src/HOL/UNITY/ProgressSets.thy
author haftmann
Sun Mar 16 18:09:04 2014 +0100 (2014-03-16)
changeset 56166 9a241bc276cd
parent 51488 3c886fe611b8
child 58889 5b7a9633cfa8
permissions -rw-r--r--
normalising simp rules for compound operators
wenzelm@32960
     1
(*  Title:      HOL/UNITY/ProgressSets.thy
paulson@13853
     2
    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
paulson@13853
     3
    Copyright   2003  University of Cambridge
paulson@13853
     4
paulson@13853
     5
Progress Sets.  From 
paulson@13853
     6
paulson@13853
     7
    David Meier and Beverly Sanders,
paulson@13853
     8
    Composing Leads-to Properties
paulson@13853
     9
    Theoretical Computer Science 243:1-2 (2000), 339-361.
paulson@13861
    10
paulson@13861
    11
    David Meier,
paulson@13861
    12
    Progress Properties in Program Refinement and Parallel Composition
paulson@13861
    13
    Swiss Federal Institute of Technology Zurich (1997)
paulson@13853
    14
*)
paulson@13853
    15
paulson@13853
    16
header{*Progress Sets*}
paulson@13853
    17
haftmann@16417
    18
theory ProgressSets imports Transformers begin
paulson@13853
    19
paulson@13866
    20
subsection {*Complete Lattices and the Operator @{term cl}*}
paulson@13866
    21
haftmann@35416
    22
definition lattice :: "'a set set => bool" where
paulson@13861
    23
   --{*Meier calls them closure sets, but they are just complete lattices*}
paulson@13861
    24
   "lattice L ==
wenzelm@32960
    25
         (\<forall>M. M \<subseteq> L --> \<Inter>M \<in> L) & (\<forall>M. M \<subseteq> L --> \<Union>M \<in> L)"
paulson@13853
    26
haftmann@35416
    27
definition cl :: "['a set set, 'a set] => 'a set" where
paulson@13853
    28
   --{*short for ``closure''*}
paulson@13861
    29
   "cl L r == \<Inter>{x. x\<in>L & r \<subseteq> x}"
paulson@13853
    30
paulson@13861
    31
lemma UNIV_in_lattice: "lattice L ==> UNIV \<in> L"
paulson@13861
    32
by (force simp add: lattice_def)
paulson@13853
    33
paulson@13861
    34
lemma empty_in_lattice: "lattice L ==> {} \<in> L"
paulson@13861
    35
by (force simp add: lattice_def)
paulson@13853
    36
paulson@13861
    37
lemma Union_in_lattice: "[|M \<subseteq> L; lattice L|] ==> \<Union>M \<in> L"
paulson@13861
    38
by (simp add: lattice_def)
paulson@13853
    39
paulson@13861
    40
lemma Inter_in_lattice: "[|M \<subseteq> L; lattice L|] ==> \<Inter>M \<in> L"
paulson@13861
    41
by (simp add: lattice_def)
paulson@13853
    42
paulson@13861
    43
lemma UN_in_lattice:
paulson@13861
    44
     "[|lattice L; !!i. i\<in>I ==> r i \<in> L|] ==> (\<Union>i\<in>I. r i) \<in> L"
haftmann@44106
    45
apply (unfold SUP_def)
paulson@13861
    46
apply (blast intro: Union_in_lattice) 
paulson@13853
    47
done
paulson@13853
    48
paulson@13861
    49
lemma INT_in_lattice:
paulson@13861
    50
     "[|lattice L; !!i. i\<in>I ==> r i \<in> L|] ==> (\<Inter>i\<in>I. r i)  \<in> L"
haftmann@44106
    51
apply (unfold INF_def)
paulson@13861
    52
apply (blast intro: Inter_in_lattice) 
paulson@13853
    53
done
paulson@13853
    54
paulson@13861
    55
lemma Un_in_lattice: "[|x\<in>L; y\<in>L; lattice L|] ==> x\<union>y \<in> L"
haftmann@44106
    56
  using Union_in_lattice [of "{x, y}" L] by simp
paulson@13853
    57
paulson@13861
    58
lemma Int_in_lattice: "[|x\<in>L; y\<in>L; lattice L|] ==> x\<inter>y \<in> L"
haftmann@44106
    59
  using Inter_in_lattice [of "{x, y}" L] by simp
paulson@13853
    60
paulson@13861
    61
lemma lattice_stable: "lattice {X. F \<in> stable X}"
paulson@13861
    62
by (simp add: lattice_def stable_def constrains_def, blast)
paulson@13853
    63
paulson@13861
    64
text{*The next three results state that @{term "cl L r"} is the minimal
paulson@13861
    65
 element of @{term L} that includes @{term r}.*}
paulson@13861
    66
lemma cl_in_lattice: "lattice L ==> cl L r \<in> L"
paulson@13861
    67
apply (simp add: lattice_def cl_def)
paulson@13853
    68
apply (erule conjE)  
paulson@13853
    69
apply (drule spec, erule mp, blast) 
paulson@13853
    70
done
paulson@13853
    71
paulson@13861
    72
lemma cl_least: "[|c\<in>L; r\<subseteq>c|] ==> cl L r \<subseteq> c" 
paulson@13853
    73
by (force simp add: cl_def)
paulson@13853
    74
paulson@13853
    75
text{*The next three lemmas constitute assertion (4.61)*}
paulson@13861
    76
lemma cl_mono: "r \<subseteq> r' ==> cl L r \<subseteq> cl L r'"
paulson@13861
    77
by (simp add: cl_def, blast)
paulson@13861
    78
paulson@13861
    79
lemma subset_cl: "r \<subseteq> cl L r"
noschinl@44918
    80
by (simp add: cl_def le_Inf_iff)
paulson@13861
    81
paulson@13874
    82
text{*A reformulation of @{thm subset_cl}*}
paulson@13874
    83
lemma clI: "x \<in> r ==> x \<in> cl L r"
paulson@13874
    84
by (simp add: cl_def, blast)
paulson@13874
    85
paulson@13874
    86
text{*A reformulation of @{thm cl_least}*}
paulson@13874
    87
lemma clD: "[|c \<in> cl L r; B \<in> L; r \<subseteq> B|] ==> c \<in> B"
paulson@13874
    88
by (force simp add: cl_def)
paulson@13874
    89
paulson@13861
    90
lemma cl_UN_subset: "(\<Union>i\<in>I. cl L (r i)) \<subseteq> cl L (\<Union>i\<in>I. r i)"
paulson@13853
    91
by (simp add: cl_def, blast)
paulson@13853
    92
paulson@13861
    93
lemma cl_Un: "lattice L ==> cl L (r\<union>s) = cl L r \<union> cl L s"
paulson@13861
    94
apply (rule equalityI) 
paulson@13861
    95
 prefer 2 
paulson@13861
    96
  apply (simp add: cl_def, blast)
paulson@13861
    97
apply (rule cl_least)
paulson@13861
    98
 apply (blast intro: Un_in_lattice cl_in_lattice)
paulson@13861
    99
apply (blast intro: subset_cl [THEN subsetD])  
paulson@13861
   100
done
paulson@13853
   101
paulson@13861
   102
lemma cl_UN: "lattice L ==> cl L (\<Union>i\<in>I. r i) = (\<Union>i\<in>I. cl L (r i))"
paulson@13853
   103
apply (rule equalityI) 
paulson@13866
   104
 prefer 2 apply (simp add: cl_def, blast)
paulson@13853
   105
apply (rule cl_least)
paulson@13861
   106
 apply (blast intro: UN_in_lattice cl_in_lattice)
paulson@13853
   107
apply (blast intro: subset_cl [THEN subsetD])  
paulson@13853
   108
done
paulson@13853
   109
paulson@13874
   110
lemma cl_Int_subset: "cl L (r\<inter>s) \<subseteq> cl L r \<inter> cl L s"
paulson@13874
   111
by (simp add: cl_def, blast)
paulson@13874
   112
paulson@13861
   113
lemma cl_idem [simp]: "cl L (cl L r) = cl L r"
paulson@13853
   114
by (simp add: cl_def, blast)
paulson@13853
   115
paulson@13861
   116
lemma cl_ident: "r\<in>L ==> cl L r = r" 
paulson@13853
   117
by (force simp add: cl_def)
paulson@13853
   118
paulson@13874
   119
lemma cl_empty [simp]: "lattice L ==> cl L {} = {}"
paulson@13874
   120
by (simp add: cl_ident empty_in_lattice)
paulson@13874
   121
paulson@13874
   122
lemma cl_UNIV [simp]: "lattice L ==> cl L UNIV = UNIV"
paulson@13874
   123
by (simp add: cl_ident UNIV_in_lattice)
paulson@13874
   124
paulson@13853
   125
text{*Assertion (4.62)*}
paulson@13861
   126
lemma cl_ident_iff: "lattice L ==> (cl L r = r) = (r\<in>L)" 
paulson@13853
   127
apply (rule iffI) 
paulson@13853
   128
 apply (erule subst)
paulson@13861
   129
 apply (erule cl_in_lattice)  
paulson@13853
   130
apply (erule cl_ident) 
paulson@13853
   131
done
paulson@13853
   132
paulson@13861
   133
lemma cl_subset_in_lattice: "[|cl L r \<subseteq> r; lattice L|] ==> r\<in>L" 
paulson@13861
   134
by (simp add: cl_ident_iff [symmetric] equalityI subset_cl)
paulson@13861
   135
paulson@13861
   136
paulson@13866
   137
subsection {*Progress Sets and the Main Lemma*}
paulson@13888
   138
text{*A progress set satisfies certain closure conditions and is a 
paulson@13888
   139
simple way of including the set @{term "wens_set F B"}.*}
paulson@13866
   140
haftmann@35416
   141
definition closed :: "['a program, 'a set, 'a set,  'a set set] => bool" where
paulson@13861
   142
   "closed F T B L == \<forall>M. \<forall>act \<in> Acts F. B\<subseteq>M & T\<inter>M \<in> L -->
paulson@13861
   143
                              T \<inter> (B \<union> wp act M) \<in> L"
paulson@13861
   144
haftmann@35416
   145
definition progress_set :: "['a program, 'a set, 'a set] => 'a set set set" where
paulson@13861
   146
   "progress_set F T B ==
paulson@13870
   147
      {L. lattice L & B \<in> L & T \<in> L & closed F T B L}"
paulson@13861
   148
paulson@13861
   149
lemma closedD:
paulson@13861
   150
   "[|closed F T B L; act \<in> Acts F; B\<subseteq>M; T\<inter>M \<in> L|] 
paulson@14150
   151
    ==> T \<inter> (B \<union> wp act M) \<in> L" 
paulson@13861
   152
by (simp add: closed_def) 
paulson@13861
   153
paulson@13866
   154
text{*Note: the formalization below replaces Meier's @{term q} by @{term B}
paulson@13866
   155
and @{term m} by @{term X}. *}
paulson@13866
   156
paulson@13866
   157
text{*Part of the proof of the claim at the bottom of page 97.  It's
paulson@13866
   158
proved separately because the argument requires a generalization over
paulson@13866
   159
all @{term "act \<in> Acts F"}.*}
paulson@13861
   160
lemma lattice_awp_lemma:
paulson@13866
   161
  assumes TXC:  "T\<inter>X \<in> C" --{*induction hypothesis in theorem below*}
paulson@13866
   162
      and BsubX:  "B \<subseteq> X"   --{*holds in inductive step*}
paulson@13861
   163
      and latt: "lattice C"
paulson@13866
   164
      and TC:   "T \<in> C"
paulson@13866
   165
      and BC:   "B \<in> C"
paulson@13866
   166
      and clos: "closed F T B C"
paulson@13866
   167
    shows "T \<inter> (B \<union> awp F (X \<union> cl C (T\<inter>r))) \<in> C"
paulson@13861
   168
apply (simp del: INT_simps add: awp_def INT_extend_simps) 
paulson@13861
   169
apply (rule INT_in_lattice [OF latt]) 
paulson@13861
   170
apply (erule closedD [OF clos]) 
paulson@13866
   171
apply (simp add: subset_trans [OF BsubX Un_upper1]) 
paulson@13866
   172
apply (subgoal_tac "T \<inter> (X \<union> cl C (T\<inter>r)) = (T\<inter>X) \<union> cl C (T\<inter>r)")
paulson@13874
   173
 prefer 2 apply (blast intro: TC clD) 
paulson@13861
   174
apply (erule ssubst) 
paulson@13866
   175
apply (blast intro: Un_in_lattice latt cl_in_lattice TXC) 
paulson@13861
   176
done
paulson@13861
   177
paulson@13866
   178
text{*Remainder of the proof of the claim at the bottom of page 97.*}
paulson@13861
   179
lemma lattice_lemma:
paulson@13866
   180
  assumes TXC:  "T\<inter>X \<in> C" --{*induction hypothesis in theorem below*}
paulson@13866
   181
      and BsubX:  "B \<subseteq> X"   --{*holds in inductive step*}
paulson@13861
   182
      and act:  "act \<in> Acts F"
paulson@13861
   183
      and latt: "lattice C"
paulson@13866
   184
      and TC:   "T \<in> C"
paulson@13866
   185
      and BC:   "B \<in> C"
paulson@13866
   186
      and clos: "closed F T B C"
paulson@13866
   187
    shows "T \<inter> (wp act X \<inter> awp F (X \<union> cl C (T\<inter>r)) \<union> X) \<in> C"
paulson@13866
   188
apply (subgoal_tac "T \<inter> (B \<union> wp act X) \<in> C")
paulson@13866
   189
 prefer 2 apply (simp add: closedD [OF clos] act BsubX TXC)
paulson@13861
   190
apply (drule Int_in_lattice
paulson@13866
   191
              [OF _ lattice_awp_lemma [OF TXC BsubX latt TC BC clos, of r]
paulson@13861
   192
                    latt])
paulson@13861
   193
apply (subgoal_tac
wenzelm@32960
   194
         "T \<inter> (B \<union> wp act X) \<inter> (T \<inter> (B \<union> awp F (X \<union> cl C (T\<inter>r)))) = 
wenzelm@32960
   195
          T \<inter> (B \<union> wp act X \<inter> awp F (X \<union> cl C (T\<inter>r)))") 
paulson@13861
   196
 prefer 2 apply blast 
paulson@13861
   197
apply simp  
paulson@13866
   198
apply (drule Un_in_lattice [OF _ TXC latt])  
paulson@13861
   199
apply (subgoal_tac
wenzelm@32960
   200
         "T \<inter> (B \<union> wp act X \<inter> awp F (X \<union> cl C (T\<inter>r))) \<union> T\<inter>X = 
wenzelm@32960
   201
          T \<inter> (wp act X \<inter> awp F (X \<union> cl C (T\<inter>r)) \<union> X)")
paulson@13866
   202
 apply simp 
paulson@13866
   203
apply (blast intro: BsubX [THEN subsetD]) 
paulson@13861
   204
done
paulson@13861
   205
paulson@13861
   206
paulson@13866
   207
text{*Induction step for the main lemma*}
paulson@13861
   208
lemma progress_induction_step:
paulson@13866
   209
  assumes TXC:  "T\<inter>X \<in> C" --{*induction hypothesis in theorem below*}
paulson@13861
   210
      and act:  "act \<in> Acts F"
paulson@13866
   211
      and Xwens: "X \<in> wens_set F B"
paulson@13861
   212
      and latt: "lattice C"
paulson@13866
   213
      and  TC:  "T \<in> C"
paulson@13866
   214
      and  BC:  "B \<in> C"
paulson@13866
   215
      and clos: "closed F T B C"
paulson@13861
   216
      and Fstable: "F \<in> stable T"
paulson@13866
   217
  shows "T \<inter> wens F act X \<in> C"
paulson@13861
   218
proof -
paulson@13866
   219
  from Xwens have BsubX: "B \<subseteq> X"
paulson@13866
   220
    by (rule wens_set_imp_subset) 
paulson@13866
   221
  let ?r = "wens F act X"
paulson@13866
   222
  have "?r \<subseteq> (wp act X \<inter> awp F (X\<union>?r)) \<union> X"
paulson@13866
   223
    by (simp add: wens_unfold [symmetric])
paulson@13866
   224
  then have "T\<inter>?r \<subseteq> T \<inter> ((wp act X \<inter> awp F (X\<union>?r)) \<union> X)"
paulson@13866
   225
    by blast
paulson@13866
   226
  then have "T\<inter>?r \<subseteq> T \<inter> ((wp act X \<inter> awp F (T \<inter> (X\<union>?r))) \<union> X)"
paulson@13866
   227
    by (simp add: awp_Int_eq Fstable stable_imp_awp_ident, blast) 
paulson@13866
   228
  then have "T\<inter>?r \<subseteq> T \<inter> ((wp act X \<inter> awp F (X \<union> cl C (T\<inter>?r))) \<union> X)"
paulson@13866
   229
    by (blast intro: awp_mono [THEN [2] rev_subsetD] subset_cl [THEN subsetD])
paulson@13866
   230
  then have "cl C (T\<inter>?r) \<subseteq> 
paulson@13866
   231
             cl C (T \<inter> ((wp act X \<inter> awp F (X \<union> cl C (T\<inter>?r))) \<union> X))"
paulson@13866
   232
    by (rule cl_mono) 
paulson@13866
   233
  then have "cl C (T\<inter>?r) \<subseteq> 
paulson@13866
   234
             T \<inter> ((wp act X \<inter> awp F (X \<union> cl C (T\<inter>?r))) \<union> X)"
paulson@13866
   235
    by (simp add: cl_ident lattice_lemma [OF TXC BsubX act latt TC BC clos])
paulson@13866
   236
  then have "cl C (T\<inter>?r) \<subseteq> (wp act X \<inter> awp F (X \<union> cl C (T\<inter>?r))) \<union> X"
paulson@13866
   237
    by blast
paulson@13866
   238
  then have "cl C (T\<inter>?r) \<subseteq> ?r"
paulson@13866
   239
    by (blast intro!: subset_wens) 
paulson@13866
   240
  then have cl_subset: "cl C (T\<inter>?r) \<subseteq> T\<inter>?r"
haftmann@32693
   241
    by (simp add: cl_ident TC
paulson@13866
   242
                  subset_trans [OF cl_mono [OF Int_lower1]]) 
paulson@13866
   243
  show ?thesis
paulson@13866
   244
    by (rule cl_subset_in_lattice [OF cl_subset latt]) 
paulson@13861
   245
qed
paulson@13861
   246
paulson@13888
   247
text{*Proved on page 96 of Meier's thesis.  The special case when
paulson@13888
   248
   @{term "T=UNIV"} states that every progress set for the program @{term F}
paulson@13888
   249
   and set @{term B} includes the set @{term "wens_set F B"}.*}
paulson@13861
   250
lemma progress_set_lemma:
paulson@13870
   251
     "[|C \<in> progress_set F T B; r \<in> wens_set F B; F \<in> stable T|] ==> T\<inter>r \<in> C"
paulson@13861
   252
apply (simp add: progress_set_def, clarify) 
paulson@13861
   253
apply (erule wens_set.induct) 
paulson@13861
   254
  txt{*Base*}
paulson@13861
   255
  apply (simp add: Int_in_lattice) 
paulson@13861
   256
 txt{*The difficult @{term wens} case*}
paulson@13861
   257
 apply (simp add: progress_induction_step) 
paulson@13861
   258
txt{*Disjunctive case*}
paulson@13861
   259
apply (subgoal_tac "(\<Union>U\<in>W. T \<inter> U) \<in> C") 
haftmann@56166
   260
 apply simp 
paulson@13861
   261
apply (blast intro: UN_in_lattice) 
paulson@13861
   262
done
paulson@13861
   263
paulson@13866
   264
paulson@13866
   265
subsection {*The Progress Set Union Theorem*}
paulson@13866
   266
paulson@13866
   267
lemma closed_mono:
paulson@13866
   268
  assumes BB':  "B \<subseteq> B'"
paulson@13866
   269
      and TBwp: "T \<inter> (B \<union> wp act M) \<in> C"
paulson@13866
   270
      and B'C:  "B' \<in> C"
paulson@13866
   271
      and TC:   "T \<in> C"
paulson@13866
   272
      and latt: "lattice C"
paulson@13866
   273
  shows "T \<inter> (B' \<union> wp act M) \<in> C"
paulson@13866
   274
proof -
paulson@13866
   275
  from TBwp have "(T\<inter>B) \<union> (T \<inter> wp act M) \<in> C"
paulson@13866
   276
    by (simp add: Int_Un_distrib)
paulson@13866
   277
  then have TBBC: "(T\<inter>B') \<union> ((T\<inter>B) \<union> (T \<inter> wp act M)) \<in> C"
paulson@13866
   278
    by (blast intro: Int_in_lattice Un_in_lattice TC B'C latt) 
paulson@13866
   279
  show ?thesis
paulson@13866
   280
    by (rule eqelem_imp_iff [THEN iffD1, OF _ TBBC], 
paulson@13866
   281
        blast intro: BB' [THEN subsetD]) 
paulson@13866
   282
qed
paulson@13866
   283
paulson@13866
   284
paulson@13866
   285
lemma progress_set_mono:
paulson@13866
   286
    assumes BB':  "B \<subseteq> B'"
paulson@13866
   287
    shows
paulson@13866
   288
     "[| B' \<in> C;  C \<in> progress_set F T B|] 
paulson@13866
   289
      ==> C \<in> progress_set F T B'"
paulson@13866
   290
by (simp add: progress_set_def closed_def closed_mono [OF BB'] 
paulson@13866
   291
                 subset_trans [OF BB']) 
paulson@13866
   292
paulson@13866
   293
theorem progress_set_Union:
paulson@13874
   294
  assumes leadsTo: "F \<in> A leadsTo B'"
paulson@13874
   295
      and prog: "C \<in> progress_set F T B"
paulson@13870
   296
      and Fstable: "F \<in> stable T"
paulson@13866
   297
      and BB':  "B \<subseteq> B'"
paulson@13866
   298
      and B'C:  "B' \<in> C"
paulson@13866
   299
      and Gco: "!!X. X\<in>C ==> G \<in> X-B co X"
paulson@13866
   300
  shows "F\<squnion>G \<in> T\<inter>A leadsTo B'"
paulson@13870
   301
apply (insert prog Fstable) 
paulson@13866
   302
apply (rule leadsTo_Join [OF leadsTo]) 
paulson@13866
   303
  apply (force simp add: progress_set_def awp_iff_stable [symmetric]) 
paulson@13866
   304
apply (simp add: awp_iff_constrains)
paulson@13866
   305
apply (drule progress_set_mono [OF BB' B'C]) 
paulson@13866
   306
apply (blast intro: progress_set_lemma Gco constrains_weaken_L 
paulson@13866
   307
                    BB' [THEN subsetD]) 
paulson@13866
   308
done
paulson@13866
   309
paulson@13870
   310
paulson@13870
   311
subsection {*Some Progress Sets*}
paulson@13870
   312
paulson@13870
   313
lemma UNIV_in_progress_set: "UNIV \<in> progress_set F T B"
paulson@13870
   314
by (simp add: progress_set_def lattice_def closed_def)
paulson@13870
   315
paulson@13874
   316
paulson@13874
   317
paulson@13885
   318
subsubsection {*Lattices and Relations*}
paulson@13874
   319
text{*From Meier's thesis, section 4.5.3*}
paulson@13874
   320
haftmann@35416
   321
definition relcl :: "'a set set => ('a * 'a) set" where
paulson@13885
   322
    -- {*Derived relation from a lattice*}
paulson@13874
   323
    "relcl L == {(x,y). y \<in> cl L {x}}"
paulson@13885
   324
  
haftmann@35416
   325
definition latticeof :: "('a * 'a) set => 'a set set" where
paulson@13885
   326
    -- {*Derived lattice from a relation: the set of upwards-closed sets*}
paulson@13885
   327
    "latticeof r == {X. \<forall>s t. s \<in> X & (s,t) \<in> r --> t \<in> X}"
paulson@13885
   328
paulson@13874
   329
paulson@13874
   330
lemma relcl_refl: "(a,a) \<in> relcl L"
paulson@13874
   331
by (simp add: relcl_def subset_cl [THEN subsetD])
paulson@13874
   332
paulson@13874
   333
lemma relcl_trans:
paulson@13874
   334
     "[| (a,b) \<in> relcl L; (b,c) \<in> relcl L; lattice L |] ==> (a,c) \<in> relcl L"
paulson@13874
   335
apply (simp add: relcl_def)
paulson@13874
   336
apply (blast intro: clD cl_in_lattice)
paulson@13874
   337
done
paulson@13874
   338
nipkow@30198
   339
lemma refl_relcl: "lattice L ==> refl (relcl L)"
nipkow@30198
   340
by (simp add: refl_onI relcl_def subset_cl [THEN subsetD])
paulson@13874
   341
paulson@13874
   342
lemma trans_relcl: "lattice L ==> trans (relcl L)"
paulson@13874
   343
by (blast intro: relcl_trans transI)
paulson@13874
   344
paulson@13885
   345
lemma lattice_latticeof: "lattice (latticeof r)"
paulson@13885
   346
by (auto simp add: lattice_def latticeof_def)
paulson@13885
   347
paulson@13885
   348
lemma lattice_singletonI:
paulson@13885
   349
     "[|lattice L; !!s. s \<in> X ==> {s} \<in> L|] ==> X \<in> L"
paulson@13885
   350
apply (cut_tac UN_singleton [of X]) 
paulson@13885
   351
apply (erule subst) 
paulson@13885
   352
apply (simp only: UN_in_lattice) 
paulson@13885
   353
done
paulson@13885
   354
paulson@13885
   355
text{*Equation (4.71) of Meier's thesis.  He gives no proof.*}
paulson@13885
   356
lemma cl_latticeof:
nipkow@30198
   357
     "[|refl r; trans r|] 
paulson@13885
   358
      ==> cl (latticeof r) X = {t. \<exists>s. s\<in>X & (s,t) \<in> r}" 
paulson@13885
   359
apply (rule equalityI) 
paulson@13885
   360
 apply (rule cl_least) 
paulson@13885
   361
  apply (simp (no_asm_use) add: latticeof_def trans_def, blast)
nipkow@30198
   362
 apply (simp add: latticeof_def refl_on_def, blast)
paulson@13885
   363
apply (simp add: latticeof_def, clarify)
paulson@13885
   364
apply (unfold cl_def, blast) 
paulson@13885
   365
done
paulson@13885
   366
paulson@13885
   367
text{*Related to (4.71).*}
paulson@13874
   368
lemma cl_eq_Collect_relcl:
paulson@13874
   369
     "lattice L ==> cl L X = {t. \<exists>s. s\<in>X & (s,t) \<in> relcl L}" 
paulson@13885
   370
apply (cut_tac UN_singleton [of X]) 
paulson@13885
   371
apply (erule subst) 
paulson@13874
   372
apply (force simp only: relcl_def cl_UN)
paulson@13874
   373
done
paulson@13874
   374
paulson@13885
   375
text{*Meier's theorem of section 4.5.3*}
paulson@13885
   376
theorem latticeof_relcl_eq: "lattice L ==> latticeof (relcl L) = L"
paulson@13885
   377
apply (rule equalityI) 
paulson@13885
   378
 prefer 2 apply (force simp add: latticeof_def relcl_def cl_def, clarify) 
paulson@13885
   379
apply (rename_tac X)
paulson@13885
   380
apply (rule cl_subset_in_lattice)   
paulson@13885
   381
 prefer 2 apply assumption
paulson@13885
   382
apply (drule cl_ident_iff [OF lattice_latticeof, THEN iffD2])
paulson@13885
   383
apply (drule equalityD1)   
paulson@13885
   384
apply (rule subset_trans) 
paulson@13885
   385
 prefer 2 apply assumption
paulson@13885
   386
apply (thin_tac "?U \<subseteq> X") 
paulson@13885
   387
apply (cut_tac A=X in UN_singleton) 
paulson@13885
   388
apply (erule subst) 
paulson@13885
   389
apply (simp only: cl_UN lattice_latticeof 
paulson@13885
   390
                  cl_latticeof [OF refl_relcl trans_relcl]) 
paulson@13885
   391
apply (simp add: relcl_def) 
paulson@13885
   392
done
paulson@13885
   393
paulson@13885
   394
theorem relcl_latticeof_eq:
nipkow@30198
   395
     "[|refl r; trans r|] ==> relcl (latticeof r) = r"
berghofe@23767
   396
by (simp add: relcl_def cl_latticeof)
paulson@13885
   397
paulson@13874
   398
paulson@13874
   399
subsubsection {*Decoupling Theorems*}
paulson@13874
   400
haftmann@35416
   401
definition decoupled :: "['a program, 'a program] => bool" where
paulson@13874
   402
   "decoupled F G ==
wenzelm@32960
   403
        \<forall>act \<in> Acts F. \<forall>B. G \<in> stable B --> G \<in> stable (wp act B)"
paulson@13874
   404
paulson@13874
   405
paulson@13874
   406
text{*Rao's Decoupling Theorem*}
paulson@13874
   407
lemma stableco: "F \<in> stable A ==> F \<in> A-B co A"
paulson@13874
   408
by (simp add: stable_def constrains_def, blast) 
paulson@13874
   409
paulson@13874
   410
theorem decoupling:
paulson@13874
   411
  assumes leadsTo: "F \<in> A leadsTo B"
paulson@13874
   412
      and Gstable: "G \<in> stable B"
paulson@13874
   413
      and dec:     "decoupled F G"
paulson@13874
   414
  shows "F\<squnion>G \<in> A leadsTo B"
paulson@13874
   415
proof -
paulson@13874
   416
  have prog: "{X. G \<in> stable X} \<in> progress_set F UNIV B"
paulson@13874
   417
    by (simp add: progress_set_def lattice_stable Gstable closed_def
paulson@13874
   418
                  stable_Un [OF Gstable] dec [unfolded decoupled_def]) 
paulson@13874
   419
  have "F\<squnion>G \<in> (UNIV\<inter>A) leadsTo B" 
paulson@13874
   420
    by (rule progress_set_Union [OF leadsTo prog],
paulson@13874
   421
        simp_all add: Gstable stableco)
paulson@13874
   422
  thus ?thesis by simp
paulson@13874
   423
qed
paulson@13874
   424
paulson@13874
   425
paulson@13874
   426
text{*Rao's Weak Decoupling Theorem*}
paulson@13874
   427
theorem weak_decoupling:
paulson@13874
   428
  assumes leadsTo: "F \<in> A leadsTo B"
paulson@13874
   429
      and stable: "F\<squnion>G \<in> stable B"
paulson@13874
   430
      and dec:     "decoupled F (F\<squnion>G)"
paulson@13874
   431
  shows "F\<squnion>G \<in> A leadsTo B"
paulson@13874
   432
proof -
paulson@13874
   433
  have prog: "{X. F\<squnion>G \<in> stable X} \<in> progress_set F UNIV B" 
paulson@13874
   434
    by (simp del: Join_stable
paulson@13874
   435
             add: progress_set_def lattice_stable stable closed_def
paulson@13874
   436
                  stable_Un [OF stable] dec [unfolded decoupled_def])
paulson@13874
   437
  have "F\<squnion>G \<in> (UNIV\<inter>A) leadsTo B" 
paulson@13874
   438
    by (rule progress_set_Union [OF leadsTo prog],
paulson@13874
   439
        simp_all del: Join_stable add: stable,
paulson@13874
   440
        simp add: stableco) 
paulson@13874
   441
  thus ?thesis by simp
paulson@13874
   442
qed
paulson@13874
   443
paulson@13874
   444
text{*The ``Decoupling via @{term G'} Union Theorem''*}
paulson@13874
   445
theorem decoupling_via_aux:
paulson@13874
   446
  assumes leadsTo: "F \<in> A leadsTo B"
paulson@13874
   447
      and prog: "{X. G' \<in> stable X} \<in> progress_set F UNIV B"
paulson@13874
   448
      and GG':  "G \<le> G'"  
paulson@13874
   449
               --{*Beware!  This is the converse of the refinement relation!*}
paulson@13874
   450
  shows "F\<squnion>G \<in> A leadsTo B"
paulson@13874
   451
proof -
paulson@13874
   452
  from prog have stable: "G' \<in> stable B"
paulson@13874
   453
    by (simp add: progress_set_def)
paulson@13874
   454
  have "F\<squnion>G \<in> (UNIV\<inter>A) leadsTo B" 
paulson@13874
   455
    by (rule progress_set_Union [OF leadsTo prog],
paulson@13874
   456
        simp_all add: stable stableco component_stable [OF GG'])
paulson@13874
   457
  thus ?thesis by simp
paulson@13874
   458
qed
paulson@13874
   459
paulson@13874
   460
paulson@13874
   461
subsection{*Composition Theorems Based on Monotonicity and Commutativity*}
paulson@13874
   462
paulson@13888
   463
subsubsection{*Commutativity of @{term "cl L"} and assignment.*}
haftmann@35416
   464
definition commutes :: "['a program, 'a set, 'a set,  'a set set] => bool" where
paulson@13874
   465
   "commutes F T B L ==
paulson@13874
   466
       \<forall>M. \<forall>act \<in> Acts F. B \<subseteq> M --> 
paulson@13874
   467
           cl L (T \<inter> wp act M) \<subseteq> T \<inter> (B \<union> wp act (cl L (T\<inter>M)))"
paulson@13874
   468
paulson@13874
   469
paulson@13888
   470
text{*From Meier's thesis, section 4.5.6*}
paulson@13885
   471
lemma commutativity1_lemma:
paulson@13874
   472
  assumes commutes: "commutes F T B L" 
paulson@13874
   473
      and lattice:  "lattice L"
paulson@13874
   474
      and BL: "B \<in> L"
paulson@13874
   475
      and TL: "T \<in> L"
paulson@13874
   476
  shows "closed F T B L"
paulson@13874
   477
apply (simp add: closed_def, clarify)
paulson@13874
   478
apply (rule ProgressSets.cl_subset_in_lattice [OF _ lattice])  
haftmann@32693
   479
apply (simp add: Int_Un_distrib cl_Un [OF lattice] 
paulson@13874
   480
                 cl_ident Int_in_lattice [OF TL BL lattice] Un_upper1)
paulson@13874
   481
apply (subgoal_tac "cl L (T \<inter> wp act M) \<subseteq> T \<inter> (B \<union> wp act (cl L (T \<inter> M)))") 
paulson@13874
   482
 prefer 2 
paulson@15102
   483
 apply (cut_tac commutes, simp add: commutes_def) 
paulson@13874
   484
apply (erule subset_trans) 
paulson@13874
   485
apply (simp add: cl_ident)
paulson@13874
   486
apply (blast intro: rev_subsetD [OF _ wp_mono]) 
paulson@13874
   487
done
paulson@13874
   488
paulson@13888
   489
text{*Version packaged with @{thm progress_set_Union}*}
paulson@13885
   490
lemma commutativity1:
paulson@13885
   491
  assumes leadsTo: "F \<in> A leadsTo B"
paulson@13885
   492
      and lattice:  "lattice L"
paulson@13885
   493
      and BL: "B \<in> L"
paulson@13885
   494
      and TL: "T \<in> L"
paulson@13885
   495
      and Fstable: "F \<in> stable T"
paulson@13885
   496
      and Gco: "!!X. X\<in>L ==> G \<in> X-B co X"
paulson@13885
   497
      and commutes: "commutes F T B L" 
paulson@13885
   498
  shows "F\<squnion>G \<in> T\<inter>A leadsTo B"
paulson@13885
   499
by (rule progress_set_Union [OF leadsTo _ Fstable subset_refl BL Gco],
paulson@13885
   500
    simp add: progress_set_def commutativity1_lemma commutes lattice BL TL) 
paulson@13885
   501
paulson@13885
   502
paulson@13885
   503
paulson@13874
   504
text{*Possibly move to Relation.thy, after @{term single_valued}*}
haftmann@35416
   505
definition funof :: "[('a*'b)set, 'a] => 'b" where
paulson@13874
   506
   "funof r == (\<lambda>x. THE y. (x,y) \<in> r)"
paulson@13874
   507
paulson@13874
   508
lemma funof_eq: "[|single_valued r; (x,y) \<in> r|] ==> funof r x = y"
paulson@13874
   509
by (simp add: funof_def single_valued_def, blast)
paulson@13874
   510
paulson@13874
   511
lemma funof_Pair_in:
paulson@13874
   512
     "[|single_valued r; x \<in> Domain r|] ==> (x, funof r x) \<in> r"
paulson@13874
   513
by (force simp add: funof_eq) 
paulson@13874
   514
paulson@13874
   515
lemma funof_in:
paulson@13874
   516
     "[|r``{x} \<subseteq> A; single_valued r; x \<in> Domain r|] ==> funof r x \<in> A" 
paulson@13874
   517
by (force simp add: funof_eq)
paulson@13874
   518
 
paulson@13874
   519
lemma funof_imp_wp: "[|funof act t \<in> A; single_valued act|] ==> t \<in> wp act A"
paulson@13874
   520
by (force simp add: in_wp_iff funof_eq)
paulson@13874
   521
paulson@13874
   522
paulson@13874
   523
subsubsection{*Commutativity of Functions and Relation*}
paulson@13874
   524
text{*Thesis, page 109*}
paulson@13874
   525
haftmann@32604
   526
(*FIXME: this proof is still an ungodly mess*)
paulson@13888
   527
text{*From Meier's thesis, section 4.5.6*}
paulson@13885
   528
lemma commutativity2_lemma:
paulson@13874
   529
  assumes dcommutes: 
wenzelm@45477
   530
      "\<And>act s t. act \<in> Acts F \<Longrightarrow> s \<in> T \<Longrightarrow> (s, t) \<in> relcl L \<Longrightarrow>
wenzelm@45477
   531
        s \<in> B | t \<in> B | (funof act s, funof act t) \<in> relcl L"
wenzelm@45477
   532
    and determ: "!!act. act \<in> Acts F ==> single_valued act"
wenzelm@45477
   533
    and total: "!!act. act \<in> Acts F ==> Domain act = UNIV"
wenzelm@45477
   534
    and lattice:  "lattice L"
wenzelm@45477
   535
    and BL: "B \<in> L"
wenzelm@45477
   536
    and TL: "T \<in> L"
wenzelm@45477
   537
    and Fstable: "F \<in> stable T"
paulson@13874
   538
  shows  "commutes F T B L"
haftmann@32604
   539
proof -
haftmann@51488
   540
  { fix M and act and t
haftmann@51488
   541
    assume 1: "B \<subseteq> M" "act \<in> Acts F" "t \<in> cl L (T \<inter> wp act M)"
haftmann@51488
   542
    then have "\<exists>s. (s,t) \<in> relcl L \<and> s \<in> T \<inter> wp act M"
haftmann@51488
   543
      by (force simp add: cl_eq_Collect_relcl [OF lattice])
haftmann@51488
   544
    then obtain s where 2: "(s, t) \<in> relcl L" "s \<in> T" "s \<in> wp act M"
haftmann@51488
   545
      by blast
haftmann@51488
   546
    then have 3: "\<forall>u\<in>L. s \<in> u --> t \<in> u"
haftmann@51488
   547
      apply (intro ballI impI) 
haftmann@51488
   548
      apply (subst cl_ident [symmetric], assumption)
haftmann@51488
   549
      apply (simp add: relcl_def)  
haftmann@51488
   550
      apply (blast intro: cl_mono [THEN [2] rev_subsetD])
haftmann@51488
   551
      done
haftmann@51488
   552
    with 1 2 Fstable have 4: "funof act s \<in> T\<inter>M"
haftmann@51488
   553
      by (force intro!: funof_in 
haftmann@51488
   554
        simp add: wp_def stable_def constrains_def determ total)
haftmann@51488
   555
    with 1 2 3 have 5: "s \<in> B | t \<in> B | (funof act s, funof act t) \<in> relcl L"
haftmann@51488
   556
      by (intro dcommutes) assumption+ 
haftmann@51488
   557
    with 1 2 3 4 have "t \<in> B | funof act t \<in> cl L (T\<inter>M)"
haftmann@51488
   558
      by (simp add: relcl_def) (blast intro: BL cl_mono [THEN [2] rev_subsetD])  
haftmann@51488
   559
    with 1 2 3 4 5 have "t \<in> B | t \<in> wp act (cl L (T\<inter>M))"
haftmann@51488
   560
      by (blast intro: funof_imp_wp determ) 
haftmann@51488
   561
    with 2 3 have "t \<in> T \<and> (t \<in> B \<or> t \<in> wp act (cl L (T \<inter> M)))"
haftmann@51488
   562
      by (blast intro: TL cl_mono [THEN [2] rev_subsetD])
haftmann@51488
   563
    then have"t \<in> T \<inter> (B \<union> wp act (cl L (T \<inter> M)))"
haftmann@51488
   564
      by simp
haftmann@51488
   565
  }
haftmann@51488
   566
  then show "commutes F T B L" unfolding commutes_def by clarify
haftmann@32604
   567
qed
haftmann@32604
   568
  
paulson@13888
   569
text{*Version packaged with @{thm progress_set_Union}*}
paulson@13885
   570
lemma commutativity2:
paulson@13885
   571
  assumes leadsTo: "F \<in> A leadsTo B"
paulson@13885
   572
      and dcommutes: 
paulson@13885
   573
        "\<forall>act \<in> Acts F. 
paulson@13885
   574
         \<forall>s \<in> T. \<forall>t. (s,t) \<in> relcl L --> 
paulson@13885
   575
                      s \<in> B | t \<in> B | (funof act s, funof act t) \<in> relcl L"
paulson@13885
   576
      and determ: "!!act. act \<in> Acts F ==> single_valued act"
paulson@13885
   577
      and total: "!!act. act \<in> Acts F ==> Domain act = UNIV"
paulson@13885
   578
      and lattice:  "lattice L"
paulson@13885
   579
      and BL: "B \<in> L"
paulson@13885
   580
      and TL: "T \<in> L"
paulson@13885
   581
      and Fstable: "F \<in> stable T"
paulson@13885
   582
      and Gco: "!!X. X\<in>L ==> G \<in> X-B co X"
paulson@13885
   583
  shows "F\<squnion>G \<in> T\<inter>A leadsTo B"
paulson@13885
   584
apply (rule commutativity1 [OF leadsTo lattice]) 
paulson@13885
   585
apply (simp_all add: Gco commutativity2_lemma dcommutes determ total
paulson@13885
   586
                     lattice BL TL Fstable)
paulson@13885
   587
done
paulson@13885
   588
paulson@13885
   589
paulson@13888
   590
subsection {*Monotonicity*}
paulson@14150
   591
text{*From Meier's thesis, section 4.5.7, page 110*}
paulson@13888
   592
(*to be continued?*)
paulson@13888
   593
paulson@13853
   594
end