Modular verification of higher-order methods with mandatory calls specified by model programs رسالة ماجستير