src/HOL/UNITY/WFair.ML
author nipkow
Fri, 27 Nov 1998 17:00:30 +0100
changeset 5983 79e301a6a51b
parent 5971 c5a7a7685826
child 6012 1894bfc4aee9
permissions -rw-r--r--
At last: linear arithmetic for nat!
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
     1
(*  Title:      HOL/UNITY/WFair
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
     2
    ID:         $Id$
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
     3
    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
     4
    Copyright   1998  University of Cambridge
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
     5
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
     6
Weak Fairness versions of transient, ensures, leadsTo.
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
     7
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
     8
From Misra, "A Logic for Concurrent Programming", 1994
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
     9
*)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    10
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    11
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    12
overload_1st_set "WFair.transient";
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    13
overload_1st_set "WFair.ensures";
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    14
overload_1st_set "WFair.leadsTo";
5340
d75c03cf77b5 Misc changes
paulson
parents: 5277
diff changeset
    15
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    16
(*** transient ***)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    17
5069
3ea049f7979d isatool fixgoal;
wenzelm
parents: 4776
diff changeset
    18
Goalw [stable_def, constrains_def, transient_def]
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    19
    "[| F : stable A; F : transient A |] ==> A = {}";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    20
by (Blast_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    21
qed "stable_transient_empty";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    22
5069
3ea049f7979d isatool fixgoal;
wenzelm
parents: 4776
diff changeset
    23
Goalw [transient_def]
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    24
    "[| F : transient A; B<=A |] ==> F : transient B";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    25
by (Clarify_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    26
by (rtac bexI 1 THEN assume_tac 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    27
by (Blast_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    28
qed "transient_strengthen";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    29
5069
3ea049f7979d isatool fixgoal;
wenzelm
parents: 4776
diff changeset
    30
Goalw [transient_def]
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    31
    "[| act: Acts F;  A <= Domain act;  act^^A <= -A |] ==> F : transient A";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    32
by (Blast_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    33
qed "transient_mem";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    34
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    35
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    36
(*** ensures ***)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    37
5069
3ea049f7979d isatool fixgoal;
wenzelm
parents: 4776
diff changeset
    38
Goalw [ensures_def]
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    39
    "[| F : constrains (A-B) (A Un B); F : transient (A-B) |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    40
\    ==> F : ensures A B";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    41
by (Blast_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    42
qed "ensuresI";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    43
5069
3ea049f7979d isatool fixgoal;
wenzelm
parents: 4776
diff changeset
    44
Goalw [ensures_def]
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    45
    "F : ensures A B ==> F : constrains (A-B) (A Un B) & F : transient (A-B)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    46
by (Blast_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    47
qed "ensuresD";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    48
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    49
(*The L-version (precondition strengthening) doesn't hold for ENSURES*)
5069
3ea049f7979d isatool fixgoal;
wenzelm
parents: 4776
diff changeset
    50
Goalw [ensures_def]
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    51
    "[| F : ensures A A'; A'<=B' |] ==> F : ensures A B'";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    52
by (blast_tac (claset() addIs [constrains_weaken, transient_strengthen]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    53
qed "ensures_weaken_R";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    54
5069
3ea049f7979d isatool fixgoal;
wenzelm
parents: 4776
diff changeset
    55
Goalw [ensures_def, constrains_def, transient_def]
5971
c5a7a7685826 simplified ensures_UNIV
paulson
parents: 5669
diff changeset
    56
    "F : ensures A UNIV";
5340
d75c03cf77b5 Misc changes
paulson
parents: 5277
diff changeset
    57
by Auto_tac;
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    58
qed "ensures_UNIV";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    59
5069
3ea049f7979d isatool fixgoal;
wenzelm
parents: 4776
diff changeset
    60
Goalw [ensures_def]
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    61
    "[| F : stable C; \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    62
\       F : constrains (C Int (A - A')) (A Un A'); \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    63
\       F : transient (C Int (A-A')) |]   \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    64
\   ==> F : ensures (C Int A) (C Int A')";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    65
by (asm_simp_tac (simpset() addsimps [Int_Un_distrib RS sym,
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    66
				      Diff_Int_distrib RS sym,
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    67
				      stable_constrains_Int]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    68
qed "stable_ensures_Int";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    69
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    70
Goal "[| F : stable A;  F : transient C;  A <= B Un C |] ==> F : ensures A B";
5640
4a59d99b5ca3 new theorems
paulson
parents: 5620
diff changeset
    71
by (asm_full_simp_tac (simpset() addsimps [ensures_def, stable_def]) 1);
4a59d99b5ca3 new theorems
paulson
parents: 5620
diff changeset
    72
by (blast_tac (claset() addIs [constrains_weaken, transient_strengthen]) 1);
4a59d99b5ca3 new theorems
paulson
parents: 5620
diff changeset
    73
qed "stable_transient_ensures";
4a59d99b5ca3 new theorems
paulson
parents: 5620
diff changeset
    74
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    75
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    76
(*** leadsTo ***)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    77
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    78
Goalw [leadsTo_def] "F : ensures A B ==> F : leadsTo A B";
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    79
by (blast_tac (claset() addIs [leadsto.Basis]) 1);
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    80
qed "leadsTo_Basis";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    81
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    82
Goalw [leadsTo_def]
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    83
     "[| F : leadsTo A B;  F : leadsTo B C |] ==> F : leadsTo A C";
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    84
by (blast_tac (claset() addIs [leadsto.Trans]) 1);
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    85
qed "leadsTo_Trans";
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    86
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    87
Goal "F : transient A ==> F : leadsTo A (-A)";
5640
4a59d99b5ca3 new theorems
paulson
parents: 5620
diff changeset
    88
by (asm_simp_tac 
4a59d99b5ca3 new theorems
paulson
parents: 5620
diff changeset
    89
    (simpset() addsimps [leadsTo_Basis, ensuresI, Compl_partition]) 1);
4a59d99b5ca3 new theorems
paulson
parents: 5620
diff changeset
    90
qed "transient_imp_leadsTo";
4a59d99b5ca3 new theorems
paulson
parents: 5620
diff changeset
    91
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    92
Goal "F : leadsTo A UNIV";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    93
by (blast_tac (claset() addIs [ensures_UNIV RS leadsTo_Basis]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    94
qed "leadsTo_UNIV";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    95
Addsimps [leadsTo_UNIV];
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    96
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    97
(*Useful with cancellation, disjunction*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
    98
Goal "F : leadsTo A (A' Un A') ==> F : leadsTo A A'";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
    99
by (asm_full_simp_tac (simpset() addsimps Un_ac) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   100
qed "leadsTo_Un_duplicate";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   101
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   102
Goal "F : leadsTo A (A' Un C Un C) ==> F : leadsTo A (A' Un C)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   103
by (asm_full_simp_tac (simpset() addsimps Un_ac) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   104
qed "leadsTo_Un_duplicate2";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   105
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   106
(*The Union introduction rule as we should have liked to state it*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   107
val prems = Goalw [leadsTo_def]
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   108
    "(!!A. A : S ==> F : leadsTo A B) ==> F : leadsTo (Union S) B";
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   109
by (blast_tac (claset() addIs [leadsto.Union] addDs prems) 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   110
qed "leadsTo_Union";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   111
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   112
val prems = Goal
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   113
    "(!!i. i : I ==> F : leadsTo (A i) B) ==> F : leadsTo (UN i:I. A i) B";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   114
by (simp_tac (simpset() addsimps [Union_image_eq RS sym]) 1);
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   115
by (blast_tac (claset() addIs leadsTo_Union::prems) 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   116
qed "leadsTo_UN";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   117
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   118
(*Binary union introduction rule*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   119
Goal "[| F : leadsTo A C; F : leadsTo B C |] ==> F : leadsTo (A Un B) C";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   120
by (stac Un_eq_Union 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   121
by (blast_tac (claset() addIs [leadsTo_Union]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   122
qed "leadsTo_Un";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   123
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   124
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   125
(*The INDUCTION rule as we should have liked to state it*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   126
val major::prems = Goalw [leadsTo_def]
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   127
  "[| F : leadsTo za zb;  \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   128
\     !!A B. F : ensures A B ==> P A B; \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   129
\     !!A B C. [| F : leadsTo A B; P A B; F : leadsTo B C; P B C |] \
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   130
\              ==> P A C; \
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   131
\     !!B S. ALL A:S. F : leadsTo A B & P A B ==> P (Union S) B \
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   132
\  |] ==> P za zb";
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   133
by (rtac (major RS CollectD RS leadsto.induct) 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   134
by (REPEAT (blast_tac (claset() addIs prems) 1));
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   135
qed "leadsTo_induct";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   136
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   137
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   138
Goal "A<=B ==> F : leadsTo A B";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   139
by (rtac leadsTo_Basis 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   140
by (rewrite_goals_tac [ensures_def, constrains_def, transient_def]);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   141
by (Blast_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   142
qed "subset_imp_leadsTo";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   143
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   144
bind_thm ("empty_leadsTo", empty_subsetI RS subset_imp_leadsTo);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   145
Addsimps [empty_leadsTo];
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   146
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   147
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   148
Goal "[| F : leadsTo A A'; A'<=B' |] ==> F : leadsTo A B'";
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   149
by (blast_tac (claset() addIs [subset_imp_leadsTo, leadsTo_Trans]) 1);
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   150
qed "leadsTo_weaken_R";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   151
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   152
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   153
Goal "[| F : leadsTo A A'; B<=A |] ==> F : leadsTo B A'";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   154
by (blast_tac (claset() addIs [leadsTo_Basis, leadsTo_Trans, 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   155
			       subset_imp_leadsTo]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   156
qed_spec_mp "leadsTo_weaken_L";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   157
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   158
(*Distributes over binary unions*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   159
Goal "F : leadsTo (A Un B) C  =  (F : leadsTo A C & F : leadsTo B C)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   160
by (blast_tac (claset() addIs [leadsTo_Un, leadsTo_weaken_L]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   161
qed "leadsTo_Un_distrib";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   162
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   163
Goal "F : leadsTo (UN i:I. A i) B  =  (ALL i : I. F : leadsTo (A i) B)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   164
by (blast_tac (claset() addIs [leadsTo_UN, leadsTo_weaken_L]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   165
qed "leadsTo_UN_distrib";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   166
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   167
Goal "F : leadsTo (Union S) B  =  (ALL A : S. F : leadsTo A B)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   168
by (blast_tac (claset() addIs [leadsTo_Union, leadsTo_weaken_L]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   169
qed "leadsTo_Union_distrib";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   170
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   171
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   172
Goal "[| F : leadsTo A A'; B<=A; A'<=B' |] ==> F : leadsTo B B'";
5340
d75c03cf77b5 Misc changes
paulson
parents: 5277
diff changeset
   173
by (blast_tac (claset() addIs [leadsTo_weaken_R, leadsTo_weaken_L,
d75c03cf77b5 Misc changes
paulson
parents: 5277
diff changeset
   174
			       leadsTo_Trans]) 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   175
qed "leadsTo_weaken";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   176
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   177
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   178
(*Set difference: maybe combine with leadsTo_weaken_L??*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   179
Goal "[| F : leadsTo (A-B) C; F : leadsTo B C |]   ==> F : leadsTo A C";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   180
by (blast_tac (claset() addIs [leadsTo_Un, leadsTo_weaken]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   181
qed "leadsTo_Diff";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   182
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   183
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   184
(** Meta or object quantifier ???
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   185
    see ball_constrains_UN in UNITY.ML***)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   186
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   187
val prems = goal thy
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   188
   "(!! i. i:I ==> F : leadsTo (A i) (A' i)) \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   189
\   ==> F : leadsTo (UN i:I. A i) (UN i:I. A' i)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   190
by (simp_tac (simpset() addsimps [Union_image_eq RS sym]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   191
by (blast_tac (claset() addIs [leadsTo_Union, leadsTo_weaken_R] 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   192
                        addIs prems) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   193
qed "leadsTo_UN_UN";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   194
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   195
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   196
(*Version with no index set*)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   197
val prems = goal thy
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   198
   "(!! i. F : leadsTo (A i) (A' i)) \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   199
\   ==> F : leadsTo (UN i. A i) (UN i. A' i)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   200
by (blast_tac (claset() addIs [leadsTo_UN_UN] 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   201
                        addIs prems) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   202
qed "leadsTo_UN_UN_noindex";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   203
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   204
(*Version with no index set*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   205
Goal "ALL i. F : leadsTo (A i) (A' i) \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   206
\   ==> F : leadsTo (UN i. A i) (UN i. A' i)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   207
by (blast_tac (claset() addIs [leadsTo_UN_UN]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   208
qed "all_leadsTo_UN_UN";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   209
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   210
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   211
(*Binary union version*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   212
Goal "[| F : leadsTo A A'; F : leadsTo B B' |]     ==> F : leadsTo (A Un B) (A' Un B')";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   213
by (blast_tac (claset() addIs [leadsTo_Un, 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   214
			       leadsTo_weaken_R]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   215
qed "leadsTo_Un_Un";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   216
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   217
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   218
(** The cancellation law **)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   219
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   220
Goal "[| F : leadsTo A (A' Un B); F : leadsTo B B' |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   221
\   ==> F : leadsTo A (A' Un B')";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   222
by (blast_tac (claset() addIs [leadsTo_Un_Un, 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   223
			       subset_imp_leadsTo, leadsTo_Trans]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   224
qed "leadsTo_cancel2";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   225
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   226
Goal "[| F : leadsTo A (A' Un B); F : leadsTo (B-A') B' |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   227
\   ==> F : leadsTo A (A' Un B')";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   228
by (rtac leadsTo_cancel2 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   229
by (assume_tac 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   230
by (ALLGOALS Asm_simp_tac);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   231
qed "leadsTo_cancel_Diff2";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   232
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   233
Goal "[| F : leadsTo A (B Un A'); F : leadsTo B B' |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   234
\   ==> F : leadsTo A (B' Un A')";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   235
by (asm_full_simp_tac (simpset() addsimps [Un_commute]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   236
by (blast_tac (claset() addSIs [leadsTo_cancel2]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   237
qed "leadsTo_cancel1";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   238
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   239
Goal "[| F : leadsTo A (B Un A'); F : leadsTo (B-A') B' |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   240
\   ==> F : leadsTo A (B' Un A')";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   241
by (rtac leadsTo_cancel1 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   242
by (assume_tac 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   243
by (ALLGOALS Asm_simp_tac);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   244
qed "leadsTo_cancel_Diff1";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   245
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   246
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   247
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   248
(** The impossibility law **)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   249
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   250
Goal "F : leadsTo A B ==> B={} --> A={}";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   251
by (etac leadsTo_induct 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   252
by (ALLGOALS Asm_simp_tac);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   253
by (rewrite_goals_tac [ensures_def, constrains_def, transient_def]);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   254
by (Blast_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   255
val lemma = result() RS mp;
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   256
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   257
Goal "F : leadsTo A {} ==> A={}";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   258
by (blast_tac (claset() addSIs [lemma]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   259
qed "leadsTo_empty";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   260
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   261
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   262
(** PSP: Progress-Safety-Progress **)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   263
5640
4a59d99b5ca3 new theorems
paulson
parents: 5620
diff changeset
   264
(*Special case of PSP: Misra's "stable conjunction"*)
5069
3ea049f7979d isatool fixgoal;
wenzelm
parents: 4776
diff changeset
   265
Goalw [stable_def]
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   266
   "[| F : leadsTo A A'; F : stable B |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   267
\   ==> F : leadsTo (A Int B) (A' Int B)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   268
by (etac leadsTo_induct 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   269
by (simp_tac (simpset() addsimps [Int_Union_Union]) 3);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   270
by (blast_tac (claset() addIs [leadsTo_Union]) 3);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   271
by (blast_tac (claset() addIs [leadsTo_Trans]) 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   272
by (rtac leadsTo_Basis 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   273
by (asm_full_simp_tac
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   274
    (simpset() addsimps [ensures_def, 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   275
			 Diff_Int_distrib2 RS sym, Int_Un_distrib2 RS sym]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   276
by (blast_tac (claset() addIs [transient_strengthen, constrains_Int]) 1);
5277
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   277
qed "psp_stable";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   278
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   279
Goal "[| F : leadsTo A A'; F : stable B |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   280
\   ==> F : leadsTo (B Int A) (B Int A')";
5536
130f3d891fb2 tidying and deleting needless parentheses
paulson
parents: 5521
diff changeset
   281
by (asm_simp_tac (simpset() addsimps psp_stable::Int_ac) 1);
5277
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   282
qed "psp_stable2";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   283
5277
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   284
Goalw [ensures_def, constrains_def]
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   285
   "[| F : ensures A A'; F : constrains B B' |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   286
\   ==> F : ensures (A Int B) ((A' Int B) Un (B' - B))";
5277
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   287
by (blast_tac (claset() addIs [transient_strengthen]) 1);
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   288
qed "psp_ensures";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   289
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   290
Goal "[| F : leadsTo A A'; F : constrains B B' |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   291
\     ==> F : leadsTo (A Int B) ((A' Int B) Un (B' - B))";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   292
by (etac leadsTo_induct 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   293
by (simp_tac (simpset() addsimps [Int_Union_Union]) 3);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   294
by (blast_tac (claset() addIs [leadsTo_Union]) 3);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   295
(*Transitivity case has a delicate argument involving "cancellation"*)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   296
by (rtac leadsTo_Un_duplicate2 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   297
by (etac leadsTo_cancel_Diff1 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   298
by (asm_full_simp_tac (simpset() addsimps [Int_Diff, Diff_triv]) 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   299
(*Basis case*)
5277
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   300
by (blast_tac (claset() addIs [leadsTo_Basis, psp_ensures]) 1);
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   301
qed "psp";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   302
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   303
Goal "[| F : leadsTo A A'; F : constrains B B' |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   304
\   ==> F : leadsTo (B Int A) ((B Int A') Un (B' - B))";
5536
130f3d891fb2 tidying and deleting needless parentheses
paulson
parents: 5521
diff changeset
   305
by (asm_simp_tac (simpset() addsimps psp::Int_ac) 1);
5277
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   306
qed "psp2";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   307
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   308
5069
3ea049f7979d isatool fixgoal;
wenzelm
parents: 4776
diff changeset
   309
Goalw [unless_def]
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   310
   "[| F : leadsTo A A';  F : unless B B' |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   311
\   ==> F : leadsTo (A Int B) ((A' Int B) Un B')";
5277
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   312
by (dtac psp 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   313
by (assume_tac 1);
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   314
by (asm_full_simp_tac (simpset() addsimps [Un_Diff_Diff, Int_Diff_Un]) 1);
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   315
by (asm_full_simp_tac (simpset() addsimps [Diff_Int_distrib]) 1);
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   316
by (etac leadsTo_Diff 1);
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   317
by (blast_tac (claset() addIs [subset_imp_leadsTo]) 1);
5277
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   318
qed "psp_unless";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   319
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   320
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   321
(*** Proving the induction rules ***)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   322
5257
c03e3ba9cbcc Indentation, comments
paulson
parents: 5253
diff changeset
   323
(** The most general rule: r is any wf relation; f is any variant function **)
c03e3ba9cbcc Indentation, comments
paulson
parents: 5253
diff changeset
   324
5239
2fd94efb9d64 Tidying
paulson
parents: 5232
diff changeset
   325
Goal "[| wf r;     \
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   326
\        ALL m. F : leadsTo (A Int f-``{m})                     \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   327
\                            ((A Int f-``(r^-1 ^^ {m})) Un B) |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   328
\     ==> F : leadsTo (A Int f-``{m}) B";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   329
by (eres_inst_tac [("a","m")] wf_induct 1);
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   330
by (subgoal_tac "F : leadsTo (A Int (f -`` (r^-1 ^^ {x}))) B" 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   331
by (stac vimage_eq_UN 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   332
by (asm_simp_tac (HOL_ss addsimps (UN_simps RL [sym])) 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   333
by (blast_tac (claset() addIs [leadsTo_UN]) 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   334
by (blast_tac (claset() addIs [leadsTo_cancel1, leadsTo_Un_duplicate]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   335
val lemma = result();
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   336
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   337
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   338
(** Meta or object quantifier ????? **)
5239
2fd94efb9d64 Tidying
paulson
parents: 5232
diff changeset
   339
Goal "[| wf r;     \
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   340
\        ALL m. F : leadsTo (A Int f-``{m})                     \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   341
\                            ((A Int f-``(r^-1 ^^ {m})) Un B) |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   342
\     ==> F : leadsTo A B";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   343
by (res_inst_tac [("t", "A")] subst 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   344
by (rtac leadsTo_UN 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   345
by (etac lemma 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   346
by (REPEAT (assume_tac 2));
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   347
by (Fast_tac 1);    (*Blast_tac: Function unknown's argument not a parameter*)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   348
qed "leadsTo_wf_induct";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   349
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   350
5239
2fd94efb9d64 Tidying
paulson
parents: 5232
diff changeset
   351
Goal "[| wf r;     \
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   352
\        ALL m:I. F : leadsTo (A Int f-``{m})                   \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   353
\                              ((A Int f-``(r^-1 ^^ {m})) Un B) |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   354
\     ==> F : leadsTo A ((A - (f-``I)) Un B)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   355
by (etac leadsTo_wf_induct 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   356
by Safe_tac;
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   357
by (case_tac "m:I" 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   358
by (blast_tac (claset() addIs [leadsTo_weaken]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   359
by (blast_tac (claset() addIs [subset_imp_leadsTo]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   360
qed "bounded_induct";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   361
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   362
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   363
(*Alternative proof is via the lemma F : leadsTo (A Int f-``(lessThan m)) B*)
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   364
Goal "[| ALL m. F : leadsTo (A Int f-``{m})                     \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   365
\                            ((A Int f-``(lessThan m)) Un B) |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   366
\     ==> F : leadsTo A B";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   367
by (rtac (wf_less_than RS leadsTo_wf_induct) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   368
by (Asm_simp_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   369
qed "lessThan_induct";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   370
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   371
Goal "[| ALL m:(greaterThan l). F : leadsTo (A Int f-``{m})   \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   372
\                                  ((A Int f-``(lessThan m)) Un B) |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   373
\     ==> F : leadsTo A ((A Int (f-``(atMost l))) Un B)";
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   374
by (simp_tac (HOL_ss addsimps [Diff_eq RS sym, vimage_Compl, 
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   375
			       Compl_greaterThan RS sym]) 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   376
by (rtac (wf_less_than RS bounded_induct) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   377
by (Asm_simp_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   378
qed "lessThan_bounded_induct";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   379
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   380
Goal "[| ALL m:(lessThan l). F : leadsTo (A Int f-``{m})   \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   381
\                              ((A Int f-``(greaterThan m)) Un B) |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   382
\     ==> F : leadsTo A ((A Int (f-``(atLeast l))) Un B)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   383
by (res_inst_tac [("f","f"),("f1", "%k. l - k")]
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   384
    (wf_less_than RS wf_inv_image RS leadsTo_wf_induct) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   385
by (simp_tac (simpset() addsimps [inv_image_def, Image_singleton]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   386
by (Clarify_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   387
by (case_tac "m<l" 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   388
by (blast_tac (claset() addIs [not_leE, subset_imp_leadsTo]) 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   389
by (blast_tac (claset() addIs [leadsTo_weaken_R, diff_less_mono2]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   390
qed "greaterThan_bounded_induct";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   391
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   392
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   393
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   394
(*** wlt ****)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   395
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   396
(*Misra's property W3*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   397
Goalw [wlt_def] "F : leadsTo (wlt F B) B";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   398
by (blast_tac (claset() addSIs [leadsTo_Union]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   399
qed "wlt_leadsTo";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   400
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   401
Goalw [wlt_def] "F : leadsTo A B ==> A <= wlt F B";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   402
by (blast_tac (claset() addSIs [leadsTo_Union]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   403
qed "leadsTo_subset";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   404
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   405
(*Misra's property W2*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   406
Goal "F : leadsTo A B = (A <= wlt F B)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   407
by (blast_tac (claset() addSIs [leadsTo_subset, 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   408
				wlt_leadsTo RS leadsTo_weaken_L]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   409
qed "leadsTo_eq_subset_wlt";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   410
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   411
(*Misra's property W4*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   412
Goal "B <= wlt F B";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   413
by (asm_simp_tac (simpset() addsimps [leadsTo_eq_subset_wlt RS sym,
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   414
				      subset_imp_leadsTo]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   415
qed "wlt_increasing";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   416
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   417
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   418
(*Used in the Trans case below*)
5069
3ea049f7979d isatool fixgoal;
wenzelm
parents: 4776
diff changeset
   419
Goalw [constrains_def]
5111
8f4b72f0c15d Uncurried functions LeadsTo and reach
paulson
parents: 5069
diff changeset
   420
   "[| B <= A2;  \
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   421
\      F : constrains (A1 - B) (A1 Un B); \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   422
\      F : constrains (A2 - C) (A2 Un C) |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   423
\   ==> F : constrains (A1 Un A2 - C) (A1 Un A2 Un C)";
5669
f5d9caafc3bd added Clarify_tac to speed up proofs
paulson
parents: 5648
diff changeset
   424
by (Clarify_tac 1);
5620
3ac11c4af76a tidying and renaming
paulson
parents: 5608
diff changeset
   425
by (Blast_tac 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   426
val lemma1 = result();
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   427
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   428
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   429
(*Lemma (1,2,3) of Misra's draft book, Chapter 4, "Progress"*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   430
Goal "F : leadsTo A A' ==> \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   431
\     EX B. A<=B & F : leadsTo B A' & F : constrains (B-A') (B Un A')";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   432
by (etac leadsTo_induct 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   433
(*Basis*)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   434
by (blast_tac (claset() addIs [leadsTo_Basis]
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   435
                        addDs [ensuresD]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   436
(*Trans*)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   437
by (Clarify_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   438
by (res_inst_tac [("x", "Ba Un Bb")] exI 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   439
by (blast_tac (claset() addIs [lemma1, leadsTo_Un_Un, leadsTo_cancel1,
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   440
			       leadsTo_Un_duplicate]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   441
(*Union*)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   442
by (clarify_tac (claset() addSDs [ball_conj_distrib RS iffD1,
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   443
				  bchoice, ball_constrains_UN]) 1);;
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   444
by (res_inst_tac [("x", "UN A:S. f A")] exI 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   445
by (blast_tac (claset() addIs [leadsTo_UN, constrains_weaken]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   446
qed "leadsTo_123";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   447
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   448
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   449
(*Misra's property W5*)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   450
Goal "F : constrains (wlt F B - B) (wlt F B)";
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   451
by (cut_inst_tac [("F","F")] (wlt_leadsTo RS leadsTo_123) 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   452
by (Clarify_tac 1);
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   453
by (subgoal_tac "Ba = wlt F B" 1);
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   454
by (blast_tac (claset() addDs [leadsTo_eq_subset_wlt RS iffD1]) 2);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   455
by (Clarify_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   456
by (asm_full_simp_tac (simpset() addsimps [wlt_increasing, Un_absorb2]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   457
qed "wlt_constrains_wlt";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   458
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   459
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   460
(*** Completion: Binary and General Finite versions ***)
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   461
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   462
Goal "[| F : leadsTo A A';  F : stable A';   \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   463
\        F : leadsTo B B';  F : stable B' |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   464
\   ==> F : leadsTo (A Int B) (A' Int B')";
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   465
by (subgoal_tac "F : stable (wlt F B')" 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   466
by (asm_full_simp_tac (simpset() addsimps [stable_def]) 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   467
by (EVERY [etac (constrains_Un RS constrains_weaken) 2,
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   468
	   rtac wlt_constrains_wlt 2,
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   469
	   fast_tac (claset() addEs [wlt_increasing RSN (2,rev_subsetD)]) 3,
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   470
	   Blast_tac 2]);
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   471
by (subgoal_tac "F : leadsTo (A Int wlt F B') (A' Int wlt F B')" 1);
5277
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   472
by (blast_tac (claset() addIs [psp_stable]) 2);
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   473
by (subgoal_tac "F : leadsTo (A' Int wlt F B') (A' Int B')" 1);
5277
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   474
by (blast_tac (claset() addIs [wlt_leadsTo, psp_stable2]) 2);
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   475
by (subgoal_tac "F : leadsTo (A Int B) (A Int wlt F B')" 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   476
by (blast_tac (claset() addIs [leadsTo_subset RS subsetD, 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   477
			       subset_imp_leadsTo]) 2);
5479
5a5dfb0f0d7d fixed PROOF FAILED
paulson
parents: 5456
diff changeset
   478
by (blast_tac (claset() addIs [leadsTo_Trans]) 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   479
qed "stable_completion";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   480
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   481
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   482
Goal "finite I ==> (ALL i:I. F : leadsTo (A i) (A' i)) -->  \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   483
\                  (ALL i:I. F : stable (A' i)) -->         \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   484
\                  F : leadsTo (INT i:I. A i) (INT i:I. A' i)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   485
by (etac finite_induct 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   486
by (Asm_simp_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   487
by (asm_simp_tac 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   488
    (simpset() addsimps [stable_completion, stable_def, 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   489
			 ball_constrains_INT]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   490
qed_spec_mp "finite_stable_completion";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   491
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   492
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   493
Goal "[| W = wlt F (B' Un C);     \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   494
\      F : leadsTo A (A' Un C);  F : constrains A' (A' Un C);   \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   495
\      F : leadsTo B (B' Un C);  F : constrains B' (B' Un C) |] \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   496
\   ==> F : leadsTo (A Int B) ((A' Int B') Un C)";
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   497
by (subgoal_tac "F : constrains (W-C) (W Un B' Un C)" 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   498
by (blast_tac (claset() addIs [[asm_rl, wlt_constrains_wlt] 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   499
			       MRS constrains_Un RS constrains_weaken]) 2);
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   500
by (subgoal_tac "F : constrains (W-C) W" 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   501
by (asm_full_simp_tac 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   502
    (simpset() addsimps [wlt_increasing, Un_assoc, Un_absorb2]) 2);
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   503
by (subgoal_tac "F : leadsTo (A Int W - C) (A' Int W Un C)" 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   504
by (simp_tac (simpset() addsimps [Int_Diff]) 2);
5277
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   505
by (blast_tac (claset() addIs [wlt_leadsTo, psp RS leadsTo_weaken_R]) 2);
5456
paulson
parents: 5340
diff changeset
   506
(** LEVEL 7 **)
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   507
by (subgoal_tac "F : leadsTo (A' Int W Un C) (A' Int B' Un C)" 1);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   508
by (blast_tac (claset() addIs [wlt_leadsTo, leadsTo_Un_Un, 
5277
e4297d03e5d2 A higher-level treatment of LeadsTo, minimizing use of "reachable"
paulson
parents: 5257
diff changeset
   509
                               psp2 RS leadsTo_weaken_R, 
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   510
			       subset_refl RS subset_imp_leadsTo, 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   511
			       leadsTo_Un_duplicate2]) 2);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   512
by (dtac leadsTo_Diff 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   513
by (blast_tac (claset() addIs [subset_imp_leadsTo]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   514
by (subgoal_tac "A Int B <= A Int W" 1);
5456
paulson
parents: 5340
diff changeset
   515
by (blast_tac (claset() addSDs [leadsTo_subset]
paulson
parents: 5340
diff changeset
   516
			addSIs [subset_refl RS Int_mono]) 2);
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   517
by (blast_tac (claset() addIs [leadsTo_Trans, subset_imp_leadsTo]) 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   518
bind_thm("completion", refl RS result());
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   519
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   520
5648
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   521
Goal "finite I ==> (ALL i:I. F : leadsTo (A i) (A' i Un C)) -->  \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   522
\                  (ALL i:I. F : constrains (A' i) (A' i Un C)) --> \
fe887910e32e specifications as sets of programs
paulson
parents: 5640
diff changeset
   523
\                  F : leadsTo (INT i:I. A i) ((INT i:I. A' i) Un C)";
4776
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   524
by (etac finite_induct 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   525
by (ALLGOALS Asm_simp_tac);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   526
by (Clarify_tac 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   527
by (dtac ball_constrains_INT 1);
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   528
by (asm_full_simp_tac (simpset() addsimps [completion]) 1); 
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   529
qed "finite_completion";
1f9362e769c1 New UNITY theory
paulson
parents:
diff changeset
   530