Thm* A:ioa{i:l}(), I:Fmla, rho:Decl, de:sig(), e:{[[de]] rho}, te:(Label Label  ). tc_ioa(A;de)  ioa_mentions_trace(A)  trace_consistent_pred(rho;A.da;te;I)  guarded_trace(A.da;te;I)  tc_pred(I;A.ds; < > ;de)  covers_pred(A;I)  closed_pred(I)  single_valued_decls(A.ds)  let M = [[A]] rho de e in ( s:M.state, tr:( [[A.da]] rho) List. (M -tr- > s)  [[VCs(A;I)]] rho A.ds A.da de e s mk_trace_env(tr, te))  (M |= always s,tr.[[I]] rho A.ds < > de e s mk_trace_env(tr, te)) | [vc_trace_correctness] |
Thm* A:ioa{i:l}(), I:Fmla, rho:Decl, de:sig(), e:{[[de]] rho}, te:(Label Label  ). tc_ioa(A;de)  ioa_mentions_trace(A)  trace_consistent_pred(rho;A.da;te;I)  tc_pred(I;A.ds; < > ;de)  covers_pred(A;I)  guarded_trace(A.da;te;I)  closed_pred(I)  single_valued_decls(A.ds)  ( s0,x:[[A]] rho de e.state, act:[[A]] rho de e.action, x':[[A]] rho de e.state, tr:( [[A.da]] rho) List. [[A]] rho de e.init(s0)  trace_reachable([[A]] rho de e;s0;mk_trace_env(tr, te).trace;x)  [[I]] rho A.ds < > de e x mk_trace_env(tr, te)  [[A]] rho de e.trans(x,act,x')  (( t:dec(). t A.da & t.lbl = kind(act))  [[I]] rho A.ds < > de e x' tappend(mk_trace_env(tr, te);act))  [[I]] rho A.ds < > de e x' tappend(mk_trace_env(tr, te);act)) | [vc_trace_correct_action_decl_lemma] |
Thm* A:ioa{i:l}(), r:rel(), rho:Decl, de:sig(), e:{[[de]] rho}, a:( [[A.da]] rho), tr:trace_env([[A.da]] rho). tc_ioa(A;de)  ioa_mentions_trace(A)  trace_consistent_rel(rho;A.da;tr.proj;r)  single_valued_decls(A.ds)  ( s,x':[[A]] rho de e.state. tc(r;A.ds; < > ;de)  closed_rel(r)  covers_rel(A;r)  [[A]] rho de e.trans(s,a,x')  ([[r]] rho A.ds < > de e x' tr  [[wp_rel(A;kind(a);r)]] rho A.ds dec_lookup(A.da;kind(a)) de e s value(a) tr)) | [wp_rel_correctness] |
Thm* A:ioa{i:l}(), de:sig(). tc_ioa(A;de)  ioa_mentions_trace(A)  ( Q:Fmla, rho:Decl, e:{[[de]] rho}, a:[[A]] rho de e.action, tr:trace_env([[A.da]] rho). tc_ioa(A;de)  ioa_mentions_trace(A)  trace_consistent_pred(rho;A.da;tr.proj;Q)  single_valued_decls(A.ds)  ( s,x':[[A]] rho de e.state. tc_pred(Q;A.ds; < > ;de)  closed_pred(Q)  covers_pred(A;Q)  [[A]] rho de e.trans(s,a,x')  ([[Q]] rho A.ds < > de e x' tr  [[wp(A;kind(a);Q)]] rho A.ds dec_lookup(A.da;kind(a)) de e s value(a) tr))) | [wp_correctness] |
Thm* A:ioa{i:l}(), de:sig(). tc_ioa(A;de)  ioa_mentions_trace(A)  ( Q:Fmla, rho:Decl, e:{[[de]] rho}, a:[[A]] rho de e.action, tr:trace_env([[A.da]] rho). trace_consistent_pred(rho;A.da;tr.proj;Q)  single_valued_decls(A.ds)  ( s,x':[[A]] rho de e.state. tc_pred(Q;A.ds; < > ;de)  closed_pred(Q)  covers_pred(A;Q)  [[A]] rho de e.trans(s,a,x')  (pred_mng_2(Q; rho; A.ds; < > ; de; e; s; x'; ; tr)  [[wp2(A;kind(a);Q)]] rho A.ds dec_lookup(A.da;kind(a)) de e s value(a) tr))) | [wp2_correctness] |
Thm* A:ioa{i:l}(), r:rel(), rho:Decl, de:sig(), e:{[[de]] rho}, a:( [[A.da]] rho), tr:trace_env([[A.da]] rho). tc_ioa(A;de)  ioa_mentions_trace(A)  trace_consistent_rel(rho;A.da;tr.proj;r)  single_valued_decls(A.ds)  ( s,x':[[A]] rho de e.state. tc(r;A.ds; < > ;de)  closed_rel(r)  covers_rel(A;r)  [[A]] rho de e.trans(s,a,x')  (rel_mng_2(r; rho; A.ds; < > ; de; e; s; x'; ; tr)  [[wp2_rel(A;kind(a);r)]] rho A.ds dec_lookup(A.da;kind(a)) de e s value(a) tr)) | [wp2_rel_correctness] |
Thm* A:ioa{i:l}(), r:rel(), rho:Decl, de:sig(), e:{[[de]] rho}, a:( [[A.da]] rho), tr:trace_env([[A.da]] rho). tc_ioa(A;de)  ioa_mentions_trace(A)  trace_consistent_rel(rho;A.da;tr.proj;r)  single_valued_decls(A.ds)  ( s,x':[[A]] rho de e.state. tc(r;A.ds;dec_lookup(A.da;kind(a));de)  covers_rel(A;r)  [[A]] rho de e.trans(s,a,x')  (rel_mng_2(r; rho; A.ds; dec_lookup(A.da;kind(a)); de; e; s; x'; value(a); tr)  [[wp2_rel(A;kind(a);r)]] rho A.ds dec_lookup(A.da;kind(a)) de e s value(a) tr)) | [wp2_rel_correct] |
Thm* p:Fmla, ds,daa:Collection(dec()), da:Collection(SimpleType), de:sig(), rho:Decl, e:{[[de]] rho}, s,s':{[[ds]] rho}, a:[[da]] rho, tr:trace_env([[daa]] rho). trace_consistent_pred(rho;daa;tr.proj;p)  tc_pred(p;ds;da;de)  (pred_mng_2(pred_unprime(p); rho; ds; da; de; e; s; s'; a; tr)  [[p]] rho ds da de e s a tr) | [pred_mng2_unprime] |
Thm* p:Fmla, ds,daa:Collection(dec()), da:Collection(SimpleType), de:sig(), rho:Decl, e:{[[de]] rho}, s,s':{[[ds]] rho}, a:[[da]] rho, tr:trace_env([[daa]] rho). trace_consistent_pred(rho;daa;tr.proj;p)  tc_pred(p;ds;da;de)  (pred_mng_2((p)'; rho; ds; da; de; e; s; s'; a; tr)  [[p]] rho ds da de e s' a tr) | [pred_mng2_addprime] |
Thm* p:Fmla, rho:Decl, ds,daa:Collection(dec()), da1,da2:Collection(SimpleType), de:sig(), s:{[[ds]] rho}, e:{[[de]] rho}, a1,a2:Top, tr:trace_env([[daa]] rho). trace_consistent_pred(rho;daa;tr.proj;p)  tc_pred(p;ds;da1;de)  closed_pred(p)  ([[p]] rho ds da1 de e s a1 tr  [[p]] rho ds da2 de e s a2 tr) | [closed_pred_mng] |
Thm* p1,p2:Fmla, ds1,ds2,daa:Collection(dec()), da1,da2:Collection(SimpleType), de:sig(), rho:Decl, e:{[[de]] rho}, s:{[[ds1]] rho}, a:[[da1]] rho, tr:trace_env([[daa]] rho). trace_consistent_pred(rho;daa;tr.proj;p1)  tc_pred(p1;ds1;da1;de)  p1 = p2  ds1 = ds2  da1 = da2  ([[p1]] rho ds1 da1 de e s a tr  [[p2]] rho ds2 da2 de e s a tr) | [pred_mng_functionality] |
Def vc_mng(v;rho;ds;da;de;e;s;tr) == Case(v) Case vc_imp(hc) = > [[hc.hyp]] rho ds < > de e s mk_trace_env(nil, tr.proj)  [[hc.concl]] rho ds < > de e s mk_trace_env(nil, tr.proj) Case vc_qimp(qhc) = > v:[[dec_lookup(da;qhc.lbl)]] rho. [[qhc.hyp]] rho ds dec_lookup(da;qhc.lbl) de e s v tr  [[qhc.concl]] rho ds dec_lookup(da;qhc.lbl) de e s v tappend(tr; < qhc.lbl,v > ) Default = > False | [vc_mng] |
Def [[A]] rho de e == mk_sm([[A.da]] rho, [[A.ds]] rho, s.[[A.init]] rho A.ds < > de e s niltrace(), s1,a,s2. ( p:pre(). p A.pre  p.kind = kind(a)  [[p.rel]] rho A.ds dec_lookup(A.da;kind(a)) de e s1 value(a) niltrace()) & ( ef:eff(). ef A.eff  ef.kind = kind(a)  s2.ef.smt.lbl = [[ef.smt.term]] 1of(e) s1 value(a) niltrace() [[ef.smt.typ]] rho) & ( fr:frame(). fr A.frame  (kind(a) fr.acts)  s2.fr.var = s1.fr.var [[fr.typ]] rho)) | [ioa_mng] |