equal
deleted
inserted
replaced
75 expanding it is extremely expensive!*) |
75 expanding it is extremely expensive!*) |
76 program_defs_ref := []; |
76 program_defs_ref := []; |
77 |
77 |
78 (*Safety property 2: clients return the right number of tokens*) |
78 (*Safety property 2: clients return the right number of tokens*) |
79 Goal "Cli_prg : (Increasing giv Int (rel localTo Cli_prg)) \ |
79 Goal "Cli_prg : (Increasing giv Int (rel localTo Cli_prg)) \ |
80 \ guarantees Always {s. rel s <= giv s}"; |
80 \ guar Always {s. rel s <= giv s}"; |
81 by (rtac guaranteesI 1); |
81 by (rtac guaranteesI 1); |
82 by (rtac AlwaysI 1); |
82 by (rtac AlwaysI 1); |
83 by (Force_tac 1); |
83 by (Force_tac 1); |
84 by (blast_tac (claset() addIs [Increasing_localTo_Stable, |
84 by (blast_tac (claset() addIs [Increasing_localTo_Stable, |
85 stable_rel_le_giv]) 1); |
85 stable_rel_le_giv]) 1); |
102 |
102 |
103 val Increasing_length = mono_length RS mono_Increasing_o; |
103 val Increasing_length = mono_length RS mono_Increasing_o; |
104 |
104 |
105 Goal "Cli_prg : \ |
105 Goal "Cli_prg : \ |
106 \ (Increasing giv Int (rel localTo Cli_prg) Int (ask localTo Cli_prg)) \ |
106 \ (Increasing giv Int (rel localTo Cli_prg) Int (ask localTo Cli_prg)) \ |
107 \ guarantees Always ({s. size (ask s) <= Suc (size (rel s))} Int \ |
107 \ guar Always ({s. size (ask s) <= Suc (size (rel s))} Int \ |
108 \ {s. size (rel s) <= size (giv s)})"; |
108 \ {s. size (rel s) <= size (giv s)})"; |
109 by (rtac guaranteesI 1); |
109 by (rtac guaranteesI 1); |
110 by (Clarify_tac 1); |
110 by (Clarify_tac 1); |
111 by (dtac (impOfSubs (rewrite_o Increasing_length)) 1); |
111 by (dtac (impOfSubs (rewrite_o Increasing_length)) 1); |
112 by (rtac AlwaysI 1); |
112 by (rtac AlwaysI 1); |
122 |
122 |
123 |
123 |
124 Goal "Cli_prg : \ |
124 Goal "Cli_prg : \ |
125 \ (Increasing giv Int (rel localTo Cli_prg) Int (ask localTo Cli_prg) \ |
125 \ (Increasing giv Int (rel localTo Cli_prg) Int (ask localTo Cli_prg) \ |
126 \ Int Always giv_meets_ask) \ |
126 \ Int Always giv_meets_ask) \ |
127 \ guarantees ({s. k < size (giv s)} LeadsTo {s. k < size (rel s)})"; |
127 \ guar ({s. k < size (giv s)} LeadsTo {s. k < size (rel s)})"; |
128 by (rtac guaranteesI 1); |
128 by (rtac guaranteesI 1); |
129 by (Clarify_tac 1); |
129 by (Clarify_tac 1); |
130 by (rtac Stable_transient_Always_LeadsTo 1); |
130 by (rtac Stable_transient_Always_LeadsTo 1); |
131 by (res_inst_tac [("k", "k")] transient_lemma 2); |
131 by (res_inst_tac [("k", "k")] transient_lemma 2); |
132 by (force_tac (claset() addDs [impOfSubs Increasing_length, |
132 by (force_tac (claset() addDs [impOfSubs Increasing_length, |