1465
|
1 |
(* Title: HOL/IMP/Hoare.ML
|
938
|
2 |
ID: $Id$
|
1465
|
3 |
Author: Tobias Nipkow
|
936
|
4 |
Copyright 1995 TUM
|
|
5 |
|
1481
|
6 |
Soundness (and part of) relative completeness of Hoare rules
|
|
7 |
wrt denotational semantics
|
936
|
8 |
*)
|
|
9 |
|
|
10 |
open Hoare;
|
|
11 |
|
1730
|
12 |
goalw Hoare.thy [hoare_valid_def] "!!P c Q. |- {P}c{Q} ==> |= {P}c{Q}";
|
|
13 |
by (etac hoare.induct 1);
|
2055
|
14 |
by (ALLGOALS Asm_simp_tac);
|
1973
|
15 |
by (Fast_tac 1);
|
1910
|
16 |
by (Fast_tac 1);
|
1465
|
17 |
by (rtac allI 1);
|
|
18 |
by (rtac allI 1);
|
|
19 |
by (rtac impI 1);
|
|
20 |
by (etac induct2 1);
|
2055
|
21 |
by (rtac Gamma_mono 1);
|
1465
|
22 |
by (rewtac Gamma_def);
|
1973
|
23 |
by (Fast_tac 1);
|
1730
|
24 |
qed "hoare_sound";
|
936
|
25 |
|
1696
|
26 |
goalw Hoare.thy [swp_def] "swp SKIP Q = Q";
|
2031
|
27 |
by (Simp_tac 1);
|
1696
|
28 |
qed "swp_SKIP";
|
1481
|
29 |
|
1696
|
30 |
goalw Hoare.thy [swp_def] "swp (x:=a) Q = (%s.Q(s[a s/x]))";
|
2031
|
31 |
by (Simp_tac 1);
|
1481
|
32 |
qed "swp_Ass";
|
|
33 |
|
|
34 |
goalw Hoare.thy [swp_def] "swp (c;d) Q = swp c (swp d Q)";
|
2031
|
35 |
by (Simp_tac 1);
|
|
36 |
by (rtac ext 1);
|
1910
|
37 |
by (Fast_tac 1);
|
1481
|
38 |
qed "swp_Semi";
|
936
|
39 |
|
1481
|
40 |
goalw Hoare.thy [swp_def]
|
1696
|
41 |
"swp (IF b THEN c ELSE d) Q = (%s. (b s --> swp c Q s) & \
|
|
42 |
\ (~b s --> swp d Q s))";
|
2031
|
43 |
by (Simp_tac 1);
|
|
44 |
by (rtac ext 1);
|
1910
|
45 |
by (Fast_tac 1);
|
1481
|
46 |
qed "swp_If";
|
936
|
47 |
|
1481
|
48 |
goalw Hoare.thy [swp_def]
|
1696
|
49 |
"!!s. b s ==> swp (WHILE b DO c) Q s = swp (c;WHILE b DO c) Q s";
|
2031
|
50 |
by (stac C_While_If 1);
|
|
51 |
by (Asm_simp_tac 1);
|
1481
|
52 |
qed "swp_While_True";
|
|
53 |
|
1696
|
54 |
goalw Hoare.thy [swp_def] "!!s. ~b s ==> swp (WHILE b DO c) Q s = Q s";
|
2031
|
55 |
by (stac C_While_If 1);
|
|
56 |
by (Asm_simp_tac 1);
|
1481
|
57 |
qed "swp_While_False";
|
|
58 |
|
1696
|
59 |
Addsimps [swp_SKIP,swp_Ass,swp_Semi,swp_If,swp_While_True,swp_While_False];
|
1481
|
60 |
|
1910
|
61 |
(*Not suitable for rewriting: LOOPS!*)
|
|
62 |
goal Hoare.thy "swp (WHILE b DO c) Q s = \
|
|
63 |
\ (if b s then swp (c;WHILE b DO c) Q s else Q s)";
|
|
64 |
by (simp_tac (!simpset setloop split_tac [expand_if]) 1);
|
|
65 |
qed "swp_While_if";
|
|
66 |
|
|
67 |
|
1481
|
68 |
Delsimps [C_while];
|
936
|
69 |
|
1910
|
70 |
AddSIs [hoare.skip, hoare.ass, hoare.semi, hoare.If];
|
|
71 |
|
1486
|
72 |
goal Hoare.thy "!Q. |- {swp c Q} c {Q}";
|
2031
|
73 |
by (com.induct_tac "c" 1);
|
|
74 |
by (ALLGOALS Simp_tac);
|
1910
|
75 |
by (REPEAT_FIRST Fast_tac);
|
|
76 |
by (deepen_tac (!claset addIs [hoare.conseq]) 0 1);
|
|
77 |
by (Step_tac 1);
|
2031
|
78 |
by (rtac hoare.conseq 1);
|
2055
|
79 |
by (etac thin_rl 1);
|
1910
|
80 |
by (Fast_tac 1);
|
2055
|
81 |
by (rtac hoare.While 1);
|
|
82 |
by (rtac hoare.conseq 1);
|
|
83 |
by (etac thin_rl 3);
|
|
84 |
by (rtac allI 3);
|
|
85 |
by (rtac impI 3);
|
|
86 |
by (assume_tac 3);
|
1910
|
87 |
by (Fast_tac 2);
|
2055
|
88 |
by (safe_tac HOL_cs);
|
|
89 |
by (rotate_tac ~1 1);
|
|
90 |
by (Asm_full_simp_tac 1);
|
2031
|
91 |
by (rotate_tac ~1 1);
|
|
92 |
by (Asm_full_simp_tac 1);
|
1486
|
93 |
qed_spec_mp "swp_is_pre";
|
1481
|
94 |
|
1486
|
95 |
goal Hoare.thy "!!c. |= {P}c{Q} ==> |- {P}c{Q}";
|
2031
|
96 |
by (rtac (swp_is_pre RSN (2,hoare.conseq)) 1);
|
1910
|
97 |
by (Fast_tac 2);
|
2031
|
98 |
by (rewrite_goals_tac [hoare_valid_def,swp_def]);
|
1910
|
99 |
by (Fast_tac 1);
|
1481
|
100 |
qed "hoare_relative_complete";
|