Isabelle Formalization of Set Theoretic Structures and Set Comprehensions (cid:63)

. Reasoning about computers and programming languages on paper is most often done with set theory, while most proof assistant formalizations of languages and programs use alternative mathematical foundations. One of the few exceptions has been Mizar where the Simple Concrete Model of computers has been used to verify programs expressed as abstract programming language instruction sequences. The model uses extended set theory features including structures and Fraenkel set comprehension operators. In this paper we show how to formally specify such objects in the Isabelle object logic implementing the Mizar foundations as de(cid:28)nitional extensions. To show the adequacy and usability of the mechanisms, we reformalize a number of Mizar de(cid:28)nitions and theorems related to structures and set comprehensions, including both mathematical and programming language examples: groups, machines and properties of computer memory states.


Introduction
Proof assistants are today increasingly used to certify software, hardware, as well as mathematical proofs that involve computer programs [10].One of the earliest proof assistants, Mizar [7], has been developed as a tool to provide a human-oriented environment which would allow proofs to be formally analyzed.
The system has already been developed over forty years with its most distinctive features being a proof style that imitates informal mathematical proofs as much as possible [16] and a rich type system that reects how mathematicians and computer scientists describe dependencies between objects [25].Such support for formal proofs has given rise to one of the largest libraries of formalized mathematics with many domains not covered in other libraries.One of such domains is the Simple Concrete Model (SCM) [17], which introduces a formal model corresponding to random-access Turing machines, their instructions, and The paper has been supported by the resources of the Polish National Science Center granted by decision n • DEC-2015/19/D/ST6/01473. programs and has been considered more realistic for modeling of real computers [21].The development of SCMs and the proofs of their various properties spans 66 Mizar Mathematical Library (MML) articles.
We build upon our recent work which aimed to specify foundations [13], notations [12], automation [14] of the Mizar system in the Isabelle Logical Framework [24].The most important motivation for the current work is to provide the completely specied set theoretic formalizations of the model of computers, instructions, languages, etc.There are multiple further directions for how we plan to extend that work, as well as multiple reasons for these extensions: Specifying Mizar in a logical framework gives the complete semantics of the system specied only on paper so far [6], including the underlying rst-order logic variant, the soft type system, denitional mechanisms, and automation mechanisms.
Despite various eorts [11], the contents of the MML are hard to access for developers of other proof and knowledge management systems.Isabelle's structures can allow experiments with sharing proof techniques and automation across proof assistants.
Mizar has a large monolithic kernel.Despite the implementers best eorts, bugs in the code can result in incorrect proofs being accepted.This problem can be signicantly remedied by certifying proofs across systems.
In the long run, develop an alternative environment for reverication and development of proofs automatically exported from the MML.
In this work we introduce and develop two components used in Mizar necessary to translate and certify the MML proofs on algebraic structures including the SCM model of computers in Isabelle.The components are Mizar structures and Mizar set comprehension operators.
Mizar structures (also referred to as aggregates or records ) allow grouping multiple other objects together with relations between them into a single entity.This is useful for dening and reasoning about mathematical structures such as rings, elds, and vector spaces.Mizar structures correspond to mechanisms in other proof assistants like the Isabelle type classes [9] or Coq records used to build an algebraic hierarchy [5].The support for structures is a crucial part of the Mizar language.Structures are built in to the Mizar verifier [6] and they are heavily used in the MML.In fact 74% of the articles in the current MML version 1289 rely directly or indirectly on the article struct_0.
Mizar set comprehension operators (referred to as Fraenkel in the Mizar literature [6]) allow describing a set of terms whose argument list satises a given predicate.Dening set comprehension in a sound and adequate way is an important part of the Mizar foundations, as in any set theory this is where most paradoxes (Russell's paradox and its variants) originate from.
We use the already specied foundations of the Mizar system together with the Tarski-Groethendieck axiomatization, and the rst few formalized articles of the MML to formally dene Mizar structures and Mizar set comprehension operators.Both can be introduced as denitional extensions, without adding any further axioms.

Related Work
B-Method [1] has aimed to ease the formalization of programs in a foundation based on set theory, however like Mizar the structures and set comprehension are a part of the system.Similarly, Metamath [20] does not have a built-in notion of structures and focuses on n-tuples instead.
Turing machines have been formalized in Isabelle/HOL [26] allowing reasoning about their behavior in Hoare logic, as well as in Matita [2] focusing on complexity theory.The main approach to formalization of imperative programs in Isabelle is used in Imperative/HOL [4].This approach was further rened to allow for formalization of programs in separation logic [18].Algebraic structures were often necessary early in the development of proof assistants.In Isabelle/HOL type classes [9] allow for further control of the polymorphic type system adding mechanisms such as inheritance between types.
Various Isabelle automation mechanisms can translate type classes to predicates, which is also how reasoning about algebraic structures with inheritance is usually performed in other HOL-based systems.Proof assistants based on versions of type theory can store objects along with their properties in tuples (or records with named elds).This has been used to build an algebraic hierarchy [5] in Coq or to extend it to topologies as done in Matita [23].Inheritance for records that can allow for good automation has become an important eld with developments including canonical structures and type classes.
Lee and Rudnicki [19] proposed an alternative approach to dening structures without special support in the Mizar system.The main motivation is to make eld structures into rst-class objects, which allows more convenient reasoning about graphs.The proposed approach directly uses other parts of the Mizar language (including preceding parts of the MML) to dene aggregates as Mizar finite Functions.This allows dening what it means for an object to have a eld, rather than to x which collections of elds constitute an aggregated object.
The exports of Mizar to ATPs [3] require a specication of the Mizar set comprehensions.The semantics of the exported objects is the same as that in Mizar and in our formalizations, but they are axiomatized rather than dened.
We are not aware of any work that species the foundations of Mizar in a formal system that would cover structures.

Contributions and Outline
We give a complete formal specication of Mizar structures formalized in the Isabelle/Mizar object logic (Sect.3).It supports strict structures (structures that do not include additional elds), domain of a structure (which allows restricting larger structures to smaller ones), and inheritance (which allows extending structures to larger ones) including multiple inheritance.
Our approach allows dening it as a single meta-level functor, therefore a denitional extension as opposed to a part of the implementation of the checker in Mizar.We further prove a number of properties of this functor.
We reformalize parts of the MML corresponding to the lattice of types focusing on the simple concrete model of computers, and show that the dened mechanisms are appropriate and usable to formalize all of Mizar specics in Isabelle (Sect.5).

Preliminaries
In this section we briey introduce the Mizar foundations dened as an object logic in the Isabelle framework.For more details see [13].
Four Isabelle types are used to model the Mizar foundations.The type of propositions is already dened by the underlying Isabelle/FOL object logic.The following types are further added: the type of Mizar sets Set and two types used for the Mizar type system: Mode and Attr.Mizar modes are the elementary types assigned to all objects.Modes are guaranteed to be non-empty.Mizar attributes allow restricting of a given mode or of another attribute.The only attributes considered in this paper will be adjectives.Each adjective corresponds to a (parametrizable) predicate on a given type.The type constructed by applying a number of adjectives to a given type corresponds to the elements of the type which satisfy all the adjective-associated predicates.For example the type non zero natural number restricts the type (mode) of numbers to both natural ones and those dierent from zero.For clarity, in the Isabelle formalization the operation that combines attributes will be denoted using a single vertical bar | and the operation of applying attributes to a mode will be denoted using a double one .More information about modes and attributes can be found in [7].
The Isabelle/Mizar object logic introduces constants that allow interacting with the Mizar types, a constant for the choice operator, and ve axioms that specify these constants.Two axioms specify what it mean to dene a new mode and a new attribute.Two axioms express the meaning of the combinations of attributes with attributes and with modes.The last one axiomatizes the Mizar axiom of choice for non-empty types.
Next, notations that imitate the Mizar text are introduced for the rst-order logic symbols: &, or, implies, for x holds P, etc. Syntax and helper lemmas are provided to allow dening functions, predicates, and new types in ways similar to that used in Mizar.In particular the denition of a meta-level function F which is to return type T in Mizar follows the pattern func F → T equals D and denitions using the description operator use means rather than equals and a predicate that the dened object should satisfy.These preliminaries are sucient to express the Tarski-Grothendieck set theory axiomatization in the same way as in Mizar.Furthermore [13] showed, that it is sucient to translate all the denitions and theorems from the rst few articles of the MML.

Structures
Mizar structures are used to dene objects that are typically represented as tuples in mathematics.For example the Mizar denition of ring F, +, 0, • , 1 consists of Mizar types assigned to elds in the structure, in particular +, • are binary operations on F , and 0, 1 are members of F .To do this, unique identiers (referred to as a eld selector or simply selector in the Mizar literature) are needed for each tuple element.In case of a ring these identiers are carrier, addF, ZeroF, multF, and OneF respectively.The Mizar syntax for the tuple including the above mentioned types is presented on the left.The Isabelle counterpart, which we will dene later in this section is presented on the right for comparison (for simplicity inheritance information is omitted here, it will be discussed in Sect. 3 The doubleLoopStr structure will correspond to a ring only with additional restrictions.Such restrictions are in Mizar introduced using adjectives (see Sect. 2).In particular, a ring in the MML is dened as a doubleLoopStr together with nine adjectives, such as Abelian and distributive with their expected meanings.Certain extensions of a ring, such as a eld, will only extend the list of adjectives (for example by commutative), which permits all Mizar mechanisms (functors, denitions, theorems) associated with rings to also work with elds.Mizar allows adjectives to be used in the eld selector types, which corresponds to structures with resticted values.This is used for SCMs (see
Here it is only important to note that inheritance does allow not only ring extensions, but also permits the use of group theory for rings and elds, since the group tuple multLoopStr is a sub-tuple of that of doubleLoopStr.This means that being a group dened for multLoopStr must allow tuples that have more than the required selectors.However, there are cases where we want to express the fact that a group has precisely the multLoopStr selectors, namely that the tuple does not have any other elements.This is achieved using the Mizar attribute strict that can be applied to any structure, which species that only the selectors from that structure are allowed.The need for strict can be illustrated by the following example.Consider the set of all groups over Z 3 .This set is nite if and only if we consider strict structures.The net hierarchy of basic algebraic structures in the MML is depicted in Fig. 1.

Structure Preliminaries
In the Mizar literature the word structure is used both for structure prototypes (e.g. the type of rings) and for actual structure instances (e.g.individual objects that are of the type of rings).We will try to distinguish the two when it is not clear from the context.Structure instances will be represented as set theoretic functions.We will use our Isabelle reformalization of the Mizar set theoretic relations for this purpose.Structure prototype denitions will correspond to schemes of functions, which can be further restricted by the given adjectives.

Structure Operations
A structure prototype denition will describe functions given as sets of assignments.Each assignment is of the form x → y, where x is a unique label (selector) and y is the specication given to that eld of the structure.As the specication may refer to the other parts of the structure (for example the zero in the ring is an element of the carrier), y needs to be a meta-level function which, when given the structure instance as an argument returns the type of that eld.We present here the general denitions of the selector and of the single eld in a structure in our formalization: denition TheSelectorOf ("the _ of _ " [90,90] 190) where "func the selector of Term → object means λit.
for T be object st selector,T in Term holds it = T" denition Field ("_ → _" 91) where "selector → spec ≡ define_attr ( λit. the selector of it be spec(it) & selector in dom it)" With this we can introduce a Mizar-like syntax for structure prototypes (# f 1 ; . . .; f n #), where each eld f i is described by an assignment sel → spec(it).
Most basic structure prototypes ignore the argument: denition one_sorted :: "Mode" ("one-sorted") where "struct one-sorted (# carrier → λ_.set #)" We now dene the domain of a structure prototype as the minimal set that is contained in the domain of any instance.This allows the following denition to be a global one, however the result makes sense only for a particular prototype.
denition domain_of::"Mode ⇒ Set" ("domain'_of _" 200) where "func domain_of M → set means ( λit. (ex X be M st it = dom X) & (for X be M holds it ⊆ dom X))" The fact that we know the domain globally also allows creating strict as an attribute.The attribute should consider the domain of the structure type, which may be the last argument after other attributes.Not to restrict the order of attributes, the Isabelle version of strict requires an argument, which repeats the mode.For example strict one-sorted || one-sorted.
denition strict :: "Mode ⇒ Attr" ("strict _" 200) where "attr strict M means ( λX.X be M & dom X = domain_of M)" We can nally introduce the restriction of an instance to a strict structure using the restriction of a function domain denoted with the slash operator.

Structure Prototype Introduction
To dene an actual structure prototype, it is necessary to use an actual set of labels which are pairwise dierent.In principle strings could be natural for this purpose.However, as we prefer to reduce the required part of the library foundations, we chose to use the set theoretic natural numbers dened by 0 = {} and succ(X ) = X ∪ {X}.
Furthermore, to dene an actual structure prototype, it is necessary to show non-emptiness, that is that there exists a structure instance which fullls the structure prototype conditions.To show such existence, Mizar requires the nonemptiness of all structure eld specications.For this, we use the global choice operator .For each eld (selector → specication) we take the pair selector, (specication) .We show that the set of such pairs for all elds of the structure fullls the prototype conditions (with convenient automation to show such existence, see Mizar_struct le).For example, for doubleLoopStr we use: term "{ carrier, the set } ∪ { addF, the BinOp-of the set } ∪ { ZeroF, the Element-of the set } ∪ { multF, the BinOp-of the set } ∪ { OneF,the Element-of the set }"

.,vn]
The generality of the denition could quickly lead to a version of the Russell's paradox, as according to the Tarski-Groethendieck axiomatization everything is a set.Therefore, the set comprehension operator is well-formed only when all the types Θ 1 , Θ 2 , . . ., Θ n have the sethood property (otherwise Mizar reports Error 86: It is only meaningful for sethood property , see [7] for more details).Denition 1.A Mizar-type Θ has the sethood property if all objects of the type Θ are elements of some set.
We dene sethood in Isabelle/Mizar and make sure that it is proved for the most important Mizar types (Mizar allows the inheritance of sethood).With this, we can show the existence of sets described by comprehensions.The Isabelle/Mizar statement and proof are quite involved, so we present these mostly in mathematical setting.
Theorem 1.Let Θ be a Mizar type with the sethood property, P be a unary predicate and F be a unary function dened on Θ.Then there exists a set C such that each x is a member of C if and only if there exists a v of type Θ such that x = F (v) ∧ P (v).
Proof.The proof only relies on the Tarski-Groethendieck axiom of Replacement.
Consider the set S ethood that contains all objects of the type Θ.Furthermore, consider the binary relation R 1 dened for a predicate P as R 1 (x, y) ⇐⇒ x = y ∧ P (x).Then, by the axiom of Replacement, there exists a set S eparation , such that x is a member of S eparation if and only if there exists y that is a member of S ethood and R 1 (x, y).Now S eparation contains the objects of the type Θ which satisfy P and only such objects.We can use the Replacement axiom again for the unary relation λy.∃x.y = F (x) and the set S ethood .This gives the image of the function F on the set S ethood .This set fullls the requirement of the theorem statement.
The theorem was so far limited to unary predicates and functions.To adapt it to multiple arguments, we can consider the Cartesian product together with the property that two tuples are equal, if their corresponding elements are equal.
In our Isabelle/Mizar formalization we introduced the Cartesian product in the zfmisc_1 theory corresponding to the Mizar article with the same name.This can used to show set comprehensions with multiple arguments: Theorem 2. Let Θ 1 , Θ 2 , . . ., Θ n be Mizar types with the sethood property, P be an n-argument predicate and F be an n-argument function dened for the arguments of the types Θ 1 , Θ 2 , . . ., Θ n .Then there exists a set C such that x is a member of C if and only if there exists v Proof.Consider the sets S i which contain objects of the types Θ i .Consider the binary relation R 1 , dened as λxy.x = y ∧ ∃ v1,v2,...,vn x = . . .v 1 , v 2 , v 3 , . . ., v n ∧ P (v 1 , v 2 , . . ., v n ) The Replacement axiom can be used to obtain the set S eparation for which x is a member of S eparation if and only if there exists y that is a member of (. . .((S 1 × S 2 ) × S 3 ) . ..) × S n and R 1 (x, y).Using the Replacement axiom again for the relation λxy.∃ v1,v2,...,vn x = .
and the set S ethood , we obtain the set C.
The following example collects the results of the function f on the set X and can be shown to be equivalent to the range of the function restricted to the set.term "{f.x where x be Element-of dom f: x in X}" Set comprehensions are often used in the MML to dene sets of terms without additional properties.The following syntax has been introduced so simplify such comprehension terms: the set of all t(v1,v2,. ..,vn)where v1 is Θ1, v2 is Θ2,. ..,vn is Θn which abbreviates: {t(v1,v2,. ..,vn)where v1 is Θ1, v2 is Θ2,. ..,vn is Θ2: non contradiction}.Just like for set comprehensions we add this abbreviation together with the Mizar notation.It can be seen for example in the following theorem: theorem funct_1_th_110: assumes "B be non empty | functional set" "f be Function" "f = union B" shows "dom f = union the set-of-all dom g where g be Element-of B" "rng f = union the set-of-all rng g where g be Element-of B"

Case Studies
In this section we argue that our model of structures is not only correct based on the Tarski-Groethendieck set theory axioms, but also that it is adequate for Mizar-like formalization.For this, we formalized a part of Mizar's group theory in Isabelle dening the basic concepts as structures, the corresponding attributes, and showing a number of their properties.We also show how groups combine with set comprehensions and a more involved inheritance example.All Isabelle examples have same identiers as their Mizar counterparts to ease comparison.

Algebraic structures
We rst dene the Mizar type of groups as the multiplicative magma structure multMagma with three adjectives.We dene the identity in the group and an inverse, where the group operation is dened as usual.
abbreviation Group where "Group ≡ Group-like | associative | non empty-struct multMagma" denition group_1_def_4 ("1'._" [1000] 99) where where Next, we show a number of theorems about groups.We show here only a property that each group fulls properties of semigroups with involution.The Mizar formalization does not need to repeat the variable declarations, thanks to the reserve mechanism, which is similar to Isabelle locales, but for each theorem only the variables and assumptions that are actually needed for its statement are exported.We do not have a complete mechanism of this kind yet.
theorem group_1_th_16: assumes "G be Group" "h be Element-of-struct G" "g be Element-of-struct G" shows "(h We have also reproved the 13 schemes that talk about set comprehension.
We show here two, one that combines set comprehension with functions, and one that uses nested comprehensions.
theorem Fraenkel_sch_9: assumes "A be set" "B be set" "X be set" "f be Function-of A,B" "g be Function-of A,B" "(f | X) = (g | X)" "for u being Element-of A st u in X holds P(u) iff Q(u)" shows "{ f. u where u be Element-of A : P(u) & u in X } = { g. v where v be Element-of A : Q(v) & v in X }" theorem Fraenkel_sch_13: assumes T0: "A be set" "B be set" "C be set" "for x1 be object,x2 be object holds F(x1,x2) be Element-of C" shows "{ st1 where st1 be Element-of C: st1 in {F(s1,t1) where s1 be Element-of A, t1 be Element-of B: P(s1,t1) } & Q(st1)} = { F(s2,t2) where s2 be Element-of A,t2 be Element-of B: P(s2,t2) & Q(F(s2,t2))}" We nally look at the combination of groups and set comprehensions.The following two denitions introduce the set of all inverses and the set of results of the group operation: denition group_2_def_1 ( inx " ¥ −1 " 150) where G where g be Element-of-struct G : g in A}" denition group_2_def_2(" _ ⊗_ _" [66, 1000, 67] 66) where We can now show the relationship between these two operations, which is a consequence of the properties of semigroups with involution (group_1_th_16 above).
theorem group_2_th_11: assumes "G be Group" "A be Subset-of-struct G" "B be Subset-of-struct G" shows We nally show a multiple inheritance relation for the double loop structure.
It follows by simple rewriting just using the denitions of the structures.

SCM computer model
The MML models computers as structures whose elements correspond to: the set of instructions, the computer memory, and the functor Execution whose role is to map each instruction to a function from memory states to memory states.The next structure in the formalization is the computer memory (see Fig. 1).
It is also modeled as a structure.The main eld, carrier, corresponds to the actual memory and the set N gives the kind of data that can be stored within it.Note that that in SCMs all memory locations are of the same size [17].The ZeroF We subsequently reformalize a machine with the halt instruction and we show that all the indicated elds have their corresponding types, and that this construction uniquely denes a computer.The proof corresponding to the below denition requires 83 lines of Isabelle proof to justify.The Isabelle proofs are mostly longer are than their Mizar counterparts.This is predominantly because of the lack of type automation for the type system, even if the Mizar type system could be handled by ATPs [15].Similarly, many Isabelle proofs require more labels than the corresponding Mizar ones, which we hope to remedy by developing legibility tools similar to the ones available for Mizar [22].Finally it would be interesting to mechanically translate MML statements or even proofs and imitate the behavior of Mizar's automation.

Fig. 1 .
Fig.1.Net of basic algebraic and computer-related structures in the MML following[8].The presented ones have already been covered in our formalization.The lower part of each node lists the selectors which are added w.r.t. the inherited ones.AMI (Architecture Model for Instructions) is an abstract computer structure parametrized by the data stored in its memory, further detailed in Sect.5.2.

"
func A ⊗ G B → Subset-of-struct G equals {a ⊗ G b where a be Element-of-struct G, b be Element-of-struct G : a in A & b in B}" denition extpro_1_def_1 ("Trivial-AMI _") where "func Trivial-AMI N → strict AMI-Struct-over N AMI-Struct-over N means ( λit. the carrier of it = {0} & the ZeroF of it = 0 & the InstructionsF of it = {[0,{},{}]} & the Object-Kind of it = {0} !E> 0 & the ValuesF of it = N !E> NAT & the Execution of it = {[0,{},{}]} !E> id product(N !E> NAT • {0} !E> 0))" Next, we introduce the Exec functor.Applying the instruction I to (the Execution of S) we should obtain a function that can be given a memory state as input and returns a memory state.Again showing the correctness of the denitions and that these properties hold requires 57 lines of Isabelle proofs.denition extpro_1_def_2( "Exec _'(_ , _')" 190) where "func Exec S (I,s) → State-of S equals ((the Execution of S).I).s " denition extpro_1_def_3("halting _") where "attr halting S means ( λI.I be Instruction-of S & (for s be State-of S holds Exec S (I,s) = s))"We nally show, that Trivial-AMI N is of the computer type and that it does halt, which shows the non-emptiness of the Mizar type of computers.
theorem extpro_1: assumes "N be with_zero set" shows "halt Trivial-AMI N is halting Trivial-AMI N" Mizar structures and set comprehension operators complete the foundations of Mizar as an Isabelle object logic.This allows manual translation of the MML to Isabelle/Mizar, as we have shown with the Mizar theory of basic algebraic structures including SCMs.We have dened 90 concepts where 27 of them required justications and proved 105 registrations, 31 theorems that discuss based algebraic structures and set comprehensions, as well as inheritance relations between 15 structures.We have dened also 27 concepts where 14 of them required justication and proved 12 registrations, 3 theorems about SCMs.The total combined size of the development is 513 kB and 8295 lines of proofs.It is available at: http://cl-informatik.uibk.ac.at/cek/macis2017/ .4): → BinOp of the carrier, ZeroF → Element of the carrier, multF → BinOp of the carrier, OneF → Element of the carrier #) denition "struct doubleLoopStr (# carrier → λS.set; addF → λS.BinOp-of the carrier of S; ZeroF → λS.Element-of the carrier of S; multF → λS.BinOp-of the carrier of S; OneF → λS.Element-of the carrier of S #)" J|A-independent |homogeneous |with_halt |standard-ins set" InsCode i is an instruction number represented by a natural number, JumpPart i is a list of natural numbers used by the Execution functor to compute the following instruction numbers, and AddressPart i is a list objects passed to the instructions as arguments.The with_halt adjective means that the set I includes a halt instruction.The halt instruction is represented as [0,{},{}], where the empty set corresponds to the empty list.The adjectives homogeneous and J|A-independent specify a subset of instructions which share the number InsCode and are necessary for the denition of the Execution functor.homogeneous species, that the JumpPart lists of arguments given to the InsCode instruction are always of the same length (for example goto always requires one argument).J|A-independent species that every list of the appropriate length can be handled (for the goto example, Execution must be able to perform a goto instruction to every location). where [17]is the instruction counter.It corresponds to the number of the instruction performed in the given state.Object-Kind indicates the kind of data stored in the given memory location and ValuesF gives the value range for the given type.We can now formulate the Mizar type of a computer and show the nonemptiness of this type.The type is a structure parametrized by the data stored in the memory of the computer.The name AMI (for Architecture Model for Instructions ) is used in the Mizar dictionaries to refer to this structure as a type and SCM is an object of the type[17].Element-of the carrier of S; InstructionsF → λ_.Instructions; Object-Kind → λS.Function-of the carrier of S, N; ValuesF → λS.ManySortedSet-of N; Execution → λS.Action-of the InstructionsF of S, product ((the ValuesF of S)*`the Object-Kind of S)#)"