  Author =	 "R. C. Waters",
  Title =	 "The Programmer's Apprentice: Knowledge Based Program
                  Editing",
  Journal =	 IEEETSE,
  Year =	 1981 ,
  Month =	 jan,
  Volume =	 "SE-1",
  Number =	 1,
  Pages =	 "1-12"
}

@InProceedings{Webber01,
  author =       "Adam Brooks Webber",
  title =        "What Is a Class Invariant",
  editor =       "{ACM}",
  booktitle =    "{ACM} {SIGPLAN} -- {SIGSOFT} Workshop on Program
                 Analysis for Software Tools and Engineering: {PASTE}'01",
  publisher =    "ACM Press",
  address =      NY,
  pages =        "86-89",
  year =         "2001",
  annote =       "13 references."
}

@Article{Wegbreit76,
  Author =	 "B. Wegbreit",
  Title =	 "Goal-Directed Program Transformation",
  Journal =	 IEEETSE,
  Year =	 1976,
  Month =	 jun,
  Volume =	 2,
  Number =	 2,
  Pages =	 "69-80"
}

@Article{Wegbreit77,
  Author =	 "Ben Wegbreit",
  Title =	 "Constructive Methods in Program Verification",
  Journal =	 IEEETSE,
  Year =	 1977,
  Volume =	 "SE-3",
  Number =	 3,
  Month =	 may,
  Pages =	 "193-209",
  Annote =	 "17 references."
}

@Book{Wegner80,
  Editor =	 "Peter Wegner",
  Title =	 "Research Directions in Software Technology",
  Publisher =	 MITP,
  Address =	 "Cambridge, Mass.",
  Year =	 1980
}

@Article{Wegner92,
  Author =	 "Peter Wegner",
  Title =	 "Dimensions of Object-Oriented Modeling",
  Journal =	 "Computer",
  Year =	 1992,
  Volume =	 25,
  Number =	 10,
  Month =	 oct,
  Pages =	 "12-20",
  Annote =	 "10 references."
}

@InProceedings{Wehrheim99,
  author =       "Heike Wehrheim",
  title =        "Data Abstraction for {CSP-OZ}",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  BookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1709,
  pages =        "1028-1047",
  annote =       "CSP-OZ combines Object-Z and CSP.  24 references.",
}

@inproceedings{Wei-etal10,
author = {Yi Wei and Yu Pei and Carlo A. Furia and Lucas S. Silva and Stefan Buchholz and Bertrand Meyer and Andreas Zeller},
title = {Automated Fixing of Programs with Contracts},
year = 2010,
isbn = 9781605588230,
publisher = ACM,
address = NY,
url = {https://doi.org/10.1145/1831708.1831716},
doi = {10.1145/1831708.1831716},
abstract = {In program debugging, finding a failing run is only the first step; what about correcting the fault? Can we automate the second task as well as the first? The AutoFix-E tool automatically generates and validates fixes for software faults. The key insights behind AutoFix-E are to rely on contracts present in the software to ensure that the proposed fixes are semantically sound, and on state diagrams using an abstract notion of state based on the boolean queries of a class. Out of 42 faults found by an automatic testing tool in two widely used Eiffel libraries, AutoFix-E proposes successful fixes for 16 faults. Submitting some of these faults to experts shows that several of the proposed fixes are identical or close to fixes proposed by humans.},
booktitle = {Proceedings of the 19th International Symposium on Software Testing and Analysis},
pages = {61–72},
numpages = 12,
keywords = {program synthesis, automatic fixing, dynamic invariants, automatic debugging},
location = {Trento, Italy},
series = {ISSTA '10},
annote="26 references."
}

@TechReport{Weide-Heym-Hollingsworth94,
  author =	 "Bruce W. Weide and Wayne D. Heym and Joseph
                  E. Hollingsworth",
  title =	 "Reverse Engineering of Legacy Code is Intractable",
  institution =	 "Dept. of Computer and Information Science, The Ohio
                  State University",
  year =	 1994,
  number =	 "OSU-CISRC-10/94-TR55",
  address =	 "Columbus, Ohio",
  month =	 oct,
  note =	 "Available from
                  \url{ftp://ftp.cis.ohio-state.edu/pub/tech-report/1994/TR55.ps.gz}"
}


@InProceedings{Weide-Ogden-Sitaraman03,
  author =	 {Bruce W. Weide and William F. Ogden and Murali
                  Sitaraman},
  title =	 {Expressiveness Issues in Compositional Performance
                  Reasoning},
  booktitle =	 {Proceedings 6th ICSE Workshop on Component-Based
                  Software Engineering},
  year =	 2003,
  editor =	 {Ivica Crnkovic and Heinz Schmidt and Judith Stafford
                  and Kurt Wallnau},
  URL =
                  {http://www.csse.monash.edu.au/~hws/cgi-bin/CBSE6/Proceedings/papersfinal/p4.pdf}
}

@Article{Weide-Ogden-Sitaraman94,
  author =	 {Bruce W. Weide and William F. Ogden and Murali
                  Sitaraman},
  title =	 {Recasting Algorithms to Encourage Reuse},
  journal =	 {IEEE Software},
  year =	 1994,
  volume =	 11,
  number =	 5,
  month =	 sep,
  pages =	 {80-88},
  annote =	 {8 references.}
}

@InCollection{Weide-Ogden-Zeben91,
  author =	 {B. W. Weide and W. F. Ogden and S. H. Zeben},
  title =	 {Reusable Software Components},
  booktitle =	 {Advances in Computers},
  publisher =	 {Academic Press},
  year =	 1991,
  editor =	 {M. Yovits},
  volume =	 33,
  pages =	 {1-65}
}

@InProceedings{Weide-etal08,
  author = 	 {Bruce W. Weide and Murali Sitaraman and Heather K. Harton and Bruce Adcock
    and Paolo Bucci and Derek Bronish and Wayne D. Heym and Jason Kirschenbaum
    and David Frazier},
  title = 	 {Incremental Benchmarks for Software Verification Tools and Technique},
  booktitle =    {Verified Software: Theories, Tools, Experiments (VSTTE)},
  pages = 	 {84-98},
  year = 	 2008,
  volume = 	 5925,
  series = 	 LNCS,
  address = 	 {Berlin},
  publisher =    SV,
  URL = 	 {http://dx.doi.org/10.1007/978-3-540-87873-5_10}
}

@Article{Weide-etal94,
  author =	 {Bruce W. Weide and Stephen H. Edwards and Douglas
                  E. Harms and David Alex Lamb},
  title =	 {Design and Specification of Iterators Using the
                  Swapping Paradigm},
  journal =	 IEEETSE,
  year =	 1994,
  volume =	 20,
  number =	 8,
  month =	 aug,
  pages =	 {631-643},
  annote =	 {Iterators in RESOLVE. 20 references.}
}

@InProceedings{Weihe97,
  author =	 {Karsten Weihe},
  title =	 {Reuse of Algorithms: Still a Challenge to
                  Object-Oriented Programming},
  BookTitle =	 "Conference Proceedings of OOPSLA '97, Atlanta",
  Series =	 SIGPLAN,
  Volume =	 "32(10)",
  Month =	 oct,
  Year =	 1997,
  organization = ACM,
  pages =	 {34-48},
  annote =	 {39 references.}
}

@Book{Weinberg98,
  author =	 {Gerald M. Weinberg},
  title =	 {The Psychology of Computer Programming : Silver
                  Anniversary Edition},
  publisher =	 {Dorset House},
  year =	 1998,
  address =	 NY
}

@Article{Weinberg99,
  author =	 {Gerald M. Weinberg},
  title =	 {Egoless Programming},
  journal =	 {IEEE Software},
  year =	 1999,
  volume =	 16,
  number =	 1,
  month =	 jan,
  pages =	 {118-120},
  note =	 {Reprinted from {\em The Psychology of Computer
                  Programming}, (Dorset House, 1998), chapter 4.},
  annote =	 {1 reference.}
}

@Book{Weisfeld-McCarty00,
  Author =	 "Matt Weisfeld and Bill McCarty",
  Title =	 "The Object-Oriented Thought Process",
  Publisher =	 "Sams",
  Year =	 2000
}

@Book{Weisfeld04,
  Author =	 "Matt Weisfeld",
  Title =	 "The Object-Oriented Thought Process",
  Publisher =	 "Sams",
  Edition =      "Second edition",
  Year =	 2004
}

@Book{Weiss91,
  Author =	 "Edmond H. Weiss",
  Title =	 "How to Write Usable User Documentation",
  Publisher =	 "Oryx Press",
  Year =	 1991,
  Edition =	 "Second",
  Annote =	 "Categorized list of 21 references."
}

@Article{Welch-Strong98,
  author =	 {David Welch and Scott Strong},
  title =	 {An Exception-Based Assertion Mechanism for {C++}},
  journal =	 JOOP,
  year =	 1998,
  volume =	 11,
  number =	 4,
  month =	 jul,
  pages =	 {50-60},
  annote =	 {1 reference.}
}

@inproceedings{Westbrook-Stump-Wehrman05,
  author="E. Westbrook and A. Stump and I. Wehrman",
  title={A Language-based Approach to Functionally Correct Imperative Programming},
  booktitle="Proceedings of the 10th International Conference on Functional Programming (ICFP05)",
  location="Tallinn, Estonia",
  year=2005
}

@Article{Weyuker-Vokolos00,
  author =	 {Elaine J. Weyuker and F. I. Vokolos},
  title =	 {Experience with Performance Testing of Software
                  Systems: Issues, An Approach, and Case Study},
  journal =	 IEEETSE,
  year =	 2000,
  volume =	 26,
  number =	 {11/12},
  pages =	 {1147-1156},
  month =	 nov
}

@article{Weyuker82,
    author = {Elaine J. Weyuker},
    title = "{On Testing Non-Testable Programs}",
    journal = {The Computer Journal},
    volume = 25,
    number = 4,
    pages = {465-470},
    year = 1982,
    month = 11,
    abstract = "{A frequently invoked assumption in program testing is that there is an oracle (i.e. the tester or an external mechanism can accurately decide whether or not the output produced by a program is correct). A program is non-testable if either an oracle does not exist or the tester must expend some extraordinary amount of time to determine whether or not the output is correct. The reasonableness of the oracle assumption is examined and the conclusion is reached that in many cases this is not a realistic assumption. The consequences of assuming the availability of an oracle are examined and alternatives investigated.}",
    issn = {0010-4620},
    doi = {10.1093/comjnl/25.4.465},
    url = {https://doi.org/10.1093/comjnl/25.4.465},
    eprint = {https://academic.oup.com/comjnl/article-pdf/25/4/465/1045637/25-4-465.pdf},
}

@Article{Weyuker98,
  author =	 {Elaine J. Weyuker},
  title =	 {Testing Component-Based Software: A Cautionary Tale},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 5,
  month =	 sep,
  pages =	 {54-59},
  annote =	 {Need specification, test suite, and links between
                  them for components. 7 references.}
}

@Article{Wiener98,
  author =	 {Richard Wiener},
  title =	 {Watch Your Language!},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 3,
  month =	 may,
  pages =	 {55-56},
  annote =	 {A reply to a paper by Hatton, claiming that C++ is
                  not a representative OO language. No references.}
}

@Book{Wieringa03,
  author =	 {R. J. Wieringa},
  title = 	 {Design Methods for Reactive Systems: Yourdon, Statemate, and the UML},
  publisher = 	 {Morgan Kaufmann Publishers},
  year = 	 2003,
  annote =	 {Many references.}
}

@InCollection{Wieringa91,
  Author =	 "R. J. Wieringa",
  Title =	 "A formalization of objects using equational dynamic
                  logic",
  BookTitle =	 "Deductive and object-Oriented Databases",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "C. Delobel and M. Kifer and Y. Masanaga",
  Series =	 LNCS,
  Volume =	 566,
  Pages =	 "431-452",
  Address =	 NY,
  Annote =	 "51 references."
}

@Article{Wieringa98,
  author =	 {Roel Wieringa},
  title =	 {A Survey of Structured and Object-Oriented Software
                  Specification Methods and Techniques},
  journal =	 ACMCS,
  year =	 1998,
  volume =	 30,
  number =	 4,
  month =	 dec,
  pages =	 {459-527},
  URL =          {http://doi.acm.org/10.1145/299917.299919},
  annote =	 {Many references.}
}

@Article{Wilde-Huitt92,
  Author =	 "Norman Wilde and Ross Huitt",
  Title =	 "Maintenance Support for Object-Oriented Programs",
  Journal =	 IEEETSE,
  Volume =	 18,
  Number =	 12,
  Month =	 dec,
  Year =	 1992,
  Pages =	 "1038-1044",
  Annote =	 "32 references."
}

@Book{Wilkie93,
  Author =	 "George Wilkie",
  Title =	 "Object-Oriented Software Engineering",
  Publisher =	 "Addison-Wesley",
  Year =	 1993,
  Address =	 "Reading, Mass.",
  Annote =	 "77 references."
}

@Article{Williams94,
  Author =	 "Lloyd Williams",
  Title =	 "Assessmant of Safety-Critical Specifications",
  Journal =	 "IEEE Software",
  Volume =	 11,
  Number =	 1,
  Year =	 1994,
  Month =	 jan,
  Pages =	 "51-60",
  Annote =	 "10 references."
}

@InCollection{Wills91,
  Author =	 "Alan Wills",
  Title =	 "Capsules and Types in {Fresco}: Program Validation
                  in {Smalltalk}",
  BookTitle =	 "ECOOP '91: European Conference on Object Oriented
                  Programming",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "P. America",
  Series =	 LNCS,
  Volume =	 512,
  Pages =	 "59-76",
  URL = {http://dx.doi.org/10.1007/BFb0057015},
  Address =	 NY
}

@InCollection{Wills92b,
  Author =	 "Alan Wills",
  Title =	 "Specification in {Fresco}",
  BookTitle =	 "Object Orientation in {Z}",
  Editor =	 "Susan Stepney and Rosalind Barden and David Cooper",
  Publisher =	 SV,
  Year =	 1992,
  Address =	 "Cambridge CB2 1LQ, UK",
  Series =	 "Workshops in Computing",
  Chapter =	 11,
  Crossref =	 "Stepney-Barden-Cooper92",
  Pages =	 "127-135",
  Annote =	 "64 references."
}

@InCollection{Wills94,
  Author =	 "Alan Wills",
  Title =	 "Refinement in {Fresco}",
  BookTitle =	 "Object-Oriented Specification Case Studies",
  Chapter =	 "9",
  Publisher =	 "Prentice-Hall",
  Year =	 1994,
  Editor =	 "Kevin Lano and Howard Houghton",
  Crossref =	 "Lano-Haughton94",
  Pages =	 "184-201",
  Address =	 "Englewood Cliffs, NJ"
}

@InProceedings{Wilson-Maharaj-Clark05,
  author = "Thomas Wilson and Savi Maharaj and Robert G. Clark",
  title = "Omnibus Verification Policies: A flexible, configurable
                  approach to assertion-based software verification",
  booktitle = "Third IEEE International Conference on Software
                  Engineering and Formal Methods (SEFM)",
  editor = "Bernhard K. Aichernig and Bernhard Beckert",
  month = sep,
  year = 2005,
  pages = "150-159",
  URL = {http://doi.ieeecomputersociety.org/10.1109/SEFM.2005.29},
  publisher = "IEEE Computer Society"
}

@Book{Winblad-Edwards-King90,
  Author =	 "Ann L. Winblad and Samuel D. Edwards and David
                  R. King",
  Title =	 "Object-Oriented Software",
  Publisher =	 Addison-Wesley,
  Address =	 "Reading, Mass.",
  Year =	 1990,
  Annote =	 "82 references."
}

@Article{Wing-Gong90,
  Author =	 "Jeannette M. Wing and Chun Gong",
  Title =	 "Experience with the {Larch Prover}",
  Journal =	 SIGSOFT,
  Year =	 1990,
  Volume =	 15,
  Number =	 4,
  Month =	 sep,
  Pages =	 "140-143",
  Note =	 "Proceedings of the ACM SIGSOFT: International
                  Workshop on Formal Methods in Software Development,
                  Mark Moriconi (editor).",
  Annote =	 "18 references."
}

@InCollection{Wing-Ockerbloom00,
  Author =	 "Jeannette M. Wing and John Ockerbloom",
  Title =	 "Respectful Type Converters for Mutable Types",
  BookTitle =	 {Foundations of Component-Based Systems},
  Editor =	 {Gary T. Leavens and Murali Sitaraman},
  Year =	 2000,
  Publisher =	 {Cambridge University Press},
  Address =	 NY,
  ISBN =	 {0-521-77164-1},
  Chapter =	 8,
  Pages =	 "161-186",
  Annote =	 "11 references."
}

@InCollection{Wing-Rollins-Zaremski92,
  Author =	 "J. M. Wing and E. Rollins and A. M. Zaremski",
  Title =	 "Thoughts on a Larch/ML and a new Application for LP",
  Editor =	 "Ursala Martin and Jeannette M. Wing",
  BookTitle =	 "First International Workshop on Larch, Dedham 1992",
  Publisher =	 SV,
  Year =	 1992,
  Pages =	 "297-312",
  Annote =	 "14 references"
}

@InCollection{Wing-Rollins-Zaremski93,
  Author =	 "Jeannette M. Wing and Eugene Rollins and Amy
                  Moormann Zaremski",
  Title =	 "Thoughts on a Larch/{ML} and a New Application for
                  {LP}",
  BookTitle =	 "Proceedings of the First International Workshop on
                  Larch, July, 1992",
  Publisher =	 SV,
  Editor =	 "U. Martin and J. Wing",
  Series =	 "Workshops in Computing",
  Pages =	 "297-312",
  Address =	 NY,
  Year =	 1993,
  Note =	 "Also Technical Report CMU/CS-92-135, Carnegie Mellon
                  University, School of Computer Science, May 1992.",
  Annote =	 "14 references."
}

@InCollection{Wing-Zaremski91,
  Author =	 "Jeannette M. Wing and Amy Moormann Zaremski",
  Title =	 "Unintrusive Ways to Integrate Formal Specifications
                  in Practice",
  BookTitle =	 "VDM '91 Formal Software Development Methods 4th
                  International Symposium of VDM Europe
                  Noordwijkerhout, The Netherlands, Volume 1:
                  Conference Contributions",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "S. Prehn and W. J. Toetenel",
  Series =	 LNCS,
  Volume =	 551,
  Pages =	 "545-569",
  Address =	 NY,
  Month =	 oct,
  Annote =	 "28 references."
}

@TechReport{Wing83,
  Author =	 "Jeannette Marie Wing",
  Title =	 "A Two-Tiered Approach to Specifying Programs",
  Institution =	 MITLCS,
  Number =	 "TR-299",
  Year =	 1983,
  Annote =	 "Semantics of two-tiered approach, design of a CLU
                  interface language, framework for reasoning about
                  two-tiered specifications, and ways of exploiting
                  the framework for specification evaluation. 84
                  references."
}

@Article{Wing87,
  Author =	 "Jeannette M. Wing",
  Title =	 "Writing {Larch} Interface Language Specifications",
  Journal =	 TOPLAS,
  Month =	 jan,
  Year =	 1987,
  Volume =	 9,
  Number =	 1,
  Pages =	 "1-24",
  URL = {http://doi.acm.org/10.1145/9758.10500},
  Annote =	 "Describes Larch interface specifications for
                  CLU. Description of the two-tiered approach. 56
                  references."
}

@InProceedings{Wing88,
  Author =	 "Jeannette M. Wing",
  Title =	 "Specifying Recoverable Objects",
  BookTitle =	 "Proceedings of the Sixth Annual Pacific Northwest
                  Software Quality Conference, Portland, OR",
  Month =	 sep,
  Year =	 1988,
  Note =	 "CMU-CS-88-170",
  Annote =	 "10 references."
}

@InCollection{Wing89a,
  Author =	 "J. M. Wing",
  Title =	 "Verifying Atomic Data Types",
  BookTitle =	 "Stepwise Refinement of Distributed Systems, Models,
                  Formalisms, Correctness, REX Workshop, Mook, The
                  Netherlands",
  Month =	 "May/June",
  Year =	 1989,
  Publisher =	 "Spring-Verlag",
  Series =	 LNCS,
  Volume =	 430,
  Editor =	 "J. W. de Bakker and W.-P. de Roever and
                  G. Rozenberg",
  Pages =	 "731-758"
}

@TechReport{Wing89b,
  Author =	 "Jeannette M. Wing",
  Title =	 "What is a Formal Method?",
  Institution =	 CMU,
  Number =	 "CMU-CS-89-200",
  Month =	 nov,
  Year =	 1989,
  Annote =	 "Survey of Formal methods with some examples. 76
                  references."
}

@Article{Wing90a,
  Author =	 "Jeannette M. Wing",
  Title =	 "A Specifier's Introduction to Formal Methods",
  Journal =	 "Computer",
  Volume =	 23,
  Number =	 9,
  Month =	 sep,
  Year =	 1990,
  Pages =	 "8-24",
  URL = {http://doi.ieeecomputersociety.org/10.1109/2.58215},
  Annote =	 "Survey with categorized references on formal methods
                  and specification languages."
}

@Article{Wing90b,
  Author =	 "Jeannette M. Wing",
  Title =	 "Using {Larch} to Specify {Avalon/C++} Objects",
  Journal =	 IEEETSE,
  Volume =	 16,
  Number =	 9,
  Month =	 sep,
  Year =	 1990,
  Pages =	 "1076-1088",
  Annote =	 "29 references."
}

@TechReport{Wing95,
  author =	 "Jeannette M. Wing",
  title =	 "Hints to Specifiers",
  institution =	 "School of Computer Science Carnegie Mellon
                  University",
  year =	 1995,
  number =	 "CMU-CS-95-118R",
  address =	 "Pittsburgh, PA 15213",
  month =	 may,
  annote =	 "19 references."
}

@article{Winkler-Kauer97,
  author =	 {Jurgen F.H. Winkler and Stefan Kauer},
  title =	 {Proving Assertions Is Also Useful},
  journal =	 SIGPLAN,
  year =	 {1997},
  month =	 mar,
  volume =	 {32},
  number =	 {3},
  pages =	 {38--41},
  annote =	 {refer to Rosenblum95, Martin96}
}

@Article{Wirfs-Brock-Johnson90,
  Author =	 "Rebecca J. Wirfs-Brock and Ralph E. Johnson",
  Title =	 "Surveying Current Research in Object-Oriented
                  Design",
  Journal =	 CACM,
  Year =	 1990,
  Volume =	 33,
  Number =	 9,
  Month =	 sep,
  Pages =	 "105-124",
  Annote =	 "61 references."
}

@Book{Wirfs-Brock-Wilkerson-Wiener90,
  Author =	 "Rebecca Wirfs-Brock and Brian Wilkerson and Lauren
                  Wiener",
  Title =	 "Designing Object-Oriented Software",
  Publisher =	 "Prentice-Hall",
  Year =	 1990,
  Address =	 "Englewood Cliffs, NJ 07632",
  Annote =	 "Model of responsibility-driven design. Hierarchy and
                  collaborations graphs. No references."
}

@Article{Wirfs-Brock-Wilkerson89,
  Author =	 "Rebecca Wirfs-Brock and Brian Wilkerson",
  Title =	 "Object-Oriented Design: A Responsibility-Driven
                  Approach",
  Journal =	 SIGPLAN,
  Volume =	 24,
  Number =	 10,
  Month =	 oct,
  Year =	 1989,
  Pages =	 "71-75",
  Note =	 "OOPSLA '89 Conference Proceedings, Norman Meyerowitz
                  (editor), October 1989, New Orleans, Louisiana.",
  Annote =	 "Distinguishes data-driven design from
                  responsibility-driven design. 13 references."
}

@InCollection{Wirsing-Broy82,
  Author =	 "Martin Wirsing and Manfred Broy",
  Title =	 "An Analysis of Semantic Models for Algebraic
                  Specifications",
  BookTitle =	 "Theoretical Foundations of Programming Methodology:
                  Lecture Notes of an International Summer School
                  directed by F. L. Bauer, E. W. Dijkstra and
                  C. A. R. Hoare",
  Editor =	 "Manfred Broy and Gunther Schmidt",
  Year =	 1982,
  Publisher =	 "D. Ridel",
  Address =	 "Dordrecht, Holland",
  Pages =	 "351-412",
  Series =	 "C",
  Volume =	 91,
  Annote =	 "44 references."
}

@Article{Wirsing-etal83,
  Author =	 "Martin Wirsing and Peter Pepper and Helmut Partsch
                  and Walter Dosch and Manfred Broy",
  Title =	 "On Hierarchies of Abstract Data Types",
  Journal =	 "Acta Informatica",
  Volume =	 20,
  Number =	 1,
  Month =	 oct,
  Year =	 1983,
  Pages =	 "1-33",
  Annote =	 "43 references."
}

@InCollection{Wirsing90,
  Author =	 "Martin Wirsing",
  Booktitle =	 "Handbook of Theoretical Computer Science",
  Title =	 "Algebraic Specification",
  Chapter =	 13,
  Publisher =	 MITP,
  Year =	 1990,
  Editor =	 "J. van Leewen",
  Pages =	 "675-788",
  Volume =	 "B: Formal Models and Semantics",
  Address =	 NY,
  Annote =	 "186 references."
}

@Article{Wirth71b,
  Author =	 "Wirth, N.",
  Title =	 "Program Development by Stepwise Refinement",
  Journal =	 CACM,
  Year =	 1971,
  Month =	 apr,
  Volume =	 14,
  Number =	 4,
  Pages =	 "221-227"
}

@Book{Wirth73,
  Author =	 "Niklaus Wirth",
  Title =	 "Systematic Programming: An Introduction",
  Publisher =	 "Prentice-Hall",
  Year =	 1973,
  Series =	 "Series in Automatic Computation",
  Address =	 "Englewood Cliffs, NJ"
}

@Article{Wirth77b,
  Author =	 "N. Wirth",
  Title =	 "Algorithms + Data Structures = Programs",
  Journal =	 SPandE,
  Year =	 1977,
  Volume =	 7,
  Number =	 1
}

@InProceedings{Wolf-etal21,
author="Felix A. Wolf and Linard Arquint and Martin Clochard and Wytse Oortwijn and Jo{\~a}o C. Pereira and Peter M{\"u}ller",
editor="Alexandra Silva and K. Rustan M. Leino",
title="Gobra: Modular Specification and Verification of {Go} Programs",
booktitle="Computer Aided Verification",
year="2021",
publisher="Springer International Publishing",
address="Cham",
pages="367--379",
abstract="Go is an increasingly-popular systems programming language targeting, especially, concurrent and distributed systems. Go differentiates itself from other imperative languages by offering structural subtyping and lightweight concurrency through goroutines with message-passing communication. This combination of features poses interesting challenges for static verification, most prominently the combination of a mutable heap and advanced concurrency primitives.",
isbn="978-3-030-81685-8"
}

@article{Wolff-etal21,
author = {Fabian Wolff and Aurel B\'{\i}l\'{y} and Christoph Matheja and Peter M\"{u}ller and Alexander J. Summers},
title = {Modular Specification and Verification of Closures in {Rust}},
year = {2021},
issue_date = {October 2021},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
volume = {5},
number = {OOPSLA},
url = {https://doi.org/10.1145/3485522},
abstract = {Closures are a language feature supported by many mainstream languages, combining
the ability to package up references to code blocks with the possibility of capturing
state from the environment of the closure's declaration. Closures are powerful, but
complicate understanding and formal reasoning, especially when closure invocations
may mutate objects reachable from the captured state or from closure arguments. This
paper presents a novel technique for the modular specification and verification of
closure-manipulating code in Rust. Our technique combines Rust's type system guarantees
and novel specification features to enable formal verification of rich functional
properties. It encodes higher-order concerns into a first-order logic, which enables
automation via SMT solvers. Our technique is implemented as an extension of the deductive
verifier Prusti, with which we have successfully verified many common idioms of closure
usage.},
journal = {Proc. ACM Program. Lang.},
month = oct,
articleno = {145},
numpages = {29},
keywords = {higher-order functions, closures, Rust, software verification}
}

% doi = {10.1145/3485522},
@InCollection{Wolter-etal95,
  author =	 {U. Wolter and K. Didrich and F. Cornelius and
                  M. Klar and R. Wess\"{a}ly and H. Ehrig},
  title =	 "How to cope with the Spectrum of {\sc Spectrum}",
  pages =	 "173-189",
  annote =	 "17 references.",
  editor =	 {Manfred Broy and Stefan J\"{a}hnichen},
  booktitle =	 "{KORSO}: Methods, Languages and Tools for the
                  Construction of Correct Software",
  Publisher =	 SV,
  address =	 NY,
  Series =	 LNCS,
  Volume =	 1009,
  Year =	 1995
}

@InProceedings{Wong96,
author={Kenny Wong}, 
booktitle={Fourth Workshop on Program Comprehension, 1996, Proceedings}, 
title={On inserting program understanding technology into the software change process}, 
year={1996}, 
month=mar, 
pages={90-99}, 
doi={http://dx.doi.org/10.1109/WPC.1996.501124}, 
ISSN={1092-8138},
annote = {20 references.}}

@Article{Woo-Dunlop-Wolf,
  Author =	 "Nam-Sung Woo and Alfred E. Dunlop and Wayne Wolf",
  Title =	 "Codesign from Cospecification",
  Journal =	 "Computer",
  Volume =	 27,
  Number =	 1,
  Month =	 jan,
  Year =	 1994,
  Pages =	 "42-48"
}

@Book{Woodcock-Davies96,
  author =	 "Jim Woodcock and Jim Davies",
  title =	 "Using {Z}: Specification, Refinement, and Proof",
  publisher =	 "Prentice Hall International Series in Computer
                  Science",
  url =		 "http://www.comlab.ox.ac.uk/usingz.html",
  ISBN =	 "0-13-948472-8",
  year =	 "1996",
  annote =	 "Provides an introduction to the world of logic, sets
                  and relations. It explains the use of the Z notation
                  in the specification of realistic systems. ",
}

@InCollection{Woodcock-Saaltink-Freitas09,
  author = {Jim Woodcock and Mark Saaltink and Leo Freitas},
  title = {Unifying Theories of Undefinedness},
  booktitle = {Summer School Marktoberdorf 2008: Engineering Methods
                  and Tools for Software Safety and Security},
  editorTBD = {},
  series = {NATO ASI Series F},
  publisher = {IOS Press},
  address = {Amsterdam},
  year = {2009},
  pagesTBD = {},
  note = {To appear}
}

@article{Woodcock89,
  Author =	 "J. C. P. Woodcock",
  Title =	 "Structuring Specifications in {Z}",
  Journal =	 "Software Engineering Journal",
  Volume =	 4,
  Number =	 1,
  Month =	 jan,
  Year =	 1989,
  Pages =	 "51-66",
  Annote =	 "Extended tutorial on Z's schema calculus."
}

@InCollection{Woodcock91,
  Author =	 "J. C. P. Woodcock",
  Title =	 "A Tutorial on the Refinement Calculus",
  BookTitle =	 "VDM '91 Formal Software Development Methods 4th
                  International Symposium of VDM Europe
                  Noordwijkerhout, The Netherlands, Volume 2:
                  Tutorials",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "S. Prehn and W. J. Toetenel",
  Series =	 LNCS,
  Volume =	 552,
  Pages =	 "79-140",
  Address =	 NY,
  Month =	 oct,
  Annote =	 "Part 1 is a tutorial on the refinement
                  calculus. Part 2 is an introduction to refinement in
                  Z. Part 3 is two refinement case studies."
}

@inproceedings{Woodside-Franks-Petriu07,
 author = {Murray Woodside and Greg Franks and Dorina C. Petriu},
 title = {The Future of Software Performance Engineering},
 booktitle = {FOSE '07: 2007 Future of Software Engineering},
 year = {2007},
 pages = {171-187},
 doi = {http://dx.doi.org/10.1109/FOSE.2007.32},
 publisher = {IEEE Computer Society},
 address = {Washington, DC, USA}
}
                  
@inproceedings{Wu-Kelly05,
 author = {Weihang Wu and Tim Kelly},
 title = {Failure modelling in software architecture design for safety},
 booktitle = {WADS '05: Proceedings of the 2005 workshop on Architecting dependable systems},
 year = {2005},
 pages = {1-7},
 location = {St. Louis, Missouri},
 doi = {http://doi.acm.org/10.1145/1083217.1083222},
 publisher = ACM,
 address = NY
}

@Book{Wulf-etal81,
  Author =	 "William A. Wulf and Mary Shaw and Paul N. Hilfinger
                  and Lawrence Flon",
  Title =	 "Fundamental Structures of Computer Science",
  Publisher =	 Addison-Wesley,
  Year =	 1981,
  Address =	 "Reading, Mass.",
  Annote =	 "56 references."
}

@inproceedings{Xie-Aiken05,
  author    = {Yichen Xie and Alexander Aiken},
  title     = {Scalable error detection using boolean satisfiability},
  booktitle = POPL,
  month     = jan,
  year      = 2005,
  pages     = {351-363},
  editor    = {Jens Palsberg and Mart\'{\i}n Abadi},
  URL = {http://doi.acm.org/10.1145/1040305.1040334},
  publisher = ACM
}

@InProceedings{Xie-Marinov-Notkin04,
  author = 	 {Tao Xie and Darko Marinov and David Notkin<},
  title = 	 {Rostra: A Framework for Detecting Redundant Object-Oriented Unit Tests},
  booktitle =	 {Proceedings of 19th Int. IEEE Conf. on Automated Sofware Engineering (ASE'04)},
  pages =	 {196-205},
  year =	 2004,
  organization = IEEE
}

@InProceedings{Xie-etal05,
    author = {Tao Xie and Darko Marinov and Wolfram Schulte and David Notkin},
    title = {Symstra: A Framework for Generating Object-Oriented Unit Tests using Symbolic Execution},
    booktitle = {Proceedings of the 11th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS 05)},
    year = 2005,
    pages = {365-381},
    month = apr,
    location = {Edinburgh, UK},
    url = {http://www.csc.ncsu.edu/faculty/xie/publications/tacas05.pdf},
}

@InProceedings{Xie-etal07,
  author = {Tao Xie and Kunal Taneja and Shreyas Kale and Darko Marinov},
  title = {Towards a Framework for Differential Unit Testing of Object-Oriented Programs.},
  booktitle = {Proceedings of the 2nd International Workshop on Automation of Software Test (AST 2007)},
  month = may,
  year = 2007,
   location = {Minneapolis, MN},
  url = {http://www.csc.ncsu.edu/faculty/xie/publications/ast07-diffut.pdf},
}

@InProceedings{Xu-Yang03,
  author = 	 {Guoqing Xu and Zongyuan Yang},
  title = 	 {JMLAutoTest: A Novel Automated Testing Framework based on JML and JUnit},
  booktitle =	 {3rd IEEE ASE workshop on Formal Approaches to Testing of Software (FATES' 03)},
  pages =	 {118-127},
  year =	 2003,
  volume =	 2931,
  series =	 LNCS,
  address =	 NY,
  publisher =	 SV,
  URL = 	 {http://www.cse.ohio-state.edu/~xug/research/papers/fates03_JMLAutoTest.pdf}
}

@Article{Xu-deRoever-He97,
  title =	"The Rely-Guarantee Method for Verifying Shared Variable Concurrent Programs",
  author =	"Qiwen Xu and Willem P. de Roever and Jifeng He",
  journal =	FAC,
  year = 	1997,
  number =	2,
  volume =	9,
  pages =	"149-174"
}

@InProceedings{Yamada-Watanabe05,
  Author =	 {Kiyoshi Yamada and Takuo Watanabe},
  Title =	 {Moxa: An Aspect-Oriented Approach to Modular Behavioral Specifications},
  BookTitle =	 {SPLAT '05},
  year =	 2005,
  month =	 mar,
  note =         {\url{http://www.daimi.au.dk/~eernst/splat05/papers/Yamada.pdf}}
}

@inproceedings{Yamada-Watanabe05a,
  author    = {Kiyoshi Yamada and Takuo Watanabe},
  title     = {An Aspect-oriented Approach to Modular Behavioral Specification                of {Java} Components},
  booktitle = {IASTED Conf. on Software Engineering},
  year      = {2005},
  pages     = {360-365},
  publisher = {IASTED/ACTA Press}
}

@Article{Yamaura98,
  author =	 {Tsuneo Yamaura},
  title =	 {How to Design Practical Test Cases},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 6,
  month =	 nov,
  pages =	 {30-36},
  annote =	 {4 references.}
}

@Article{Yar-Tsai86,
  Author =	 "Stephen S. Yau and Jeffery J.-P. Tsai",
  Title =	 "A Survey of Software Design Techniques",
  Journal =	 IEEETSE,
  Volume =	 "SE-12",
  Number =	 6,
  Month =	 jun,
  Year =	 1986,
  Pages =	 "713-721",
  Annote =	 "83 references."
}

@TechReport{Ye06,
  author = 	 {Cui Ye},
  title = 	 {Improving {JML}'s assignable clause analysis},
  institution =  {Department of Computer Science, Iowa State University},
  year = 	 2006,
  number =	 {06-19},
  address =	 {226 Atanasoff Hall, Ames, Iowa 50011},
  month =	 jul,
  URL = 	 {ftp://ftp.cs.iastate.edu/pub/techreports/TR06-19/TR.pdf},
  annote =	 {12 references.}
}

@TechReport{Yelick91,
  Author =	 "Katherine Yelick",
  Title =	 "Using Abstraction In Explicitly Parallel Programs",
  Institution =	 "Laboratory for Computer Science, MIT",
  Year =	 1991,
  Number =	 "MIT/LCS/TR-507",
  Address =	 "545 Technology Square, Cambridge, MA 02139",
  Month =	 jul,
  Annote =	 "79 references."
}

@Article{Yemini-Berry87,
  Author =	 "Shaula Yemini and Daniel M. Berry",
  Title =	 "An Axiomatic Treatment of Exception Handling in an
                  Expression-Oriented Language",
  Journal =	 TOPLAS,
  Volume =	 9,
  Number =	 3,
  Month =	 jul,
  Year =	 1987,
  Pages =	 "390-407",
  Annote =	 "Axiomatic semantics of the replacement model of
                  exception handling 27 references."
}

@inproceedings{Yi-etal13,
author = {Jooyong Yi and Robby and Xianghua Deng and Abhik Roychoudhury},
title = {Past Expression: Encapsulating Pre-States at Post-Conditions by Means of AOP},
year = {2013},
isbn = {9781450317665},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/2451436.2451453},
doi = {10.1145/2451436.2451453},
abstract = {Providing a pair of pre and post-condition for a method or a procedure is a typical
way of program specification. When specifying a post-condition, it is often necessary
to compare the post-state value of a variable with its pre-state value. To access
a pre-sate value at a post-condition, most contract languages such as Eiffel and JML
provide an old expression; old(x) returns a pre-state value of variable x. However,
old expressions pose several problems, most notably the lack of encapsulation; old(x)
does not encapsulate an object graph rooted from the pre-state value of x. Thus, method-call
expressions like x.equals(old(x)) should generally not be used, and instead each field
of x should be compared individually as in x.f1==old(x.f1) & x.f2==old(x.f2). In this
paper, we first describe this lack of encapsulation and other problems of old expressions
in more detail. Then, to address those problems, we propose our novel past expression
along with its formal semantics. We also describe how our past expression can be supported
during runtime assertion checking. We explain the involved problems, and show how
we solve them. We implement our solution by means of AOP where we exploit various
primitive pointcuts including our custom branch pointcut.},
booktitle = {Proceedings of the 12th Annual International Conference on Aspect-Oriented Software Development},
pages = {133–144},
numpages = {12},
keywords = {past expression, encapsulation, branch pointcut, runtime assertion checking (RAC), contract, old expression},
location = {Fukuoka, Japan},
series = {AOSD '13}
}

@article{Yi-etal15,
author = {Jooyong Yi and Dawei Qi and Shin Hwei Tan and Abhik Roychoudhury},
title = {Software Change Contracts},
year = {2015},
issue_date = {May 2015},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
volume = {24},
number = {3},
issn = {1049-331X},
url = {https://doi.org/10.1145/2729973},
doi = {10.1145/2729973},
abstract = {Software errors often originate from incorrect changes, including incorrect program
fixes, incorrect feature updates, and so on. Capturing the intended program behavior
explicitly via contracts is thus an attractive proposition. In our recent work, we
had espoused the notion of “change contracts” to express the intended program behavior
changes across program versions. Change contracts differ from program contracts in
that they do not require the programmer to describe the intended behavior of those
program features which are unchanged across program versions. In this work, we present
the formal semantics of our change contract language built on top of the Java modeling
language (JML). Our change contract language can describe behavioral as well as structural
changes. We evaluate the expressivity of the change contract language via a survey
given to final-year undergraduate students. The survey results enable to understand
the usability of our change contract language for purposes of writing contracts, comprehending
written contracts, and modifying programs according to given change contracts.Finally,
we develop both dynamic and static checkers for change contracts, and show how they
can be used in maintaining software changes. We use our dynamic checker to automatically
suggest tests that manifest violations of change contracts. Meanwhile, we use our
static checker to verify that a program is changed as specified in its change contract.
Apart from verification, our static checker also performs various other software engineering
tasks, such as localizing the buggy method, detecting/debugging regression errors,
and classifying the cause for a test failure as either error in production code or
error in test code.},
journal = {ACM Trans. Softw. Eng. Methodol.},
month = may,
articleno = {18},
numpages = {43},
keywords = {dynamic checking, Software changes, static checking}
}

@InCollection{Yodaiken90,
  Author =	 "Victor Yodaiken",
  Title =	 "A logic-free method for modular compostion of
                  specifications",
  BookTitle =	 "Advances in Computing and Information - ICCI'90",
  Publisher =	 SV,
  Year =	 1990,
  Editor =	 "S.G. Akl and F. Fiala and W.W. Koczkodaj",
  Series =	 LNCS,
  Volume =	 468,
  Pages =	 "196-205",
  Address =	 NY,
  Annote =	 "14 references."
}

@TechReport{Yonezawa77,
  Author =	 "Akinori Yonezawa",
  Title =	 "Specification and Verification Techniques for
                  Parallel Programs based on Message Passing
                  Semantics",
  Institution =	 MITLCS,
  Number =	 191,
  Month =	 dec,
  Year =	 1977,
  Annote =	 "Specification using an abstract model approach
                  called conceptual representations. Deals with
                  mutable objects, message passing in actor systems
                  and parallel processing. 59 references."
}

@InProceedings{Yorsh-Ball-Sagiv06,
  title =	"Testing, abstraction, theorem proving: better together!",
  author =	"Greta Yorsh and Thomas Ball and Mooly Sagiv",
  booktitle =	"Proceedings of the {ACM}/{SIGSOFT} International
		 Symposium on Software Testing and Analysis, {ISSTA}
		 2006, Portland, Maine",
  publisher =	"ACM",
  month =       jul,
  year = 	2006,
  editor =	"Lori L. Pollock and Mauro Pezz{\`e}",
  ISBN = 	"1-59593-263-1",
  pages =	"145-156",
  URL =  	"http://doi.acm.org/10.1145/1146238.1146255",
}

@Article{Young97,
  author =	 {William D. Young},
  title =	 {Comparing Verification Systems: Interactive
                  Consistency in {ACL2}},
  journal =	 IEEETSE,
  year =	 1997,
  volume =	 23,
  number =	 4,
  month =	 apr,
  pages =	 {214-223},
  annote =	 {First-order logic may be good enough for some
                  problems. Comparisons with PVS. 23 references.}
}

@Book{Yourdon89,
  Author =	 "Edward Yourdon",
  Title =	 "Modern Structured Analysis",
  Publisher =	 "Prentice-Hall",
  Year =	 1989,
  Series =	 "Yourdon Press computing series",
  Address =	 "Englewood Cliffs, New Jersey"
}

@InCollection{Zamulin93,
  Author =	 "A. V. Zamulin",
  Title =	 "Algebraic Modelling of Imperative Languages with
                  Pointers",
  BookTitle =	 "Formal Methods in Programming and Their
                  Applications",
  Publisher =	 SV,
  Year =	 1993,
  Editor =	 "Dines Bjoerner and Manfred Broy and Igor
                  V. Pottosin",
  Series =	 LNCS,
  Volume =	 735,
  Pages =	 "81-97",
  Month =	 jul,
  Annote =	 "18 references."
}

@TechReport{Zamulin94a,
  Author =	 "Alexandre Zamulin",
  Title =	 "The Database Specification Language Ruslan (a
                  preliminary communication)",
  Institution =	 "Siberian Division of the Russian Academy of Sciences
                  Institute of Informatics Sytems",
  Year =	 1994,
  Number =	 "Preprint 28",
  Address =	 "Novosibirsk",
  Annote =	 "12 references."
}

@TechReport{Zamulin94b,
  Author =	 "Alexandre Zamulin",
  Title =	 "The Database Specification Language Ruslan
                  (specification examples)",
  Institution =	 " Division of the Russian Academy of Sciences
                  Institute of Informatics Sytems",
  Year =	 1994,
  Number =	 "Preprint 29",
  Address =	 "Novosibirsk",
  Annote =	 "2 references."
}

@InProceedings{Zaremski-Wing95,
  author =	 "Amy Moormann Zaremski and Jeannette M. Wing",
  title =	 "Specification Matching of Software Components",
  booktitle =	 "Proceedings of SIGSOFT'95 Third ACM SIGSOFT
                  Symposium on the Foundations of Software
                  Engineering",
  pages =	 "6--17",
  month =	 oct,
  year =	 1995
}

@Article{Zaremski-Wing97,
  author =	 "Amy Moormann Zaremski and Jeannette M. Wing",
  title =	 "Specification Matching of Software Components",
  journal =	 TOSEM,
  year =	 1997,
  volume =	 6,
  number =	 4,
  month =	 oct,
  pages =	 {333-369},
  annote =	 {46 references}
}

@InProceedings{Zave-Jackson89,
  Author =	 "Pamela Zave and Daniel Jackson",
  Title =	 "Practical Specification Techniques for
                  Control-Oriented Systems",
  BookTitle =	 "Information Processing '89",
  Editor =	 "G. X. Ritter",
  Year =	 1989,
  Publisher =	 "Elsevier Science publishers B. V. (North-Holland)",
  Pages =	 "83-88",
  Annote =	 "Combination of structure diagrams (from JSP and JSD)
                  with Statecharts. 16 references."
}

@Article{Zave-Jackson93,
  Author =	 "P. Zave and Michael Jackson",
  Title =	 "Conjunction as composition",
  Journal =	 "ACM Transactions on Software Engineering and
                  Methodology",
  Volume =	 2,
  Number =	 4,
  Month =	 oct,
  Year =	 1993,
  Pages =	 "379-411",
  Annote =	 "36 References"
}

@Article{Zave-Jackson97,
  Author =	 "P. Zave and M. Jackson",
  Title =	 "Four Dark Corners of Requirements Engineering",
  Journal =	 "ACM Transactions on Software Engineering and
                  Methodology",
  Volume =	 6,
  Number =	 1,
  Month =	 jan,
  Year =	 1997,
  Pages =	 "1-30",
  URL =          "http://doi.acm.org/10.1145/237432.237434"
}

@Article{Zave-Jackson98,
  author =	 {Pamela Zave and Michael Jackson},
  title =	 {A Component-Based Approach to Telecommunications
                  Software},
  journal =	 {IEEE Software},
  year =	 1998,
  volume =	 15,
  number =	 5,
  month =	 sep,
  pages =	 {70-87},
  annote =	 {10 references.}
}

@Article{Zave72,
  Author =	 "P. Zave",
  Title =	 "An Operational Approach to Requirements
                  Specification for Embedded Systems",
  Journal =	 IEEETSE,
  Volume =	 8,
  Number =	 3,
  Month =	 may,
  Year =	 1972,
  Pages =	 "250-269"
}

@Article{Zave84,
  Author =	 "Pamela Zave",
  Title =	 "The Operational Versus the Conventional Approach to
                  Software Development",
  Journal =	 CACM,
  Volume =	 27,
  Number =	 2,
  Month =	 feb,
  Year =	 1984,
  Pages =	 "104-118",
  Annote =	 "Operational approach specifies systems
                  operationally, that is, at problem-level and
                  transforms it to an implementation level
                  program. Separation of problem-oriented from
                  implementation oriented concerns. Executable
                  specifications. Efficiency versus maintenance
                  trade-off is between localizing information or
                  spreading it around. 42 references."
}

@Article{Zave97,
  author =	 {Pamela Zave},
  title =	 {Classification of Research Efforts in Requirements
                  Engineering},
  journal =	 ACMCS,
  year =	 1997,
  volume =	 29,
  number =	 4,
  month =	 dec,
  pages =	 {315-321},
  annote =	 {39 references.}
}

@inproceedings{Zee-Kuncak-Rinard08,
  author    = {Karen Zee and Viktor Kuncak and Martin C. Rinard},
  title     = {Full functional verification of linked data structures},
  year      = 2008,
  pages     = {349-361},
  editor    = {Rajiv Gupta and Saman P. Amarasinghe},
  booktitle = {Programming Language Design and Implementation (PLDI)},
  publisher = ACM,
  address = NY
}

@Book{Zeigler97,
  author =	 {Bernard P. Zeigler},
  title =	 {Objects and systems: principled design with
                  implementations in C++ and Java},
  publisher =	 SV,
  year =	 1997,
  series =	 {Springer undergraduate texts in computer science},
  address =	 NY,
  annote =	 {Includes formal specification and verification.}
}

@Article{Zelkowitz90,
  Author =	 "Marvin V. Zelkowitz",
  Title =	 "A Functional Correctness Model of Program
                  Verification",
  Journal =	 "Computer",
  Year =	 1990,
  Volume =	 23,
  Number =	 1,
  Month =	 nov,
  Pages =	 "30-39",
  Note =	 "This model's verification conditions depend only on
                  elementary symbolic execution of a trace table. An
                  easy-to-learn technique, it's used in a freshman
                  computer science class",
  Annote =	 "8 references."
}

@Article{Zeller01,
  author = 	 {Andreas Zeller},
  title = 	 {Automated Debugging: Are We Close?},
  journal = 	 {Computer},
  year = 	 2001,
  volume =	 34,
  number =	 11,
  pages =	 {26-31},
  month =	 nov,
  annote =	 {7 references.}
}

@inproceedings{Zemin-etal17,
author = {Luciano Zem\'{\i}n and Sim\'{o}n Guti\'{e}rrez Brida and Ariel Godio and C\'{e}sar Cornejo and Renzo Degiovanni and Germ\'{a}n Regis and Nazareno Aguirre and Marcelo Frias},
title = {An Analysis of the Suitability of Test-Based Patch Acceptance Criteria},
year = 2017,
isbn = 9781538627891,
publisher = IEEE,
address="Los Altos",
abstract = {Program repair techniques attempt to fix programs by looking for patches within a search space of fix candidates. These techniques require a specification of the program to be repaired, used as an acceptance criterion for fix candidates, that often also plays an important role in guiding some search processes. Most tools use tests as specifications, which constitutes a risk, since the incompleteness of tests as specifications may lead one to obtain spurious repairs, that pass all tests but are in fact incorrect. This problem has been identified by various researchers, raising concerns about the validity of program fixes. More thorough studies have been proposed using different sets of tests for fix validation, and resorting to manual inspection, showing that while tools reduce their program fixing rate, they are still able to repair a significant number of cases.In this paper, we perform a different analysis of the suitability of tests as acceptance criteria for automated program fixes, by checking patches produced by automated repair tools using a bug-finding tool, as opposed to previous works that used tests or manual inspections. We develop a number of experiments in which faulty programs from a known benchmark are fed to the program repair tools GenProg, Angelix, AutoFix and Nopol, using test suites of varying quality and extension, including those accompanying the benchmark. We then check the produced patches against formal specifications using a bug-finding tool. Our results show that, in general, automated program repair tools are significantly more likely to accept a spurious program fix than producing an actual one, in the studied scenarios.},
booktitle = {Proceedings of the 10th International Workshop on Search-Based Software Testing},
pages = {14–20},
numpages = 7,
location = {Buenos Aires, Argentina},
series = {SBST '17},
annote="25 references."
}
                  
@article{Zhang-etal22,
  title={General cutting planes for bound-propagation-based neural network verification},
  author={Huan Zhang and Shiqi Wang and Kaidi Xu and Linyi Li and Bo Li and Suman Jana and Cho Hsieh-Jui and J Zico Kolter},
  journal={arXiv preprint arXiv:2208.05740},
  year={2022}
}

@TechReport{Zhang88,
  Author =	 "Hantao Zhang",
  Title =	 "Reduction, Superposition and Induction: Automated
                  Reasoning in an Equational Logic",
  Institution =	 "Department of Computer Science, The University of
                  Iowa",
  Address =	 "Iowa City, Iowa",
  Number =	 "86-06",
  Month =	 nov,
  Year =	 1988,
  Note =	 "The author's Ph.D. thesis, from RPI",
  Annote =	 "Systematic study of automated reasoning techniques
                  based on equational logic. About a hundred
                  references."
}

@InProceedings{Zhao-Rinard03,
  title =	 {Pipa: A Behavioral Interface Specification Language
                  for AspectJ},
  author =	 {Jianjun Zhao and Martin C. Rinard},
  year =	 {2003},
  booktitle =	 {Proc. Fundamental Approaches to Software Engineering
                  (FASE'2003) of ETAPS'2003},
  series =	 {Lecture Notes in Computer Science},
  month =	 apr,
  publisher =	 SV,
}

@Article{Zhao99,
  author =	 {Jianjun Zhao},
  title =	 {Bibliography on Software Architecture Analysis},
  journal =	 SIGSOFT,
  year =	 1999,
  volume =	 24,
  number =	 3,
  month =	 may,
  pages =	 {61-62},
  URL =		 "http://www.fit.ac.jl/~zhaz/pub/sa.html",
  annote =	 {44 references.}
}

@Article{Zheng-Zhang-Wang98,
  author =	 {Mingchun Zheng and Jiahong Zhang and Yanbing Wang},
  title =	 {Integrating a Formal Specification Notation with
                  {HOOD}},
  journal =	 SIGSOFT,
  year =	 1998,
  volume =	 23,
  number =	 5,
  month =	 sep,
  pages =	 {47-61},
  annote =	 {Integration with Z. 8 references.}
}

@Article{Zhu-Hall-May97,
  author =	 {Hong Zhu and Patrick A. V. Hall and John H. R. May},
  title =	 {Software Unit Test Coverage and Adequacy},
  journal =	 ACMCS,
  year =	 1997,
  volume =	 29,
  number =	 4,
  month =	 dec,
  pages =	 {366-427},
  annote =	 {Many references.}
}

@Article{Zhu94,
  Author =	 "Hong Zhu",
  Title =	 "How powerful are folding/unfolding transformations?",
  Journal =	 "Journal of Functional Programming",
  Year =	 1994,
  Volume =	 4,
  Number =	 1,
  Month =	 jan,
  Pages =	 "89-112",
  Annote =	 "24 references."
}

@inproceedings{Zimmerman-Nagmoti10,
       Author = {Daniel M. Zimmerman and Rinkesh Nagmoti},
       Booktitle = {International Conference on Formal Verification of Object-Oriented Software ({FoVeOOS} 2010)},
       location = {Paris, France},
       Month = jun,
       Title = {{JMLUnit}: The Next Generation},
       Year = 2010,
       pages="183-197",
       publisher=SV,
       address="Berlin",
       annote="16 references."
}

@Article{Zwaenpoel-Lantz84,
  Author =	 "Willy Zwaenpoel and Keith A. Lantz",
  Title =	 "Perseus: Retrospective on a Portable Operating
                  System",
  Journal =	 SPandE,
  Volume =	 14,
  Number =	 1,
  Month =	 jan,
  Year =	 1984,
  Pages =	 "31-48"
}

@incollection{Zwiers-etal96,
author={Job Zwiers and Ulrich Hannemann and Yassine Lakhneche and Willem-Paul Roever and Frank Stomp},
title={Modular completeness: Integrating the reuse of specified software in top-down program development},
year={1996},
isbn={978-3-540-60973-5},
booktitle={FME'96: Industrial Benefit and Advances in Formal Methods},
volume={1051},
series={Lecture Notes in Computer Science},
editor={Gaudel, Marie-Claude and Woodcock, James},
doi={10.1007/3-540-60973-3_109},
url={http://dx.doi.org/10.1007/3-540-60973-3_109},
publisher={Springer Berlin Heidelberg},
pages={595-608}
}

@MastersThesis{bruns09,
  author =      "Daniel Bruns",
  title =       "Formal Semantics for the {Java Modeling Language}",
  year =        2009,
  month =       jun,
  school =      "Universit{\"{a}}t {Karlsruhe}",
  type =        "Diploma thesis",
  url =		"http://lfm.iti.uni-karlsruhe.de/download/Diplomarbeit_DanielBruns.pdf",
}

@Unpublished{cme03,
  author =	 {IBM},
  title =	 {Concern Manipulation Environment},
  note =	 {Available from
                  \url{http://www.research.ibm.com/cme/papers/handout.html}},
  year =	 {2003},
  annote =	 {Handout from AOSD presentation}
}

@InProceedings{dAmorim-etal06,
  author = 	 {Marcelo d'Amorim and Carlos Pacheco and Tao Xie and Darko Marinov and Michael Ernst},
  title = 	 {An Empirical Comparison of Automated Generation and Classification
    Techniques for Object-Oriented Unit Testing},
  booktitle =	 {Proceedings of the 21st IEEE/ACM International
     Conference on Automated Software Engineering (ASE 2006)},
  year =	 2006,
  organization = {ACM},
  note =	 {To appear.},
  URL = 	 {http://www.csc.ncsu.edu/faculty/xie/publications/ase06-symclat.pdf}
}

@Book{deBakker80,
  Author =	 "Jaco de Bakker",
  Title =	 "Mathematical Theory of Program Correctness",
  Publisher =	 Prentice-Hall,
  Address =	 "Englewood Cliffs, N.J.",
  Year =	 1980,
  Series =	 "International Series in Computer Science",
  Annote =	 "Program verification. Bibliographical notes and 134
                  references."
}

@InProceedings{deBoer-Hannemann-deRoever99,
  author =       "F. S. de Boer and U. Hannemann and W.-P. de Roever",
  title =        "Formal Justification of the Rely-Guarantee Paradigm
                 for Shared-Variable Concurrency: {A} Semantic
                 Approach",
  Editor =	 "Jeannette M. Wing and Jim Woodcock and Jim Davies",
  BookTitle =	 "FM'99 --- Formal Methods: World Congress on Formal
                  Methods in the Development of Computing Systems,
                  Toulouse, France, September 1999, Proceedings",
  Year =	 1999,
  Series =	 LNCS,
  Publisher =	 SV,
  Volume =	 1709,
  pages =        "1245-1265",
  annote =       "Completeness proof for the rely-guarantee technique.  15 references.",
}

@inproceedings{deBoer-Pierik02,
author={F.S. de Boer and C. Pierik},
title={Computer-Aided Specification and Verification of Annotated Object-Oriented Programs},
editor={B. Jacobs and A. Rensink},
booktitle={Formal Methods for Open Object-Based Distributed Systems},
pages={163-177},
year=2002
}

@InProceedings{deBoer90,
  Author =	 "Frank S. de Boer",
  Title =	 "A Proof System for the Parallel Object-Oriented
                  Language POOL",
  BookTitle =	 "17th International Colloquium on Automata,
                  Languages, and Programming (ICALP), Warwick,
                  England",
  Month =	 jul,
  Year =	 1990,
  Annote =	 "Hoare-style proof system for partial
                  correctness. Deals with aliasing. Does not allow use
                  of subtyping for assignments or message passing."
}

@InCollection{deBoer91,
  Author =	 "Frank S. de Boer",
  Title =	 "A Proof System for the Language {POOL}",
  BookTitle =	 "Foundations of Object-Oriented Languages, REX
                  School/Workshop, Noordwijkerhout, The Netherlands,
                  May/June 1990",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "J. W. de Bakker and W. P. de Roever and
                  G. Rozenberg",
  Series =	 LNCS,
  Volume =	 489,
  Pages =	 "124-150",
  Address =	 NY,
  Annote =	 "Hoare-logic for POOL. Deals with pointers. 15
                  references."
}

@InProceedings{deBoer99,
  author = 	 {Frank S. de Boer},
  title = 	 {A {WP}-calculus for {OO}},
  booktitle = 	 {Foundations of Software Science and Computation Structures (FOSSACS)},
  pages =	 {135-149},
  year =	 1999,
  editor =	 {Wolfgang Thomas},
  volume =	 1578,
  series =	 LNCS,
  URL =          {http://www.springerlink.com/content/avdcmfyp8fxwk1y0},
  publisher =	 SV
}

@Article{deChampeaux-Faure92,
  Author =	 "Dennis de Champeaux and Penelope Faure",
  Title =	 "A Comparative Study of object-oriented analysis
                  methods",
  Journal =	 JOOP,
  Year =	 1992,
  Volume =	 5,
  Number =	 1,
  Month =	 mar,
  Pages =	 "21-33",
  Annote =	 "33 references."
}

@Article{deChampeaux-Lea-Faure92,
  Author =	 "Dennis de Champeaux and Doug Lea and Penelope Faure",
  Title =	 "The Process of Object-Oriented Design",
  Journal =	 SIGPLAN,
  Volume =	 27,
  Number =	 10,
  Month =	 oct,
  Year =	 1992,
  Pages =	 "45-62",
  Note =	 "{\em OOPSLA '92 Proceedings}, Andreas Papecke
                  (editor).",
  Annote =	 "20 references."
}

@Book{deChampeaux-Lea-Faure93,
  Author =	 "Dennis de Champeaux and Doug Lea and Penelope Faure",
  Title =	 "Object Oriented System Development",
  Year =	 1993,
  Publisher =	 Addison-Wesley,
  Address =	 "Mass,",
  Annote =	 "20 references."
}

@InProceedings{deChampeaux-etal91,
  Author =	 "Dennis de Champeaux and Pierre America and Derek
                  Coleman and Roger Duke and Doug Lea and Gary
                  Leavens",
  Title =	 "Formal Techniques for {OO} Software Development",
  BookTitle =	 "OOPSLA '92 Proceedings",
  Editor =	 "Andreas Paepcke",
  Series =	 SIGPLAN,
  Year =	 1991,
  Volume =	 "26(11)",
  Month =	 nov,
  Pages =	 "166-170",
  Annote =	 "no references"
}

@Article{deChampeaux91,
  Author =	 "Dennis de Champeaux",
  Title =	 "Formal Techniques for Object Oriented Software
                  Development",
  Journal =	 "OOPS Messenger",
  Volume =	 3,
  Number =	 4,
  Month =	 oct,
  Year =	 1992,
  Pages =	 "49",
  Note =	 "{\em OOPSLA '91 Addendum to the Proceedings}, Jerry
                  L. Archibald (editor)."
}

@Book{deRoever-Englhardt98,
  author =	 {Willem-Paul de Roever and Kai Engelhardt},
  title =	 {Data Refinement: Model-Oriented Proof Methods and
                  their Comparison},
  publisher =	 {Cambridge University Press},
  year =	 1998,
  volume =	 47,
  series =	 {Cambridge Tracts in Theoretical Computer Science},
  address =	 NY,
  annote =	 {Comprehensive and systematic introduction to data
                  refinement. Many references.}
}

@InProceedings{deRoever85,
  author =	"W. P. de Roever",
  title =	"The quest for compositionality---a survey of assertion
		 based proof systems for concurrent programs, {P}art
		 {I}: Concurrency based on shared variables",
  booktitle =	"Proceedings of the IFIP Working Conference",
  year = 	"1985"
}

@InProceedings{duBousquet-etal04,
  author = 	 {Lydie du Bousquet and Yves Ledru and Olivier Maury and Pierre Bontron},
  title = 	 {A case study in {JML}-based software validation},
  booktitle =	 {Proceedings of 19th Int. IEEE Conf. on Automated Sofware
Engineering (ASE'04)},
  pages =	 {294-297},
  year =	 2004,
  month =	 sep,
  publisher =	 {IEEE Computer Society Press},
  URL = 	 {http://www-lsr.imag.fr/Les.Personnes/Yves.Ledru/Publications/duBousquetASE04.pdf}
}

@misc{openjmlweb,
  author={David R. Cok},
  year={2018},
  note = {\url{http://www.openjml.org }}
}

@InCollection{vanHee-Somers-Voorheve91,
  Author =	 "K. M. van Hee and L. J. Somers and M. Voorhoeve",
  Title =	 "{Z and High Level Petri Nets}",
  BookTitle =	 "VDM '91 Formal Software Development Methods 4th
                  International Symposium of VDM Europe
                  Noordwijkerhout, The Netherlands, Volume 1:
                  Conference Contributions",
  Publisher =	 SV,
  Year =	 1991,
  Editor =	 "S. Prehn and W. J. Toetenel",
  Series =	 LNCS,
  Volume =	 551,
  Pages =	 "204-219",
  Address =	 NY,
  Month =	 oct,
  Annote =	 "11 references."
}

@Article{vanLamsweerde-Darimont-Letier98,
  author =	 {Axel van Lamsweerde and Robert Darimont and Emmanuel
                  Letier},
  title =	 {Managing Conflicts in Goal-Directed Requirements
                  Engineering},
  journal =	 IEEETSE,
  year =	 1998,
  volume =	 24,
  number =	 11,
  month =	 nov,
  pages =	 {908-925},
  annote =	 {57 references.}
}

@InProceedings{vanLamsweerde00,
  author =       {Axel van Lamsweerde},
  title =        "Requirements Engineering in the Year 00:
                  A Research Perspective",
  booktitle =    {Proceedings of the 22nd International Conference on
                 Software Engineering},
  month =        jun,
  publisher =    "ACM Press",
  address =      NY,
  year =         2000,
  pages =        {5-19},
  annote =       {Many references.}
}

@inproceedings{vanLamsweerde00a,
 author =       {Axel van Lamsweerde},
 title = {Formal Specification: A Roadmap},
 booktitle = {ICSE '00: Proceedings of the Conference on The Future of Software Engineering},
 year = {2000},
 pages = {147--159},
 location = {Limerick, Ireland},
 publisher = {ACM},
 address = {New York, NY, USA},
 doi = {http://doi.acm.org/10.1145/336512.336546}
}

@Article{vanVliet-Gladney85,
  Author =	 "J. C. van Vliet and H. M. Gladney",
  Title =	 "An Evaluation of Tagging",
  Journal =	 SPandE,
  Volume =	 15,
  Number =	 9,
  Month =	 sep,
  Year =	 1985,
  Pages =	 "823-837",
  Annote =	 "Two programs coded in object-oriented languages and
                  compared to codings done in PL/1. The
                  object-oriented version was found to be easier to
                  understand, easier to change, and easier to
                  maintain. But other factors besides dynamic binding
                  also helped, e.g., storage allocation and abstract
                  data type support."
}

@InProceedings{vandeSnepscheut94,
  author =	 {Jan L. van de Snepscheut},
  title =	 {Mechanized Support for Stepwise Refinement},
  booktitle =	 {Programming Languages and System Architecture},
  editor =	 {J. Gutknecht},
  year =	 1994,
  publisher =	 SV,
  address =	 NY,
  pages =	 {35-48}
}

@InProceedings{vandenBerg-Jacobs01,
  author = 	 {Joachim van den Berg and Bart Jacobs},
  title = 	 {The {LOOP} compiler for {Java} and {JML}},
  booktitle =	 {Tools and Algorithms for the Construction and Analysis of Software (TACAS)},
  pages =	 {299-312},
  year =	 2001,
  editor =	 {T. Margaria and W. Yi},
  volume =	 2031,
  series =	 LNCS,
  publisher =	 SV,
}

@InProceedings{vandenBerg-Poll-Jacobs00,
AUTHOR       = {Joachim van den Berg and Erik Poll and Bart Jacobs},
TITLE        = {First steps in formalising {JML}: exceptions in predicates},
EDITOR       = {Sophia Drossopoulou and Susan Eisenbach and Bart Jacobs and
                Gary T. Leavens and Peter M{\"u}ller and Arnd Poetzsch-Heffter},
BOOKTITLE    = {Formal Techniques for Java Programs. Proceedings
                of the ECOOP'00 Workshop},
PUBLISHER    = {Techn. Rep., Fernuniversit{\"a}t Hagen},
YEAR         = {2000},
URL = {http://www.cs.ru.nl/~erikpoll/publications/ftfjp00.ps.gz}
}

@inproceedings{vandenBerg-etal01,
  author =   {Joachim van den Berg and Cees-Bart Breunesse and Bart Jacobs and Erik Poll},
  title =    {On the Role of Invariants in Reasoning about Object-Oriented Languages},
  year =     2001,
  booktitle = {{Formal Techniques for Java Programs. Proceedings of
              the ECOOP'2001 Workshop}},
  url       = {http://www.cs.ru.nl/~erikpoll/publications/ftfjp01.pdf},
  annote    = {14 references.}
}
