Thm* M1,M2:MsgA.
Thm* M1 M2
Thm* 
Thm* ( k:Knd, l:IdLnk, tg:Id.
Thm* (M2.sframe(k sends <l,tg>)  M1.sframe(k sends <l,tg>)) | [ma-sframe-sub] |
Thm* M1,M2:MsgA.
Thm* M1 M2  ( k:Knd, x:Id. M2.frame(k affects x)  M1.frame(k affects x)) | [ma-frame-sub] |
Thm* M1,M2:MsgA.
Thm* M1 M2
Thm* 
Thm* ( k:Knd, l:IdLnk, s:M2.state, v:M2.da(k), i:Id, ms:(tg:Id
Thm* ( k:Knd, l:IdLnk, s:M2.state, v:M2.da(k), i:Id, ms:( if source(l) = i
Thm* ( k:Knd, l:IdLnk, s:M2.state, v:M2.da(k), i:Id, ms:( if M2.da(rcv(l; tg))
Thm* ( k:Knd, l:IdLnk, s:M2.state, v:M2.da(k), i:Id, ms:( else Top fi) List.
Thm* (M2.send(k;l;s;v;ms;i)  M1.send(k;l;s;v;ms;i)) | [ma-send-sub] |
Thm* M1,M2:MsgA.
Thm* M1 M2
Thm* 
Thm* ( k:Knd, x:Id, s:M2.state, v:M2.da(k), w:M2.ds(x).
Thm* (M2.ef(k,x,s,v,w)  M1.ef(k,x,s,v,w)) | [ma-ef-sub] |
Thm* M1,M2:MsgA.
Thm* M1 M2
Thm* 
Thm* ( a:Id, s:M2.state.
Thm* (a declared in M1  unsolvable M2.pre(a,s)  unsolvable M1.pre(a,s)) | [ma-npre-sub] |
Thm* M1,M2:MsgA. M1 M2  ( a:Id. a declared in M1  a declared in M2) | [ma-decla-sub] |
Thm* M1,M2:MsgA.
Thm* M1 M2
Thm* 
Thm* ( a:Id, s:M2.state, v:M2.da(locl(a)). M2.pre(a,s,v)  M1.pre(a,s,v)) | [ma-pre-sub] |
Thm* V:(Id Type), M1,M2:MsgA.
Thm* ( x:Id. V(x) r M2.ds(x))
Thm* 
Thm* M1 M2  ( x:Id, v:V(x). M2.init(x,v)  M1.init(x,v)) | [ma-init-sub] |
Thm* M1,M2:MsgA, k:Knd. M1 M2  (M2.da(k) r M1.da(k)) | [ma-da-sub] |
Thm* M1,M2:MsgA, x:Id. M1 M2  (M2.ds(x) r M1.ds(x)) | [ma-ds-sub] |
Thm* a:Id, T,A:Type, x:Id, P:(A T Prop).
Thm* ma-single-pre1(x;A;a;T;x,v.P(x,v)) MsgA | [ma-single-pre1_wf] |
Thm* a:Id, T:Type, ds:x:Id fp-> Type, P:(State(ds) T Prop).
Thm* (with ds: ds action a:T precondition a(v) is P s v) MsgA | [ma-single-pre_wf] |
Thm* x,y:Id, k:Knd, A,B,T:Type, f:(A B T A).
Thm* y = x  ma-single-effect1(x;A;y;B;k;T;f) MsgA | [ma-single-effect1_wf] |
Thm* x:Id, k:Knd, A,T:Type, f:(A T A). ma-single-effect0(x;A;k;T;f) MsgA | [ma-single-effect0_wf] |
Thm* x:Id, k:Knd, ds:x:Id fp-> Type, da:a:Knd fp-> Type,
Thm* f:(State(ds) ma-valtype(da; k) ds(x)?Void).
Thm* ma-single-effect(ds; da; k; x; f) MsgA | [ma-single-effect_wf] |
Thm* l:IdLnk, tg:Id, L:Knd List. only L sends on (l with tg) MsgA | [ma-single-sframe_wf] |
Thm* x:Id, L:Knd List, t:Type. only members of L affect x :t MsgA | [ma-single-frame_wf] |
Thm* x:Id, t:Type, v:t. x : t initially x = v MsgA | [ma-single-init_wf] |
Thm* A:MsgA. A || | [ma-empty-compatible-right] |
Thm* A:MsgA. || A | [ma-empty-compatible-left] |
Thm* M1,M2:MsgA. M1 || M2  M2 M1 M2 | [ma-sub-join-right] |
Thm* M1,M2:MsgA. M1 || M2  M2 || M1 | [ma-compatible-symmetry] |
Thm* M1,M2:MsgA. M1 || M2 Prop{i'} | [ma-compatible_wf] |
Thm* M1,M2:MsgA. M1 M1 M2 | [ma-sub-join-left] |
Thm* M1,M2:MsgA. M1 ||decl M2  M1 M2 MsgA | [ma-join_wf] |
Thm* A,B:MsgA. ma-is-empty(A)  A B | [ma-is-empty-sub] |
Thm* M:MsgA. M | [ma-empty-sub] |
Thm* M:MsgA. ma-is-empty(M)  M = MsgA | [assert-ma-is-empty] |
Thm* M:MsgA. ma-is-empty(M)  | [ma-is-empty_wf] |
Thm* MsgA | [ma-empty_wf] |
Thm* M1,M2:MsgA. M1 = M2  M1 M2 | [ma-sub_weakening] |
Thm* M1,M2,M3:MsgA. M1 M2  M2 M3  M1 M3 | [ma-sub_transitivity] |
Thm* M1,M2:MsgA. M1 M2 Prop{i'} | [ma-sub_wf] |
Thm* M:MsgA, k:Knd, l:IdLnk, tg:Id. M.sframe(k sends <l,tg>) Prop | [ma-sframe_wf] |
Thm* M:MsgA, k:Knd, x:Id. M.frame(k affects x) Prop | [ma-frame_wf] |
Thm* M:MsgA, l:IdLnk. M sends on link l  | [ma-sends-on_wf] |
Thm* M:MsgA, k:Knd, l:IdLnk, s:M.state, v:M.V(k), i:Id, ms:(tg:Id
Thm* M:MsgA, k:Knd, l:IdLnk, s:M.state, v:M.V(k), i:Id, ms:( if source(l) = i
Thm* M:MsgA, k:Knd, l:IdLnk, s:M.state, v:M.V(k), i:Id, ms:( if M.da(rcv
Thm* M:MsgA, k:Knd, l:IdLnk, s:M.state, v:M.V(k), i:Id, ms:( if (l; tg))
Thm* M:MsgA, k:Knd, l:IdLnk, s:M.state, v:M.V(k), i:Id, ms:( else Top fi) List.
Thm* M.send(k;l;s;v;ms;i) Prop | [ma-send_wf] |
Thm* M:MsgA, k:Knd, s:M.state, v:M.da(k), x:Id, w:M.ds(x).
Thm* M.ef(k,x,s,v,w) Prop | [ma-ef_wf] |
Thm* M:MsgA, a:Id, s:M.state, v:M.da(locl(a)). M.pre(a,s,v) Prop | [ma-pre_wf] |
Thm* M:MsgA, a:Id, s:M.state. unsolvable M.pre(a,s) Prop | [ma-npre_wf] |
Thm* M:MsgA, k:Knd. M.V(k) Type | [ma-v_wf] |
Thm* M:MsgA. M.state Type | [ma-st_wf] |
Thm* M:MsgA, x:Id, v:M.ds(x). M.init(x,v) Prop | [ma-init_wf] |
Thm* M:MsgA, l:IdLnk, tg:Id. M.dout(l,tg) Type | [ma-dout_wf] |
Thm* M:MsgA, l:IdLnk, tg:Id. M.din(l,tg) Type | [ma-din_wf] |
Thm* M:MsgA, a:Knd. M.da(a) Type | [ma-da_wf] |
Thm* M:MsgA, i:Id. ma-outlinks(M;i) (IdLnk Id Type) List | [ma-outlinks_wf] |
Thm* M:MsgA, a:Id. a declared in M Prop | [ma-decla_wf] |
Thm* M:MsgA, x:Id. M.ds(x) Type | [ma-ds_wf] |
Def Dsys == Id MsgA | [dsys] |