Allan M. Stavely Verifying Definite Iteration Over Data Structures. 506-514 http://doi.ieeecomputersociety.org/10.1109/32.391377 1995 21 IEEE Trans. Software Eng. 6 db/journals/tse/tse21.html#Stavely95