type Field a, Heap = [ref, Field a]a; function f([b, Field a]a) returns (int); axiom (forall x:[int, Field a]a :: f(x) == 17); axiom (forall x:[ref, Field a]a :: f(x) == 42); procedure P() returns () { var h : Heap, g : [bool, Field a]a; assert f(h) == 42; assert f(g) >= 0; // should not be provable } type ref; const null : ref;