Following Burstall, a flow diagram can be represented by a pair consisting of a graph and a functor from the free category to the category of sets and relations. A program is verified by incorporating the assertions of the Floyd-Naur proof method into a second functor and exhibiting a natural transformation to the program. A broader range of properties is obtained by substituting spans for relations and introducing oplaxness into both the functors representing programs and the natural transformations in the morphisms between programs. The apparent complexity of this generalization is overcome by the observation that an oplax functor J Sp(C) is essentially the same as a functor e J C where e J is the twisted arrow category of J. Thus, a program is a presheaf F (G) Set as are the properties of the program. By analogy with categorical models of first-order logic, a program and the properties which pertain to it are subobjects of a suitably chosen base object. In this setting safety ...