Putting Theories Together to Make Specifications
Proving Theorems about LISP Functions