A comparative study of verification condition generators