5.4.1 Guarded Recursive Specifications