CLARVA: Model-based Residual Verification of Java Programs