added Imperative_HOL examples; added tail-recursive combinator for monadic heap functions; adopted code generation of references; added lemmas
authorbulwahn
Thu Dec 10 11:58:26 2009 +0100 (2009-12-10)
changeset 340511a82e2e29d67
parent 34050 3d2acb18f2f2
child 34052 b2e6245fb3da
added Imperative_HOL examples; added tail-recursive combinator for monadic heap functions; adopted code generation of references; added lemmas
src/HOL/Imperative_HOL/Heap.thy
src/HOL/Imperative_HOL/Heap_Monad.thy
src/HOL/Imperative_HOL/Imperative_HOL_ex.thy
src/HOL/Imperative_HOL/Ref.thy
src/HOL/Imperative_HOL/ex/Imperative_Reverse.thy
src/HOL/Imperative_HOL/ex/Linked_Lists.thy
     1.1 --- a/src/HOL/Imperative_HOL/Heap.thy	Wed Dec 09 21:33:50 2009 +0100
     1.2 +++ b/src/HOL/Imperative_HOL/Heap.thy	Thu Dec 10 11:58:26 2009 +0100
     1.3 @@ -365,6 +365,10 @@
     1.4    "ref_present r (set_ref r' v h) = ref_present r h"
     1.5    by (simp add: set_ref_def ref_present_def)
     1.6  
     1.7 +lemma noteq_refsI: "\<lbrakk> ref_present r h; \<not>ref_present r' h \<rbrakk>  \<Longrightarrow> r =!= r'"
     1.8 +  unfolding noteq_refs_def ref_present_def
     1.9 +  by auto
    1.10 +
    1.11  lemma array_ranI: "\<lbrakk> Some b = get_array a h ! i; i < Heap.length a h \<rbrakk> \<Longrightarrow> b \<in> array_ran a h"
    1.12  unfolding array_ran_def Heap.length_def by simp
    1.13  
     2.1 --- a/src/HOL/Imperative_HOL/Heap_Monad.thy	Wed Dec 09 21:33:50 2009 +0100
     2.2 +++ b/src/HOL/Imperative_HOL/Heap_Monad.thy	Thu Dec 10 11:58:26 2009 +0100
     2.3 @@ -266,6 +266,81 @@
     2.4    shows "(assert P x >>= f) = (assert P' x >>= f')"
     2.5    using assms by (auto simp add: assert_def return_bind raise_bind)
     2.6  
     2.7 +subsubsection {* A monadic combinator for simple recursive functions *}
     2.8 + 
     2.9 +function (default "\<lambda>(f,g,x,h). (Inr Exn, undefined)") 
    2.10 +  mrec 
    2.11 +where
    2.12 +  "mrec f g x h = 
    2.13 +   (case Heap_Monad.execute (f x) h of
    2.14 +     (Inl (Inl r), h') \<Rightarrow> (Inl r, h')
    2.15 +   | (Inl (Inr s), h') \<Rightarrow> 
    2.16 +          (case mrec f g s h' of
    2.17 +             (Inl z, h'') \<Rightarrow> Heap_Monad.execute (g x s z) h''
    2.18 +           | (Inr e, h'') \<Rightarrow> (Inr e, h''))
    2.19 +   | (Inr e, h') \<Rightarrow> (Inr e, h')
    2.20 +   )"
    2.21 +by auto
    2.22 +
    2.23 +lemma graph_implies_dom:
    2.24 +	"mrec_graph x y \<Longrightarrow> mrec_dom x"
    2.25 +apply (induct rule:mrec_graph.induct) 
    2.26 +apply (rule accpI)
    2.27 +apply (erule mrec_rel.cases)
    2.28 +by simp
    2.29 +
    2.30 +lemma f_default: "\<not> mrec_dom (f, g, x, h) \<Longrightarrow> mrec f g x h = (Inr Exn, undefined)"
    2.31 +	unfolding mrec_def 
    2.32 +  by (rule fundef_default_value[OF mrec_sumC_def graph_implies_dom, of _ _ "(f, g, x, h)", simplified])
    2.33 +
    2.34 +lemma f_di_reverse: 
    2.35 +  assumes "\<not> mrec_dom (f, g, x, h)"
    2.36 +  shows "
    2.37 +   (case Heap_Monad.execute (f x) h of
    2.38 +     (Inl (Inl r), h') \<Rightarrow> mrecalse
    2.39 +   | (Inl (Inr s), h') \<Rightarrow> \<not> mrec_dom (f, g, s, h')
    2.40 +   | (Inr e, h') \<Rightarrow> mrecalse
    2.41 +   )" 
    2.42 +using assms
    2.43 +by (auto split:prod.splits sum.splits)
    2.44 + (erule notE, rule accpI, elim mrec_rel.cases, simp)+
    2.45 +
    2.46 +
    2.47 +lemma mrec_rule:
    2.48 +  "mrec f g x h = 
    2.49 +   (case Heap_Monad.execute (f x) h of
    2.50 +     (Inl (Inl r), h') \<Rightarrow> (Inl r, h')
    2.51 +   | (Inl (Inr s), h') \<Rightarrow> 
    2.52 +          (case mrec f g s h' of
    2.53 +             (Inl z, h'') \<Rightarrow> Heap_Monad.execute (g x s z) h''
    2.54 +           | (Inr e, h'') \<Rightarrow> (Inr e, h''))
    2.55 +   | (Inr e, h') \<Rightarrow> (Inr e, h')
    2.56 +   )"
    2.57 +apply (cases "mrec_dom (f,g,x,h)", simp)
    2.58 +apply (frule f_default)
    2.59 +apply (frule f_di_reverse, simp)
    2.60 +by (auto split: sum.split prod.split simp: f_default)
    2.61 +
    2.62 +
    2.63 +definition
    2.64 +  "MREC f g x = Heap (mrec f g x)"
    2.65 +
    2.66 +lemma MREC_rule:
    2.67 +  "MREC f g x = 
    2.68 +  (do y \<leftarrow> f x;
    2.69 +                (case y of 
    2.70 +                Inl r \<Rightarrow> return r
    2.71 +              | Inr s \<Rightarrow> 
    2.72 +                do z \<leftarrow> MREC f g s ;
    2.73 +                   g x s z
    2.74 +                done) done)"
    2.75 +  unfolding MREC_def
    2.76 +  unfolding bindM_def return_def
    2.77 +  apply simp
    2.78 +  apply (rule ext)
    2.79 +  apply (unfold mrec_rule[of f g x])
    2.80 +  by (auto split:prod.splits sum.splits)
    2.81 +
    2.82  hide (open) const heap execute
    2.83  
    2.84  
     3.1 --- a/src/HOL/Imperative_HOL/Imperative_HOL_ex.thy	Wed Dec 09 21:33:50 2009 +0100
     3.2 +++ b/src/HOL/Imperative_HOL/Imperative_HOL_ex.thy	Thu Dec 10 11:58:26 2009 +0100
     3.3 @@ -6,7 +6,7 @@
     3.4  header {* Monadic imperative HOL with examples *}
     3.5  
     3.6  theory Imperative_HOL_ex
     3.7 -imports Imperative_HOL "ex/Imperative_Quicksort"
     3.8 +imports Imperative_HOL "ex/Imperative_Quicksort" "ex/Imperative_Reverse" "ex/Linked_Lists"
     3.9  begin
    3.10  
    3.11  end
     4.1 --- a/src/HOL/Imperative_HOL/Ref.thy	Wed Dec 09 21:33:50 2009 +0100
     4.2 +++ b/src/HOL/Imperative_HOL/Ref.thy	Thu Dec 10 11:58:26 2009 +0100
     4.3 @@ -60,9 +60,9 @@
     4.4  
     4.5  subsubsection {* SML *}
     4.6  
     4.7 -code_type ref (SML "_/ ref")
     4.8 +code_type ref (SML "_/ Unsynchronized.ref")
     4.9  code_const Ref (SML "raise/ (Fail/ \"bare Ref\")")
    4.10 -code_const Ref.new (SML "(fn/ ()/ =>/ ref/ _)")
    4.11 +code_const Ref.new (SML "(fn/ ()/ =>/ Unsynchronized.ref/ _)")
    4.12  code_const Ref.lookup (SML "(fn/ ()/ =>/ !/ _)")
    4.13  code_const Ref.update (SML "(fn/ ()/ =>/ _/ :=/ _)")
    4.14  
     5.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     5.2 +++ b/src/HOL/Imperative_HOL/ex/Imperative_Reverse.thy	Thu Dec 10 11:58:26 2009 +0100
     5.3 @@ -0,0 +1,112 @@
     5.4 +theory Imperative_Reverse
     5.5 +imports "~~/src/HOL/Imperative_HOL/Imperative_HOL" Subarray
     5.6 +begin
     5.7 +
     5.8 +hide (open) const swap rev
     5.9 +
    5.10 +fun swap :: "'a\<Colon>heap array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> unit Heap" where
    5.11 +  "swap a i j = (do
    5.12 +     x \<leftarrow> nth a i;
    5.13 +     y \<leftarrow> nth a j;
    5.14 +     upd i y a;
    5.15 +     upd j x a;
    5.16 +     return ()
    5.17 +   done)"
    5.18 +
    5.19 +fun rev :: "'a\<Colon>heap array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> unit Heap" where
    5.20 +  "rev a i j = (if (i < j) then (do
    5.21 +     swap a i j;
    5.22 +     rev a (i + 1) (j - 1)
    5.23 +   done)
    5.24 +   else return ())"
    5.25 +
    5.26 +notation (output) swap ("swap")
    5.27 +notation (output) rev ("rev")
    5.28 +
    5.29 +declare swap.simps [simp del] rev.simps [simp del]
    5.30 +
    5.31 +lemma swap_pointwise: assumes "crel (swap a i j) h h' r"
    5.32 +  shows "get_array a h' ! k = (if k = i then get_array a h ! j
    5.33 +      else if k = j then get_array a h ! i
    5.34 +      else get_array a h ! k)"
    5.35 +using assms unfolding swap.simps
    5.36 +by (elim crel_elim_all)
    5.37 + (auto simp: Heap.length_def)
    5.38 +
    5.39 +lemma rev_pointwise: assumes "crel (rev a i j) h h' r"
    5.40 +  shows "get_array a h' ! k = (if k < i then get_array a h ! k
    5.41 +      else if j < k then get_array a h ! k
    5.42 +      else get_array a h ! (j - (k - i)))" (is "?P a i j h h'")
    5.43 +using assms proof (induct a i j arbitrary: h h' rule: rev.induct)
    5.44 +  case (1 a i j h h'')
    5.45 +  thus ?case
    5.46 +  proof (cases "i < j")
    5.47 +    case True
    5.48 +    with 1[unfolded rev.simps[of a i j]]
    5.49 +    obtain h' where
    5.50 +      swp: "crel (swap a i j) h h' ()"
    5.51 +      and rev: "crel (rev a (i + 1) (j - 1)) h' h'' ()"
    5.52 +      by (auto elim: crel_elim_all)
    5.53 +    from rev 1 True
    5.54 +    have eq: "?P a (i + 1) (j - 1) h' h''" by auto
    5.55 +
    5.56 +    have "k < i \<or> i = k \<or> (i < k \<and> k < j) \<or> j = k \<or> j < k" by arith
    5.57 +    with True show ?thesis
    5.58 +      by (elim disjE) (auto simp: eq swap_pointwise[OF swp])
    5.59 +  next
    5.60 +    case False
    5.61 +    with 1[unfolded rev.simps[of a i j]]
    5.62 +    show ?thesis
    5.63 +      by (cases "k = j") (auto elim: crel_elim_all)
    5.64 +  qed
    5.65 +qed
    5.66 +
    5.67 +lemma rev_length:
    5.68 +  assumes "crel (rev a i j) h h' r"
    5.69 +  shows "Heap.length a h = Heap.length a h'"
    5.70 +using assms
    5.71 +proof (induct a i j arbitrary: h h' rule: rev.induct)
    5.72 +  case (1 a i j h h'')
    5.73 +  thus ?case
    5.74 +  proof (cases "i < j")
    5.75 +    case True
    5.76 +    with 1[unfolded rev.simps[of a i j]]
    5.77 +    obtain h' where
    5.78 +      swp: "crel (swap a i j) h h' ()"
    5.79 +      and rev: "crel (rev a (i + 1) (j - 1)) h' h'' ()"
    5.80 +      by (auto elim: crel_elim_all)
    5.81 +    from swp rev 1 True show ?thesis
    5.82 +      unfolding swap.simps
    5.83 +      by (elim crel_elim_all) fastsimp
    5.84 +  next
    5.85 +    case False
    5.86 +    with 1[unfolded rev.simps[of a i j]]
    5.87 +    show ?thesis
    5.88 +      by (auto elim: crel_elim_all)
    5.89 +  qed
    5.90 +qed
    5.91 +
    5.92 +lemma rev2_rev': assumes "crel (rev a i j) h h' u"
    5.93 +  assumes "j < Heap.length a h"
    5.94 +  shows "subarray i (j + 1) a h' = List.rev (subarray i (j + 1) a h)"
    5.95 +proof - 
    5.96 +  {
    5.97 +    fix k
    5.98 +    assume "k < Suc j - i"
    5.99 +    with rev_pointwise[OF assms(1)] have "get_array a h' ! (i + k) = get_array a h ! (j - k)"
   5.100 +      by auto
   5.101 +  } 
   5.102 +  with assms(2) rev_length[OF assms(1)] show ?thesis
   5.103 +  unfolding subarray_def Heap.length_def
   5.104 +  by (auto simp add: length_sublist' rev_nth min_def nth_sublist' intro!: nth_equalityI)
   5.105 +qed
   5.106 +
   5.107 +lemma rev2_rev: 
   5.108 +  assumes "crel (rev a 0 (Heap.length a h - 1)) h h' u"
   5.109 +  shows "get_array a h' = List.rev (get_array a h)"
   5.110 +  using rev2_rev'[OF assms] rev_length[OF assms] assms
   5.111 +    by (cases "Heap.length a h = 0", auto simp add: Heap.length_def
   5.112 +      subarray_def sublist'_all rev.simps[where j=0] elim!: crel_elim_all)
   5.113 +  (drule sym[of "List.length (get_array a h)"], simp)
   5.114 +
   5.115 +end
     6.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     6.2 +++ b/src/HOL/Imperative_HOL/ex/Linked_Lists.thy	Thu Dec 10 11:58:26 2009 +0100
     6.3 @@ -0,0 +1,993 @@
     6.4 +theory Linked_Lists
     6.5 +imports "~~/src/HOL/Imperative_HOL/Imperative_HOL" Code_Integer
     6.6 +begin
     6.7 +
     6.8 +section {* Definition of Linked Lists *}
     6.9 +
    6.10 +setup {* Sign.add_const_constraint (@{const_name Ref}, SOME @{typ "nat \<Rightarrow> 'a\<Colon>type ref"}) *}
    6.11 +datatype 'a node = Empty | Node 'a "('a node) ref"
    6.12 +
    6.13 +fun
    6.14 +  node_encode :: "'a\<Colon>countable node \<Rightarrow> nat"
    6.15 +where
    6.16 +  "node_encode Empty = 0"
    6.17 +  | "node_encode (Node x r) = Suc (to_nat (x, r))"
    6.18 +
    6.19 +instance node :: (countable) countable
    6.20 +proof (rule countable_classI [of "node_encode"])
    6.21 +  fix x y :: "'a\<Colon>countable node"
    6.22 +  show "node_encode x = node_encode y \<Longrightarrow> x = y"
    6.23 +  by (induct x, auto, induct y, auto, induct y, auto)
    6.24 +qed
    6.25 +
    6.26 +instance node :: (heap) heap ..
    6.27 +
    6.28 +fun make_llist :: "'a\<Colon>heap list \<Rightarrow> 'a node Heap"
    6.29 +where 
    6.30 +  [simp del]: "make_llist []     = return Empty"
    6.31 +            | "make_llist (x#xs) = do tl   \<leftarrow> make_llist xs;
    6.32 +                                      next \<leftarrow> Ref.new tl;
    6.33 +	                              return (Node x next)
    6.34 +		                   done"
    6.35 +
    6.36 +
    6.37 +text {* define traverse using the MREC combinator *}
    6.38 +
    6.39 +definition
    6.40 +  traverse :: "'a\<Colon>heap node \<Rightarrow> 'a list Heap"
    6.41 +where
    6.42 +[code del]: "traverse = MREC (\<lambda>n. case n of Empty \<Rightarrow> return (Inl [])
    6.43 +                                | Node x r \<Rightarrow> (do tl \<leftarrow> Ref.lookup r;
    6.44 +                                                  return (Inr tl) done))
    6.45 +                   (\<lambda>n tl xs. case n of Empty \<Rightarrow> undefined
    6.46 +                                      | Node x r \<Rightarrow> return (x # xs))"
    6.47 +
    6.48 +
    6.49 +lemma traverse_simps[code, simp]:
    6.50 +  "traverse Empty      = return []"
    6.51 +  "traverse (Node x r) = do tl \<leftarrow> Ref.lookup r;
    6.52 +                            xs \<leftarrow> traverse tl;
    6.53 +                            return (x#xs)
    6.54 +                         done"
    6.55 +unfolding traverse_def
    6.56 +by (auto simp: traverse_def monad_simp MREC_rule)
    6.57 +
    6.58 +
    6.59 +section {* Proving correctness with relational abstraction *}
    6.60 +
    6.61 +subsection {* Definition of list_of, list_of', refs_of and refs_of' *}
    6.62 +
    6.63 +fun list_of :: "heap \<Rightarrow> ('a::heap) node \<Rightarrow> 'a list \<Rightarrow> bool"
    6.64 +where
    6.65 +  "list_of h r [] = (r = Empty)"
    6.66 +| "list_of h r (a#as) = (case r of Empty \<Rightarrow> False | Node b bs \<Rightarrow> (a = b \<and> list_of h (get_ref bs h) as))"
    6.67 + 
    6.68 +definition list_of' :: "heap \<Rightarrow> ('a::heap) node ref \<Rightarrow> 'a list \<Rightarrow> bool"
    6.69 +where
    6.70 +  "list_of' h r xs = list_of h (get_ref r h) xs"
    6.71 +
    6.72 +fun refs_of :: "heap \<Rightarrow> ('a::heap) node \<Rightarrow> 'a node ref list \<Rightarrow> bool"
    6.73 +where
    6.74 +  "refs_of h r [] = (r = Empty)"
    6.75 +| "refs_of h r (x#xs) = (case r of Empty \<Rightarrow> False | Node b bs \<Rightarrow> (x = bs) \<and> refs_of h (get_ref bs h) xs)"
    6.76 +
    6.77 +fun refs_of' :: "heap \<Rightarrow> ('a::heap) node ref \<Rightarrow> 'a node ref list \<Rightarrow> bool"
    6.78 +where
    6.79 +  "refs_of' h r [] = False"
    6.80 +| "refs_of' h r (x#xs) = ((x = r) \<and> refs_of h (get_ref x h) xs)"
    6.81 +
    6.82 +
    6.83 +subsection {* Properties of these definitions *}
    6.84 +
    6.85 +lemma list_of_Empty[simp]: "list_of h Empty xs = (xs = [])"
    6.86 +by (cases xs, auto)
    6.87 +
    6.88 +lemma list_of_Node[simp]: "list_of h (Node x ps) xs = (\<exists>xs'. (xs = x # xs') \<and> list_of h (get_ref ps h) xs')"
    6.89 +by (cases xs, auto)
    6.90 +
    6.91 +lemma list_of'_Empty[simp]: "get_ref q h = Empty \<Longrightarrow> list_of' h q xs = (xs = [])"
    6.92 +unfolding list_of'_def by simp
    6.93 +
    6.94 +lemma list_of'_Node[simp]: "get_ref q h = Node x ps \<Longrightarrow> list_of' h q xs = (\<exists>xs'. (xs = x # xs') \<and> list_of' h ps xs')"
    6.95 +unfolding list_of'_def by simp
    6.96 +
    6.97 +lemma list_of'_Nil: "list_of' h q [] \<Longrightarrow> get_ref q h = Empty"
    6.98 +unfolding list_of'_def by simp
    6.99 +
   6.100 +lemma list_of'_Cons: 
   6.101 +assumes "list_of' h q (x#xs)"
   6.102 +obtains n where "get_ref q h = Node x n" and "list_of' h n xs"
   6.103 +using assms unfolding list_of'_def by (auto split: node.split_asm)
   6.104 +
   6.105 +lemma refs_of_Empty[simp] : "refs_of h Empty xs = (xs = [])"
   6.106 +  by (cases xs, auto)
   6.107 +
   6.108 +lemma refs_of_Node[simp]: "refs_of h (Node x ps) xs = (\<exists>prs. xs = ps # prs \<and> refs_of h (get_ref ps h) prs)"
   6.109 +  by (cases xs, auto)
   6.110 +
   6.111 +lemma refs_of'_def': "refs_of' h p ps = (\<exists>prs. (ps = (p # prs)) \<and> refs_of h (get_ref p h) prs)"
   6.112 +by (cases ps, auto)
   6.113 +
   6.114 +lemma refs_of'_Node:
   6.115 +  assumes "refs_of' h p xs"
   6.116 +  assumes "get_ref p h = Node x pn"
   6.117 +  obtains pnrs
   6.118 +  where "xs = p # pnrs" and "refs_of' h pn pnrs"
   6.119 +using assms
   6.120 +unfolding refs_of'_def' by auto
   6.121 +
   6.122 +lemma list_of_is_fun: "\<lbrakk> list_of h n xs; list_of h n ys\<rbrakk> \<Longrightarrow> xs = ys"
   6.123 +proof (induct xs arbitrary: ys n)
   6.124 +  case Nil thus ?case by auto
   6.125 +next
   6.126 +  case (Cons x xs')
   6.127 +  thus ?case
   6.128 +    by (cases ys,  auto split: node.split_asm)
   6.129 +qed
   6.130 +
   6.131 +lemma refs_of_is_fun: "\<lbrakk> refs_of h n xs; refs_of h n ys\<rbrakk> \<Longrightarrow> xs = ys"
   6.132 +proof (induct xs arbitrary: ys n)
   6.133 +  case Nil thus ?case by auto
   6.134 +next
   6.135 +  case (Cons x xs')
   6.136 +  thus ?case
   6.137 +    by (cases ys,  auto split: node.split_asm)
   6.138 +qed
   6.139 +
   6.140 +lemma refs_of'_is_fun: "\<lbrakk> refs_of' h p as; refs_of' h p bs \<rbrakk> \<Longrightarrow> as = bs"
   6.141 +unfolding refs_of'_def' by (auto dest: refs_of_is_fun)
   6.142 +
   6.143 +
   6.144 +lemma list_of_refs_of_HOL:
   6.145 +  assumes "list_of h r xs"
   6.146 +  shows "\<exists>rs. refs_of h r rs"
   6.147 +using assms
   6.148 +proof (induct xs arbitrary: r)
   6.149 +  case Nil thus ?case by auto
   6.150 +next
   6.151 +  case (Cons x xs')
   6.152 +  thus ?case
   6.153 +    by (cases r, auto)
   6.154 +qed
   6.155 +    
   6.156 +lemma list_of_refs_of:
   6.157 +  assumes "list_of h r xs"
   6.158 +  obtains rs where "refs_of h r rs"
   6.159 +using list_of_refs_of_HOL[OF assms]
   6.160 +by auto
   6.161 +
   6.162 +lemma list_of'_refs_of'_HOL:
   6.163 +  assumes "list_of' h r xs"
   6.164 +  shows "\<exists>rs. refs_of' h r rs"
   6.165 +proof -
   6.166 +  from assms obtain rs' where "refs_of h (get_ref r h) rs'"
   6.167 +    unfolding list_of'_def by (rule list_of_refs_of)
   6.168 +  thus ?thesis unfolding refs_of'_def' by auto
   6.169 +qed
   6.170 +
   6.171 +lemma list_of'_refs_of':
   6.172 +  assumes "list_of' h r xs"
   6.173 +  obtains rs where "refs_of' h r rs"
   6.174 +using list_of'_refs_of'_HOL[OF assms]
   6.175 +by auto
   6.176 +
   6.177 +lemma refs_of_list_of_HOL:
   6.178 +  assumes "refs_of h r rs"
   6.179 +  shows "\<exists>xs. list_of h r xs"
   6.180 +using assms
   6.181 +proof (induct rs arbitrary: r)
   6.182 +  case Nil thus ?case by auto
   6.183 +next
   6.184 +  case (Cons r rs')
   6.185 +  thus ?case
   6.186 +    by (cases r, auto)
   6.187 +qed
   6.188 +
   6.189 +lemma refs_of_list_of:
   6.190 +  assumes "refs_of h r rs"
   6.191 +  obtains xs where "list_of h r xs"
   6.192 +using refs_of_list_of_HOL[OF assms]
   6.193 +by auto
   6.194 +
   6.195 +lemma refs_of'_list_of'_HOL:
   6.196 +  assumes "refs_of' h r rs"
   6.197 +  shows "\<exists>xs. list_of' h r xs"
   6.198 +using assms
   6.199 +unfolding list_of'_def refs_of'_def'
   6.200 +by (auto intro: refs_of_list_of)
   6.201 +
   6.202 +
   6.203 +lemma refs_of'_list_of':
   6.204 +  assumes "refs_of' h r rs"
   6.205 +  obtains xs where "list_of' h r xs"
   6.206 +using refs_of'_list_of'_HOL[OF assms]
   6.207 +by auto
   6.208 +
   6.209 +lemma refs_of'E: "refs_of' h q rs \<Longrightarrow> q \<in> set rs"
   6.210 +unfolding refs_of'_def' by auto
   6.211 +
   6.212 +lemma list_of'_refs_of'2:
   6.213 +  assumes "list_of' h r xs"
   6.214 +  shows "\<exists>rs'. refs_of' h r (r#rs')"
   6.215 +proof -
   6.216 +  from assms obtain rs where "refs_of' h r rs" by (rule list_of'_refs_of')
   6.217 +  thus ?thesis by (auto simp add: refs_of'_def')
   6.218 +qed
   6.219 +
   6.220 +subsection {* More complicated properties of these predicates *}
   6.221 +
   6.222 +lemma list_of_append:
   6.223 +  "list_of h n (as @ bs) \<Longrightarrow> \<exists>m. list_of h m bs"
   6.224 +apply (induct as arbitrary: n)
   6.225 +apply auto
   6.226 +apply (case_tac n)
   6.227 +apply auto
   6.228 +done
   6.229 +
   6.230 +lemma refs_of_append: "refs_of h n (as @ bs) \<Longrightarrow> \<exists>m. refs_of h m bs"
   6.231 +apply (induct as arbitrary: n)
   6.232 +apply auto
   6.233 +apply (case_tac n)
   6.234 +apply auto
   6.235 +done
   6.236 +
   6.237 +lemma refs_of_next:
   6.238 +assumes "refs_of h (get_ref p h) rs"
   6.239 +  shows "p \<notin> set rs"
   6.240 +proof (rule ccontr)
   6.241 +  assume a: "\<not> (p \<notin> set rs)"
   6.242 +  from this obtain as bs where split:"rs = as @ p # bs" by (fastsimp dest: split_list)
   6.243 +  with assms obtain q where "refs_of h q (p # bs)" by (fast dest: refs_of_append)
   6.244 +  with assms split show "False"
   6.245 +    by (cases q,auto dest: refs_of_is_fun)
   6.246 +qed
   6.247 +
   6.248 +lemma refs_of_distinct: "refs_of h p rs \<Longrightarrow> distinct rs"
   6.249 +proof (induct rs arbitrary: p)
   6.250 +  case Nil thus ?case by simp
   6.251 +next
   6.252 +  case (Cons r rs')
   6.253 +  thus ?case
   6.254 +    by (cases p, auto simp add: refs_of_next)
   6.255 +qed
   6.256 +
   6.257 +lemma refs_of'_distinct: "refs_of' h p rs \<Longrightarrow> distinct rs"
   6.258 +  unfolding refs_of'_def'
   6.259 +  by (fastsimp simp add: refs_of_distinct refs_of_next)
   6.260 +
   6.261 +
   6.262 +subsection {* Interaction of these predicates with our heap transitions *}
   6.263 +
   6.264 +lemma list_of_set_ref: "refs_of h q rs \<Longrightarrow> p \<notin> set rs \<Longrightarrow> list_of (set_ref p v h) q as = list_of h q as"
   6.265 +using assms
   6.266 +proof (induct as arbitrary: q rs)
   6.267 +  case Nil thus ?case by simp
   6.268 +next
   6.269 +  case (Cons x xs)
   6.270 +  thus ?case
   6.271 +  proof (cases q)
   6.272 +    case Empty thus ?thesis by auto
   6.273 +  next
   6.274 +    case (Node a ref)
   6.275 +    from Cons(2) Node obtain rs' where 1: "refs_of h (get_ref ref h) rs'" and rs_rs': "rs = ref # rs'" by auto
   6.276 +    from Cons(3) rs_rs' have "ref \<noteq> p" by fastsimp
   6.277 +    hence ref_eq: "get_ref ref (set_ref p v h) = (get_ref ref h)" by (auto simp add: ref_get_set_neq)
   6.278 +    from rs_rs' Cons(3) have 2: "p \<notin> set rs'" by simp
   6.279 +    from Cons.hyps[OF 1 2] Node ref_eq show ?thesis by simp
   6.280 +  qed
   6.281 +qed
   6.282 +
   6.283 +lemma refs_of_set_ref: "refs_of h q rs \<Longrightarrow> p \<notin> set rs \<Longrightarrow> refs_of (set_ref p v h) q as = refs_of h q as"
   6.284 +proof (induct as arbitrary: q rs)
   6.285 +  case Nil thus ?case by simp
   6.286 +next
   6.287 +  case (Cons x xs)
   6.288 +  thus ?case
   6.289 +  proof (cases q)
   6.290 +    case Empty thus ?thesis by auto
   6.291 +  next
   6.292 +    case (Node a ref)
   6.293 +    from Cons(2) Node obtain rs' where 1: "refs_of h (get_ref ref h) rs'" and rs_rs': "rs = ref # rs'" by auto
   6.294 +    from Cons(3) rs_rs' have "ref \<noteq> p" by fastsimp
   6.295 +    hence ref_eq: "get_ref ref (set_ref p v h) = (get_ref ref h)" by (auto simp add: ref_get_set_neq)
   6.296 +    from rs_rs' Cons(3) have 2: "p \<notin> set rs'" by simp
   6.297 +    from Cons.hyps[OF 1 2] Node ref_eq show ?thesis by auto
   6.298 +  qed
   6.299 +qed
   6.300 +
   6.301 +lemma refs_of_set_ref2: "refs_of (set_ref p v h) q rs \<Longrightarrow> p \<notin> set rs \<Longrightarrow> refs_of (set_ref p v h) q rs = refs_of h q rs"
   6.302 +proof (induct rs arbitrary: q)
   6.303 +  case Nil thus ?case by simp
   6.304 +next
   6.305 +  case (Cons x xs)
   6.306 +  thus ?case
   6.307 +  proof (cases q)
   6.308 +    case Empty thus ?thesis by auto
   6.309 +  next
   6.310 +    case (Node a ref)
   6.311 +    from Cons(2) Node have 1:"refs_of (set_ref p v h) (get_ref ref (set_ref p v h)) xs" and x_ref: "x = ref" by auto
   6.312 +    from Cons(3) this have "ref \<noteq> p" by fastsimp
   6.313 +    hence ref_eq: "get_ref ref (set_ref p v h) = (get_ref ref h)" by (auto simp add: ref_get_set_neq)
   6.314 +    from Cons(3) have 2: "p \<notin> set xs" by simp
   6.315 +    with Cons.hyps 1 2 Node ref_eq show ?thesis
   6.316 +      by simp
   6.317 +  qed
   6.318 +qed
   6.319 +
   6.320 +lemma list_of'_set_ref:
   6.321 +  assumes "refs_of' h q rs"
   6.322 +  assumes "p \<notin> set rs"
   6.323 +  shows "list_of' (set_ref p v h) q as = list_of' h q as"
   6.324 +proof -
   6.325 +  from assms have "q \<noteq> p" by (auto simp only: dest!: refs_of'E)
   6.326 +  with assms show ?thesis
   6.327 +    unfolding list_of'_def refs_of'_def'
   6.328 +    by (auto simp add: list_of_set_ref)
   6.329 +qed
   6.330 +
   6.331 +lemma list_of'_set_next_ref_Node[simp]:
   6.332 +  assumes "list_of' h r xs"
   6.333 +  assumes "get_ref p h = Node x r'"
   6.334 +  assumes "refs_of' h r rs"
   6.335 +  assumes "p \<notin> set rs"
   6.336 +  shows "list_of' (set_ref p (Node x r) h) p (x#xs) = list_of' h r xs"
   6.337 +using assms
   6.338 +unfolding list_of'_def refs_of'_def'
   6.339 +by (auto simp add: list_of_set_ref noteq_refs_sym)
   6.340 +
   6.341 +lemma refs_of'_set_ref:
   6.342 +  assumes "refs_of' h q rs"
   6.343 +  assumes "p \<notin> set rs"
   6.344 +  shows "refs_of' (set_ref p v h) q as = refs_of' h q as"
   6.345 +using assms
   6.346 +proof -
   6.347 +  from assms have "q \<noteq> p" by (auto simp only: dest!: refs_of'E)
   6.348 +  with assms show ?thesis
   6.349 +    unfolding refs_of'_def'
   6.350 +    by (auto simp add: refs_of_set_ref)
   6.351 +qed
   6.352 +
   6.353 +lemma refs_of'_set_ref2:
   6.354 +  assumes "refs_of' (set_ref p v h) q rs"
   6.355 +  assumes "p \<notin> set rs"
   6.356 +  shows "refs_of' (set_ref p v h) q as = refs_of' h q as"
   6.357 +using assms
   6.358 +proof -
   6.359 +  from assms have "q \<noteq> p" by (auto simp only: dest!: refs_of'E)
   6.360 +  with assms show ?thesis
   6.361 +    unfolding refs_of'_def'
   6.362 +    apply auto
   6.363 +    apply (subgoal_tac "prs = prsa")
   6.364 +    apply (insert refs_of_set_ref2[of p v h "get_ref q h"])
   6.365 +    apply (erule_tac x="prs" in meta_allE)
   6.366 +    apply auto
   6.367 +    apply (auto dest: refs_of_is_fun)
   6.368 +    done
   6.369 +qed
   6.370 +
   6.371 +lemma refs_of'_set_next_ref:
   6.372 +assumes "get_ref p h1 = Node x pn"
   6.373 +assumes "refs_of' (set_ref p (Node x r1) h1) p rs"
   6.374 +obtains r1s where "rs = (p#r1s)" and "refs_of' h1 r1 r1s"
   6.375 +using assms
   6.376 +proof -
   6.377 +  from assms refs_of'_distinct[OF assms(2)] have "\<exists> r1s. rs = (p # r1s) \<and> refs_of' h1 r1 r1s"
   6.378 +    apply -
   6.379 +    unfolding refs_of'_def'[of _ p]
   6.380 +    apply (auto, frule refs_of_set_ref2) by (auto dest: noteq_refs_sym)
   6.381 +  with prems show thesis by auto
   6.382 +qed
   6.383 +
   6.384 +section {* Proving make_llist and traverse correct *}
   6.385 +
   6.386 +lemma refs_of_invariant:
   6.387 +  assumes "refs_of h (r::('a::heap) node) xs"
   6.388 +  assumes "\<forall>refs. refs_of h r refs \<longrightarrow> (\<forall>ref \<in> set refs. ref_present ref h \<and> ref_present ref h' \<and> get_ref ref h = get_ref ref h')"
   6.389 +  shows "refs_of h' r xs"
   6.390 +using assms
   6.391 +proof (induct xs arbitrary: r)
   6.392 +  case Nil thus ?case by simp
   6.393 +next
   6.394 +  case (Cons x xs')
   6.395 +  from Cons(2) obtain v where Node: "r = Node v x" by (cases r, auto)
   6.396 +  from Cons(2) Node have refs_of_next: "refs_of h (get_ref x h) xs'" by simp
   6.397 +  from Cons(2-3) Node have ref_eq: "get_ref x h = get_ref x h'" by auto
   6.398 +  from ref_eq refs_of_next have 1: "refs_of h (get_ref x h') xs'" by simp
   6.399 +  from Cons(2) Cons(3) have "\<forall>ref \<in> set xs'. ref_present ref h \<and> ref_present ref h' \<and> get_ref ref h = get_ref ref h'"
   6.400 +    by fastsimp
   6.401 +  with Cons(3) 1 have 2: "\<forall>refs. refs_of h (get_ref x h') refs \<longrightarrow> (\<forall>ref \<in> set refs. ref_present ref h \<and> ref_present ref h' \<and> get_ref ref h = get_ref ref h')"
   6.402 +    by (fastsimp dest: refs_of_is_fun)
   6.403 +  from Cons.hyps[OF 1 2] have "refs_of h' (get_ref x h') xs'" .
   6.404 +  with Node show ?case by simp
   6.405 +qed
   6.406 +
   6.407 +lemma refs_of'_invariant:
   6.408 +  assumes "refs_of' h r xs"
   6.409 +  assumes "\<forall>refs. refs_of' h r refs \<longrightarrow> (\<forall>ref \<in> set refs. ref_present ref h \<and> ref_present ref h' \<and> get_ref ref h = get_ref ref h')"
   6.410 +  shows "refs_of' h' r xs"
   6.411 +using assms
   6.412 +proof -
   6.413 +  from assms obtain prs where refs:"refs_of h (get_ref r h) prs" and xs_def: "xs = r # prs"
   6.414 +    unfolding refs_of'_def' by auto
   6.415 +  from xs_def assms have x_eq: "get_ref r h = get_ref r h'" by fastsimp
   6.416 +  from refs assms xs_def have 2: "\<forall>refs. refs_of h (get_ref r h) refs \<longrightarrow>
   6.417 +     (\<forall>ref\<in>set refs. ref_present ref h \<and> ref_present ref h' \<and> get_ref ref h = get_ref ref h')" 
   6.418 +    by (fastsimp dest: refs_of_is_fun)
   6.419 +  from refs_of_invariant [OF refs 2] xs_def x_eq show ?thesis
   6.420 +    unfolding refs_of'_def' by auto
   6.421 +qed
   6.422 +
   6.423 +lemma list_of_invariant:
   6.424 +  assumes "list_of h (r::('a::heap) node) xs"
   6.425 +  assumes "\<forall>refs. refs_of h r refs \<longrightarrow> (\<forall>ref \<in> set refs. ref_present ref h \<and> ref_present ref h' \<and> get_ref ref h = get_ref ref h')"
   6.426 +  shows "list_of h' r xs"
   6.427 +using assms
   6.428 +proof (induct xs arbitrary: r)
   6.429 +  case Nil thus ?case by simp
   6.430 +next
   6.431 +  case (Cons x xs')
   6.432 +
   6.433 +  from Cons(2) obtain ref where Node: "r = Node x ref"
   6.434 +    by (cases r, auto)
   6.435 +  from Cons(2) obtain rs where rs_def: "refs_of h r rs" by (rule list_of_refs_of)
   6.436 +  from Node rs_def obtain rss where refs_of: "refs_of h r (ref#rss)" and rss_def: "rs = ref#rss" by auto
   6.437 +  from Cons(3) Node refs_of have ref_eq: "get_ref ref h = get_ref ref h'"
   6.438 +    by auto
   6.439 +  from Cons(2) ref_eq Node have 1: "list_of h (get_ref ref h') xs'" by simp
   6.440 +  from refs_of Node ref_eq have refs_of_ref: "refs_of h (get_ref ref h') rss" by simp
   6.441 +  from Cons(3) rs_def have rs_heap_eq: "\<forall>ref\<in>set rs. ref_present ref h \<and> ref_present ref h' \<and> get_ref ref h = get_ref ref h'" by simp
   6.442 +  from refs_of_ref rs_heap_eq rss_def have 2: "\<forall>refs. refs_of h (get_ref ref h') refs \<longrightarrow>
   6.443 +          (\<forall>ref\<in>set refs. ref_present ref h \<and> ref_present ref h' \<and> get_ref ref h = get_ref ref h')"
   6.444 +    by (auto dest: refs_of_is_fun)
   6.445 +  from Cons(1)[OF 1 2]
   6.446 +  have "list_of h' (get_ref ref h') xs'" .
   6.447 +  with Node show ?case
   6.448 +    unfolding list_of'_def
   6.449 +    by simp
   6.450 +qed
   6.451 +
   6.452 +lemma make_llist:
   6.453 +assumes "crel (make_llist xs) h h' r"
   6.454 +shows "list_of h' r xs \<and> (\<forall>rs. refs_of h' r rs \<longrightarrow> (\<forall>ref \<in> (set rs). ref_present ref h'))"
   6.455 +using assms 
   6.456 +proof (induct xs arbitrary: h h' r)
   6.457 +  case Nil thus ?case by (auto elim: crel_return simp add: make_llist.simps)
   6.458 +next
   6.459 +  case (Cons x xs')
   6.460 +  from Cons.prems obtain h1 r1 r' where make_llist: "crel (make_llist xs') h h1 r1"
   6.461 +    and crel_refnew:"crel (Ref.new r1) h1 h' r'" and Node: "r = Node x r'"
   6.462 +    unfolding make_llist.simps
   6.463 +    by (auto elim!: crelE crel_return)
   6.464 +  from Cons.hyps[OF make_llist] have list_of_h1: "list_of h1 r1 xs'" ..
   6.465 +  from Cons.hyps[OF make_llist] obtain rs' where rs'_def: "refs_of h1 r1 rs'" by (auto intro: list_of_refs_of)
   6.466 +  from Cons.hyps[OF make_llist] rs'_def have refs_present: "\<forall>ref\<in>set rs'. ref_present ref h1" by simp
   6.467 +  from crel_refnew rs'_def refs_present have refs_unchanged: "\<forall>refs. refs_of h1 r1 refs \<longrightarrow>
   6.468 +         (\<forall>ref\<in>set refs. ref_present ref h1 \<and> ref_present ref h' \<and> get_ref ref h1 = get_ref ref h')"
   6.469 +    by (auto elim!: crel_Ref_new dest: refs_of_is_fun)
   6.470 +  with list_of_invariant[OF list_of_h1 refs_unchanged] Node crel_refnew have fstgoal: "list_of h' r (x # xs')"
   6.471 +    unfolding list_of.simps
   6.472 +    by (auto elim!: crel_Ref_new)
   6.473 +  from refs_unchanged rs'_def have refs_still_present: "\<forall>ref\<in>set rs'. ref_present ref h'" by auto
   6.474 +  from refs_of_invariant[OF rs'_def refs_unchanged] refs_unchanged Node crel_refnew refs_still_present
   6.475 +  have sndgoal: "\<forall>rs. refs_of h' r rs \<longrightarrow> (\<forall>ref\<in>set rs. ref_present ref h')"
   6.476 +    by (fastsimp elim!: crel_Ref_new dest: refs_of_is_fun)
   6.477 +  from fstgoal sndgoal show ?case ..
   6.478 +qed
   6.479 +
   6.480 +lemma traverse: "list_of h n r \<Longrightarrow> crel (traverse n) h h r"
   6.481 +proof (induct r arbitrary: n)
   6.482 +  case Nil
   6.483 +  thus ?case
   6.484 +    by (auto intro: crel_returnI)
   6.485 +next
   6.486 +  case (Cons x xs)
   6.487 +  thus ?case
   6.488 +  apply (cases n, auto)
   6.489 +  by (auto intro!: crelI crel_returnI crel_lookupI)
   6.490 +qed
   6.491 +
   6.492 +lemma traverse_make_llist':
   6.493 +  assumes crel: "crel (make_llist xs \<guillemotright>= traverse) h h' r"
   6.494 +  shows "r = xs"
   6.495 +proof -
   6.496 +  from crel obtain h1 r1
   6.497 +    where makell: "crel (make_llist xs) h h1 r1"
   6.498 +    and trav: "crel (traverse r1) h1 h' r"
   6.499 +    by (auto elim!: crelE)
   6.500 +  from make_llist[OF makell] have "list_of h1 r1 xs" ..
   6.501 +  from traverse [OF this] trav show ?thesis
   6.502 +    using crel_deterministic by fastsimp
   6.503 +qed
   6.504 +
   6.505 +section {* Proving correctness of in-place reversal *}
   6.506 +
   6.507 +subsection {* Definition of in-place reversal *}
   6.508 +
   6.509 +definition rev' :: "(('a::heap) node ref \<times> 'a node ref) \<Rightarrow> 'a node ref Heap"
   6.510 +where "rev' = MREC (\<lambda>(q, p). do v \<leftarrow> !p; (case v of Empty \<Rightarrow> (return (Inl q))
   6.511 +                            | Node x next \<Rightarrow> do
   6.512 +                                    p := Node x q;
   6.513 +                                    return (Inr (p, next))
   6.514 +                                  done) done)
   6.515 +             (\<lambda>x s z. return z)"
   6.516 +
   6.517 +lemma rev'_simps [code]:
   6.518 +  "rev' (q, p) =
   6.519 +   do
   6.520 +     v \<leftarrow> !p;
   6.521 +     (case v of
   6.522 +        Empty \<Rightarrow> return q
   6.523 +      | Node x next \<Rightarrow>
   6.524 +        do
   6.525 +          p := Node x q;
   6.526 +          rev' (p, next)
   6.527 +        done)
   6.528 +  done"
   6.529 +  unfolding rev'_def MREC_rule[of _ _ "(q, p)"] unfolding rev'_def[symmetric]
   6.530 +thm arg_cong2
   6.531 +  by (auto simp add: monad_simp expand_fun_eq intro: arg_cong2[where f = "op \<guillemotright>="] split: node.split)
   6.532 +
   6.533 +fun rev :: "('a:: heap) node \<Rightarrow> 'a node Heap" 
   6.534 +where
   6.535 +  "rev Empty = return Empty"
   6.536 +| "rev (Node x n) = (do q \<leftarrow> Ref.new Empty; p \<leftarrow> Ref.new (Node x n); v \<leftarrow> rev' (q, p); !v done)"
   6.537 +
   6.538 +subsection {* Correctness Proof *}
   6.539 +
   6.540 +lemma rev'_invariant:
   6.541 +  assumes "crel (rev' (q, p)) h h' v"
   6.542 +  assumes "list_of' h q qs"
   6.543 +  assumes "list_of' h p ps"
   6.544 +  assumes "\<forall>qrs prs. refs_of' h q qrs \<and> refs_of' h p prs \<longrightarrow> set prs \<inter> set qrs = {}"
   6.545 +  shows "\<exists>vs. list_of' h' v vs \<and> vs = (List.rev ps) @ qs"
   6.546 +using assms
   6.547 +proof (induct ps arbitrary: qs p q h)
   6.548 +  case Nil
   6.549 +  thus ?case
   6.550 +    unfolding rev'_simps[of q p] list_of'_def
   6.551 +    by (auto elim!: crelE crel_lookup crel_return)
   6.552 +next
   6.553 +  case (Cons x xs)
   6.554 +  (*"LinkedList.list_of h' (get_ref v h') (List.rev xs @ x # qsa)"*)
   6.555 +  from Cons(4) obtain ref where 
   6.556 +    p_is_Node: "get_ref p h = Node x ref"
   6.557 +    (*and "ref_present ref h"*)
   6.558 +    and list_of'_ref: "list_of' h ref xs"
   6.559 +    unfolding list_of'_def by (cases "get_ref p h", auto)
   6.560 +  from p_is_Node Cons(2) have crel_rev': "crel (rev' (p, ref)) (set_ref p (Node x q) h) h' v"
   6.561 +    by (auto simp add: rev'_simps [of q p] elim!: crelE crel_lookup crel_update)
   6.562 +  from Cons(3) obtain qrs where qrs_def: "refs_of' h q qrs" by (elim list_of'_refs_of')
   6.563 +  from Cons(4) obtain prs where prs_def: "refs_of' h p prs" by (elim list_of'_refs_of')
   6.564 +  from qrs_def prs_def Cons(5) have distinct_pointers: "set qrs \<inter> set prs = {}" by fastsimp
   6.565 +  from qrs_def prs_def distinct_pointers refs_of'E have p_notin_qrs: "p \<notin> set qrs" by fastsimp
   6.566 +  from Cons(3) qrs_def this have 1: "list_of' (set_ref p (Node x q) h) p (x#qs)"
   6.567 +    unfolding list_of'_def  
   6.568 +    apply (simp)
   6.569 +    unfolding list_of'_def[symmetric]
   6.570 +    by (simp add: list_of'_set_ref)
   6.571 +  from list_of'_refs_of'2[OF Cons(4)] p_is_Node prs_def obtain refs where refs_def: "refs_of' h ref refs" and prs_refs: "prs = p # refs"
   6.572 +    unfolding refs_of'_def' by auto
   6.573 +  from prs_refs prs_def have p_not_in_refs: "p \<notin> set refs"
   6.574 +    by (fastsimp dest!: refs_of'_distinct)
   6.575 +  with refs_def p_is_Node list_of'_ref have 2: "list_of' (set_ref p (Node x q) h) ref xs"
   6.576 +    by (auto simp add: list_of'_set_ref)
   6.577 +  from p_notin_qrs qrs_def have refs_of1: "refs_of' (set_ref p (Node x q) h) p (p#qrs)"
   6.578 +    unfolding refs_of'_def'
   6.579 +    apply (simp)
   6.580 +    unfolding refs_of'_def'[symmetric]
   6.581 +    by (simp add: refs_of'_set_ref)
   6.582 +  from p_not_in_refs p_is_Node refs_def have refs_of2: "refs_of' (set_ref p (Node x q) h) ref refs"
   6.583 +    by (simp add: refs_of'_set_ref)
   6.584 +  from p_not_in_refs refs_of1 refs_of2 distinct_pointers prs_refs have 3: "\<forall>qrs prs. refs_of' (set_ref p (Node x q) h) p qrs \<and> refs_of' (set_ref p (Node x q) h) ref prs \<longrightarrow> set prs \<inter> set qrs = {}"
   6.585 +    apply - apply (rule allI)+ apply (rule impI) apply (erule conjE)
   6.586 +    apply (drule refs_of'_is_fun) back back apply assumption
   6.587 +    apply (drule refs_of'_is_fun) back back apply assumption
   6.588 +    apply auto done
   6.589 +  from Cons.hyps [OF crel_rev' 1 2 3] show ?case by simp
   6.590 +qed
   6.591 +
   6.592 +
   6.593 +lemma rev_correctness:
   6.594 +  assumes list_of_h: "list_of h r xs"
   6.595 +  assumes validHeap: "\<forall>refs. refs_of h r refs \<longrightarrow> (\<forall>r \<in> set refs. ref_present r h)"
   6.596 +  assumes crel_rev: "crel (rev r) h h' r'"
   6.597 +  shows "list_of h' r' (List.rev xs)"
   6.598 +using assms
   6.599 +proof (cases r)
   6.600 +  case Empty
   6.601 +  with list_of_h crel_rev show ?thesis
   6.602 +    by (auto simp add: list_of_Empty elim!: crel_return)
   6.603 +next
   6.604 +  case (Node x ps)
   6.605 +  with crel_rev obtain p q h1 h2 h3 v where
   6.606 +    init: "crel (Ref.new Empty) h h1 q"
   6.607 +    "crel (Ref.new (Node x ps)) h1 h2 p"
   6.608 +    and crel_rev':"crel (rev' (q, p)) h2 h3 v"
   6.609 +    and lookup: "crel (!v) h3 h' r'"
   6.610 +    using rev.simps
   6.611 +    by (auto elim!: crelE)
   6.612 +  from init have a1:"list_of' h2 q []"
   6.613 +    unfolding list_of'_def
   6.614 +    by (auto elim!: crel_Ref_new)
   6.615 +  from list_of_h obtain refs where refs_def: "refs_of h r refs" by (rule list_of_refs_of)
   6.616 +  from validHeap init refs_def have heap_eq: "\<forall>refs. refs_of h r refs \<longrightarrow> (\<forall>ref\<in>set refs. ref_present ref h \<and> ref_present ref h2 \<and> get_ref ref h = get_ref ref h2)"
   6.617 +    by (fastsimp elim!: crel_Ref_new dest: refs_of_is_fun)
   6.618 +  from list_of_invariant[OF list_of_h heap_eq] have "list_of h2 r xs" .
   6.619 +  from init this Node have a2: "list_of' h2 p xs"
   6.620 +    apply -
   6.621 +    unfolding list_of'_def
   6.622 +    apply (auto elim!: crel_Ref_new)
   6.623 +    done
   6.624 +  from init have refs_of_q: "refs_of' h2 q [q]"
   6.625 +    by (auto elim!: crel_Ref_new)
   6.626 +  from refs_def Node have refs_of'_ps: "refs_of' h ps refs"
   6.627 +    by (auto simp add: refs_of'_def'[symmetric])
   6.628 +  from validHeap refs_def have all_ref_present: "\<forall>r\<in>set refs. ref_present r h" by simp
   6.629 +  from init refs_of'_ps Node this have heap_eq: "\<forall>refs. refs_of' h ps refs \<longrightarrow> (\<forall>ref\<in>set refs. ref_present ref h \<and> ref_present ref h2 \<and> get_ref ref h = get_ref ref h2)"
   6.630 +    by (fastsimp elim!: crel_Ref_new dest: refs_of'_is_fun)
   6.631 +  from refs_of'_invariant[OF refs_of'_ps this] have "refs_of' h2 ps refs" .
   6.632 +  with init have refs_of_p: "refs_of' h2 p (p#refs)"
   6.633 +    by (auto elim!: crel_Ref_new simp add: refs_of'_def')
   6.634 +  with init all_ref_present have q_is_new: "q \<notin> set (p#refs)"
   6.635 +    by (auto elim!: crel_Ref_new intro!: noteq_refsI)
   6.636 +  from refs_of_p refs_of_q q_is_new have a3: "\<forall>qrs prs. refs_of' h2 q qrs \<and> refs_of' h2 p prs \<longrightarrow> set prs \<inter> set qrs = {}"
   6.637 +    by (fastsimp simp only: set.simps dest: refs_of'_is_fun)
   6.638 +  from rev'_invariant [OF crel_rev' a1 a2 a3] have "list_of h3 (get_ref v h3) (List.rev xs)" 
   6.639 +    unfolding list_of'_def by auto
   6.640 +  with lookup show ?thesis
   6.641 +    by (auto elim: crel_lookup)
   6.642 +qed
   6.643 +
   6.644 +
   6.645 +section {* The merge function on Linked Lists *}
   6.646 +text {* We also prove merge correct *}
   6.647 +
   6.648 +text{* First, we define merge on lists in a natural way. *}
   6.649 +
   6.650 +fun Lmerge :: "('a::ord) list \<Rightarrow> 'a list \<Rightarrow> 'a list"
   6.651 +where
   6.652 +  "Lmerge (x#xs) (y#ys) =
   6.653 +     (if x \<le> y then x # Lmerge xs (y#ys) else y # Lmerge (x#xs) ys)"
   6.654 +| "Lmerge [] ys = ys"
   6.655 +| "Lmerge xs [] = xs"
   6.656 +
   6.657 +subsection {* Definition of merge function *}
   6.658 +
   6.659 +definition merge' :: "(('a::{heap, ord}) node ref * ('a::{heap, ord})) * ('a::{heap, ord}) node ref * ('a::{heap, ord}) node ref \<Rightarrow> ('a::{heap, ord}) node ref Heap"
   6.660 +where
   6.661 +"merge' = MREC (\<lambda>(_, p, q). (do v \<leftarrow> !p; w \<leftarrow> !q;
   6.662 +  (case v of Empty \<Rightarrow> return (Inl q)
   6.663 +          | Node valp np \<Rightarrow>
   6.664 +            (case w of Empty \<Rightarrow> return (Inl p)
   6.665 +                     | Node valq nq \<Rightarrow>
   6.666 +                       if (valp \<le> valq) then
   6.667 +                         return (Inr ((p, valp), np, q))
   6.668 +                       else
   6.669 +                         return (Inr ((q, valq), p, nq)))) done))
   6.670 + (\<lambda> _ ((n, v), _, _) r. do n := Node v r; return n done)"
   6.671 +
   6.672 +definition merge where "merge p q = merge' (undefined, p, q)"
   6.673 +
   6.674 +lemma if_return: "(if P then return x else return y) = return (if P then x else y)"
   6.675 +by auto
   6.676 +
   6.677 +lemma if_distrib_App: "(if P then f else g) x = (if P then f x else g x)"
   6.678 +by auto
   6.679 +lemma redundant_if: "(if P then (if P then x else z) else y) = (if P then x else y)"
   6.680 +  "(if P then x else (if P then z else y)) = (if P then x else y)"
   6.681 +by auto
   6.682 +
   6.683 +
   6.684 +
   6.685 +lemma sum_distrib: "sum_case fl fr (case x of Empty \<Rightarrow> y | Node v n \<Rightarrow> (z v n)) = (case x of Empty \<Rightarrow> sum_case fl fr y | Node v n \<Rightarrow> sum_case fl fr (z v n))"
   6.686 +by (cases x) auto
   6.687 +
   6.688 +lemma merge: "merge' (x, p, q) = merge p q"
   6.689 +unfolding merge'_def merge_def
   6.690 +apply (simp add: MREC_rule) done
   6.691 +term "Ref.change"
   6.692 +lemma merge_simps [code]:
   6.693 +shows "merge p q =
   6.694 +do v \<leftarrow> !p;
   6.695 +   w \<leftarrow> !q;
   6.696 +   (case v of node.Empty \<Rightarrow> return q
   6.697 +    | Node valp np \<Rightarrow>
   6.698 +        case w of node.Empty \<Rightarrow> return p
   6.699 +        | Node valq nq \<Rightarrow>
   6.700 +            if valp \<le> valq then do r \<leftarrow> merge np q;
   6.701 +                                   p := (Node valp r);
   6.702 +                                   return p
   6.703 +                                done
   6.704 +            else do r \<leftarrow> merge p nq;
   6.705 +                    q := (Node valq r);
   6.706 +                    return q
   6.707 +                 done)
   6.708 +done"
   6.709 +proof -
   6.710 +  {fix v x y
   6.711 +    have case_return: "(case v of Empty \<Rightarrow> return x | Node v n \<Rightarrow> return (y v n)) = return (case v of Empty \<Rightarrow> x | Node v n \<Rightarrow> y v n)" by (cases v) auto
   6.712 +    } note case_return = this
   6.713 +show ?thesis
   6.714 +unfolding merge_def[of p q] merge'_def
   6.715 +apply (simp add: MREC_rule[of _ _ "(undefined, p, q)"])
   6.716 +unfolding bind_bind return_bind
   6.717 +unfolding merge'_def[symmetric]
   6.718 +unfolding if_return case_return bind_bind return_bind sum_distrib sum.cases
   6.719 +unfolding if_distrib[symmetric, where f="Inr"]
   6.720 +unfolding sum.cases
   6.721 +unfolding if_distrib
   6.722 +unfolding split_beta fst_conv snd_conv
   6.723 +unfolding if_distrib_App redundant_if merge
   6.724 +..
   6.725 +qed
   6.726 +
   6.727 +subsection {* Induction refinement by applying the abstraction function to our induct rule *}
   6.728 +
   6.729 +text {* From our original induction rule Lmerge.induct, we derive a new rule with our list_of' predicate *}
   6.730 +
   6.731 +lemma merge_induct2:
   6.732 +  assumes "list_of' h (p::'a::{heap, ord} node ref) xs"
   6.733 +  assumes "list_of' h q ys"
   6.734 +  assumes "\<And> ys p q. \<lbrakk> list_of' h p []; list_of' h q ys; get_ref p h = Empty \<rbrakk> \<Longrightarrow> P p q [] ys"
   6.735 +  assumes "\<And> x xs' p q pn. \<lbrakk> list_of' h p (x#xs'); list_of' h q []; get_ref p h = Node x pn; get_ref q h = Empty \<rbrakk> \<Longrightarrow> P p q (x#xs') []"
   6.736 +  assumes "\<And> x xs' y ys' p q pn qn.
   6.737 +  \<lbrakk> list_of' h p (x#xs'); list_of' h q (y#ys'); get_ref p h = Node x pn; get_ref q h = Node y qn;
   6.738 +  x \<le> y; P pn q xs' (y#ys') \<rbrakk>
   6.739 +  \<Longrightarrow> P p q (x#xs') (y#ys')"
   6.740 +  assumes "\<And> x xs' y ys' p q pn qn.
   6.741 +  \<lbrakk> list_of' h p (x#xs'); list_of' h q (y#ys'); get_ref p h = Node x pn; get_ref q h = Node y qn;
   6.742 +  \<not> x \<le> y; P p qn (x#xs') ys'\<rbrakk>
   6.743 +  \<Longrightarrow> P p q (x#xs') (y#ys')"
   6.744 +  shows "P p q xs ys"
   6.745 +using assms(1-2)
   6.746 +proof (induct xs ys arbitrary: p q rule: Lmerge.induct)
   6.747 +  case (2 ys)
   6.748 +  from 2(1) have "get_ref p h = Empty" unfolding list_of'_def by simp
   6.749 +  with 2(1-2) assms(3) show ?case by blast
   6.750 +next
   6.751 +  case (3 x xs')
   6.752 +  from 3(1) obtain pn where Node: "get_ref p h = Node x pn" by (rule list_of'_Cons)
   6.753 +  from 3(2) have "get_ref q h = Empty" unfolding list_of'_def by simp
   6.754 +  with Node 3(1-2) assms(4) show ?case by blast
   6.755 +next
   6.756 +  case (1 x xs' y ys')
   6.757 +  from 1(3) obtain pn where pNode:"get_ref p h = Node x pn"
   6.758 +    and list_of'_pn: "list_of' h pn xs'" by (rule list_of'_Cons)
   6.759 +  from 1(4) obtain qn where qNode:"get_ref q h = Node y qn"
   6.760 +    and  list_of'_qn: "list_of' h qn ys'" by (rule list_of'_Cons)
   6.761 +  show ?case
   6.762 +  proof (cases "x \<le> y")
   6.763 +    case True
   6.764 +    from 1(1)[OF True list_of'_pn 1(4)] assms(5) 1(3-4) pNode qNode True
   6.765 +    show ?thesis by blast
   6.766 +  next
   6.767 +    case False
   6.768 +    from 1(2)[OF False 1(3) list_of'_qn] assms(6) 1(3-4) pNode qNode False
   6.769 +    show ?thesis by blast
   6.770 +  qed
   6.771 +qed
   6.772 +
   6.773 +
   6.774 +text {* secondly, we add the crel statement in the premise, and derive the crel statements for the single cases which we then eliminate with our crel elim rules. *}
   6.775 +  
   6.776 +lemma merge_induct3: 
   6.777 +assumes  "list_of' h p xs"
   6.778 +assumes  "list_of' h q ys"
   6.779 +assumes  "crel (merge p q) h h' r"
   6.780 +assumes  "\<And> ys p q. \<lbrakk> list_of' h p []; list_of' h q ys; get_ref p h = Empty \<rbrakk> \<Longrightarrow> P p q h h q [] ys"
   6.781 +assumes  "\<And> x xs' p q pn. \<lbrakk> list_of' h p (x#xs'); list_of' h q []; get_ref p h = Node x pn; get_ref q h = Empty \<rbrakk> \<Longrightarrow> P p q h h p (x#xs') []"
   6.782 +assumes  "\<And> x xs' y ys' p q pn qn h1 r1 h'.
   6.783 +  \<lbrakk> list_of' h p (x#xs'); list_of' h q (y#ys');get_ref p h = Node x pn; get_ref q h = Node y qn;
   6.784 +  x \<le> y; crel (merge pn q) h h1 r1 ; P pn q h h1 r1 xs' (y#ys'); h' = set_ref p (Node x r1) h1 \<rbrakk>
   6.785 +  \<Longrightarrow> P p q h h' p (x#xs') (y#ys')"
   6.786 +assumes "\<And> x xs' y ys' p q pn qn h1 r1 h'.
   6.787 +  \<lbrakk> list_of' h p (x#xs'); list_of' h q (y#ys'); get_ref p h = Node x pn; get_ref q h = Node y qn;
   6.788 +  \<not> x \<le> y; crel (merge p qn) h h1 r1; P p qn h h1 r1 (x#xs') ys'; h' = set_ref q (Node y r1) h1 \<rbrakk>
   6.789 +  \<Longrightarrow> P p q h h' q (x#xs') (y#ys')"
   6.790 +shows "P p q h h' r xs ys"
   6.791 +using assms(3)
   6.792 +proof (induct arbitrary: h' r rule: merge_induct2[OF assms(1) assms(2)])
   6.793 +  case (1 ys p q)
   6.794 +  from 1(3-4) have "h = h' \<and> r = q"
   6.795 +    unfolding merge_simps[of p q]
   6.796 +    by (auto elim!: crel_lookup crelE crel_return)
   6.797 +  with assms(4)[OF 1(1) 1(2) 1(3)] show ?case by simp
   6.798 +next
   6.799 +  case (2 x xs' p q pn)
   6.800 +  from 2(3-5) have "h = h' \<and> r = p"
   6.801 +    unfolding merge_simps[of p q]
   6.802 +    by (auto elim!: crel_lookup crelE crel_return)
   6.803 +  with assms(5)[OF 2(1-4)] show ?case by simp
   6.804 +next
   6.805 +  case (3 x xs' y ys' p q pn qn)
   6.806 +  from 3(3-5) 3(7) obtain h1 r1 where
   6.807 +    1: "crel (merge pn q) h h1 r1" 
   6.808 +    and 2: "h' = set_ref p (Node x r1) h1 \<and> r = p"
   6.809 +    unfolding merge_simps[of p q]
   6.810 +    by (auto elim!: crel_lookup crelE crel_return crel_if crel_update)
   6.811 +  from 3(6)[OF 1] assms(6) [OF 3(1-5)] 1 2 show ?case by simp
   6.812 +next
   6.813 +  case (4 x xs' y ys' p q pn qn)
   6.814 +  from 4(3-5) 4(7) obtain h1 r1 where
   6.815 +    1: "crel (merge p qn) h h1 r1" 
   6.816 +    and 2: "h' = set_ref q (Node y r1) h1 \<and> r = q"
   6.817 +    unfolding merge_simps[of p q]
   6.818 +    by (auto elim!: crel_lookup crelE crel_return crel_if crel_update)
   6.819 +  from 4(6)[OF 1] assms(7) [OF 4(1-5)] 1 2 show ?case by simp
   6.820 +qed
   6.821 +
   6.822 +
   6.823 +subsection {* Proving merge correct *}
   6.824 +
   6.825 +text {* As many parts of the following three proofs are identical, we could actually move the
   6.826 +same reasoning into an extended induction rule *}
   6.827 + 
   6.828 +lemma merge_unchanged:
   6.829 +  assumes "refs_of' h p xs"
   6.830 +  assumes "refs_of' h q ys"  
   6.831 +  assumes "crel (merge p q) h h' r'"
   6.832 +  assumes "set xs \<inter> set ys = {}"
   6.833 +  assumes "r \<notin> set xs \<union> set ys"
   6.834 +  shows "get_ref r h = get_ref r h'"
   6.835 +proof -
   6.836 +  from assms(1) obtain ps where ps_def: "list_of' h p ps" by (rule refs_of'_list_of')
   6.837 +  from assms(2) obtain qs where qs_def: "list_of' h q qs" by (rule refs_of'_list_of')
   6.838 +  show ?thesis using assms(1) assms(2) assms(4) assms(5)
   6.839 +  proof (induct arbitrary: xs ys r rule: merge_induct3[OF ps_def qs_def assms(3)])
   6.840 +    case 1 thus ?case by simp
   6.841 +  next
   6.842 +    case 2 thus ?case by simp
   6.843 +  next
   6.844 +    case (3 x xs' y ys' p q pn qn h1 r1 h' xs ys r)
   6.845 +    from 3(9) 3(3) obtain pnrs
   6.846 +      where pnrs_def: "xs = p#pnrs"
   6.847 +      and refs_of'_pn: "refs_of' h pn pnrs"
   6.848 +      by (rule refs_of'_Node)
   6.849 +    with 3(12) have r_in: "r \<notin> set pnrs \<union> set ys" by auto
   6.850 +    from pnrs_def 3(12) have "r \<noteq> p" by auto
   6.851 +    with 3(11) 3(12) pnrs_def refs_of'_distinct[OF 3(9)] have p_in: "p \<notin> set pnrs \<union> set ys" by auto
   6.852 +    from 3(11) pnrs_def have no_inter: "set pnrs \<inter> set ys = {}" by auto
   6.853 +    from 3(7)[OF refs_of'_pn 3(10) this p_in] 3(3) have p_is_Node: "get_ref p h1 = Node x pn" by simp
   6.854 +    from 3(7)[OF refs_of'_pn 3(10) no_inter r_in] 3(8) `r \<noteq> p` show ?case
   6.855 +      by simp
   6.856 +  next
   6.857 +    case (4 x xs' y ys' p q pn qn h1 r1 h' xs ys r)
   6.858 +    from 4(10) 4(4) obtain qnrs
   6.859 +      where qnrs_def: "ys = q#qnrs"
   6.860 +      and refs_of'_qn: "refs_of' h qn qnrs"
   6.861 +      by (rule refs_of'_Node)
   6.862 +    with 4(12) have r_in: "r \<notin> set xs \<union> set qnrs" by auto
   6.863 +    from qnrs_def 4(12) have "r \<noteq> q" by auto
   6.864 +    with 4(11) 4(12) qnrs_def refs_of'_distinct[OF 4(10)] have q_in: "q \<notin> set xs \<union> set qnrs" by auto
   6.865 +    from 4(11) qnrs_def have no_inter: "set xs \<inter> set qnrs = {}" by auto
   6.866 +    from 4(7)[OF 4(9) refs_of'_qn this q_in] 4(4) have q_is_Node: "get_ref q h1 = Node y qn" by simp
   6.867 +    from 4(7)[OF 4(9) refs_of'_qn no_inter r_in] 4(8) `r \<noteq> q` show ?case
   6.868 +      by simp
   6.869 +  qed
   6.870 +qed
   6.871 +
   6.872 +lemma refs_of'_merge:
   6.873 +  assumes "refs_of' h p xs"
   6.874 +  assumes "refs_of' h q ys"
   6.875 +  assumes "crel (merge p q) h h' r"
   6.876 +  assumes "set xs \<inter> set ys = {}"
   6.877 +  assumes "refs_of' h' r rs"
   6.878 +  shows "set rs \<subseteq> set xs \<union> set ys"
   6.879 +proof -
   6.880 +  from assms(1) obtain ps where ps_def: "list_of' h p ps" by (rule refs_of'_list_of')
   6.881 +  from assms(2) obtain qs where qs_def: "list_of' h q qs" by (rule refs_of'_list_of')
   6.882 +  show ?thesis using assms(1) assms(2) assms(4) assms(5)
   6.883 +  proof (induct arbitrary: xs ys rs rule: merge_induct3[OF ps_def qs_def assms(3)])
   6.884 +    case 1
   6.885 +    from 1(5) 1(7) have "rs = ys" by (fastsimp simp add: refs_of'_is_fun)
   6.886 +    thus ?case by auto
   6.887 +  next
   6.888 +    case 2
   6.889 +    from 2(5) 2(8) have "rs = xs" by (auto simp add: refs_of'_is_fun)
   6.890 +    thus ?case by auto
   6.891 +  next
   6.892 +    case (3 x xs' y ys' p q pn qn h1 r1 h' xs ys rs)
   6.893 +    from 3(9) 3(3) obtain pnrs
   6.894 +      where pnrs_def: "xs = p#pnrs"
   6.895 +      and refs_of'_pn: "refs_of' h pn pnrs"
   6.896 +      by (rule refs_of'_Node)
   6.897 +    from 3(10) 3(9) 3(11) pnrs_def refs_of'_distinct[OF 3(9)] have p_in: "p \<notin> set pnrs \<union> set ys" by auto
   6.898 +    from 3(11) pnrs_def have no_inter: "set pnrs \<inter> set ys = {}" by auto
   6.899 +    from merge_unchanged[OF refs_of'_pn 3(10) 3(6) no_inter p_in] have p_stays: "get_ref p h1 = get_ref p h" ..
   6.900 +    from 3 p_stays obtain r1s
   6.901 +      where rs_def: "rs = p#r1s" and refs_of'_r1:"refs_of' h1 r1 r1s"
   6.902 +      by (auto elim: refs_of'_set_next_ref)
   6.903 +    from 3(7)[OF refs_of'_pn 3(10) no_inter refs_of'_r1] rs_def pnrs_def show ?case by auto
   6.904 +  next
   6.905 +    case (4 x xs' y ys' p q pn qn h1 r1 h' xs ys rs)
   6.906 +    from 4(10) 4(4) obtain qnrs
   6.907 +      where qnrs_def: "ys = q#qnrs"
   6.908 +      and refs_of'_qn: "refs_of' h qn qnrs"
   6.909 +      by (rule refs_of'_Node)
   6.910 +    from 4(10) 4(9) 4(11) qnrs_def refs_of'_distinct[OF 4(10)] have q_in: "q \<notin> set xs \<union> set qnrs" by auto
   6.911 +    from 4(11) qnrs_def have no_inter: "set xs \<inter> set qnrs = {}" by auto
   6.912 +    from merge_unchanged[OF 4(9) refs_of'_qn 4(6) no_inter q_in] have q_stays: "get_ref q h1 = get_ref q h" ..
   6.913 +    from 4 q_stays obtain r1s
   6.914 +      where rs_def: "rs = q#r1s" and refs_of'_r1:"refs_of' h1 r1 r1s"
   6.915 +      by (auto elim: refs_of'_set_next_ref)
   6.916 +    from 4(7)[OF 4(9) refs_of'_qn no_inter refs_of'_r1] rs_def qnrs_def show ?case by auto
   6.917 +  qed
   6.918 +qed
   6.919 +
   6.920 +lemma
   6.921 +  assumes "list_of' h p xs"
   6.922 +  assumes "list_of' h q ys"
   6.923 +  assumes "crel (merge p q) h h' r"
   6.924 +  assumes "\<forall>qrs prs. refs_of' h q qrs \<and> refs_of' h p prs \<longrightarrow> set prs \<inter> set qrs = {}"
   6.925 +  shows "list_of' h' r (Lmerge xs ys)"
   6.926 +using assms(4)
   6.927 +proof (induct rule: merge_induct3[OF assms(1-3)])
   6.928 +  case 1
   6.929 +  thus ?case by simp
   6.930 +next
   6.931 +  case 2
   6.932 +  thus ?case by simp
   6.933 +next
   6.934 +  case (3 x xs' y ys' p q pn qn h1 r1 h')
   6.935 +  from 3(1) obtain prs where prs_def: "refs_of' h p prs" by (rule list_of'_refs_of')
   6.936 +  from 3(2) obtain qrs where qrs_def: "refs_of' h q qrs" by (rule list_of'_refs_of')
   6.937 +  from prs_def 3(3) obtain pnrs
   6.938 +    where pnrs_def: "prs = p#pnrs"
   6.939 +    and refs_of'_pn: "refs_of' h pn pnrs"
   6.940 +    by (rule refs_of'_Node)
   6.941 +  from prs_def qrs_def 3(9) pnrs_def refs_of'_distinct[OF prs_def] have p_in: "p \<notin> set pnrs \<union> set qrs" by fastsimp
   6.942 +  from prs_def qrs_def 3(9) pnrs_def have no_inter: "set pnrs \<inter> set qrs = {}" by fastsimp
   6.943 +  from no_inter refs_of'_pn qrs_def have no_inter2: "\<forall>qrs prs. refs_of' h q qrs \<and> refs_of' h pn prs \<longrightarrow> set prs \<inter> set qrs = {}"
   6.944 +    by (fastsimp dest: refs_of'_is_fun)
   6.945 +  from merge_unchanged[OF refs_of'_pn qrs_def 3(6) no_inter p_in] have p_stays: "get_ref p h1 = get_ref p h" ..
   6.946 +  from 3(7)[OF no_inter2] obtain rs where rs_def: "refs_of' h1 r1 rs" by (rule list_of'_refs_of')
   6.947 +  from refs_of'_merge[OF refs_of'_pn qrs_def 3(6) no_inter this] p_in have p_rs: "p \<notin> set rs" by auto
   6.948 +  with 3(7)[OF no_inter2] 3(1-5) 3(8) p_rs rs_def p_stays
   6.949 +  show ?case by auto
   6.950 +next
   6.951 +  case (4 x xs' y ys' p q pn qn h1 r1 h')
   6.952 +  from 4(1) obtain prs where prs_def: "refs_of' h p prs" by (rule list_of'_refs_of')
   6.953 +  from 4(2) obtain qrs where qrs_def: "refs_of' h q qrs" by (rule list_of'_refs_of')
   6.954 +  from qrs_def 4(4) obtain qnrs
   6.955 +    where qnrs_def: "qrs = q#qnrs"
   6.956 +    and refs_of'_qn: "refs_of' h qn qnrs"
   6.957 +    by (rule refs_of'_Node)
   6.958 +  from prs_def qrs_def 4(9) qnrs_def refs_of'_distinct[OF qrs_def] have q_in: "q \<notin> set prs \<union> set qnrs" by fastsimp
   6.959 +  from prs_def qrs_def 4(9) qnrs_def have no_inter: "set prs \<inter> set qnrs = {}" by fastsimp
   6.960 +  from no_inter refs_of'_qn prs_def have no_inter2: "\<forall>qrs prs. refs_of' h qn qrs \<and> refs_of' h p prs \<longrightarrow> set prs \<inter> set qrs = {}"
   6.961 +    by (fastsimp dest: refs_of'_is_fun)
   6.962 +  from merge_unchanged[OF prs_def refs_of'_qn 4(6) no_inter q_in] have q_stays: "get_ref q h1 = get_ref q h" ..
   6.963 +  from 4(7)[OF no_inter2] obtain rs where rs_def: "refs_of' h1 r1 rs" by (rule list_of'_refs_of')
   6.964 +  from refs_of'_merge[OF prs_def refs_of'_qn 4(6) no_inter this] q_in have q_rs: "q \<notin> set rs" by auto
   6.965 +  with 4(7)[OF no_inter2] 4(1-5) 4(8) q_rs rs_def q_stays
   6.966 +  show ?case by auto
   6.967 +qed
   6.968 +
   6.969 +section {* Code generation *}
   6.970 +
   6.971 +export_code merge in SML file -
   6.972 +
   6.973 +export_code rev in SML file -
   6.974 +
   6.975 +text {* A simple example program *}
   6.976 +
   6.977 +definition test_1 where "test_1 = (do ll_xs <- make_llist [1..(15::int)]; xs <- traverse ll_xs; return xs done)" 
   6.978 +definition test_2 where "test_2 = (do ll_xs <- make_llist [1..(15::int)]; ll_ys <- rev ll_xs; ys <- traverse ll_ys; return ys done)"
   6.979 +
   6.980 +definition test_3 where "test_3 =
   6.981 +  (do
   6.982 +    ll_xs \<leftarrow> make_llist (filter (%n. n mod 2 = 0) [2..8]);
   6.983 +    ll_ys \<leftarrow> make_llist (filter (%n. n mod 2 = 1) [5..11]);
   6.984 +    r \<leftarrow> Ref.new ll_xs;
   6.985 +    q \<leftarrow> Ref.new ll_ys;
   6.986 +    p \<leftarrow> merge r q;
   6.987 +    ll_zs \<leftarrow> !p;
   6.988 +    zs \<leftarrow> traverse ll_zs;
   6.989 +    return zs
   6.990 +  done)"
   6.991 +
   6.992 +ML {* @{code test_1} () *}
   6.993 +ML {* @{code test_2} () *}
   6.994 +ML {* @{code test_3} () *}
   6.995 +
   6.996 +end
   6.997 \ No newline at end of file