Leo Marcus The Incorporation of Testing into Formal Verification: Direct, Modular, and Hierarchical Correctness Degrees. 235-261 1996 9 Formal Methods in System Design 3 db/journals/fmsd/fmsd9.html#Marcus96