es:ES, X:AbsInterface(Top), f:(E(X)E(X)).
(x:E(X). f(x) c x)  (e:E(X). ((f(e) = e  E))  (f**(e) < e)) 

latex

Definitions

(e < e'), x:AB(x), x:A. B(x), s = t, t  T, strong-subtype(A;B), P  Q, ES, AbsInterface(A), E(X), A, left + right, P  Q, f(a), EState(T), a:A fp B(a), Id, , Type, EqDecider(T), Unit, IdLnk, x:A  B(x), EOrderAxioms(E; pred?; info), kindcase(k; a.f(a); l,t.g(l;t) ), Knd, loc(e), kind(e), Msg(M), type List, , val-axiom(E;V;M;info;pred?;init;Trans;Choose;Send;val;time), r  s, e < e', , b, constant_function(f;A;B), SWellFounded(R(x;y)), , pred!(e;e'), x,y. t(x;y), <a, b>, pred(e), first(e), x. t(x), P & Q, Top, E, {x:A| B(x)} , let x,y = A in B(x;y), t.1, False, sender(e), e loc e' , (e <loc e'), Void, (x  l), f**(e), e c e', P  Q

Lemmas

es-fix-equal, es-interface wf, false wf, event system wf, es-causle wf, es-E-interface-subtype rel, es-E wf, es-E-interface wf, deq wf, EOrderAxioms wf, IdLnk wf, Msg wf, unit wf, nat wf, val-axiom wf, qle wf, cless wf, bool wf, top wf, Knd wf, kindcase wf, constant function wf, assert wf, not wf, loc wf, pred! wf, strongwellfounded wf, member wf, rationals wf, Id wf, EState wf, subtype rel wf, es-fix-causle, es-causl wf