Laurent Mauborgne Astrée: verification of absence of run-time error. 385-392 2004 conf/ifip/2004bis IFIP Congress Topical Sessions db/conf/ifip/ifip2004bis.html#Mauborgne04