using procedures plus ensures instead of functions with axioms