Jim McDonald
Kestrel Institute
Programming language elements for correctness proofs
Acta Cybernetica