Thm* M1,M2:MsgA.
Thm* M1 M2
Thm* 
Thm* ( k:Knd, l:IdLnk, tg:Id.
Thm* (M2.sframe(k sends <l,tg>)  M1.sframe(k sends <l,tg>)) | [ma-sframe-sub] |
Thm* M1,M2:MsgA.
Thm* M1 M2  ( k:Knd, x:Id. M2.frame(k affects x)  M1.frame(k affects x)) | [ma-frame-sub] |
Thm* M1,M2:MsgA.
Thm* M1 M2
Thm* 
Thm* ( k:Knd, l:IdLnk, s:M2.state, v:M2.da(k), i:Id, ms:(tg:Id
Thm* ( k:Knd, l:IdLnk, s:M2.state, v:M2.da(k), i:Id, ms:( if source(l) = i
Thm* ( k:Knd, l:IdLnk, s:M2.state, v:M2.da(k), i:Id, ms:( if M2.da(rcv(l; tg))
Thm* ( k:Knd, l:IdLnk, s:M2.state, v:M2.da(k), i:Id, ms:( else Top fi) List.
Thm* (M2.send(k;l;s;v;ms;i)  M1.send(k;l;s;v;ms;i)) | [ma-send-sub] |
Thm* M1,M2:MsgA.
Thm* M1 M2
Thm* 
Thm* ( k:Knd, x:Id, s:M2.state, v:M2.da(k), w:M2.ds(x).
Thm* (M2.ef(k,x,s,v,w)  M1.ef(k,x,s,v,w)) | [ma-ef-sub] |
Thm* M1,M2:MsgA.
Thm* M1 M2
Thm* 
Thm* ( a:Id, s:M2.state.
Thm* (a declared in M1  unsolvable M2.pre(a,s)  unsolvable M1.pre(a,s)) | [ma-npre-sub] |
Thm* M1,M2:MsgA. M1 M2  ( a:Id. a declared in M1  a declared in M2) | [ma-decla-sub] |
Thm* M1,M2:MsgA.
Thm* M1 M2
Thm* 
Thm* ( a:Id, s:M2.state, v:M2.da(locl(a)). M2.pre(a,s,v)  M1.pre(a,s,v)) | [ma-pre-sub] |
Thm* V:(Id Type), M1,M2:MsgA.
Thm* ( x:Id. V(x) r M2.ds(x))
Thm* 
Thm* M1 M2  ( x:Id, v:V(x). M2.init(x,v)  M1.init(x,v)) | [ma-init-sub] |
Thm* M1,M2:MsgA, k:Knd. M1 M2  (M2.da(k) r M1.da(k)) | [ma-da-sub] |
Thm* M1,M2:MsgA, x:Id. M1 M2  (M2.ds(x) r M1.ds(x)) | [ma-ds-sub] |
Thm* x,y:Id, k:Knd, A,B,T:Type, f:(A B T A).
Thm* y = x  ma-single-effect1(x;A;y;B;k;T;f) MsgA | [ma-single-effect1_wf] |
Thm* M1,M2:MsgA. M1 || M2  M2 M1 M2 | [ma-sub-join-right] |
Thm* M1,M2:MsgA. M1 || M2  M2 || M1 | [ma-compatible-symmetry] |
Thm* ds,ds':ltg:Id fp-> Type. ds ds'  State(ds') State(ds) | [ma-state-subtype2] |
Thm* ds,ds':ltg:Id fp-> Type. ds ds'  (State(ds') r State(ds)) | [ma-state-subtype] |
Thm* M1,M2:MsgA. M1 ||decl M2  M1 M2 MsgA | [ma-join_wf] |
Thm* A,B:MsgA. ma-is-empty(A)  A B | [ma-is-empty-sub] |
Thm* M1,M2:MsgA. M1 = M2  M1 M2 | [ma-sub_weakening] |
Thm* M1,M2,M3:MsgA. M1 M2  M2 M3  M1 M3 | [ma-sub_transitivity] |
Thm* ltg:(IdLnk Id Type), i:Id, da1,da2:k:Knd fp-> Type.
Thm* (ltg da-outlinks(da1 da2;i))
Thm* 
Thm* (ltg da-outlinks(da1;i)) (ltg da-outlinks(da2;i)) | [da-outlinks-join] |
Thm* ltg:(IdLnk Id Type), i:Id, k:Knd, T:Type.
Thm* (ltg da-outlinks(k : T;i))
Thm* 
Thm* isrcv(k) & source(lnk(k)) = i
Thm* & (1of(ltg) ~ lnk(k))
Thm* & (1of(2of(ltg)) ~ tag(k))
Thm* & 2of(2of(ltg)) = T | [da-outlinks-single] |
Thm* eq:EqDecider(T), f,g,h:x:T fp-> Type.
Thm* f || g
Thm* 
Thm* h || f
Thm* 
Thm* h || g
Thm* 
Thm* g h f g & f h f g & h g h f g & h f h f g | [fpf-compatible-triple] |
Thm* eq:EqDecider(A), P:(A Type Prop), f,g:x:A fp-> Type.
Thm* y dom(f). w=f(y)  P(y,w)
Thm* 
Thm* y dom(g). w=g(y)  P(y,w)  y dom(f g). w=f g(y)  P(y,w) | [fpf-all-join-decl] |
Thm* eq:EqDecider(A), B:(A Type), f,g,h:a:A fp-> B(a).
Thm* f || h  g || h  f g || h | [fpf-compatible-join2] |
Thm* eq:EqDecider(A), B:(A Type), f,g:a:A fp-> B(a). f || g  g || f | [fpf-compatible-symmetry] |
Thm* eq:EqDecider(A), B:(A Type), f,g,h:a:A fp-> B(a).
Thm* h || f  h || g  h || f g | [fpf-compatible-join] |
Thm* B:(A Type), eq:EqDecider(A), f,g:a:A fp-> B(a). f || g  g f g | [fpf-sub-join-right] |
Thm* B,C:(A Type), eq:EqDecider(A), f:a:A fp-> B(a), g:a:A fp-> C(a), x:A.
Thm* x dom(f)  f g(x) = f(x) B(x) | [fpf-join-ap-left] |
Thm* B:(A Type), eq:EqDecider(A), f,g:a:A fp-> B(a), x:A.
Thm* x dom(f g)  f g(x) = if x dom(f) f(x) else g(x) fi B(x) | [fpf-join-ap] |
Thm* eq:EqDecider(X), f,g:x:X fp-> Type, x:X. f g  (f(x)?Void r g(x)?T) | [subtype-fpf-cap-void] |
Thm* eq:EqDecider(X), f,g:x:X fp-> Type, x:X. g f  (f(x)?T r g(x)?Top) | [subtype-fpf-cap-top] |
Thm* eq:EqDecider(X), f,g:x:X fp-> Type. g f  ( x:X. f(x)?Top r g(x)?Top) | [subtype-fpf-cap] |
Thm* B:(A Type), eq:EqDecider(A), f,g:a:A fp-> B(a). f = g  f g | [fpf-sub_weakening] |
Thm* B:(A Type), eq:EqDecider(A), f,g,h:a:A fp-> B(a). f g  g h  f h | [fpf-sub_transitivity] |
Thm* strong-subtype(A;A')
Thm* 
Thm* ( B:(A Type), C:(A' Type), eq:EqDecider(A), eq':EqDecider(A'),
Thm* ( f,g:a:A fp-> B(a). ( a:A. B(a) r C(a))  f g  f g) | [fpf-sub_functionality] |
Thm* strong-subtype(A;A')
Thm* 
Thm* ( B:(A Type), C:(A' Type), eq:EqDecider(A), eq':EqDecider(A'),
Thm* ( f,g:a:A fp-> B(a). ( a:A. B(a) r C(a))  f g  f g) | [fpf-sub-functionality] |
Thm* eq:EqDecider(A), B:(A Type), x,y:A, v:B(x), u:B(y).
Thm* (x = y  v = u B(x))  x : v || y : u | [fpf-compatible-singles] |
Def PossibleWorld(D;w)
Def == FairFifo
Def == & ( i,x:Id. vartype(i;x) r M(i).ds(x))
Def == & & ( i:Id, a:Action(i).
Def == & & ( isnull(a)  (valtype(i;a) r M(i).da(kind(a))))
Def == & & ( l:IdLnk, tg:Id. (w.M(l,tg)) r M(source(l)).da(rcv(l; tg)))
Def == & & ( i,x:Id. M(i).init(x,s(i;0).x))
Def == & & ( i:Id, t: .
Def == & & ( isnull(a(i;t))
Def == & & (
Def == & & (( islocal(kind(a(i;t)))
Def == & & ((
Def == & & ((M(i).pre(act(kind(a(i;t))), x.s(i;t).x,val(a(i;t))))
Def == & & (& ( x:Id.
Def == & & (& (M(i).ef(kind(a(i;t)),x, x.s(i;t).x,val(a(i;t)),s(i;t+1).x))
Def == & & (& ( l:IdLnk.
Def == & & (& (M(i).send(kind(a(i;t));l; x.
Def == & & (& (s(i;t).x;val(a(i;t));withlnk(l;m(i;t));i))
Def == & & (& ( x:Id.
Def == & & (& ( M(i).frame(kind(a(i;t)) affects x)
Def == & & (& (
Def == & & (& (s(i;t).x = s(i;t+1).x M(i).ds(x))
Def == & & (& ( l:IdLnk, tg:Id.
Def == & & (& ( M(i).sframe(kind(a(i;t)) sends <l,tg>)
Def == & & (& (
Def == & & (& (w-tagged(tg; onlnk(l;m(i;t))) = nil Msg List))
Def == & & ( i,a:Id, t: .
Def == & & ( t': .
Def == & & (t t'
Def == & & (&  isnull(a(i;t')) & kind(a(i;t')) = locl(a)
Def == & & (& a declared in M(i)
Def == & & (& unsolvable M(i).pre(a, x.s(i;t').x)) | [possible-world] |