Added the formal model and proofs of type safety