Describir: Program correctness over abstract data types, with error-state semantics / J.V. Tucker, J.I. Zucker.