author | paulson |
Tue, 11 May 1999 10:33:26 +0200 | |
changeset 6633 | 2ed30ebd7e31 |
parent 6570 | a7d7985050a9 |
child 6836 | 0b06eac56dd5 |
permissions | -rw-r--r-- |
5252 | 1 |
(* Title: HOL/UNITY/Union.ML |
2 |
ID: $Id$ |
|
3 |
Author: Lawrence C Paulson, Cambridge University Computer Laboratory |
|
4 |
Copyright 1998 University of Cambridge |
|
5 |
||
6 |
Unions of programs |
|
7 |
||
8 |
From Misra's Chapter 5: Asynchronous Compositions of Programs |
|
9 |
*) |
|
10 |
||
6012
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
11 |
Addcongs [UN_cong, INT_cong]; |
5252 | 12 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
13 |
|
5867 | 14 |
(** SKIP **) |
15 |
||
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
16 |
Goal "Init SKIP = UNIV"; |
5648 | 17 |
by (simp_tac (simpset() addsimps [SKIP_def]) 1); |
5611 | 18 |
qed "Init_SKIP"; |
19 |
||
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
20 |
Goal "Acts SKIP = {Id}"; |
5648 | 21 |
by (simp_tac (simpset() addsimps [SKIP_def]) 1); |
22 |
qed "Acts_SKIP"; |
|
23 |
||
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
24 |
Addsimps [Init_SKIP, Acts_SKIP]; |
5648 | 25 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
26 |
Goal "reachable SKIP = UNIV"; |
6012
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
27 |
by (force_tac (claset() addEs [reachable.induct] |
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
28 |
addIs reachable.intrs, simpset()) 1); |
5867 | 29 |
qed "reachable_SKIP"; |
30 |
||
31 |
Addsimps [reachable_SKIP]; |
|
32 |
||
33 |
||
6012
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
34 |
(** Join **) |
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
35 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
36 |
Goal "Init (F Join G) = Init F Int Init G"; |
6012
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
37 |
by (simp_tac (simpset() addsimps [Join_def]) 1); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
38 |
qed "Init_Join"; |
5252 | 39 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
40 |
Goal "Acts (F Join G) = Acts F Un Acts G"; |
5596 | 41 |
by (auto_tac (claset(), simpset() addsimps [Join_def])); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
42 |
qed "Acts_Join"; |
5252 | 43 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
44 |
Addsimps [Init_Join]; |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
45 |
|
6012
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
46 |
|
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
47 |
(** JN **) |
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
48 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
49 |
Goalw [JOIN_def, SKIP_def] "(JN i:{}. F i) = SKIP"; |
6012
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
50 |
by Auto_tac; |
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
51 |
qed "JN_empty"; |
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
52 |
Addsimps [JN_empty]; |
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
53 |
|
6633 | 54 |
Goal "(JN i:insert a I. F i) = (F a) Join (JN i:I. F i)"; |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
55 |
by (rtac program_equalityI 1); |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
56 |
by (ALLGOALS (simp_tac (simpset() addsimps [JOIN_def, Join_def]))); |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
57 |
qed "JN_insert"; |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
58 |
Addsimps[JN_empty, JN_insert]; |
6012
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
59 |
|
5611 | 60 |
Goal "Init (JN i:I. F i) = (INT i:I. Init (F i))"; |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
61 |
by (simp_tac (simpset() addsimps [JOIN_def]) 1); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
62 |
qed "Init_JN"; |
5252 | 63 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
64 |
Goal "Acts (JN i:I. F i) = insert Id (UN i:I. Acts (F i))"; |
5596 | 65 |
by (auto_tac (claset(), simpset() addsimps [JOIN_def])); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
66 |
qed "Acts_JN"; |
5252 | 67 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
68 |
Addsimps [Init_JN]; |
5867 | 69 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
70 |
val prems = Goalw [JOIN_def] |
6633 | 71 |
"[| I=J; !!i. i:J ==> F i = G i |] ==> \ |
72 |
\ (JN i:I. F i) = (JN i:J. G i)"; |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
73 |
by (asm_simp_tac (simpset() addsimps prems) 1); |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
74 |
qed "JN_cong"; |
6012
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
75 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
76 |
Addcongs [JN_cong]; |
5584 | 77 |
|
78 |
||
5611 | 79 |
(** Algebraic laws **) |
5259 | 80 |
|
5611 | 81 |
Goal "F Join G = G Join F"; |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
82 |
by (simp_tac (simpset() addsimps [Join_def, Un_commute, Int_commute]) 1); |
5259 | 83 |
qed "Join_commute"; |
84 |
||
5611 | 85 |
Goal "(F Join G) Join H = F Join (G Join H)"; |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
86 |
by (simp_tac (simpset() addsimps Un_ac@[Join_def, Int_assoc]) 1); |
5259 | 87 |
qed "Join_assoc"; |
5596 | 88 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
89 |
Goalw [Join_def, SKIP_def] "SKIP Join F = F"; |
5611 | 90 |
by (rtac program_equalityI 1); |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
91 |
by (ALLGOALS (simp_tac (simpset() addsimps [insert_absorb]))); |
5611 | 92 |
qed "Join_SKIP_left"; |
5584 | 93 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
94 |
Goalw [Join_def, SKIP_def] "F Join SKIP = F"; |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
95 |
by (rtac program_equalityI 1); |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
96 |
by (ALLGOALS (simp_tac (simpset() addsimps [insert_absorb]))); |
5611 | 97 |
qed "Join_SKIP_right"; |
98 |
||
99 |
Addsimps [Join_SKIP_left, Join_SKIP_right]; |
|
100 |
||
101 |
Goalw [Join_def] "F Join F = F"; |
|
102 |
by (rtac program_equalityI 1); |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
103 |
by Auto_tac; |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
104 |
qed "Join_absorb"; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
105 |
|
5611 | 106 |
Addsimps [Join_absorb]; |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
107 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
108 |
|
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
109 |
|
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
110 |
(*** JN laws ***) |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
111 |
|
6633 | 112 |
(*Also follows by JN_insert and insert_absorb, but the proof is longer*) |
113 |
Goal "k:I ==> F k Join (JN i:I. F i) = (JN i:I. F i)"; |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
114 |
by (auto_tac (claset() addSIs [program_equalityI], |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
115 |
simpset() addsimps [Acts_JN, Acts_Join])); |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
116 |
qed "JN_absorb"; |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
117 |
|
6633 | 118 |
Goal "(JN i: I Un J. F i) = ((JN i: I. F i) Join (JN i:J. F i))"; |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
119 |
by (auto_tac (claset() addSIs [program_equalityI], |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
120 |
simpset() addsimps [Acts_JN, Acts_Join])); |
6633 | 121 |
qed "JN_Un"; |
5970 | 122 |
|
123 |
Goal "i: I ==> (JN i:I. c) = c"; |
|
124 |
by (auto_tac (claset() addSIs [program_equalityI], |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
125 |
simpset() addsimps [Acts_JN])); |
5970 | 126 |
qed "JN_constant"; |
127 |
||
6633 | 128 |
Goal "(JN i:I. F i Join G i) = (JN i:I. F i) Join (JN i:I. G i)"; |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
129 |
by (auto_tac (claset() addSIs [program_equalityI], |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
130 |
simpset() addsimps [Acts_JN, Acts_Join])); |
5970 | 131 |
qed "JN_Join_distrib"; |
5584 | 132 |
|
6633 | 133 |
Goal "i : I ==> (JN i:I. F i Join G) = ((JN i:I. F i) Join G)"; |
134 |
by (asm_simp_tac (simpset() addsimps [JN_Join_distrib, JN_constant]) 1); |
|
135 |
qed "JN_Join_miniscope"; |
|
136 |
||
5584 | 137 |
|
6536 | 138 |
(*** Safety: co, stable, FP ***) |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
139 |
|
6633 | 140 |
(*Fails if I={} because it collapses to SKIP : A co B*) |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
141 |
Goalw [constrains_def, JOIN_def] |
6633 | 142 |
"i : I ==> (JN i:I. F i) : A co B = (ALL i:I. F i : A co B)"; |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
143 |
by (Simp_tac 1); |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
144 |
by (Blast_tac 1); |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
145 |
qed "constrains_JN"; |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
146 |
|
6633 | 147 |
Goal "(F Join G : A co B) = (F : A co B & G : A co B)"; |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
148 |
by (auto_tac |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
149 |
(claset(), |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
150 |
simpset() addsimps [constrains_def, Join_def])); |
5620 | 151 |
qed "constrains_Join"; |
152 |
||
6633 | 153 |
(*Analogous weak versions FAIL; see Misra [1994] 5.4.1, Substitution Axiom. |
154 |
reachable (F Join G) could be much bigger than reachable F, reachable G |
|
155 |
*) |
|
6012
1894bfc4aee9
Addition of the States component; parts of Comp not working
paulson
parents:
5970
diff
changeset
|
156 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
157 |
|
6536 | 158 |
Goal "[| F : A co A'; G : B co B' |] \ |
159 |
\ ==> F Join G : (A Int B) co (A' Un B')"; |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
160 |
by (simp_tac (simpset() addsimps [constrains_Join]) 1); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
161 |
by (blast_tac (claset() addIs [constrains_weaken]) 1); |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
162 |
qed "constrains_Join_weaken"; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
163 |
|
6633 | 164 |
Goal "[| ALL i:I. F i : A i co A' i; i: I |] \ |
165 |
\ ==> (JN i:I. F i) : (INT i:I. A i) co (UN i:I. A' i)"; |
|
166 |
by (asm_simp_tac (simpset() addsimps [constrains_JN]) 1); |
|
167 |
by (blast_tac (claset() addIs [constrains_weaken]) 1); |
|
168 |
qed "constrains_JN_weaken"; |
|
169 |
||
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
170 |
Goal "i : I ==> \ |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
171 |
\ (JN i:I. F i) : stable A = (ALL i:I. F i : stable A)"; |
5584 | 172 |
by (asm_simp_tac (simpset() addsimps [stable_def, constrains_JN]) 1); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
173 |
qed "stable_JN"; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
174 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
175 |
Goal "[| ALL i:I. F i : invariant A; i : I |] \ |
5970 | 176 |
\ ==> (JN i:I. F i) : invariant A"; |
177 |
by (asm_full_simp_tac (simpset() addsimps [invariant_def, stable_JN]) 1); |
|
178 |
by (Blast_tac 1); |
|
179 |
bind_thm ("invariant_JN_I", ballI RS result()); |
|
180 |
||
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
181 |
Goal "F Join G : stable A = \ |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
182 |
\ (F : stable A & G : stable A)"; |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
183 |
by (simp_tac (simpset() addsimps [stable_def, constrains_Join]) 1); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
184 |
qed "stable_Join"; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
185 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
186 |
Goal "[| F : invariant A; G : invariant A |] \ |
5970 | 187 |
\ ==> F Join G : invariant A"; |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
188 |
by (full_simp_tac (simpset() addsimps [invariant_def, stable_Join]) 1); |
5970 | 189 |
by (Blast_tac 1); |
190 |
qed "invariant_JoinI"; |
|
191 |
||
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
192 |
Goal "i : I ==> FP (JN i:I. F i) = (INT i:I. FP (F i))"; |
5584 | 193 |
by (asm_simp_tac (simpset() addsimps [FP_def, stable_JN, INTER_def]) 1); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
194 |
qed "FP_JN"; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
195 |
|
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
196 |
|
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
197 |
(*** Progress: transient, ensures ***) |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
198 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
199 |
Goal "i : I ==> \ |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
200 |
\ (JN i:I. F i) : transient A = (EX i:I. F i : transient A)"; |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
201 |
by (auto_tac (claset(), |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
202 |
simpset() addsimps [transient_def, JOIN_def])); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
203 |
qed "transient_JN"; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
204 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
205 |
Goal "F Join G : transient A = \ |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
206 |
\ (F : transient A | G : transient A)"; |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
207 |
by (auto_tac (claset(), |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
208 |
simpset() addsimps [bex_Un, transient_def, |
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
209 |
Join_def])); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
210 |
qed "transient_Join"; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
211 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
212 |
Goal "i : I ==> \ |
6536 | 213 |
\ (JN i:I. F i) : A ensures B = \ |
214 |
\ ((ALL i:I. F i : (A-B) co (A Un B)) & \ |
|
215 |
\ (EX i:I. F i : A ensures B))"; |
|
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
216 |
by (auto_tac (claset(), |
5584 | 217 |
simpset() addsimps [ensures_def, constrains_JN, transient_JN])); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
218 |
qed "ensures_JN"; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
219 |
|
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
220 |
Goalw [ensures_def] |
6536 | 221 |
"F Join G : A ensures B = \ |
222 |
\ (F : (A-B) co (A Un B) & \ |
|
223 |
\ G : (A-B) co (A Un B) & \ |
|
224 |
\ (F : A ensures B | G : A ensures B))"; |
|
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
225 |
by (auto_tac (claset(), |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
226 |
simpset() addsimps [constrains_Join, transient_Join])); |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
227 |
qed "ensures_Join"; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
228 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
229 |
Goalw [stable_def, constrains_def, Join_def] |
6536 | 230 |
"[| F : stable A; G : A co A' |] \ |
231 |
\ ==> F Join G : A co A'"; |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
232 |
by (asm_full_simp_tac (simpset() addsimps [ball_Un]) 1); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
233 |
by (Blast_tac 1); |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
234 |
qed "stable_constrains_Join"; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
235 |
|
6633 | 236 |
(*Premise for G cannot use Always because F: Stable A is weaker than |
5648 | 237 |
G : stable A *) |
6570 | 238 |
Goal "[| F : stable A; G : invariant A |] ==> F Join G : Always A"; |
239 |
by (full_simp_tac (simpset() addsimps [Always_def, invariant_def, |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
240 |
Stable_eq_stable, stable_Join]) 1); |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
241 |
by (force_tac(claset() addIs [stable_reachable, stable_Int], |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
242 |
simpset() addsimps [Acts_Join]) 1); |
6570 | 243 |
qed "stable_Join_Always"; |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
244 |
|
6536 | 245 |
Goal "[| F : stable A; G : A ensures B |] ==> F Join G : A ensures B"; |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
246 |
by (asm_simp_tac (simpset() addsimps [ensures_Join]) 1); |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
247 |
by (asm_full_simp_tac (simpset() addsimps [stable_def, ensures_def]) 1); |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
248 |
by (etac constrains_weaken 1); |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
249 |
by Auto_tac; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
250 |
qed "ensures_stable_Join1"; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
251 |
|
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
252 |
(*As above, but exchanging the roles of F and G*) |
6536 | 253 |
Goal "[| F : A ensures B; G : stable A |] ==> F Join G : A ensures B"; |
5313
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
254 |
by (stac Join_commute 1); |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
255 |
by (blast_tac (claset() addIs [ensures_stable_Join1]) 1); |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
256 |
qed "ensures_stable_Join2"; |
1861a564d7e2
Constrains, Stable, Invariant...more of the substitution axiom, but Union
paulson
parents:
5259
diff
changeset
|
257 |
|
5648 | 258 |
|
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
259 |
(** Diff and localTo **) |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
260 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
261 |
Goalw [Join_def, Diff_def] "F Join (Diff G (Acts F)) = F Join G"; |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
262 |
by (rtac program_equalityI 1); |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
263 |
by Auto_tac; |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
264 |
qed "Join_Diff2"; |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
265 |
|
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
266 |
Goalw [Diff_def, Disjoint_def] "Disjoint F (Diff G (Acts F))"; |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
267 |
by Auto_tac; |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
268 |
qed "Diff_Disjoint"; |
5648 | 269 |
|
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
270 |
Goal "[| F Join G : v localTo F; Disjoint F G |] \ |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
271 |
\ ==> G : (INT z. stable {s. v s = z})"; |
5648 | 272 |
by (asm_full_simp_tac |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
273 |
(simpset() addsimps [localTo_def, Diff_def, Disjoint_def, |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
274 |
Acts_Join, stable_def, constrains_def]) 1); |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
275 |
by (Blast_tac 1); |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
276 |
qed "localTo_imp_stable"; |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
277 |
|
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
278 |
Goal "[| F Join G : v localTo F; (s,s') : act; \ |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
279 |
\ act : Acts G; Disjoint F G |] ==> v s' = v s"; |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
280 |
by (asm_full_simp_tac |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
281 |
(simpset() addsimps [localTo_def, Diff_def, Disjoint_def, |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
282 |
Acts_Join, stable_def, constrains_def]) 1); |
5648 | 283 |
by (Blast_tac 1); |
284 |
qed "localTo_imp_equals"; |
|
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
285 |
|
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
286 |
Goalw [localTo_def, stable_def, constrains_def] |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
287 |
"v localTo F <= (f o v) localTo F"; |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
288 |
by (Clarify_tac 1); |
5898 | 289 |
by (force_tac (claset() addSEs [allE, ballE], simpset()) 1); |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
290 |
qed "localTo_imp_o_localTo"; |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
291 |
|
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
292 |
|
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
293 |
(*** Higher-level rules involving localTo and Join ***) |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
294 |
|
6536 | 295 |
Goal "[| F : {s. P (v s) (w s)} co {s. P' (v s) (w s)}; \ |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
296 |
\ F Join G : v localTo F; \ |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
297 |
\ F Join G : w localTo F; \ |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
298 |
\ Disjoint F G |] \ |
6536 | 299 |
\ ==> F Join G : {s. P (v s) (w s)} co {s. P' (v s) (w s)}"; |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
300 |
by (auto_tac (claset(), simpset() addsimps [constrains_def, Acts_Join])); |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
301 |
by (REPEAT_FIRST (dtac localTo_imp_equals THEN' REPEAT1 o atac)); |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
302 |
by Auto_tac; |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
303 |
qed "constrains_localTo_constrains2"; |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
304 |
|
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
305 |
Goalw [stable_def] |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
306 |
"[| F : stable {s. P (v s) (w s)}; \ |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
307 |
\ F Join G : v localTo F; \ |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
308 |
\ F Join G : w localTo F; \ |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
309 |
\ Disjoint F G |] \ |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
310 |
\ ==> F Join G : stable {s. P (v s) (w s)}"; |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
311 |
by (blast_tac (claset() addIs [constrains_localTo_constrains2]) 1); |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
312 |
qed "stable_localTo_stable2"; |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
313 |
|
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
314 |
|
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
315 |
Goal "(UN k. {s. f s = k}) = UNIV"; |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
316 |
by (Blast_tac 1); |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
317 |
qed "UN_eq_UNIV"; |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
318 |
|
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
319 |
Goal "[| F : stable {s. v s <= w s}; \ |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
320 |
\ F Join G : v localTo F; \ |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
321 |
\ F Join G : Increasing w; \ |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
322 |
\ Disjoint F G |] \ |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
323 |
\ ==> F Join G : Stable {s. v s <= w s}"; |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
324 |
by (safe_tac (claset() addSDs [localTo_imp_stable])); |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
325 |
by (rewrite_goals_tac [stable_def, Stable_def, Increasing_def]); |
6536 | 326 |
by (subgoal_tac "ALL k: UNIV. ?H : ({s. v s = k} Int ?AA) Co ?AA" 1); |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
327 |
by (dtac ball_Constrains_UN 1); |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
328 |
by (full_simp_tac (simpset() addsimps [UN_eq_UNIV]) 1); |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
329 |
by (rtac ballI 1); |
6536 | 330 |
by (subgoal_tac "F Join G : ({s. v s = k} Int {s. v s <= w s}) co \ |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
331 |
\ ({s. v s = k} Un {s. v s <= w s})" 1); |
6295
351b3c2b0d83
removed the infernal States, eqStates, compatible, etc.
paulson
parents:
6019
diff
changeset
|
332 |
by (asm_simp_tac (simpset() addsimps [constrains_Join]) 2); |
5804
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
333 |
by (blast_tac (claset() addIs [constrains_weaken]) 2); |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
334 |
by (dtac (constrains_imp_Constrains RS Constrains_Int) 1 THEN etac INT_D 1); |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
335 |
by (etac Constrains_weaken 2); |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
336 |
by Auto_tac; |
8e0a4c4fd67b
Revising the Client proof as suggested by Michel Charpentier. New lemmas
paulson
parents:
5785
diff
changeset
|
337 |
qed "Increasing_localTo_Stable"; |