Verifying higher-order programs with the dijkstra monad
Dafny: An automatic program verifier for functional correctness