Submitted version to JML (1 Oct 2014).