Using SMT solvers to verify high-integrity programsPaul B. JacksonBill J. Elliset al.2007AFM 2007Conference paper