Re: [Haskell-cafe] use of models in proving program properties