author | blanchet |
Fri, 01 Aug 2014 14:43:57 +0200 | |
changeset 57743 | 0af2d5dfb0ac |
parent 56199 | 8e8d28ed7529 |
child 58963 | 26bf09b95dda |
permissions | -rw-r--r-- |
37936 | 1 |
(* Title: HOL/UNITY/Comp/Alloc.thy |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
2 |
Author: Lawrence C Paulson, Cambridge University Computer Laboratory |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
3 |
Copyright 1998 University of Cambridge |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
4 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
5 |
Specification of Chandy and Charpentier's Allocator |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
6 |
*) |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
7 |
|
17310 | 8 |
theory Alloc |
21710 | 9 |
imports AllocBase "../PPROD" |
17310 | 10 |
begin |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
11 |
|
21710 | 12 |
subsection{*State definitions. OUTPUT variables are locals*} |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
13 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
14 |
record clientState = |
21710 | 15 |
giv :: "nat list" --{*client's INPUT history: tokens GRANTED*} |
16 |
ask :: "nat list" --{*client's OUTPUT history: tokens REQUESTED*} |
|
17 |
rel :: "nat list" --{*client's OUTPUT history: tokens RELEASED*} |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
18 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
19 |
record 'a clientState_d = |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
20 |
clientState + |
21710 | 21 |
dummy :: 'a --{*dummy field for new variables*} |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
22 |
|
36866 | 23 |
definition |
21710 | 24 |
--{*DUPLICATED FROM Client.thy, but with "tok" removed*} |
25 |
--{*Maybe want a special theory section to declare such maps*} |
|
17310 | 26 |
non_dummy :: "'a clientState_d => clientState" |
36866 | 27 |
where "non_dummy s = (|giv = giv s, ask = ask s, rel = rel s|)" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
28 |
|
36866 | 29 |
definition |
21710 | 30 |
--{*Renaming map to put a Client into the standard form*} |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
31 |
client_map :: "'a clientState_d => clientState*'a" |
36866 | 32 |
where "client_map = funPair non_dummy dummy" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
33 |
|
24147 | 34 |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
35 |
record allocState = |
21710 | 36 |
allocGiv :: "nat => nat list" --{*OUTPUT history: source of "giv" for i*} |
37 |
allocAsk :: "nat => nat list" --{*INPUT: allocator's copy of "ask" for i*} |
|
38 |
allocRel :: "nat => nat list" --{*INPUT: allocator's copy of "rel" for i*} |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
39 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
40 |
record 'a allocState_d = |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
41 |
allocState + |
21710 | 42 |
dummy :: 'a --{*dummy field for new variables*} |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
43 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
44 |
record 'a systemState = |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
45 |
allocState + |
21710 | 46 |
client :: "nat => clientState" --{*states of all clients*} |
47 |
dummy :: 'a --{*dummy field for new variables*} |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
48 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
49 |
|
21710 | 50 |
--{** Resource allocation system specification **} |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
51 |
|
36866 | 52 |
definition |
21710 | 53 |
--{*spec (1)*} |
17310 | 54 |
system_safety :: "'a systemState program set" |
36866 | 55 |
where "system_safety = |
15074 | 56 |
Always {s. (SUM i: lessThan Nclients. (tokens o giv o sub i o client)s) |
21710 | 57 |
\<le> NbT + (SUM i: lessThan Nclients. (tokens o rel o sub i o client)s)}" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
58 |
|
36866 | 59 |
definition |
21710 | 60 |
--{*spec (2)*} |
17310 | 61 |
system_progress :: "'a systemState program set" |
36866 | 62 |
where "system_progress = (INT i : lessThan Nclients. |
24147 | 63 |
INT h. |
64 |
{s. h \<le> (ask o sub i o client)s} LeadsTo |
|
36866 | 65 |
{s. h pfixLe (giv o sub i o client) s})" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
66 |
|
36866 | 67 |
definition |
17310 | 68 |
system_spec :: "'a systemState program set" |
36866 | 69 |
where "system_spec = system_safety Int system_progress" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
70 |
|
21710 | 71 |
--{** Client specification (required) ***} |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
72 |
|
36866 | 73 |
definition |
21710 | 74 |
--{*spec (3)*} |
17310 | 75 |
client_increasing :: "'a clientState_d program set" |
36866 | 76 |
where "client_increasing = UNIV guarantees Increasing ask Int Increasing rel" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
77 |
|
36866 | 78 |
definition |
21710 | 79 |
--{*spec (4)*} |
17310 | 80 |
client_bounded :: "'a clientState_d program set" |
36866 | 81 |
where "client_bounded = UNIV guarantees Always {s. ALL elt : set (ask s). elt \<le> NbT}" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
82 |
|
36866 | 83 |
definition |
21710 | 84 |
--{*spec (5)*} |
17310 | 85 |
client_progress :: "'a clientState_d program set" |
36866 | 86 |
where "client_progress = |
24147 | 87 |
Increasing giv guarantees |
88 |
(INT h. {s. h \<le> giv s & h pfixGe ask s} |
|
89 |
LeadsTo {s. tokens h \<le> (tokens o rel) s})" |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
90 |
|
36866 | 91 |
definition |
21710 | 92 |
--{*spec: preserves part*} |
17310 | 93 |
client_preserves :: "'a clientState_d program set" |
36866 | 94 |
where "client_preserves = preserves giv Int preserves clientState_d.dummy" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
95 |
|
36866 | 96 |
definition |
21710 | 97 |
--{*environmental constraints*} |
17310 | 98 |
client_allowed_acts :: "'a clientState_d program set" |
36866 | 99 |
where "client_allowed_acts = |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
100 |
{F. AllowedActs F = |
24147 | 101 |
insert Id (UNION (preserves (funPair rel ask)) Acts)}" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
102 |
|
36866 | 103 |
definition |
17310 | 104 |
client_spec :: "'a clientState_d program set" |
36866 | 105 |
where "client_spec = client_increasing Int client_bounded Int client_progress |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
106 |
Int client_allowed_acts Int client_preserves" |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
107 |
|
21710 | 108 |
--{** Allocator specification (required) **} |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
109 |
|
36866 | 110 |
definition |
21710 | 111 |
--{*spec (6)*} |
17310 | 112 |
alloc_increasing :: "'a allocState_d program set" |
36866 | 113 |
where "alloc_increasing = |
24147 | 114 |
UNIV guarantees |
115 |
(INT i : lessThan Nclients. Increasing (sub i o allocGiv))" |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
116 |
|
36866 | 117 |
definition |
21710 | 118 |
--{*spec (7)*} |
17310 | 119 |
alloc_safety :: "'a allocState_d program set" |
36866 | 120 |
where "alloc_safety = |
24147 | 121 |
(INT i : lessThan Nclients. Increasing (sub i o allocRel)) |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
122 |
guarantees |
24147 | 123 |
Always {s. (SUM i: lessThan Nclients. (tokens o sub i o allocGiv)s) |
21710 | 124 |
\<le> NbT + (SUM i: lessThan Nclients. (tokens o sub i o allocRel)s)}" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
125 |
|
36866 | 126 |
definition |
21710 | 127 |
--{*spec (8)*} |
17310 | 128 |
alloc_progress :: "'a allocState_d program set" |
36866 | 129 |
where "alloc_progress = |
24147 | 130 |
(INT i : lessThan Nclients. Increasing (sub i o allocAsk) Int |
131 |
Increasing (sub i o allocRel)) |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
132 |
Int |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
133 |
Always {s. ALL i<Nclients. |
24147 | 134 |
ALL elt : set ((sub i o allocAsk) s). elt \<le> NbT} |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
135 |
Int |
24147 | 136 |
(INT i : lessThan Nclients. |
137 |
INT h. {s. h \<le> (sub i o allocGiv)s & h pfixGe (sub i o allocAsk)s} |
|
138 |
LeadsTo |
|
139 |
{s. tokens h \<le> (tokens o sub i o allocRel)s}) |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
140 |
guarantees |
24147 | 141 |
(INT i : lessThan Nclients. |
142 |
INT h. {s. h \<le> (sub i o allocAsk) s} |
|
143 |
LeadsTo |
|
144 |
{s. h pfixLe (sub i o allocGiv) s})" |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
145 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
146 |
(*NOTE: to follow the original paper, the formula above should have had |
24147 | 147 |
INT h. {s. h i \<le> (sub i o allocGiv)s & h i pfixGe (sub i o allocAsk)s} |
148 |
LeadsTo |
|
149 |
{s. tokens h i \<le> (tokens o sub i o allocRel)s}) |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
150 |
thus h should have been a function variable. However, only h i is ever |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
151 |
looked at.*) |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
152 |
|
36866 | 153 |
definition |
21710 | 154 |
--{*spec: preserves part*} |
17310 | 155 |
alloc_preserves :: "'a allocState_d program set" |
36866 | 156 |
where "alloc_preserves = preserves allocRel Int preserves allocAsk Int |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
157 |
preserves allocState_d.dummy" |
24147 | 158 |
|
36866 | 159 |
definition |
21710 | 160 |
--{*environmental constraints*} |
17310 | 161 |
alloc_allowed_acts :: "'a allocState_d program set" |
36866 | 162 |
where "alloc_allowed_acts = |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
163 |
{F. AllowedActs F = |
24147 | 164 |
insert Id (UNION (preserves allocGiv) Acts)}" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
165 |
|
36866 | 166 |
definition |
17310 | 167 |
alloc_spec :: "'a allocState_d program set" |
36866 | 168 |
where "alloc_spec = alloc_increasing Int alloc_safety Int alloc_progress Int |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
169 |
alloc_allowed_acts Int alloc_preserves" |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
170 |
|
21710 | 171 |
--{** Network specification **} |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
172 |
|
36866 | 173 |
definition |
21710 | 174 |
--{*spec (9.1)*} |
17310 | 175 |
network_ask :: "'a systemState program set" |
36866 | 176 |
where "network_ask = (INT i : lessThan Nclients. |
24147 | 177 |
Increasing (ask o sub i o client) guarantees |
36866 | 178 |
((sub i o allocAsk) Fols (ask o sub i o client)))" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
179 |
|
36866 | 180 |
definition |
21710 | 181 |
--{*spec (9.2)*} |
17310 | 182 |
network_giv :: "'a systemState program set" |
36866 | 183 |
where "network_giv = (INT i : lessThan Nclients. |
24147 | 184 |
Increasing (sub i o allocGiv) |
185 |
guarantees |
|
36866 | 186 |
((giv o sub i o client) Fols (sub i o allocGiv)))" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
187 |
|
36866 | 188 |
definition |
21710 | 189 |
--{*spec (9.3)*} |
17310 | 190 |
network_rel :: "'a systemState program set" |
36866 | 191 |
where "network_rel = (INT i : lessThan Nclients. |
24147 | 192 |
Increasing (rel o sub i o client) |
193 |
guarantees |
|
36866 | 194 |
((sub i o allocRel) Fols (rel o sub i o client)))" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
195 |
|
36866 | 196 |
definition |
21710 | 197 |
--{*spec: preserves part*} |
17310 | 198 |
network_preserves :: "'a systemState program set" |
36866 | 199 |
where "network_preserves = |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
200 |
preserves allocGiv Int |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
201 |
(INT i : lessThan Nclients. preserves (rel o sub i o client) Int |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
202 |
preserves (ask o sub i o client))" |
24147 | 203 |
|
36866 | 204 |
definition |
21710 | 205 |
--{*environmental constraints*} |
17310 | 206 |
network_allowed_acts :: "'a systemState program set" |
36866 | 207 |
where "network_allowed_acts = |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
208 |
{F. AllowedActs F = |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
209 |
insert Id |
24147 | 210 |
(UNION (preserves allocRel Int |
211 |
(INT i: lessThan Nclients. preserves(giv o sub i o client))) |
|
212 |
Acts)}" |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
213 |
|
36866 | 214 |
definition |
17310 | 215 |
network_spec :: "'a systemState program set" |
36866 | 216 |
where "network_spec = network_ask Int network_giv Int |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
217 |
network_rel Int network_allowed_acts Int |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
218 |
network_preserves" |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
219 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
220 |
|
21710 | 221 |
--{** State mappings **} |
36866 | 222 |
definition |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
223 |
sysOfAlloc :: "((nat => clientState) * 'a) allocState_d => 'a systemState" |
36866 | 224 |
where "sysOfAlloc = (%s. let (cl,xtr) = allocState_d.dummy s |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
225 |
in (| allocGiv = allocGiv s, |
24147 | 226 |
allocAsk = allocAsk s, |
227 |
allocRel = allocRel s, |
|
228 |
client = cl, |
|
36866 | 229 |
dummy = xtr|))" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
230 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
231 |
|
36866 | 232 |
definition |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
233 |
sysOfClient :: "(nat => clientState) * 'a allocState_d => 'a systemState" |
36866 | 234 |
where "sysOfClient = (%(cl,al). (| allocGiv = allocGiv al, |
24147 | 235 |
allocAsk = allocAsk al, |
236 |
allocRel = allocRel al, |
|
237 |
client = cl, |
|
36866 | 238 |
systemState.dummy = allocState_d.dummy al|))" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
239 |
|
36866 | 240 |
axiomatization Alloc :: "'a allocState_d program" |
241 |
where Alloc: "Alloc : alloc_spec" |
|
24147 | 242 |
|
36866 | 243 |
axiomatization Client :: "'a clientState_d program" |
244 |
where Client: "Client : client_spec" |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
245 |
|
36866 | 246 |
axiomatization Network :: "'a systemState program" |
247 |
where Network: "Network : network_spec" |
|
248 |
||
249 |
definition System :: "'a systemState program" |
|
250 |
where "System = rename sysOfAlloc Alloc Join Network Join |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
251 |
(rename sysOfClient |
24147 | 252 |
(plam x: lessThan Nclients. rename client_map Client))" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
253 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
254 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
255 |
(** |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
256 |
locale System = |
24147 | 257 |
fixes |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
258 |
Alloc :: 'a allocState_d program |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
259 |
Client :: 'a clientState_d program |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
260 |
Network :: 'a systemState program |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
261 |
System :: 'a systemState program |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
262 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
263 |
assumes |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
264 |
Alloc "Alloc : alloc_spec" |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
265 |
Client "Client : client_spec" |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
266 |
Network "Network : network_spec" |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
267 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
268 |
defines |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
269 |
System_def |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
270 |
"System == rename sysOfAlloc Alloc |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
271 |
Join |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
272 |
Network |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
273 |
Join |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
274 |
(rename sysOfClient |
24147 | 275 |
(plam x: lessThan Nclients. rename client_map Client))" |
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
276 |
**) |
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
277 |
|
21632 | 278 |
declare subset_preserves_o [THEN [2] rev_subsetD, intro] |
279 |
declare subset_preserves_o [THEN [2] rev_subsetD, simp] |
|
280 |
declare funPair_o_distrib [simp] |
|
281 |
declare Always_INT_distrib [simp] |
|
282 |
declare o_apply [simp del] |
|
283 |
||
284 |
(*For rewriting of specifications related by "guarantees"*) |
|
285 |
lemmas [simp] = |
|
286 |
rename_image_constrains |
|
287 |
rename_image_stable |
|
288 |
rename_image_increasing |
|
289 |
rename_image_invariant |
|
290 |
rename_image_Constrains |
|
291 |
rename_image_Stable |
|
292 |
rename_image_Increasing |
|
293 |
rename_image_Always |
|
294 |
rename_image_leadsTo |
|
295 |
rename_image_LeadsTo |
|
296 |
rename_preserves |
|
297 |
rename_image_preserves |
|
298 |
lift_image_preserves |
|
299 |
bij_image_INT |
|
300 |
bij_is_inj [THEN image_Int] |
|
301 |
bij_image_Collect_eq |
|
302 |
||
303 |
ML {* |
|
304 |
(*Splits up conjunctions & intersections: like CONJUNCTS in the HOL system*) |
|
24147 | 305 |
fun list_of_Int th = |
21632 | 306 |
(list_of_Int (th RS conjunct1) @ list_of_Int (th RS conjunct2)) |
307 |
handle THM _ => (list_of_Int (th RS IntD1) @ list_of_Int (th RS IntD2)) |
|
24147 | 308 |
handle THM _ => (list_of_Int (th RS @{thm INT_D})) |
21632 | 309 |
handle THM _ => (list_of_Int (th RS bspec)) |
310 |
handle THM _ => [th]; |
|
311 |
*} |
|
312 |
||
313 |
lemmas lessThanBspec = lessThan_iff [THEN iffD2, THEN [2] bspec] |
|
314 |
||
30528 | 315 |
attribute_setup normalized = {* |
24147 | 316 |
let |
317 |
fun normalized th = |
|
318 |
normalized (th RS spec |
|
319 |
handle THM _ => th RS @{thm lessThanBspec} |
|
320 |
handle THM _ => th RS bspec |
|
321 |
handle THM _ => th RS (@{thm guarantees_INT_right_iff} RS iffD1)) |
|
322 |
handle THM _ => th; |
|
21632 | 323 |
in |
30528 | 324 |
Scan.succeed (Thm.rule_attribute (K normalized)) |
21632 | 325 |
end |
42814 | 326 |
*} |
21632 | 327 |
|
328 |
(*** bijectivity of sysOfAlloc [MUST BE AUTOMATED] ***) |
|
329 |
ML {* |
|
42767 | 330 |
fun record_auto_tac ctxt = |
42793 | 331 |
let val ctxt' = |
51717
9e7d1c139569
simplifier uses proper Proof.context instead of historic type simpset;
wenzelm
parents:
51703
diff
changeset
|
332 |
ctxt addSWrapper Record.split_wrapper |
9e7d1c139569
simplifier uses proper Proof.context instead of historic type simpset;
wenzelm
parents:
51703
diff
changeset
|
333 |
addsimps |
42795
66fcc9882784
clarified map_simpset versus Simplifier.map_simpset_global;
wenzelm
parents:
42793
diff
changeset
|
334 |
[@{thm sysOfAlloc_def}, @{thm sysOfClient_def}, |
66fcc9882784
clarified map_simpset versus Simplifier.map_simpset_global;
wenzelm
parents:
42793
diff
changeset
|
335 |
@{thm client_map_def}, @{thm non_dummy_def}, @{thm funPair_def}, |
51717
9e7d1c139569
simplifier uses proper Proof.context instead of historic type simpset;
wenzelm
parents:
51703
diff
changeset
|
336 |
@{thm o_apply}, @{thm Let_def}] |
42793 | 337 |
in auto_tac ctxt' end; |
338 |
||
21632 | 339 |
*} |
340 |
||
42814 | 341 |
method_setup record_auto = {* Scan.succeed (SIMPLE_METHOD o record_auto_tac) *} |
21632 | 342 |
|
343 |
lemma inj_sysOfAlloc [iff]: "inj sysOfAlloc" |
|
344 |
apply (unfold sysOfAlloc_def Let_def) |
|
345 |
apply (rule inj_onI) |
|
24147 | 346 |
apply record_auto |
21632 | 347 |
done |
348 |
||
21710 | 349 |
text{*We need the inverse; also having it simplifies the proof of surjectivity*} |
24147 | 350 |
lemma inv_sysOfAlloc_eq [simp]: "!!s. inv sysOfAlloc s = |
351 |
(| allocGiv = allocGiv s, |
|
352 |
allocAsk = allocAsk s, |
|
353 |
allocRel = allocRel s, |
|
21632 | 354 |
allocState_d.dummy = (client s, dummy s) |)" |
355 |
apply (rule inj_sysOfAlloc [THEN inv_f_eq]) |
|
24147 | 356 |
apply record_auto |
21632 | 357 |
done |
358 |
||
359 |
lemma surj_sysOfAlloc [iff]: "surj sysOfAlloc" |
|
40702 | 360 |
apply (simp add: surj_iff_all) |
24147 | 361 |
apply record_auto |
21632 | 362 |
done |
363 |
||
364 |
lemma bij_sysOfAlloc [iff]: "bij sysOfAlloc" |
|
365 |
apply (blast intro: bijI) |
|
366 |
done |
|
367 |
||
368 |
||
21710 | 369 |
subsubsection{*bijectivity of @{term sysOfClient}*} |
21632 | 370 |
|
371 |
lemma inj_sysOfClient [iff]: "inj sysOfClient" |
|
372 |
apply (unfold sysOfClient_def) |
|
373 |
apply (rule inj_onI) |
|
24147 | 374 |
apply record_auto |
21632 | 375 |
done |
376 |
||
24147 | 377 |
lemma inv_sysOfClient_eq [simp]: "!!s. inv sysOfClient s = |
378 |
(client s, |
|
379 |
(| allocGiv = allocGiv s, |
|
380 |
allocAsk = allocAsk s, |
|
381 |
allocRel = allocRel s, |
|
21632 | 382 |
allocState_d.dummy = systemState.dummy s|) )" |
383 |
apply (rule inj_sysOfClient [THEN inv_f_eq]) |
|
24147 | 384 |
apply record_auto |
21632 | 385 |
done |
386 |
||
387 |
lemma surj_sysOfClient [iff]: "surj sysOfClient" |
|
40702 | 388 |
apply (simp add: surj_iff_all) |
24147 | 389 |
apply record_auto |
21632 | 390 |
done |
391 |
||
392 |
lemma bij_sysOfClient [iff]: "bij sysOfClient" |
|
393 |
apply (blast intro: bijI) |
|
394 |
done |
|
395 |
||
396 |
||
21710 | 397 |
subsubsection{*bijectivity of @{term client_map}*} |
21632 | 398 |
|
399 |
lemma inj_client_map [iff]: "inj client_map" |
|
400 |
apply (unfold inj_on_def) |
|
24147 | 401 |
apply record_auto |
21632 | 402 |
done |
403 |
||
24147 | 404 |
lemma inv_client_map_eq [simp]: "!!s. inv client_map s = |
405 |
(%(x,y).(|giv = giv x, ask = ask x, rel = rel x, |
|
21632 | 406 |
clientState_d.dummy = y|)) s" |
407 |
apply (rule inj_client_map [THEN inv_f_eq]) |
|
24147 | 408 |
apply record_auto |
21632 | 409 |
done |
410 |
||
411 |
lemma surj_client_map [iff]: "surj client_map" |
|
40702 | 412 |
apply (simp add: surj_iff_all) |
24147 | 413 |
apply record_auto |
21632 | 414 |
done |
415 |
||
416 |
lemma bij_client_map [iff]: "bij client_map" |
|
417 |
apply (blast intro: bijI) |
|
418 |
done |
|
419 |
||
420 |
||
21710 | 421 |
text{*o-simprules for @{term client_map}*} |
21632 | 422 |
|
423 |
lemma fst_o_client_map: "fst o client_map = non_dummy" |
|
424 |
apply (unfold client_map_def) |
|
425 |
apply (rule fst_o_funPair) |
|
426 |
done |
|
427 |
||
56199 | 428 |
ML {* ML_Thms.bind_thms ("fst_o_client_map'", make_o_equivs @{context} @{thm fst_o_client_map}) *} |
21632 | 429 |
declare fst_o_client_map' [simp] |
430 |
||
431 |
lemma snd_o_client_map: "snd o client_map = clientState_d.dummy" |
|
432 |
apply (unfold client_map_def) |
|
433 |
apply (rule snd_o_funPair) |
|
434 |
done |
|
435 |
||
56199 | 436 |
ML {* ML_Thms.bind_thms ("snd_o_client_map'", make_o_equivs @{context} @{thm snd_o_client_map}) *} |
21632 | 437 |
declare snd_o_client_map' [simp] |
438 |
||
21710 | 439 |
|
440 |
subsection{*o-simprules for @{term sysOfAlloc} [MUST BE AUTOMATED]*} |
|
21632 | 441 |
|
442 |
lemma client_o_sysOfAlloc: "client o sysOfAlloc = fst o allocState_d.dummy " |
|
24147 | 443 |
apply record_auto |
21632 | 444 |
done |
445 |
||
56199 | 446 |
ML {* ML_Thms.bind_thms ("client_o_sysOfAlloc'", make_o_equivs @{context} @{thm client_o_sysOfAlloc}) *} |
21632 | 447 |
declare client_o_sysOfAlloc' [simp] |
448 |
||
449 |
lemma allocGiv_o_sysOfAlloc_eq: "allocGiv o sysOfAlloc = allocGiv" |
|
24147 | 450 |
apply record_auto |
21632 | 451 |
done |
452 |
||
56199 | 453 |
ML {* ML_Thms.bind_thms ("allocGiv_o_sysOfAlloc_eq'", make_o_equivs @{context} @{thm allocGiv_o_sysOfAlloc_eq}) *} |
21632 | 454 |
declare allocGiv_o_sysOfAlloc_eq' [simp] |
455 |
||
456 |
lemma allocAsk_o_sysOfAlloc_eq: "allocAsk o sysOfAlloc = allocAsk" |
|
24147 | 457 |
apply record_auto |
21632 | 458 |
done |
459 |
||
56199 | 460 |
ML {* ML_Thms.bind_thms ("allocAsk_o_sysOfAlloc_eq'", make_o_equivs @{context} @{thm allocAsk_o_sysOfAlloc_eq}) *} |
21632 | 461 |
declare allocAsk_o_sysOfAlloc_eq' [simp] |
462 |
||
463 |
lemma allocRel_o_sysOfAlloc_eq: "allocRel o sysOfAlloc = allocRel" |
|
24147 | 464 |
apply record_auto |
21632 | 465 |
done |
466 |
||
56199 | 467 |
ML {* ML_Thms.bind_thms ("allocRel_o_sysOfAlloc_eq'", make_o_equivs @{context} @{thm allocRel_o_sysOfAlloc_eq}) *} |
21632 | 468 |
declare allocRel_o_sysOfAlloc_eq' [simp] |
469 |
||
21710 | 470 |
|
471 |
subsection{* o-simprules for @{term sysOfClient} [MUST BE AUTOMATED]*} |
|
21632 | 472 |
|
473 |
lemma client_o_sysOfClient: "client o sysOfClient = fst" |
|
24147 | 474 |
apply record_auto |
21632 | 475 |
done |
476 |
||
56199 | 477 |
ML {* ML_Thms.bind_thms ("client_o_sysOfClient'", make_o_equivs @{context} @{thm client_o_sysOfClient}) *} |
21632 | 478 |
declare client_o_sysOfClient' [simp] |
479 |
||
480 |
lemma allocGiv_o_sysOfClient_eq: "allocGiv o sysOfClient = allocGiv o snd " |
|
24147 | 481 |
apply record_auto |
21632 | 482 |
done |
483 |
||
56199 | 484 |
ML {* ML_Thms.bind_thms ("allocGiv_o_sysOfClient_eq'", make_o_equivs @{context} @{thm allocGiv_o_sysOfClient_eq}) *} |
21632 | 485 |
declare allocGiv_o_sysOfClient_eq' [simp] |
486 |
||
487 |
lemma allocAsk_o_sysOfClient_eq: "allocAsk o sysOfClient = allocAsk o snd " |
|
24147 | 488 |
apply record_auto |
21632 | 489 |
done |
490 |
||
56199 | 491 |
ML {* ML_Thms.bind_thms ("allocAsk_o_sysOfClient_eq'", make_o_equivs @{context} @{thm allocAsk_o_sysOfClient_eq}) *} |
21632 | 492 |
declare allocAsk_o_sysOfClient_eq' [simp] |
493 |
||
494 |
lemma allocRel_o_sysOfClient_eq: "allocRel o sysOfClient = allocRel o snd " |
|
24147 | 495 |
apply record_auto |
21632 | 496 |
done |
497 |
||
56199 | 498 |
ML {* ML_Thms.bind_thms ("allocRel_o_sysOfClient_eq'", make_o_equivs @{context} @{thm allocRel_o_sysOfClient_eq}) *} |
21632 | 499 |
declare allocRel_o_sysOfClient_eq' [simp] |
500 |
||
501 |
lemma allocGiv_o_inv_sysOfAlloc_eq: "allocGiv o inv sysOfAlloc = allocGiv" |
|
502 |
apply (simp add: o_def) |
|
503 |
done |
|
504 |
||
56199 | 505 |
ML {* ML_Thms.bind_thms ("allocGiv_o_inv_sysOfAlloc_eq'", make_o_equivs @{context} @{thm allocGiv_o_inv_sysOfAlloc_eq}) *} |
21632 | 506 |
declare allocGiv_o_inv_sysOfAlloc_eq' [simp] |
507 |
||
508 |
lemma allocAsk_o_inv_sysOfAlloc_eq: "allocAsk o inv sysOfAlloc = allocAsk" |
|
509 |
apply (simp add: o_def) |
|
510 |
done |
|
511 |
||
56199 | 512 |
ML {* ML_Thms.bind_thms ("allocAsk_o_inv_sysOfAlloc_eq'", make_o_equivs @{context} @{thm allocAsk_o_inv_sysOfAlloc_eq}) *} |
21632 | 513 |
declare allocAsk_o_inv_sysOfAlloc_eq' [simp] |
514 |
||
515 |
lemma allocRel_o_inv_sysOfAlloc_eq: "allocRel o inv sysOfAlloc = allocRel" |
|
516 |
apply (simp add: o_def) |
|
517 |
done |
|
518 |
||
56199 | 519 |
ML {* ML_Thms.bind_thms ("allocRel_o_inv_sysOfAlloc_eq'", make_o_equivs @{context} @{thm allocRel_o_inv_sysOfAlloc_eq}) *} |
21632 | 520 |
declare allocRel_o_inv_sysOfAlloc_eq' [simp] |
521 |
||
24147 | 522 |
lemma rel_inv_client_map_drop_map: "(rel o inv client_map o drop_map i o inv sysOfClient) = |
21632 | 523 |
rel o sub i o client" |
524 |
apply (simp add: o_def drop_map_def) |
|
525 |
done |
|
526 |
||
56199 | 527 |
ML {* ML_Thms.bind_thms ("rel_inv_client_map_drop_map'", make_o_equivs @{context} @{thm rel_inv_client_map_drop_map}) *} |
21632 | 528 |
declare rel_inv_client_map_drop_map [simp] |
529 |
||
24147 | 530 |
lemma ask_inv_client_map_drop_map: "(ask o inv client_map o drop_map i o inv sysOfClient) = |
21632 | 531 |
ask o sub i o client" |
532 |
apply (simp add: o_def drop_map_def) |
|
533 |
done |
|
534 |
||
56199 | 535 |
ML {* ML_Thms.bind_thms ("ask_inv_client_map_drop_map'", make_o_equivs @{context} @{thm ask_inv_client_map_drop_map}) *} |
21632 | 536 |
declare ask_inv_client_map_drop_map [simp] |
537 |
||
538 |
||
21710 | 539 |
text{*Client : <unfolded specification> *} |
21632 | 540 |
lemmas client_spec_simps = |
541 |
client_spec_def client_increasing_def client_bounded_def |
|
542 |
client_progress_def client_allowed_acts_def client_preserves_def |
|
543 |
guarantees_Int_right |
|
544 |
||
545 |
ML {* |
|
546 |
val [Client_Increasing_ask, Client_Increasing_rel, |
|
24147 | 547 |
Client_Bounded, Client_Progress, Client_AllowedActs, |
21632 | 548 |
Client_preserves_giv, Client_preserves_dummy] = |
51717
9e7d1c139569
simplifier uses proper Proof.context instead of historic type simpset;
wenzelm
parents:
51703
diff
changeset
|
549 |
@{thm Client} |> simplify (@{context} addsimps @{thms client_spec_simps}) |
21632 | 550 |
|> list_of_Int; |
551 |
||
56199 | 552 |
ML_Thms.bind_thm ("Client_Increasing_ask", Client_Increasing_ask); |
553 |
ML_Thms.bind_thm ("Client_Increasing_rel", Client_Increasing_rel); |
|
554 |
ML_Thms.bind_thm ("Client_Bounded", Client_Bounded); |
|
555 |
ML_Thms.bind_thm ("Client_Progress", Client_Progress); |
|
556 |
ML_Thms.bind_thm ("Client_AllowedActs", Client_AllowedActs); |
|
557 |
ML_Thms.bind_thm ("Client_preserves_giv", Client_preserves_giv); |
|
558 |
ML_Thms.bind_thm ("Client_preserves_dummy", Client_preserves_dummy); |
|
21632 | 559 |
*} |
560 |
||
561 |
declare |
|
562 |
Client_Increasing_ask [iff] |
|
563 |
Client_Increasing_rel [iff] |
|
564 |
Client_Bounded [iff] |
|
565 |
Client_preserves_giv [iff] |
|
566 |
Client_preserves_dummy [iff] |
|
567 |
||
568 |
||
21710 | 569 |
text{*Network : <unfolded specification> *} |
21632 | 570 |
lemmas network_spec_simps = |
571 |
network_spec_def network_ask_def network_giv_def |
|
572 |
network_rel_def network_allowed_acts_def network_preserves_def |
|
573 |
ball_conj_distrib |
|
574 |
||
575 |
ML {* |
|
576 |
val [Network_Ask, Network_Giv, Network_Rel, Network_AllowedActs, |
|
24147 | 577 |
Network_preserves_allocGiv, Network_preserves_rel, |
578 |
Network_preserves_ask] = |
|
51717
9e7d1c139569
simplifier uses proper Proof.context instead of historic type simpset;
wenzelm
parents:
51703
diff
changeset
|
579 |
@{thm Network} |> simplify (@{context} addsimps @{thms network_spec_simps}) |
21632 | 580 |
|> list_of_Int; |
581 |
||
56199 | 582 |
ML_Thms.bind_thm ("Network_Ask", Network_Ask); |
583 |
ML_Thms.bind_thm ("Network_Giv", Network_Giv); |
|
584 |
ML_Thms.bind_thm ("Network_Rel", Network_Rel); |
|
585 |
ML_Thms.bind_thm ("Network_AllowedActs", Network_AllowedActs); |
|
586 |
ML_Thms.bind_thm ("Network_preserves_allocGiv", Network_preserves_allocGiv); |
|
587 |
ML_Thms.bind_thm ("Network_preserves_rel", Network_preserves_rel); |
|
588 |
ML_Thms.bind_thm ("Network_preserves_ask", Network_preserves_ask); |
|
21632 | 589 |
*} |
590 |
||
591 |
declare Network_preserves_allocGiv [iff] |
|
592 |
||
593 |
declare |
|
594 |
Network_preserves_rel [simp] |
|
595 |
Network_preserves_ask [simp] |
|
596 |
||
597 |
declare |
|
598 |
Network_preserves_rel [simplified o_def, simp] |
|
599 |
Network_preserves_ask [simplified o_def, simp] |
|
600 |
||
21710 | 601 |
text{*Alloc : <unfolded specification> *} |
21632 | 602 |
lemmas alloc_spec_simps = |
603 |
alloc_spec_def alloc_increasing_def alloc_safety_def |
|
604 |
alloc_progress_def alloc_allowed_acts_def alloc_preserves_def |
|
605 |
||
606 |
ML {* |
|
607 |
val [Alloc_Increasing_0, Alloc_Safety, Alloc_Progress, Alloc_AllowedActs, |
|
24147 | 608 |
Alloc_preserves_allocRel, Alloc_preserves_allocAsk, |
609 |
Alloc_preserves_dummy] = |
|
51717
9e7d1c139569
simplifier uses proper Proof.context instead of historic type simpset;
wenzelm
parents:
51703
diff
changeset
|
610 |
@{thm Alloc} |> simplify (@{context} addsimps @{thms alloc_spec_simps}) |
21632 | 611 |
|> list_of_Int; |
612 |
||
56199 | 613 |
ML_Thms.bind_thm ("Alloc_Increasing_0", Alloc_Increasing_0); |
614 |
ML_Thms.bind_thm ("Alloc_Safety", Alloc_Safety); |
|
615 |
ML_Thms.bind_thm ("Alloc_Progress", Alloc_Progress); |
|
616 |
ML_Thms.bind_thm ("Alloc_AllowedActs", Alloc_AllowedActs); |
|
617 |
ML_Thms.bind_thm ("Alloc_preserves_allocRel", Alloc_preserves_allocRel); |
|
618 |
ML_Thms.bind_thm ("Alloc_preserves_allocAsk", Alloc_preserves_allocAsk); |
|
619 |
ML_Thms.bind_thm ("Alloc_preserves_dummy", Alloc_preserves_dummy); |
|
21632 | 620 |
*} |
621 |
||
21710 | 622 |
text{*Strip off the INT in the guarantees postcondition*} |
24147 | 623 |
|
624 |
lemmas Alloc_Increasing = Alloc_Increasing_0 [normalized] |
|
21632 | 625 |
|
626 |
declare |
|
627 |
Alloc_preserves_allocRel [iff] |
|
628 |
Alloc_preserves_allocAsk [iff] |
|
629 |
Alloc_preserves_dummy [iff] |
|
630 |
||
631 |
||
21710 | 632 |
subsection{*Components Lemmas [MUST BE AUTOMATED]*} |
21632 | 633 |
|
24147 | 634 |
lemma Network_component_System: "Network Join |
635 |
((rename sysOfClient |
|
636 |
(plam x: (lessThan Nclients). rename client_map Client)) Join |
|
637 |
rename sysOfAlloc Alloc) |
|
21632 | 638 |
= System" |
21710 | 639 |
by (simp add: System_def Join_ac) |
21632 | 640 |
|
24147 | 641 |
lemma Client_component_System: "(rename sysOfClient |
642 |
(plam x: (lessThan Nclients). rename client_map Client)) Join |
|
21632 | 643 |
(Network Join rename sysOfAlloc Alloc) = System" |
21710 | 644 |
by (simp add: System_def Join_ac) |
21632 | 645 |
|
24147 | 646 |
lemma Alloc_component_System: "rename sysOfAlloc Alloc Join |
647 |
((rename sysOfClient (plam x: (lessThan Nclients). rename client_map Client)) Join |
|
21632 | 648 |
Network) = System" |
21710 | 649 |
by (simp add: System_def Join_ac) |
21632 | 650 |
|
651 |
declare |
|
652 |
Client_component_System [iff] |
|
653 |
Network_component_System [iff] |
|
654 |
Alloc_component_System [iff] |
|
655 |
||
21710 | 656 |
|
657 |
text{** These preservation laws should be generated automatically **} |
|
21632 | 658 |
|
659 |
lemma Client_Allowed [simp]: "Allowed Client = preserves rel Int preserves ask" |
|
21710 | 660 |
by (auto simp add: Allowed_def Client_AllowedActs safety_prop_Acts_iff) |
21632 | 661 |
|
24147 | 662 |
lemma Network_Allowed [simp]: "Allowed Network = |
663 |
preserves allocRel Int |
|
21632 | 664 |
(INT i: lessThan Nclients. preserves(giv o sub i o client))" |
21710 | 665 |
by (auto simp add: Allowed_def Network_AllowedActs safety_prop_Acts_iff) |
21632 | 666 |
|
667 |
lemma Alloc_Allowed [simp]: "Allowed Alloc = preserves allocGiv" |
|
21710 | 668 |
by (auto simp add: Allowed_def Alloc_AllowedActs safety_prop_Acts_iff) |
21632 | 669 |
|
21710 | 670 |
text{*needed in @{text rename_client_map_tac}*} |
21632 | 671 |
lemma OK_lift_rename_Client [simp]: "OK I (%i. lift i (rename client_map Client))" |
672 |
apply (rule OK_lift_I) |
|
673 |
apply auto |
|
674 |
apply (drule_tac w1 = rel in subset_preserves_o [THEN [2] rev_subsetD]) |
|
675 |
apply (drule_tac [2] w1 = ask in subset_preserves_o [THEN [2] rev_subsetD]) |
|
676 |
apply (auto simp add: o_def split_def) |
|
677 |
done |
|
678 |
||
21710 | 679 |
lemma fst_lift_map_eq_fst [simp]: "fst (lift_map i x) i = fst x" |
680 |
apply (insert fst_o_lift_map [of i]) |
|
24147 | 681 |
apply (drule fun_cong [where x=x]) |
40702 | 682 |
apply (simp add: o_def) |
21710 | 683 |
done |
684 |
||
685 |
lemma fst_o_lift_map' [simp]: |
|
686 |
"(f \<circ> sub i \<circ> fst \<circ> lift_map i \<circ> g) = f o fst o g" |
|
24147 | 687 |
apply (subst fst_o_lift_map [symmetric]) |
688 |
apply (simp only: o_assoc) |
|
21710 | 689 |
done |
690 |
||
21632 | 691 |
|
692 |
(*The proofs of rename_Client_Increasing, rename_Client_Bounded and |
|
693 |
rename_Client_Progress are similar. All require copying out the original |
|
694 |
Client property. A forward proof can be constructed as follows: |
|
695 |
||
696 |
Client_Increasing_ask RS |
|
697 |
(bij_client_map RS rename_rename_guarantees_eq RS iffD2) |
|
698 |
RS (lift_lift_guarantees_eq RS iffD2) |
|
699 |
RS guarantees_PLam_I |
|
700 |
RS (bij_sysOfClient RS rename_rename_guarantees_eq RS iffD2) |
|
24147 | 701 |
|> simplify (simpset() addsimps [lift_image_eq_rename, o_def, split_def, |
40702 | 702 |
surj_rename]) |
21632 | 703 |
|
704 |
However, the "preserves" property remains to be discharged, and the unfolding |
|
705 |
of "o" and "sub" complicates subsequent reasoning. |
|
706 |
||
707 |
The following tactic works for all three proofs, though it certainly looks |
|
708 |
ad-hoc! |
|
709 |
*) |
|
710 |
ML |
|
711 |
{* |
|
51717
9e7d1c139569
simplifier uses proper Proof.context instead of historic type simpset;
wenzelm
parents:
51703
diff
changeset
|
712 |
fun rename_client_map_tac ctxt = |
21632 | 713 |
EVERY [ |
51717
9e7d1c139569
simplifier uses proper Proof.context instead of historic type simpset;
wenzelm
parents:
51703
diff
changeset
|
714 |
simp_tac (ctxt addsimps [@{thm rename_guarantees_eq_rename_inv}]) 1, |
24147 | 715 |
rtac @{thm guarantees_PLam_I} 1, |
21632 | 716 |
assume_tac 2, |
24147 | 717 |
(*preserves: routine reasoning*) |
51717
9e7d1c139569
simplifier uses proper Proof.context instead of historic type simpset;
wenzelm
parents:
51703
diff
changeset
|
718 |
asm_simp_tac (ctxt addsimps [@{thm lift_preserves_sub}]) 2, |
24147 | 719 |
(*the guarantee for "lift i (rename client_map Client)" *) |
21632 | 720 |
asm_simp_tac |
51717
9e7d1c139569
simplifier uses proper Proof.context instead of historic type simpset;
wenzelm
parents:
51703
diff
changeset
|
721 |
(ctxt addsimps [@{thm lift_guarantees_eq_lift_inv}, |
24147 | 722 |
@{thm rename_guarantees_eq_rename_inv}, |
40702 | 723 |
@{thm bij_imp_bij_inv}, @{thm surj_rename}, |
24147 | 724 |
@{thm inv_inv_eq}]) 1, |
52089 | 725 |
asm_simp_tac |
726 |
(ctxt addsimps [@{thm o_def}, @{thm non_dummy_def}, @{thm guarantees_Int_right}]) 1] |
|
21632 | 727 |
*} |
728 |
||
24147 | 729 |
method_setup rename_client_map = {* |
51717
9e7d1c139569
simplifier uses proper Proof.context instead of historic type simpset;
wenzelm
parents:
51703
diff
changeset
|
730 |
Scan.succeed (fn ctxt => SIMPLE_METHOD (rename_client_map_tac ctxt)) |
42814 | 731 |
*} |
24147 | 732 |
|
21710 | 733 |
text{*Lifting @{text Client_Increasing} to @{term systemState}*} |
24147 | 734 |
lemma rename_Client_Increasing: "i : I |
735 |
==> rename sysOfClient (plam x: I. rename client_map Client) : |
|
736 |
UNIV guarantees |
|
737 |
Increasing (ask o sub i o client) Int |
|
21632 | 738 |
Increasing (rel o sub i o client)" |
24147 | 739 |
by rename_client_map |
21632 | 740 |
|
24147 | 741 |
lemma preserves_sub_fst_lift_map: "[| F : preserves w; i ~= j |] |
21632 | 742 |
==> F : preserves (sub i o fst o lift_map j o funPair v w)" |
743 |
apply (auto simp add: lift_map_def split_def linorder_neq_iff o_def) |
|
744 |
apply (drule_tac [!] subset_preserves_o [THEN [2] rev_subsetD]) |
|
745 |
apply (auto simp add: o_def) |
|
746 |
done |
|
747 |
||
24147 | 748 |
lemma client_preserves_giv_oo_client_map: "[| i < Nclients; j < Nclients |] |
21632 | 749 |
==> Client : preserves (giv o sub i o fst o lift_map j o client_map)" |
46911 | 750 |
apply (cases "i=j") |
21710 | 751 |
apply (simp, simp add: o_def non_dummy_def) |
21632 | 752 |
apply (drule Client_preserves_dummy [THEN preserves_sub_fst_lift_map]) |
753 |
apply (drule_tac [!] subset_preserves_o [THEN [2] rev_subsetD]) |
|
754 |
apply (simp add: o_def client_map_def) |
|
755 |
done |
|
756 |
||
757 |
lemma rename_sysOfClient_ok_Network: |
|
24147 | 758 |
"rename sysOfClient (plam x: lessThan Nclients. rename client_map Client) |
21632 | 759 |
ok Network" |
21710 | 760 |
by (auto simp add: ok_iff_Allowed client_preserves_giv_oo_client_map) |
21632 | 761 |
|
762 |
lemma rename_sysOfClient_ok_Alloc: |
|
24147 | 763 |
"rename sysOfClient (plam x: lessThan Nclients. rename client_map Client) |
21632 | 764 |
ok rename sysOfAlloc Alloc" |
21710 | 765 |
by (simp add: ok_iff_Allowed) |
21632 | 766 |
|
767 |
lemma rename_sysOfAlloc_ok_Network: "rename sysOfAlloc Alloc ok Network" |
|
21710 | 768 |
by (simp add: ok_iff_Allowed) |
21632 | 769 |
|
770 |
declare |
|
771 |
rename_sysOfClient_ok_Network [iff] |
|
772 |
rename_sysOfClient_ok_Alloc [iff] |
|
773 |
rename_sysOfAlloc_ok_Network [iff] |
|
774 |
||
24147 | 775 |
text{*The "ok" laws, re-oriented. |
21710 | 776 |
But not sure this works: theorem @{text ok_commute} is needed below*} |
21632 | 777 |
declare |
778 |
rename_sysOfClient_ok_Network [THEN ok_sym, iff] |
|
779 |
rename_sysOfClient_ok_Alloc [THEN ok_sym, iff] |
|
780 |
rename_sysOfAlloc_ok_Network [THEN ok_sym] |
|
781 |
||
782 |
lemma System_Increasing: "i < Nclients |
|
24147 | 783 |
==> System : Increasing (ask o sub i o client) Int |
21632 | 784 |
Increasing (rel o sub i o client)" |
785 |
apply (rule component_guaranteesD [OF rename_Client_Increasing Client_component_System]) |
|
786 |
apply auto |
|
787 |
done |
|
788 |
||
789 |
lemmas rename_guarantees_sysOfAlloc_I = |
|
45605 | 790 |
bij_sysOfAlloc [THEN rename_rename_guarantees_eq, THEN iffD2] |
21632 | 791 |
|
792 |
||
793 |
(*Lifting Alloc_Increasing up to the level of systemState*) |
|
21710 | 794 |
lemmas rename_Alloc_Increasing = |
795 |
Alloc_Increasing |
|
24147 | 796 |
[THEN rename_guarantees_sysOfAlloc_I, |
40702 | 797 |
simplified surj_rename o_def sub_apply |
24147 | 798 |
rename_image_Increasing bij_sysOfAlloc |
40702 | 799 |
allocGiv_o_inv_sysOfAlloc_eq'] |
21632 | 800 |
|
24147 | 801 |
lemma System_Increasing_allocGiv: |
21632 | 802 |
"i < Nclients ==> System : Increasing (sub i o allocGiv)" |
803 |
apply (unfold System_def) |
|
804 |
apply (simp add: o_def) |
|
805 |
apply (rule rename_Alloc_Increasing [THEN guarantees_Join_I1, THEN guaranteesD]) |
|
806 |
apply auto |
|
807 |
done |
|
21710 | 808 |
|
21632 | 809 |
|
810 |
ML {* |
|
56199 | 811 |
ML_Thms.bind_thms ("System_Increasing'", list_of_Int @{thm System_Increasing}) |
21632 | 812 |
*} |
813 |
||
814 |
declare System_Increasing' [intro!] |
|
815 |
||
21710 | 816 |
text{* Follows consequences. |
21632 | 817 |
The "Always (INT ...) formulation expresses the general safety property |
21710 | 818 |
and allows it to be combined using @{text Always_Int_rule} below. *} |
21632 | 819 |
|
24147 | 820 |
lemma System_Follows_rel: |
21632 | 821 |
"i < Nclients ==> System : ((sub i o allocRel) Fols (rel o sub i o client))" |
822 |
apply (auto intro!: Network_Rel [THEN component_guaranteesD]) |
|
24147 | 823 |
apply (simp add: ok_commute [of Network]) |
21710 | 824 |
done |
21632 | 825 |
|
24147 | 826 |
lemma System_Follows_ask: |
21632 | 827 |
"i < Nclients ==> System : ((sub i o allocAsk) Fols (ask o sub i o client))" |
21710 | 828 |
apply (auto intro!: Network_Ask [THEN component_guaranteesD]) |
24147 | 829 |
apply (simp add: ok_commute [of Network]) |
21632 | 830 |
done |
831 |
||
24147 | 832 |
lemma System_Follows_allocGiv: |
21632 | 833 |
"i < Nclients ==> System : (giv o sub i o client) Fols (sub i o allocGiv)" |
834 |
apply (auto intro!: Network_Giv [THEN component_guaranteesD] |
|
835 |
rename_Alloc_Increasing [THEN component_guaranteesD]) |
|
21710 | 836 |
apply (simp_all add: o_def non_dummy_def ok_commute [of Network]) |
21632 | 837 |
apply (auto intro!: rename_Alloc_Increasing [THEN component_guaranteesD]) |
838 |
done |
|
21710 | 839 |
|
21632 | 840 |
|
24147 | 841 |
lemma Always_giv_le_allocGiv: "System : Always (INT i: lessThan Nclients. |
21710 | 842 |
{s. (giv o sub i o client) s \<le> (sub i o allocGiv) s})" |
21632 | 843 |
apply auto |
844 |
apply (erule System_Follows_allocGiv [THEN Follows_Bounded]) |
|
845 |
done |
|
21710 | 846 |
|
21632 | 847 |
|
24147 | 848 |
lemma Always_allocAsk_le_ask: "System : Always (INT i: lessThan Nclients. |
21710 | 849 |
{s. (sub i o allocAsk) s \<le> (ask o sub i o client) s})" |
21632 | 850 |
apply auto |
851 |
apply (erule System_Follows_ask [THEN Follows_Bounded]) |
|
852 |
done |
|
21710 | 853 |
|
21632 | 854 |
|
24147 | 855 |
lemma Always_allocRel_le_rel: "System : Always (INT i: lessThan Nclients. |
21710 | 856 |
{s. (sub i o allocRel) s \<le> (rel o sub i o client) s})" |
857 |
by (auto intro!: Follows_Bounded System_Follows_rel) |
|
858 |
||
21632 | 859 |
|
21710 | 860 |
subsection{*Proof of the safety property (1)*} |
21632 | 861 |
|
21710 | 862 |
text{*safety (1), step 1 is @{text System_Follows_rel}*} |
21632 | 863 |
|
21710 | 864 |
text{*safety (1), step 2*} |
21632 | 865 |
(* i < Nclients ==> System : Increasing (sub i o allocRel) *) |
45605 | 866 |
lemmas System_Increasing_allocRel = System_Follows_rel [THEN Follows_Increasing1] |
21632 | 867 |
|
868 |
(*Lifting Alloc_safety up to the level of systemState. |
|
21710 | 869 |
Simplifying with o_def gets rid of the translations but it unfortunately |
21632 | 870 |
gets rid of the other "o"s too.*) |
871 |
||
21710 | 872 |
text{*safety (1), step 3*} |
24147 | 873 |
lemma System_sum_bounded: |
21710 | 874 |
"System : Always {s. (\<Sum>i \<in> lessThan Nclients. (tokens o sub i o allocGiv) s) |
875 |
\<le> NbT + (\<Sum>i \<in> lessThan Nclients. (tokens o sub i o allocRel) s)}" |
|
21632 | 876 |
apply (simp add: o_apply) |
24147 | 877 |
apply (insert Alloc_Safety [THEN rename_guarantees_sysOfAlloc_I]) |
40702 | 878 |
apply (simp add: o_def) |
24147 | 879 |
apply (erule component_guaranteesD) |
21710 | 880 |
apply (auto simp add: System_Increasing_allocRel [simplified sub_apply o_def]) |
21632 | 881 |
done |
882 |
||
21710 | 883 |
text{* Follows reasoning*} |
21632 | 884 |
|
24147 | 885 |
lemma Always_tokens_giv_le_allocGiv: "System : Always (INT i: lessThan Nclients. |
886 |
{s. (tokens o giv o sub i o client) s |
|
21710 | 887 |
\<le> (tokens o sub i o allocGiv) s})" |
21632 | 888 |
apply (rule Always_giv_le_allocGiv [THEN Always_weaken]) |
889 |
apply (auto intro: tokens_mono_prefix simp add: o_apply) |
|
890 |
done |
|
891 |
||
24147 | 892 |
lemma Always_tokens_allocRel_le_rel: "System : Always (INT i: lessThan Nclients. |
893 |
{s. (tokens o sub i o allocRel) s |
|
21710 | 894 |
\<le> (tokens o rel o sub i o client) s})" |
21632 | 895 |
apply (rule Always_allocRel_le_rel [THEN Always_weaken]) |
896 |
apply (auto intro: tokens_mono_prefix simp add: o_apply) |
|
897 |
done |
|
898 |
||
21710 | 899 |
text{*safety (1), step 4 (final result!) *} |
900 |
theorem System_safety: "System : system_safety" |
|
21632 | 901 |
apply (unfold system_safety_def) |
39159 | 902 |
apply (tactic {* rtac (Always_Int_rule [@{thm System_sum_bounded}, |
903 |
@{thm Always_tokens_giv_le_allocGiv}, @{thm Always_tokens_allocRel_le_rel}] RS |
|
904 |
@{thm Always_weaken}) 1 *}) |
|
21632 | 905 |
apply auto |
906 |
apply (rule setsum_fun_mono [THEN order_trans]) |
|
907 |
apply (drule_tac [2] order_trans) |
|
908 |
apply (rule_tac [2] add_le_mono [OF order_refl setsum_fun_mono]) |
|
909 |
prefer 3 apply assumption |
|
910 |
apply auto |
|
911 |
done |
|
912 |
||
21710 | 913 |
subsection {* Proof of the progress property (2) *} |
21632 | 914 |
|
21710 | 915 |
text{*progress (2), step 1 is @{text System_Follows_ask} and |
916 |
@{text System_Follows_rel}*} |
|
21632 | 917 |
|
21710 | 918 |
text{*progress (2), step 2; see also @{text System_Increasing_allocRel}*} |
21632 | 919 |
(* i < Nclients ==> System : Increasing (sub i o allocAsk) *) |
45605 | 920 |
lemmas System_Increasing_allocAsk = System_Follows_ask [THEN Follows_Increasing1] |
21632 | 921 |
|
21710 | 922 |
text{*progress (2), step 3: lifting @{text Client_Bounded} to systemState*} |
24147 | 923 |
lemma rename_Client_Bounded: "i : I |
924 |
==> rename sysOfClient (plam x: I. rename client_map Client) : |
|
925 |
UNIV guarantees |
|
21710 | 926 |
Always {s. ALL elt : set ((ask o sub i o client) s). elt \<le> NbT}" |
24147 | 927 |
by rename_client_map |
21710 | 928 |
|
21632 | 929 |
|
24147 | 930 |
lemma System_Bounded_ask: "i < Nclients |
931 |
==> System : Always |
|
21710 | 932 |
{s. ALL elt : set ((ask o sub i o client) s). elt \<le> NbT}" |
21632 | 933 |
apply (rule component_guaranteesD [OF rename_Client_Bounded Client_component_System]) |
934 |
apply auto |
|
935 |
done |
|
936 |
||
937 |
lemma Collect_all_imp_eq: "{x. ALL y. P y --> Q x y} = (INT y: {y. P y}. {x. Q x y})" |
|
938 |
apply blast |
|
939 |
done |
|
940 |
||
21710 | 941 |
text{*progress (2), step 4*} |
24147 | 942 |
lemma System_Bounded_allocAsk: "System : Always {s. ALL i<Nclients. |
21710 | 943 |
ALL elt : set ((sub i o allocAsk) s). elt \<le> NbT}" |
21632 | 944 |
apply (auto simp add: Collect_all_imp_eq) |
39159 | 945 |
apply (tactic {* rtac (Always_Int_rule [@{thm Always_allocAsk_le_ask}, |
946 |
@{thm System_Bounded_ask}] RS @{thm Always_weaken}) 1 *}) |
|
21632 | 947 |
apply (auto dest: set_mono) |
948 |
done |
|
949 |
||
21710 | 950 |
text{*progress (2), step 5 is @{text System_Increasing_allocGiv}*} |
21632 | 951 |
|
21710 | 952 |
text{*progress (2), step 6*} |
21632 | 953 |
(* i < Nclients ==> System : Increasing (giv o sub i o client) *) |
45605 | 954 |
lemmas System_Increasing_giv = System_Follows_allocGiv [THEN Follows_Increasing1] |
21632 | 955 |
|
956 |
||
24147 | 957 |
lemma rename_Client_Progress: "i: I |
958 |
==> rename sysOfClient (plam x: I. rename client_map Client) |
|
959 |
: Increasing (giv o sub i o client) |
|
960 |
guarantees |
|
961 |
(INT h. {s. h \<le> (giv o sub i o client) s & |
|
962 |
h pfixGe (ask o sub i o client) s} |
|
21710 | 963 |
LeadsTo {s. tokens h \<le> (tokens o rel o sub i o client) s})" |
24147 | 964 |
apply rename_client_map |
21632 | 965 |
apply (simp add: Client_Progress [simplified o_def]) |
966 |
done |
|
967 |
||
968 |
||
21710 | 969 |
text{*progress (2), step 7*} |
24147 | 970 |
lemma System_Client_Progress: |
971 |
"System : (INT i : (lessThan Nclients). |
|
972 |
INT h. {s. h \<le> (giv o sub i o client) s & |
|
973 |
h pfixGe (ask o sub i o client) s} |
|
21710 | 974 |
LeadsTo {s. tokens h \<le> (tokens o rel o sub i o client) s})" |
21632 | 975 |
apply (rule INT_I) |
976 |
(*Couldn't have just used Auto_tac since the "INT h" must be kept*) |
|
977 |
apply (rule component_guaranteesD [OF rename_Client_Progress Client_component_System]) |
|
978 |
apply (auto simp add: System_Increasing_giv) |
|
979 |
done |
|
980 |
||
981 |
(*Concludes |
|
24147 | 982 |
System : {s. k \<le> (sub i o allocGiv) s} |
21632 | 983 |
LeadsTo |
21710 | 984 |
{s. (sub i o allocAsk) s \<le> (ask o sub i o client) s} Int |
985 |
{s. k \<le> (giv o sub i o client) s} *) |
|
21632 | 986 |
|
21710 | 987 |
lemmas System_lemma1 = |
988 |
Always_LeadsToD [OF System_Follows_ask [THEN Follows_Bounded] |
|
989 |
System_Follows_allocGiv [THEN Follows_LeadsTo]] |
|
21632 | 990 |
|
21710 | 991 |
lemmas System_lemma2 = |
992 |
PSP_Stable [OF System_lemma1 |
|
24147 | 993 |
System_Follows_ask [THEN Follows_Increasing1, THEN IncreasingD]] |
21710 | 994 |
|
995 |
||
24147 | 996 |
lemma System_lemma3: "i < Nclients |
997 |
==> System : {s. h \<le> (sub i o allocGiv) s & |
|
998 |
h pfixGe (sub i o allocAsk) s} |
|
999 |
LeadsTo |
|
1000 |
{s. h \<le> (giv o sub i o client) s & |
|
21632 | 1001 |
h pfixGe (ask o sub i o client) s}" |
1002 |
apply (rule single_LeadsTo_I) |
|
45600
1bbbac9a0cb0
'lemmas' / 'theorems' commands allow 'for' fixes and standardize the result before storing;
wenzelm
parents:
44871
diff
changeset
|
1003 |
apply (rule_tac k1 = h and x1 = "(sub i o allocAsk) s" |
21710 | 1004 |
in System_lemma2 [THEN LeadsTo_weaken]) |
21632 | 1005 |
apply auto |
21710 | 1006 |
apply (blast intro: trans_Ge [THEN trans_genPrefix, THEN transD] prefix_imp_pfixGe) |
21632 | 1007 |
done |
1008 |
||
1009 |
||
21710 | 1010 |
text{*progress (2), step 8: Client i's "release" action is visible system-wide*} |
24147 | 1011 |
lemma System_Alloc_Client_Progress: "i < Nclients |
1012 |
==> System : {s. h \<le> (sub i o allocGiv) s & |
|
1013 |
h pfixGe (sub i o allocAsk) s} |
|
21710 | 1014 |
LeadsTo {s. tokens h \<le> (tokens o sub i o allocRel) s}" |
21632 | 1015 |
apply (rule LeadsTo_Trans) |
1016 |
prefer 2 |
|
1017 |
apply (drule System_Follows_rel [THEN |
|
1018 |
mono_tokens [THEN mono_Follows_o, THEN [2] rev_subsetD], |
|
1019 |
THEN Follows_LeadsTo]) |
|
1020 |
apply (simp add: o_assoc) |
|
1021 |
apply (rule LeadsTo_Trans) |
|
1022 |
apply (cut_tac [2] System_Client_Progress) |
|
1023 |
prefer 2 |
|
1024 |
apply (blast intro: LeadsTo_Basis) |
|
21710 | 1025 |
apply (erule System_lemma3) |
21632 | 1026 |
done |
1027 |
||
21710 | 1028 |
text{*Lifting @{text Alloc_Progress} up to the level of systemState*} |
21632 | 1029 |
|
21710 | 1030 |
text{*progress (2), step 9*} |
24147 | 1031 |
lemma System_Alloc_Progress: |
1032 |
"System : (INT i : (lessThan Nclients). |
|
1033 |
INT h. {s. h \<le> (sub i o allocAsk) s} |
|
21632 | 1034 |
LeadsTo {s. h pfixLe (sub i o allocGiv) s})" |
1035 |
apply (simp only: o_apply sub_def) |
|
24147 | 1036 |
apply (insert Alloc_Progress [THEN rename_guarantees_sysOfAlloc_I]) |
32139 | 1037 |
apply (simp add: o_def del: INT_iff) |
21710 | 1038 |
apply (erule component_guaranteesD) |
24147 | 1039 |
apply (auto simp add: |
21710 | 1040 |
System_Increasing_allocRel [simplified sub_apply o_def] |
1041 |
System_Increasing_allocAsk [simplified sub_apply o_def] |
|
1042 |
System_Bounded_allocAsk [simplified sub_apply o_def] |
|
1043 |
System_Alloc_Client_Progress [simplified sub_apply o_def]) |
|
21632 | 1044 |
done |
1045 |
||
21710 | 1046 |
text{*progress (2), step 10 (final result!) *} |
21632 | 1047 |
lemma System_Progress: "System : system_progress" |
1048 |
apply (unfold system_progress_def) |
|
1049 |
apply (cut_tac System_Alloc_Progress) |
|
1050 |
apply (blast intro: LeadsTo_Trans |
|
1051 |
System_Follows_allocGiv [THEN Follows_LeadsTo_pfixLe] |
|
1052 |
System_Follows_ask [THEN Follows_LeadsTo]) |
|
1053 |
done |
|
1054 |
||
1055 |
||
21710 | 1056 |
theorem System_correct: "System : system_spec" |
21632 | 1057 |
apply (unfold system_spec_def) |
1058 |
apply (blast intro: System_safety System_Progress) |
|
1059 |
done |
|
1060 |
||
1061 |
||
21710 | 1062 |
text{* Some obsolete lemmas *} |
21632 | 1063 |
|
24147 | 1064 |
lemma non_dummy_eq_o_funPair: "non_dummy = (% (g,a,r). (| giv = g, ask = a, rel = r |)) o |
21632 | 1065 |
(funPair giv (funPair ask rel))" |
1066 |
apply (rule ext) |
|
1067 |
apply (auto simp add: o_def non_dummy_def) |
|
1068 |
done |
|
1069 |
||
24147 | 1070 |
lemma preserves_non_dummy_eq: "(preserves non_dummy) = |
21632 | 1071 |
(preserves rel Int preserves ask Int preserves giv)" |
1072 |
apply (simp add: non_dummy_eq_o_funPair) |
|
1073 |
apply auto |
|
1074 |
apply (drule_tac w1 = rel in subset_preserves_o [THEN [2] rev_subsetD]) |
|
1075 |
apply (drule_tac [2] w1 = ask in subset_preserves_o [THEN [2] rev_subsetD]) |
|
1076 |
apply (drule_tac [3] w1 = giv in subset_preserves_o [THEN [2] rev_subsetD]) |
|
1077 |
apply (auto simp add: o_def) |
|
1078 |
done |
|
1079 |
||
21710 | 1080 |
text{*Could go to Extend.ML*} |
21632 | 1081 |
lemma bij_fst_inv_inv_eq: "bij f ==> fst (inv (%(x, u). inv f x) z) = f z" |
1082 |
apply (rule fst_inv_equalityI) |
|
1083 |
apply (rule_tac f = "%z. (f z, ?h z) " in surjI) |
|
1084 |
apply (simp add: bij_is_inj inv_f_f) |
|
1085 |
apply (simp add: bij_is_surj surj_f_inv_f) |
|
1086 |
done |
|
11194
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
1087 |
|
ea13ff5a26d1
reorganization of HOL/UNITY, moving examples to subdirectories Simple and Comp
paulson
parents:
diff
changeset
|
1088 |
end |