Guttag, John V. and Horning, James J., with Stephen J. Garland, Kevin D. Jones, Andrés Modet, and Jeannette M. Wing, Larch: Languages and Tools for Formal Specification , Springer-Verlag, Texts and Monographs in Computer Science, 1993.An account describing using LCLint 1.2 on the program is found in
David Evans, Using Specifications to Check Source Code, MIT/LCS/TR-628, June 1994.In each iteration, LCLint is run incrementally on the code and certain anomalies are detected. The next section fixes these anomalies and runs LCLint again (sometimes with different flag settings) to detect more anomalies.
If you want to experiment with the code on your own system, you can also download the code.