PROVING A COMPUTER CORRECT IN HIGHER ORDER LOGIC