src/HOL/UNITY/Union.thy
author wenzelm
Fri Jun 26 11:07:04 2015 +0200 (2015-06-26)
changeset 60586 1d31e3a50373
parent 58889 5b7a9633cfa8
child 60773 d09c66a0ea10
permissions -rw-r--r--
proper spacing, as for other syntax for these symbols;
     1 (*  Title:      HOL/UNITY/Union.thy
     2     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
     3     Copyright   1998  University of Cambridge
     4 
     5 Partly from Misra's Chapter 5: Asynchronous Compositions of Programs.
     6 *)
     7 
     8 section{*Unions of Programs*}
     9 
    10 theory Union imports SubstAx FP begin
    11 
    12   (*FIXME: conjoin Init F \<inter> Init G \<noteq> {} *) 
    13 definition
    14   ok :: "['a program, 'a program] => bool"      (infixl "ok" 65)
    15   where "F ok G == Acts F \<subseteq> AllowedActs G &
    16                Acts G \<subseteq> AllowedActs F"
    17 
    18   (*FIXME: conjoin (\<Inter>i \<in> I. Init (F i)) \<noteq> {} *) 
    19 definition
    20   OK  :: "['a set, 'a => 'b program] => bool"
    21   where "OK I F = (\<forall>i \<in> I. \<forall>j \<in> I-{i}. Acts (F i) \<subseteq> AllowedActs (F j))"
    22 
    23 definition
    24   JOIN  :: "['a set, 'a => 'b program] => 'b program"
    25   where "JOIN I F = mk_program (\<Inter>i \<in> I. Init (F i), \<Union>i \<in> I. Acts (F i),
    26                              \<Inter>i \<in> I. AllowedActs (F i))"
    27 
    28 definition
    29   Join :: "['a program, 'a program] => 'a program"      (infixl "Join" 65)
    30   where "F Join G = mk_program (Init F \<inter> Init G, Acts F \<union> Acts G,
    31                              AllowedActs F \<inter> AllowedActs G)"
    32 
    33 definition
    34   SKIP :: "'a program"
    35   where "SKIP = mk_program (UNIV, {}, UNIV)"
    36 
    37   (*Characterizes safety properties.  Used with specifying Allowed*)
    38 definition
    39   safety_prop :: "'a program set => bool"
    40   where "safety_prop X <-> SKIP: X & (\<forall>G. Acts G \<subseteq> UNION X Acts --> G \<in> X)"
    41 
    42 notation (xsymbols)
    43   SKIP  ("\<bottom>") and
    44   Join  (infixl "\<squnion>" 65)
    45 
    46 syntax
    47   "_JOIN1"     :: "[pttrns, 'b set] => 'b set"         ("(3JN _./ _)" 10)
    48   "_JOIN"      :: "[pttrn, 'a set, 'b set] => 'b set"  ("(3JN _:_./ _)" 10)
    49 syntax (xsymbols)
    50   "_JOIN1" :: "[pttrns, 'b set] => 'b set"              ("(3\<Squnion>_./ _)" 10)
    51   "_JOIN"  :: "[pttrn, 'a set, 'b set] => 'b set"       ("(3\<Squnion>_\<in>_./ _)" 10)
    52 
    53 translations
    54   "JN x: A. B" == "CONST JOIN A (%x. B)"
    55   "JN x y. B" == "JN x. JN y. B"
    56   "JN x. B" == "CONST JOIN (CONST UNIV) (%x. B)"
    57 
    58 
    59 subsection{*SKIP*}
    60 
    61 lemma Init_SKIP [simp]: "Init SKIP = UNIV"
    62 by (simp add: SKIP_def)
    63 
    64 lemma Acts_SKIP [simp]: "Acts SKIP = {Id}"
    65 by (simp add: SKIP_def)
    66 
    67 lemma AllowedActs_SKIP [simp]: "AllowedActs SKIP = UNIV"
    68 by (auto simp add: SKIP_def)
    69 
    70 lemma reachable_SKIP [simp]: "reachable SKIP = UNIV"
    71 by (force elim: reachable.induct intro: reachable.intros)
    72 
    73 subsection{*SKIP and safety properties*}
    74 
    75 lemma SKIP_in_constrains_iff [iff]: "(SKIP \<in> A co B) = (A \<subseteq> B)"
    76 by (unfold constrains_def, auto)
    77 
    78 lemma SKIP_in_Constrains_iff [iff]: "(SKIP \<in> A Co B) = (A \<subseteq> B)"
    79 by (unfold Constrains_def, auto)
    80 
    81 lemma SKIP_in_stable [iff]: "SKIP \<in> stable A"
    82 by (unfold stable_def, auto)
    83 
    84 declare SKIP_in_stable [THEN stable_imp_Stable, iff]
    85 
    86 
    87 subsection{*Join*}
    88 
    89 lemma Init_Join [simp]: "Init (F\<squnion>G) = Init F \<inter> Init G"
    90 by (simp add: Join_def)
    91 
    92 lemma Acts_Join [simp]: "Acts (F\<squnion>G) = Acts F \<union> Acts G"
    93 by (auto simp add: Join_def)
    94 
    95 lemma AllowedActs_Join [simp]:
    96      "AllowedActs (F\<squnion>G) = AllowedActs F \<inter> AllowedActs G"
    97 by (auto simp add: Join_def)
    98 
    99 
   100 subsection{*JN*}
   101 
   102 lemma JN_empty [simp]: "(\<Squnion>i\<in>{}. F i) = SKIP"
   103 by (unfold JOIN_def SKIP_def, auto)
   104 
   105 lemma JN_insert [simp]: "(\<Squnion>i \<in> insert a I. F i) = (F a)\<squnion>(\<Squnion>i \<in> I. F i)"
   106 apply (rule program_equalityI)
   107 apply (auto simp add: JOIN_def Join_def)
   108 done
   109 
   110 lemma Init_JN [simp]: "Init (\<Squnion>i \<in> I. F i) = (\<Inter>i \<in> I. Init (F i))"
   111 by (simp add: JOIN_def)
   112 
   113 lemma Acts_JN [simp]: "Acts (\<Squnion>i \<in> I. F i) = insert Id (\<Union>i \<in> I. Acts (F i))"
   114 by (auto simp add: JOIN_def)
   115 
   116 lemma AllowedActs_JN [simp]:
   117      "AllowedActs (\<Squnion>i \<in> I. F i) = (\<Inter>i \<in> I. AllowedActs (F i))"
   118 by (auto simp add: JOIN_def)
   119 
   120 
   121 lemma JN_cong [cong]: 
   122     "[| I=J;  !!i. i \<in> J ==> F i = G i |] ==> (\<Squnion>i \<in> I. F i) = (\<Squnion>i \<in> J. G i)"
   123 by (simp add: JOIN_def)
   124 
   125 
   126 subsection{*Algebraic laws*}
   127 
   128 lemma Join_commute: "F\<squnion>G = G\<squnion>F"
   129 by (simp add: Join_def Un_commute Int_commute)
   130 
   131 lemma Join_assoc: "(F\<squnion>G)\<squnion>H = F\<squnion>(G\<squnion>H)"
   132 by (simp add: Un_ac Join_def Int_assoc insert_absorb)
   133  
   134 lemma Join_left_commute: "A\<squnion>(B\<squnion>C) = B\<squnion>(A\<squnion>C)"
   135 by (simp add: Un_ac Int_ac Join_def insert_absorb)
   136 
   137 lemma Join_SKIP_left [simp]: "SKIP\<squnion>F = F"
   138 apply (unfold Join_def SKIP_def)
   139 apply (rule program_equalityI)
   140 apply (simp_all (no_asm) add: insert_absorb)
   141 done
   142 
   143 lemma Join_SKIP_right [simp]: "F\<squnion>SKIP = F"
   144 apply (unfold Join_def SKIP_def)
   145 apply (rule program_equalityI)
   146 apply (simp_all (no_asm) add: insert_absorb)
   147 done
   148 
   149 lemma Join_absorb [simp]: "F\<squnion>F = F"
   150 apply (unfold Join_def)
   151 apply (rule program_equalityI, auto)
   152 done
   153 
   154 lemma Join_left_absorb: "F\<squnion>(F\<squnion>G) = F\<squnion>G"
   155 apply (unfold Join_def)
   156 apply (rule program_equalityI, auto)
   157 done
   158 
   159 (*Join is an AC-operator*)
   160 lemmas Join_ac = Join_assoc Join_left_absorb Join_commute Join_left_commute
   161 
   162 
   163 subsection{*Laws Governing @{text "\<Squnion>"}*}
   164 
   165 (*Also follows by JN_insert and insert_absorb, but the proof is longer*)
   166 lemma JN_absorb: "k \<in> I ==> F k\<squnion>(\<Squnion>i \<in> I. F i) = (\<Squnion>i \<in> I. F i)"
   167 by (auto intro!: program_equalityI)
   168 
   169 lemma JN_Un: "(\<Squnion>i \<in> I \<union> J. F i) = ((\<Squnion>i \<in> I. F i)\<squnion>(\<Squnion>i \<in> J. F i))"
   170 by (auto intro!: program_equalityI)
   171 
   172 lemma JN_constant: "(\<Squnion>i \<in> I. c) = (if I={} then SKIP else c)"
   173 by (rule program_equalityI, auto)
   174 
   175 lemma JN_Join_distrib:
   176      "(\<Squnion>i \<in> I. F i\<squnion>G i) = (\<Squnion>i \<in> I. F i) \<squnion> (\<Squnion>i \<in> I. G i)"
   177 by (auto intro!: program_equalityI)
   178 
   179 lemma JN_Join_miniscope:
   180      "i \<in> I ==> (\<Squnion>i \<in> I. F i\<squnion>G) = ((\<Squnion>i \<in> I. F i)\<squnion>G)"
   181 by (auto simp add: JN_Join_distrib JN_constant)
   182 
   183 (*Used to prove guarantees_JN_I*)
   184 lemma JN_Join_diff: "i \<in> I ==> F i\<squnion>JOIN (I - {i}) F = JOIN I F"
   185 apply (unfold JOIN_def Join_def)
   186 apply (rule program_equalityI, auto)
   187 done
   188 
   189 
   190 subsection{*Safety: co, stable, FP*}
   191 
   192 (*Fails if I={} because it collapses to SKIP \<in> A co B, i.e. to A \<subseteq> B.  So an
   193   alternative precondition is A \<subseteq> B, but most proofs using this rule require
   194   I to be nonempty for other reasons anyway.*)
   195 lemma JN_constrains: 
   196     "i \<in> I ==> (\<Squnion>i \<in> I. F i) \<in> A co B = (\<forall>i \<in> I. F i \<in> A co B)"
   197 by (simp add: constrains_def JOIN_def, blast)
   198 
   199 lemma Join_constrains [simp]:
   200      "(F\<squnion>G \<in> A co B) = (F \<in> A co B & G \<in> A co B)"
   201 by (auto simp add: constrains_def Join_def)
   202 
   203 lemma Join_unless [simp]:
   204      "(F\<squnion>G \<in> A unless B) = (F \<in> A unless B & G \<in> A unless B)"
   205 by (simp add: unless_def)
   206 
   207 (*Analogous weak versions FAIL; see Misra [1994] 5.4.1, Substitution Axiom.
   208   reachable (F\<squnion>G) could be much bigger than reachable F, reachable G
   209 *)
   210 
   211 
   212 lemma Join_constrains_weaken:
   213      "[| F \<in> A co A';  G \<in> B co B' |]  
   214       ==> F\<squnion>G \<in> (A \<inter> B) co (A' \<union> B')"
   215 by (simp, blast intro: constrains_weaken)
   216 
   217 (*If I={}, it degenerates to SKIP \<in> UNIV co {}, which is false.*)
   218 lemma JN_constrains_weaken:
   219      "[| \<forall>i \<in> I. F i \<in> A i co A' i;  i \<in> I |]  
   220       ==> (\<Squnion>i \<in> I. F i) \<in> (\<Inter>i \<in> I. A i) co (\<Union>i \<in> I. A' i)"
   221 apply (simp (no_asm_simp) add: JN_constrains)
   222 apply (blast intro: constrains_weaken)
   223 done
   224 
   225 lemma JN_stable: "(\<Squnion>i \<in> I. F i) \<in> stable A = (\<forall>i \<in> I. F i \<in> stable A)"
   226 by (simp add: stable_def constrains_def JOIN_def)
   227 
   228 lemma invariant_JN_I:
   229      "[| !!i. i \<in> I ==> F i \<in> invariant A;  i \<in> I |]   
   230        ==> (\<Squnion>i \<in> I. F i) \<in> invariant A"
   231 by (simp add: invariant_def JN_stable, blast)
   232 
   233 lemma Join_stable [simp]:
   234      "(F\<squnion>G \<in> stable A) =  
   235       (F \<in> stable A & G \<in> stable A)"
   236 by (simp add: stable_def)
   237 
   238 lemma Join_increasing [simp]:
   239      "(F\<squnion>G \<in> increasing f) =  
   240       (F \<in> increasing f & G \<in> increasing f)"
   241 by (auto simp add: increasing_def)
   242 
   243 lemma invariant_JoinI:
   244      "[| F \<in> invariant A; G \<in> invariant A |]   
   245       ==> F\<squnion>G \<in> invariant A"
   246 by (auto simp add: invariant_def)
   247 
   248 lemma FP_JN: "FP (\<Squnion>i \<in> I. F i) = (\<Inter>i \<in> I. FP (F i))"
   249 by (simp add: FP_def JN_stable INTER_eq)
   250 
   251 
   252 subsection{*Progress: transient, ensures*}
   253 
   254 lemma JN_transient:
   255      "i \<in> I ==>  
   256     (\<Squnion>i \<in> I. F i) \<in> transient A = (\<exists>i \<in> I. F i \<in> transient A)"
   257 by (auto simp add: transient_def JOIN_def)
   258 
   259 lemma Join_transient [simp]:
   260      "F\<squnion>G \<in> transient A =  
   261       (F \<in> transient A | G \<in> transient A)"
   262 by (auto simp add: bex_Un transient_def Join_def)
   263 
   264 lemma Join_transient_I1: "F \<in> transient A ==> F\<squnion>G \<in> transient A"
   265 by simp
   266 
   267 lemma Join_transient_I2: "G \<in> transient A ==> F\<squnion>G \<in> transient A"
   268 by simp
   269 
   270 (*If I={} it degenerates to (SKIP \<in> A ensures B) = False, i.e. to ~(A \<subseteq> B) *)
   271 lemma JN_ensures:
   272      "i \<in> I ==>  
   273       (\<Squnion>i \<in> I. F i) \<in> A ensures B =  
   274       ((\<forall>i \<in> I. F i \<in> (A-B) co (A \<union> B)) & (\<exists>i \<in> I. F i \<in> A ensures B))"
   275 by (auto simp add: ensures_def JN_constrains JN_transient)
   276 
   277 lemma Join_ensures: 
   278      "F\<squnion>G \<in> A ensures B =      
   279       (F \<in> (A-B) co (A \<union> B) & G \<in> (A-B) co (A \<union> B) &  
   280        (F \<in> transient (A-B) | G \<in> transient (A-B)))"
   281 by (auto simp add: ensures_def)
   282 
   283 lemma stable_Join_constrains: 
   284     "[| F \<in> stable A;  G \<in> A co A' |]  
   285      ==> F\<squnion>G \<in> A co A'"
   286 apply (unfold stable_def constrains_def Join_def)
   287 apply (simp add: ball_Un, blast)
   288 done
   289 
   290 (*Premise for G cannot use Always because  F \<in> Stable A  is weaker than
   291   G \<in> stable A *)
   292 lemma stable_Join_Always1:
   293      "[| F \<in> stable A;  G \<in> invariant A |] ==> F\<squnion>G \<in> Always A"
   294 apply (simp (no_asm_use) add: Always_def invariant_def Stable_eq_stable)
   295 apply (force intro: stable_Int)
   296 done
   297 
   298 (*As above, but exchanging the roles of F and G*)
   299 lemma stable_Join_Always2:
   300      "[| F \<in> invariant A;  G \<in> stable A |] ==> F\<squnion>G \<in> Always A"
   301 apply (subst Join_commute)
   302 apply (blast intro: stable_Join_Always1)
   303 done
   304 
   305 lemma stable_Join_ensures1:
   306      "[| F \<in> stable A;  G \<in> A ensures B |] ==> F\<squnion>G \<in> A ensures B"
   307 apply (simp (no_asm_simp) add: Join_ensures)
   308 apply (simp add: stable_def ensures_def)
   309 apply (erule constrains_weaken, auto)
   310 done
   311 
   312 (*As above, but exchanging the roles of F and G*)
   313 lemma stable_Join_ensures2:
   314      "[| F \<in> A ensures B;  G \<in> stable A |] ==> F\<squnion>G \<in> A ensures B"
   315 apply (subst Join_commute)
   316 apply (blast intro: stable_Join_ensures1)
   317 done
   318 
   319 
   320 subsection{*the ok and OK relations*}
   321 
   322 lemma ok_SKIP1 [iff]: "SKIP ok F"
   323 by (simp add: ok_def)
   324 
   325 lemma ok_SKIP2 [iff]: "F ok SKIP"
   326 by (simp add: ok_def)
   327 
   328 lemma ok_Join_commute:
   329      "(F ok G & (F\<squnion>G) ok H) = (G ok H & F ok (G\<squnion>H))"
   330 by (auto simp add: ok_def)
   331 
   332 lemma ok_commute: "(F ok G) = (G ok F)"
   333 by (auto simp add: ok_def)
   334 
   335 lemmas ok_sym = ok_commute [THEN iffD1]
   336 
   337 lemma ok_iff_OK:
   338      "OK {(0::int,F),(1,G),(2,H)} snd = (F ok G & (F\<squnion>G) ok H)"
   339 apply (simp add: Ball_def conj_disj_distribR ok_def Join_def OK_def insert_absorb
   340               all_conj_distrib)
   341 apply blast
   342 done
   343 
   344 lemma ok_Join_iff1 [iff]: "F ok (G\<squnion>H) = (F ok G & F ok H)"
   345 by (auto simp add: ok_def)
   346 
   347 lemma ok_Join_iff2 [iff]: "(G\<squnion>H) ok F = (G ok F & H ok F)"
   348 by (auto simp add: ok_def)
   349 
   350 (*useful?  Not with the previous two around*)
   351 lemma ok_Join_commute_I: "[| F ok G; (F\<squnion>G) ok H |] ==> F ok (G\<squnion>H)"
   352 by (auto simp add: ok_def)
   353 
   354 lemma ok_JN_iff1 [iff]: "F ok (JOIN I G) = (\<forall>i \<in> I. F ok G i)"
   355 by (auto simp add: ok_def)
   356 
   357 lemma ok_JN_iff2 [iff]: "(JOIN I G) ok F =  (\<forall>i \<in> I. G i ok F)"
   358 by (auto simp add: ok_def)
   359 
   360 lemma OK_iff_ok: "OK I F = (\<forall>i \<in> I. \<forall>j \<in> I-{i}. (F i) ok (F j))"
   361 by (auto simp add: ok_def OK_def)
   362 
   363 lemma OK_imp_ok: "[| OK I F; i \<in> I; j \<in> I; i \<noteq> j|] ==> (F i) ok (F j)"
   364 by (auto simp add: OK_iff_ok)
   365 
   366 
   367 subsection{*Allowed*}
   368 
   369 lemma Allowed_SKIP [simp]: "Allowed SKIP = UNIV"
   370 by (auto simp add: Allowed_def)
   371 
   372 lemma Allowed_Join [simp]: "Allowed (F\<squnion>G) = Allowed F \<inter> Allowed G"
   373 by (auto simp add: Allowed_def)
   374 
   375 lemma Allowed_JN [simp]: "Allowed (JOIN I F) = (\<Inter>i \<in> I. Allowed (F i))"
   376 by (auto simp add: Allowed_def)
   377 
   378 lemma ok_iff_Allowed: "F ok G = (F \<in> Allowed G & G \<in> Allowed F)"
   379 by (simp add: ok_def Allowed_def)
   380 
   381 lemma OK_iff_Allowed: "OK I F = (\<forall>i \<in> I. \<forall>j \<in> I-{i}. F i \<in> Allowed(F j))"
   382 by (auto simp add: OK_iff_ok ok_iff_Allowed)
   383 
   384 subsection{*@{term safety_prop}, for reasoning about
   385  given instances of "ok"*}
   386 
   387 lemma safety_prop_Acts_iff:
   388      "safety_prop X ==> (Acts G \<subseteq> insert Id (UNION X Acts)) = (G \<in> X)"
   389 by (auto simp add: safety_prop_def)
   390 
   391 lemma safety_prop_AllowedActs_iff_Allowed:
   392      "safety_prop X ==> (UNION X Acts \<subseteq> AllowedActs F) = (X \<subseteq> Allowed F)"
   393 by (auto simp add: Allowed_def safety_prop_Acts_iff [symmetric])
   394 
   395 lemma Allowed_eq:
   396      "safety_prop X ==> Allowed (mk_program (init, acts, UNION X Acts)) = X"
   397 by (simp add: Allowed_def safety_prop_Acts_iff)
   398 
   399 (*For safety_prop to hold, the property must be satisfiable!*)
   400 lemma safety_prop_constrains [iff]: "safety_prop (A co B) = (A \<subseteq> B)"
   401 by (simp add: safety_prop_def constrains_def, blast)
   402 
   403 lemma safety_prop_stable [iff]: "safety_prop (stable A)"
   404 by (simp add: stable_def)
   405 
   406 lemma safety_prop_Int [simp]:
   407   "safety_prop X \<Longrightarrow> safety_prop Y \<Longrightarrow> safety_prop (X \<inter> Y)"
   408   by (simp add: safety_prop_def) blast
   409 
   410 lemma safety_prop_INTER [simp]:
   411   "(\<And>i. i \<in> I \<Longrightarrow> safety_prop (X i)) \<Longrightarrow> safety_prop (\<Inter>i\<in>I. X i)"
   412   by (simp add: safety_prop_def) blast
   413 
   414 lemma safety_prop_INTER1 [simp]:
   415   "(\<And>i. safety_prop (X i)) \<Longrightarrow> safety_prop (\<Inter>i. X i)"
   416   by (rule safety_prop_INTER) simp
   417 
   418 lemma def_prg_Allowed:
   419      "[| F == mk_program (init, acts, UNION X Acts) ; safety_prop X |]  
   420       ==> Allowed F = X"
   421 by (simp add: Allowed_eq)
   422 
   423 lemma Allowed_totalize [simp]: "Allowed (totalize F) = Allowed F"
   424 by (simp add: Allowed_def) 
   425 
   426 lemma def_total_prg_Allowed:
   427      "[| F = mk_total_program (init, acts, UNION X Acts) ; safety_prop X |]  
   428       ==> Allowed F = X"
   429 by (simp add: mk_total_program_def def_prg_Allowed) 
   430 
   431 lemma def_UNION_ok_iff:
   432      "[| F = mk_program(init,acts,UNION X Acts); safety_prop X |]  
   433       ==> F ok G = (G \<in> X & acts \<subseteq> AllowedActs G)"
   434 by (auto simp add: ok_def safety_prop_Acts_iff)
   435 
   436 text{*The union of two total programs is total.*}
   437 lemma totalize_Join: "totalize F\<squnion>totalize G = totalize (F\<squnion>G)"
   438 by (simp add: program_equalityI totalize_def Join_def image_Un)
   439 
   440 lemma all_total_Join: "[|all_total F; all_total G|] ==> all_total (F\<squnion>G)"
   441 by (simp add: all_total_def, blast)
   442 
   443 lemma totalize_JN: "(\<Squnion>i \<in> I. totalize (F i)) = totalize(\<Squnion>i \<in> I. F i)"
   444 by (simp add: program_equalityI totalize_def JOIN_def image_UN)
   445 
   446 lemma all_total_JN: "(!!i. i\<in>I ==> all_total (F i)) ==> all_total(\<Squnion>i\<in>I. F i)"
   447 by (simp add: all_total_iff_totalize totalize_JN [symmetric])
   448 
   449 end