Clyde Ruby, Gary T. Leavens: Safely creating correct subclasses without seeing superclass code. OOPSLA 2000: 208-228