src/HOL/Bali/AxSem.thy
author paulson
Thu Sep 26 10:51:29 2002 +0200 (2002-09-26)
changeset 13585 db4005b40cc6
parent 13384 a34e38154413
child 13688 a0b16d42d489
permissions -rw-r--r--
Converted Fun to Isar style.
Moved Pi, funcset, restrict from Fun.thy to Library/FuncSet.thy.
Renamed constant "Fun.op o" to "Fun.comp"
wenzelm@12857
     1
(*  Title:      HOL/Bali/AxSem.thy
schirmer@12854
     2
    ID:         $Id$
schirmer@12854
     3
    Author:     David von Oheimb
wenzelm@12859
     4
    License:    GPL (GNU GENERAL PUBLIC LICENSE)
schirmer@12854
     5
*)
schirmer@12854
     6
schirmer@12854
     7
header {* Axiomatic semantics of Java expressions and statements 
schirmer@12854
     8
          (see also Eval.thy)
schirmer@12854
     9
        *}
schirmer@12854
    10
schirmer@12854
    11
theory AxSem = Evaln + TypeSafe:
schirmer@12854
    12
schirmer@12854
    13
text {*
schirmer@12854
    14
design issues:
schirmer@12854
    15
\begin{itemize}
schirmer@12854
    16
\item a strong version of validity for triples with premises, namely one that 
schirmer@12854
    17
      takes the recursive depth needed to complete execution, enables 
schirmer@12854
    18
      correctness proof
schirmer@12854
    19
\item auxiliary variables are handled first-class (-> Thomas Kleymann)
schirmer@12854
    20
\item expressions not flattened to elementary assignments (as usual for 
schirmer@12854
    21
      axiomatic semantics) but treated first-class => explicit result value 
schirmer@12854
    22
      handling
schirmer@12854
    23
\item intermediate values not on triple, but on assertion level 
schirmer@12854
    24
      (with result entry)
schirmer@12854
    25
\item multiple results with semantical substitution mechnism not requiring a 
schirmer@12854
    26
      stack 
schirmer@12854
    27
\item because of dynamic method binding, terms need to be dependent on state.
schirmer@12854
    28
  this is also useful for conditional expressions and statements
schirmer@12854
    29
\item result values in triples exactly as in eval relation (also for xcpt 
schirmer@12854
    30
      states)
schirmer@12854
    31
\item validity: additional assumption of state conformance and well-typedness,
schirmer@12854
    32
  which is required for soundness and thus rule hazard required of completeness
schirmer@12854
    33
\end{itemize}
schirmer@12854
    34
schirmer@12854
    35
restrictions:
schirmer@12854
    36
\begin{itemize}
schirmer@12854
    37
\item all triples in a derivation are of the same type (due to weak 
schirmer@12854
    38
      polymorphism)
schirmer@12854
    39
\end{itemize}
schirmer@12854
    40
*}
schirmer@12854
    41
schirmer@12854
    42
types  res = vals (* result entry *)
schirmer@12854
    43
syntax
schirmer@12854
    44
  Val  :: "val      \<Rightarrow> res"
schirmer@12854
    45
  Var  :: "var      \<Rightarrow> res"
schirmer@12854
    46
  Vals :: "val list \<Rightarrow> res"
schirmer@12854
    47
translations
schirmer@12854
    48
  "Val  x"     => "(In1 x)"
schirmer@12854
    49
  "Var  x"     => "(In2 x)"
schirmer@12854
    50
  "Vals x"     => "(In3 x)"
schirmer@12854
    51
schirmer@12854
    52
syntax
schirmer@12854
    53
  "Val_"    :: "[pttrn] => pttrn"     ("Val:_"  [951] 950)
schirmer@12854
    54
  "Var_"    :: "[pttrn] => pttrn"     ("Var:_"  [951] 950)
schirmer@12854
    55
  "Vals_"   :: "[pttrn] => pttrn"     ("Vals:_" [951] 950)
schirmer@12854
    56
schirmer@12854
    57
translations
schirmer@12854
    58
  "\<lambda>Val:v . b"  == "(\<lambda>v. b) \<circ> the_In1"
schirmer@12854
    59
  "\<lambda>Var:v . b"  == "(\<lambda>v. b) \<circ> the_In2"
schirmer@12854
    60
  "\<lambda>Vals:v. b"  == "(\<lambda>v. b) \<circ> the_In3"
schirmer@12854
    61
schirmer@12854
    62
  (* relation on result values, state and auxiliary variables *)
schirmer@12854
    63
types 'a assn   =        "res \<Rightarrow> state \<Rightarrow> 'a \<Rightarrow> bool"
schirmer@12854
    64
translations
schirmer@12854
    65
      "res"    <= (type) "AxSem.res"
schirmer@12854
    66
      "a assn" <= (type) "vals \<Rightarrow> state \<Rightarrow> a \<Rightarrow> bool"
schirmer@12854
    67
schirmer@12854
    68
constdefs
schirmer@12854
    69
  assn_imp   :: "'a assn \<Rightarrow> 'a assn \<Rightarrow> bool"             (infixr "\<Rightarrow>" 25)
schirmer@12854
    70
 "P \<Rightarrow> Q \<equiv> \<forall>Y s Z. P Y s Z \<longrightarrow> Q Y s Z"
schirmer@12854
    71
  
schirmer@12854
    72
lemma assn_imp_def2 [iff]: "(P \<Rightarrow> Q) = (\<forall>Y s Z. P Y s Z \<longrightarrow> Q Y s Z)"
schirmer@12854
    73
apply (unfold assn_imp_def)
schirmer@12854
    74
apply (rule HOL.refl)
schirmer@12854
    75
done
schirmer@12854
    76
schirmer@12854
    77
schirmer@12854
    78
section "assertion transformers"
schirmer@12854
    79
schirmer@12854
    80
subsection "peek-and"
schirmer@12854
    81
schirmer@12854
    82
constdefs
schirmer@12854
    83
  peek_and   :: "'a assn \<Rightarrow> (state \<Rightarrow>  bool) \<Rightarrow> 'a assn" (infixl "\<and>." 13)
schirmer@12854
    84
 "P \<and>. p \<equiv> \<lambda>Y s Z. P Y s Z \<and> p s"
schirmer@12854
    85
schirmer@12854
    86
lemma peek_and_def2 [simp]: "peek_and P p Y s = (\<lambda>Z. (P Y s Z \<and> p s))"
schirmer@12854
    87
apply (unfold peek_and_def)
schirmer@12854
    88
apply (simp (no_asm))
schirmer@12854
    89
done
schirmer@12854
    90
schirmer@12854
    91
lemma peek_and_Not [simp]: "(P \<and>. (\<lambda>s. \<not> f s)) = (P \<and>. Not \<circ> f)"
schirmer@12854
    92
apply (rule ext)
schirmer@12854
    93
apply (rule ext)
schirmer@12854
    94
apply (simp (no_asm))
schirmer@12854
    95
done
schirmer@12854
    96
schirmer@12854
    97
lemma peek_and_and [simp]: "peek_and (peek_and P p) p = peek_and P p"
schirmer@12854
    98
apply (unfold peek_and_def)
schirmer@12854
    99
apply (simp (no_asm))
schirmer@12854
   100
done
schirmer@12854
   101
schirmer@12854
   102
lemma peek_and_commut: "(P \<and>. p \<and>. q) = (P \<and>. q \<and>. p)"
schirmer@12854
   103
apply (rule ext)
schirmer@12854
   104
apply (rule ext)
schirmer@12854
   105
apply (rule ext)
schirmer@12854
   106
apply auto
schirmer@12854
   107
done
schirmer@12854
   108
schirmer@12854
   109
syntax
schirmer@12854
   110
  Normal     :: "'a assn \<Rightarrow> 'a assn"
schirmer@12854
   111
translations
schirmer@12854
   112
  "Normal P" == "P \<and>. normal"
schirmer@12854
   113
schirmer@12854
   114
lemma peek_and_Normal [simp]: "peek_and (Normal P) p = Normal (peek_and P p)"
schirmer@12854
   115
apply (rule ext)
schirmer@12854
   116
apply (rule ext)
schirmer@12854
   117
apply (rule ext)
schirmer@12854
   118
apply auto
schirmer@12854
   119
done
schirmer@12854
   120
schirmer@12854
   121
subsection "assn-supd"
schirmer@12854
   122
schirmer@12854
   123
constdefs
schirmer@12854
   124
  assn_supd  :: "'a assn \<Rightarrow> (state \<Rightarrow> state) \<Rightarrow> 'a assn" (infixl ";." 13)
schirmer@12854
   125
 "P ;. f \<equiv> \<lambda>Y s' Z. \<exists>s. P Y s Z \<and> s' = f s"
schirmer@12854
   126
schirmer@12854
   127
lemma assn_supd_def2 [simp]: "assn_supd P f Y s' Z = (\<exists>s. P Y s Z \<and> s' = f s)"
schirmer@12854
   128
apply (unfold assn_supd_def)
schirmer@12854
   129
apply (simp (no_asm))
schirmer@12854
   130
done
schirmer@12854
   131
schirmer@12854
   132
subsection "supd-assn"
schirmer@12854
   133
schirmer@12854
   134
constdefs
schirmer@12854
   135
  supd_assn  :: "(state \<Rightarrow> state) \<Rightarrow> 'a assn \<Rightarrow> 'a assn" (infixr ".;" 13)
schirmer@12854
   136
 "f .; P \<equiv> \<lambda>Y s. P Y (f s)"
schirmer@12854
   137
schirmer@12854
   138
schirmer@12854
   139
lemma supd_assn_def2 [simp]: "(f .; P) Y s = P Y (f s)"
schirmer@12854
   140
apply (unfold supd_assn_def)
schirmer@12854
   141
apply (simp (no_asm))
schirmer@12854
   142
done
schirmer@12854
   143
schirmer@12854
   144
lemma supd_assn_supdD [elim]: "((f .; Q) ;. f) Y s Z \<Longrightarrow> Q Y s Z"
schirmer@12854
   145
apply auto
schirmer@12854
   146
done
schirmer@12854
   147
schirmer@12854
   148
lemma supd_assn_supdI [elim]: "Q Y s Z \<Longrightarrow> (f .; (Q ;. f)) Y s Z"
schirmer@12854
   149
apply (auto simp del: split_paired_Ex)
schirmer@12854
   150
done
schirmer@12854
   151
schirmer@12854
   152
subsection "subst-res"
schirmer@12854
   153
schirmer@12854
   154
constdefs
schirmer@12854
   155
  subst_res   :: "'a assn \<Rightarrow> res \<Rightarrow> 'a assn"              ("_\<leftarrow>_"  [60,61] 60)
schirmer@12854
   156
 "P\<leftarrow>w \<equiv> \<lambda>Y. P w"
schirmer@12854
   157
schirmer@12854
   158
lemma subst_res_def2 [simp]: "(P\<leftarrow>w) Y = P w"
schirmer@12854
   159
apply (unfold subst_res_def)
schirmer@12854
   160
apply (simp (no_asm))
schirmer@12854
   161
done
schirmer@12854
   162
schirmer@12854
   163
lemma subst_subst_res [simp]: "P\<leftarrow>w\<leftarrow>v = P\<leftarrow>w"
schirmer@12854
   164
apply (rule ext)
schirmer@12854
   165
apply (simp (no_asm))
schirmer@12854
   166
done
schirmer@12854
   167
schirmer@12854
   168
lemma peek_and_subst_res [simp]: "(P \<and>. p)\<leftarrow>w = (P\<leftarrow>w \<and>. p)"
schirmer@12854
   169
apply (rule ext)
schirmer@12854
   170
apply (rule ext)
schirmer@12854
   171
apply (simp (no_asm))
schirmer@12854
   172
done
schirmer@12854
   173
schirmer@12854
   174
(*###Do not work for some strange (unification?) reason
schirmer@12854
   175
lemma subst_res_Val_beta [simp]: "(\<lambda>Y. P (the_In1 Y))\<leftarrow>Val v = (\<lambda>Y. P v)"
schirmer@12854
   176
apply (rule ext)
schirmer@12854
   177
by simp
schirmer@12854
   178
schirmer@12854
   179
lemma subst_res_Var_beta [simp]: "(\<lambda>Y. P (the_In2 Y))\<leftarrow>Var vf = (\<lambda>Y. P vf)";
schirmer@12854
   180
apply (rule ext)
schirmer@12854
   181
by simp
schirmer@12854
   182
schirmer@12854
   183
lemma subst_res_Vals_beta [simp]: "(\<lambda>Y. P (the_In3 Y))\<leftarrow>Vals vs = (\<lambda>Y. P vs)";
schirmer@12854
   184
apply (rule ext)
schirmer@12854
   185
by simp
schirmer@12854
   186
*)
schirmer@12854
   187
schirmer@12854
   188
subsection "subst-Bool"
schirmer@12854
   189
schirmer@12854
   190
constdefs
schirmer@12854
   191
  subst_Bool  :: "'a assn \<Rightarrow> bool \<Rightarrow> 'a assn"             ("_\<leftarrow>=_" [60,61] 60)
schirmer@12854
   192
 "P\<leftarrow>=b \<equiv> \<lambda>Y s Z. \<exists>v. P (Val v) s Z \<and> (normal s \<longrightarrow> the_Bool v=b)"
schirmer@12854
   193
schirmer@12854
   194
lemma subst_Bool_def2 [simp]: 
schirmer@12854
   195
"(P\<leftarrow>=b) Y s Z = (\<exists>v. P (Val v) s Z \<and> (normal s \<longrightarrow> the_Bool v=b))"
schirmer@12854
   196
apply (unfold subst_Bool_def)
schirmer@12854
   197
apply (simp (no_asm))
schirmer@12854
   198
done
schirmer@12854
   199
schirmer@12854
   200
lemma subst_Bool_the_BoolI: "P (Val b) s Z \<Longrightarrow> (P\<leftarrow>=the_Bool b) Y s Z"
schirmer@12854
   201
apply auto
schirmer@12854
   202
done
schirmer@12854
   203
schirmer@12854
   204
subsection "peek-res"
schirmer@12854
   205
schirmer@12854
   206
constdefs
schirmer@12854
   207
  peek_res    :: "(res \<Rightarrow> 'a assn) \<Rightarrow> 'a assn"
schirmer@12854
   208
 "peek_res Pf \<equiv> \<lambda>Y. Pf Y Y"
schirmer@12854
   209
schirmer@12854
   210
syntax
schirmer@12854
   211
"@peek_res"  :: "pttrn \<Rightarrow> 'a assn \<Rightarrow> 'a assn"            ("\<lambda>_:. _" [0,3] 3)
schirmer@12854
   212
translations
schirmer@12854
   213
  "\<lambda>w:. P"   == "peek_res (\<lambda>w. P)"
schirmer@12854
   214
schirmer@12854
   215
lemma peek_res_def2 [simp]: "peek_res P Y = P Y Y"
schirmer@12854
   216
apply (unfold peek_res_def)
schirmer@12854
   217
apply (simp (no_asm))
schirmer@12854
   218
done
schirmer@12854
   219
schirmer@12854
   220
lemma peek_res_subst_res [simp]: "peek_res P\<leftarrow>w = P w\<leftarrow>w"
schirmer@12854
   221
apply (rule ext)
schirmer@12854
   222
apply (simp (no_asm))
schirmer@12854
   223
done
schirmer@12854
   224
schirmer@12854
   225
(* unused *)
schirmer@12854
   226
lemma peek_subst_res_allI: 
schirmer@12854
   227
 "(\<And>a. T a (P (f a)\<leftarrow>f a)) \<Longrightarrow> \<forall>a. T a (peek_res P\<leftarrow>f a)"
schirmer@12854
   228
apply (rule allI)
schirmer@12854
   229
apply (simp (no_asm))
schirmer@12854
   230
apply fast
schirmer@12854
   231
done
schirmer@12854
   232
schirmer@12854
   233
subsection "ign-res"
schirmer@12854
   234
schirmer@12854
   235
constdefs
schirmer@12854
   236
  ign_res    ::  "        'a assn \<Rightarrow> 'a assn"            ("_\<down>" [1000] 1000)
schirmer@12854
   237
  "P\<down>        \<equiv> \<lambda>Y s Z. \<exists>Y. P Y s Z"
schirmer@12854
   238
schirmer@12854
   239
lemma ign_res_def2 [simp]: "P\<down> Y s Z = (\<exists>Y. P Y s Z)"
schirmer@12854
   240
apply (unfold ign_res_def)
schirmer@12854
   241
apply (simp (no_asm))
schirmer@12854
   242
done
schirmer@12854
   243
schirmer@12854
   244
lemma ign_ign_res [simp]: "P\<down>\<down> = P\<down>"
schirmer@12854
   245
apply (rule ext)
schirmer@12854
   246
apply (rule ext)
schirmer@12854
   247
apply (rule ext)
schirmer@12854
   248
apply (simp (no_asm))
schirmer@12854
   249
done
schirmer@12854
   250
schirmer@12854
   251
lemma ign_subst_res [simp]: "P\<down>\<leftarrow>w = P\<down>"
schirmer@12854
   252
apply (rule ext)
schirmer@12854
   253
apply (rule ext)
schirmer@12854
   254
apply (rule ext)
schirmer@12854
   255
apply (simp (no_asm))
schirmer@12854
   256
done
schirmer@12854
   257
schirmer@12854
   258
lemma peek_and_ign_res [simp]: "(P \<and>. p)\<down> = (P\<down> \<and>. p)"
schirmer@12854
   259
apply (rule ext)
schirmer@12854
   260
apply (rule ext)
schirmer@12854
   261
apply (rule ext)
schirmer@12854
   262
apply (simp (no_asm))
schirmer@12854
   263
done
schirmer@12854
   264
schirmer@12854
   265
subsection "peek-st"
schirmer@12854
   266
schirmer@12854
   267
constdefs
schirmer@12854
   268
  peek_st    :: "(st \<Rightarrow> 'a assn) \<Rightarrow> 'a assn"
schirmer@12854
   269
 "peek_st P \<equiv> \<lambda>Y s. P (store s) Y s"
schirmer@12854
   270
schirmer@12854
   271
syntax
schirmer@12854
   272
"@peek_st"   :: "pttrn \<Rightarrow> 'a assn \<Rightarrow> 'a assn"            ("\<lambda>_.. _" [0,3] 3)
schirmer@12854
   273
translations
schirmer@12854
   274
  "\<lambda>s.. P"   == "peek_st (\<lambda>s. P)"
schirmer@12854
   275
schirmer@12854
   276
lemma peek_st_def2 [simp]: "(\<lambda>s.. Pf s) Y s = Pf (store s) Y s"
schirmer@12854
   277
apply (unfold peek_st_def)
schirmer@12854
   278
apply (simp (no_asm))
schirmer@12854
   279
done
schirmer@12854
   280
schirmer@12854
   281
lemma peek_st_triv [simp]: "(\<lambda>s.. P) = P"
schirmer@12854
   282
apply (rule ext)
schirmer@12854
   283
apply (rule ext)
schirmer@12854
   284
apply (simp (no_asm))
schirmer@12854
   285
done
schirmer@12854
   286
schirmer@12854
   287
lemma peek_st_st [simp]: "(\<lambda>s.. \<lambda>s'.. P s s') = (\<lambda>s.. P s s)"
schirmer@12854
   288
apply (rule ext)
schirmer@12854
   289
apply (rule ext)
schirmer@12854
   290
apply (simp (no_asm))
schirmer@12854
   291
done
schirmer@12854
   292
schirmer@12854
   293
lemma peek_st_split [simp]: "(\<lambda>s.. \<lambda>Y s'. P s Y s') = (\<lambda>Y s. P (store s) Y s)"
schirmer@12854
   294
apply (rule ext)
schirmer@12854
   295
apply (rule ext)
schirmer@12854
   296
apply (simp (no_asm))
schirmer@12854
   297
done
schirmer@12854
   298
schirmer@12854
   299
lemma peek_st_subst_res [simp]: "(\<lambda>s.. P s)\<leftarrow>w = (\<lambda>s.. P s\<leftarrow>w)"
schirmer@12854
   300
apply (rule ext)
schirmer@12854
   301
apply (simp (no_asm))
schirmer@12854
   302
done
schirmer@12854
   303
schirmer@12854
   304
lemma peek_st_Normal [simp]: "(\<lambda>s..(Normal (P s))) = Normal (\<lambda>s.. P s)"
schirmer@12854
   305
apply (rule ext)
schirmer@12854
   306
apply (rule ext)
schirmer@12854
   307
apply (simp (no_asm))
schirmer@12854
   308
done
schirmer@12854
   309
schirmer@12854
   310
subsection "ign-res-eq"
schirmer@12854
   311
schirmer@12854
   312
constdefs
schirmer@12854
   313
  ign_res_eq :: "'a assn \<Rightarrow> res \<Rightarrow> 'a assn"               ("_\<down>=_"  [60,61] 60)
schirmer@12854
   314
 "P\<down>=w       \<equiv> \<lambda>Y:. P\<down> \<and>. (\<lambda>s. Y=w)"
schirmer@12854
   315
schirmer@12854
   316
lemma ign_res_eq_def2 [simp]: "(P\<down>=w) Y s Z = ((\<exists>Y. P Y s Z) \<and> Y=w)"
schirmer@12854
   317
apply (unfold ign_res_eq_def)
schirmer@12854
   318
apply auto
schirmer@12854
   319
done
schirmer@12854
   320
schirmer@12854
   321
lemma ign_ign_res_eq [simp]: "(P\<down>=w)\<down> = P\<down>"
schirmer@12854
   322
apply (rule ext)
schirmer@12854
   323
apply (rule ext)
schirmer@12854
   324
apply (rule ext)
schirmer@12854
   325
apply (simp (no_asm))
schirmer@12854
   326
done
schirmer@12854
   327
schirmer@12854
   328
(* unused *)
schirmer@12854
   329
lemma ign_res_eq_subst_res: "P\<down>=w\<leftarrow>w = P\<down>"
schirmer@12854
   330
apply (rule ext)
schirmer@12854
   331
apply (rule ext)
schirmer@12854
   332
apply (rule ext)
schirmer@12854
   333
apply (simp (no_asm))
schirmer@12854
   334
done
schirmer@12854
   335
schirmer@12854
   336
(* unused *)
schirmer@12854
   337
lemma subst_Bool_ign_res_eq: "((P\<leftarrow>=b)\<down>=x) Y s Z = ((P\<leftarrow>=b) Y s Z  \<and> Y=x)"
schirmer@12854
   338
apply (simp (no_asm))
schirmer@12854
   339
done
schirmer@12854
   340
schirmer@12854
   341
subsection "RefVar"
schirmer@12854
   342
schirmer@12854
   343
constdefs
schirmer@12854
   344
  RefVar    :: "(state \<Rightarrow> vvar \<times> state) \<Rightarrow> 'a assn \<Rightarrow> 'a assn"(infixr "..;" 13)
schirmer@12854
   345
 "vf ..; P \<equiv> \<lambda>Y s. let (v,s') = vf s in P (Var v) s'"
schirmer@12854
   346
 
schirmer@12854
   347
lemma RefVar_def2 [simp]: "(vf ..; P) Y s =  
schirmer@12854
   348
  P (Var (fst (vf s))) (snd (vf s))"
schirmer@12854
   349
apply (unfold RefVar_def Let_def)
schirmer@12854
   350
apply (simp (no_asm) add: split_beta)
schirmer@12854
   351
done
schirmer@12854
   352
schirmer@12854
   353
subsection "allocation"
schirmer@12854
   354
schirmer@12854
   355
constdefs
schirmer@12854
   356
  Alloc      :: "prog \<Rightarrow> obj_tag \<Rightarrow> 'a assn \<Rightarrow> 'a assn"
schirmer@12854
   357
 "Alloc G otag P \<equiv> \<lambda>Y s Z.
schirmer@12854
   358
                   \<forall>s' a. G\<turnstile>s \<midarrow>halloc otag\<succ>a\<rightarrow> s'\<longrightarrow> P (Val (Addr a)) s' Z"
schirmer@12854
   359
schirmer@12854
   360
  SXAlloc     :: "prog \<Rightarrow> 'a assn \<Rightarrow> 'a assn"
schirmer@12854
   361
 "SXAlloc G P \<equiv> \<lambda>Y s Z. \<forall>s'. G\<turnstile>s \<midarrow>sxalloc\<rightarrow> s' \<longrightarrow> P Y s' Z"
schirmer@12854
   362
schirmer@12854
   363
schirmer@12854
   364
lemma Alloc_def2 [simp]: "Alloc G otag P Y s Z =  
schirmer@12854
   365
       (\<forall>s' a. G\<turnstile>s \<midarrow>halloc otag\<succ>a\<rightarrow> s'\<longrightarrow> P (Val (Addr a)) s' Z)"
schirmer@12854
   366
apply (unfold Alloc_def)
schirmer@12854
   367
apply (simp (no_asm))
schirmer@12854
   368
done
schirmer@12854
   369
schirmer@12854
   370
lemma SXAlloc_def2 [simp]: 
schirmer@12854
   371
  "SXAlloc G P Y s Z = (\<forall>s'. G\<turnstile>s \<midarrow>sxalloc\<rightarrow> s' \<longrightarrow> P Y s' Z)"
schirmer@12854
   372
apply (unfold SXAlloc_def)
schirmer@12854
   373
apply (simp (no_asm))
schirmer@12854
   374
done
schirmer@12854
   375
schirmer@12854
   376
section "validity"
schirmer@12854
   377
schirmer@12854
   378
constdefs
schirmer@12854
   379
  type_ok  :: "prog \<Rightarrow> term \<Rightarrow> state \<Rightarrow> bool"
schirmer@12854
   380
 "type_ok G t s \<equiv> \<exists>L T C. (normal s \<longrightarrow> \<lparr>prg=G,cls=C,lcl=L\<rparr>\<turnstile>t\<Colon>T) \<and> s\<Colon>\<preceq>(G,L)"
schirmer@12854
   381
schirmer@12854
   382
datatype    'a triple = triple "('a assn)" "term" "('a assn)" (** should be
schirmer@12854
   383
something like triple = \<forall>'a. triple ('a assn) term ('a assn)   **)
schirmer@12854
   384
                                        ("{(1_)}/ _>/ {(1_)}"      [3,65,3]75)
schirmer@12854
   385
types    'a triples = "'a triple set"
schirmer@12854
   386
schirmer@12854
   387
syntax
schirmer@12854
   388
schirmer@12854
   389
  var_triple   :: "['a assn, var         ,'a assn] \<Rightarrow> 'a triple"
schirmer@12854
   390
                                         ("{(1_)}/ _=>/ {(1_)}"    [3,80,3] 75)
schirmer@12854
   391
  expr_triple  :: "['a assn, expr        ,'a assn] \<Rightarrow> 'a triple"
schirmer@12854
   392
                                         ("{(1_)}/ _->/ {(1_)}"    [3,80,3] 75)
schirmer@12854
   393
  exprs_triple :: "['a assn, expr list   ,'a assn] \<Rightarrow> 'a triple"
schirmer@12854
   394
                                         ("{(1_)}/ _#>/ {(1_)}"    [3,65,3] 75)
schirmer@12854
   395
  stmt_triple  :: "['a assn, stmt,        'a assn] \<Rightarrow> 'a triple"
schirmer@12854
   396
                                         ("{(1_)}/ ._./ {(1_)}"     [3,65,3] 75)
schirmer@12854
   397
schirmer@12854
   398
syntax (xsymbols)
schirmer@12854
   399
schirmer@12854
   400
  triple       :: "['a assn, term        ,'a assn] \<Rightarrow> 'a triple"
schirmer@12854
   401
                                         ("{(1_)}/ _\<succ>/ {(1_)}"     [3,65,3] 75)
schirmer@12854
   402
  var_triple   :: "['a assn, var         ,'a assn] \<Rightarrow> 'a triple"
schirmer@12854
   403
                                         ("{(1_)}/ _=\<succ>/ {(1_)}"    [3,80,3] 75)
schirmer@12854
   404
  expr_triple  :: "['a assn, expr        ,'a assn] \<Rightarrow> 'a triple"
schirmer@12854
   405
                                         ("{(1_)}/ _-\<succ>/ {(1_)}"    [3,80,3] 75)
schirmer@12854
   406
  exprs_triple :: "['a assn, expr list   ,'a assn] \<Rightarrow> 'a triple"
schirmer@12854
   407
                                         ("{(1_)}/ _\<doteq>\<succ>/ {(1_)}"    [3,65,3] 75)
schirmer@12854
   408
schirmer@12854
   409
translations
schirmer@12854
   410
  "{P} e-\<succ> {Q}" == "{P} In1l e\<succ> {Q}"
schirmer@12854
   411
  "{P} e=\<succ> {Q}" == "{P} In2  e\<succ> {Q}"
schirmer@12854
   412
  "{P} e\<doteq>\<succ> {Q}" == "{P} In3  e\<succ> {Q}"
schirmer@12854
   413
  "{P} .c. {Q}" == "{P} In1r c\<succ> {Q}"
schirmer@12854
   414
schirmer@12854
   415
lemma inj_triple: "inj (\<lambda>(P,t,Q). {P} t\<succ> {Q})"
paulson@13585
   416
apply (rule inj_onI)
schirmer@12854
   417
apply auto
schirmer@12854
   418
done
schirmer@12854
   419
schirmer@12854
   420
lemma triple_inj_eq: "({P} t\<succ> {Q} = {P'} t'\<succ> {Q'} ) = (P=P' \<and> t=t' \<and> Q=Q')"
schirmer@12854
   421
apply auto
schirmer@12854
   422
done
schirmer@12854
   423
schirmer@12854
   424
constdefs
schirmer@12854
   425
  mtriples  :: "('c \<Rightarrow> 'sig \<Rightarrow> 'a assn) \<Rightarrow> ('c \<Rightarrow> 'sig \<Rightarrow> expr) \<Rightarrow> 
schirmer@12854
   426
                ('c \<Rightarrow> 'sig \<Rightarrow> 'a assn) \<Rightarrow> ('c \<times>  'sig) set \<Rightarrow> 'a triples"
schirmer@12854
   427
                                     ("{{(1_)}/ _-\<succ>/ {(1_)} | _}"[3,65,3,65]75)
schirmer@12854
   428
 "{{P} tf-\<succ> {Q} | ms} \<equiv> (\<lambda>(C,sig). {Normal(P C sig)} tf C sig-\<succ> {Q C sig})`ms"
schirmer@12854
   429
  
schirmer@12854
   430
consts
schirmer@12854
   431
schirmer@12854
   432
 triple_valid :: "prog \<Rightarrow> nat \<Rightarrow>        'a triple  \<Rightarrow> bool"
schirmer@12854
   433
                                                (   "_\<Turnstile>_:_" [61,0, 58] 57)
schirmer@12854
   434
    ax_valids :: "prog \<Rightarrow> 'b triples \<Rightarrow> 'a triples \<Rightarrow> bool"
schirmer@12854
   435
                                                ("_,_|\<Turnstile>_"   [61,58,58] 57)
schirmer@12854
   436
    ax_derivs :: "prog \<Rightarrow> ('b triples \<times> 'a triples) set"
schirmer@12854
   437
schirmer@12854
   438
syntax
schirmer@12854
   439
schirmer@12854
   440
 triples_valid:: "prog \<Rightarrow> nat \<Rightarrow>         'a triples \<Rightarrow> bool"
schirmer@12854
   441
                                                (  "_||=_:_" [61,0, 58] 57)
schirmer@12854
   442
     ax_valid :: "prog \<Rightarrow>  'b triples \<Rightarrow> 'a triple  \<Rightarrow> bool"
schirmer@12854
   443
                                                ( "_,_|=_"   [61,58,58] 57)
schirmer@12854
   444
     ax_Derivs:: "prog \<Rightarrow>  'b triples \<Rightarrow> 'a triples \<Rightarrow> bool"
schirmer@12854
   445
                                                ("_,_||-_"   [61,58,58] 57)
schirmer@12854
   446
     ax_Deriv :: "prog \<Rightarrow>  'b triples \<Rightarrow> 'a triple  \<Rightarrow> bool"
schirmer@12854
   447
                                                ( "_,_|-_"   [61,58,58] 57)
schirmer@12854
   448
schirmer@12854
   449
syntax (xsymbols)
schirmer@12854
   450
schirmer@12854
   451
 triples_valid:: "prog \<Rightarrow> nat \<Rightarrow>         'a triples \<Rightarrow> bool"
schirmer@12854
   452
                                                (  "_|\<Turnstile>_:_" [61,0, 58] 57)
schirmer@12854
   453
     ax_valid :: "prog \<Rightarrow>  'b triples \<Rightarrow> 'a triple  \<Rightarrow> bool"
schirmer@12854
   454
                                                ( "_,_\<Turnstile>_"   [61,58,58] 57)
schirmer@12854
   455
     ax_Derivs:: "prog \<Rightarrow>  'b triples \<Rightarrow> 'a triples \<Rightarrow> bool"
schirmer@12854
   456
                                                ("_,_|\<turnstile>_"   [61,58,58] 57)
schirmer@12854
   457
     ax_Deriv :: "prog \<Rightarrow>  'b triples \<Rightarrow> 'a triple  \<Rightarrow> bool"
schirmer@12854
   458
                                                ( "_,_\<turnstile>_"   [61,58,58] 57)
schirmer@12854
   459
schirmer@12854
   460
defs  triple_valid_def:  "G\<Turnstile>n:t  \<equiv> case t of {P} t\<succ> {Q} \<Rightarrow>
schirmer@12854
   461
                          \<forall>Y s Z. P Y s Z \<longrightarrow> type_ok G t s \<longrightarrow>
schirmer@12854
   462
                          (\<forall>Y' s'. G\<turnstile>s \<midarrow>t\<succ>\<midarrow>n\<rightarrow> (Y',s') \<longrightarrow> Q Y' s' Z)"
schirmer@12854
   463
translations         "G|\<Turnstile>n:ts" == "Ball ts (triple_valid G n)"
schirmer@12854
   464
defs   ax_valids_def:"G,A|\<Turnstile>ts  \<equiv>  \<forall>n. G|\<Turnstile>n:A \<longrightarrow> G|\<Turnstile>n:ts"
schirmer@12854
   465
translations         "G,A \<Turnstile>t"  == "G,A|\<Turnstile>{t}"
schirmer@12854
   466
                     "G,A|\<turnstile>ts" == "(A,ts) \<in> ax_derivs G"
schirmer@12854
   467
                     "G,A \<turnstile>t"  == "G,A|\<turnstile>{t}"
schirmer@12854
   468
schirmer@12854
   469
lemma triple_valid_def2: "G\<Turnstile>n:{P} t\<succ> {Q} =  
schirmer@12854
   470
 (\<forall>Y s Z. P Y s Z 
schirmer@12854
   471
  \<longrightarrow> (\<exists>L. (normal s \<longrightarrow> (\<exists>T C. \<lparr>prg=G,cls=C,lcl=L\<rparr>\<turnstile>t\<Colon>T)) \<and> s\<Colon>\<preceq>(G,L)) \<longrightarrow> 
schirmer@12854
   472
  (\<forall>Y' s'. G\<turnstile>s \<midarrow>t\<succ>\<midarrow>n\<rightarrow> (Y',s')\<longrightarrow> Q Y' s' Z))"
schirmer@12854
   473
apply (unfold triple_valid_def type_ok_def)
schirmer@12854
   474
apply (simp (no_asm))
schirmer@12854
   475
done
schirmer@12854
   476
schirmer@12854
   477
schirmer@12854
   478
declare split_paired_All [simp del] split_paired_Ex [simp del] 
schirmer@12854
   479
declare split_if     [split del] split_if_asm     [split del] 
schirmer@12854
   480
        option.split [split del] option.split_asm [split del]
schirmer@12854
   481
ML_setup {*
schirmer@12854
   482
simpset_ref() := simpset() delloop "split_all_tac";
schirmer@12854
   483
claset_ref () := claset () delSWrapper "split_all_tac"
schirmer@12854
   484
*}
schirmer@12854
   485
schirmer@12854
   486
inductive "ax_derivs G" intros
schirmer@12854
   487
schirmer@12854
   488
  empty: " G,A|\<turnstile>{}"
schirmer@12854
   489
  insert:"\<lbrakk>G,A\<turnstile>t; G,A|\<turnstile>ts\<rbrakk> \<Longrightarrow>
schirmer@12854
   490
          G,A|\<turnstile>insert t ts"
schirmer@12854
   491
schirmer@12854
   492
  asm:   "ts\<subseteq>A \<Longrightarrow> G,A|\<turnstile>ts"
schirmer@12854
   493
schirmer@12854
   494
(* could be added for convenience and efficiency, but is not necessary
schirmer@12854
   495
  cut:   "\<lbrakk>G,A'|\<turnstile>ts; G,A|\<turnstile>A'\<rbrakk> \<Longrightarrow>
schirmer@12854
   496
           G,A |\<turnstile>ts"
schirmer@12854
   497
*)
schirmer@12854
   498
  weaken:"\<lbrakk>G,A|\<turnstile>ts'; ts \<subseteq> ts'\<rbrakk> \<Longrightarrow> G,A|\<turnstile>ts"
schirmer@12854
   499
schirmer@12854
   500
  conseq:"\<forall>Y s Z . P  Y s Z  \<longrightarrow> (\<exists>P' Q'. G,A\<turnstile>{P'} t\<succ> {Q'} \<and> (\<forall>Y' s'. 
schirmer@12854
   501
         (\<forall>Y   Z'. P' Y s Z' \<longrightarrow> Q' Y' s' Z') \<longrightarrow>
schirmer@12854
   502
                                 Q  Y' s' Z ))
schirmer@12854
   503
                                         \<Longrightarrow> G,A\<turnstile>{P } t\<succ> {Q }"
schirmer@12854
   504
schirmer@12854
   505
  hazard:"G,A\<turnstile>{P \<and>. Not \<circ> type_ok G t} t\<succ> {Q}"
schirmer@12854
   506
schirmer@12854
   507
  Abrupt:  "G,A\<turnstile>{P\<leftarrow>(arbitrary3 t) \<and>. Not \<circ> normal} t\<succ> {P}"
schirmer@12854
   508
schirmer@12854
   509
  (* variables *)
schirmer@12854
   510
  LVar:  " G,A\<turnstile>{Normal (\<lambda>s.. P\<leftarrow>Var (lvar vn s))} LVar vn=\<succ> {P}"
schirmer@12854
   511
schirmer@12854
   512
  FVar: "\<lbrakk>G,A\<turnstile>{Normal P} .Init C. {Q};
schirmer@12854
   513
          G,A\<turnstile>{Q} e-\<succ> {\<lambda>Val:a:. fvar C stat fn a ..; R}\<rbrakk> \<Longrightarrow>
schirmer@12925
   514
                                 G,A\<turnstile>{Normal P} {accC,C,stat}e..fn=\<succ> {R}"
schirmer@12854
   515
schirmer@12854
   516
  AVar:  "\<lbrakk>G,A\<turnstile>{Normal P} e1-\<succ> {Q};
schirmer@12854
   517
          \<forall>a. G,A\<turnstile>{Q\<leftarrow>Val a} e2-\<succ> {\<lambda>Val:i:. avar G i a ..; R}\<rbrakk> \<Longrightarrow>
schirmer@12854
   518
                                 G,A\<turnstile>{Normal P} e1.[e2]=\<succ> {R}"
schirmer@12854
   519
  (* expressions *)
schirmer@12854
   520
schirmer@12854
   521
  NewC: "\<lbrakk>G,A\<turnstile>{Normal P} .Init C. {Alloc G (CInst C) Q}\<rbrakk> \<Longrightarrow>
schirmer@12854
   522
                                 G,A\<turnstile>{Normal P} NewC C-\<succ> {Q}"
schirmer@12854
   523
schirmer@12854
   524
  NewA: "\<lbrakk>G,A\<turnstile>{Normal P} .init_comp_ty T. {Q};  G,A\<turnstile>{Q} e-\<succ>
schirmer@12854
   525
	  {\<lambda>Val:i:. abupd (check_neg i) .; Alloc G (Arr T (the_Intg i)) R}\<rbrakk> \<Longrightarrow>
schirmer@12854
   526
                                 G,A\<turnstile>{Normal P} New T[e]-\<succ> {R}"
schirmer@12854
   527
schirmer@12854
   528
  Cast: "\<lbrakk>G,A\<turnstile>{Normal P} e-\<succ> {\<lambda>Val:v:. \<lambda>s..
schirmer@12854
   529
          abupd (raise_if (\<not>G,s\<turnstile>v fits T) ClassCast) .; Q\<leftarrow>Val v}\<rbrakk> \<Longrightarrow>
schirmer@12854
   530
                                 G,A\<turnstile>{Normal P} Cast T e-\<succ> {Q}"
schirmer@12854
   531
schirmer@12854
   532
  Inst: "\<lbrakk>G,A\<turnstile>{Normal P} e-\<succ> {\<lambda>Val:v:. \<lambda>s..
schirmer@12854
   533
                  Q\<leftarrow>Val (Bool (v\<noteq>Null \<and> G,s\<turnstile>v fits RefT T))}\<rbrakk> \<Longrightarrow>
schirmer@12854
   534
                                 G,A\<turnstile>{Normal P} e InstOf T-\<succ> {Q}"
schirmer@12854
   535
schirmer@12854
   536
  Lit:                          "G,A\<turnstile>{Normal (P\<leftarrow>Val v)} Lit v-\<succ> {P}"
schirmer@12854
   537
schirmer@13337
   538
  UnOp: "\<lbrakk>G,A\<turnstile>{Normal P} e-\<succ> {\<lambda>Val:v:. Q\<leftarrow>Val (eval_unop unop v)}\<rbrakk>
schirmer@13337
   539
          \<Longrightarrow>
schirmer@13337
   540
          G,A\<turnstile>{Normal P} UnOp unop e-\<succ> {Q}"
schirmer@13337
   541
schirmer@13337
   542
  BinOp:
schirmer@13337
   543
   "\<lbrakk>G,A\<turnstile>{Normal P} e1-\<succ> {Q};
schirmer@13384
   544
     \<forall>v1. G,A\<turnstile>{Q\<leftarrow>Val v1} 
schirmer@13384
   545
               (if need_second_arg binop v1 then (In1l e2) else (In1r Skip))\<succ>
schirmer@13384
   546
               {\<lambda>Val:v2:. R\<leftarrow>Val (eval_binop binop v1 v2)}\<rbrakk>
schirmer@13337
   547
    \<Longrightarrow>
schirmer@13337
   548
    G,A\<turnstile>{Normal P} BinOp binop e1 e2-\<succ> {R}" 
schirmer@13337
   549
schirmer@12854
   550
  Super:" G,A\<turnstile>{Normal (\<lambda>s.. P\<leftarrow>Val (val_this s))} Super-\<succ> {P}"
schirmer@12854
   551
schirmer@12854
   552
  Acc:  "\<lbrakk>G,A\<turnstile>{Normal P} va=\<succ> {\<lambda>Var:(v,f):. Q\<leftarrow>Val v}\<rbrakk> \<Longrightarrow>
schirmer@12854
   553
                                 G,A\<turnstile>{Normal P} Acc va-\<succ> {Q}"
schirmer@12854
   554
schirmer@12854
   555
  Ass:  "\<lbrakk>G,A\<turnstile>{Normal P} va=\<succ> {Q};
schirmer@12854
   556
     \<forall>vf. G,A\<turnstile>{Q\<leftarrow>Var vf} e-\<succ> {\<lambda>Val:v:. assign (snd vf) v .; R}\<rbrakk> \<Longrightarrow>
schirmer@12854
   557
                                 G,A\<turnstile>{Normal P} va:=e-\<succ> {R}"
schirmer@12854
   558
schirmer@12854
   559
  Cond: "\<lbrakk>G,A \<turnstile>{Normal P} e0-\<succ> {P'};
schirmer@12854
   560
          \<forall>b. G,A\<turnstile>{P'\<leftarrow>=b} (if b then e1 else e2)-\<succ> {Q}\<rbrakk> \<Longrightarrow>
schirmer@12854
   561
                                 G,A\<turnstile>{Normal P} e0 ? e1 : e2-\<succ> {Q}"
schirmer@12854
   562
schirmer@12854
   563
  Call: 
schirmer@12854
   564
"\<lbrakk>G,A\<turnstile>{Normal P} e-\<succ> {Q}; \<forall>a. G,A\<turnstile>{Q\<leftarrow>Val a} args\<doteq>\<succ> {R a};
schirmer@12854
   565
  \<forall>a vs invC declC l. G,A\<turnstile>{(R a\<leftarrow>Vals vs \<and>.
schirmer@12854
   566
 (\<lambda>s. declC=invocation_declclass G mode (store s) a statT \<lparr>name=mn,parTs=pTs\<rparr> \<and>
schirmer@12854
   567
      invC = invocation_class mode (store s) a statT \<and>
schirmer@12854
   568
         l = locals (store s)) ;.
schirmer@12854
   569
      init_lvars G declC \<lparr>name=mn,parTs=pTs\<rparr> mode a vs) \<and>.
schirmer@12854
   570
      (\<lambda>s. normal s \<longrightarrow> G\<turnstile>mode\<rightarrow>invC\<preceq>statT)}
schirmer@12854
   571
 Methd declC \<lparr>name=mn,parTs=pTs\<rparr>-\<succ> {set_lvars l .; S}\<rbrakk> \<Longrightarrow>
schirmer@12925
   572
         G,A\<turnstile>{Normal P} {accC,statT,mode}e\<cdot>mn({pTs}args)-\<succ> {S}"
schirmer@12854
   573
schirmer@12854
   574
  Methd:"\<lbrakk>G,A\<union> {{P} Methd-\<succ> {Q} | ms} |\<turnstile> {{P} body G-\<succ> {Q} | ms}\<rbrakk> \<Longrightarrow>
schirmer@12854
   575
                                 G,A|\<turnstile>{{P} Methd-\<succ>  {Q} | ms}"
schirmer@12854
   576
schirmer@12854
   577
  Body: "\<lbrakk>G,A\<turnstile>{Normal P} .Init D. {Q}; 
schirmer@12854
   578
  G,A\<turnstile>{Q} .c. {\<lambda>s.. abupd (absorb Ret) .; R\<leftarrow>(In1 (the (locals s Result)))}\<rbrakk> 
schirmer@12854
   579
    \<Longrightarrow>
schirmer@12854
   580
                                 G,A\<turnstile>{Normal P} Body D c-\<succ> {R}"
schirmer@12854
   581
  
schirmer@12854
   582
  (* expression lists *)
schirmer@12854
   583
schirmer@12854
   584
  Nil:                          "G,A\<turnstile>{Normal (P\<leftarrow>Vals [])} []\<doteq>\<succ> {P}"
schirmer@12854
   585
schirmer@12854
   586
  Cons: "\<lbrakk>G,A\<turnstile>{Normal P} e-\<succ> {Q};
schirmer@12854
   587
          \<forall>v. G,A\<turnstile>{Q\<leftarrow>Val v} es\<doteq>\<succ> {\<lambda>Vals:vs:. R\<leftarrow>Vals (v#vs)}\<rbrakk> \<Longrightarrow>
schirmer@12854
   588
                                 G,A\<turnstile>{Normal P} e#es\<doteq>\<succ> {R}"
schirmer@12854
   589
schirmer@12854
   590
  (* statements *)
schirmer@12854
   591
schirmer@12854
   592
  Skip:                         "G,A\<turnstile>{Normal (P\<leftarrow>\<diamondsuit>)} .Skip. {P}"
schirmer@12854
   593
schirmer@12854
   594
  Expr: "\<lbrakk>G,A\<turnstile>{Normal P} e-\<succ> {Q\<leftarrow>\<diamondsuit>}\<rbrakk> \<Longrightarrow>
schirmer@12854
   595
                                 G,A\<turnstile>{Normal P} .Expr e. {Q}"
schirmer@12854
   596
schirmer@13337
   597
  Lab: "\<lbrakk>G,A\<turnstile>{Normal P} .c. {abupd (absorb l) .; Q}\<rbrakk> \<Longrightarrow>
schirmer@12854
   598
                           G,A\<turnstile>{Normal P} .l\<bullet> c. {Q}"
schirmer@12854
   599
schirmer@12854
   600
  Comp: "\<lbrakk>G,A\<turnstile>{Normal P} .c1. {Q};
schirmer@12854
   601
          G,A\<turnstile>{Q} .c2. {R}\<rbrakk> \<Longrightarrow>
schirmer@12854
   602
                                 G,A\<turnstile>{Normal P} .c1;;c2. {R}"
schirmer@12854
   603
schirmer@12854
   604
  If:   "\<lbrakk>G,A \<turnstile>{Normal P} e-\<succ> {P'};
schirmer@12854
   605
          \<forall>b. G,A\<turnstile>{P'\<leftarrow>=b} .(if b then c1 else c2). {Q}\<rbrakk> \<Longrightarrow>
schirmer@12854
   606
                                 G,A\<turnstile>{Normal P} .If(e) c1 Else c2. {Q}"
schirmer@12854
   607
(* unfolding variant of Loop, not needed here
schirmer@12854
   608
  LoopU:"\<lbrakk>G,A \<turnstile>{Normal P} e-\<succ> {P'};
schirmer@12854
   609
          \<forall>b. G,A\<turnstile>{P'\<leftarrow>=b} .(if b then c;;While(e) c else Skip).{Q}\<rbrakk>
schirmer@12854
   610
         \<Longrightarrow>              G,A\<turnstile>{Normal P} .While(e) c. {Q}"
schirmer@12854
   611
*)
schirmer@12854
   612
  Loop: "\<lbrakk>G,A\<turnstile>{P} e-\<succ> {P'}; 
schirmer@12854
   613
          G,A\<turnstile>{Normal (P'\<leftarrow>=True)} .c. {abupd (absorb (Cont l)) .; P}\<rbrakk> \<Longrightarrow>
schirmer@12854
   614
                            G,A\<turnstile>{P} .l\<bullet> While(e) c. {(P'\<leftarrow>=False)\<down>=\<diamondsuit>}"
schirmer@12854
   615
(** Beware of polymorphic_Loop below: should be identical terms **)
schirmer@12854
   616
  
schirmer@12854
   617
  Do: "G,A\<turnstile>{Normal (abupd (\<lambda>a. (Some (Jump j))) .; P\<leftarrow>\<diamondsuit>)} .Do j. {P}"
schirmer@12854
   618
schirmer@12854
   619
  Throw:"\<lbrakk>G,A\<turnstile>{Normal P} e-\<succ> {\<lambda>Val:a:. abupd (throw a) .; Q\<leftarrow>\<diamondsuit>}\<rbrakk> \<Longrightarrow>
schirmer@12854
   620
                                 G,A\<turnstile>{Normal P} .Throw e. {Q}"
schirmer@12854
   621
schirmer@12854
   622
  Try:  "\<lbrakk>G,A\<turnstile>{Normal P} .c1. {SXAlloc G Q};
schirmer@12854
   623
          G,A\<turnstile>{Q \<and>. (\<lambda>s.  G,s\<turnstile>catch C) ;. new_xcpt_var vn} .c2. {R};
schirmer@12854
   624
              (Q \<and>. (\<lambda>s. \<not>G,s\<turnstile>catch C)) \<Rightarrow> R\<rbrakk> \<Longrightarrow>
schirmer@12854
   625
                                 G,A\<turnstile>{Normal P} .Try c1 Catch(C vn) c2. {R}"
schirmer@12854
   626
schirmer@12854
   627
  Fin:  "\<lbrakk>G,A\<turnstile>{Normal P} .c1. {Q};
schirmer@12854
   628
      \<forall>x. G,A\<turnstile>{Q \<and>. (\<lambda>s. x = fst s) ;. abupd (\<lambda>x. None)}
schirmer@12854
   629
              .c2. {abupd (abrupt_if (x\<noteq>None) x) .; R}\<rbrakk> \<Longrightarrow>
schirmer@12854
   630
                                 G,A\<turnstile>{Normal P} .c1 Finally c2. {R}"
schirmer@12854
   631
schirmer@12854
   632
  Done:                       "G,A\<turnstile>{Normal (P\<leftarrow>\<diamondsuit> \<and>. initd C)} .Init C. {P}"
schirmer@12854
   633
schirmer@12854
   634
  Init: "\<lbrakk>the (class G C) = c;
schirmer@12854
   635
          G,A\<turnstile>{Normal ((P \<and>. Not \<circ> initd C) ;. supd (init_class_obj G C))}
schirmer@12854
   636
              .(if C = Object then Skip else Init (super c)). {Q};
schirmer@12854
   637
      \<forall>l. G,A\<turnstile>{Q \<and>. (\<lambda>s. l = locals (store s)) ;. set_lvars empty}
schirmer@12854
   638
              .init c. {set_lvars l .; R}\<rbrakk> \<Longrightarrow>
schirmer@12854
   639
                               G,A\<turnstile>{Normal (P \<and>. Not \<circ> initd C)} .Init C. {R}"
schirmer@12854
   640
schirmer@13337
   641
-- {* Some dummy rules for the intermediate terms @{text Callee},
schirmer@13337
   642
@{text InsInitE}, @{text InsInitV}, @{text FinA} only used by the smallstep 
schirmer@13337
   643
semantics.
schirmer@13337
   644
*}
schirmer@13337
   645
  InstInitV: " G,A\<turnstile>{Normal P} InsInitV c v=\<succ> {Q}"
schirmer@13337
   646
  InstInitE: " G,A\<turnstile>{Normal P} InsInitE c e-\<succ> {Q}"
schirmer@13337
   647
  Callee:    " G,A\<turnstile>{Normal P} Callee l e-\<succ> {Q}"
schirmer@13337
   648
  FinA:      " G,A\<turnstile>{Normal P} .FinA a c. {Q}"
schirmer@12854
   649
axioms (** these terms are the same as above, but with generalized typing **)
schirmer@12854
   650
  polymorphic_conseq:
schirmer@12854
   651
        "\<forall>Y s Z . P  Y s Z  \<longrightarrow> (\<exists>P' Q'. G,A\<turnstile>{P'} t\<succ> {Q'} \<and> (\<forall>Y' s'. 
schirmer@12854
   652
        (\<forall>Y   Z'. P' Y s Z' \<longrightarrow> Q' Y' s' Z') \<longrightarrow>
schirmer@12854
   653
                                Q  Y' s' Z ))
schirmer@12854
   654
                                         \<Longrightarrow> G,A\<turnstile>{P } t\<succ> {Q }"
schirmer@12854
   655
schirmer@12854
   656
  polymorphic_Loop:
schirmer@12854
   657
        "\<lbrakk>G,A\<turnstile>{P} e-\<succ> {P'}; 
schirmer@12854
   658
          G,A\<turnstile>{Normal (P'\<leftarrow>=True)} .c. {abupd (absorb (Cont l)) .; P}\<rbrakk> \<Longrightarrow>
schirmer@12854
   659
                            G,A\<turnstile>{P} .l\<bullet> While(e) c. {(P'\<leftarrow>=False)\<down>=\<diamondsuit>}"
schirmer@12854
   660
schirmer@12854
   661
constdefs
schirmer@12854
   662
 adapt_pre :: "'a assn \<Rightarrow> 'a assn \<Rightarrow> 'a assn \<Rightarrow> 'a assn"
schirmer@12854
   663
"adapt_pre P Q Q'\<equiv>\<lambda>Y s Z. \<forall>Y' s'. \<exists>Z'. P Y s Z' \<and> (Q Y' s' Z' \<longrightarrow> Q' Y' s' Z)"
schirmer@12854
   664
schirmer@12854
   665
schirmer@12854
   666
section "rules derived by induction"
schirmer@12854
   667
schirmer@12854
   668
lemma cut_valid: "\<lbrakk>G,A'|\<Turnstile>ts; G,A|\<Turnstile>A'\<rbrakk> \<Longrightarrow> G,A|\<Turnstile>ts"
schirmer@12854
   669
apply (unfold ax_valids_def)
schirmer@12854
   670
apply fast
schirmer@12854
   671
done
schirmer@12854
   672
schirmer@12854
   673
(*if cut is available
schirmer@12854
   674
Goal "\<lbrakk>G,A'|\<turnstile>ts; A' \<subseteq> A; \<forall>P Q t. {P} t\<succ> {Q} \<in> A' \<longrightarrow> (\<exists>T. (G,L)\<turnstile>t\<Colon>T) \<rbrakk> \<Longrightarrow>  
schirmer@12854
   675
       G,A|\<turnstile>ts"
schirmer@12854
   676
b y etac ax_derivs.cut 1;
schirmer@12854
   677
b y eatac ax_derivs.asm 1 1;
schirmer@12854
   678
qed "ax_thin";
schirmer@12854
   679
*)
schirmer@12854
   680
lemma ax_thin [rule_format (no_asm)]: 
schirmer@12854
   681
  "G,(A'::'a triple set)|\<turnstile>(ts::'a triple set) \<Longrightarrow> \<forall>A. A' \<subseteq> A \<longrightarrow> G,A|\<turnstile>ts"
schirmer@12854
   682
apply (erule ax_derivs.induct)
schirmer@12854
   683
apply                (tactic "ALLGOALS(EVERY'[Clarify_tac,REPEAT o smp_tac 1])")
schirmer@12854
   684
apply                (rule ax_derivs.empty)
schirmer@12854
   685
apply               (erule (1) ax_derivs.insert)
schirmer@12854
   686
apply              (fast intro: ax_derivs.asm)
schirmer@12854
   687
(*apply           (fast intro: ax_derivs.cut) *)
schirmer@12854
   688
apply            (fast intro: ax_derivs.weaken)
schirmer@13337
   689
apply           (rule ax_derivs.conseq, intro strip, tactic "smp_tac 3 1",clarify, tactic "smp_tac 1 1",rule exI, rule exI, erule (1) conjI) 
schirmer@13337
   690
(* 37 subgoals *)
schirmer@13337
   691
prefer 18 (* Methd *)
schirmer@12854
   692
apply (rule ax_derivs.Methd, drule spec, erule mp, fast)
schirmer@12854
   693
apply (tactic {* TRYALL (resolve_tac ((funpow 5 tl) (thms "ax_derivs.intros")) 
schirmer@12854
   694
                     THEN_ALL_NEW Blast_tac) *})
schirmer@12854
   695
apply (erule ax_derivs.Call)
schirmer@12854
   696
apply   clarify 
schirmer@12854
   697
apply   blast
schirmer@12854
   698
schirmer@12854
   699
apply   (rule allI)+ 
schirmer@12854
   700
apply   (drule spec)+
schirmer@12854
   701
apply   blast
schirmer@12854
   702
done
schirmer@12854
   703
schirmer@12854
   704
lemma ax_thin_insert: "G,(A::'a triple set)\<turnstile>(t::'a triple) \<Longrightarrow> G,insert x A\<turnstile>t"
schirmer@12854
   705
apply (erule ax_thin)
schirmer@12854
   706
apply fast
schirmer@12854
   707
done
schirmer@12854
   708
schirmer@12854
   709
lemma subset_mtriples_iff: 
schirmer@12854
   710
  "ts \<subseteq> {{P} mb-\<succ> {Q} | ms} = (\<exists>ms'. ms'\<subseteq>ms \<and>  ts = {{P} mb-\<succ> {Q} | ms'})"
schirmer@12854
   711
apply (unfold mtriples_def)
schirmer@12854
   712
apply (rule subset_image_iff)
schirmer@12854
   713
done
schirmer@12854
   714
schirmer@12854
   715
lemma weaken: 
schirmer@12854
   716
 "G,(A::'a triple set)|\<turnstile>(ts'::'a triple set) \<Longrightarrow> !ts. ts \<subseteq> ts' \<longrightarrow> G,A|\<turnstile>ts"
schirmer@12854
   717
apply (erule ax_derivs.induct)
schirmer@13337
   718
(*42 subgoals*)
schirmer@12854
   719
apply       (tactic "ALLGOALS strip_tac")
schirmer@12854
   720
apply       (tactic {* ALLGOALS(REPEAT o (EVERY'[dtac (thm "subset_singletonD"),
schirmer@12854
   721
         etac disjE, fast_tac (claset() addSIs [thm "ax_derivs.empty"])]))*})
schirmer@12854
   722
apply       (tactic "TRYALL hyp_subst_tac")
schirmer@12854
   723
apply       (simp, rule ax_derivs.empty)
schirmer@12854
   724
apply      (drule subset_insertD)
schirmer@12854
   725
apply      (blast intro: ax_derivs.insert)
schirmer@12854
   726
apply     (fast intro: ax_derivs.asm)
schirmer@12854
   727
(*apply  (blast intro: ax_derivs.cut) *)
schirmer@12854
   728
apply   (fast intro: ax_derivs.weaken)
schirmer@12854
   729
apply  (rule ax_derivs.conseq, clarify, tactic "smp_tac 3 1", blast(* unused *))
schirmer@13337
   730
(*37 subgoals*)
schirmer@12854
   731
apply (tactic {* TRYALL (resolve_tac ((funpow 5 tl) (thms "ax_derivs.intros")) 
schirmer@12854
   732
                   THEN_ALL_NEW Fast_tac) *})
schirmer@12854
   733
(*1 subgoal*)
schirmer@12854
   734
apply (clarsimp simp add: subset_mtriples_iff)
schirmer@12854
   735
apply (rule ax_derivs.Methd)
schirmer@12854
   736
apply (drule spec)
schirmer@12854
   737
apply (erule impE)
schirmer@12854
   738
apply  (rule exI)
schirmer@12854
   739
apply  (erule conjI)
schirmer@12854
   740
apply  (rule HOL.refl)
schirmer@12854
   741
oops (* dead end, Methd is to blame *)
schirmer@12854
   742
schirmer@12854
   743
schirmer@12854
   744
section "rules derived from conseq"
schirmer@12854
   745
schirmer@12854
   746
lemma conseq12: "\<lbrakk>G,A\<turnstile>{P'} t\<succ> {Q'};  
schirmer@12854
   747
 \<forall>Y s Z. P Y s Z \<longrightarrow> (\<forall>Y' s'. (\<forall>Y Z'. P' Y s Z' \<longrightarrow> Q' Y' s' Z') \<longrightarrow>  
schirmer@12854
   748
  Q Y' s' Z)\<rbrakk>  
schirmer@12854
   749
  \<Longrightarrow>  G,A\<turnstile>{P ::'a assn} t\<succ> {Q }"
schirmer@12854
   750
apply (rule polymorphic_conseq)
schirmer@12854
   751
apply clarsimp
schirmer@12854
   752
apply blast
schirmer@12854
   753
done
schirmer@12854
   754
schirmer@12854
   755
(*unused, but nice variant*)
schirmer@12854
   756
lemma conseq12': "\<lbrakk>G,A\<turnstile>{P'} t\<succ> {Q'}; \<forall>s Y' s'.  
schirmer@12854
   757
       (\<forall>Y Z. P' Y s Z \<longrightarrow> Q' Y' s' Z) \<longrightarrow>  
schirmer@12854
   758
       (\<forall>Y Z. P  Y s Z \<longrightarrow> Q  Y' s' Z)\<rbrakk>  
schirmer@12854
   759
  \<Longrightarrow>  G,A\<turnstile>{P } t\<succ> {Q }"
schirmer@12854
   760
apply (erule conseq12)
schirmer@12854
   761
apply fast
schirmer@12854
   762
done
schirmer@12854
   763
schirmer@12854
   764
lemma conseq12_from_conseq12': "\<lbrakk>G,A\<turnstile>{P'} t\<succ> {Q'};  
schirmer@12854
   765
 \<forall>Y s Z. P Y s Z \<longrightarrow> (\<forall>Y' s'. (\<forall>Y Z'. P' Y s Z' \<longrightarrow> Q' Y' s' Z') \<longrightarrow>  
schirmer@12854
   766
  Q Y' s' Z)\<rbrakk>  
schirmer@12854
   767
  \<Longrightarrow>  G,A\<turnstile>{P } t\<succ> {Q }"
schirmer@12854
   768
apply (erule conseq12')
schirmer@12854
   769
apply blast
schirmer@12854
   770
done
schirmer@12854
   771
schirmer@12854
   772
lemma conseq1: "\<lbrakk>G,A\<turnstile>{P'} t\<succ> {Q}; P \<Rightarrow> P'\<rbrakk> \<Longrightarrow> G,A\<turnstile>{P } t\<succ> {Q}"
schirmer@12854
   773
apply (erule conseq12)
schirmer@12854
   774
apply blast
schirmer@12854
   775
done
schirmer@12854
   776
schirmer@12854
   777
lemma conseq2: "\<lbrakk>G,A\<turnstile>{P} t\<succ> {Q'}; Q' \<Rightarrow> Q\<rbrakk> \<Longrightarrow> G,A\<turnstile>{P} t\<succ> {Q}"
schirmer@12854
   778
apply (erule conseq12)
schirmer@12854
   779
apply blast
schirmer@12854
   780
done
schirmer@12854
   781
schirmer@12854
   782
lemma ax_escape: "\<lbrakk>\<forall>Y s Z. P Y s Z \<longrightarrow> G,A\<turnstile>{\<lambda>Y' s' Z'. (Y',s') = (Y,s)} t\<succ> {\<lambda>Y s Z'. Q Y s Z}\<rbrakk> \<Longrightarrow>  
schirmer@12854
   783
  G,A\<turnstile>{P} t\<succ> {Q}"
schirmer@12854
   784
apply (rule polymorphic_conseq)
schirmer@12854
   785
apply force
schirmer@12854
   786
done
schirmer@12854
   787
schirmer@12854
   788
(* unused *)
schirmer@12854
   789
lemma ax_constant: "\<lbrakk> C \<Longrightarrow> G,A\<turnstile>{P} t\<succ> {Q}\<rbrakk> \<Longrightarrow> G,A\<turnstile>{\<lambda>Y s Z. C \<and> P Y s Z} t\<succ> {Q}"
schirmer@12854
   790
apply (rule ax_escape (* unused *))
schirmer@12854
   791
apply clarify
schirmer@12854
   792
apply (rule conseq12)
schirmer@12854
   793
apply  fast
schirmer@12854
   794
apply auto
schirmer@12854
   795
done
schirmer@12854
   796
(*alternative (more direct) proof:
schirmer@12854
   797
apply (rule ax_derivs.conseq) *)(* unused *)(*
schirmer@12854
   798
apply (fast)
schirmer@12854
   799
*)
schirmer@12854
   800
schirmer@12854
   801
schirmer@12854
   802
lemma ax_impossible [intro]: "G,A\<turnstile>{\<lambda>Y s Z. False} t\<succ> {Q}"
schirmer@12854
   803
apply (rule ax_escape)
schirmer@12854
   804
apply clarify
schirmer@12854
   805
done
schirmer@12854
   806
schirmer@12854
   807
(* unused *)
schirmer@12854
   808
lemma ax_nochange_lemma: "\<lbrakk>P Y s; All (op = w)\<rbrakk> \<Longrightarrow> P w s"
schirmer@12854
   809
apply auto
schirmer@12854
   810
done
schirmer@12854
   811
lemma ax_nochange:"G,A\<turnstile>{\<lambda>Y s Z. (Y,s)=Z} t\<succ> {\<lambda>Y s Z. (Y,s)=Z} \<Longrightarrow> G,A\<turnstile>{P} t\<succ> {P}"
schirmer@12854
   812
apply (erule conseq12)
schirmer@12854
   813
apply auto
schirmer@12854
   814
apply (erule (1) ax_nochange_lemma)
schirmer@12854
   815
done
schirmer@12854
   816
schirmer@12854
   817
(* unused *)
schirmer@12854
   818
lemma ax_trivial: "G,A\<turnstile>{P}  t\<succ> {\<lambda>Y s Z. True}"
schirmer@12854
   819
apply (rule polymorphic_conseq(* unused *))
schirmer@12854
   820
apply auto
schirmer@12854
   821
done
schirmer@12854
   822
schirmer@12854
   823
(* unused *)
schirmer@12854
   824
lemma ax_disj: "\<lbrakk>G,A\<turnstile>{P1} t\<succ> {Q1}; G,A\<turnstile>{P2} t\<succ> {Q2}\<rbrakk> \<Longrightarrow>  
schirmer@12854
   825
  G,A\<turnstile>{\<lambda>Y s Z. P1 Y s Z \<or> P2 Y s Z} t\<succ> {\<lambda>Y s Z. Q1 Y s Z \<or> Q2 Y s Z}"
schirmer@12854
   826
apply (rule ax_escape (* unused *))
schirmer@12854
   827
apply safe
schirmer@12854
   828
apply  (erule conseq12, fast)+
schirmer@12854
   829
done
schirmer@12854
   830
schirmer@12854
   831
(* unused *)
schirmer@12854
   832
lemma ax_supd_shuffle: "(\<exists>Q. G,A\<turnstile>{P} .c1. {Q} \<and> G,A\<turnstile>{Q ;. f} .c2. {R}) =  
schirmer@12854
   833
       (\<exists>Q'. G,A\<turnstile>{P} .c1. {f .; Q'} \<and> G,A\<turnstile>{Q'} .c2. {R})"
schirmer@12854
   834
apply (best elim!: conseq1 conseq2)
schirmer@12854
   835
done
schirmer@12854
   836
schirmer@12854
   837
lemma ax_cases: "\<lbrakk>G,A\<turnstile>{P \<and>.       C} t\<succ> {Q};  
schirmer@12854
   838
                       G,A\<turnstile>{P \<and>. Not \<circ> C} t\<succ> {Q}\<rbrakk> \<Longrightarrow> G,A\<turnstile>{P} t\<succ> {Q}"
schirmer@12854
   839
apply (unfold peek_and_def)
schirmer@12854
   840
apply (rule ax_escape)
schirmer@12854
   841
apply clarify
schirmer@12854
   842
apply (case_tac "C s")
schirmer@12854
   843
apply  (erule conseq12, force)+
schirmer@12854
   844
done
schirmer@12854
   845
(*alternative (more direct) proof:
schirmer@12854
   846
apply (rule rtac ax_derivs.conseq) *)(* unused *)(*
schirmer@12854
   847
apply clarify
schirmer@12854
   848
apply (case_tac "C s")
schirmer@12854
   849
apply  force+
schirmer@12854
   850
*)
schirmer@12854
   851
schirmer@12854
   852
lemma ax_adapt: "G,A\<turnstile>{P} t\<succ> {Q} \<Longrightarrow> G,A\<turnstile>{adapt_pre P Q Q'} t\<succ> {Q'}"
schirmer@12854
   853
apply (unfold adapt_pre_def)
schirmer@12854
   854
apply (erule conseq12)
schirmer@12854
   855
apply fast
schirmer@12854
   856
done
schirmer@12854
   857
schirmer@12854
   858
lemma adapt_pre_adapts: "G,A\<Turnstile>{P} t\<succ> {Q} \<longrightarrow> G,A\<Turnstile>{adapt_pre P Q Q'} t\<succ> {Q'}"
schirmer@12854
   859
apply (unfold adapt_pre_def)
schirmer@12854
   860
apply (simp add: ax_valids_def triple_valid_def2)
schirmer@12854
   861
apply fast
schirmer@12854
   862
done
schirmer@12854
   863
schirmer@12854
   864
schirmer@12854
   865
lemma adapt_pre_weakest: 
schirmer@12854
   866
"\<forall>G (A::'a triple set) t. G,A\<Turnstile>{P} t\<succ> {Q} \<longrightarrow> G,A\<Turnstile>{P'} t\<succ> {Q'} \<Longrightarrow>  
schirmer@12854
   867
  P' \<Rightarrow> adapt_pre P Q (Q'::'a assn)"
schirmer@12854
   868
apply (unfold adapt_pre_def)
schirmer@12854
   869
apply (drule spec)
schirmer@12854
   870
apply (drule_tac x = "{}" in spec)
schirmer@12854
   871
apply (drule_tac x = "In1r Skip" in spec)
schirmer@12854
   872
apply (simp add: ax_valids_def triple_valid_def2)
schirmer@12854
   873
oops
schirmer@12854
   874
schirmer@12854
   875
(*
schirmer@12854
   876
Goal "\<forall>(A::'a triple set) t. G,A\<Turnstile>{P} t\<succ> {Q} \<longrightarrow> G,A\<Turnstile>{P'} t\<succ> {Q'} \<Longrightarrow>  
schirmer@12854
   877
  wf_prog G \<Longrightarrow> G,(A::'a triple set)\<turnstile>{P} t\<succ> {Q::'a assn} \<Longrightarrow> G,A\<turnstile>{P'} t\<succ> {Q'::'a assn}"
schirmer@12854
   878
b y fatac ax_sound 1 1;
schirmer@12854
   879
b y asm_full_simp_tac (simpset() addsimps [ax_valids_def,triple_valid_def2]) 1;
schirmer@12854
   880
b y rtac ax_no_hazard 1; 
schirmer@12854
   881
b y etac conseq12 1;
schirmer@12854
   882
b y Clarify_tac 1;
schirmer@12854
   883
b y case_tac "\<forall>Z. \<not>P Y s Z" 1;
schirmer@12854
   884
b y smp_tac 2 1;
schirmer@12854
   885
b y etac thin_rl 1;
schirmer@12854
   886
b y etac thin_rl 1;
schirmer@12854
   887
b y clarsimp_tac (claset(), simpset() addsimps [type_ok_def]) 1;
schirmer@12854
   888
b y subgoal_tac "G|\<Turnstile>n:A" 1;
schirmer@12854
   889
b y smp_tac 1 1;
schirmer@12854
   890
b y smp_tac 3 1;
schirmer@12854
   891
b y etac impE 1;
schirmer@12854
   892
 back();
schirmer@12854
   893
 b y Fast_tac 1;
schirmer@12854
   894
b y 
schirmer@12854
   895
b y rotate_tac 2 1;
schirmer@12854
   896
b y etac thin_rl 1;
schirmer@12854
   897
b y  etac thin_rl 2;
schirmer@12854
   898
b y  etac thin_rl 2;
schirmer@12854
   899
b y  Clarify_tac 2;
schirmer@12854
   900
b y  dtac spec 2;
schirmer@12854
   901
b y  EVERY'[dtac spec, mp_tac] 2;
schirmer@12854
   902
b y  thin_tac "\<forall>n Y s Z. ?PP n Y s Z" 2;
schirmer@12854
   903
b y  thin_tac "P' Y s Z" 2;
schirmer@12854
   904
b y  Blast_tac 2;
schirmer@12854
   905
b y smp_tac 3 1;
schirmer@12854
   906
b y case_tac "\<forall>Z. \<not>P Y s Z" 1;
schirmer@12854
   907
b y dres_inst_tac [("x","In1r Skip")] spec 1;
schirmer@12854
   908
b y Full_simp_tac 1;
schirmer@12854
   909
*)
schirmer@12854
   910
schirmer@12854
   911
lemma peek_and_forget1_Normal: 
schirmer@12854
   912
 "G,A\<turnstile>{Normal P} t\<succ> {Q} \<Longrightarrow> G,A\<turnstile>{Normal (P \<and>. p)} t\<succ> {Q}"
schirmer@12854
   913
apply (erule conseq1)
schirmer@12854
   914
apply (simp (no_asm))
schirmer@12854
   915
done
schirmer@12854
   916
schirmer@12854
   917
lemma peek_and_forget1: "G,A\<turnstile>{P} t\<succ> {Q} \<Longrightarrow> G,A\<turnstile>{P \<and>. p} t\<succ> {Q}"
schirmer@12854
   918
apply (erule conseq1)
schirmer@12854
   919
apply (simp (no_asm))
schirmer@12854
   920
done
schirmer@12854
   921
schirmer@12854
   922
lemmas ax_NormalD = peek_and_forget1 [of _ _ _ _ _ normal] 
schirmer@12854
   923
schirmer@12854
   924
lemma peek_and_forget2: "G,A\<turnstile>{P} t\<succ> {Q \<and>. p} \<Longrightarrow> G,A\<turnstile>{P} t\<succ> {Q}"
schirmer@12854
   925
apply (erule conseq2)
schirmer@12854
   926
apply (simp (no_asm))
schirmer@12854
   927
done
schirmer@12854
   928
schirmer@12854
   929
lemma ax_subst_Val_allI: "\<forall>v. G,A\<turnstile>{(P'               v )\<leftarrow>Val v} t\<succ> {Q v} \<Longrightarrow>  
schirmer@12854
   930
      \<forall>v. G,A\<turnstile>{(\<lambda>w:. P' (the_In1 w))\<leftarrow>Val v} t\<succ> {Q v}"
schirmer@12854
   931
apply (force elim!: conseq1)
schirmer@12854
   932
done
schirmer@12854
   933
schirmer@12854
   934
lemma ax_subst_Var_allI: "\<forall>v. G,A\<turnstile>{(P'               v )\<leftarrow>Var v} t\<succ> {Q v} \<Longrightarrow>  
schirmer@12854
   935
      \<forall>v. G,A\<turnstile>{(\<lambda>w:. P' (the_In2 w))\<leftarrow>Var v} t\<succ> {Q v}"
schirmer@12854
   936
apply (force elim!: conseq1)
schirmer@12854
   937
done
schirmer@12854
   938
schirmer@12854
   939
lemma ax_subst_Vals_allI: "(\<forall>v. G,A\<turnstile>{(     P'          v )\<leftarrow>Vals v} t\<succ> {Q v}) \<Longrightarrow>  
schirmer@12854
   940
       \<forall>v. G,A\<turnstile>{(\<lambda>w:. P' (the_In3 w))\<leftarrow>Vals v} t\<succ> {Q v}"
schirmer@12854
   941
apply (force elim!: conseq1)
schirmer@12854
   942
done
schirmer@12854
   943
schirmer@12854
   944
schirmer@12854
   945
section "alternative axioms"
schirmer@12854
   946
schirmer@12854
   947
lemma ax_Lit2: 
schirmer@12854
   948
  "G,(A::'a triple set)\<turnstile>{Normal P::'a assn} Lit v-\<succ> {Normal (P\<down>=Val v)}"
schirmer@12854
   949
apply (rule ax_derivs.Lit [THEN conseq1])
schirmer@12854
   950
apply force
schirmer@12854
   951
done
schirmer@12854
   952
lemma ax_Lit2_test_complete: 
schirmer@12854
   953
  "G,(A::'a triple set)\<turnstile>{Normal (P\<leftarrow>Val v)::'a assn} Lit v-\<succ> {P}"
schirmer@12854
   954
apply (rule ax_Lit2 [THEN conseq2])
schirmer@12854
   955
apply force
schirmer@12854
   956
done
schirmer@12854
   957
schirmer@12854
   958
lemma ax_LVar2: "G,(A::'a triple set)\<turnstile>{Normal P::'a assn} LVar vn=\<succ> {Normal (\<lambda>s.. P\<down>=Var (lvar vn s))}"
schirmer@12854
   959
apply (rule ax_derivs.LVar [THEN conseq1])
schirmer@12854
   960
apply force
schirmer@12854
   961
done
schirmer@12854
   962
schirmer@12854
   963
lemma ax_Super2: "G,(A::'a triple set)\<turnstile>
schirmer@12854
   964
  {Normal P::'a assn} Super-\<succ> {Normal (\<lambda>s.. P\<down>=Val (val_this s))}"
schirmer@12854
   965
apply (rule ax_derivs.Super [THEN conseq1])
schirmer@12854
   966
apply force
schirmer@12854
   967
done
schirmer@12854
   968
schirmer@12854
   969
lemma ax_Nil2: 
schirmer@12854
   970
  "G,(A::'a triple set)\<turnstile>{Normal P::'a assn} []\<doteq>\<succ> {Normal (P\<down>=Vals [])}"
schirmer@12854
   971
apply (rule ax_derivs.Nil [THEN conseq1])
schirmer@12854
   972
apply force
schirmer@12854
   973
done
schirmer@12854
   974
schirmer@12854
   975
schirmer@12854
   976
section "misc derived structural rules"
schirmer@12854
   977
schirmer@12854
   978
(* unused *)
schirmer@12854
   979
lemma ax_finite_mtriples_lemma: "\<lbrakk>F \<subseteq> ms; finite ms; \<forall>(C,sig)\<in>ms. 
schirmer@12854
   980
    G,(A::'a triple set)\<turnstile>{Normal (P C sig)::'a assn} mb C sig-\<succ> {Q C sig}\<rbrakk> \<Longrightarrow> 
schirmer@12854
   981
       G,A|\<turnstile>{{P} mb-\<succ> {Q} | F}"
schirmer@12854
   982
apply (frule (1) finite_subset)
schirmer@12854
   983
apply (erule make_imp)
schirmer@12854
   984
apply (erule thin_rl)
schirmer@12854
   985
apply (erule finite_induct)
schirmer@12854
   986
apply  (unfold mtriples_def)
schirmer@12854
   987
apply  (clarsimp intro!: ax_derivs.empty ax_derivs.insert)+
schirmer@12854
   988
apply force
schirmer@12854
   989
done
schirmer@12854
   990
lemmas ax_finite_mtriples = ax_finite_mtriples_lemma [OF subset_refl]
schirmer@12854
   991
schirmer@12854
   992
lemma ax_derivs_insertD: 
schirmer@12854
   993
 "G,(A::'a triple set)|\<turnstile>insert (t::'a triple) ts \<Longrightarrow> G,A\<turnstile>t \<and> G,A|\<turnstile>ts"
schirmer@12854
   994
apply (fast intro: ax_derivs.weaken)
schirmer@12854
   995
done
schirmer@12854
   996
schirmer@12854
   997
lemma ax_methods_spec: 
schirmer@12854
   998
"\<lbrakk>G,(A::'a triple set)|\<turnstile>split f ` ms; (C,sig) \<in> ms\<rbrakk>\<Longrightarrow> G,A\<turnstile>((f C sig)::'a triple)"
schirmer@12854
   999
apply (erule ax_derivs.weaken)
schirmer@12854
  1000
apply (force del: image_eqI intro: rev_image_eqI)
schirmer@12854
  1001
done
schirmer@12854
  1002
schirmer@12854
  1003
(* this version is used to avoid using the cut rule *)
schirmer@12854
  1004
lemma ax_finite_pointwise_lemma [rule_format]: "\<lbrakk>F \<subseteq> ms; finite ms\<rbrakk> \<Longrightarrow>  
schirmer@12854
  1005
  ((\<forall>(C,sig)\<in>F. G,(A::'a triple set)\<turnstile>(f C sig::'a triple)) \<longrightarrow> (\<forall>(C,sig)\<in>ms. G,A\<turnstile>(g C sig::'a triple))) \<longrightarrow>  
schirmer@12854
  1006
      G,A|\<turnstile>split f ` F \<longrightarrow> G,A|\<turnstile>split g ` F"
schirmer@12854
  1007
apply (frule (1) finite_subset)
schirmer@12854
  1008
apply (erule make_imp)
schirmer@12854
  1009
apply (erule thin_rl)
schirmer@12854
  1010
apply (erule finite_induct)
schirmer@12854
  1011
apply  clarsimp+
schirmer@12854
  1012
apply (drule ax_derivs_insertD)
schirmer@12854
  1013
apply (rule ax_derivs.insert)
schirmer@12854
  1014
apply  (simp (no_asm_simp) only: split_tupled_all)
schirmer@12854
  1015
apply  (auto elim: ax_methods_spec)
schirmer@12854
  1016
done
schirmer@12854
  1017
lemmas ax_finite_pointwise = ax_finite_pointwise_lemma [OF subset_refl]
schirmer@12854
  1018
 
schirmer@12854
  1019
lemma ax_no_hazard: 
schirmer@12854
  1020
  "G,(A::'a triple set)\<turnstile>{P \<and>. type_ok G t} t\<succ> {Q::'a assn} \<Longrightarrow> G,A\<turnstile>{P} t\<succ> {Q}"
schirmer@12854
  1021
apply (erule ax_cases)
schirmer@12854
  1022
apply (rule ax_derivs.hazard [THEN conseq1])
schirmer@12854
  1023
apply force
schirmer@12854
  1024
done
schirmer@12854
  1025
schirmer@12854
  1026
lemma ax_free_wt: 
schirmer@12854
  1027
 "(\<exists>T L C. \<lparr>prg=G,cls=C,lcl=L\<rparr>\<turnstile>t\<Colon>T) 
schirmer@12854
  1028
  \<longrightarrow> G,(A::'a triple set)\<turnstile>{Normal P} t\<succ> {Q::'a assn} \<Longrightarrow> 
schirmer@12854
  1029
  G,A\<turnstile>{Normal P} t\<succ> {Q}"
schirmer@12854
  1030
apply (rule ax_no_hazard)
schirmer@12854
  1031
apply (rule ax_escape)
schirmer@12854
  1032
apply clarify
schirmer@12854
  1033
apply (erule mp [THEN conseq12])
schirmer@12854
  1034
apply  (auto simp add: type_ok_def)
schirmer@12854
  1035
done
schirmer@12854
  1036
schirmer@12854
  1037
ML {*
schirmer@12854
  1038
bind_thms ("ax_Abrupts", sum3_instantiate (thm "ax_derivs.Abrupt"))
schirmer@12854
  1039
*}
schirmer@12854
  1040
declare ax_Abrupts [intro!]
schirmer@12854
  1041
schirmer@12854
  1042
lemmas ax_Normal_cases = ax_cases [of _ _ normal]
schirmer@12854
  1043
schirmer@12854
  1044
lemma ax_Skip [intro!]: "G,(A::'a triple set)\<turnstile>{P\<leftarrow>\<diamondsuit>} .Skip. {P::'a assn}"
schirmer@12854
  1045
apply (rule ax_Normal_cases)
schirmer@12854
  1046
apply  (rule ax_derivs.Skip)
schirmer@12854
  1047
apply fast
schirmer@12854
  1048
done
schirmer@12854
  1049
lemmas ax_SkipI = ax_Skip [THEN conseq1, standard]
schirmer@12854
  1050
schirmer@12854
  1051
schirmer@12854
  1052
section "derived rules for methd call"
schirmer@12854
  1053
schirmer@12854
  1054
lemma ax_Call_known_DynT: 
schirmer@12854
  1055
"\<lbrakk>G\<turnstile>IntVir\<rightarrow>C\<preceq>statT; 
schirmer@12854
  1056
  \<forall>a vs l. G,A\<turnstile>{(R a\<leftarrow>Vals vs \<and>. (\<lambda>s. l = locals (store s)) ;.
schirmer@12854
  1057
  init_lvars G C \<lparr>name=mn,parTs=pTs\<rparr> IntVir a vs)} 
schirmer@12854
  1058
    Methd C \<lparr>name=mn,parTs=pTs\<rparr>-\<succ> {set_lvars l .; S}; 
schirmer@12854
  1059
  \<forall>a. G,A\<turnstile>{Q\<leftarrow>Val a} args\<doteq>\<succ>  
schirmer@12854
  1060
       {R a \<and>. (\<lambda>s. C = obj_class (the (heap (store s) (the_Addr a))) \<and>
schirmer@12854
  1061
                     C = invocation_declclass 
schirmer@12854
  1062
                            G IntVir (store s) a statT \<lparr>name=mn,parTs=pTs\<rparr> )};  
schirmer@12854
  1063
       G,(A::'a triple set)\<turnstile>{Normal P} e-\<succ> {Q::'a assn}\<rbrakk>  
schirmer@12925
  1064
   \<Longrightarrow> G,A\<turnstile>{Normal P} {accC,statT,IntVir}e\<cdot>mn({pTs}args)-\<succ> {S}"
schirmer@12854
  1065
apply (erule ax_derivs.Call)
schirmer@12854
  1066
apply  safe
schirmer@12854
  1067
apply  (erule spec)
schirmer@12854
  1068
apply (rule ax_escape, clarsimp)
schirmer@12854
  1069
apply (drule spec, drule spec, drule spec,erule conseq12)
schirmer@12854
  1070
apply force
schirmer@12854
  1071
done
schirmer@12854
  1072
schirmer@12854
  1073
schirmer@12854
  1074
lemma ax_Call_Static: 
schirmer@12854
  1075
 "\<lbrakk>\<forall>a vs l. G,A\<turnstile>{R a\<leftarrow>Vals vs \<and>. (\<lambda>s. l = locals (store s)) ;.  
schirmer@12854
  1076
               init_lvars G C \<lparr>name=mn,parTs=pTs\<rparr> Static any_Addr vs}  
schirmer@12854
  1077
              Methd C \<lparr>name=mn,parTs=pTs\<rparr>-\<succ> {set_lvars l .; S}; 
schirmer@12854
  1078
  G,A\<turnstile>{Normal P} e-\<succ> {Q};
schirmer@12854
  1079
  \<forall> a. G,(A::'a triple set)\<turnstile>{Q\<leftarrow>Val a} args\<doteq>\<succ> {(R::val \<Rightarrow> 'a assn)  a 
schirmer@12854
  1080
  \<and>. (\<lambda> s. C=invocation_declclass 
schirmer@12854
  1081
                G Static (store s) a statT \<lparr>name=mn,parTs=pTs\<rparr>)}
schirmer@12925
  1082
\<rbrakk>  \<Longrightarrow>  G,A\<turnstile>{Normal P} {accC,statT,Static}e\<cdot>mn({pTs}args)-\<succ> {S}"
schirmer@12854
  1083
apply (erule ax_derivs.Call)
schirmer@12854
  1084
apply  safe
schirmer@12854
  1085
apply  (erule spec)
schirmer@12854
  1086
apply (rule ax_escape, clarsimp)
schirmer@12854
  1087
apply (erule_tac V = "?P \<longrightarrow> ?Q" in thin_rl)
schirmer@12854
  1088
apply (drule spec,drule spec,drule spec, erule conseq12)
schirmer@12854
  1089
apply (force simp add: init_lvars_def)
schirmer@12854
  1090
done
schirmer@12854
  1091
schirmer@12854
  1092
lemma ax_Methd1: 
schirmer@12854
  1093
 "\<lbrakk>G,A\<union>{{P} Methd-\<succ> {Q} | ms}|\<turnstile> {{P} body G-\<succ> {Q} | ms}; (C,sig)\<in> ms\<rbrakk> \<Longrightarrow> 
schirmer@12854
  1094
       G,A\<turnstile>{Normal (P C sig)} Methd C sig-\<succ> {Q C sig}"
schirmer@12854
  1095
apply (drule ax_derivs.Methd)
schirmer@12854
  1096
apply (unfold mtriples_def)
schirmer@12854
  1097
apply (erule (1) ax_methods_spec)
schirmer@12854
  1098
done
schirmer@12854
  1099
schirmer@12854
  1100
lemma ax_MethdN: 
schirmer@12854
  1101
"G,insert({Normal P} Methd  C sig-\<succ> {Q}) A\<turnstile> 
schirmer@12854
  1102
          {Normal P} body G C sig-\<succ> {Q} \<Longrightarrow>  
schirmer@12854
  1103
      G,A\<turnstile>{Normal P} Methd   C sig-\<succ> {Q}"
schirmer@12854
  1104
apply (rule ax_Methd1)
schirmer@12854
  1105
apply  (rule_tac [2] singletonI)
schirmer@12854
  1106
apply (unfold mtriples_def)
schirmer@12854
  1107
apply clarsimp
schirmer@12854
  1108
done
schirmer@12854
  1109
schirmer@12854
  1110
lemma ax_StatRef: 
schirmer@12854
  1111
  "G,(A::'a triple set)\<turnstile>{Normal (P\<leftarrow>Val Null)} StatRef rt-\<succ> {P::'a assn}"
schirmer@12854
  1112
apply (rule ax_derivs.Cast)
schirmer@12854
  1113
apply (rule ax_Lit2 [THEN conseq2])
schirmer@12854
  1114
apply clarsimp
schirmer@12854
  1115
done
schirmer@12854
  1116
schirmer@12854
  1117
section "rules derived from Init and Done"
schirmer@12854
  1118
schirmer@12854
  1119
  lemma ax_InitS: "\<lbrakk>the (class G C) = c; C \<noteq> Object;  
schirmer@12854
  1120
     \<forall>l. G,A\<turnstile>{Q \<and>. (\<lambda>s. l = locals (store s)) ;. set_lvars empty}  
schirmer@12854
  1121
            .init c. {set_lvars l .; R};   
schirmer@12854
  1122
         G,A\<turnstile>{Normal ((P \<and>. Not \<circ> initd C) ;. supd (init_class_obj G C))}  
schirmer@12854
  1123
  .Init (super c). {Q}\<rbrakk> \<Longrightarrow>  
schirmer@12854
  1124
  G,(A::'a triple set)\<turnstile>{Normal (P \<and>. Not \<circ> initd C)} .Init C. {R::'a assn}"
schirmer@12854
  1125
apply (erule ax_derivs.Init)
schirmer@12854
  1126
apply  (simp (no_asm_simp))
schirmer@12854
  1127
apply assumption
schirmer@12854
  1128
done
schirmer@12854
  1129
schirmer@12854
  1130
lemma ax_Init_Skip_lemma: 
schirmer@12854
  1131
"\<forall>l. G,(A::'a triple set)\<turnstile>{P\<leftarrow>\<diamondsuit> \<and>. (\<lambda>s. l = locals (store s)) ;. set_lvars l'}
schirmer@12854
  1132
  .Skip. {(set_lvars l .; P)::'a assn}"
schirmer@12854
  1133
apply (rule allI)
schirmer@12854
  1134
apply (rule ax_SkipI)
schirmer@12854
  1135
apply clarsimp
schirmer@12854
  1136
done
schirmer@12854
  1137
schirmer@12854
  1138
lemma ax_triv_InitS: "\<lbrakk>the (class G C) = c;init c = Skip; C \<noteq> Object; 
schirmer@12854
  1139
       P\<leftarrow>\<diamondsuit> \<Rightarrow> (supd (init_class_obj G C) .; P);  
schirmer@12854
  1140
       G,A\<turnstile>{Normal (P \<and>. initd C)} .Init (super c). {(P \<and>. initd C)\<leftarrow>\<diamondsuit>}\<rbrakk> \<Longrightarrow>  
schirmer@12854
  1141
       G,(A::'a triple set)\<turnstile>{Normal P\<leftarrow>\<diamondsuit>} .Init C. {(P \<and>. initd C)::'a assn}"
schirmer@12854
  1142
apply (rule_tac C = "initd C" in ax_cases)
schirmer@12854
  1143
apply  (rule conseq1, rule ax_derivs.Done, clarsimp)
schirmer@12854
  1144
apply (simp (no_asm))
schirmer@12854
  1145
apply (erule (1) ax_InitS)
schirmer@12854
  1146
apply  simp
schirmer@12854
  1147
apply  (rule ax_Init_Skip_lemma)
schirmer@12854
  1148
apply (erule conseq1)
schirmer@12854
  1149
apply force
schirmer@12854
  1150
done
schirmer@12854
  1151
schirmer@12854
  1152
lemma ax_Init_Object: "wf_prog G \<Longrightarrow> G,(A::'a triple set)\<turnstile>
schirmer@12854
  1153
  {Normal ((supd (init_class_obj G Object) .; P\<leftarrow>\<diamondsuit>) \<and>. Not \<circ> initd Object)} 
schirmer@12854
  1154
       .Init Object. {(P \<and>. initd Object)::'a assn}"
schirmer@12854
  1155
apply (rule ax_derivs.Init)
schirmer@12854
  1156
apply   (drule class_Object, force)
schirmer@12854
  1157
apply (simp_all (no_asm))
schirmer@12854
  1158
apply (rule_tac [2] ax_Init_Skip_lemma)
schirmer@12854
  1159
apply (rule ax_SkipI, force)
schirmer@12854
  1160
done
schirmer@12854
  1161
schirmer@12854
  1162
lemma ax_triv_Init_Object: "\<lbrakk>wf_prog G;  
schirmer@12854
  1163
       (P::'a assn) \<Rightarrow> (supd (init_class_obj G Object) .; P)\<rbrakk> \<Longrightarrow>  
schirmer@12854
  1164
  G,(A::'a triple set)\<turnstile>{Normal P\<leftarrow>\<diamondsuit>} .Init Object. {P \<and>. initd Object}"
schirmer@12854
  1165
apply (rule_tac C = "initd Object" in ax_cases)
schirmer@12854
  1166
apply  (rule conseq1, rule ax_derivs.Done, clarsimp)
schirmer@12854
  1167
apply (erule ax_Init_Object [THEN conseq1])
schirmer@12854
  1168
apply force
schirmer@12854
  1169
done
schirmer@12854
  1170
schirmer@12854
  1171
schirmer@12854
  1172
section "introduction rules for Alloc and SXAlloc"
schirmer@12854
  1173
schirmer@12854
  1174
lemma ax_SXAlloc_Normal: "G,A\<turnstile>{P} .c. {Normal Q} \<Longrightarrow> G,A\<turnstile>{P} .c. {SXAlloc G Q}"
schirmer@12854
  1175
apply (erule conseq2)
schirmer@12854
  1176
apply (clarsimp elim!: sxalloc_elim_cases simp add: split_tupled_all)
schirmer@12854
  1177
done
schirmer@12854
  1178
schirmer@12854
  1179
lemma ax_Alloc: 
schirmer@12854
  1180
  "G,A\<turnstile>{P} t\<succ> {Normal (\<lambda>Y (x,s) Z. (\<forall>a. new_Addr (heap s) = Some a \<longrightarrow>  
schirmer@12854
  1181
 Q (Val (Addr a)) (Norm(init_obj G (CInst C) (Heap a) s)) Z)) \<and>. 
schirmer@12854
  1182
    heap_free (Suc (Suc 0))}
schirmer@12854
  1183
   \<Longrightarrow> G,A\<turnstile>{P} t\<succ> {Alloc G (CInst C) Q}"
schirmer@12854
  1184
apply (erule conseq2)
schirmer@12854
  1185
apply (auto elim!: halloc_elim_cases)
schirmer@12854
  1186
done
schirmer@12854
  1187
schirmer@12854
  1188
lemma ax_Alloc_Arr: 
schirmer@12854
  1189
 "G,A\<turnstile>{P} t\<succ> {\<lambda>Val:i:. Normal (\<lambda>Y (x,s) Z. \<not>the_Intg i<0 \<and>  
schirmer@12854
  1190
  (\<forall>a. new_Addr (heap s) = Some a \<longrightarrow>  
schirmer@12854
  1191
  Q (Val (Addr a)) (Norm (init_obj G (Arr T (the_Intg i)) (Heap a) s)) Z)) \<and>. 
schirmer@12854
  1192
   heap_free (Suc (Suc 0))} \<Longrightarrow>  
schirmer@12854
  1193
 G,A\<turnstile>{P} t\<succ> {\<lambda>Val:i:. abupd (check_neg i) .; Alloc G (Arr T(the_Intg i)) Q}"
schirmer@12854
  1194
apply (erule conseq2)
schirmer@12854
  1195
apply (auto elim!: halloc_elim_cases)
schirmer@12854
  1196
done
schirmer@12854
  1197
schirmer@12854
  1198
lemma ax_SXAlloc_catch_SXcpt: 
schirmer@12854
  1199
 "\<lbrakk>G,A\<turnstile>{P} t\<succ> {(\<lambda>Y (x,s) Z. x=Some (Xcpt (Std xn)) \<and>  
schirmer@12854
  1200
  (\<forall>a. new_Addr (heap s) = Some a \<longrightarrow>  
schirmer@12854
  1201
  Q Y (Some (Xcpt (Loc a)),init_obj G (CInst (SXcpt xn)) (Heap a) s) Z))  
schirmer@12854
  1202
  \<and>. heap_free (Suc (Suc 0))}\<rbrakk> \<Longrightarrow>  
schirmer@12854
  1203
  G,A\<turnstile>{P} t\<succ> {SXAlloc G (\<lambda>Y s Z. Q Y s Z \<and> G,s\<turnstile>catch SXcpt xn)}"
schirmer@12854
  1204
apply (erule conseq2)
schirmer@12854
  1205
apply (auto elim!: sxalloc_elim_cases halloc_elim_cases)
schirmer@12854
  1206
done
schirmer@12854
  1207
schirmer@12854
  1208
end