real-world applications (e.g. [EHM + 99, Buh95]). Moreover, aspects of ML such as strong typing and the exceptions system have significantly influenced the design of languages such as Java [GJS96], and it seems likely that future systems languages will incorporate many of these features [Mac00]. Regarding the second requirement, even before the definition of ML had fully taken shape, the LCF system [GMW78] provided a program logic for a rather restricted fragment of the language. Subsequent research has sought to build on the definition in order to support formal reasoning about programs. Most notably, the Extended ML project [KST97] resulted in a formal language for specifying program properties, but the complexity of this language prohibited the development of useful proof rules. A di#erent approach has been pursued by Elsa Gunter et al [GV94], who have formalized the definition of ML within the HOL theorem prover; this has proved useful for metatheo