3.3.1 Guarded Recursive Specifications