## Logical reasoning for higher-order functions with local state (2006)

### Cached

### Download Links

- [arxiv.org]
- [www.doc.ic.ac.uk]
- [www.doc.ic.ac.uk]
- [www.doc.ic.ac.uk]
- [www.doc.ic.ac.uk]
- [www.doc.ic.ac.uk]
- DBLP

### Other Repositories/Bibliography

Venue: | of Lecture Notes in Computer Science |

Citations: | 13 - 4 self |

### BibTeX

@TECHREPORT{Yoshida06logicalreasoning,

author = {Nobuko Yoshida and Kohei Honda and Martin Berger and Queen Mary},

title = {Logical reasoning for higher-order functions with local state},

institution = {of Lecture Notes in Computer Science},

year = {2006}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. We introduce an extension of Hoare logic for call-by-value higherorder functions with ML-like local reference generation. Local references may be generated dynamically and exported outside their scope, may store higherorder functions and may be used to construct complex mutable data structures. This primitive is captured logically using a predicate asserting reachability of a reference name from a possibly higher-order datum and quantifiers over hidden references. The logic enjoys three completeness properties: relative completeness, a logical characterisation of the contextual congruence and derivability of characteristic formulae. We explore the logic’s descriptive and reasoning power with non-trivial programming examples combining higher-order procedures and dynamically generated local state. Axioms for reachability and local invariant play a central role for reasoning about the examples. 1

### Citations

1562 | The Definition of Standard ML
- Miller, Tofte, et al.
- 1990
(Show Context)
Citation Context ...nd higher-order procedures (both as programs and as stored values). We can check [Hoare-Wirth] is derivable from [LetRef] and [Assign]. Among the studies on verification methods for ML-like languages =-=[4, 35]-=-, Extended ML [49] is a formal development framework for Standard ML. A specification is given by combining a module’ signature and algebraic axioms on them. Correctness of an implementation w.r.t. a ... |

1361 | An axiomatic basis for computer programming
- Hoare
- 1969
(Show Context)
Citation Context ...reachability and local invariant play a central role for reasoning about the examples. 1 Introduction Reference Generation in Higher-Order Programming. This paper proposes an extension of Hoare Logic =-=[14]-=- for call-by-value higher-order functions with ML-like new reference generation [3, 4], and demonstrates its use through non-trivial reasoning examples. The new reference generation, the ref-construct... |

708 | Separation logic: A logic for shared mutable data structures
- Reynolds
- 2002
(Show Context)
Citation Context ...ld assume x#x, i.e. F). • νx.C ′ cannot be strengthened to #x.C ′ since N may store x in an existing reference. One may note the rule directly gives a proof rule for general new reference declaration =-=[31, 42, 48]-=-, new x := M in N, which has the same operational behaviour as let x = ref(M) in N. We can now treat IncShared from Introduction: IncShared def = a:=Inc;b:=!a;c1 :=(!a)();c2 :=(!b)();(!c1+!c2) Naming ... |

704 |
Types and Programming Languages
- Pierce
- 2002
(Show Context)
Citation Context ...nduces a local state by generating a fresh reference inaccessible from the outside. Consider the following program: Inc def = let x = ref(0) in λ().(x :=!x + 1; !x) (1.1) We use the standard notation =-=[40]-=-: in particular, “ref(M)” returns a fresh reference whose content is the value to which M evaluates. “!x” is the dereferencing of an imperative variable x. “;” is a sequential composition. In (1.1), a... |

563 |
Assigning meanings to programs
- Floyd
- 1967
(Show Context)
Citation Context ... y iff the distance from x up to, but not including, z is strictly smaller than that from y. Thus �z combined with equality is a well-founded partial order (which is enough for carrying out induction =-=[12]-=-). The reasoning uses the following judgement for induction, writing cyclesimple ′ for the program cyclesimple minus the initial recursion: {∀m �z l.B( f ,m)}cyclesimple ′ :u {B(u,l)} (6.4) where we s... |

413 |
Proof of correctness of data representations
- Hoare
- 1972
(Show Context)
Citation Context ...d graphs which may possibly store higher-order values [40]. Difficulties in formal reasoning about shared (possibly higher-order) local store, both axiomatic and otherwise, have been well-known since =-=[15, 31, 33]-=-. Thirdly, and related to the previous two points, local references can be used for efficient implementation of highly regular observable behaviour, for example purely functional behaviour, through in... |

304 |
Introduction to Mathematical Logic
- Mendelson
- 1987
(Show Context)
Citation Context ...ions l,l ′ ,...), pairing, projection, injection and standard first-order operations. !e denotes the dereference of a reference e. Formulae include the standard logical connectives and quantification =-=[30]-=-. Quantifiers, ∃x.C and ∀x.C, are standard. The hiding quantifiers, νx.C (read: “for some hidden 5sreference x, C holds”) and νx.C (read: “for each hidden reference x, C holds”), which are mutually du... |

207 | A new approach to abstract syntax with variable binding. Formal Aspects of Computing 13
- GABBAY, PITTS
- 2002
(Show Context)
Citation Context ... One method, which can treat hiding as above categorically, uses a class of toposes which capture renaming through symmetries [16]. We can also use the “swapping”-based treatment of binding following =-=[11]-=-. Note however that the use of such different presentations (with respective merits) does not alter the equational and other properties of models and satisfaction. Here we take the simplest approach t... |

195 |
An algebraic definition of simulation between programs
- Milner
- 1971
(Show Context)
Citation Context ...d graphs which may possibly store higher-order values [40]. Difficulties in formal reasoning about shared (possibly higher-order) local store, both axiomatic and otherwise, have been well-known since =-=[15, 31, 33]-=-. Thirdly, and related to the previous two points, local references can be used for efficient implementation of highly regular observable behaviour, for example purely functional behaviour, through in... |

189 | A calculus of mobile processes, parts
- Milner, Parrow, et al.
- 1992
(Show Context)
Citation Context ...s, Soundness and Completeness 3.1 Models We introduce operationally-based semantics of the logic, based on term models. For capturing local state, models incorporate hidden locations using a ν-binder =-=[34]-=-. We illustrate the key idea using the Introduction’s Inc (in (1.1)). We model Inc named u as: (νl)({u : λ().(l :=!l + 1; !l)}, {l ↦→ 0}) (3.1) (3.1) says that there is a behaviour named u and a refer... |

163 | Nominal logic, a first order theory of names and binding
- PITTS
(Show Context)
Citation Context ...iance. Meta-logical Study on Freshness. Freshness of names is recently studied from the viewpoint of formalising binding relations in programming languages and computational calculi. Pitts and Gabbay =-=[13, 43]-=- extend First-Order Logic with constructs to reason about freshness of names based on the theory of permutations. The key syntactic additions are the (interdefinable) “fresh” quantifierN and the fresh... |

162 | Separation and information hiding
- O’Hearn, Yang, et al.
- 2004
(Show Context)
Citation Context ...er we can apply their ideas on effective axiomatisation or mechanisation to a large class of mutable data structures treatable in our method. Hoare Logics (3): Separation Reynolds, O’Hearn and others =-=[9, 39, 48]-=- study a reasoning method for dynamically generated and deallocated mutable data structures using a spacial conjunction, C ∗C ′ . Taking the tree copy in § 6.2 (which is from [48]), they start from a ... |

145 | A new approach to abstract syntax involving binders
- Gabbay, Pitts
- 1999
(Show Context)
Citation Context ...n reach the reference named by e2 from a datum denoted by e1. As an example, if x denotes a starting point of a linked list, x ↩→ y says a reference y occurs in one of the cells reachable from x. y#x =-=[13, 47]-=- is the negation of x ↩→ y, which says: One can never reach a reference y starting from a datum denoted by x. Convention. Logical connectives are used with standard precedence/association, using paren... |

144 |
Semantics of programming languages
- Gunter
- 1992
(Show Context)
Citation Context ...α .M | 〈V,W〉 | inj α+β i (V ) M,N ::= V | MN | M := N | ref(M) | !M | op( ˜M) | πi(M) | 〈M,N〉 | inj α+β i (M) | if M then M1 else M2 | case M of {ini(x αi i ).Mi} i∈{1,2} We use the standard notation =-=[12, 35]-=- like constants c (unit (); booleans t, f; numbers n; and location labels also called simply locations l,l ′ ,...) and first-order operations op (+, −, ×, = , ¬, ∧, ...). Locations only appear at runt... |

136 | A spatial logic for concurrency (part I
- Caires, Cardelli
- 2001
(Show Context)
Citation Context ...nts a situation where l is hidden and u denotes a function which increments and returns the content of l; whereas M ′ is the result of taking off this hiding, exposing the originally local state, cf. =-=[11]-=-.LOGICAL REASONING FOR HIGHER-ORDER FUNCTIONS WITH LOCAL STATE 19 Despite x’s type being a reference, ∀x.C differs substantially from νx.C. The former says that for any reference x, which can be eith... |

131 | A logic of object-oriented programs
- Abadi, Leino
- 1997
(Show Context)
Citation Context ...ng future topic. Other Hoare Logics. Names have been used in Hoare logic since early work by Kowaltowski [28], and are found in the work by von Oheimb [60], Leavens and Baker [30] and Abadi and Leino =-=[3]-=-, for treating parameter passing and return values. These works do not treat higher-order procedures and data types, which are uniformly captured in the present logic along with parameters and return ... |

125 |
A correspondence between ALGOL 60 and Church's lambdanotation
- Landin
- 1965
(Show Context)
Citation Context ... a higher-order store, the following is yet another implementation of the factorial function using local state. 2sWe start from the following program which realises a recursion by circular references =-=[24]-=-: circFact def = x := λz.if z = 0 then 1 else z × (!x)(z − 1) This program calculates the factorial of n. But since x is free in circFact, if a program reads from x and stores it in another variable, ... |

119 | Comparing Object Encodings
- Bruce, Cardelli, et al.
- 1999
(Show Context)
Citation Context ...m an ideal target for formal validation of programs’ properties on a rigorous semantic basis. Further, given expressive power of imperative higher-order functions (attested by encodability of objects =-=[10, 40, 41]-=- and of low-level idioms [1]), a study of logics for these languages may have wide repercussions on logics of programming languages in general. These languages combine higher-order functions and imper... |

116 |
A fully abstract game semantics for general references
- Abramsky, Honda, et al.
- 1998
(Show Context)
Citation Context ...servational semantics (Morris-like contextual congruence) or the equivalent models (so-called fully abstract models) as a basis of our logic. Another significant point is that the game-based model in =-=[4]-=- is the only known model satisfying this (full abstraction) criteria, whose morphisms are isomorphic to a class of typed π-calculus processes [21]. The presented “operational” model is hinted at by, a... |

110 | Operational reasoning in functions with local state
- Pitts, Stark
- 1998
(Show Context)
Citation Context ...ed argument, it calculates the factorial f x, and stores the new pair. The reason why memFact behaves indistinguishably from the pure factorial is tantamount to the following local invariant property =-=[44]-=-. Throughout all possible invocations of this procedure, the content of b is the factorial of the content of a. Such local invariants capture one of the basic patterns in programming with local state,... |

99 |
Toward fully abstract semantics for local variables
- Meyer, Sieber
- 1988
(Show Context)
Citation Context ...d graphs which may possibly store higher-order values [40]. Difficulties in formal reasoning about shared (possibly higher-order) local store, both axiomatic and otherwise, have been well-known since =-=[15, 31, 33]-=-. Thirdly, and related to the previous two points, local references can be used for efficient implementation of highly regular observable behaviour, for example purely functional behaviour, through in... |

89 | An overview of the FLINT/ML compiler
- Shao
- 1997
(Show Context)
Citation Context ...ion of programs’ properties on a rigorous semantic basis. Further, given expressive power of imperative higher-order functions (attested by encodability of objects [8, 35, 36] and of low-level idioms =-=[45]-=-), a study of logics for these languages may have wide repercussions on logics of programming languages in general. These languages [1, 2] directly combine higher-order functions and imperative featur... |

88 | The HOL logic
- Pitts
- 1993
(Show Context)
Citation Context ...not been treated in Dynamic Logic, even though we believe part of the proposed method to treat higher-order functions would work consistently in their framework. Evaluation Logic, introduced by Pitts =-=[50]-=- and studied by Moggi [39, 40], is a typed logic for higher-order programs based on the metalanguage for computational monads which permits statements about the evaluation of programs to values using ... |

77 |
Jerzy Tiuryn. Dynamic Logic
- Harel, Kozen
- 2000
(Show Context)
Citation Context ...ot allow procedure parameters and general reference creation. No work mentioned in this section studies local invariance in the context of program logics. Dynamic and Evaluation Logics. Dynamic Logic =-=[16]-=-, introduced by Pratt [52] and studied by Harel and others [15], uses programs and predicates on them as part of formulae, facilitating detailed specification of various programs properties such as (n... |

66 | F.;Nipkow, T.: Proving Pointer Programs in Higher-Order Logic
- Mehta
- 2005
(Show Context)
Citation Context ...haracterisation of the support by the swapping operation may lead to deeper understanding of axiomatisations of reachability. There are mechanisation of Hoare logics in higher-order logics, including =-=[11, 29, 38]-=-. While these works do discuss some aspects of imperative programs the proposed logic treats (such as pointer-based data structures), none so far may offer a general assertion method and compositional... |

64 | Polymorphism and separation in Hoare Type Theory
- Nanevski, Morrisett, et al.
- 2006
(Show Context)
Citation Context ...ssert and validate examples treated in § 5 and § 6. It is an interesting future topic to examine the use of higher-order predicate abstraction in the present logic. Other Hoare Logics. Nanevski et al =-=[36]-=- studies Hoare Type Theory (HTT) which combines dependent types and Hoare triples with anchors based on monadic understanding of computation. HTT aims to provide an effective general framework which u... |

61 |
Introduction to generalized type systems
- Barendregt
- 1991
(Show Context)
Citation Context ...n assume that the table stored in x contains pairs of isomorphic nodes. This is no longer so for graphCopy since it now contains 4 If we are to use the implicit (a la Curry) typing for programs as in =-=[5]-=-, we would assert for the untyped version of graphCopy simply by ∀X.graphcopy[X](u), in which case we have the (strict) implication ∀X.graphcopy[X](u) ⊃ graphcopy[α](u). 30sfresh nodes with temporary ... |

60 | A proof theory for generic judgments
- Miller, Tiu
- 2005
(Show Context)
Citation Context ...ory of permutations. The key syntactic additions are the (interdefinable) “fresh” quantifierN and the freshness predicate #, 35smediated by the swapping (finite permutation) predicate. Miller and Tiu =-=[32]-=- are motivated by the significance of generic (or eigen-) variables and quantifiers at the level of both formulae and sequents, and splits universal quantification in two, introduce a selfdual freshne... |

58 | Semantics of separation-logic typing and higher-order frame rules
- Birkedal, Torp-Smith, et al.
- 2005
(Show Context)
Citation Context ... the in-place reversal of a linear list as an example. Following the method in Section 6, a tractable reasoning is possible for such an example using reachability combined with [Inv]. Birkedal et al. =-=[8]-=- present a “separation logic typing” for a variant of Idealised Algol where types are constructed from formulae of disjunction-free separation logic. The typing system uses the subtyping calculated vi... |

56 | BI-hyperdoctrines, higher-order separation logic, and abstraction
- Biering, Birkedal, et al.
(Show Context)
Citation Context ...ised Algol where types are constructed from formulae of disjunction-free separation logic. The typing system uses the subtyping calculated via categorical semantics, on which their study focusses. In =-=[7]-=-, they extend the original separation logic with higher-order predicates, and demonstrate how the extension helps modular reasoning on priority queues. Both of these works treat neither exportable fre... |

55 |
Names and Higher-Order Functions
- Stark
- 1994
(Show Context)
Citation Context ... Such local invariants capture one of the basic patterns in programming with local state, and play a key role in the preceding studies on operational reasoning of program equivalence with local state =-=[21, 42, 44, 50]-=-. Can we distill this principle axiomatically and use it for effectively validating properties of higher-order programs with local state, such as memFact? As a further example of local invariant, but ... |

53 |
Verifying reachability invariants of linked structures
- Nelson
- 1983
(Show Context)
Citation Context ...n. We shall show that this predicate is fully axiomatisable using (in)equality when it only involves first-order data types (the 3sresult is closely related with known axiomatisations of reachability =-=[37]-=-). However we shall also show that the predicate becomes undecidable in itself when higher-order types are involved, indicating its inherent intractability. A good news is, however, this predicate ena... |

52 | Verification of non-functional programs using interpretations in type theory
- Filliâtre
- 2003
(Show Context)
Citation Context ...haracterisation of the support by the swapping operation may lead to deeper understanding of axiomatisations of reachability. There are mechanisation of Hoare logics in higher-order logics, including =-=[11, 29, 38]-=-. While these works do discuss some aspects of imperative programs the proposed logic treats (such as pointer-based data structures), none so far may offer a general assertion method and compositional... |

52 |
Certified assembly programming with embedded code pointers
- Ni, Shao
- 2006
(Show Context)
Citation Context ...haracterisation of the support by the swapping operation may lead to deeper understanding of axiomatisations of reachability. There are mechanisation of Hoare logics in higher-order logics, including =-=[11, 29, 38]-=-. While these works do discuss some aspects of imperative programs the proposed logic treats (such as pointer-based data structures), none so far may offer a general assertion method and compositional... |

48 |
Idealized Algol and its specification logic
- Reynolds
- 1982
(Show Context)
Citation Context ...n reach the reference named by e2 from a datum denoted by e1. As an example, if x denotes a starting point of a linked list, x ↩→ y says a reference y occurs in one of the cells reachable from x. y#x =-=[13, 47]-=- is the negation of x ↩→ y, which says: One can never reach a reference y starting from a datum denoted by x. Convention. Logical connectives are used with standard precedence/association, using paren... |

48 | A variable typed logic of effects
- Honsell, Mason, et al.
- 1995
(Show Context)
Citation Context ...dition of studying equivalences over higher-order programs with local state. Meyer and Sieber [27] present examples and reasoning principles based on denotational semantics. Mason, Talcott and others =-=[21, 24, 25]-=- investigate equational axioms for an untyped version of the language treated in the present paper, including local invariance. Pitts and Stark [37, 39, 46] present powerful operational reasoning prin... |

46 |
Small bisimulations for reasoning about higher-order imperative programs
- Koutavas, Wand
- 2006
(Show Context)
Citation Context ... Such local invariants capture one of the basic patterns in programming with local state, and play a key role in the preceding studies on operational reasoning of program equivalence with local state =-=[21, 42, 44, 50]-=-. Can we distill this principle axiomatically and use it for effectively validating properties of higher-order programs with local state, such as memFact? As a further example of local invariant, but ... |

43 | Verifying properties of well-founded linked lists
- Lahiri, Qadeer
- 2006
(Show Context)
Citation Context ...nerated references. Hoare Logics (2): Reachability. A seminal work by Nelson [37] first presented the use of reachability predicates for reasoning about linked lists. Based on [37], Lahiri and Qadeer =-=[23]-=- study a tractable axiomatisation of cyclic lists and apply the resulting axiomatisation to the development of a VC generator/checker for a first-order procedural language. The key idea in their axiom... |

43 | Abstract Predicates and Mutable ADTs in Hoare Type Theory
- Nanevski, Ahmed, et al.
- 2007
(Show Context)
Citation Context ... represent assertions and validate the examples in § 6. Examining the use of higherorder predicate abstraction in the present logic is an interesting future topic. Other Hoare Logics. Nanevski et al. =-=[32, 33]-=- study Hoare Type Theory (HTT) which combines dependent types and Hoare triples with anchors based on monadic understanding of computation. HTT aims to provide an effective general framework which uni... |

42 | A Bisimulation for Dynamic Sealing
- Sumii, Pierce
- 2007
(Show Context)
Citation Context ...ent powerful operationally-based reasoning principles for the same language as the present work treats, with the reasoning principle for local invariants for higher-order types [44]. Sumii and Pierce =-=[51]-=- present a fully abstract bisimulation technique for equational reasoning on higher-order functions with dynamic sealing and type abstraction. Their bisimulations are parameterised by related seals, w... |

39 | An observationally complete program logic for imperative higher-order frame rules
- Honda, Yoshida, et al.
- 2005
(Show Context)
Citation Context ...{ν#ab.(E1a∧ E1b)} (3, LetRef) 5.{T}m•()=u{ν#ab.(E1a∧ E1b)} ⊃ {T}m•()=u{Fact(u)} (⋆) 6.{T} memFact :u {Fact(u)} (4, 5, ConsEval) 18sLine 2 used {C} f • x=y{C1∧C2}@ ˜w⊃∧i=1,2{C} f • x = y{Ci}@ ˜w (from =-=[6, 20]-=-). (⋆) in Line 5 is by (AIH) in Proposition 14. 5.3 Information Hiding (2): Stored Circular Procedures We next consider circFact from Introduction, which uses a self-recursive higher-order local store... |

38 | Enhancing the Pre- and Postcondition Technique for More Expressive Specifications
- Leavens, Leavens, et al.
- 1999
(Show Context)
Citation Context ...ent logic is an interesting future topic. Other Hoare Logics. Names have been used in Hoare logic since early work by Kowaltowski [28], and are found in the work by von Oheimb [60], Leavens and Baker =-=[30]-=- and Abadi and Leino [3], for treating parameter passing and return values. These works do not treat higher-order procedures and data types, which are uniformly captured in the present logic along wit... |

35 |
A spatial logic for concurrency
- Cardelli, Caires
- 2001
(Show Context)
Citation Context ...nts a situation where l is hidden and u denotes a function which increments and returns the content of l; whereas M ′ is the result of taking off this hiding, exposing the originally local state, cf. =-=[9]-=-. Note that even the type of x is a reference type, ∀x.C substantially differs from νx.C. The former says that for any reference x, which can be either (1) an existing free reference; (2) an existing ... |

35 |
Process logic
- Pratt
- 1979
(Show Context)
Citation Context ...ers and general reference creation. No work mentioned in this section studies local invariance in the context of program logics. Dynamic and Evaluation Logics. Dynamic Logic [16], introduced by Pratt =-=[52]-=- and studied by Harel and others [15], uses programs and predicates on them as part of formulae, facilitating detailed specification of various programs properties such as (non-)termination, or more i... |

32 | Reasoning about local variables with operationally-based logical relations. LICS
- Pitts
- 1996
(Show Context)
Citation Context ... Such local invariants capture one of the basic patterns in programming with local state, and play a key role in the preceding studies on operational reasoning of program equivalence with local state =-=[21, 42, 44, 50]-=-. Can we distill this principle axiomatically and use it for effectively validating properties of higher-order programs with local state, such as memFact? As a further example of local invariant, but ... |

30 | References, local variables and operational reasoning
- Mason, Talcott
- 1992
(Show Context)
Citation Context ...late the factorial is precisely because x stores this very behaviour. We shall show a general reasoning principle for local invariants which can verify properties of these two and many other examples =-=[21, 27, 28, 31, 42, 44]-=-, including mutually recursive multiple stored functions. Program Logic for Imperative Higher-Order Functions. Starting from their origins in the λ-calculus, typed higher-order functional programming ... |

29 | Observational purity and encapsulation
- Naumann
- 2007
(Show Context)
Citation Context ...ot affect M during evaluation of L in M. Note that values are always functional terms. In a context of reasoning for object-oriented languages, a similar formulation (called strong purity) is used in =-=[44]-=- for justifying the semantics of method invocations whose evaluation has no effect on the state of existing objects.18 YOSHIDA, HONDA AND BERGER Now we define: Dually, we have: M |= ∀x.C def ≡ ∀L ∈ F... |

27 | Local reasoning, separation and aliasing
- Bornat, Calcagno, et al.
- 2004
(Show Context)
Citation Context ...er we can apply their ideas on effective axiomatisation or mechanisation to a large class of mutable data structures treatable in our method. Hoare Logics (3): Separation Reynolds, O’Hearn and others =-=[9, 39, 48]-=- study a reasoning method for dynamically generated and deallocated mutable data structures using a spacial conjunction, C ∗C ′ . Taking the tree copy in § 6.2 (which is from [48]), they start from a ... |

26 | A compositional logic for polymorphic higher-order functions
- Honda, Yoshida
- 2004
(Show Context)
Citation Context ...nested reference types. • Dynamically generated local references and scope exclusion. In our preceding studies, we presented Hoare logics for the core parts of ML which capture the first two features =-=[6, 17, 19, 20]-=-. On the basis of these works, the present work introduces an extension of Hoare logic for ML-like local reference generation. As noted above, this construct radically enriches programs’ behaviour, an... |

26 | Inferring the equivalence of functional program that mutate data, Theoretical Computer Science 105
- Mason, Talcott
- 1992
(Show Context)
Citation Context ...late the factorial is precisely because x stores this very behaviour. We shall show a general reasoning principle for local invariants which can verify properties of these two and many other examples =-=[21, 27, 28, 31, 42, 44]-=-, including mutually recursive multiple stored functions. Program Logic for Imperative Higher-Order Functions. Starting from their origins in the λ-calculus, typed higher-order functional programming ... |