11479
|
1 |
(* Title: HOL/UNITY/WFair.ML
|
|
2 |
ID: $Id$
|
|
3 |
Author: Sidi O Ehmety, Computer Laboratory
|
|
4 |
Copyright 2001 University of Cambridge
|
|
5 |
|
|
6 |
Weak Fairness versions of transient, ensures, leadsTo.
|
|
7 |
|
|
8 |
From Misra, "A Logic for Concurrent Programming", 1994
|
|
9 |
*)
|
|
10 |
|
|
11 |
(*** transient ***)
|
|
12 |
|
12195
|
13 |
Goalw [transient_def] "transient(A)<=program";
|
11479
|
14 |
by Auto_tac;
|
12195
|
15 |
qed "transient_type";
|
|
16 |
|
|
17 |
Goalw [transient_def]
|
|
18 |
"F:transient(A) ==> F:program & st_set(A)";
|
|
19 |
by Auto_tac;
|
|
20 |
qed "transientD2";
|
11479
|
21 |
|
|
22 |
Goalw [stable_def, constrains_def, transient_def]
|
|
23 |
"[| F : stable(A); F : transient(A) |] ==> A = 0";
|
|
24 |
by Auto_tac;
|
|
25 |
by (Blast_tac 1);
|
|
26 |
qed "stable_transient_empty";
|
|
27 |
|
12195
|
28 |
Goalw [transient_def, st_set_def]
|
|
29 |
"[|F:transient(A); B<=A|] ==> F:transient(B)";
|
11479
|
30 |
by Safe_tac;
|
|
31 |
by (res_inst_tac [("x", "act")] bexI 1);
|
|
32 |
by (ALLGOALS(Asm_full_simp_tac));
|
|
33 |
by (Blast_tac 1);
|
12195
|
34 |
by Auto_tac;
|
11479
|
35 |
qed "transient_strengthen";
|
|
36 |
|
12195
|
37 |
Goalw [transient_def]
|
|
38 |
"[|act:Acts(F); A <= domain(act); act``A <= state-A; \
|
|
39 |
\ F:program; st_set(A)|] ==> F:transient(A)";
|
11479
|
40 |
by (Blast_tac 1);
|
|
41 |
qed "transientI";
|
|
42 |
|
|
43 |
val major::prems =
|
12195
|
44 |
Goalw [transient_def] "[| F:transient(A); \
|
|
45 |
\ !!act. [| act:Acts(F); A <= domain(act); act``A <= state-A|]==>P|]==>P";
|
11479
|
46 |
by (rtac (major RS CollectE) 1);
|
|
47 |
by (blast_tac (claset() addIs prems) 1);
|
|
48 |
qed "transientE";
|
|
49 |
|
|
50 |
Goalw [transient_def] "transient(state) = 0";
|
|
51 |
by (rtac equalityI 1);
|
|
52 |
by (ALLGOALS(Clarify_tac));
|
12195
|
53 |
by (cut_inst_tac [("F", "x")] Acts_type 1);
|
11479
|
54 |
by (asm_full_simp_tac (simpset() addsimps [Diff_cancel]) 1);
|
12195
|
55 |
by (subgoal_tac "EX x. x:state" 1);
|
|
56 |
by Auto_tac;
|
11479
|
57 |
qed "transient_state";
|
|
58 |
|
12195
|
59 |
Goalw [transient_def,st_set_def] "state<=B ==> transient(B) = 0";
|
|
60 |
by (rtac equalityI 1);
|
|
61 |
by (ALLGOALS(Clarify_tac));
|
|
62 |
by (cut_inst_tac [("F", "x")] Acts_type 1);
|
|
63 |
by (asm_full_simp_tac (simpset() addsimps [Diff_cancel]) 1);
|
|
64 |
by (subgoal_tac "EX x. x:state" 1);
|
|
65 |
by (subgoal_tac "B=state" 1);
|
|
66 |
by Auto_tac;
|
|
67 |
qed "transient_state2";
|
|
68 |
|
11479
|
69 |
Goalw [transient_def] "transient(0) = program";
|
|
70 |
by (rtac equalityI 1);
|
12195
|
71 |
by Auto_tac;
|
11479
|
72 |
qed "transient_empty";
|
|
73 |
|
12195
|
74 |
Addsimps [transient_empty, transient_state, transient_state2];
|
11479
|
75 |
|
|
76 |
(*** ensures ***)
|
|
77 |
|
12195
|
78 |
Goalw [ensures_def, constrains_def] "A ensures B <=program";
|
|
79 |
by Auto_tac;
|
|
80 |
qed "ensures_type";
|
|
81 |
|
11479
|
82 |
Goalw [ensures_def]
|
12195
|
83 |
"[|F:(A-B) co (A Un B); F:transient(A-B)|]==>F:A ensures B";
|
|
84 |
by (auto_tac (claset(), simpset() addsimps [transient_type RS subsetD]));
|
11479
|
85 |
qed "ensuresI";
|
|
86 |
|
12195
|
87 |
(* Added by Sidi, from Misra's notes, Progress chapter, exercise 4 *)
|
11479
|
88 |
Goal "[| F:A co A Un B; F: transient(A) |] ==> F: A ensures B";
|
|
89 |
by (dres_inst_tac [("B", "A-B")] constrains_weaken_L 1);
|
|
90 |
by (dres_inst_tac [("B", "A-B")] transient_strengthen 2);
|
12195
|
91 |
by (auto_tac (claset(), simpset() addsimps [ensures_def, transient_type RS subsetD]));
|
11479
|
92 |
qed "ensuresI2";
|
|
93 |
|
12195
|
94 |
Goalw [ensures_def] "F:A ensures B ==> F:(A-B) co (A Un B) & F:transient (A-B)";
|
|
95 |
by Auto_tac;
|
11479
|
96 |
qed "ensuresD";
|
|
97 |
|
12195
|
98 |
Goalw [ensures_def] "[|F:A ensures A'; A'<=B' |] ==> F:A ensures B'";
|
11479
|
99 |
by (blast_tac (claset()
|
12195
|
100 |
addIs [transient_strengthen, constrains_weaken]) 1);
|
11479
|
101 |
qed "ensures_weaken_R";
|
|
102 |
|
|
103 |
(*The L-version (precondition strengthening) fails, but we have this*)
|
12195
|
104 |
Goalw [ensures_def] "[| F:stable(C); F:A ensures B |] ==> F:(C Int A) ensures (C Int B)";
|
11479
|
105 |
by (asm_full_simp_tac (simpset() addsimps [ensures_def,
|
|
106 |
Int_Un_distrib2,
|
|
107 |
Diff_Int_distrib RS sym]) 1);
|
|
108 |
by (Clarify_tac 1);
|
|
109 |
by (blast_tac (claset()
|
|
110 |
addIs [transient_strengthen,
|
12195
|
111 |
stable_constrains_Int, constrains_weaken]) 1);
|
11479
|
112 |
qed "stable_ensures_Int";
|
|
113 |
|
12195
|
114 |
Goal "[|F:stable(A); F:transient(C); A<=B Un C|] ==> F : A ensures B";
|
|
115 |
by (forward_tac [stable_type RS subsetD] 1);
|
|
116 |
by (asm_full_simp_tac (simpset() addsimps [ensures_def, stable_def]) 1);
|
11479
|
117 |
by (Clarify_tac 1);
|
|
118 |
by (blast_tac (claset() addIs [transient_strengthen,
|
12195
|
119 |
constrains_weaken]) 1);
|
11479
|
120 |
qed "stable_transient_ensures";
|
|
121 |
|
|
122 |
Goal "(A ensures B) = (A unless B) Int transient (A-B)";
|
12195
|
123 |
by (auto_tac (claset(), simpset() addsimps [ensures_def, unless_def]));
|
11479
|
124 |
qed "ensures_eq";
|
|
125 |
|
12195
|
126 |
Goal "[| F:program; A<=B |] ==> F : A ensures B";
|
|
127 |
by (rewrite_goal_tac [ensures_def,constrains_def,transient_def, st_set_def] 1);
|
|
128 |
by Auto_tac;
|
|
129 |
qed "subset_imp_ensures";
|
|
130 |
|
11479
|
131 |
(*** leadsTo ***)
|
12195
|
132 |
val leads_left = leads.dom_subset RS subsetD RS SigmaD1;
|
|
133 |
val leads_right = leads.dom_subset RS subsetD RS SigmaD2;
|
11479
|
134 |
|
12195
|
135 |
Goalw [leadsTo_def] "A leadsTo B <= program";
|
|
136 |
by Auto_tac;
|
|
137 |
qed "leadsTo_type";
|
|
138 |
|
|
139 |
Goalw [leadsTo_def, st_set_def]
|
|
140 |
"F: A leadsTo B ==> F:program & st_set(A) & st_set(B)";
|
|
141 |
by (blast_tac (claset() addDs [leads_left, leads_right]) 1);
|
|
142 |
qed "leadsToD2";
|
11479
|
143 |
|
12195
|
144 |
Goalw [leadsTo_def, st_set_def]
|
|
145 |
"[|F:A ensures B; st_set(A); st_set(B)|] ==> F:A leadsTo B";
|
|
146 |
by (cut_facts_tac [ensures_type] 1);
|
|
147 |
by (auto_tac (claset() addIs [leads.Basis], simpset()));
|
11479
|
148 |
qed "leadsTo_Basis";
|
12195
|
149 |
AddIs [leadsTo_Basis];
|
11479
|
150 |
|
12195
|
151 |
(* Added by Sidi, from Misra's notes, Progress chapter, exercise number 4 *)
|
|
152 |
(* [| F:program; A<=B; st_set(A); st_set(B) |] ==> A leadsTo B *)
|
|
153 |
bind_thm ("subset_imp_leadsTo", subset_imp_ensures RS leadsTo_Basis);
|
11479
|
154 |
|
12195
|
155 |
Goalw [leadsTo_def] "[|F: A leadsTo B; F: B leadsTo C |]==>F: A leadsTo C";
|
|
156 |
by (auto_tac (claset() addIs [leads.Trans], simpset()));
|
11479
|
157 |
qed "leadsTo_Trans";
|
|
158 |
|
12195
|
159 |
(* Better when used in association with leadsTo_weaken_R *)
|
|
160 |
Goalw [transient_def] "F:transient(A) ==> F : A leadsTo (state-A )";
|
11479
|
161 |
by (rtac (ensuresI RS leadsTo_Basis) 1);
|
|
162 |
by (ALLGOALS(Clarify_tac));
|
|
163 |
by (blast_tac (claset() addIs [transientI]) 2);
|
|
164 |
by (rtac constrains_weaken 1);
|
|
165 |
by Auto_tac;
|
|
166 |
qed "transient_imp_leadsTo";
|
|
167 |
|
|
168 |
(*Useful with cancellation, disjunction*)
|
|
169 |
Goal "F : A leadsTo (A' Un A') ==> F : A leadsTo A'";
|
|
170 |
by (asm_full_simp_tac (simpset() addsimps Un_ac) 1);
|
|
171 |
qed "leadsTo_Un_duplicate";
|
|
172 |
|
|
173 |
Goal "F : A leadsTo (A' Un C Un C) ==> F : A leadsTo (A' Un C)";
|
|
174 |
by (asm_full_simp_tac (simpset() addsimps Un_ac) 1);
|
|
175 |
qed "leadsTo_Un_duplicate2";
|
|
176 |
|
12195
|
177 |
(* The Union introduction rule as we should have liked to state it *)
|
|
178 |
val [major, program,B]= Goalw [leadsTo_def, st_set_def]
|
|
179 |
"[|(!!A. A:S ==> F:A leadsTo B); F:program; st_set(B)|]==>F:Union(S) leadsTo B";
|
|
180 |
by (cut_facts_tac [program, B] 1);
|
|
181 |
by Auto_tac;
|
|
182 |
by (rtac leads.Union 1);
|
|
183 |
by Auto_tac;
|
|
184 |
by (ALLGOALS(dtac major));
|
|
185 |
by (auto_tac (claset() addDs [leads_left], simpset()));
|
|
186 |
qed "leadsTo_Union";
|
11479
|
187 |
|
12195
|
188 |
val [major,program,B] = Goalw [leadsTo_def, st_set_def]
|
|
189 |
"[|(!!A. A:S ==>F:(A Int C) leadsTo B); F:program; st_set(B)|]==>F:(Union(S)Int C)leadsTo B";
|
|
190 |
by (cut_facts_tac [program, B] 1);
|
|
191 |
by (asm_simp_tac (simpset() addsimps [Int_Union_Union]) 1);
|
|
192 |
by (rtac leads.Union 1);
|
|
193 |
by Auto_tac;
|
|
194 |
by (ALLGOALS(dtac major));
|
|
195 |
by (auto_tac (claset() addDs [leads_left], simpset()));
|
|
196 |
qed "leadsTo_Union_Int";
|
11479
|
197 |
|
12195
|
198 |
val [major,program,B] = Goalw [leadsTo_def, st_set_def]
|
|
199 |
"[|(!!i. i:I ==> F : A(i) leadsTo B); F:program; st_set(B)|]==>F:(UN i:I. A(i)) leadsTo B";
|
|
200 |
by (cut_facts_tac [program, B] 1);
|
|
201 |
by (asm_simp_tac (simpset() addsimps [Int_Union_Union]) 1);
|
|
202 |
by (rtac leads.Union 1);
|
|
203 |
by Auto_tac;
|
|
204 |
by (ALLGOALS(dtac major));
|
|
205 |
by (auto_tac (claset() addDs [leads_left], simpset()));
|
|
206 |
qed "leadsTo_UN";
|
11479
|
207 |
|
12195
|
208 |
(* Binary union introduction rule *)
|
11479
|
209 |
Goal "[| F: A leadsTo C; F: B leadsTo C |] ==> F : (A Un B) leadsTo C";
|
|
210 |
by (stac Un_eq_Union 1);
|
12195
|
211 |
by (blast_tac (claset() addIs [leadsTo_Union] addDs [leadsToD2]) 1);
|
11479
|
212 |
qed "leadsTo_Un";
|
|
213 |
|
12195
|
214 |
val [major, program, B] = Goal
|
|
215 |
"[|(!!x. x:A==> F:{x} leadsTo B); F:program; st_set(B) |] ==> F:A leadsTo B";
|
|
216 |
by (res_inst_tac [("b", "A")] (UN_singleton RS subst) 1);
|
|
217 |
by (rtac leadsTo_UN 1);
|
|
218 |
by (auto_tac (claset() addDs prems, simpset() addsimps [major, program, B]));
|
|
219 |
qed "single_leadsTo_I";
|
|
220 |
|
|
221 |
Goal "[| F:program; st_set(A) |] ==> F: A leadsTo A";
|
|
222 |
by (blast_tac (claset() addIs [subset_imp_leadsTo]) 1);
|
|
223 |
qed "leadsTo_refl";
|
|
224 |
|
|
225 |
Goal "F: A leadsTo A <-> F:program & st_set(A)";
|
|
226 |
by (auto_tac (claset() addIs [leadsTo_refl]
|
|
227 |
addDs [leadsToD2], simpset()));
|
|
228 |
qed "leadsTo_refl_iff";
|
|
229 |
|
|
230 |
Goal "F: 0 leadsTo B <-> (F:program & st_set(B))";
|
|
231 |
by (auto_tac (claset() addIs [subset_imp_leadsTo]
|
|
232 |
addDs [leadsToD2], simpset()));
|
|
233 |
qed "empty_leadsTo";
|
|
234 |
AddIffs [empty_leadsTo];
|
|
235 |
|
|
236 |
Goal "F: A leadsTo state <-> (F:program & st_set(A))";
|
|
237 |
by (auto_tac (claset() addIs [subset_imp_leadsTo]
|
|
238 |
addDs [leadsToD2, st_setD], simpset()));
|
|
239 |
qed "leadsTo_state";
|
|
240 |
AddIffs [leadsTo_state];
|
|
241 |
|
|
242 |
Goal "[| F:A leadsTo A'; A'<=B'; st_set(B') |] ==> F : A leadsTo B'";
|
|
243 |
by (blast_tac (claset() addDs [leadsToD2]
|
|
244 |
addIs [subset_imp_leadsTo,leadsTo_Trans]) 1);
|
|
245 |
qed "leadsTo_weaken_R";
|
|
246 |
|
|
247 |
Goal "[| F:A leadsTo A'; B<=A |] ==> F : B leadsTo A'";
|
|
248 |
by (forward_tac [leadsToD2] 1);
|
|
249 |
by (blast_tac (claset() addIs [leadsTo_Trans,subset_imp_leadsTo, st_set_subset]) 1);
|
|
250 |
qed_spec_mp "leadsTo_weaken_L";
|
|
251 |
|
|
252 |
Goal "[| F:A leadsTo A'; B<=A; A'<=B'; st_set(B')|]==> F:B leadsTo B'";
|
|
253 |
by (forward_tac [leadsToD2] 1);
|
|
254 |
by (blast_tac (claset() addIs [leadsTo_weaken_R, leadsTo_weaken_L,
|
|
255 |
leadsTo_Trans, leadsTo_refl]) 1);
|
|
256 |
qed "leadsTo_weaken";
|
|
257 |
|
|
258 |
(* This rule has a nicer conclusion *)
|
|
259 |
Goal "[| F:transient(A); state-A<=B; st_set(B)|] ==> F:A leadsTo B";
|
|
260 |
by (forward_tac [transientD2] 1);
|
|
261 |
by (rtac leadsTo_weaken_R 1);
|
|
262 |
by (auto_tac (claset(), simpset() addsimps [transient_imp_leadsTo]));
|
|
263 |
qed "transient_imp_leadsTo2";
|
|
264 |
|
|
265 |
(*Distributes over binary unions*)
|
|
266 |
Goal "F:(A Un B) leadsTo C <-> (F:A leadsTo C & F : B leadsTo C)";
|
|
267 |
by (blast_tac (claset() addIs [leadsTo_Un, leadsTo_weaken_L]) 1);
|
|
268 |
qed "leadsTo_Un_distrib";
|
|
269 |
|
|
270 |
Goal
|
|
271 |
"(F:(UN i:I. A(i)) leadsTo B)<-> ((ALL i : I. F: A(i) leadsTo B) & F:program & st_set(B))";
|
|
272 |
by (blast_tac (claset() addDs [leadsToD2]
|
|
273 |
addIs [leadsTo_UN, leadsTo_weaken_L]) 1);
|
|
274 |
qed "leadsTo_UN_distrib";
|
|
275 |
|
|
276 |
Goal "(F: Union(S) leadsTo B) <-> (ALL A:S. F : A leadsTo B) & F:program & st_set(B)";
|
|
277 |
by (blast_tac (claset() addDs [leadsToD2]
|
|
278 |
addIs [leadsTo_Union, leadsTo_weaken_L]) 1);
|
|
279 |
qed "leadsTo_Union_distrib";
|
|
280 |
|
|
281 |
(*Set difference: maybe combine with leadsTo_weaken_L?*)
|
|
282 |
Goal "[| F: (A-B) leadsTo C; F: B leadsTo C; st_set(C) |] ==> F: A leadsTo C";
|
|
283 |
by (blast_tac (claset() addIs [leadsTo_Un, leadsTo_weaken]
|
|
284 |
addDs [leadsToD2]) 1);
|
|
285 |
qed "leadsTo_Diff";
|
|
286 |
|
|
287 |
val [major,minor] = Goal
|
|
288 |
"[|(!!i. i:I ==> F: A(i) leadsTo A'(i)); F:program |] \
|
|
289 |
\ ==> F: (UN i:I. A(i)) leadsTo (UN i:I. A'(i))";
|
|
290 |
by (rtac leadsTo_Union 1);
|
|
291 |
by (ALLGOALS(Asm_simp_tac));
|
|
292 |
by Safe_tac;
|
|
293 |
by (simp_tac (simpset() addsimps [minor]) 2);
|
|
294 |
by (blast_tac (claset() addDs [leadsToD2, major])2);
|
|
295 |
by (blast_tac (claset() addIs [leadsTo_weaken_R] addDs [major, leadsToD2]) 1);
|
|
296 |
qed "leadsTo_UN_UN";
|
|
297 |
|
|
298 |
(*Binary union version*)
|
|
299 |
Goal "[| F: A leadsTo A'; F:B leadsTo B' |] ==> F : (A Un B) leadsTo (A' Un B')";
|
|
300 |
by (subgoal_tac "st_set(A) & st_set(A') & st_set(B) & st_set(B')" 1);
|
|
301 |
by (blast_tac (claset() addDs [leadsToD2]) 2);
|
|
302 |
by (blast_tac (claset() addIs [leadsTo_Un, leadsTo_weaken_R]) 1);
|
|
303 |
qed "leadsTo_Un_Un";
|
|
304 |
|
|
305 |
(** The cancellation law **)
|
|
306 |
Goal "[|F: A leadsTo (A' Un B); F: B leadsTo B'|] ==> F: A leadsTo (A' Un B')";
|
|
307 |
by (subgoal_tac "st_set(A) & st_set(A') & st_set(B) & st_set(B') &F:program" 1);
|
|
308 |
by (blast_tac (claset() addDs [leadsToD2]) 2);
|
|
309 |
by (blast_tac (claset() addIs [leadsTo_Trans, leadsTo_Un_Un, leadsTo_refl]) 1);
|
|
310 |
qed "leadsTo_cancel2";
|
|
311 |
|
|
312 |
Goal "[|F: A leadsTo (A' Un B); F : (B-A') leadsTo B'|]==> F: A leadsTo (A' Un B')";
|
|
313 |
by (rtac leadsTo_cancel2 1);
|
|
314 |
by (assume_tac 2);
|
|
315 |
by (blast_tac (claset() addDs [leadsToD2] addIs [leadsTo_weaken_R]) 1);
|
|
316 |
qed "leadsTo_cancel_Diff2";
|
|
317 |
|
11479
|
318 |
|
12195
|
319 |
Goal "[| F : A leadsTo (B Un A'); F : B leadsTo B' |] ==> F:A leadsTo (B' Un A')";
|
|
320 |
by (asm_full_simp_tac (simpset() addsimps [Un_commute]) 1);
|
|
321 |
by (blast_tac (claset() addSIs [leadsTo_cancel2]) 1);
|
|
322 |
qed "leadsTo_cancel1";
|
11479
|
323 |
|
12195
|
324 |
Goal "[|F: A leadsTo (B Un A'); F: (B-A') leadsTo B'|]==> F : A leadsTo (B' Un A')";
|
|
325 |
by (rtac leadsTo_cancel1 1);
|
|
326 |
by (assume_tac 2);
|
|
327 |
by (blast_tac (claset() addIs [leadsTo_weaken_R] addDs [leadsToD2]) 1);
|
|
328 |
qed "leadsTo_cancel_Diff1";
|
11479
|
329 |
|
|
330 |
(*The INDUCTION rule as we should have liked to state it*)
|
12195
|
331 |
val [major, basis_prem, trans_prem, union_prem] = Goalw [leadsTo_def, st_set_def]
|
11479
|
332 |
"[| F: za leadsTo zb; \
|
12195
|
333 |
\ !!A B. [| F: A ensures B; st_set(A); st_set(B) |] ==> P(A, B); \
|
11479
|
334 |
\ !!A B C. [| F: A leadsTo B; P(A, B); \
|
|
335 |
\ F: B leadsTo C; P(B, C) |] \
|
|
336 |
\ ==> P(A, C); \
|
12195
|
337 |
\ !!B S. [| ALL A:S. F:A leadsTo B; ALL A:S. P(A, B); st_set(B); ALL A:S. st_set(A)|] \
|
11479
|
338 |
\ ==> P(Union(S), B) \
|
|
339 |
\ |] ==> P(za, zb)";
|
|
340 |
by (cut_facts_tac [major] 1);
|
|
341 |
by (rtac (major RS CollectD2 RS leads.induct) 1);
|
12195
|
342 |
by (rtac union_prem 3);
|
|
343 |
by (rtac trans_prem 2);
|
|
344 |
by (rtac basis_prem 1);
|
|
345 |
by Auto_tac;
|
11479
|
346 |
qed "leadsTo_induct";
|
|
347 |
|
12195
|
348 |
(* Added by Sidi, an induction rule without ensures *)
|
|
349 |
val [major,imp_prem,basis_prem,trans_prem,union_prem] = Goal
|
11479
|
350 |
"[| F: za leadsTo zb; \
|
12195
|
351 |
\ !!A B. [| A<=B; st_set(B) |] ==> P(A, B); \
|
|
352 |
\ !!A B. [| F:A co A Un B; F:transient(A); st_set(B) |] ==> P(A, B); \
|
11479
|
353 |
\ !!A B C. [| F: A leadsTo B; P(A, B); \
|
|
354 |
\ F: B leadsTo C; P(B, C) |] \
|
|
355 |
\ ==> P(A, C); \
|
12195
|
356 |
\ !!B S. [| ALL A:S. F:A leadsTo B; ALL A:S. P(A, B); st_set(B); ALL A:S. st_set(A) |] \
|
11479
|
357 |
\ ==> P(Union(S), B) \
|
|
358 |
\ |] ==> P(za, zb)";
|
|
359 |
by (cut_facts_tac [major] 1);
|
|
360 |
by (etac leadsTo_induct 1);
|
12195
|
361 |
by (auto_tac (claset() addIs [trans_prem,union_prem], simpset()));
|
11479
|
362 |
by (rewrite_goal_tac [ensures_def] 1);
|
12195
|
363 |
by (Clarify_tac 1);
|
11479
|
364 |
by (forward_tac [constrainsD2] 1);
|
|
365 |
by (dres_inst_tac [("B'", "(A-B) Un B")] constrains_weaken_R 1);
|
12195
|
366 |
by (Blast_tac 1);
|
11479
|
367 |
by (forward_tac [ensuresI2 RS leadsTo_Basis] 1);
|
12195
|
368 |
by (dtac basis_prem 4);
|
|
369 |
by (ALLGOALS(Asm_full_simp_tac));
|
|
370 |
by (forw_inst_tac [("A1", "A"), ("B", "B")] (Int_lower2 RS imp_prem) 1);
|
|
371 |
by (subgoal_tac "A=Union({A - B, A Int B})" 1);
|
|
372 |
by (Blast_tac 2);
|
|
373 |
by (etac ssubst 1);
|
|
374 |
by (rtac union_prem 1);
|
11479
|
375 |
by (auto_tac (claset() addIs [subset_imp_leadsTo], simpset()));
|
|
376 |
qed "leadsTo_induct2";
|
|
377 |
|
|
378 |
(** Variant induction rule: on the preconditions for B **)
|
|
379 |
(*Lemma is the weak version: can't see how to do it in one step*)
|
|
380 |
val major::prems = Goal
|
|
381 |
"[| F : za leadsTo zb; \
|
|
382 |
\ P(zb); \
|
12195
|
383 |
\ !!A B. [| F : A ensures B; P(B); st_set(A); st_set(B) |] ==> P(A); \
|
|
384 |
\ !!S. [| ALL A:S. P(A); ALL A:S. st_set(A) |] ==> P(Union(S)) \
|
11479
|
385 |
\ |] ==> P(za)";
|
|
386 |
(*by induction on this formula*)
|
|
387 |
by (subgoal_tac "P(zb) --> P(za)" 1);
|
|
388 |
(*now solve first subgoal: this formula is sufficient*)
|
|
389 |
by (blast_tac (claset() addIs leadsTo_refl::prems) 1);
|
|
390 |
by (rtac (major RS leadsTo_induct) 1);
|
|
391 |
by (REPEAT (blast_tac (claset() addIs prems) 1));
|
|
392 |
qed "lemma";
|
|
393 |
|
|
394 |
|
12195
|
395 |
val [major, zb_prem, basis_prem, union_prem] = Goal
|
11479
|
396 |
"[| F : za leadsTo zb; \
|
|
397 |
\ P(zb); \
|
12195
|
398 |
\ !!A B. [| F : A ensures B; F : B leadsTo zb; P(B); st_set(A) |] ==> P(A); \
|
|
399 |
\ !!S. ALL A:S. F : A leadsTo zb & P(A) & st_set(A) ==> P(Union(S)) \
|
11479
|
400 |
\ |] ==> P(za)";
|
|
401 |
by (cut_facts_tac [major] 1);
|
|
402 |
by (subgoal_tac "(F : za leadsTo zb) & P(za)" 1);
|
|
403 |
by (etac conjunct2 1);
|
|
404 |
by (rtac (major RS lemma) 1);
|
12195
|
405 |
by (blast_tac (claset() addDs [leadsToD2]
|
|
406 |
addIs [leadsTo_Union,union_prem]) 3);
|
|
407 |
by (blast_tac (claset() addIs [leadsTo_Trans,basis_prem, leadsTo_Basis]) 2);
|
|
408 |
by (blast_tac (claset() addIs [leadsTo_refl,zb_prem]
|
|
409 |
addDs [leadsToD2]) 1);
|
11479
|
410 |
qed "leadsTo_induct_pre";
|
|
411 |
|
|
412 |
(** The impossibility law **)
|
|
413 |
Goal
|
|
414 |
"F : A leadsTo 0 ==> A=0";
|
|
415 |
by (etac leadsTo_induct_pre 1);
|
12195
|
416 |
by (auto_tac (claset(), simpset() addsimps
|
|
417 |
[ensures_def, constrains_def, transient_def, st_set_def]));
|
|
418 |
by (dtac bspec 1);
|
|
419 |
by (REPEAT(Blast_tac 1));
|
11479
|
420 |
qed "leadsTo_empty";
|
12195
|
421 |
Addsimps [leadsTo_empty];
|
11479
|
422 |
|
|
423 |
(** PSP: Progress-Safety-Progress **)
|
|
424 |
|
|
425 |
(*Special case of PSP: Misra's "stable conjunction"*)
|
|
426 |
Goalw [stable_def]
|
12195
|
427 |
"[| F : A leadsTo A'; F : stable(B) |] ==> F:(A Int B) leadsTo (A' Int B)";
|
11479
|
428 |
by (etac leadsTo_induct 1);
|
|
429 |
by (rtac leadsTo_Union_Int 3);
|
12195
|
430 |
by (ALLGOALS(Asm_simp_tac));
|
|
431 |
by (REPEAT(blast_tac (claset() addDs [constrainsD2]) 3));
|
11479
|
432 |
by (blast_tac (claset() addIs [leadsTo_Trans]) 2);
|
|
433 |
by (rtac leadsTo_Basis 1);
|
|
434 |
by (asm_full_simp_tac (simpset()
|
|
435 |
addsimps [ensures_def, Diff_Int_distrib RS sym,
|
|
436 |
Diff_Int_distrib2 RS sym, Int_Un_distrib RS sym]) 1);
|
|
437 |
by (REPEAT(blast_tac (claset()
|
|
438 |
addIs [transient_strengthen,constrains_Int]
|
|
439 |
addDs [constrainsD2]) 1));
|
|
440 |
qed "psp_stable";
|
|
441 |
|
|
442 |
|
12195
|
443 |
Goal "[|F: A leadsTo A'; F : stable(B) |]==>F: (B Int A) leadsTo (B Int A')";
|
11479
|
444 |
by (asm_simp_tac (simpset()
|
|
445 |
addsimps psp_stable::Int_ac) 1);
|
|
446 |
qed "psp_stable2";
|
|
447 |
|
12195
|
448 |
Goalw [ensures_def, constrains_def, st_set_def]
|
|
449 |
"[| F: A ensures A'; F: B co B' |]==> F: (A Int B') ensures ((A' Int B) Un (B' - B))";
|
11479
|
450 |
(*speeds up the proof*)
|
|
451 |
by (Clarify_tac 1);
|
|
452 |
by (blast_tac (claset() addIs [transient_strengthen]) 1);
|
|
453 |
qed "psp_ensures";
|
|
454 |
|
12195
|
455 |
Goal
|
|
456 |
"[|F:A leadsTo A'; F: B co B'; st_set(B')|]==> F:(A Int B') leadsTo ((A' Int B) Un (B' - B))";
|
|
457 |
by (subgoal_tac "F:program & st_set(A) & st_set(A')& st_set(B)" 1);
|
|
458 |
by (blast_tac (claset() addSDs [constrainsD2, leadsToD2]) 2);
|
11479
|
459 |
by (etac leadsTo_induct 1);
|
|
460 |
by (blast_tac (claset() addIs [leadsTo_Union_Int]) 3);
|
|
461 |
(*Transitivity case has a delicate argument involving "cancellation"*)
|
|
462 |
by (rtac leadsTo_Un_duplicate2 2);
|
|
463 |
by (etac leadsTo_cancel_Diff1 2);
|
|
464 |
by (asm_full_simp_tac (simpset() addsimps [Int_Diff, Diff_triv]) 2);
|
|
465 |
by (blast_tac (claset() addIs [leadsTo_weaken_L]
|
|
466 |
addDs [constrains_imp_subset]) 2);
|
|
467 |
(*Basis case*)
|
12195
|
468 |
by (blast_tac (claset() addIs [psp_ensures, leadsTo_Basis]) 1);
|
11479
|
469 |
qed "psp";
|
|
470 |
|
|
471 |
|
12195
|
472 |
Goal "[| F : A leadsTo A'; F : B co B'; st_set(B') |] \
|
11479
|
473 |
\ ==> F : (B' Int A) leadsTo ((B Int A') Un (B' - B))";
|
|
474 |
by (asm_simp_tac (simpset() addsimps psp::Int_ac) 1);
|
|
475 |
qed "psp2";
|
|
476 |
|
|
477 |
Goalw [unless_def]
|
12195
|
478 |
"[| F : A leadsTo A'; F : B unless B'; st_set(B); st_set(B') |] \
|
11479
|
479 |
\ ==> F : (A Int B) leadsTo ((A' Int B) Un B')";
|
12195
|
480 |
by (subgoal_tac "st_set(A)&st_set(A')" 1);
|
|
481 |
by (blast_tac (claset() addDs [leadsToD2]) 2);
|
11479
|
482 |
by (dtac psp 1);
|
|
483 |
by (assume_tac 1);
|
12195
|
484 |
by (Blast_tac 1);
|
|
485 |
by (REPEAT(blast_tac (claset() addIs [leadsTo_weaken]) 1));
|
11479
|
486 |
qed "psp_unless";
|
|
487 |
|
12195
|
488 |
(*** Proving the wf induction rules ***)
|
11479
|
489 |
(** The most general rule: r is any wf relation; f is any variant function **)
|
|
490 |
Goal "[| wf(r); \
|
|
491 |
\ m:I; \
|
|
492 |
\ field(r)<=I; \
|
12195
|
493 |
\ F:program; st_set(B);\
|
11479
|
494 |
\ ALL m:I. F : (A Int f-``{m}) leadsTo \
|
|
495 |
\ ((A Int f-``(converse(r)``{m})) Un B) |] \
|
|
496 |
\ ==> F : (A Int f-``{m}) leadsTo B";
|
|
497 |
by (eres_inst_tac [("a","m")] wf_induct2 1);
|
|
498 |
by (ALLGOALS(Asm_simp_tac));
|
|
499 |
by (subgoal_tac "F : (A Int (f-``(converse(r)``{x}))) leadsTo B" 1);
|
|
500 |
by (stac vimage_eq_UN 2);
|
|
501 |
by (asm_simp_tac (simpset() addsimps [Int_UN_distrib]) 2);
|
|
502 |
by (blast_tac (claset() addIs [leadsTo_cancel1, leadsTo_Un_duplicate]) 1);
|
12195
|
503 |
by (auto_tac (claset() addIs [leadsTo_UN], simpset()));
|
11479
|
504 |
qed "lemma1";
|
|
505 |
|
|
506 |
(** Meta or object quantifier ? **)
|
|
507 |
Goal "[| wf(r); \
|
|
508 |
\ field(r)<=I; \
|
|
509 |
\ A<=f-``I;\
|
12195
|
510 |
\ F:program; st_set(A); st_set(B); \
|
11479
|
511 |
\ ALL m:I. F : (A Int f-``{m}) leadsTo \
|
|
512 |
\ ((A Int f-``(converse(r)``{m})) Un B) |] \
|
|
513 |
\ ==> F : A leadsTo B";
|
|
514 |
by (res_inst_tac [("b", "A")] subst 1);
|
|
515 |
by (res_inst_tac [("I", "I")] leadsTo_UN 2);
|
|
516 |
by (REPEAT (assume_tac 2));
|
|
517 |
by (Clarify_tac 2);
|
|
518 |
by (eres_inst_tac [("I", "I")] lemma1 2);
|
|
519 |
by (REPEAT (assume_tac 2));
|
|
520 |
by (rtac equalityI 1);
|
|
521 |
by Safe_tac;
|
|
522 |
by (thin_tac "field(r)<=I" 1);
|
|
523 |
by (dres_inst_tac [("c", "x")] subsetD 1);
|
|
524 |
by Safe_tac;
|
|
525 |
by (res_inst_tac [("b", "x")] UN_I 1);
|
|
526 |
by Auto_tac;
|
|
527 |
qed "leadsTo_wf_induct";
|
|
528 |
|
|
529 |
Goalw [field_def] "field(less_than(nat)) = nat";
|
|
530 |
by (simp_tac (simpset() addsimps [less_than_equals]) 1);
|
|
531 |
by (rtac equalityI 1);
|
12195
|
532 |
by (force_tac (claset(), simpset()) 1);
|
11479
|
533 |
by (Clarify_tac 1);
|
|
534 |
by (thin_tac "x~:range(?y)" 1);
|
|
535 |
by (etac nat_induct 1);
|
|
536 |
by (ALLGOALS(asm_full_simp_tac (simpset() addsimps [domain_def])));
|
|
537 |
by (res_inst_tac [("x", "<succ(xa),succ(succ(xa))>")] ReplaceI 2);
|
|
538 |
by (res_inst_tac [("x", "<0,1>")] ReplaceI 1);
|
|
539 |
by (REPEAT(force_tac (claset() addIs [splitI], simpset()) 1));
|
|
540 |
qed "nat_less_than_field";
|
|
541 |
|
|
542 |
(*Alternative proof is via the lemma F : (A Int f-`(lessThan m)) leadsTo B*)
|
|
543 |
Goal
|
|
544 |
"[| A<=f-``nat;\
|
12195
|
545 |
\ F:program; st_set(A); st_set(B); \
|
11479
|
546 |
\ ALL m:nat. F:(A Int f-``{m}) leadsTo ((A Int f-``lessThan(m,nat)) Un B) |] \
|
|
547 |
\ ==> F : A leadsTo B";
|
|
548 |
by (res_inst_tac [("A1", "nat")]
|
|
549 |
(wf_less_than RS leadsTo_wf_induct) 1);
|
|
550 |
by (Clarify_tac 6);
|
|
551 |
by (ALLGOALS(asm_full_simp_tac
|
|
552 |
(simpset() addsimps [nat_less_than_field])));
|
|
553 |
by (Clarify_tac 1);
|
|
554 |
by (ALLGOALS(asm_full_simp_tac
|
|
555 |
(simpset() addsimps [rewrite_rule [vimage_def] Image_inverse_less_than])));
|
|
556 |
qed "lessThan_induct";
|
|
557 |
|
|
558 |
(*** wlt ****)
|
|
559 |
|
|
560 |
(*Misra's property W3*)
|
12195
|
561 |
Goalw [wlt_def] "wlt(F,B) <=state";
|
|
562 |
by Auto_tac;
|
|
563 |
qed "wlt_type";
|
|
564 |
|
|
565 |
Goalw [st_set_def] "st_set(wlt(F, B))";
|
|
566 |
by (resolve_tac [wlt_type] 1);
|
|
567 |
qed "wlt_st_set";
|
|
568 |
AddIffs [wlt_st_set];
|
|
569 |
|
|
570 |
Goalw [wlt_def] "F:wlt(F, B) leadsTo B <-> (F:program & st_set(B))";
|
|
571 |
by (blast_tac (claset() addDs [leadsToD2] addSIs [leadsTo_Union]) 1);
|
|
572 |
qed "wlt_leadsTo_iff";
|
|
573 |
|
|
574 |
(* [| F:program; st_set(B) |] ==> F:wlt(F, B) leadsTo B *)
|
|
575 |
bind_thm("wlt_leadsTo", conjI RS (wlt_leadsTo_iff RS iffD2));
|
11479
|
576 |
|
|
577 |
Goalw [wlt_def] "F : A leadsTo B ==> A <= wlt(F, B)";
|
12195
|
578 |
by (forward_tac [leadsToD2] 1);
|
|
579 |
by (auto_tac (claset(), simpset() addsimps [st_set_def]));
|
11479
|
580 |
qed "leadsTo_subset";
|
|
581 |
|
|
582 |
(*Misra's property W2*)
|
12195
|
583 |
Goal "F : A leadsTo B <-> (A <= wlt(F,B) & F:program & st_set(B))";
|
|
584 |
by Auto_tac;
|
|
585 |
by (REPEAT(blast_tac (claset() addDs [leadsToD2,leadsTo_subset]
|
|
586 |
addIs [leadsTo_weaken_L, wlt_leadsTo]) 1));
|
11479
|
587 |
qed "leadsTo_eq_subset_wlt";
|
|
588 |
|
|
589 |
(*Misra's property W4*)
|
12195
|
590 |
Goal "[| F:program; st_set(B) |] ==> B <= wlt(F,B)";
|
|
591 |
by (rtac leadsTo_subset 1);
|
11479
|
592 |
by (asm_simp_tac (simpset()
|
|
593 |
addsimps [leadsTo_eq_subset_wlt RS iff_sym,
|
|
594 |
subset_imp_leadsTo]) 1);
|
|
595 |
qed "wlt_increasing";
|
|
596 |
|
|
597 |
(*Used in the Trans case below*)
|
12195
|
598 |
Goalw [constrains_def, st_set_def]
|
11479
|
599 |
"[| B <= A2; \
|
|
600 |
\ F : (A1 - B) co (A1 Un B); \
|
|
601 |
\ F : (A2 - C) co (A2 Un C) |] \
|
|
602 |
\ ==> F : (A1 Un A2 - C) co (A1 Un A2 Un C)";
|
|
603 |
by (Clarify_tac 1);
|
|
604 |
by (Blast_tac 1);
|
|
605 |
qed "lemma1";
|
|
606 |
|
|
607 |
(*Lemma (1,2,3) of Misra's draft book, Chapter 4, "Progress"*)
|
|
608 |
(* slightly different from the HOL one: B here is bounded *)
|
|
609 |
Goal "F : A leadsTo A' \
|
12195
|
610 |
\ ==> EX B:Pow(state). A<=B & F:B leadsTo A' & F : (B-A') co (B Un A')";
|
|
611 |
by (forward_tac [leadsToD2] 1);
|
11479
|
612 |
by (etac leadsTo_induct 1);
|
|
613 |
(*Basis*)
|
12195
|
614 |
by (blast_tac (claset() addDs [ensuresD, constrainsD2, st_setD]) 1);
|
11479
|
615 |
(*Trans*)
|
|
616 |
by (Clarify_tac 1);
|
|
617 |
by (res_inst_tac [("x", "Ba Un Bb")] bexI 1);
|
|
618 |
by (blast_tac (claset() addIs [lemma1,leadsTo_Un_Un, leadsTo_cancel1,
|
|
619 |
leadsTo_Un_duplicate]) 1);
|
|
620 |
by (Blast_tac 1);
|
|
621 |
(*Union*)
|
|
622 |
by (clarify_tac (claset() addSDs [ball_conj_distrib RS iffD1]) 1);
|
12195
|
623 |
by (subgoal_tac "EX y. y:Pi(S, %A. {Ba:Pow(state). A<=Ba & \
|
11479
|
624 |
\ F:Ba leadsTo B & F:Ba - B co Ba Un B})" 1);
|
|
625 |
by (rtac AC_ball_Pi 2);
|
12195
|
626 |
by (ALLGOALS(Clarify_tac));
|
|
627 |
by (rotate_tac 1 2);
|
|
628 |
by (dres_inst_tac [("x", "x")] bspec 2);
|
|
629 |
by (REPEAT(Blast_tac 2));
|
11479
|
630 |
by (res_inst_tac [("x", "UN A:S. y`A")] bexI 1);
|
|
631 |
by Safe_tac;
|
|
632 |
by (res_inst_tac [("I1", "S")] (constrains_UN RS constrains_weaken) 3);
|
|
633 |
by (rtac leadsTo_Union 2);
|
12195
|
634 |
by (blast_tac (claset() addSDs [apply_type]) 5);
|
|
635 |
by (ALLGOALS(Asm_full_simp_tac));
|
|
636 |
by (REPEAT(force_tac (claset() addSDs [apply_type], simpset()) 1));
|
11479
|
637 |
qed "leadsTo_123";
|
|
638 |
|
|
639 |
|
|
640 |
(*Misra's property W5*)
|
12195
|
641 |
Goal "[| F:program; st_set(B) |] ==>F : (wlt(F, B) - B) co (wlt(F,B))";
|
11479
|
642 |
by (cut_inst_tac [("F","F")] (wlt_leadsTo RS leadsTo_123) 1);
|
|
643 |
by (assume_tac 1);
|
12195
|
644 |
by (Blast_tac 1);
|
11479
|
645 |
by (Clarify_tac 1);
|
|
646 |
by (subgoal_tac "Ba = wlt(F,B)" 1);
|
|
647 |
by (blast_tac (claset() addDs [leadsTo_eq_subset_wlt RS iffD1]) 2);
|
|
648 |
by (Clarify_tac 1);
|
|
649 |
by (asm_full_simp_tac (simpset()
|
|
650 |
addsimps [wlt_increasing RS (subset_Un_iff2 RS iffD1)]) 1);
|
|
651 |
qed "wlt_constrains_wlt";
|
|
652 |
|
|
653 |
(*** Completion: Binary and General Finite versions ***)
|
|
654 |
|
|
655 |
Goal "[| W = wlt(F, (B' Un C)); \
|
|
656 |
\ F : A leadsTo (A' Un C); F : A' co (A' Un C); \
|
|
657 |
\ F : B leadsTo (B' Un C); F : B' co (B' Un C) |] \
|
|
658 |
\ ==> F : (A Int B) leadsTo ((A' Int B') Un C)";
|
12195
|
659 |
by (subgoal_tac "st_set(C)&st_set(W)&st_set(W-C)&st_set(A')&st_set(A)\
|
|
660 |
\ & st_set(B) & st_set(B') & F:program" 1);
|
|
661 |
by (Asm_simp_tac 2);
|
|
662 |
by (blast_tac (claset() addSDs [leadsToD2]) 2);
|
11479
|
663 |
by (subgoal_tac "F : (W-C) co (W Un B' Un C)" 1);
|
|
664 |
by (blast_tac (claset() addIs [[asm_rl, wlt_constrains_wlt]
|
12195
|
665 |
MRS constrains_Un RS constrains_weaken]) 2);
|
11479
|
666 |
by (subgoal_tac "F : (W-C) co W" 1);
|
12195
|
667 |
by (asm_full_simp_tac (simpset() addsimps [wlt_increasing RS
|
|
668 |
(subset_Un_iff2 RS iffD1), Un_assoc]) 2);
|
11479
|
669 |
by (subgoal_tac "F : (A Int W - C) leadsTo (A' Int W Un C)" 1);
|
12195
|
670 |
by (blast_tac (claset() addIs [wlt_leadsTo, psp RS leadsTo_weaken]) 2);
|
|
671 |
(** LEVEL 9 **)
|
11479
|
672 |
by (subgoal_tac "F : (A' Int W Un C) leadsTo (A' Int B' Un C)" 1);
|
|
673 |
by (rtac leadsTo_Un_duplicate2 2);
|
12195
|
674 |
by (rtac leadsTo_Un_Un 2);
|
|
675 |
by (blast_tac (claset() addIs [leadsTo_refl]) 3);
|
|
676 |
by (res_inst_tac [("A'1", "B' Un C")] (wlt_leadsTo RS psp2 RS leadsTo_weaken) 2);
|
|
677 |
by (REPEAT(Blast_tac 2));
|
|
678 |
(** LEVEL 17 **)
|
11479
|
679 |
by (dtac leadsTo_Diff 1);
|
12195
|
680 |
by (blast_tac (claset() addIs [subset_imp_leadsTo]
|
|
681 |
addDs [leadsToD2, constrainsD2]) 1);
|
|
682 |
by (force_tac (claset(), simpset() addsimps [st_set_def]) 1);
|
11479
|
683 |
by (subgoal_tac "A Int B <= A Int W" 1);
|
|
684 |
by (blast_tac (claset() addSDs [leadsTo_subset]
|
|
685 |
addSIs [subset_refl RS Int_mono]) 2);
|
12195
|
686 |
by (blast_tac (claset() addIs [leadsTo_Trans, subset_imp_leadsTo]) 1);
|
|
687 |
qed "completion_aux";
|
|
688 |
bind_thm("completion", refl RS completion_aux);
|
11479
|
689 |
|
12195
|
690 |
Goal "[| I:Fin(X); F:program; st_set(C) |] ==> \
|
11479
|
691 |
\(ALL i:I. F : (A(i)) leadsTo (A'(i) Un C)) --> \
|
|
692 |
\ (ALL i:I. F : (A'(i)) co (A'(i) Un C)) --> \
|
|
693 |
\ F : (INT i:I. A(i)) leadsTo ((INT i:I. A'(i)) Un C)";
|
|
694 |
by (etac Fin_induct 1);
|
12195
|
695 |
by (auto_tac (claset(), simpset() addsimps [Inter_0]));
|
11479
|
696 |
by (case_tac "y=0" 1);
|
|
697 |
by Auto_tac;
|
|
698 |
by (etac not_emptyE 1);
|
|
699 |
by (subgoal_tac "Inter(cons(A(x), RepFun(y, A)))= A(x) Int Inter(RepFun(y,A)) & \
|
|
700 |
\ Inter(cons(A'(x), RepFun(y, A')))= A'(x) Int Inter(RepFun(y,A'))" 1);
|
|
701 |
by (Blast_tac 2);
|
|
702 |
by (Asm_simp_tac 1);
|
|
703 |
by (rtac completion 1);
|
|
704 |
by (subgoal_tac "Inter(RepFun(y, A')) Un C = (INT x:RepFun(y, A'). x Un C)" 4);
|
|
705 |
by (Blast_tac 5);
|
|
706 |
by (Asm_simp_tac 4);
|
|
707 |
by (rtac constrains_INT 4);
|
|
708 |
by (REPEAT(Blast_tac 1));
|
|
709 |
qed "lemma";
|
|
710 |
|
|
711 |
val prems = Goal
|
|
712 |
"[| I:Fin(X); \
|
|
713 |
\ !!i. i:I ==> F : A(i) leadsTo (A'(i) Un C); \
|
12195
|
714 |
\ !!i. i:I ==> F : A'(i) co (A'(i) Un C); F:program; st_set(C)|] \
|
11479
|
715 |
\ ==> F : (INT i:I. A(i)) leadsTo ((INT i:I. A'(i)) Un C)";
|
12195
|
716 |
by (resolve_tac [lemma RS mp RS mp] 1);
|
|
717 |
by (resolve_tac prems 3);
|
|
718 |
by (REPEAT(blast_tac (claset() addIs prems) 1));
|
11479
|
719 |
qed "finite_completion";
|
|
720 |
|
|
721 |
Goalw [stable_def]
|
|
722 |
"[| F : A leadsTo A'; F : stable(A'); \
|
|
723 |
\ F : B leadsTo B'; F : stable(B') |] \
|
|
724 |
\ ==> F : (A Int B) leadsTo (A' Int B')";
|
|
725 |
by (res_inst_tac [("C1", "0")] (completion RS leadsTo_weaken_R) 1);
|
12195
|
726 |
by (REPEAT(blast_tac (claset() addDs [leadsToD2, constrainsD2]) 5));
|
11479
|
727 |
by (ALLGOALS(Asm_full_simp_tac));
|
|
728 |
qed "stable_completion";
|
|
729 |
|
|
730 |
|
12195
|
731 |
val major::prems = Goalw [stable_def]
|
11479
|
732 |
"[| I:Fin(X); \
|
12195
|
733 |
\ (!!i. i:I ==> F : A(i) leadsTo A'(i)); \
|
|
734 |
\ (!!i. i:I ==> F: stable(A'(i))); F:program |] \
|
11479
|
735 |
\ ==> F : (INT i:I. A(i)) leadsTo (INT i:I. A'(i))";
|
12195
|
736 |
by (cut_facts_tac [major] 1);
|
|
737 |
by (subgoal_tac "st_set(INT i:I. A'(i))" 1);
|
|
738 |
by (blast_tac (claset() addDs [leadsToD2]@prems) 2);
|
11479
|
739 |
by (res_inst_tac [("C1", "0")] (finite_completion RS leadsTo_weaken_R) 1);
|
12195
|
740 |
by (Asm_simp_tac 1);
|
|
741 |
by (assume_tac 6);
|
|
742 |
by (ALLGOALS(asm_full_simp_tac (simpset() addsimps prems)));
|
|
743 |
by (resolve_tac prems 2);
|
|
744 |
by (resolve_tac prems 1);
|
|
745 |
by Auto_tac;
|
11479
|
746 |
qed "finite_stable_completion";
|
|
747 |
|