[Haskell-cafe] use of models in proving program properties