Who Cites R safety?
R_safety	Def safetyR(E)(tr_1,tr_2) == tr_2 tr_1
	Thm* E:EventStruct. safetyR(E) (|E| List)(|E| List)Prop
event_str	Def EventStruct == E:TypeM:MessageStruct(E|M|)(ELabel)(E)Top
	Thm* EventStruct Type{i'}
message_str	Def MessageStruct == M:TypeC:DecidableEquiv(M|C|)(MLabel)(M)Top
	Thm* MessageStruct Type{i'}
carrier	Def |S| == 1of(S)
	Thm* S:Structure. |S| Type
induced_event_str	Def induced_event_str(E;A;f) == < A,MS(E),msg(E) o f,loc(E) o f,is-send(E) o f, >
	Thm* E:EventStruct, A:Type, f:(A|E|). induced_event_str(E;A;f) EventStruct
map	Def map(f;as) == Case of as; nil nil ; a.as' [(f(a)) / map(f;as')] (recursive)
	Thm* A,B:Type, f:(AB), l:A List. map(f;l) B List
	Thm* A,B:Type, f:(AB), l:A List. map(f;l) B List
iseg	Def l1 l2 == l:T List. l2 = (l1 @ l)
	Thm* T:Type, l1,l2:T List. l1 l2 Prop
event_is_snd	Def is-send(E) == 1of(2of(2of(2of(2of(E)))))
	Thm* E:EventStruct. is-send(E) |E|
event_loc	Def loc(E) == 1of(2of(2of(2of(E))))
	Thm* E:EventStruct. loc(E) |E|Label
event_msg	Def msg(E) == 1of(2of(2of(E)))
	Thm* E:EventStruct. msg(E) |E||MS(E)|
event_msg_str	Def MS(E) == 1of(2of(E))
	Thm* E:EventStruct. MS(E) MessageStruct
pi1	Def 1of(t) == t.1
	Thm* A:Type, B:(AType), p:(a:AB(a)). 1of(p) A
dequiv	Def DecidableEquiv == T:TypeE:TTEquivRel(T)((_1 E _2))Top
	Thm* DecidableEquiv Type{i'}
top	Def Top == Void given Void
	Thm* Top Type
lbl	Def Label == {p:Pattern| ground_ptn(p) }
	Thm* Label Type
compose	Def (f o g)(x) == f(g(x))
	Thm* A,B,C:Type, f:(BC), g:(AB). f o g AC
append	Def as @ bs == Case of as; nil bs ; a.as' [a / (as' @ bs)] (recursive)
	Thm* T:Type, as,bs:T List. (as @ bs) T List
ground_ptn	Def ground_ptn(p) == Case(p) Case ptn_var(v) = > false Case ptn_pr( < x, y > ) = > ground_ptn(x)ground_ptn(y) Default = > true (recursive)
	Thm* p:Pattern. ground_ptn(p)
assert	Def b == if b True else False fi
	Thm* b:. b Prop
ptn	Def Pattern == rec(T.ptn_con(T))
	Thm* Pattern Type
pi2	Def 2of(t) == t.2
	Thm* A:Type, B:(AType), p:(a:AB(a)). 2of(p) B(1of(p))
case_default	Def Default = > body(value,value) == body
band	Def pq == if p q else false fi
	Thm* p,q:. (pq)
case_lbl_pair	Def Case ptn_pr( < x, y > ) = > body(x;y) cont(x1,z) == InjCase(x1; _. cont(z,z); x2. InjCase(x2; _. cont(z,z); x2@0. InjCase(x2@0; _. cont(z,z); x2@1. x2@1/x3,x2@2. body(x3;x2@2))))
case_ptn_var	Def Case ptn_var(x) = > body(x) cont(x1,z) == (x1.inr(x2) = > (x1.inr(x2) = > (x1.inl(x2) = > body(hd([x2 / tl(x1)])) cont(hd(x1),z))([x2 / tl(x1)]) cont (hd(x1) ,z)) ([x2 / tl(x1)]) cont (hd(x1) ,z)) ([x1])
case	Def Case(value) body == body(value,value)
ptn_con	Def ptn_con(T) == Atom++Atom+(TT)
	Thm* T:Type. ptn_con(T) Type
equiv_rel	Def EquivRel x,y:T. E(x;y) == Refl(T;x,y.E(x;y)) & Sym x,y:T. E(x;y) & Trans x,y:T. E(x;y)
	Thm* T:Type, E:(TTProp). (EquivRel x,y:T. E(x,y)) Prop
hd	Def hd(l) == Case of l; nil "?" ; h.t h
	Thm* A:Type, l:A List. ||l||1 hd(l) A
	Thm* A:Type, l:A List. hd(l) A
tl	Def tl(l) == Case of l; nil nil ; h.t t
	Thm* A:Type, l:A List. tl(l) A List
case_inl	Def inl(x) = > body(x) cont(value,contvalue) == InjCase(value; x. body(x); _. cont(contvalue,contvalue))
case_inr	Def inr(x) = > body(x) cont(value,contvalue) == InjCase(value; _. cont(contvalue,contvalue); x. body(x))
trans	Def Trans x,y:T. E(x;y) == a,b,c:T. E(a;b) E(b;c) E(a;c)
	Thm* T:Type, E:(TTProp). Trans x,y:T. E(x,y) Prop
sym	Def Sym x,y:T. E(x;y) == a,b:T. E(a;b) E(b;a)
	Thm* T:Type, E:(TTProp). Sym x,y:T. E(x,y) Prop
refl	Def Refl(T;x,y.E(x;y)) == a:T. E(a;a)
	Thm* T:Type, E:(TTProp). Refl(T;x,y.E(x,y)) Prop

About: