Buobe
    Verifying using temporal logic of action in Dafny | Buobe