. Lemma-cp-dot-p-er-son--name, X::·Person) .name))) by(auto simp: dot-accessor cp-def )

. Lemma-cp-dot-c-lient--name, X::·Client) .name))) by(auto simp: dot-accessor cp-def )

. Lemma-cp-dot-s-taf-f--name, X::·Staff ) .name))) by(auto simp: dot-accessor cp-def )

F. Lemma-dot and . Ht, cl-res = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot C lient --address-invalid : (invalid::·Client) .address = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot C lient --address-null : (null::·Client) .address = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot C lient -0---cl-resat-pre-invalid : (invalid::·Client) .cl-res@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot C lient -0---cl-resat-pre-null : (null::·Client) .cl-res@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot C lient --addressat-pre-invalid : (invalid::·Client) .address@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot C lient --addressat-pre-null : (null::·Client) .address@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot P er son-0---flights-invalid : (invalid::·Person) .flights = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot P er son-0---flights-nul l : (null::·Person) .flights = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot P er son--name-invalid : (invalid::·Person) .name = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot P er son--name-nul l : (null::·Person) .name = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot P er son-0---flightsat-pre-invalid : (invalid::·Person) .flights@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot P er son-0---flightsat-pre-nul l : (null::·Person) .flights@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot P er son--nameat-pre-invalid : (invalid::·Person) .name@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot P er son--nameat-pre-nul l : (null::·Person) .name@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot Reser v ation-0---prev-invalid : (invalid::·Reservation) .prev = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot Reser v ation-0---prev-nul l : (null::·Reservation) .prev = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot Reser v ation-1---next-invalid : (invalid::·Reservation) .next = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot Reser v ation-1---next-nul l : (null::·Reservation) .next = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot Reser v ation-1---client-invalid : (invalid::·Reservation) .client = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot Reser v ation-1---client-nul l : (null::·Reservation) .client = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot Reser v ation--id-invalid : (invalid::·Reservation) .id = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot Reser v ation--id-nul l : (null::·Reservation) .id = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot Reser v ation--date-invalid : (invalid::·Reservation) .date = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot Reser v ation--date-nul l : (null::·Reservation) .date = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot Reser v ation--flight-invalid : (invalid::·Reservation) .flight = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot Reser v ation--flight-nul l : (null::·Reservation) .flight = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot Reser v ation-0---prevat-pre-invalid : (invalid::·Reservation) .prev@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot Reser v ation-0---prevat-pre-nul l : (null::·Reservation) .prev@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot Reser v ation-1---nextat-pre-invalid : (invalid::·Reservation) .next@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot Reser v ation-1---nextat-pre-nul l : (null::·Reservation) .next@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot Reser v ation-1---clientat-pre-invalid : (invalid::·Reservation) .client@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot Reser v ation-1---clientat-pre-nul l : (null::·Reservation) .client@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot Reser v ation--idat-pre-invalid : (invalid::·Reservation) .id@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot Reser v ation--idat-pre-nul l : (null::·Reservation) .id@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot Reser v ation--dateat-pre-invalid : (invalid::·Reservation) .date@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot Reser v ation--dateat-pre-nul l : (null::·Reservation) .date@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot Reser v ation--flightat-pre-invalid : (invalid::·Reservation) .flight@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot Reser v ation--flightat-pre-nul l : (null::·Reservation) .flight@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot C lient -0---flights-invalid : (invalid::·Client) .flights = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot C lient -0---flights-null : (null::·Client) .flights = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot C lient --name-invalid : (invalid::·Client) .name = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot C lient --name-null : (null::·Client) .name = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot C lient -0---flightsat-pre-invalid : (invalid::·Client) .flights@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot C lient -0---flightsat-pre-null : (null::·Client) .flights@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot C lient --nameat-pre-invalid : (invalid::·Client) .name@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot C lient --nameat-pre-null : (null::·Client) .name@pre = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot S taf f -0---flights-invalid : (invalid::·Staff ) .flights = invalid by(rule ext, simp add: dot-accessor bot-option-def invalid-def ) lemma dot S taf f -0---flights-null : (null::·Staff ) .flights = invalid by(rule ext, simp add: dot-accessor bot-option-def null-fun-def null-option-def ) lemma dot S taf f --name-invalid : (invalid::·Staff ), ·Flight) .to@pre = invalid by(rule ext·Flight) .to@pre = invalid by(rule ext

M. St-bertha, uncurry cons (Ocl-instance-single Valencia)))))), uncurry cons uncurry cons (Ocl-instance-single- Ocl-multiplicity-ext (uncurry cons (I (Mult-nat ((Code-Numeral uncurry cons (META-association (Ocl-association-ext (OclAssTy-association, OclAss- Rel (uncurry cons (I (OclTyObj (OclTyCore-pre ((META.SS-base (META.ST Client))), nil), Ocl-multiplicity-ext (uncurry cons (I (Mult-nat ((Code-Numeral Reservation))), nil), Ocl-multiplicity-ext (uncurry cons (I (Mult-star, uncurry cons uncurry cons-base (META.ST flight)), ShallB-str ((META.SS-base (META.ST F1 ))))), uncurry cons (I (NONE, I ((META.SS-base (META.ST date)), ShallB-str ((META.SS-base (META.ST Mon))))), nil)))), ()), uncurry cons (Ocl-instance-single-ext (SOME ((META.SS-base (META.ST R21 ))), SOME ((META.SS-base (META.ST Reservation))), NONE, OclAttrNoCast (uncurry cons (I (NONE, I ((META.SS-base (META.ST id)), ShallB-term (OclDefInteger ((META.SS-base (META.ST 98765 )))))), uncurry cons (I (NONE, I ((META.SS-base (META.ST flight)), ShallB-str ((META.SS-base (META.ST F1 ))))), nil))), ()), uncurry cons uncurry consMETA.ST Wed)), uncurry cons ((META.SS-base (META.ST Thu)), uncurry cons ((META.SS-base (META.ST Fri)), uncurry cons ((META.SS-base (META.ST Sat)), uncurry cons ((META.SS-base (META.ST Sun)), nil))))))))), uncurry cons (META-association (Ocl-association-ext (OclAssTy-association, OclAssRel (uncurry cons (I (OclTyObj (OclTyCore-pre ((META.SS-base (META.ST Reservation))), nil), Ocl-multiplicity-ext (uncurry cons (I (Mult-nat ((Code-Numeral.Nat 0 )), SOME (Mult-nat ((Code-Numeral.Nat 1 )))), nil), SOME ((META.SS-base (META.ST next))), nil uncurry cons (I (OclTyObj (OclTyCore-pre ((META.SS-base (META.ST Reservation))), nil) SOME ((META.SS-base (META.ST cl-res))), nil uncurry cons (META-association (Ocl-association-ext (OclAssTy-aggregation, OclAssRel (uncurry cons (I (OclTyObj (OclTyCore-pre ((META.SS-base (META.ST Flight))), nil), Ocl-multiplicity-ext (uncurry cons (I (Mult-nat ((Code-Numeral.Nat 1 )), NONE), nil), SOME ((META.SS-base (META.ST flight))), nil uncurry cons (I (OclTyObj (OclTyCore-pre ((META.SS-base (META.ST Reservation))), nil), Ocl-multiplicity-ext (uncurry cons (I (Mult-star, NONE), nil), SOME ((META.SS-base (META.ST fl-res))), uncurry cons (Sequence uncurry cons (META-association (Ocl-association-ext (OclAssTy-association, OclAssRel (uncurry cons (I (OclTyObj (OclTyCore-pre ((META.SS-base Ocl-multiplicity-ext (uncurry cons (I (Mult-star SOME ((META.SS-base Ocl-multiplicity-ext (uncurry cons (I (Mult-star SOME ((META.SS-base uncurry cons (META-class-raw (Floor1 , Ocl-class-raw-ext (OclTyObj (OclTyCore-pre ((META.SS-base uncurry cons (META-class-raw (Floor1 , Ocl-class-raw-ext (OclTyObj (OclTyCore-pre ((META.SS-base (META.ST Client))), uncurry cons (uncurry cons (OclTyCore-pre ((META.SS-base nil)), uncurry cons (I ((META.SS-base (META.ST address)), OclTy-base-string), nil), nil, false))), nil), uncurry cons (I ((META.SS-base (META.ST name)), OclTy-base-string), nil), nil, false uncurry cons (META-class-raw (Floor1 , Ocl-class-raw-ext (OclTyObj (OclTyCore-pre ((META.SS-base (META.ST Reservation))), nil), uncurry cons (I ((META.SS-base (META.ST id)), OclTy-base-integer), uncurry cons (I ((META.SS-base (META.ST date)), OclTy-object (OclTyObj (OclTyCore-pre ((META.SS-base (META.ST Week))), nil))), nil)), nil, false, ())), uncurry cons (META-class-raw (Floor1 , Ocl-class-raw-ext (OclTyObj (OclTyCore-pre ((META.SS-base (META.ST Flight))), nil), uncurry cons (I ((META.SS-base (META.ST seats)), OclTy-base-integer), uncurry cons (I ((META.SS-base (META.ST from)), OclTy-base-string), uncurry cons (I ((META.SS-base (META.ST to)), OclTy-base-string), nil))), nil, false, p.uncurry cons (I (OclTyObj (OclTyCore-pre ((META.SS-base uncurry cons (uncurry cons (OclTyCore-pre ((META.SS-base uncurry cons (META-class-raw

D. Operations, . Fold, M. Map, |. True, |. Meta-def-state-floor1-?-true et al., allinst-lemmas-id} local-setup embedding-fun-info @{const-name print-allinst-astype} local-setup embedding-fun-info @{const-name print-allinst-exec} local-setup embedding-fun-info @{const-name print-allinst-istypeof-pre} local-setup embedding-fun-info @{const-name print-allinst-istypeof } local-setup embedding-fun-info @{const-name print-allinst-iskindof-eq} local-setup embedding-fun-info @{const-name print-allinst-iskindof-larger} local-setup embedding-fun-info @{const-name print-access-oid-uniq-ml} local-setup embedding-fun-info @{const-name print-access-oid-uniq} local-setup embedding-fun-info @{const-name print-access-eval-extract} local-setup embedding-fun-info @{const-name print-access-choose-ml} local-setup embedding-fun-info @{const-name print-access-choose} local-setup embedding-fun-info @{const-name print-access-deref-oid} local-setup embedding-fun-info @{const-name print-access-deref-assocs} local-setup embedding-fun-info @{const-name print-access-select} local-setup embedding-fun-info @{const-name print-access-select-obj} local-setup embedding-fun-info @{const-name print-access-dot-consts} local-setup embedding-fun-info @{const-name print-access-dot} local-setup embedding-fun-info @{const-name print-access-dot-lemmas-id} local-setup embedding-fun-info @{const-name print-access-dot-cp-lemmas} local-setup embedding-fun-info @{const-name print-access-dot-lemma-cp} local-setup embedding-fun-info @{const-name print-access-dot-lemmas-cp} local-setup embedding-fun-info @{const-name print-access-lemma-strict} local-setup embedding-fun-info @{const-name print-access-def-mono} local-setup embedding-fun-info @{const-name print-access-is-repr} local-setup embedding-fun-info @{const-name print-access-repr-allinst} local-setup embedding-fun-info @{const-name print-examp-def-st-defs} local-setup embedding-fun-info @{const-name print-astype-lemmas-id2 } local-setup embedding-fun-info @{const-name print-enum} local-setup embedding-fun-info @{const-name print-examp-instance-defassoc-typecheck-var} local-setup embedding-fun-info @{const-name print-examp-instance-defassoc} local-setup embedding-fun-info @{const-name print-examp-instance} local-setup embedding-fun-info @{const-name print-examp-instance-defassoc-typecheck} local-setup embedding-fun-info @{const-name print-examp-oclbase} local-setup embedding-fun-info-f1 @{const-name Floor1-examp.print-examp-def-st-typecheck-var} local-setup embedding-fun-info-f1 @{const-name Floor1-examp.print-examp-def-st1 } local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-examp-def-st-locale} local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-examp-def-st2 } local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-examp-def-st-dom} local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-examp-def-st-dom-lemmas} local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-examp-def-st-perm} local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-examp-def-st-allinst} local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-examp-def-st-defassoc-typecheck} local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-examp-def-st-def-interp} local-setup embedding-fun-info-f1 @{const-name Floor1-examp.print-transition} local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-transition-locale} local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-transition-interp} local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-transition-def-state} local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-transition-wff } local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-transition-where} local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-transition-def-interp} local-setup embedding-fun-info-f2 @{const-name Floor2-examp.print-transition-lemmas-oid} local-setup embedding-fun-info-f1 @{const-name Floor1-ctxt.print-ctxt} local-setup embedding-fun-info-f2 @{const-name Floor2-ctxt.print-ctxt-pre-post} local-setup embedding-fun-info-f2 @{const-name Floor2-ctxt.print-ctxt-inv} local-setup embedding-fun-info-f2 @{const-name Floor2-ctxt.print-ctxt-thm} local-setup embedding-fun-info @{const-name print-meta-setup-def-state} local-setup embedding-fun-info @{const-name print-meta-setup-def-transition} Parse.of-ocl-collection-def Parse.of-ocl-multiplicity-single-def Parse.of-ocl-multiplicity-def Parse.of-ocl-ty-class-node-def Parse.of-ocl-ty-class-def Parse.of-ocl-ty-obj-core-def Parse.of-ocl-ty-obj-def Parse.of-ocl-ty-def Parse.of-ocl-association-type-def Parse.of-ocl-association-relation-def Parse.of-ocl-association-def Parse.of-ocl-ctxt-prefix-def Parse.of-ocl-ctxt-term-def Parse.of-ocl-prop-def Parse.of-ocl-ctxt-term-inv-def Parse.of-ocl-ctxt-term-pp-def Parse.of-ocl-ctxt-pre-post-def Parse.of-ocl-ctxt-clause-def Parse.of-ocl-ctxt-def Parse.of-ocl-class-def Parse.of-ocl-class-raw-def Parse, def end G.3 Instantiating the Parser of META theory Parser-META imports Meta-META Parser-UML Parser-UML-extended begin Parse

. Sublocale-parse-sml-<-parse-?c, . Case, and . String, of-string Parse-SML.of-string base Parse-SML.of-nat Parse-SML.of-unit Parse-SML.of-bool Parse-SML.Of-Pair Parse-SML.Of-Nil Parse-SML.Of-Cons Parse-SML.Of-None Parse-SML.Of-Some done context Parse-SML begin definition compiler-env-config a b = of-compiler-env-config a b (? -. of-unit) end definition sml-of-compiler-env-config = Parse-SML.compiler-env-config lemmas [code] = Parse-SML.Of-Pair-def Parse-SML.Of-Nil-def Parse-SML.Of-Cons-def Parse-SML.Of-None-def Parse-SML.Of-Some-def Parse-SML.of-pair-def Parse-SML.of-list-def Parse-SML.of-option-def Parse-SML.of-unit-def Parse-SML.of-bool-def Parse-SML.of-string-def Parse-SML.of-string base -def Parse-SML.of-nat-def Parse-SML.sml-escape-def Parse-SML.compiler-env-config-def definition sml-apply s l = S.flatten [s, p.end

*. and *. *. %d, let (l-thy, lg) = L.mapM (?l n. (of-all-meta env l, Succ n)) l 0 in (( # %s, %d * )%s (To-string (if compiler-env-config.more env then else °char-escape°)) (To-nat (Succ i)) (To-nat cpt) (To-nat lg) (case msg of None ? | Some msg ? ( * term %s * ) (To-string msg))

M. Catia, . Angelo, J. M. Luc, H. Claesen, and . Man, Degrees of formality in shallow embedding hardware description languages in HOL, Joyce and Seger [JS94], pp.89-100

M. Arjona, C. Dania, M. Egea, and A. Maña, Validation of a security metamodel for the development of cloud applications, Proceedings of the MODELS 2014 OCL Workshop CEUR Workshop Proceedings. CEUR- WS.org, p.142, 2014.

K. Arnold, J. Gosling, and D. Holmes, The Java Programming Language, Third Edition, 2000.

K. Aehlig and F. Joachimski, Operational aspects of untyped Normalisation by Evaluation, Mathematical Structures in Computer Science, vol.14, issue.4, pp.587-611, 2004.
DOI : 10.1017/S096012950400427X

J. Soto-andrade, S. Jaramillo, C. Gutiérrez, and J. Letelier, Ouroboros avatars: A mathematical exploration of self-reference and metabolic closure Advances in Artificial Life: 20th Anniversary Edition -Back to the Origins of Alife, pp.763-770, 2011.

B. Peter and . Andrews, Introduction to Mathematical Logic and Type Theory: To Truth through Proof, 1921.

A. Inc, The swift programming language, TheSwiftProgrammingLanguage(Swift2.2) .epub, 2016. Swift 2.2 Edition, p.11

[. Ballarin, Locales: A Module System for Mathematical Theories, Journal of Automated Reasoning, vol.254, issue.2, pp.123-153, 2014.
DOI : 10.1007/s10817-013-9284-7

[. Barendregt, Introduction to generalized type systems, J. Funct. Program, vol.1, issue.2, pp.125-154, 1991.

B. Barras, Sets in coq, coq in sets Interactive Theorem Proving and Program Development. Coq'Art: The Calculus of Inductive Constructions, J. Formalized Reasoning Metalogical frameworks. Logical Environments, vol.3, issue.1, pp.29-48, 1993.

D. A. Basin, M. Clavel, and J. Meseguer, Reflective metalogical frameworks, ACM Transactions on Computational Logic, vol.5, issue.3, pp.528-576, 2004.
DOI : 10.1145/1013560.1013566

B. Blanchette, M. Desharnais, L. Panny, A. Popescu, and D. Traytel, Defining (Co)datatypes in Isabelle/HOL, 2016.

D. Achim, J. Brucker, B. Doser, and . Wolff, An MDA framework supporting OCL, Electronic Communications of the EASST, vol.5, p.94, 2006.

D. Achim, J. Brucker, B. Doser, and . Wolff, A model transformation semantics and analysis methodology for SecureUML

D. Achim, J. Brucker, B. Doser, and . Wolff, Semantic issues of OCL: Past, present, and future, Electronic Communications of the EASST, vol.5, p.14, 2006.

A. Bgg-+-93-]-richard-boulton, M. J. Gordon, J. Gordon, J. Harrison, J. Herbert et al., Experience with embedding hardware description languages in HOL, Proceedings of the the International Conference on Theorem Provers in Circuit Design: Theory, Practice and Experience, volume A-10 of IFIP Transactions, pp.129-156, 1993.

[. Barbier, B. Henderson-sellers, A. L. Opdahl, and M. Gogolla, The Whole-Part Relationship in the Unified Modeling Language, Unified Modeling Language: Systems Analysis, Design and Development Issues, pp.185-209
DOI : 10.4018/978-1-930708-05-1.ch012

D. Achim, M. P. Brucker, D. Krieger, B. Longuet, and . Wolff, A specification-based test case generation method for UML/OCL, MoD- ELS Workshops, number 6627 in Lecture Notes in Computer Science, pp.334-348, 2010.

D. Achim, M. P. Brucker, B. Krieger, and . Wolff, Extending OCL with null-references, Models in Software Engineering, number 6002 in Lecture Notes in Computer Science, pp.261-275, 2009.

[. Blanchette, Hammering Away: A User's Guide to Sledgehammer for Isabelle/HOL, 2016.

M. Barnett, K. Rustan, M. Leino, and W. Schulte, The Spec# Programming System: An Overview, Construction and Analysis of Safe, Secure, and Interoperable Smart Devices (CASSIS), pp.49-69, 2005.
DOI : 10.1007/978-3-540-30569-9_3

D. Achim, D. Brucker, F. Longuet, B. Tuong, and . Wolff, On the semantics of object-oriented data structures and path expressions, Proceedings of the MoDELS 2013 OCL Workshop (OCL 2013), volume 1092 of CEUR Workshop Proceedings, pp.23-32, 2013.

S. Böhme, K. Rustan, M. Leino, and B. Wolff, HOL-Boogie ??? An Interactive Prover for the Boogie Program-Verifier, Theorem Proving in Higher Order Logics, pp.150-166, 2008.
DOI : 10.1007/978-3-540-74591-4_26

S. Robert, J. Boyer, and . Strother-moore, Metafunctions: Proving them correct and using them efficiently as new proof procedures, p.67, 1979.

S. Boutin, Using reflection to build efficient and certified decision procedures, Theoretical Aspects of Computer Software, Third International Symposium, TACS '97 Proceedings, volume 1281 of Lecture Notes in Computer Science, pp.515-529, 1997.
DOI : 10.1007/BFb0014565

D. Achim and . Brucker, An Interactive Proof Environment for Objectoriented Specifications, ETH Dissertation No, vol.17097, p.33, 2007.

D. Achim, F. Brucker, B. Rittinger, and . Wolff, HOL-Z 2.0: A proof environment for Z-specifications An inverse of the evaluation functional for typed lambda-calculus, Proceedings of the Sixth Annual Symposium on Logic in Computer Science (LICS '91), pp.152-172, 1991.

C. Barrett, C. Tinelli, and . Cvc3, CVC3, Lecture Notes in Computer Science, vol.4590, pp.298-302, 2007.
DOI : 10.1007/978-3-540-73368-3_34

B. Barras, C. Tankink, and E. Tassi, Asynchronous Processing of Coq Documents: From the Kernel up to the User Interface, Interactive Theorem Proving -6th International Conference, ITP 2015 Proceedings, pp.51-66, 2015.
DOI : 10.1007/978-3-319-22102-1_4
URL : https://hal.archives-ouvertes.fr/hal-01135919

D. Achim, F. Brucker, B. Tuong, and . Wolff, Featherweight OCL: A proposal for a machine-checked formal semantics for OCL 2.5. Archive of Formal Proofs, 2014.

[. Barras and B. Werner, Coq in coq Inductive datatypes in HOL -lessons learned in formal-logic engineering, Theorem Proving in Higher Order Logics, 12th International Conference, TPHOLs'99 Proceedings, volume 1690 of Lecture Notes in Computer Science, pp.142-161, 1997.

G. Bauer and M. Wenzel, Calculational Reasoning Revisited An Isabelle/Isar Experience, In Richard J. Boulton and Paul B
DOI : 10.1007/3-540-44755-5_7

D. Achim, B. Brucker, and . Wolff, HOL-OCL: Experiences, consequences and design choices, UML 2002: Model Engineering, Concepts and Tools, number 2460 in Lecture Notes in Computer Science, pp.196-211, 2002.

D. Achim, B. Brucker, and . Wolff, A proposal for a formal OCL semantics in Isabelle/HOL

D. Achim, B. Brucker, and . Wolff, The HOL-OCL book, p.45, 2006.

D. Achim, B. Brucker, and . Wolff, An extensible encoding of object-oriented data models in HOL, Journal of Automated Reasoning, vol.41, issue.141, pp.219-249, 2008.

D. Achim, B. Brucker, and . Wolff, Extensible universes for object-oriented data models, ECOOP 2008 ? Object-Oriented Programming, number 5142 in Lecture Notes in Computer Science, pp.438-462, 2008.

D. Achim, B. Brucker, and . Wolff, Semantics, calculi, and analysis for object-oriented specifications, Acta Informatica, vol.46, issue.127, pp.255-284, 1922.

E. Cohen, M. Dahlweid, M. A. Hillebrand, D. Leinenbach, M. Moskal et al., VCC: A Practical System for Verifying Concurrent C, Theorem Proving in Higher Order Logics (TPHOLs), pp.23-42, 2009.
DOI : 10.1007/978-3-540-74591-4_15

H. B. Curry, R. Feys, and W. Craig, Combinatory Logic §9E. 64 [Che76] Peter Pin-Shan Chen. The entity-relationship model ? toward a unified view of data, ACM Trans. Database Syst, vol.1, issue.11, pp.9-36, 1958.

S. Cook, A. Kleppe, R. Mitchell, B. Rumpe, J. Warmer et al., The Amsterdam Manifesto on OCL, Lecture Notes in Computer Science, vol.2263, pp.115-149, 2002.
DOI : 10.1007/3-540-45669-4_7

G. Manuel, J. Clavel, and . Meseguer, Axiomatizing reflective logics and languages, Proceedings of Reflection'96, pp.263-288, 1996.

A. Chaieb and T. Nipkow, Verifying and reflecting quantifier elimination for presburger arithmetic Meta-reasoning: A survey, Logic for Programming 12th International Conference, LPAR 2005 Proceedings The Coq proof assistant reference manual, 2016. 89 [Cos02] Stefania Costantini Computational Logic: Logic Programming and Beyond, Essays in Honour of Robert A. Kowalski, Part II, volume 2408 of Lecture Notes in Computer Science, pp.367-380, 2002.

P. Chalin and F. Rioux, Non-null references by default in the Java modeling language, SAVCBS '05: Proceedings of the 2005 conference on Specification and verification of component-based systems, p.143, 2005.

C. Dania and M. Clavel, OCL2FOL+: coping with undefinedness, Proceedings of the MODELS 2013 OCL Workshop co-located with the 16th International ACM/IEEE Conference on Model Driven Engineering Languages and Systems (MOD- ELS 2013) 1092 of CEUR Workshop Proceedings, pp.53-62, 2013.

D. Delahaye, A Tactic Language for the System Coq, Logic for Programming and Automated Reasoning, 7th International Conference Proceedings, pp.85-95, 1955.
DOI : 10.1007/3-540-44404-1_7
URL : https://hal.archives-ouvertes.fr/hal-01125070

P. Dybjer and A. Filinski, Normalization and Partial Evaluation, Applied Semantics, International Summer School, APPSEM 2000, Caminha, PortugalDM82] Luís Damas and Robin Milner Conference Record of the Ninth Annual ACM Symposium on Principles of Programming Languages, pp.137-192, 1982.
DOI : 10.1007/3-540-45699-6_4

L. Mendonça-de-moura and N. Bjørner, Z3: An Efficient SMT Solver, TACAS, pp.337-340, 2008.
DOI : 10.1007/978-3-540-78800-3_24

O. Dahl and K. Nygaard, SIMULA: an ALGOL-based simulation language, Communications of the ACM, vol.9, issue.9, pp.671-678, 1966.
DOI : 10.1145/365813.365819

G. Gogolla, F. Büttner, M. Richters, U. , and O. Sci, USE: A UML-based specification environment for validating UML and OCL, Science of Computer Programming, vol.69, issue.1-3, pp.27-34, 2007.
DOI : 10.1016/j.scico.2007.01.013

J. C. Michael, R. Gordon, C. P. Milner, and . Wadsworth, Edinburgh LCF: A Mechanised Logic of Computation, LNCS, vol.78, issue.62, p.70, 1979.

M. Gordon, From LCF to HOL: a short history, Proof, Language, and Interaction: Essays in Honour of Robin Milner, pp.169-185, 2000.

M. Gogolla and M. Richters, Expressing UML Class Diagrams Properties with OCL, Lecture Notes in Computer Science, vol.2263, pp.85-114, 2002.
DOI : 10.1007/3-540-45669-4_6

E. L. Gunter, Why We Can't have SML Style datatype Declarations in HOL, Higher Order Logic Theorem Proving and its Applications, Proceedings of the IFIP TC10/WG10.2 Workshop HOL'92, pp.21-24
DOI : 10.1016/B978-0-444-89880-7.50042-5

[. Haftmann, Code generation from specifications in higherorder logic Code generation from Isabelle theories, p.85, 2009.

J. Harrison, Metatheory and reflection in theorem proving: A survey and critique, p.67, 1995.

A. Hamie, F. Civello, J. Howse, S. Kent, and R. Mitchell, Reflections on the Object Constraint Language, The Unified Modeling Language. «UML»'98: Beyond the Notation, pp.162-172, 1998.
DOI : 10.1007/978-3-540-48480-6_13

[. Hudak, J. Hughes, S. L. Jones, and P. Wadler, A history of Haskell, Proceedings of the third ACM SIGPLAN conference on History of programming languages , HOPL III, pp.9-10, 2007.
DOI : 10.1145/1238844.1238856

R. Hindleyhn10, F. Haftmann, T. Nipkowhow80, and ]. W. Howard, Code generation via higherorder rewrite systems The formulae-as-types notion of constructions, Functional and Logic Programming, 10th International Symposium, FLOPS 2010 Proceedings, volume 6009 of Lecture Notes in Computer Science to H.B. Curry : Essays on Combinatory Logic, Lambda Calculus and Formalism, pp.29-60, 1969.

P. Gérard and . Huet, The gallina specification language: A case study

J. Kae-+-10-]-gerwin-klein, K. Andronick, G. Elphinstone, D. Heiser, P. Cock et al., seL4, Communications of the ACM, vol.53, issue.6, pp.107-115, 2010.
DOI : 10.1145/1743546.1743574

A. C. Kay-martin-gogolla, The early history of smalltalk From UML and OCL to relational logic and back, History of Programming Languages Conference (HOPL-II) Model Driven Engineering Languages and Systems -15th International Conference Proceedings , volume 7590 of Lecture Notes in Computer Science, pp.69-95, 1993.

P. Matthias, A. Krieger, and . Knapp, Executing underspecified ocl operation contracts with a sat solver, Proceedings of the the OCL 2008 Workshop, p.47, 2008.

J. Koenig, K. Rustan, and M. Leino, Getting started with Dafny: A guide Software Safety and Security: Tools for Analysis and Verification, volume 33 of NATO Science for Peace and Security Series D: Information and Communication Security, pp.152-181, 2012.

[. Kleene, On notation for ordinal numbers, The Journal of Symbolic Logic, vol.28, issue.04, pp.150-155, 1938.
DOI : 10.1215/S0012-7094-36-00227-2

A. Krauss, Partial Recursive Functions in Higher-Order Logic
DOI : 10.1007/11814771_48

A. Krauss, Defining Recursive Functions in Isabelle/HOL, 2016.

X. Leroy, D. Doligez, A. Frisch, and J. Garrigue, Didier Rémy, and Jérôme Vouillon. The OCaml system release 4.02: Documentation and user's manual, p.24, 2014.

X. Leroy, Formal verification of a realistic compiler, Communications of the ACM, vol.52, issue.7
DOI : 10.1145/1538788.1538814
URL : https://hal.archives-ouvertes.fr/inria-00415861

M. [. Rustan, G. Leino, J. B. Nelson, and . Saxe, ESC/Java user's manual, p.49, 2000.

D. Longuet, F. Tuong, and B. Wolff, Towards a tool for featherweight OCL: A case study on semantic reflection, Proceedings of the MoDELS 2014 OCL Workshop (OCL 2014), volume 1285 of CEUR Workshop Proceedings, pp.43-52, 2014.
URL : https://hal.archives-ouvertes.fr/hal-01214466

L. Mandel and M. Victoria-cengarle, On the Expressive Power of OCL, World Congress on Formal Methods in the Development of Computing Systems (FM), pp.854-874, 1999.
DOI : 10.1007/3-540-48119-2_47

J. Mccarthy, LISP 1.5 Programmer???s Manual, p.12, 1965.
DOI : 10.1007/978-3-662-09507-2_12

F. Thomas and . Melham, A package for inductive relation definitions in HOL, Proceedings of the 1991 International Workshop on the HOL Theorem Proving System and its Applications, pp.350-357, 1991.

J. Meseguer, Conditional rewriting logic as a unified model of concurrency, Theoretical Computer Science, vol.96, issue.1, pp.73-155, 1992.
DOI : 10.1016/0304-3975(92)90182-F

[. Meyer, Object-oriented Software Construction A theory of type polymorphism in programming, J. Comput. Syst. Sci, vol.48, issue.173, pp.142348-375, 1978.

[. Martin-löf, An Intuitionistic Theory of Types: Predicative Part
DOI : 10.1016/S0049-237X(08)71945-1

[. Martin-lef, Intuitionistic type theory Naples: Bibliopolis, 1984. 76 [Mog91] Eugenio Moggi. Notions of computation and monads, Inf. Comput, vol.93, issue.1, pp.55-92, 1991.

J. Meng and L. C. Paulson, Translating Higher-Order Clauses to First-Order Clauses, Journal of Automated Reasoning, vol.9, issue.2, pp.35-60, 2008.
DOI : 10.1007/s10817-007-9085-y

C. J. David, M. Matthews, and . Wenzel, Efficient parallel programming in poly/ml and isabelle/ml, Proceedings of the POPL 2010 Workshop on Declarative Aspects of Multicore Programming, pp.53-62, 2010.

D. Matichuk, M. Wenzel, and T. C. Murray, An Isabelle Proof Method Language, Interactive Theorem Proving -5th International Conference Proceedings, pp.390-405, 2014.
DOI : 10.1007/978-3-319-08970-6_25

[. Nemouchi, A. Feliachi, B. Wolff, and C. Proch, Isabelle in certification processes, p.98, 2015.

/. Isabelle and . Hol?a, Proof Assistant for Higher-Order Logic, volume 2283 of Lecture Notes in Computer Science, p.33, 2002.

T. Nipkow, L. C. Paulson, and M. Wenzel, Isabelle's logic: HOL, The HOL System Tutorial, pp.14-26, 2009.

M. Odersky, An overview of the scala programming language, 2004.

C. Lawrence and . Paulson, Isabelle's Logics, 2016.

C. Lawrence, J. C. Paulson, and . Blanchette, Three years of experience with sledgehammer, a practical link between automatic and interactive theorem provers, The 8th International Workshop on the Implementation of Logics, IWIL 2010, pp.1-11, 2010.

C. Lawrence, K. Paulson, and . Susanto, Source-level proof reconstruction for interactive theorem proving, Theorem Proving in Higher Order Logics, 20th International Conference Proceedings, pp.232-245, 2007.

M. Gogolla, OCL: Syntax, semantics, and tools Object Modeling with the OCL: The Rationale behind the Object Constraint Language, volume 2263 of Lecture Notes in Computer Science [Ric02] Mark Richters. A Precise Approach to Validating UML Models and OCL Constraints Collaborative interactive theorem proving with clide, SH-4 Software Manual Interactive Theorem Proving -5th International Conference, ITP 2014, Held as Part of the Vienna Summer of Logic Proceedings, pp.142-184, 2002.

X. Shi, Certification of an Instruction Set Simulator. Theses, 0141.
URL : https://hal.archives-ouvertes.fr/tel-00937524

[. Smith, Reflections and semantics in a procedural language, p.87, 1982.

[. Smith, Reflection and semantics in LISP, Proceedings of the 11th ACM SIGACT-SIGPLAN symposium on Principles of programming languages , POPL '84, pp.23-35, 1984.
DOI : 10.1145/800017.800513

X. Shi, J. Monin, F. Tuong, and F. Blanqui, First steps towards the certification of an ARM simulator using compcert Steunebrink and Jürgen Schmidhuber. Towards an actual gödel machine implementation: A lesson in self-reflective systems, Certified Programs and Proofs -First International Conference. Proceedings Theoretical Foundations of Artificial General Intelligence, pp.346-361, 2011.

[. Stehr, Towards a unified language based on equational logic, rewriting logic, and type theory, p.76, 2002.

B. Stroustrup, C++ programming language, IEEE Software, vol.3, issue.1, pp.71-72, 1986.

M. Heine-sørensen and P. Urzyczyn, Lectures on the Curry- Howard isomorphism, p.38, 2006.

D. Traytel, A. Popescu, and J. C. Blanchette, Foundational, Compositional (Co)datatypes for Higher-Order Logic: Category Theory Applied to Theorem Proving, 2012 27th Annual IEEE Symposium on Logic in Computer Science, pp.596-605, 2012.
DOI : 10.1109/LICS.2012.75

[. Tuong and B. Wolff, A meta-model for the isabelle API Archive of Formal Proofs http:// www.isa-afp.org/entries/Isabelle_Meta_Model.shtml, Formal proof development, pp.71-85, 2015.

. Kumar-neeraj, J. Verma, S. Goubault-larrecq, S. Prasad, P. Arun-kumar-guido-van-rossum et al., Reflecting bdds in coq Advances in Computing Science -ASIAN 2000, 6th Asian Computing Science Conference Python programming language How to make ad-hoc polymorphism less ad-hoc Makarius Wenzel and Amine Chaieb. SML with antiquotations embedded into Isabelle/Isar, Proceedings, volume 1961 of Lecture Notes in Computer Science Proceedings of the 2007 USENIX Annual Technical Conference Conference Record of the Sixteenth Annual ACM Symposium on Principles of Programming Languages Programming Languages for Mechanized Mathematics Workshop (CAL- CULEMUS 2007), number 07-10 in RISC-Linz Report. RISC, pp.162-181, 1989.

M. Wenzel, Type classes and overloading in higher-order logic
DOI : 10.1007/BFb0028402

M. Wenzel, Isar ??? A Generic Interpretative Approach to Readable Formal Proof Documents, Theorem Proving in Higher Order Logics, 12th International Conference , TPHOLs'99 Proceedings, volume 1690 of Lecture Notes in Computer Science, pp.167-184, 1999.
DOI : 10.1007/3-540-48256-3_12

M. M. Wenzel, Isabelle/Isar ? a versatile environment for human-readable formal proof documents, p.21, 2002.

]. M. Wen09 and . Wenzel, Parallel proof checking in Isabelle/Isar, ACM SIGSAM Workshop on Programming Languages for Mechanized Mathematics Systems, 2009.

[. Wenzel, Asynchronous Proof Processing with Isabelle/Scala and Isabelle/jEdit, Electronic Notes in Theoretical Computer Science, vol.285, pp.101-114, 2012.
DOI : 10.1016/j.entcs.2012.06.009

M. Wenzel, The Isabelle/Isar Implementation, p.70, 2016.

W. Richard and . Weyhrauch, Prolegomena to a theory of mechanized formal reasoning, Artificial intelligence, vol.13, issue.12, pp.133-170, 1980.

J. Wenzel and B. Wolff, Reasoning Building formal method tools in the Isabelle/Isar framework, TPHOLS 2007, number 4732 in Lecture Notes in Computer Science, pp.389-411, 2002.