Joseph R. Kiniry Daniel M. Zimmerman Secret Ninja Formal Methods. 214-228 2008 FM http://dx.doi.org/10.1007/978-3-540-68237-0_16 conf/fm/2008 db/conf/fm/fm2008.html#KiniryZ08