author | paulson |
Wed, 02 Apr 1997 11:30:48 +0200 | |
changeset 2861 | 7bbd3751523f |
parent 2810 | c4e16b36bc57 |
child 3023 | 01364e2f30ad |
permissions | -rw-r--r-- |
1465 | 1 |
(* Title: HOL/IMP/Hoare.ML |
938 | 2 |
ID: $Id$ |
1465 | 3 |
Author: Tobias Nipkow |
936 | 4 |
Copyright 1995 TUM |
5 |
||
1481 | 6 |
Soundness (and part of) relative completeness of Hoare rules |
7 |
wrt denotational semantics |
|
936 | 8 |
*) |
9 |
||
10 |
open Hoare; |
|
11 |
||
1730 | 12 |
goalw Hoare.thy [hoare_valid_def] "!!P c Q. |- {P}c{Q} ==> |= {P}c{Q}"; |
13 |
by (etac hoare.induct 1); |
|
2055 | 14 |
by (ALLGOALS Asm_simp_tac); |
1973 | 15 |
by (Fast_tac 1); |
1910 | 16 |
by (Fast_tac 1); |
1465 | 17 |
by (rtac allI 1); |
18 |
by (rtac allI 1); |
|
19 |
by (rtac impI 1); |
|
20 |
by (etac induct2 1); |
|
2055 | 21 |
by (rtac Gamma_mono 1); |
1465 | 22 |
by (rewtac Gamma_def); |
1973 | 23 |
by (Fast_tac 1); |
1730 | 24 |
qed "hoare_sound"; |
936 | 25 |
|
2810 | 26 |
goalw Hoare.thy [wp_def] "wp SKIP Q = Q"; |
2031 | 27 |
by (Simp_tac 1); |
2810 | 28 |
qed "wp_SKIP"; |
1481 | 29 |
|
2810 | 30 |
goalw Hoare.thy [wp_def] "wp (x:=a) Q = (%s.Q(s[a s/x]))"; |
2031 | 31 |
by (Simp_tac 1); |
2810 | 32 |
qed "wp_Ass"; |
1481 | 33 |
|
2810 | 34 |
goalw Hoare.thy [wp_def] "wp (c;d) Q = wp c (wp d Q)"; |
2031 | 35 |
by (Simp_tac 1); |
36 |
by (rtac ext 1); |
|
1910 | 37 |
by (Fast_tac 1); |
2810 | 38 |
qed "wp_Semi"; |
936 | 39 |
|
2810 | 40 |
goalw Hoare.thy [wp_def] |
41 |
"wp (IF b THEN c ELSE d) Q = (%s. (b s --> wp c Q s) & \ |
|
42 |
\ (~b s --> wp d Q s))"; |
|
2031 | 43 |
by (Simp_tac 1); |
44 |
by (rtac ext 1); |
|
1910 | 45 |
by (Fast_tac 1); |
2810 | 46 |
qed "wp_If"; |
936 | 47 |
|
2810 | 48 |
goalw Hoare.thy [wp_def] |
49 |
"!!s. b s ==> wp (WHILE b DO c) Q s = wp (c;WHILE b DO c) Q s"; |
|
2031 | 50 |
by (stac C_While_If 1); |
51 |
by (Asm_simp_tac 1); |
|
2810 | 52 |
qed "wp_While_True"; |
1481 | 53 |
|
2810 | 54 |
goalw Hoare.thy [wp_def] "!!s. ~b s ==> wp (WHILE b DO c) Q s = Q s"; |
2031 | 55 |
by (stac C_While_If 1); |
56 |
by (Asm_simp_tac 1); |
|
2810 | 57 |
qed "wp_While_False"; |
1481 | 58 |
|
2810 | 59 |
Addsimps [wp_SKIP,wp_Ass,wp_Semi,wp_If,wp_While_True,wp_While_False]; |
1481 | 60 |
|
1910 | 61 |
(*Not suitable for rewriting: LOOPS!*) |
2810 | 62 |
goal Hoare.thy "wp (WHILE b DO c) Q s = \ |
63 |
\ (if b s then wp (c;WHILE b DO c) Q s else Q s)"; |
|
1910 | 64 |
by (simp_tac (!simpset setloop split_tac [expand_if]) 1); |
2810 | 65 |
qed "wp_While_if"; |
1910 | 66 |
|
2810 | 67 |
goal thy |
68 |
"wp (WHILE b DO c) Q s = \ |
|
69 |
\ (s : gfp(%S.{s.if b s then wp c (%s.s:S) s else Q s}))"; |
|
70 |
by(simp_tac (!simpset setloop(split_tac[expand_if])) 1); |
|
71 |
br iffI 1; |
|
72 |
br weak_coinduct 1; |
|
2861
7bbd3751523f
Replaced Best_tac by the one rule needed for the proof
paulson
parents:
2810
diff
changeset
|
73 |
by(etac CollectI 1); |
2810 | 74 |
by(safe_tac (!claset)); |
75 |
by(rotate_tac ~1 1); |
|
76 |
by(Asm_full_simp_tac 1); |
|
77 |
by(rotate_tac ~1 1); |
|
78 |
by(Asm_full_simp_tac 1); |
|
79 |
by(asm_full_simp_tac (!simpset addsimps [wp_def,Gamma_def]) 1); |
|
80 |
by(strip_tac 1); |
|
81 |
br mp 1; |
|
82 |
ba 2; |
|
83 |
be induct2 1; |
|
84 |
by(fast_tac (!claset addSIs [monoI]) 1); |
|
85 |
by(stac gfp_Tarski 1); |
|
86 |
by(fast_tac (!claset addSIs [monoI]) 1); |
|
87 |
by(Fast_tac 1); |
|
88 |
qed "wp_While"; |
|
1910 | 89 |
|
1481 | 90 |
Delsimps [C_while]; |
936 | 91 |
|
1910 | 92 |
AddSIs [hoare.skip, hoare.ass, hoare.semi, hoare.If]; |
93 |
||
2810 | 94 |
goal Hoare.thy "!Q. |- {wp c Q} c {Q}"; |
2031 | 95 |
by (com.induct_tac "c" 1); |
96 |
by (ALLGOALS Simp_tac); |
|
1910 | 97 |
by (REPEAT_FIRST Fast_tac); |
98 |
by (deepen_tac (!claset addIs [hoare.conseq]) 0 1); |
|
99 |
by (Step_tac 1); |
|
2031 | 100 |
by (rtac hoare.conseq 1); |
2055 | 101 |
by (etac thin_rl 1); |
1910 | 102 |
by (Fast_tac 1); |
2055 | 103 |
by (rtac hoare.While 1); |
104 |
by (rtac hoare.conseq 1); |
|
105 |
by (etac thin_rl 3); |
|
106 |
by (rtac allI 3); |
|
107 |
by (rtac impI 3); |
|
108 |
by (assume_tac 3); |
|
1910 | 109 |
by (Fast_tac 2); |
2055 | 110 |
by (safe_tac HOL_cs); |
111 |
by (rotate_tac ~1 1); |
|
112 |
by (Asm_full_simp_tac 1); |
|
2031 | 113 |
by (rotate_tac ~1 1); |
114 |
by (Asm_full_simp_tac 1); |
|
2810 | 115 |
qed_spec_mp "wp_is_pre"; |
1481 | 116 |
|
1486 | 117 |
goal Hoare.thy "!!c. |= {P}c{Q} ==> |- {P}c{Q}"; |
2810 | 118 |
by (rtac (wp_is_pre RSN (2,hoare.conseq)) 1); |
1910 | 119 |
by (Fast_tac 2); |
2810 | 120 |
by (rewrite_goals_tac [hoare_valid_def,wp_def]); |
1910 | 121 |
by (Fast_tac 1); |
1481 | 122 |
qed "hoare_relative_complete"; |