Natarajan Shankar Sam Owre Principles and Pragmatics of Subtyping in PVS. 37-52 1999 conf/wadt/1999 WADT db/conf/wadt/wadt1999.html#ShankarO99