Abstract. A properly encapsulated data representation can be revised for refactoring or other purposes without affecting the correctness of client programs and extensions of a class. But encapsulation is difficult to achieve in object-oriented programs owing to heap based structures and reentrant callbacks. This paper shows that it is achieved by a discipline using assertions and auxiliary fields to manage invariants and transferrable ownership. The main result is representation independence: a rule for modular proof of equivalence of class implementations. 1

A properly encapsulated data representation can be revised without affecting the correctness of client programs and extensions but encapsulation is difficult to achieve for heap based structures and object-oriented (OO) programs with reentrant callbacks. Building on a discipline that uses assertions and auxiliary fields to manage invariants and transferrable ownership, we give a rule for modular reasoning based on simulations. This representation independence result is proved for a sequential OO language with recursive, generic classes.