Alberto Coen-Porisini Richard A. Kemmerer Dino Mandrioli A Formal Framework for ASTRAL Inter-level Proof Obligations. 90-108 1995 conf/esec/1995 ESEC db/conf/esec/esec95.html#Coen-PorisiniKM95