Merlin: specification inference for explicit information flow problems
An axiomatic basis for computer programming