17 qed "ifE"; |
17 qed "ifE"; |
18 |
18 |
19 AddSEs [ifE]; |
19 AddSEs [ifE]; |
20 |
20 |
21 |
21 |
22 Addsimps [Rprg_def RS def_prg_simps]; |
22 Addsimps [Rprg_def RS def_prg_Init]; |
|
23 program_defs_ref := [Rprg_def]; |
23 |
24 |
24 Addsimps [simp_of_act asgt_def]; |
25 Addsimps [simp_of_act asgt_def]; |
25 |
26 |
26 (*All vertex sets are finite*) |
27 (*All vertex sets are finite*) |
27 AddIffs [[subset_UNIV, finite_graph] MRS finite_subset]; |
28 AddIffs [[subset_UNIV, finite_graph] MRS finite_subset]; |
28 |
29 |
29 Addsimps [simp_of_set reach_invariant_def]; |
30 Addsimps [simp_of_set reach_invariant_def]; |
30 |
31 |
31 Goal "Invariant Rprg reach_invariant"; |
32 Goal "Rprg : Invariant reach_invariant"; |
32 by (rtac InvariantI 1); |
33 by (rtac InvariantI 1); |
33 by Auto_tac; (*for the initial state; proof of stability remains*) |
34 by Auto_tac; (*for the initial state; proof of stability remains*) |
34 by (constrains_tac 1); |
35 by (constrains_tac 1); |
35 by (blast_tac (claset() addIs [r_into_rtrancl,rtrancl_trans]) 1); |
36 by (blast_tac (claset() addIs [r_into_rtrancl,rtrancl_trans]) 1); |
36 qed "reach_invariant"; |
37 qed "reach_invariant"; |
46 by (blast_tac (claset() addIs [r_into_rtrancl,rtrancl_trans]) 2); |
47 by (blast_tac (claset() addIs [r_into_rtrancl,rtrancl_trans]) 2); |
47 by (etac rtrancl_induct 1); |
48 by (etac rtrancl_induct 1); |
48 by Auto_tac; |
49 by Auto_tac; |
49 qed "fixedpoint_invariant_correct"; |
50 qed "fixedpoint_invariant_correct"; |
50 |
51 |
51 Goalw [FP_def, fixedpoint_def, stable_def, constrains_def] |
52 Goalw [FP_def, fixedpoint_def, stable_def, constrains_def, Rprg_def] |
52 "FP (Acts Rprg) <= fixedpoint"; |
53 "FP Rprg <= fixedpoint"; |
53 by Auto_tac; |
54 by Auto_tac; |
54 by (asm_full_simp_tac (simpset() addsimps [Image_singleton, image_iff]) 1); |
55 by (asm_full_simp_tac (simpset() addsimps [Image_singleton, image_iff]) 1); |
55 by (dtac fun_cong 1); |
56 by (dtac fun_cong 1); |
56 by Auto_tac; |
57 by Auto_tac; |
57 val lemma1 = result(); |
58 val lemma1 = result(); |
58 |
59 |
59 Goalw [FP_def, fixedpoint_def, stable_def, constrains_def] |
60 Goalw [FP_def, fixedpoint_def, stable_def, constrains_def, Rprg_def] |
60 "fixedpoint <= FP (Acts Rprg)"; |
61 "fixedpoint <= FP Rprg"; |
61 by (auto_tac (claset() addSIs [ext], simpset())); |
62 by (auto_tac (claset() addSIs [ext], simpset())); |
62 val lemma2 = result(); |
63 val lemma2 = result(); |
63 |
64 |
64 Goal "FP (Acts Rprg) = fixedpoint"; |
65 Goal "FP Rprg = fixedpoint"; |
65 by (rtac ([lemma1,lemma2] MRS equalityI) 1); |
66 by (rtac ([lemma1,lemma2] MRS equalityI) 1); |
66 qed "FP_fixedpoint"; |
67 qed "FP_fixedpoint"; |
67 |
68 |
68 |
69 |
69 (*If we haven't reached a fixedpoint then there is some edge for which u but |
70 (*If we haven't reached a fixedpoint then there is some edge for which u but |
72 a LEADSTO assertion that the metric decreases if we are not at a fixedpoint. |
73 a LEADSTO assertion that the metric decreases if we are not at a fixedpoint. |
73 *) |
74 *) |
74 |
75 |
75 Goal "- fixedpoint = (UN (u,v): edges. {s. s u & ~ s v})"; |
76 Goal "- fixedpoint = (UN (u,v): edges. {s. s u & ~ s v})"; |
76 by (simp_tac (simpset() addsimps |
77 by (simp_tac (simpset() addsimps |
77 ([Compl_FP, UN_UN_flatten, FP_fixedpoint RS sym])) 1); |
78 ([Compl_FP, UN_UN_flatten, FP_fixedpoint RS sym, Rprg_def])) 1); |
78 by Auto_tac; |
79 by Auto_tac; |
79 by (rtac fun_upd_idem 1); |
80 by (rtac fun_upd_idem 1); |
80 by (auto_tac (claset(),simpset() addsimps [fun_upd_idem_iff])); |
81 by (auto_tac (claset(),simpset() addsimps [fun_upd_idem_iff])); |
81 qed "Compl_fixedpoint"; |
82 qed "Compl_fixedpoint"; |
82 |
83 |
104 by (case_tac "s x --> s y" 1); |
105 by (case_tac "s x --> s y" 1); |
105 by (auto_tac (claset() addIs [less_imp_le], |
106 by (auto_tac (claset() addIs [less_imp_le], |
106 simpset() addsimps [fun_upd_idem])); |
107 simpset() addsimps [fun_upd_idem])); |
107 qed "metric_le"; |
108 qed "metric_le"; |
108 |
109 |
109 Goal "LeadsTo Rprg ((metric-``{m}) - fixedpoint) (metric-``(lessThan m))"; |
110 Goal "Rprg : LeadsTo ((metric-``{m}) - fixedpoint) (metric-``(lessThan m))"; |
110 by (simp_tac (simpset() addsimps [Diff_fixedpoint]) 1); |
111 by (simp_tac (simpset() addsimps [Diff_fixedpoint]) 1); |
111 by (rtac LeadsTo_UN 1); |
112 by (rtac LeadsTo_UN 1); |
112 by Auto_tac; |
113 by Auto_tac; |
113 by (ensures_tac "asgt a b" 1); |
114 by (ensures_tac "asgt a b" 1); |
114 by (Blast_tac 2); |
115 by (Blast_tac 2); |
116 by (dtac (metric_le RS le_anti_sym) 1); |
117 by (dtac (metric_le RS le_anti_sym) 1); |
117 by (auto_tac (claset() addEs [less_not_refl3 RSN (2, rev_notE)], |
118 by (auto_tac (claset() addEs [less_not_refl3 RSN (2, rev_notE)], |
118 simpset())); |
119 simpset())); |
119 qed "LeadsTo_Diff_fixedpoint"; |
120 qed "LeadsTo_Diff_fixedpoint"; |
120 |
121 |
121 Goal "LeadsTo Rprg (metric-``{m}) (metric-``(lessThan m) Un fixedpoint)"; |
122 Goal "Rprg : LeadsTo (metric-``{m}) (metric-``(lessThan m) Un fixedpoint)"; |
122 by (rtac ([LeadsTo_Diff_fixedpoint RS LeadsTo_weaken_R, |
123 by (rtac ([LeadsTo_Diff_fixedpoint RS LeadsTo_weaken_R, |
123 subset_imp_LeadsTo] MRS LeadsTo_Diff) 1); |
124 subset_imp_LeadsTo] MRS LeadsTo_Diff) 1); |
124 by Auto_tac; |
125 by Auto_tac; |
125 qed "LeadsTo_Un_fixedpoint"; |
126 qed "LeadsTo_Un_fixedpoint"; |
126 |
127 |
127 |
128 |
128 (*Execution in any state leads to a fixedpoint (i.e. can terminate)*) |
129 (*Execution in any state leads to a fixedpoint (i.e. can terminate)*) |
129 Goal "LeadsTo Rprg UNIV fixedpoint"; |
130 Goal "Rprg : LeadsTo UNIV fixedpoint"; |
130 by (rtac LessThan_induct 1); |
131 by (rtac LessThan_induct 1); |
131 by Auto_tac; |
132 by Auto_tac; |
132 by (rtac LeadsTo_Un_fixedpoint 1); |
133 by (rtac LeadsTo_Un_fixedpoint 1); |
133 qed "LeadsTo_fixedpoint"; |
134 qed "LeadsTo_fixedpoint"; |
134 |
135 |
135 Goal "LeadsTo Rprg UNIV { %v. (init, v) : edges^* }"; |
136 Goal "Rprg : LeadsTo UNIV { %v. (init, v) : edges^* }"; |
136 by (stac (fixedpoint_invariant_correct RS sym) 1); |
137 by (stac (fixedpoint_invariant_correct RS sym) 1); |
137 by (rtac ([reach_invariant, LeadsTo_fixedpoint] |
138 by (rtac ([reach_invariant, LeadsTo_fixedpoint] |
138 MRS Invariant_LeadsTo_weaken) 1); |
139 MRS Invariant_LeadsTo_weaken) 1); |
139 by Auto_tac; |
140 by Auto_tac; |
140 qed "LeadsTo_correct"; |
141 qed "LeadsTo_correct"; |