author | wenzelm |
Mon, 13 Mar 2000 13:21:39 +0100 | |
changeset 8434 | 5e4bba59bfaa |
parent 8327 | 108fcc85a767 |
child 8849 | f1933a670ae4 |
permissions | -rw-r--r-- |
6828 | 1 |
(* Title: HOL/UNITY/Alloc |
2 |
ID: $Id$ |
|
3 |
Author: Lawrence C Paulson, Cambridge University Computer Laboratory |
|
4 |
Copyright 1998 University of Cambridge |
|
5 |
||
6 |
Specification of Chandy and Charpentier's Allocator |
|
7540 | 7 |
|
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
8 |
Goal "(plam x: lessThan Nclients. Client) = x"; |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
9 |
Client :: (clientState * ((nat => clientState) * 'b)) program |
6828 | 10 |
*) |
11 |
||
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
12 |
(***USEFUL??*) |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
13 |
Goal "surj h ==> h `` {s. P (h s)} = {s. P s}"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
14 |
by Auto_tac; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
15 |
by (force_tac (claset() addSIs [exI, surj_f_inv_f RS sym], |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
16 |
simpset() addsimps [surj_f_inv_f]) 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
17 |
qed "surj_image_Collect_lemma"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
18 |
|
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
19 |
|
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
20 |
AddIs [impOfSubs subset_preserves_o]; |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
21 |
Addsimps [funPair_o_distrib]; |
8327 | 22 |
Addsimps [Always_INT_distrib]; |
8067 | 23 |
Delsimps [o_apply]; |
24 |
||
8314 | 25 |
(*Eliminate the "o" operator*) |
7841 | 26 |
val o_simp = simplify (simpset() addsimps [o_def]); |
7399
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
27 |
|
8314 | 28 |
(*For rewriting of specifications related by "guarantees"*) |
29 |
Addsimps [rename_image_constrains, rename_image_stable, |
|
30 |
rename_image_increasing, rename_image_invariant, |
|
31 |
rename_image_Constrains, rename_image_Stable, |
|
32 |
rename_image_Increasing, rename_image_Always, |
|
8327 | 33 |
rename_image_leadsTo, rename_image_LeadsTo, |
34 |
rename_preserves, |
|
35 |
bij_image_INT, bij_is_inj RS image_Int, bij_image_Collect_eq]; |
|
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
36 |
|
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
37 |
(*Splits up conjunctions & intersections: like CONJUNCTS in the HOL system*) |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
38 |
fun list_of_Int th = |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
39 |
(list_of_Int (th RS conjunct1) @ list_of_Int (th RS conjunct2)) |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
40 |
handle THM _ => (list_of_Int (th RS IntD1) @ list_of_Int (th RS IntD2)) |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
41 |
handle THM _ => (list_of_Int (th RS INT_D)) |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
42 |
handle THM _ => [th]; |
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
43 |
|
8314 | 44 |
(*Used just once, for Alloc_Increasing*) |
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
45 |
val lessThanBspec = lessThan_iff RS iffD2 RSN (2, bspec); |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
46 |
fun normalize th = |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
47 |
normalize (th RS spec |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
48 |
handle THM _ => th RS lessThanBspec |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
49 |
handle THM _ => th RS bspec |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
50 |
handle THM _ => th RS (guarantees_INT_right_iff RS iffD1)) |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
51 |
handle THM _ => th; |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
52 |
|
8067 | 53 |
|
7538 | 54 |
Goal "(ALL i: lessThan n. f i <= g i) --> sum f n <= sum g n"; |
55 |
by (induct_tac "n" 1); |
|
56 |
by Auto_tac; |
|
57 |
by (dres_inst_tac [("x","n")] bspec 1); |
|
58 |
by Auto_tac; |
|
59 |
by (arith_tac 1); |
|
60 |
qed_spec_mp "sum_mono"; |
|
61 |
||
7540 | 62 |
Goal "ALL xs. xs <= ys --> tokens xs <= tokens ys"; |
63 |
by (induct_tac "ys" 1); |
|
64 |
by (auto_tac (claset(), simpset() addsimps [prefix_Cons])); |
|
65 |
qed_spec_mp "tokens_mono_prefix"; |
|
66 |
||
67 |
Goalw [mono_def] "mono tokens"; |
|
68 |
by (blast_tac (claset() addIs [tokens_mono_prefix]) 1); |
|
69 |
qed "mono_tokens"; |
|
7399
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
70 |
|
8314 | 71 |
|
72 |
(*** bijectivity of sysOfAlloc [MUST BE AUTOMATED] ***) |
|
73 |
||
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
74 |
Goalw [sysOfAlloc_def, Let_def] "inj sysOfAlloc"; |
6828 | 75 |
by (rtac injI 1); |
7347 | 76 |
by (auto_tac (claset() addSWrapper record_split_wrapper, simpset())); |
6828 | 77 |
qed "inj_sysOfAlloc"; |
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
78 |
AddIffs [inj_sysOfAlloc]; |
7399
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
79 |
|
8314 | 80 |
(*We need the inverse; also having it simplifies the proof of surjectivity*) |
7399
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
81 |
Goal "!!s. inv sysOfAlloc s = \ |
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
82 |
\ (| allocGiv = allocGiv s, \ |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
83 |
\ allocAsk = allocAsk s, \ |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
84 |
\ allocRel = allocRel s, \ |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
85 |
\ allocState_u.extra = (client s, extra s) |)"; |
7399
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
86 |
by (rtac (inj_sysOfAlloc RS inv_f_eq) 1); |
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
87 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
88 |
simpset() addsimps [sysOfAlloc_def, Let_def])); |
7399
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
89 |
qed "inv_sysOfAlloc_eq"; |
7538 | 90 |
Addsimps [inv_sysOfAlloc_eq]; |
7399
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
91 |
|
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
92 |
Goal "surj sysOfAlloc"; |
8327 | 93 |
by (simp_tac (simpset() addsimps [surj_iff, expand_fun_eq, o_apply]) 1); |
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
94 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
95 |
simpset() addsimps [sysOfAlloc_def, Let_def])); |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
96 |
qed "surj_sysOfAlloc"; |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
97 |
AddIffs [surj_sysOfAlloc]; |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
98 |
|
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
99 |
Goal "bij sysOfAlloc"; |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
100 |
by (blast_tac (claset() addIs [bijI]) 1); |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
101 |
qed "bij_sysOfAlloc"; |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
102 |
AddIffs [bij_sysOfAlloc]; |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
103 |
|
8314 | 104 |
|
105 |
(*** bijectivity of sysOfClient ***) |
|
106 |
||
7347 | 107 |
Goalw [sysOfClient_def] "inj sysOfClient"; |
108 |
by (rtac injI 1); |
|
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
109 |
by (auto_tac (claset() addSWrapper record_split_wrapper, simpset())); |
7347 | 110 |
qed "inj_sysOfClient"; |
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
111 |
AddIffs [inj_sysOfClient]; |
6828 | 112 |
|
7347 | 113 |
Goal "!!s. inv sysOfClient s = \ |
114 |
\ (client s, \ |
|
115 |
\ (| allocGiv = allocGiv s, \ |
|
116 |
\ allocAsk = allocAsk s, \ |
|
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
117 |
\ allocRel = allocRel s, \ |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
118 |
\ allocState_u.extra = systemState.extra s|) )"; |
7347 | 119 |
by (rtac (inj_sysOfClient RS inv_f_eq) 1); |
7399
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
120 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
121 |
simpset() addsimps [sysOfClient_def])); |
7365 | 122 |
qed "inv_sysOfClient_eq"; |
7689 | 123 |
Addsimps [inv_sysOfClient_eq]; |
6837 | 124 |
|
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
125 |
Goal "surj sysOfClient"; |
8327 | 126 |
by (simp_tac (simpset() addsimps [surj_iff, expand_fun_eq, o_apply]) 1); |
8286
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
127 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
128 |
simpset() addsimps [sysOfClient_def])); |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
129 |
qed "surj_sysOfClient"; |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
130 |
AddIffs [surj_sysOfClient]; |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
131 |
|
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
132 |
Goal "bij sysOfClient"; |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
133 |
by (blast_tac (claset() addIs [bijI]) 1); |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
134 |
qed "bij_sysOfClient"; |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
135 |
AddIffs [bij_sysOfClient]; |
d4b895d3afa7
not working yet. partial conversion to use "rename" instead of "extend"
paulson
parents:
8251
diff
changeset
|
136 |
|
6837 | 137 |
|
8314 | 138 |
(*** bijectivity of client_map ***) |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
139 |
|
8314 | 140 |
Goal "inj client_map"; |
141 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
|
142 |
simpset() addsimps [client_map_def, non_extra_def, inj_on_def])); |
|
143 |
qed "inj_client_map"; |
|
144 |
AddIffs [inj_client_map]; |
|
145 |
||
146 |
Goal "!!s. inv client_map s = \ |
|
147 |
\ (%(x,y).(|giv = giv x, ask = ask x, rel = rel x, \ |
|
148 |
\ clientState_u.extra = y|)) s"; |
|
149 |
by (rtac (inj_client_map RS inv_f_eq) 1); |
|
150 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
|
151 |
simpset() addsimps [client_map_def, funPair_def, non_extra_def])); |
|
152 |
qed "inv_client_map_eq"; |
|
153 |
Addsimps [inv_client_map_eq]; |
|
154 |
||
155 |
Goal "surj client_map"; |
|
8327 | 156 |
by (simp_tac (simpset() addsimps [surj_iff, expand_fun_eq, o_apply]) 1); |
8314 | 157 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
158 |
simpset() addsimps [client_map_def, non_extra_def])); |
|
159 |
qed "surj_client_map"; |
|
160 |
AddIffs [surj_client_map]; |
|
161 |
||
162 |
Goal "bij client_map"; |
|
163 |
by (blast_tac (claset() addIs [bijI]) 1); |
|
164 |
qed "bij_client_map"; |
|
165 |
AddIffs [bij_client_map]; |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
166 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
167 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
168 |
(** o-simprules for client_map **) |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
169 |
|
8327 | 170 |
Goalw [client_map_def] "fst o client_map = non_extra"; |
171 |
by (rtac fst_o_funPair 1); |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
172 |
qed "fst_o_client_map"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
173 |
Addsimps (make_o_equivs fst_o_client_map); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
174 |
|
8327 | 175 |
Goalw [client_map_def] "snd o client_map = clientState_u.extra"; |
176 |
by (rtac snd_o_funPair 1); |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
177 |
qed "snd_o_client_map"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
178 |
Addsimps (make_o_equivs snd_o_client_map); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
179 |
|
8327 | 180 |
(** o-simprules for sysOfAlloc [MUST BE AUTOMATED] **) |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
181 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
182 |
Goal "client o sysOfAlloc = fst o allocState_u.extra "; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
183 |
by (rtac ext 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
184 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
8327 | 185 |
simpset() addsimps [o_apply, sysOfAlloc_def, Let_def])); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
186 |
qed "client_o_sysOfAlloc"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
187 |
Addsimps (make_o_equivs client_o_sysOfAlloc); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
188 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
189 |
Goal "allocGiv o sysOfAlloc = allocGiv"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
190 |
by (rtac ext 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
191 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
8327 | 192 |
simpset() addsimps [sysOfAlloc_def, Let_def, o_apply])); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
193 |
qed "allocGiv_o_sysOfAlloc_eq"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
194 |
Addsimps (make_o_equivs allocGiv_o_sysOfAlloc_eq); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
195 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
196 |
Goal "allocAsk o sysOfAlloc = allocAsk"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
197 |
by (rtac ext 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
198 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
8327 | 199 |
simpset() addsimps [sysOfAlloc_def, Let_def, o_apply])); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
200 |
qed "allocAsk_o_sysOfAlloc_eq"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
201 |
Addsimps (make_o_equivs allocAsk_o_sysOfAlloc_eq); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
202 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
203 |
Goal "allocRel o sysOfAlloc = allocRel"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
204 |
by (rtac ext 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
205 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
8327 | 206 |
simpset() addsimps [sysOfAlloc_def, Let_def, o_apply])); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
207 |
qed "allocRel_o_sysOfAlloc_eq"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
208 |
Addsimps (make_o_equivs allocRel_o_sysOfAlloc_eq); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
209 |
|
8327 | 210 |
(** o-simprules for sysOfClient [MUST BE AUTOMATED] **) |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
211 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
212 |
Goal "client o sysOfClient = fst"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
213 |
by (rtac ext 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
214 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
8327 | 215 |
simpset() addsimps [o_apply, sysOfClient_def])); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
216 |
qed "client_o_sysOfClient"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
217 |
Addsimps (make_o_equivs client_o_sysOfClient); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
218 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
219 |
Goal "allocGiv o sysOfClient = allocGiv o snd "; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
220 |
by (rtac ext 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
221 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
8327 | 222 |
simpset() addsimps [sysOfClient_def, o_apply])); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
223 |
qed "allocGiv_o_sysOfClient_eq"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
224 |
Addsimps (make_o_equivs allocGiv_o_sysOfClient_eq); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
225 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
226 |
Goal "allocAsk o sysOfClient = allocAsk o snd "; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
227 |
by (rtac ext 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
228 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
8327 | 229 |
simpset() addsimps [sysOfClient_def, o_apply])); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
230 |
qed "allocAsk_o_sysOfClient_eq"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
231 |
Addsimps (make_o_equivs allocAsk_o_sysOfClient_eq); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
232 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
233 |
Goal "allocRel o sysOfClient = allocRel o snd "; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
234 |
by (rtac ext 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
235 |
by (auto_tac (claset() addSWrapper record_split_wrapper, |
8327 | 236 |
simpset() addsimps [sysOfClient_def, o_apply])); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
237 |
qed "allocRel_o_sysOfClient_eq"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
238 |
Addsimps (make_o_equivs allocRel_o_sysOfClient_eq); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
239 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
240 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
241 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
242 |
(** |
7365 | 243 |
Open_locale "System"; |
244 |
||
245 |
val Alloc = thm "Alloc"; |
|
246 |
val Client = thm "Client"; |
|
247 |
val Network = thm "Network"; |
|
248 |
val System_def = thm "System_def"; |
|
8314 | 249 |
|
250 |
(*CANNOT use bind_thm: it puts the theorem into standard form, in effect |
|
251 |
exporting it from the locale*) |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
252 |
**) |
7365 | 253 |
|
254 |
AddIffs [finite_lessThan]; |
|
255 |
||
256 |
(*Client : <unfolded specification> *) |
|
257 |
val Client_Spec = |
|
258 |
rewrite_rule [client_spec_def, client_increasing_def, |
|
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
259 |
client_bounded_def, client_progress_def, |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
260 |
client_preserves_def] Client; |
7365 | 261 |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
262 |
val [Client_Increasing_ask, Client_Increasing_rel, |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
263 |
Client_Bounded, Client_Progress, Client_preserves_giv, |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
264 |
Client_preserves_extra] = |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
265 |
Client_Spec |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
266 |
|> simplify (simpset() addsimps [guarantees_Int_right]) |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
267 |
|> list_of_Int; |
7365 | 268 |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
269 |
AddIffs [Client_Increasing_ask, Client_Increasing_rel, Client_Bounded, |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
270 |
Client_preserves_giv, Client_preserves_extra]; |
6828 | 271 |
|
272 |
||
7365 | 273 |
(*Network : <unfolded specification> *) |
274 |
val Network_Spec = |
|
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
275 |
rewrite_rule [network_spec_def, network_ask_def, network_giv_def, |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
276 |
network_rel_def, network_preserves_def] Network; |
7365 | 277 |
|
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
278 |
val [Network_Ask, Network_Giv, Network_Rel, |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
279 |
Network_preserves_allocGiv, Network_preserves_rel_ask] = |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
280 |
list_of_Int Network_Spec; |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
281 |
|
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
282 |
AddIffs [Network_preserves_allocGiv]; |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
283 |
|
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
284 |
Addsimps (Network_preserves_rel_ask |> simplify (simpset()) |> list_of_Int); |
7365 | 285 |
|
286 |
||
287 |
(*Alloc : <unfolded specification> *) |
|
288 |
val Alloc_Spec = |
|
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
289 |
rewrite_rule [alloc_spec_def, alloc_increasing_def, alloc_safety_def, |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
290 |
alloc_progress_def, alloc_preserves_def] Alloc; |
7365 | 291 |
|
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
292 |
val [Alloc_Increasing_0, Alloc_Safety, |
8069
19b9f92ca503
working with weak LeadsTo in guarantees precondition\!
paulson
parents:
8067
diff
changeset
|
293 |
Alloc_Progress, Alloc_preserves] = list_of_Int Alloc_Spec; |
7399
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
294 |
|
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
295 |
(*Strip off the INT in the guarantees postcondition*) |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
296 |
val Alloc_Increasing = normalize Alloc_Increasing_0; |
7365 | 297 |
|
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
298 |
AddIffs (Alloc_preserves |> simplify (simpset()) |> list_of_Int); |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
299 |
|
8327 | 300 |
(** Components lemmas [MUST BE AUTOMATED] **) |
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
301 |
|
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
302 |
Goal "Network Join \ |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
303 |
\ ((rename sysOfClient \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
304 |
\ (plam x: lessThan Nclients. rename client_map Client)) Join \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
305 |
\ rename sysOfAlloc Alloc) \ |
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
306 |
\ = System"; |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
307 |
by (simp_tac (simpset() addsimps System_def::Join_ac) 1); |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
308 |
qed "Network_component_System"; |
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
309 |
|
8314 | 310 |
Goal "(rename sysOfClient \ |
311 |
\ (plam x: lessThan Nclients. rename client_map Client)) Join \ |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
312 |
\ (Network Join rename sysOfAlloc Alloc) = System"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
313 |
by (simp_tac (simpset() addsimps System_def::Join_ac) 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
314 |
qed "Client_component_System"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
315 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
316 |
Goal "rename sysOfAlloc Alloc Join \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
317 |
\ ((rename sysOfClient (plam x: lessThan Nclients. rename client_map Client)) Join \ |
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
318 |
\ Network) = System"; |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
319 |
by (simp_tac (simpset() addsimps System_def::Join_ac) 1); |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
320 |
qed "Alloc_component_System"; |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
321 |
|
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
322 |
AddIffs [Client_component_System, Network_component_System, |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
323 |
Alloc_component_System]; |
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
324 |
|
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
325 |
(** These preservation laws should be generated automatically **) |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
326 |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
327 |
AddIs [impOfSubs subset_preserves_o]; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
328 |
Addsimps [impOfSubs subset_preserves_o]; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
329 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
330 |
(*Lifting Client_Increasing to systemState*) |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
331 |
Goal "i : I \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
332 |
\ ==> rename sysOfClient (plam x: I. rename client_map Client) : \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
333 |
\ UNIV \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
334 |
\ guarantees[(funPair rel ask) o sub i o client] \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
335 |
\ Increasing (ask o sub i o client) Int \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
336 |
\ Increasing (rel o sub i o client)"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
337 |
by (simp_tac (simpset() addsimps [rename_guarantees_eq_rename_inv]) 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
338 |
by (rtac guarantees_PLam_I 1); |
8314 | 339 |
by (assume_tac 2); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
340 |
(*preserves: routine reasoning*) |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
341 |
by (asm_simp_tac (simpset() addsimps [lift_preserves_sub]) 2); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
342 |
(*the guarantee for "lift i (rename client_map Client)" *) |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
343 |
by (asm_simp_tac |
8327 | 344 |
(simpset() addsimps [lift_guarantees_eq_lift_inv, |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
345 |
rename_guarantees_eq_rename_inv, |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
346 |
bij_imp_bij_inv, surj_rename RS surj_range, |
8314 | 347 |
inv_inv_eq]) 1); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
348 |
by (asm_simp_tac |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
349 |
(simpset() addsimps [o_def, non_extra_def, guarantees_Int_right]) 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
350 |
qed "rename_Client_Increasing"; |
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
351 |
|
8327 | 352 |
(*The proofs of rename_Client_Bounded and rename_Client_Progress are |
353 |
similar to the one above. All require copying out the original Client |
|
354 |
property. A forward proof can be constructed as follows: |
|
355 |
||
356 |
Client_Increasing_ask RS |
|
357 |
(bij_client_map RS rename_rename_guarantees_eq RS iffD2) |
|
358 |
RS (lift_lift_guarantees_eq RS iffD2) |
|
359 |
RS guarantees_PLam_I |
|
360 |
RS (bij_sysOfClient RS rename_rename_guarantees_eq RS iffD2) |
|
361 |
|> simplify (simpset() addsimps [lift_image_eq_rename, o_def, split_def, |
|
362 |
surj_rename RS surj_range]); |
|
363 |
||
364 |
However, the "preserves" property remains to be discharged, and the unfolding |
|
365 |
of "o" and "sub" complicates subsequent reasoning. |
|
366 |
*) |
|
367 |
||
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
368 |
Goal "i < Nclients \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
369 |
\ ==> System : Increasing (ask o sub i o client) Int \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
370 |
\ Increasing (rel o sub i o client)"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
371 |
by (rtac ([rename_Client_Increasing, |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
372 |
Client_component_System] MRS component_guaranteesD) 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
373 |
by Auto_tac; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
374 |
qed "System_Increasing"; |
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
375 |
|
8327 | 376 |
bind_thm ("rename_guarantees_sysOfAlloc_I", |
377 |
bij_sysOfAlloc RS rename_rename_guarantees_eq RS iffD2); |
|
378 |
||
379 |
||
8314 | 380 |
(*Lifting Alloc_Increasing up to the level of systemState*) |
381 |
val rename_Alloc_Increasing = |
|
8327 | 382 |
Alloc_Increasing RS rename_guarantees_sysOfAlloc_I |
383 |
|> simplify (simpset() addsimps [surj_rename RS surj_range, o_def]); |
|
8314 | 384 |
|
7841 | 385 |
Goalw [System_def] |
386 |
"i < Nclients ==> System : Increasing (sub i o allocGiv)"; |
|
8314 | 387 |
by (simp_tac (simpset() addsimps [o_def]) 1); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
388 |
by (rtac (rename_Alloc_Increasing RS guarantees_Join_I1 RS guaranteesD) 1); |
7841 | 389 |
by Auto_tac; |
390 |
qed "System_Increasing_allocGiv"; |
|
7365 | 391 |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
392 |
AddSIs (list_of_Int System_Increasing); |
6828 | 393 |
|
7841 | 394 |
(** Follows consequences. |
395 |
The "Always (INT ...) formulation expresses the general safety property |
|
396 |
and allows it to be combined using Always_Int_rule below. **) |
|
397 |
||
8067 | 398 |
Goal |
399 |
"i < Nclients ==> System : ((sub i o allocRel) Fols (rel o sub i o client))"; |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
400 |
by (auto_tac (claset() addSIs [Network_Rel RS component_guaranteesD], |
8067 | 401 |
simpset())); |
402 |
qed "System_Follows_rel"; |
|
403 |
||
404 |
Goal |
|
405 |
"i < Nclients ==> System : ((sub i o allocAsk) Fols (ask o sub i o client))"; |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
406 |
by (auto_tac (claset() addSIs [Network_Ask RS component_guaranteesD], |
8067 | 407 |
simpset())); |
408 |
qed "System_Follows_ask"; |
|
409 |
||
410 |
Goal |
|
411 |
"i < Nclients ==> System : (giv o sub i o client) Fols (sub i o allocGiv)"; |
|
412 |
by (auto_tac (claset() addSIs [Network_Giv RS component_guaranteesD, |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
413 |
rename_Alloc_Increasing RS component_guaranteesD], |
8067 | 414 |
simpset())); |
8314 | 415 |
by (ALLGOALS (simp_tac (simpset() addsimps [o_def, non_extra_def]))); |
416 |
by (auto_tac |
|
417 |
(claset() addSIs [rename_Alloc_Increasing RS component_guaranteesD], |
|
418 |
simpset())); |
|
8067 | 419 |
qed "System_Follows_allocGiv"; |
420 |
||
7841 | 421 |
Goal "System : Always (INT i: lessThan Nclients. \ |
422 |
\ {s. (giv o sub i o client) s <= (sub i o allocGiv) s})"; |
|
8327 | 423 |
by Auto_tac; |
8067 | 424 |
by (etac (System_Follows_allocGiv RS Follows_Bounded) 1); |
7841 | 425 |
qed "Always_giv_le_allocGiv"; |
426 |
||
427 |
Goal "System : Always (INT i: lessThan Nclients. \ |
|
428 |
\ {s. (sub i o allocAsk) s <= (ask o sub i o client) s})"; |
|
8327 | 429 |
by Auto_tac; |
8067 | 430 |
by (etac (System_Follows_ask RS Follows_Bounded) 1); |
7841 | 431 |
qed "Always_allocAsk_le_ask"; |
432 |
||
433 |
Goal "System : Always (INT i: lessThan Nclients. \ |
|
434 |
\ {s. (sub i o allocRel) s <= (rel o sub i o client) s})"; |
|
8067 | 435 |
by (auto_tac (claset() addSIs [Follows_Bounded, System_Follows_rel], |
8327 | 436 |
simpset())); |
7841 | 437 |
qed "Always_allocRel_le_rel"; |
438 |
||
439 |
||
440 |
(*** Proof of the safety property (1) ***) |
|
441 |
||
442 |
(*safety (1), step 1 is System_Increasing_rel*) |
|
443 |
||
7689 | 444 |
(*safety (1), step 2*) |
7365 | 445 |
Goal "i < Nclients ==> System : Increasing (sub i o allocRel)"; |
8067 | 446 |
by (etac (System_Follows_rel RS Follows_Increasing1) 1); |
7365 | 447 |
qed "System_Increasing_allocRel"; |
6828 | 448 |
|
8314 | 449 |
(*Lifting Alloc_safety up to the level of systemState*) |
450 |
val rename_Alloc_Safety = |
|
8327 | 451 |
Alloc_Safety RS rename_guarantees_sysOfAlloc_I |
452 |
|> simplify (simpset() addsimps [o_def]); |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
453 |
|
7689 | 454 |
(*safety (1), step 3*) |
7399
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
455 |
Goal "System : Always {s. sum (%i. (tokens o sub i o allocGiv) s) Nclients \ |
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
456 |
\ <= NbT + sum (%i. (tokens o sub i o allocRel) s) Nclients}"; |
8327 | 457 |
by (simp_tac (simpset() addsimps [o_apply]) 1); |
458 |
by (rtac (rename_Alloc_Safety RS component_guaranteesD) 1); |
|
459 |
by (auto_tac (claset(), |
|
460 |
simpset() addsimps [o_simp System_Increasing_allocRel])); |
|
7538 | 461 |
qed "System_sum_bounded"; |
7537 | 462 |
|
8314 | 463 |
|
7841 | 464 |
(** Follows reasoning **) |
465 |
||
7540 | 466 |
Goal "System : Always (INT i: lessThan Nclients. \ |
467 |
\ {s. (tokens o giv o sub i o client) s \ |
|
468 |
\ <= (tokens o sub i o allocGiv) s})"; |
|
7841 | 469 |
by (rtac (Always_giv_le_allocGiv RS Always_weaken) 1); |
8067 | 470 |
by (auto_tac (claset() addIs [tokens_mono_prefix], |
471 |
simpset() addsimps [o_apply])); |
|
7841 | 472 |
qed "Always_tokens_giv_le_allocGiv"; |
7540 | 473 |
|
474 |
Goal "System : Always (INT i: lessThan Nclients. \ |
|
475 |
\ {s. (tokens o sub i o allocRel) s \ |
|
476 |
\ <= (tokens o rel o sub i o client) s})"; |
|
7841 | 477 |
by (rtac (Always_allocRel_le_rel RS Always_weaken) 1); |
8067 | 478 |
by (auto_tac (claset() addIs [tokens_mono_prefix], |
479 |
simpset() addsimps [o_apply])); |
|
7841 | 480 |
qed "Always_tokens_allocRel_le_rel"; |
7540 | 481 |
|
7841 | 482 |
(*safety (1), step 4 (final result!) *) |
8128 | 483 |
Goalw [system_safety_def] "System : system_safety"; |
7841 | 484 |
by (rtac (Always_Int_rule [System_sum_bounded, Always_tokens_giv_le_allocGiv, |
485 |
Always_tokens_allocRel_le_rel] RS Always_weaken) 1); |
|
7538 | 486 |
by Auto_tac; |
7540 | 487 |
by (rtac (sum_mono RS order_trans) 1); |
488 |
by (dtac order_trans 2); |
|
489 |
by (rtac ([order_refl, sum_mono] MRS add_le_mono) 2); |
|
490 |
by (assume_tac 3); |
|
7482 | 491 |
by Auto_tac; |
7540 | 492 |
qed "System_safety"; |
7399
cf780c2bcccf
changed "component" infix in HOL/UNITY/Comp.thy to be overloaded <
paulson
parents:
7365
diff
changeset
|
493 |
|
7689 | 494 |
|
495 |
(*** Proof of the progress property (2) ***) |
|
496 |
||
7965 | 497 |
(*Now there are proofs identical to System_Increasing_rel and |
7689 | 498 |
System_Increasing_allocRel: tactics needed!*) |
499 |
||
7841 | 500 |
(*progress (2), step 1 is System_Increasing_ask and System_Increasing_rel*) |
7689 | 501 |
|
7841 | 502 |
(*progress (2), step 2; see also System_Increasing_allocRel*) |
7689 | 503 |
Goal "i < Nclients ==> System : Increasing (sub i o allocAsk)"; |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
504 |
by (etac (System_Follows_ask RS Follows_Increasing1) 1); |
7689 | 505 |
qed "System_Increasing_allocAsk"; |
506 |
||
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
507 |
(*progress (2), step 3*) |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
508 |
(*All this trouble just to lift "Client_Bounded" to systemState |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
509 |
(though it is similar to that for Client_Increasing*) |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
510 |
Goal "i : I \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
511 |
\ ==> rename sysOfClient (plam x: I. rename client_map Client) : \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
512 |
\ UNIV \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
513 |
\ guarantees[ask o sub i o client] \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
514 |
\ Always {s. ALL elt : set ((ask o sub i o client) s). elt <= NbT}"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
515 |
by (simp_tac (simpset() addsimps [rename_guarantees_eq_rename_inv]) 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
516 |
by (rtac guarantees_PLam_I 1); |
8314 | 517 |
by (assume_tac 2); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
518 |
(*preserves: routine reasoning*) |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
519 |
by (asm_simp_tac (simpset() addsimps [lift_preserves_sub]) 2); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
520 |
(*the guarantee for "lift i (rename client_map Client)" *) |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
521 |
by (asm_simp_tac |
8327 | 522 |
(simpset() addsimps [lift_guarantees_eq_lift_inv, |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
523 |
rename_guarantees_eq_rename_inv, |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
524 |
bij_imp_bij_inv, surj_rename RS surj_range, |
8327 | 525 |
inv_inv_eq]) 1); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
526 |
by (asm_simp_tac (simpset() addsimps [o_def, non_extra_def]) 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
527 |
qed "rename_Client_Bounded"; |
7841 | 528 |
|
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
529 |
Goal "i < Nclients \ |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
530 |
\ ==> System : Always \ |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
531 |
\ {s. ALL elt : set ((ask o sub i o client) s). elt <= NbT}"; |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
532 |
by (rtac ([rename_Client_Bounded, |
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
533 |
Client_component_System] MRS component_guaranteesD) 1); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
534 |
by Auto_tac; |
7841 | 535 |
qed "System_Bounded_ask"; |
536 |
||
537 |
(*progress (2), step 4*) |
|
538 |
Goal "System : Always {s. ALL i : lessThan Nclients. \ |
|
539 |
\ ALL elt : set ((sub i o allocAsk) s). elt <= NbT}"; |
|
540 |
by (auto_tac (claset(), |
|
8327 | 541 |
simpset() addsimps [Collect_ball_eq])); |
7841 | 542 |
by (rtac (Always_Int_rule [Always_allocAsk_le_ask, System_Bounded_ask] |
543 |
RS Always_weaken) 1); |
|
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
544 |
by (auto_tac (claset() addDs [set_mono], simpset())); |
7841 | 545 |
qed "System_Bounded_allocAsk"; |
546 |
||
7965 | 547 |
(*progress (2), step 5 is System_Increasing_allocGiv*) |
7841 | 548 |
|
7965 | 549 |
(*progress (2), step 6*) |
7841 | 550 |
Goal "i < Nclients ==> System : Increasing (giv o sub i o client)"; |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
551 |
by (etac (System_Follows_allocGiv RS Follows_Increasing1) 1); |
7841 | 552 |
qed "System_Increasing_giv"; |
553 |
||
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
554 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
555 |
Goal "i: I \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
556 |
\ ==> rename sysOfClient (plam x: I. rename client_map Client) \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
557 |
\ : Increasing (giv o sub i o client) \ |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
558 |
\ guarantees[funPair rel ask o sub i o client] \ |
8314 | 559 |
\ (INT h. {s. h <= (giv o sub i o client) s & \ |
560 |
\ h pfixGe (ask o sub i o client) s} \ |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
561 |
\ LeadsTo {s. tokens h <= (tokens o rel o sub i o client) s})"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
562 |
by (simp_tac (simpset() addsimps [rename_guarantees_eq_rename_inv]) 1); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
563 |
by (rtac guarantees_PLam_I 1); |
8314 | 564 |
by (assume_tac 2); |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
565 |
(*preserves: routine reasoning*) |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
566 |
by (asm_simp_tac (simpset() addsimps [lift_preserves_sub]) 2); |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
567 |
(*the guarantee for "lift i (rename client_map Client)" *) |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
568 |
by (asm_simp_tac |
8327 | 569 |
(simpset() addsimps [lift_guarantees_eq_lift_inv, |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
570 |
rename_guarantees_eq_rename_inv, |
8327 | 571 |
bij_imp_bij_inv, inv_inv_eq]) 1); |
8314 | 572 |
by (asm_simp_tac (simpset() addsimps [o_def, non_extra_def, |
573 |
rewrite_rule [o_def] Client_Progress]) 1); |
|
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
574 |
qed "rename_Client_Progress"; |
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
575 |
|
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
576 |
|
7965 | 577 |
(*progress (2), step 7*) |
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
578 |
Goal |
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
579 |
"System : (INT i : lessThan Nclients. \ |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
580 |
\ INT h. {s. h <= (giv o sub i o client) s & \ |
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
581 |
\ h pfixGe (ask o sub i o client) s} \ |
8314 | 582 |
\ LeadsTo {s. tokens h <= (tokens o rel o sub i o client) s})"; |
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
583 |
by (rtac INT_I 1); |
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
584 |
(*Couldn't have just used Auto_tac since the "INT h" must be kept*) |
8311
6218522253e7
new mostly working version; Alloc nearly converted to "Rename"
paulson
parents:
8286
diff
changeset
|
585 |
by (rtac ([rename_Client_Progress, |
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
586 |
Client_component_System] MRS component_guaranteesD) 1); |
8327 | 587 |
by (asm_full_simp_tac (simpset() addsimps [System_Increasing_giv]) 2); |
8128 | 588 |
by Auto_tac; |
8065
658e0d4e4ed9
first working version to Alloc/System_Client_Progress;
paulson
parents:
8055
diff
changeset
|
589 |
qed "System_Client_Progress"; |
8055
bb15396278fb
abolition of localTo: instead "guarantees" has local vars as extra argument
paulson
parents:
8041
diff
changeset
|
590 |
|
8314 | 591 |
(*Concludes |
592 |
System : {s. k <= (sub i o allocGiv) s} |
|
593 |
LeadsTo |
|
594 |
{s. (sub i o allocAsk) s <= (ask o sub i o client) s} Int |
|
595 |
{s. k <= (giv o sub i o client) s} *) |
|
8067 | 596 |
val lemma = |
597 |
[System_Follows_ask RS Follows_Bounded, |
|
598 |
System_Follows_allocGiv RS Follows_LeadsTo] MRS Always_LeadsToD; |
|
8041 | 599 |
|
8314 | 600 |
(*A more complicated variant of the previous one*) |
8067 | 601 |
val lemma2 = [lemma, |
602 |
System_Follows_ask RS Follows_Increasing1 RS IncreasingD] |
|
603 |
MRS PSP_Stable; |
|
604 |
||
605 |
Goal "i < Nclients \ |
|
606 |
\ ==> System : {s. h <= (sub i o allocGiv) s & \ |
|
607 |
\ h pfixGe (sub i o allocAsk) s} \ |
|
608 |
\ LeadsTo \ |
|
609 |
\ {s. h <= (giv o sub i o client) s & \ |
|
610 |
\ h pfixGe (ask o sub i o client) s}"; |
|
611 |
by (rtac single_LeadsTo_I 1); |
|
612 |
by (res_inst_tac [("k6", "h"), ("x2", "(sub i o allocAsk) s")] |
|
613 |
(lemma2 RS LeadsTo_weaken) 1); |
|
614 |
by Auto_tac; |
|
615 |
by (blast_tac (claset() addIs [trans_Ge RS trans_genPrefix RS transD, |
|
616 |
prefix_imp_pfixGe]) 1); |
|
617 |
val lemma3 = result(); |
|
618 |
||
619 |
||
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
620 |
(*progress (2), step 8: Client i's "release" action is visible system-wide*) |
8075 | 621 |
Goal "i < Nclients \ |
622 |
\ ==> System : {s. h <= (sub i o allocGiv) s & \ |
|
8067 | 623 |
\ h pfixGe (sub i o allocAsk) s} \ |
8075 | 624 |
\ LeadsTo {s. tokens h <= (tokens o sub i o allocRel) s}"; |
8067 | 625 |
by (rtac LeadsTo_Trans 1); |
626 |
by (dtac (System_Follows_rel RS impOfSubs (mono_tokens RS mono_Follows_o) RS |
|
8113 | 627 |
Follows_LeadsTo) 2); |
8067 | 628 |
by (asm_full_simp_tac (simpset() addsimps [o_assoc]) 2); |
629 |
by (rtac LeadsTo_Trans 1); |
|
630 |
by (cut_facts_tac [System_Client_Progress] 2); |
|
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
631 |
by (blast_tac (claset() addIs [LeadsTo_Basis]) 2); |
8067 | 632 |
by (etac lemma3 1); |
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
633 |
qed "System_Alloc_Client_Progress"; |
8069
19b9f92ca503
working with weak LeadsTo in guarantees precondition\!
paulson
parents:
8067
diff
changeset
|
634 |
|
8314 | 635 |
(*Lifting Alloc_Progress up to the level of systemState*) |
636 |
val rename_Alloc_Progress = |
|
8327 | 637 |
Alloc_Progress RS rename_guarantees_sysOfAlloc_I |
638 |
|> simplify (simpset() addsimps [o_def]); |
|
8075 | 639 |
|
8069
19b9f92ca503
working with weak LeadsTo in guarantees precondition\!
paulson
parents:
8067
diff
changeset
|
640 |
(*progress (2), step 9*) |
19b9f92ca503
working with weak LeadsTo in guarantees precondition\!
paulson
parents:
8067
diff
changeset
|
641 |
Goal |
19b9f92ca503
working with weak LeadsTo in guarantees precondition\!
paulson
parents:
8067
diff
changeset
|
642 |
"System : (INT i : lessThan Nclients. \ |
19b9f92ca503
working with weak LeadsTo in guarantees precondition\!
paulson
parents:
8067
diff
changeset
|
643 |
\ INT h. {s. h <= (sub i o allocAsk) s} \ |
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
644 |
\ LeadsTo {s. h pfixLe (sub i o allocGiv) s})"; |
8314 | 645 |
(*Can't use simpset(): the "INT h" must be kept*) |
8327 | 646 |
by (simp_tac (HOL_ss addsimps [o_apply, sub_def]) 1); |
647 |
by (rtac (rename_Alloc_Progress RS component_guaranteesD) 1); |
|
8075 | 648 |
by (auto_tac (claset(), |
8314 | 649 |
simpset() addsimps [o_simp System_Increasing_allocRel, |
650 |
o_simp System_Increasing_allocAsk, |
|
651 |
o_simp System_Bounded_allocAsk, |
|
652 |
o_simp System_Alloc_Client_Progress])); |
|
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
653 |
qed "System_Alloc_Progress"; |
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
654 |
|
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
655 |
|
8128 | 656 |
(*progress (2), step 10 (final result!) *) |
657 |
Goalw [system_progress_def] "System : system_progress"; |
|
658 |
by (Clarify_tac 1); |
|
659 |
by (rtac LeadsTo_Trans 1); |
|
660 |
by (etac (System_Follows_allocGiv RS Follows_LeadsTo_pfixLe) 2); |
|
661 |
by (rtac LeadsTo_Trans 1); |
|
662 |
by (cut_facts_tac [System_Alloc_Progress] 2); |
|
663 |
by (Blast_tac 2); |
|
664 |
by (etac (System_Follows_ask RS Follows_LeadsTo) 1); |
|
665 |
qed "System_Progress"; |
|
666 |
||
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
667 |
|
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
668 |
(*Ultimate goal*) |
8128 | 669 |
Goalw [system_spec_def] "System : system_spec"; |
670 |
by (blast_tac (claset() addIs [System_safety, System_Progress]) 1); |
|
671 |
qed "System_correct"; |
|
8122
b43ad07660b9
working version, with Alloc now working on the same state space as the whole
paulson
parents:
8113
diff
changeset
|
672 |
|
8314 | 673 |