added verification framework for the HeapMonad and quicksort as example for this framework
authorbulwahn
Sat Jul 19 19:27:13 2008 +0200 (2008-07-19)
changeset 27656d4f6e64ee7cc
parent 27655 cf0c60e821bb
child 27657 0efc8b68ee4a
added verification framework for the HeapMonad and quicksort as example for this framework
src/HOL/Library/Array.thy
src/HOL/Library/Assert.thy
src/HOL/Library/Imperative_HOL.thy
src/HOL/Library/Relational.thy
src/HOL/Library/Subarray.thy
src/HOL/Library/Sublist.thy
src/HOL/SetInterval.thy
src/HOL/ex/ImperativeQuicksort.thy
     1.1 --- a/src/HOL/Library/Array.thy	Sat Jul 19 11:05:18 2008 +0200
     1.2 +++ b/src/HOL/Library/Array.thy	Sat Jul 19 19:27:13 2008 +0200
     1.3 @@ -93,7 +93,16 @@
     1.4       mapM (nth a) [0..<n]
     1.5     done)"
     1.6  
     1.7 -hide (open) const new -- {* avoid clashed with some popular names *}
     1.8 +definition
     1.9 +   map :: "('a\<Colon>heap \<Rightarrow> 'a) \<Rightarrow> 'a array \<Rightarrow> 'a array Heap"
    1.10 +where
    1.11 +  "map f a = (do
    1.12 +     n \<leftarrow> length a;
    1.13 +     mapM (\<lambda>n. map_entry n f a) [0..<n];
    1.14 +     return a
    1.15 +   done)"
    1.16 +
    1.17 +hide (open) const new map -- {* avoid clashed with some popular names *}
    1.18  
    1.19  
    1.20  subsection {* Properties *}
     2.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     2.2 +++ b/src/HOL/Library/Assert.thy	Sat Jul 19 19:27:13 2008 +0200
     2.3 @@ -0,0 +1,51 @@
     2.4 +theory Assert
     2.5 +imports Heap_Monad
     2.6 +begin
     2.7 +
     2.8 +section {* The Assert command *}
     2.9 +
    2.10 +text {* We define a command Assert a property P.
    2.11 + This property does not consider any statement about the heap but only about functional values in the program. *}
    2.12 +
    2.13 +definition
    2.14 +  assert :: "('a \<Rightarrow> bool) \<Rightarrow> 'a \<Rightarrow> 'a Heap"
    2.15 +where
    2.16 +  "assert P x = (if P x then return x else raise (''assert''))"
    2.17 +
    2.18 +lemma assert_cong[fundef_cong]:
    2.19 +assumes "P = P'"
    2.20 +assumes "\<And>x. P' x \<Longrightarrow> f x = f' x"
    2.21 +shows "(assert P x >>= f) = (assert P' x >>= f')"
    2.22 +using assms
    2.23 +by (auto simp add: assert_def return_bind raise_bind)
    2.24 +
    2.25 +section {* Example : Using Assert for showing termination of functions *}
    2.26 +
    2.27 +function until_zero :: "int \<Rightarrow> int Heap"
    2.28 +where
    2.29 +  "until_zero a = (if a \<le> 0 then return a else (do x \<leftarrow> return (a - 1); until_zero x done))" 
    2.30 +by (pat_completeness, auto)
    2.31 +
    2.32 +termination
    2.33 +apply (relation "measure (\<lambda>x. nat x)")
    2.34 +apply simp
    2.35 +apply simp
    2.36 +oops
    2.37 +
    2.38 +
    2.39 +function until_zero' :: "int \<Rightarrow> int Heap"
    2.40 +where
    2.41 +  "until_zero' a = (if a \<le> 0 then return a else (do x \<leftarrow> return (a - 1); y \<leftarrow> assert (\<lambda>x. x < a) x; until_zero' y done))" 
    2.42 +by (pat_completeness, auto)
    2.43 +
    2.44 +termination
    2.45 +apply (relation "measure (\<lambda>x. nat x)")
    2.46 +apply simp
    2.47 +apply simp
    2.48 +done
    2.49 +
    2.50 +hide (open) const until_zero until_zero'
    2.51 +
    2.52 +text {* Also look at lemmas about assert in Relational theory. *}
    2.53 +
    2.54 +end
     3.1 --- a/src/HOL/Library/Imperative_HOL.thy	Sat Jul 19 11:05:18 2008 +0200
     3.2 +++ b/src/HOL/Library/Imperative_HOL.thy	Sat Jul 19 19:27:13 2008 +0200
     3.3 @@ -6,7 +6,7 @@
     3.4  header {* Entry point into monadic imperative HOL *}
     3.5  
     3.6  theory Imperative_HOL
     3.7 -imports Array Ref
     3.8 +imports Array Ref Relational
     3.9  begin
    3.10  
    3.11  end
     4.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     4.2 +++ b/src/HOL/Library/Relational.thy	Sat Jul 19 19:27:13 2008 +0200
     4.3 @@ -0,0 +1,700 @@
     4.4 +theory Relational 
     4.5 +imports Array Ref Assert
     4.6 +begin
     4.7 +
     4.8 +section{* Definition of the Relational framework *}
     4.9 +
    4.10 +text {* The crel predicate states that when a computation c runs with the heap h
    4.11 +  will result in return value r and a heap h' (if no exception occurs). *}  
    4.12 +
    4.13 +definition crel :: "'a Heap \<Rightarrow> heap \<Rightarrow> heap \<Rightarrow> 'a \<Rightarrow> bool"
    4.14 +where
    4.15 +  crel_def': "crel c h h' r \<longleftrightarrow> Heap_Monad.execute c h = (Inl r, h')"
    4.16 +
    4.17 +lemma crel_def: -- FIXME
    4.18 +  "crel c h h' r \<longleftrightarrow> (Inl r, h') = Heap_Monad.execute c h"
    4.19 +  unfolding crel_def' by auto
    4.20 +
    4.21 +lemma crel_deterministic: "\<lbrakk> crel f h h' a; crel f h h'' b \<rbrakk> \<Longrightarrow> (a = b) \<and> (h' = h'')"
    4.22 +unfolding crel_def' by auto
    4.23 +
    4.24 +section {* Elimination rules *}
    4.25 +
    4.26 +text {* For all commands, we define simple elimination rules. *}
    4.27 +(* FIXME: consumes 1 necessary ?? *)
    4.28 +
    4.29 +subsection {* Elimination rules for basic monadic commands *}
    4.30 +
    4.31 +lemma crelE[consumes 1]:
    4.32 +  assumes "crel (f >>= g) h h'' r'"
    4.33 +  obtains h' r where "crel f h h' r" "crel (g r) h' h'' r'"
    4.34 +  using assms
    4.35 +  by (auto simp add: crel_def bindM_def Let_def prod_case_beta split_def Pair_fst_snd_eq split add: sum.split_asm)
    4.36 +
    4.37 +lemma crelE'[consumes 1]:
    4.38 +  assumes "crel (f >> g) h h'' r'"
    4.39 +  obtains h' r where "crel f h h' r" "crel g h' h'' r'"
    4.40 +  using assms
    4.41 +  by (elim crelE) auto
    4.42 +
    4.43 +lemma crel_return[consumes 1]:
    4.44 +  assumes "crel (return x) h h' r"
    4.45 +  obtains "r = x" "h = h'"
    4.46 +  using assms
    4.47 +  unfolding crel_def return_def by simp
    4.48 +
    4.49 +lemma crel_raise[consumes 1]:
    4.50 +  assumes "crel (raise x) h h' r"
    4.51 +  obtains "False"
    4.52 +  using assms
    4.53 +  unfolding crel_def raise_def by simp
    4.54 +
    4.55 +lemma crel_if:
    4.56 +  assumes "crel (if c then t else e) h h' r"
    4.57 +  obtains "c" "crel t h h' r"
    4.58 +        | "\<not>c" "crel e h h' r"
    4.59 +  using assms
    4.60 +  unfolding crel_def by auto
    4.61 +
    4.62 +lemma crel_option_case:
    4.63 +  assumes "crel (case x of None \<Rightarrow> n | Some y \<Rightarrow> s y) h h' r"
    4.64 +  obtains "x = None" "crel n h h' r"
    4.65 +        | y where "x = Some y" "crel (s y) h h' r" 
    4.66 +  using assms
    4.67 +  unfolding crel_def by auto
    4.68 +
    4.69 +lemma crel_mapM:
    4.70 +  assumes "crel (mapM f xs) h h' r"
    4.71 +  assumes "\<And>h h'. P f [] h h' []"
    4.72 +  assumes "\<And>h h1 h' x xs y ys. \<lbrakk> crel (f x) h h1 y; crel (mapM f xs) h1 h' ys; P f xs h1 h' ys \<rbrakk> \<Longrightarrow> P f (x#xs) h h' (y#ys)"
    4.73 +  shows "P f xs h h' r"
    4.74 +using assms(1)
    4.75 +proof (induct xs arbitrary: h h' r)
    4.76 +  case Nil  with assms(2) show ?case
    4.77 +    by (auto elim: crel_return)
    4.78 +next
    4.79 +  case (Cons x xs)
    4.80 +  from Cons(2) obtain h1 y ys where crel_f: "crel (f x) h h1 y"
    4.81 +    and crel_mapM: "crel (mapM f xs) h1 h' ys"
    4.82 +    and r_def: "r = y#ys"
    4.83 +    unfolding mapM.simps run_drop
    4.84 +    by (auto elim!: crelE crel_return)
    4.85 +  from Cons(1)[OF crel_mapM] crel_mapM crel_f assms(3) r_def
    4.86 +  show ?case by auto
    4.87 +qed
    4.88 +
    4.89 +lemma crel_heap:
    4.90 +  assumes "crel (Heap_Monad.heap f) h h' r"
    4.91 +  obtains "h' = snd (f h)" "r = fst (f h)"
    4.92 +  using assms
    4.93 +  unfolding heap_def crel_def apfst_def split_def prod_fun_def by simp_all
    4.94 +
    4.95 +subsection {* Elimination rules for array commands *}
    4.96 +
    4.97 +lemma crel_length:
    4.98 +  assumes "crel (length a) h h' r"
    4.99 +  obtains "h = h'" "r = Heap.length a h'"
   4.100 +  using assms
   4.101 +  unfolding length_def
   4.102 +  by (elim crel_heap) simp
   4.103 +
   4.104 +(* Strong version of the lemma for this operation is missing *) 
   4.105 +lemma crel_new_weak:
   4.106 +  assumes "crel (Array.new n v) h h' r"
   4.107 +  obtains "get_array r h' = List.replicate n v"
   4.108 +  using assms unfolding  Array.new_def
   4.109 +  by (elim crel_heap) (auto simp:Heap.array_def Let_def split_def)
   4.110 +
   4.111 +lemma crel_nth[consumes 1]:
   4.112 +  assumes "crel (nth a i) h h' r"
   4.113 +  obtains "r = (get_array a h) ! i" "h = h'" "i < Heap.length a h"
   4.114 +  using assms
   4.115 +  unfolding nth_def run_drop
   4.116 +  by (auto elim!: crelE crel_if crel_raise crel_length crel_heap)
   4.117 +
   4.118 +lemma crel_upd[consumes 1]:
   4.119 +  assumes "crel (upd i v a) h h' r"
   4.120 +  obtains "r = a" "h' = Heap.upd a i v h"
   4.121 +  using assms
   4.122 +  unfolding upd_def run_drop
   4.123 +  by (elim crelE crel_if crel_return crel_raise
   4.124 +    crel_length crel_heap) auto
   4.125 +
   4.126 +(* Strong version of the lemma for this operation is missing *)
   4.127 +lemma crel_of_list_weak:
   4.128 +  assumes "crel (Array.of_list xs) h h' r"
   4.129 +  obtains "get_array r h' = xs"
   4.130 +  using assms
   4.131 +  unfolding of_list_def 
   4.132 +  by (elim crel_heap) (simp add:get_array_init_array_list)
   4.133 +
   4.134 +lemma crel_map_entry:
   4.135 +  assumes "crel (Array.map_entry i f a) h h' r"
   4.136 +  obtains "r = a" "h' = Heap.upd a i (f (get_array a h ! i)) h"
   4.137 +  using assms
   4.138 +  unfolding Array.map_entry_def run_drop
   4.139 +  by (elim crelE crel_upd crel_nth) auto
   4.140 +
   4.141 +lemma crel_swap:
   4.142 +  assumes "crel (Array.swap i x a) h h' r"
   4.143 +  obtains "r = get_array a h ! i" "h' = Heap.upd a i x h"
   4.144 +  using assms
   4.145 +  unfolding Array.swap_def run_drop
   4.146 +  by (elim crelE crel_upd crel_nth crel_return) auto
   4.147 +
   4.148 +(* Strong version of the lemma for this operation is missing *)
   4.149 +lemma crel_make_weak:
   4.150 +  assumes "crel (Array.make n f) h h' r"
   4.151 +  obtains "i < n \<Longrightarrow> get_array r h' ! i = f i"
   4.152 +  using assms
   4.153 +  unfolding Array.make_def
   4.154 +  by (elim crel_of_list_weak) auto
   4.155 +
   4.156 +lemma upt_conv_Cons':
   4.157 +  assumes "Suc a \<le> b"
   4.158 +  shows "[b - Suc a..<b] = (b - Suc a)#[b - a..<b]"
   4.159 +proof -
   4.160 +  from assms have l: "b - Suc a < b" by arith
   4.161 +  from assms have "Suc (b - Suc a) = b - a" by arith
   4.162 +  with l show ?thesis by (simp add: upt_conv_Cons)
   4.163 +qed
   4.164 +
   4.165 +lemma crel_mapM_nth:
   4.166 +  assumes
   4.167 +  "crel (mapM (Array.nth a) [Heap.length a h - n..<Heap.length a h]) h h' xs"
   4.168 +  assumes "n \<le> Heap.length a h"
   4.169 +  shows "h = h' \<and> xs = drop (Heap.length a h - n) (get_array a h)"
   4.170 +using assms
   4.171 +proof (induct n arbitrary: xs h h')
   4.172 +  case 0 thus ?case
   4.173 +    by (auto elim!: crel_return simp add: Heap.length_def)
   4.174 +next
   4.175 +  case (Suc n)
   4.176 +  from Suc(3) have "[Heap.length a h - Suc n..<Heap.length a h] = (Heap.length a h - Suc n)#[Heap.length a h - n..<Heap.length a h]"
   4.177 +    by (simp add: upt_conv_Cons')
   4.178 +  with Suc(2) obtain r where
   4.179 +    crel_mapM: "crel (mapM (Array.nth a) [Heap.length a h - n..<Heap.length a h]) h h' r"
   4.180 +    and xs_def: "xs = get_array a h ! (Heap.length a h - Suc n) # r"
   4.181 +    by (auto simp add: run_drop elim!: crelE crel_nth crel_return)
   4.182 +  from Suc(3) have "Heap.length a h - n = Suc (Heap.length a h - Suc n)" 
   4.183 +    by arith
   4.184 +  with Suc.hyps[OF crel_mapM] xs_def show ?case
   4.185 +    unfolding Heap.length_def
   4.186 +    by (auto simp add: nth_drop')
   4.187 +qed
   4.188 +
   4.189 +lemma crel_freeze:
   4.190 +  assumes "crel (Array.freeze a) h h' xs"
   4.191 +  obtains "h = h'" "xs = get_array a h"
   4.192 +proof 
   4.193 +  from assms have "crel (mapM (Array.nth a) [0..<Heap.length a h]) h h' xs"
   4.194 +    unfolding freeze_def run_drop
   4.195 +    by (auto elim: crelE crel_length)
   4.196 +  hence "crel (mapM (Array.nth a) [(Heap.length a h - Heap.length a h)..<Heap.length a h]) h h' xs"
   4.197 +    by simp
   4.198 +  from crel_mapM_nth[OF this] show "h = h'" and "xs = get_array a h" by auto
   4.199 +qed
   4.200 +
   4.201 +lemma crel_mapM_map_entry_remains:
   4.202 +  assumes "crel (mapM (\<lambda>n. map_entry n f a) [Heap.length a h - n..<Heap.length a h]) h h' r"
   4.203 +  assumes "i < Heap.length a h - n"
   4.204 +  shows "get_array a h ! i = get_array a h' ! i"
   4.205 +using assms
   4.206 +proof (induct n arbitrary: h h' r)
   4.207 +  case 0
   4.208 +  thus ?case
   4.209 +    by (auto elim: crel_return)
   4.210 +next
   4.211 +  case (Suc n)
   4.212 +  let ?h1 = "Heap.upd a (Heap.length a h - Suc n) (f (get_array a h ! (Heap.length a h - Suc n))) h"
   4.213 +  from Suc(3) have "[Heap.length a h - Suc n..<Heap.length a h] = (Heap.length a h - Suc n)#[Heap.length a h - n..<Heap.length a h]"
   4.214 +    by (simp add: upt_conv_Cons')
   4.215 +  from Suc(2) this obtain r where
   4.216 +    crel_mapM: "crel (mapM (\<lambda>n. map_entry n f a) [Heap.length a h - n..<Heap.length a h]) ?h1 h' r"
   4.217 +    by (auto simp add: run_drop elim!: crelE crel_map_entry crel_return)
   4.218 +  have length_remains: "Heap.length a ?h1 = Heap.length a h" by simp
   4.219 +  from crel_mapM have crel_mapM': "crel (mapM (\<lambda>n. map_entry n f a) [Heap.length a ?h1 - n..<Heap.length a ?h1]) ?h1 h' r"
   4.220 +    by simp
   4.221 +  from Suc(1)[OF this] length_remains Suc(3) show ?case by simp
   4.222 +qed
   4.223 +
   4.224 +lemma crel_mapM_map_entry_changes:
   4.225 +  assumes "crel (mapM (\<lambda>n. map_entry n f a) [Heap.length a h - n..<Heap.length a h]) h h' r"
   4.226 +  assumes "n \<le> Heap.length a h"  
   4.227 +  assumes "i \<ge> Heap.length a h - n"
   4.228 +  assumes "i < Heap.length a h"
   4.229 +  shows "get_array a h' ! i = f (get_array a h ! i)"
   4.230 +using assms
   4.231 +proof (induct n arbitrary: h h' r)
   4.232 +  case 0
   4.233 +  thus ?case
   4.234 +    by (auto elim!: crel_return)
   4.235 +next
   4.236 +  case (Suc n)
   4.237 +  let ?h1 = "Heap.upd a (Heap.length a h - Suc n) (f (get_array a h ! (Heap.length a h - Suc n))) h"
   4.238 +  from Suc(3) have "[Heap.length a h - Suc n..<Heap.length a h] = (Heap.length a h - Suc n)#[Heap.length a h - n..<Heap.length a h]"
   4.239 +    by (simp add: upt_conv_Cons')
   4.240 +  from Suc(2) this obtain r where
   4.241 +    crel_mapM: "crel (mapM (\<lambda>n. map_entry n f a) [Heap.length a h - n..<Heap.length a h]) ?h1 h' r"
   4.242 +    by (auto simp add: run_drop elim!: crelE crel_map_entry crel_return)
   4.243 +  have length_remains: "Heap.length a ?h1 = Heap.length a h" by simp
   4.244 +  from Suc(3) have less: "Heap.length a h - Suc n < Heap.length a h - n" by arith
   4.245 +  from Suc(3) have less2: "Heap.length a h - Suc n < Heap.length a h" by arith
   4.246 +  from Suc(4) length_remains have cases: "i = Heap.length a ?h1 - Suc n \<or> i \<ge> Heap.length a ?h1 - n" by arith
   4.247 +  from crel_mapM have crel_mapM': "crel (mapM (\<lambda>n. map_entry n f a) [Heap.length a ?h1 - n..<Heap.length a ?h1]) ?h1 h' r"
   4.248 +    by simp
   4.249 +  from Suc(1)[OF this] cases Suc(3) Suc(5) length_remains
   4.250 +    crel_mapM_map_entry_remains[OF this, of "Heap.length a h - Suc n", symmetric] less less2
   4.251 +  show ?case
   4.252 +    by (auto simp add: nth_list_update_eq Heap.length_def)
   4.253 +qed
   4.254 +
   4.255 +lemma crel_mapM_map_entry_length:
   4.256 +  assumes "crel (mapM (\<lambda>n. map_entry n f a) [Heap.length a h - n..<Heap.length a h]) h h' r"
   4.257 +  assumes "n \<le> Heap.length a h"
   4.258 +  shows "Heap.length a h' = Heap.length a h"
   4.259 +using assms
   4.260 +proof (induct n arbitrary: h h' r)
   4.261 +  case 0
   4.262 +  thus ?case by (auto elim!: crel_return)
   4.263 +next
   4.264 +  case (Suc n)
   4.265 +  let ?h1 = "Heap.upd a (Heap.length a h - Suc n) (f (get_array a h ! (Heap.length a h - Suc n))) h"
   4.266 +  from Suc(3) have "[Heap.length a h - Suc n..<Heap.length a h] = (Heap.length a h - Suc n)#[Heap.length a h - n..<Heap.length a h]"
   4.267 +    by (simp add: upt_conv_Cons')
   4.268 +  from Suc(2) this obtain r where 
   4.269 +    crel_mapM: "crel (mapM (\<lambda>n. map_entry n f a) [Heap.length a h - n..<Heap.length a h]) ?h1 h' r"
   4.270 +    by (auto simp add: run_drop elim!: crelE crel_map_entry crel_return)
   4.271 +  have length_remains: "Heap.length a ?h1 = Heap.length a h" by simp
   4.272 +  from crel_mapM have crel_mapM': "crel (mapM (\<lambda>n. map_entry n f a) [Heap.length a ?h1 - n..<Heap.length a ?h1]) ?h1 h' r"
   4.273 +    by simp
   4.274 +  from Suc(1)[OF this] length_remains Suc(3) show ?case by simp
   4.275 +qed
   4.276 +
   4.277 +lemma crel_mapM_map_entry:
   4.278 +assumes "crel (mapM (\<lambda>n. map_entry n f a) [0..<Heap.length a h]) h h' r"
   4.279 +  shows "get_array a h' = List.map f (get_array a h)"
   4.280 +proof -
   4.281 +  from assms have "crel (mapM (\<lambda>n. map_entry n f a) [Heap.length a h - Heap.length a h..<Heap.length a h]) h h' r" by simp
   4.282 +  from crel_mapM_map_entry_length[OF this]
   4.283 +  crel_mapM_map_entry_changes[OF this] show ?thesis
   4.284 +    unfolding Heap.length_def
   4.285 +    by (auto intro: nth_equalityI)
   4.286 +qed
   4.287 +
   4.288 +lemma crel_map_weak:
   4.289 +  assumes crel_map: "crel (Array.map f a) h h' r"
   4.290 +  obtains "r = a" "get_array a h' = List.map f (get_array a h)"
   4.291 +proof
   4.292 +  from assms crel_mapM_map_entry show  "get_array a h' = List.map f (get_array a h)"
   4.293 +    unfolding Array.map_def run_drop
   4.294 +    by (fastsimp elim!: crelE crel_length crel_return)
   4.295 +  from assms show "r = a"
   4.296 +    unfolding Array.map_def run_drop
   4.297 +    by (elim crelE crel_return)
   4.298 +qed
   4.299 +
   4.300 +subsection {* Elimination rules for reference commands *}
   4.301 +
   4.302 +(* TODO:
   4.303 +maybe introduce a new predicate "extends h' h x"
   4.304 +which means h' extends h with a new reference x.
   4.305 +Then crel_new: would be
   4.306 +assumes "crel (Ref.new v) h h' x"
   4.307 +obtains "get_ref x h' = v"
   4.308 +and "extends h' h x"
   4.309 +
   4.310 +and we would need further rules for extends:
   4.311 +extends h' h x \<Longrightarrow> \<not> ref_present x h
   4.312 +extends h' h x \<Longrightarrow>  ref_present x h'
   4.313 +extends h' h x \<Longrightarrow> ref_present y h \<Longrightarrow> ref_present y h'
   4.314 +extends h' h x \<Longrightarrow> ref_present y h \<Longrightarrow> get_ref y h = get_ref y h'
   4.315 +extends h' h x \<Longrightarrow> lim h' = Suc (lim h)
   4.316 +*)
   4.317 +
   4.318 +lemma crel_Ref_new:
   4.319 +  assumes "crel (Ref.new v) h h' x"
   4.320 +  obtains "get_ref x h' = v"
   4.321 +  and "\<not> ref_present x h"
   4.322 +  and "ref_present x h'"
   4.323 +  and "\<forall>y. ref_present y h \<longrightarrow> get_ref y h = get_ref y h'"
   4.324 + (* and "lim h' = Suc (lim h)" *)
   4.325 +  and "\<forall>y. ref_present y h \<longrightarrow> ref_present y h'"
   4.326 +  using assms
   4.327 +  unfolding Ref.new_def
   4.328 +  apply (elim crel_heap)
   4.329 +  unfolding Heap.ref_def
   4.330 +  apply (simp add: Let_def)
   4.331 +  unfolding Heap.new_ref_def
   4.332 +  apply (simp add: Let_def)
   4.333 +  unfolding ref_present_def
   4.334 +  apply auto
   4.335 +  unfolding get_ref_def set_ref_def
   4.336 +  apply auto
   4.337 +  done
   4.338 +
   4.339 +lemma crel_lookup:
   4.340 +  assumes "crel (!ref) h h' r"
   4.341 +  obtains "h = h'" "r = get_ref ref h"
   4.342 +using assms
   4.343 +unfolding Ref.lookup_def
   4.344 +by (auto elim: crel_heap)
   4.345 +
   4.346 +lemma crel_update:
   4.347 +  assumes "crel (ref := v) h h' r"
   4.348 +  obtains "h' = set_ref ref v h" "r = ()"
   4.349 +using assms
   4.350 +unfolding Ref.update_def
   4.351 +by (auto elim: crel_heap)
   4.352 +
   4.353 +lemma crel_change:
   4.354 +  assumes "crel (Ref.change f ref) h h' r"
   4.355 +  obtains "h' = set_ref ref (f (get_ref ref h)) h" "r = f (get_ref ref h)"
   4.356 +using assms
   4.357 +unfolding Ref.change_def run_drop Let_def
   4.358 +by (auto elim!: crelE crel_lookup crel_update crel_return)
   4.359 +
   4.360 +subsection {* Elimination rules for the assert command *}
   4.361 +
   4.362 +lemma crel_assert[consumes 1]:
   4.363 +  assumes "crel (assert P x) h h' r"
   4.364 +  obtains "P x" "r = x" "h = h'"
   4.365 +  using assms
   4.366 +  unfolding assert_def
   4.367 +  by (elim crel_if crel_return crel_raise) auto
   4.368 +
   4.369 +lemma crel_assert_eq: "(\<And>h h' r. crel f h h' r \<Longrightarrow> P r) \<Longrightarrow> f \<guillemotright>= assert P = f"
   4.370 +unfolding crel_def bindM_def Let_def assert_def
   4.371 +  raise_def return_def prod_case_beta
   4.372 +apply (cases f)
   4.373 +apply simp
   4.374 +apply (simp add: expand_fun_eq split_def)
   4.375 +apply auto
   4.376 +apply (case_tac "fst (fun x)")
   4.377 +apply (simp_all add: Pair_fst_snd_eq)
   4.378 +apply (erule_tac x="x" in meta_allE)
   4.379 +apply fastsimp
   4.380 +done
   4.381 +
   4.382 +section {* Introduction rules *}
   4.383 +
   4.384 +subsection {* Introduction rules for basic monadic commands *}
   4.385 +
   4.386 +lemma crelI:
   4.387 +  assumes "crel f h h' r" "crel (g r) h' h'' r'"
   4.388 +  shows "crel (f >>= g) h h'' r'"
   4.389 +  using assms by (simp add: crel_def' bindM_def)
   4.390 +
   4.391 +lemma crelI':
   4.392 +  assumes "crel f h h' r" "crel g h' h'' r'"
   4.393 +  shows "crel (f >> g) h h'' r'"
   4.394 +  using assms by (intro crelI) auto
   4.395 +
   4.396 +lemma crel_returnI:
   4.397 +  shows "crel (return x) h h x"
   4.398 +  unfolding crel_def return_def by simp
   4.399 +
   4.400 +lemma crel_raiseI:
   4.401 +  shows "\<not> (crel (raise x) h h' r)"
   4.402 +  unfolding crel_def raise_def by simp
   4.403 +
   4.404 +lemma crel_ifI:
   4.405 +  assumes "c \<longrightarrow> crel t h h' r"
   4.406 +  "\<not>c \<longrightarrow> crel e h h' r"
   4.407 +  shows "crel (if c then t else e) h h' r"
   4.408 +  using assms
   4.409 +  unfolding crel_def by auto
   4.410 +
   4.411 +lemma crel_option_caseI:
   4.412 +  assumes "\<And>y. x = Some y \<Longrightarrow> crel (s y) h h' r"
   4.413 +  assumes "x = None \<Longrightarrow> crel n h h' r"
   4.414 +  shows "crel (case x of None \<Rightarrow> n | Some y \<Rightarrow> s y) h h' r"
   4.415 +using assms
   4.416 +by (auto split: option.split)
   4.417 +
   4.418 +lemma crel_heapI:
   4.419 +  shows "crel (Heap_Monad.heap f) h (snd (f h)) (fst (f h))"
   4.420 +  by (simp add: crel_def apfst_def split_def prod_fun_def)
   4.421 +
   4.422 +lemma crel_heapI':
   4.423 +  assumes "h' = snd (f h)" "r = fst (f h)"
   4.424 +  shows "crel (Heap_Monad.heap f) h h' r"
   4.425 +  using assms
   4.426 +  by (simp add: crel_def split_def apfst_def prod_fun_def)
   4.427 +
   4.428 +lemma crelI2:
   4.429 +  assumes "\<exists>h' rs'. crel f h h' rs' \<and> (\<exists>h'' rs. crel (g rs') h' h'' rs)"
   4.430 +  shows "\<exists>h'' rs. crel (f\<guillemotright>= g) h h'' rs"
   4.431 +  oops
   4.432 +
   4.433 +lemma crel_ifI2:
   4.434 +  assumes "c \<Longrightarrow> \<exists>h' r. crel t h h' r"
   4.435 +  "\<not> c \<Longrightarrow> \<exists>h' r. crel e h h' r"
   4.436 +  shows "\<exists> h' r. crel (if c then t else e) h h' r"
   4.437 +  oops
   4.438 +
   4.439 +subsection {* Introduction rules for array commands *}
   4.440 +
   4.441 +lemma crel_lengthI:
   4.442 +  shows "crel (length a) h h (Heap.length a h)"
   4.443 +  unfolding length_def
   4.444 +  by (rule crel_heapI') auto
   4.445 +
   4.446 +(* thm crel_newI for Array.new is missing *)
   4.447 +
   4.448 +lemma crel_nthI:
   4.449 +  assumes "i < Heap.length a h"
   4.450 +  shows "crel (nth a i) h h ((get_array a h) ! i)"
   4.451 +  using assms
   4.452 +  unfolding nth_def run_drop
   4.453 +  by (auto intro!: crelI crel_ifI crel_raiseI crel_lengthI crel_heapI')
   4.454 +
   4.455 +lemma crel_updI:
   4.456 +  assumes "i < Heap.length a h"
   4.457 +  shows "crel (upd i v a) h (Heap.upd a i v h) a"
   4.458 +  using assms
   4.459 +  unfolding upd_def run_drop
   4.460 +  by (auto intro!: crelI crel_ifI crel_returnI crel_raiseI
   4.461 +    crel_lengthI crel_heapI')
   4.462 +
   4.463 +(* thm crel_of_listI is missing *)
   4.464 +
   4.465 +(* thm crel_map_entryI is missing *)
   4.466 +
   4.467 +(* thm crel_swapI is missing *)
   4.468 +
   4.469 +(* thm crel_makeI is missing *)
   4.470 +
   4.471 +(* thm crel_freezeI is missing *)
   4.472 +
   4.473 +(* thm crel_mapI is missing *)
   4.474 +
   4.475 +subsection {* Introduction rules for reference commands *}
   4.476 +
   4.477 +lemma crel_lookupI:
   4.478 +  shows "crel (!ref) h h (get_ref ref h)"
   4.479 +  unfolding lookup_def by (auto intro!: crel_heapI')
   4.480 +
   4.481 +lemma crel_updateI:
   4.482 +  shows "crel (ref := v) h (set_ref ref v h) ()"
   4.483 +  unfolding update_def by (auto intro!: crel_heapI')
   4.484 +
   4.485 +lemma crel_changeI: 
   4.486 +  shows "crel (Ref.change f ref) h (set_ref ref (f (get_ref ref h)) h) (f (get_ref ref h))"
   4.487 +unfolding change_def Let_def run_drop by (auto intro!: crelI crel_returnI crel_lookupI crel_updateI)
   4.488 +
   4.489 +subsection {* Introduction rules for the assert command *}
   4.490 +
   4.491 +lemma crel_assertI:
   4.492 +  assumes "P x"
   4.493 +  shows "crel (assert P x) h h x"
   4.494 +  using assms
   4.495 +  unfolding assert_def
   4.496 +  by (auto intro!: crel_ifI crel_returnI crel_raiseI)
   4.497 + 
   4.498 +section {* Defintion of the noError predicate *}
   4.499 +
   4.500 +text {* We add a simple definitional setting for crel intro rules
   4.501 +  where we only would like to show that the computation does not result in a exception for heap h,
   4.502 +  but we do not care about statements about the resulting heap and return value.*}
   4.503 +
   4.504 +definition noError :: "'a Heap \<Rightarrow> heap \<Rightarrow> bool"
   4.505 +where
   4.506 +  "noError c h \<longleftrightarrow> (\<exists>r h'. (Inl r, h') = Heap_Monad.execute c h)"
   4.507 +
   4.508 +lemma noError_def': -- FIXME
   4.509 +  "noError c h \<longleftrightarrow> (\<exists>r h'. Heap_Monad.execute c h = (Inl r, h'))"
   4.510 +  unfolding noError_def apply auto proof -
   4.511 +  fix r h'
   4.512 +  assume "(Inl r, h') = Heap_Monad.execute c h"
   4.513 +  then have "Heap_Monad.execute c h = (Inl r, h')" ..
   4.514 +  then show "\<exists>r h'. Heap_Monad.execute c h = (Inl r, h')" by blast
   4.515 +qed
   4.516 +
   4.517 +subsection {* Introduction rules for basic monadic commands *}
   4.518 +
   4.519 +lemma noErrorI:
   4.520 +  assumes "noError f h"
   4.521 +  assumes "\<And>h' r. crel f h h' r \<Longrightarrow> noError (g r) h'"
   4.522 +  shows "noError (f \<guillemotright>= g) h"
   4.523 +  using assms
   4.524 +  by (auto simp add: noError_def' crel_def' bindM_def)
   4.525 +
   4.526 +lemma noErrorI':
   4.527 +  assumes "noError f h"
   4.528 +  assumes "\<And>h' r. crel f h h' r \<Longrightarrow> noError g h'"
   4.529 +  shows "noError (f \<guillemotright> g) h"
   4.530 +  using assms
   4.531 +  by (auto simp add: noError_def' crel_def' bindM_def)
   4.532 +
   4.533 +lemma noErrorI2:
   4.534 +"\<lbrakk>crel f h h' r ; noError f h; noError (g r) h'\<rbrakk>
   4.535 +\<Longrightarrow> noError (f \<guillemotright>= g) h"
   4.536 +by (auto simp add: noError_def' crel_def' bindM_def)
   4.537 +
   4.538 +lemma noError_return: 
   4.539 +  shows "noError (return x) h"
   4.540 +  unfolding noError_def return_def
   4.541 +  by auto
   4.542 +
   4.543 +lemma noError_if:
   4.544 +  assumes "c \<Longrightarrow> noError t h" "\<not> c \<Longrightarrow> noError e h"
   4.545 +  shows "noError (if c then t else e) h"
   4.546 +  using assms
   4.547 +  unfolding noError_def
   4.548 +  by auto
   4.549 +
   4.550 +lemma noError_option_case:
   4.551 +  assumes "\<And>y. x = Some y \<Longrightarrow> noError (s y) h"
   4.552 +  assumes "noError n h"
   4.553 +  shows "noError (case x of None \<Rightarrow> n | Some y \<Rightarrow> s y) h"
   4.554 +using assms
   4.555 +by (auto split: option.split)
   4.556 +
   4.557 +lemma noError_mapM: 
   4.558 +assumes "\<forall>x \<in> set xs. noError (f x) h \<and> crel (f x) h h (r x)" 
   4.559 +shows "noError (mapM f xs) h"
   4.560 +using assms
   4.561 +proof (induct xs)
   4.562 +  case Nil
   4.563 +  thus ?case
   4.564 +    unfolding mapM.simps by (intro noError_return)
   4.565 +next
   4.566 +  case (Cons x xs)
   4.567 +  thus ?case
   4.568 +    unfolding mapM.simps run_drop
   4.569 +    by (auto intro: noErrorI2[of "f x"] noErrorI noError_return)
   4.570 +qed
   4.571 +
   4.572 +lemma noError_heap:
   4.573 +  shows "noError (Heap_Monad.heap f) h"
   4.574 +  by (simp add: noError_def' apfst_def prod_fun_def split_def)
   4.575 +
   4.576 +subsection {* Introduction rules for array commands *}
   4.577 +
   4.578 +lemma noError_length:
   4.579 +  shows "noError (Array.length a) h"
   4.580 +  unfolding length_def
   4.581 +  by (intro noError_heap)
   4.582 +
   4.583 +lemma noError_new:
   4.584 +  shows "noError (Array.new n v) h"
   4.585 +unfolding Array.new_def by (intro noError_heap)
   4.586 +
   4.587 +lemma noError_upd:
   4.588 +  assumes "i < Heap.length a h"
   4.589 +  shows "noError (Array.upd i v a) h"
   4.590 +  using assms
   4.591 +  unfolding upd_def run_drop
   4.592 +  by (auto intro!: noErrorI noError_if noError_return noError_length noError_heap) (auto elim: crel_length)
   4.593 +
   4.594 +lemma noError_nth:
   4.595 +assumes "i < Heap.length a h"
   4.596 +  shows "noError (Array.nth a i) h"
   4.597 +  using assms
   4.598 +  unfolding nth_def run_drop
   4.599 +  by (auto intro!: noErrorI noError_if noError_return noError_length noError_heap) (auto elim: crel_length)
   4.600 +
   4.601 +lemma noError_of_list:
   4.602 +  shows "noError (of_list ls) h"
   4.603 +  unfolding of_list_def by (rule noError_heap)
   4.604 +
   4.605 +lemma noError_map_entry:
   4.606 +  assumes "i < Heap.length a h"
   4.607 +  shows "noError (map_entry i f a) h"
   4.608 +  using assms
   4.609 +  unfolding map_entry_def run_drop
   4.610 +  by (auto elim: crel_nth intro!: noErrorI noError_nth noError_upd)
   4.611 +
   4.612 +lemma noError_swap:
   4.613 +  assumes "i < Heap.length a h"
   4.614 +  shows "noError (swap i x a) h"
   4.615 +  using assms
   4.616 +  unfolding swap_def run_drop
   4.617 +  by (auto elim: crel_nth intro!: noErrorI noError_return noError_nth noError_upd)
   4.618 +
   4.619 +lemma noError_make:
   4.620 +  shows "noError (make n f) h"
   4.621 +  unfolding make_def
   4.622 +  by (auto intro: noError_of_list)
   4.623 +
   4.624 +(*TODO: move to HeapMonad *)
   4.625 +lemma mapM_append:
   4.626 +  "mapM f (xs @ ys) = mapM f xs \<guillemotright>= (\<lambda>xs. mapM f ys \<guillemotright>= (\<lambda>ys. return (xs @ ys)))"
   4.627 +  by (induct xs) (simp_all add: monad_simp)
   4.628 +
   4.629 +lemma noError_freeze:
   4.630 +  shows "noError (freeze a) h"
   4.631 +unfolding freeze_def run_drop
   4.632 +by (auto intro!: noErrorI noError_length noError_mapM[of _ _ _ "\<lambda>x. get_array a h ! x"]
   4.633 +  noError_nth crel_nthI elim: crel_length)
   4.634 +
   4.635 +lemma noError_mapM_map_entry:
   4.636 +  assumes "n \<le> Heap.length a h"
   4.637 +  shows "noError (mapM (\<lambda>n. map_entry n f a) [Heap.length a h - n..<Heap.length a h]) h"
   4.638 +using assms
   4.639 +proof (induct n arbitrary: h)
   4.640 +  case 0
   4.641 +  thus ?case by (auto intro: noError_return)
   4.642 +next
   4.643 +  case (Suc n)
   4.644 +  from Suc.prems have "[Heap.length a h - Suc n..<Heap.length a h] = (Heap.length a h - Suc n)#[Heap.length a h - n..<Heap.length a h]"
   4.645 +    by (simp add: upt_conv_Cons')
   4.646 +  with Suc.hyps[of "(Heap.upd a (Heap.length a h - Suc n) (f (get_array a h ! (Heap.length a h - Suc n))) h)"] Suc.prems show ?case
   4.647 +    by (auto simp add: run_drop intro!: noErrorI noError_return noError_map_entry elim: crel_map_entry)
   4.648 +qed
   4.649 +
   4.650 +lemma noError_map:
   4.651 +  shows "noError (Array.map f a) h"
   4.652 +using noError_mapM_map_entry[of "Heap.length a h" a h]
   4.653 +unfolding Array.map_def run_drop
   4.654 +by (auto intro: noErrorI noError_length noError_return elim!: crel_length)
   4.655 +
   4.656 +subsection {* Introduction rules for the reference commands *}
   4.657 +
   4.658 +lemma noError_Ref_new:
   4.659 +  shows "noError (Ref.new v) h"
   4.660 +unfolding Ref.new_def by (intro noError_heap)
   4.661 +
   4.662 +lemma noError_lookup:
   4.663 +  shows "noError (!ref) h"
   4.664 +  unfolding lookup_def by (intro noError_heap)
   4.665 +
   4.666 +lemma noError_update:
   4.667 +  shows "noError (ref := v) h"
   4.668 +  unfolding update_def by (intro noError_heap)
   4.669 +
   4.670 +lemma noError_change:
   4.671 +  shows "noError (Ref.change f ref) h"
   4.672 +  unfolding Ref.change_def run_drop Let_def by (intro noErrorI noError_lookup noError_update noError_return)
   4.673 +
   4.674 +subsection {* Introduction rules for the assert command *}
   4.675 +
   4.676 +lemma noError_assert:
   4.677 +  assumes "P x"
   4.678 +  shows "noError (assert P x) h"
   4.679 +  using assms
   4.680 +  unfolding assert_def
   4.681 +  by (auto intro: noError_if noError_return)
   4.682 +
   4.683 +section {* Cumulative lemmas *}
   4.684 +
   4.685 +lemmas crel_elim_all =
   4.686 +  crelE crelE' crel_return crel_raise crel_if crel_option_case
   4.687 +  crel_length crel_new_weak crel_nth crel_upd crel_of_list_weak crel_map_entry crel_swap crel_make_weak crel_freeze crel_map_weak
   4.688 +  crel_Ref_new crel_lookup crel_update crel_change
   4.689 +  crel_assert
   4.690 +
   4.691 +lemmas crel_intro_all =
   4.692 +  crelI crelI' crel_returnI crel_raiseI crel_ifI crel_option_caseI
   4.693 +  crel_lengthI (* crel_newI *) crel_nthI crel_updI (* crel_of_listI crel_map_entryI crel_swapI crel_makeI crel_freezeI crel_mapI *)
   4.694 +  (* crel_Ref_newI *) crel_lookupI crel_updateI crel_changeI
   4.695 +  crel_assert
   4.696 +
   4.697 +lemmas noError_intro_all = 
   4.698 +  noErrorI noErrorI' noError_return noError_if noError_option_case
   4.699 +  noError_length noError_new noError_nth noError_upd noError_of_list noError_map_entry noError_swap noError_make noError_freeze noError_map
   4.700 +  noError_Ref_new noError_lookup noError_update noError_change
   4.701 +  noError_assert
   4.702 +
   4.703 +end
   4.704 \ No newline at end of file
     5.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     5.2 +++ b/src/HOL/Library/Subarray.thy	Sat Jul 19 19:27:13 2008 +0200
     5.3 @@ -0,0 +1,66 @@
     5.4 +theory Subarray
     5.5 +imports Array Sublist
     5.6 +begin
     5.7 +
     5.8 +definition subarray :: "nat \<Rightarrow> nat \<Rightarrow> ('a::heap) array \<Rightarrow> heap \<Rightarrow> 'a list"
     5.9 +where
    5.10 +  "subarray n m a h \<equiv> sublist' n m (get_array a h)"
    5.11 +
    5.12 +lemma subarray_upd: "i \<ge> m \<Longrightarrow> subarray n m a (Heap.upd a i v h) = subarray n m a h"
    5.13 +apply (simp add: subarray_def Heap.upd_def)
    5.14 +apply (simp add: sublist'_update1)
    5.15 +done
    5.16 +
    5.17 +lemma subarray_upd2: " i < n  \<Longrightarrow> subarray n m a (Heap.upd a i v h) = subarray n m a h"
    5.18 +apply (simp add: subarray_def Heap.upd_def)
    5.19 +apply (subst sublist'_update2)
    5.20 +apply fastsimp
    5.21 +apply simp
    5.22 +done
    5.23 +
    5.24 +lemma subarray_upd3: "\<lbrakk> n \<le> i; i < m\<rbrakk> \<Longrightarrow> subarray n m a (Heap.upd a i v h) = subarray n m a h[i - n := v]"
    5.25 +unfolding subarray_def Heap.upd_def
    5.26 +by (simp add: sublist'_update3)
    5.27 +
    5.28 +lemma subarray_Nil: "n \<ge> m \<Longrightarrow> subarray n m a h = []"
    5.29 +by (simp add: subarray_def sublist'_Nil')
    5.30 +
    5.31 +lemma subarray_single: "\<lbrakk> n < Heap.length a h \<rbrakk> \<Longrightarrow> subarray n (Suc n) a h = [get_array a h ! n]" 
    5.32 +by (simp add: subarray_def Heap.length_def sublist'_single)
    5.33 +
    5.34 +lemma length_subarray: "m \<le> Heap.length a h \<Longrightarrow> List.length (subarray n m a h) = m - n"
    5.35 +by (simp add: subarray_def Heap.length_def length_sublist')
    5.36 +
    5.37 +lemma length_subarray_0: "m \<le> Heap.length a h \<Longrightarrow> List.length (subarray 0 m a h) = m"
    5.38 +by (simp add: length_subarray)
    5.39 +
    5.40 +lemma subarray_nth_array_Cons: "\<lbrakk> i < Heap.length a h; i < j \<rbrakk> \<Longrightarrow> (get_array a h ! i) # subarray (Suc i) j a h = subarray i j a h"
    5.41 +unfolding Heap.length_def subarray_def
    5.42 +by (simp add: sublist'_front)
    5.43 +
    5.44 +lemma subarray_nth_array_back: "\<lbrakk> i < j; j \<le> Heap.length a h\<rbrakk> \<Longrightarrow> subarray i j a h = subarray i (j - 1) a h @ [get_array a h ! (j - 1)]"
    5.45 +unfolding Heap.length_def subarray_def
    5.46 +by (simp add: sublist'_back)
    5.47 +
    5.48 +lemma subarray_append: "\<lbrakk> i < j; j < k \<rbrakk> \<Longrightarrow> subarray i j a h @ subarray j k a h = subarray i k a h"
    5.49 +unfolding subarray_def
    5.50 +by (simp add: sublist'_append)
    5.51 +
    5.52 +lemma subarray_all: "subarray 0 (Heap.length a h) a h = get_array a h"
    5.53 +unfolding Heap.length_def subarray_def
    5.54 +by (simp add: sublist'_all)
    5.55 +
    5.56 +lemma nth_subarray: "\<lbrakk> k < j - i; j \<le> Heap.length a h \<rbrakk> \<Longrightarrow> subarray i j a h ! k = get_array a h ! (i + k)"
    5.57 +unfolding Heap.length_def subarray_def
    5.58 +by (simp add: nth_sublist')
    5.59 +
    5.60 +lemma subarray_eq_samelength_iff: "Heap.length a h = Heap.length a h' \<Longrightarrow> (subarray i j a h = subarray i j a h') = (\<forall>i'. i \<le> i' \<and> i' < j \<longrightarrow> get_array a h ! i' = get_array a h' ! i')"
    5.61 +unfolding Heap.length_def subarray_def by (rule sublist'_eq_samelength_iff)
    5.62 +
    5.63 +lemma all_in_set_subarray_conv: "(\<forall>j. j \<in> set (subarray l r a h) \<longrightarrow> P j) = (\<forall>k. l \<le> k \<and> k < r \<and> k < Heap.length a h \<longrightarrow> P (get_array a h ! k))"
    5.64 +unfolding subarray_def Heap.length_def by (rule all_in_set_sublist'_conv)
    5.65 +
    5.66 +lemma ball_in_set_subarray_conv: "(\<forall>j \<in> set (subarray l r a h). P j) = (\<forall>k. l \<le> k \<and> k < r \<and> k < Heap.length a h \<longrightarrow> P (get_array a h ! k))"
    5.67 +unfolding subarray_def Heap.length_def by (rule ball_in_set_sublist'_conv)
    5.68 +
    5.69 +end
    5.70 \ No newline at end of file
     6.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     6.2 +++ b/src/HOL/Library/Sublist.thy	Sat Jul 19 19:27:13 2008 +0200
     6.3 @@ -0,0 +1,507 @@
     6.4 +(* $Id$ *)
     6.5 +
     6.6 +header {* Slices of lists *}
     6.7 +
     6.8 +theory Sublist
     6.9 +imports Multiset
    6.10 +begin
    6.11 +
    6.12 +
    6.13 +lemma sublist_split: "i \<le> j \<and> j \<le> k \<Longrightarrow> sublist xs {i..<j} @ sublist xs {j..<k} = sublist xs {i..<k}" 
    6.14 +apply (induct xs arbitrary: i j k)
    6.15 +apply simp
    6.16 +apply (simp only: sublist_Cons)
    6.17 +apply simp
    6.18 +apply safe
    6.19 +apply simp
    6.20 +apply (erule_tac x="0" in meta_allE)
    6.21 +apply (erule_tac x="j - 1" in meta_allE)
    6.22 +apply (erule_tac x="k - 1" in meta_allE)
    6.23 +apply (subgoal_tac "0 \<le> j - 1 \<and> j - 1 \<le> k - 1")
    6.24 +apply simp
    6.25 +apply (subgoal_tac "{ja. Suc ja < j} = {0..<j - Suc 0}")
    6.26 +apply (subgoal_tac "{ja. j \<le> Suc ja \<and> Suc ja < k} = {j - Suc 0..<k - Suc 0}")
    6.27 +apply (subgoal_tac "{j. Suc j < k} = {0..<k - Suc 0}")
    6.28 +apply simp
    6.29 +apply fastsimp
    6.30 +apply fastsimp
    6.31 +apply fastsimp
    6.32 +apply fastsimp
    6.33 +apply (erule_tac x="i - 1" in meta_allE)
    6.34 +apply (erule_tac x="j - 1" in meta_allE)
    6.35 +apply (erule_tac x="k - 1" in meta_allE)
    6.36 +apply (subgoal_tac " {ja. i \<le> Suc ja \<and> Suc ja < j} = {i - 1 ..<j - 1}")
    6.37 +apply (subgoal_tac " {ja. j \<le> Suc ja \<and> Suc ja < k} = {j - 1..<k - 1}")
    6.38 +apply (subgoal_tac "{j. i \<le> Suc j \<and> Suc j < k} = {i - 1..<k - 1}")
    6.39 +apply (subgoal_tac " i - 1 \<le> j - 1 \<and> j - 1 \<le> k - 1")
    6.40 +apply simp
    6.41 +apply fastsimp
    6.42 +apply fastsimp
    6.43 +apply fastsimp
    6.44 +apply fastsimp
    6.45 +done
    6.46 +
    6.47 +lemma sublist_update1: "i \<notin> inds \<Longrightarrow> sublist (xs[i := v]) inds = sublist xs inds"
    6.48 +apply (induct xs arbitrary: i inds)
    6.49 +apply simp
    6.50 +apply (case_tac i)
    6.51 +apply (simp add: sublist_Cons)
    6.52 +apply (simp add: sublist_Cons)
    6.53 +done
    6.54 +
    6.55 +lemma sublist_update2: "i \<in> inds \<Longrightarrow> sublist (xs[i := v]) inds = (sublist xs inds)[(card {k \<in> inds. k < i}):= v]"
    6.56 +proof (induct xs arbitrary: i inds)
    6.57 +  case Nil thus ?case by simp
    6.58 +next
    6.59 +  case (Cons x xs)
    6.60 +  thus ?case
    6.61 +  proof (cases i)
    6.62 +    case 0 with Cons show ?thesis by (simp add: sublist_Cons)
    6.63 +  next
    6.64 +    case (Suc i')
    6.65 +    with Cons show ?thesis
    6.66 +      apply simp
    6.67 +      apply (simp add: sublist_Cons)
    6.68 +      apply auto
    6.69 +      apply (auto simp add: nat.split)
    6.70 +      apply (simp add: card_less)
    6.71 +      apply (simp add: card_less)
    6.72 +      apply (simp add: card_less_Suc[symmetric])
    6.73 +      apply (simp add: card_less_Suc2)
    6.74 +      done
    6.75 +  qed
    6.76 +qed
    6.77 +
    6.78 +lemma sublist_update: "sublist (xs[i := v]) inds = (if i \<in> inds then (sublist xs inds)[(card {k \<in> inds. k < i}) := v] else sublist xs inds)"
    6.79 +by (simp add: sublist_update1 sublist_update2)
    6.80 +
    6.81 +lemma sublist_take: "sublist xs {j. j < m} = take m xs"
    6.82 +apply (induct xs arbitrary: m)
    6.83 +apply simp
    6.84 +apply (case_tac m)
    6.85 +apply simp
    6.86 +apply (simp add: sublist_Cons)
    6.87 +done
    6.88 +
    6.89 +lemma sublist_take': "sublist xs {0..<m} = take m xs"
    6.90 +apply (induct xs arbitrary: m)
    6.91 +apply simp
    6.92 +apply (case_tac m)
    6.93 +apply simp
    6.94 +apply (simp add: sublist_Cons sublist_take)
    6.95 +done
    6.96 +
    6.97 +lemma sublist_all[simp]: "sublist xs {j. j < length xs} = xs"
    6.98 +apply (induct xs)
    6.99 +apply simp
   6.100 +apply (simp add: sublist_Cons)
   6.101 +done
   6.102 +
   6.103 +lemma sublist_all'[simp]: "sublist xs {0..<length xs} = xs"
   6.104 +apply (induct xs)
   6.105 +apply simp
   6.106 +apply (simp add: sublist_Cons)
   6.107 +done
   6.108 +
   6.109 +lemma sublist_single: "a < length xs \<Longrightarrow> sublist xs {a} = [xs ! a]"
   6.110 +apply (induct xs arbitrary: a)
   6.111 +apply simp
   6.112 +apply(case_tac aa)
   6.113 +apply simp
   6.114 +apply (simp add: sublist_Cons)
   6.115 +apply simp
   6.116 +apply (simp add: sublist_Cons)
   6.117 +done
   6.118 +
   6.119 +lemma sublist_is_Nil: "\<forall>i \<in> inds. i \<ge> length xs \<Longrightarrow> sublist xs inds = []" 
   6.120 +apply (induct xs arbitrary: inds)
   6.121 +apply simp
   6.122 +apply (simp add: sublist_Cons)
   6.123 +apply auto
   6.124 +apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
   6.125 +apply auto
   6.126 +done
   6.127 +
   6.128 +lemma sublist_Nil': "sublist xs inds = [] \<Longrightarrow> \<forall>i \<in> inds. i \<ge> length xs"
   6.129 +apply (induct xs arbitrary: inds)
   6.130 +apply simp
   6.131 +apply (simp add: sublist_Cons)
   6.132 +apply (auto split: if_splits)
   6.133 +apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
   6.134 +apply (case_tac x, auto)
   6.135 +done
   6.136 +
   6.137 +lemma sublist_Nil[simp]: "(sublist xs inds = []) = (\<forall>i \<in> inds. i \<ge> length xs)"
   6.138 +apply (induct xs arbitrary: inds)
   6.139 +apply simp
   6.140 +apply (simp add: sublist_Cons)
   6.141 +apply auto
   6.142 +apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
   6.143 +apply (case_tac x, auto)
   6.144 +done
   6.145 +
   6.146 +lemma sublist_eq_subseteq: " \<lbrakk> inds' \<subseteq> inds; sublist xs inds = sublist ys inds \<rbrakk> \<Longrightarrow> sublist xs inds' = sublist ys inds'"
   6.147 +apply (induct xs arbitrary: ys inds inds')
   6.148 +apply simp
   6.149 +apply (drule sym, rule sym)
   6.150 +apply (simp add: sublist_Nil, fastsimp)
   6.151 +apply (case_tac ys)
   6.152 +apply (simp add: sublist_Nil, fastsimp)
   6.153 +apply (auto simp add: sublist_Cons)
   6.154 +apply (erule_tac x="list" in meta_allE)
   6.155 +apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
   6.156 +apply (erule_tac x="{j. Suc j \<in> inds'}" in meta_allE)
   6.157 +apply fastsimp
   6.158 +apply (erule_tac x="list" in meta_allE)
   6.159 +apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
   6.160 +apply (erule_tac x="{j. Suc j \<in> inds'}" in meta_allE)
   6.161 +apply fastsimp
   6.162 +done
   6.163 +
   6.164 +lemma sublist_eq: "\<lbrakk> \<forall>i \<in> inds. ((i < length xs) \<and> (i < length ys)) \<or> ((i \<ge> length xs ) \<and> (i \<ge> length ys)); \<forall>i \<in> inds. xs ! i = ys ! i \<rbrakk> \<Longrightarrow> sublist xs inds = sublist ys inds"
   6.165 +apply (induct xs arbitrary: ys inds)
   6.166 +apply simp
   6.167 +apply (rule sym, simp add: sublist_Nil)
   6.168 +apply (case_tac ys)
   6.169 +apply (simp add: sublist_Nil)
   6.170 +apply (auto simp add: sublist_Cons)
   6.171 +apply (erule_tac x="list" in meta_allE)
   6.172 +apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
   6.173 +apply fastsimp
   6.174 +apply (erule_tac x="list" in meta_allE)
   6.175 +apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
   6.176 +apply fastsimp
   6.177 +done
   6.178 +
   6.179 +lemma sublist_eq_samelength: "\<lbrakk> length xs = length ys; \<forall>i \<in> inds. xs ! i = ys ! i \<rbrakk> \<Longrightarrow> sublist xs inds = sublist ys inds"
   6.180 +by (rule sublist_eq, auto)
   6.181 +
   6.182 +lemma sublist_eq_samelength_iff: "length xs = length ys \<Longrightarrow> (sublist xs inds = sublist ys inds) = (\<forall>i \<in> inds. xs ! i = ys ! i)"
   6.183 +apply (induct xs arbitrary: ys inds)
   6.184 +apply simp
   6.185 +apply (rule sym, simp add: sublist_Nil)
   6.186 +apply (case_tac ys)
   6.187 +apply (simp add: sublist_Nil)
   6.188 +apply (auto simp add: sublist_Cons)
   6.189 +apply (case_tac i)
   6.190 +apply auto
   6.191 +apply (case_tac i)
   6.192 +apply auto
   6.193 +done
   6.194 +
   6.195 +section {* Another sublist function *}
   6.196 +
   6.197 +function sublist' :: "nat \<Rightarrow> nat \<Rightarrow> 'a list \<Rightarrow> 'a list"
   6.198 +where
   6.199 +  "sublist' n m [] = []"
   6.200 +| "sublist' n 0 xs = []"
   6.201 +| "sublist' 0 (Suc m) (x#xs) = (x#sublist' 0 m xs)"
   6.202 +| "sublist' (Suc n) (Suc m) (x#xs) = sublist' n m xs"
   6.203 +by pat_completeness auto
   6.204 +termination by lexicographic_order
   6.205 +
   6.206 +subsection {* Proving equivalence to the other sublist command *}
   6.207 +
   6.208 +lemma sublist'_sublist: "sublist' n m xs = sublist xs {j. n \<le> j \<and> j < m}"
   6.209 +apply (induct xs arbitrary: n m)
   6.210 +apply simp
   6.211 +apply (case_tac n)
   6.212 +apply (case_tac m)
   6.213 +apply simp
   6.214 +apply (simp add: sublist_Cons)
   6.215 +apply (case_tac m)
   6.216 +apply simp
   6.217 +apply (simp add: sublist_Cons)
   6.218 +done
   6.219 +
   6.220 +
   6.221 +lemma "sublist' n m xs = sublist xs {n..<m}"
   6.222 +apply (induct xs arbitrary: n m)
   6.223 +apply simp
   6.224 +apply (case_tac n, case_tac m)
   6.225 +apply simp
   6.226 +apply simp
   6.227 +apply (simp add: sublist_take')
   6.228 +apply (case_tac m)
   6.229 +apply simp
   6.230 +apply (simp add: sublist_Cons sublist'_sublist)
   6.231 +done
   6.232 +
   6.233 +
   6.234 +subsection {* Showing equivalence to use of drop and take for definition *}
   6.235 +
   6.236 +lemma "sublist' n m xs = take (m - n) (drop n xs)"
   6.237 +apply (induct xs arbitrary: n m)
   6.238 +apply simp
   6.239 +apply (case_tac m)
   6.240 +apply simp
   6.241 +apply (case_tac n)
   6.242 +apply simp
   6.243 +apply simp
   6.244 +done
   6.245 +
   6.246 +subsection {* General lemma about sublist *}
   6.247 +
   6.248 +lemma sublist'_Nil[simp]: "sublist' i j [] = []"
   6.249 +by simp
   6.250 +
   6.251 +lemma sublist'_Cons[simp]: "sublist' i (Suc j) (x#xs) = (case i of 0 \<Rightarrow> (x # sublist' 0 j xs) | Suc i' \<Rightarrow>  sublist' i' j xs)"
   6.252 +by (cases i) auto
   6.253 +
   6.254 +lemma sublist'_Cons2[simp]: "sublist' i j (x#xs) = (if (j = 0) then [] else ((if (i = 0) then [x] else []) @ sublist' (i - 1) (j - 1) xs))"
   6.255 +apply (cases j)
   6.256 +apply auto
   6.257 +apply (cases i)
   6.258 +apply auto
   6.259 +done
   6.260 +
   6.261 +lemma sublist_n_0: "sublist' n 0 xs = []"
   6.262 +by (induct xs, auto)
   6.263 +
   6.264 +lemma sublist'_Nil': "n \<ge> m \<Longrightarrow> sublist' n m xs = []"
   6.265 +apply (induct xs arbitrary: n m)
   6.266 +apply simp
   6.267 +apply (case_tac m)
   6.268 +apply simp
   6.269 +apply (case_tac n)
   6.270 +apply simp
   6.271 +apply simp
   6.272 +done
   6.273 +
   6.274 +lemma sublist'_Nil2: "n \<ge> length xs \<Longrightarrow> sublist' n m xs = []"
   6.275 +apply (induct xs arbitrary: n m)
   6.276 +apply simp
   6.277 +apply (case_tac m)
   6.278 +apply simp
   6.279 +apply (case_tac n)
   6.280 +apply simp
   6.281 +apply simp
   6.282 +done
   6.283 +
   6.284 +lemma sublist'_Nil3: "(sublist' n m xs = []) = ((n \<ge> m) \<or> (n \<ge> length xs))"
   6.285 +apply (induct xs arbitrary: n m)
   6.286 +apply simp
   6.287 +apply (case_tac m)
   6.288 +apply simp
   6.289 +apply (case_tac n)
   6.290 +apply simp
   6.291 +apply simp
   6.292 +done
   6.293 +
   6.294 +lemma sublist'_notNil: "\<lbrakk> n < length xs; n < m \<rbrakk> \<Longrightarrow> sublist' n m xs \<noteq> []"
   6.295 +apply (induct xs arbitrary: n m)
   6.296 +apply simp
   6.297 +apply (case_tac m)
   6.298 +apply simp
   6.299 +apply (case_tac n)
   6.300 +apply simp
   6.301 +apply simp
   6.302 +done
   6.303 +
   6.304 +lemma sublist'_single: "n < length xs \<Longrightarrow> sublist' n (Suc n) xs = [xs ! n]"
   6.305 +apply (induct xs arbitrary: n)
   6.306 +apply simp
   6.307 +apply simp
   6.308 +apply (case_tac n)
   6.309 +apply (simp add: sublist_n_0)
   6.310 +apply simp
   6.311 +done
   6.312 +
   6.313 +lemma sublist'_update1: "i \<ge> m \<Longrightarrow> sublist' n m (xs[i:=v]) = sublist' n m xs"
   6.314 +apply (induct xs arbitrary: n m i)
   6.315 +apply simp
   6.316 +apply simp
   6.317 +apply (case_tac i)
   6.318 +apply simp
   6.319 +apply simp
   6.320 +done
   6.321 +
   6.322 +lemma sublist'_update2: "i < n \<Longrightarrow> sublist' n m (xs[i:=v]) = sublist' n m xs"
   6.323 +apply (induct xs arbitrary: n m i)
   6.324 +apply simp
   6.325 +apply simp
   6.326 +apply (case_tac i)
   6.327 +apply simp
   6.328 +apply simp
   6.329 +done
   6.330 +
   6.331 +lemma sublist'_update3: "\<lbrakk>n \<le> i; i < m\<rbrakk> \<Longrightarrow> sublist' n m (xs[i := v]) = (sublist' n m xs)[i - n := v]"
   6.332 +proof (induct xs arbitrary: n m i)
   6.333 +  case Nil thus ?case by auto
   6.334 +next
   6.335 +  case (Cons x xs)
   6.336 +  thus ?case
   6.337 +    apply -
   6.338 +    apply auto
   6.339 +    apply (cases i)
   6.340 +    apply auto
   6.341 +    apply (cases i)
   6.342 +    apply auto
   6.343 +    done
   6.344 +qed
   6.345 +
   6.346 +lemma "\<lbrakk> sublist' i j xs = sublist' i j ys; n \<ge> i; m \<le> j \<rbrakk> \<Longrightarrow> sublist' n m xs = sublist' n m ys"
   6.347 +proof (induct xs arbitrary: i j ys n m)
   6.348 +  case Nil
   6.349 +  thus ?case
   6.350 +    apply -
   6.351 +    apply (rule sym, drule sym)
   6.352 +    apply (simp add: sublist'_Nil)
   6.353 +    apply (simp add: sublist'_Nil3)
   6.354 +    apply arith
   6.355 +    done
   6.356 +next
   6.357 +  case (Cons x xs i j ys n m)
   6.358 +  note c = this
   6.359 +  thus ?case
   6.360 +  proof (cases m)
   6.361 +    case 0 thus ?thesis by (simp add: sublist_n_0)
   6.362 +  next
   6.363 +    case (Suc m')
   6.364 +    note a = this
   6.365 +    thus ?thesis
   6.366 +    proof (cases n)
   6.367 +      case 0 note b = this
   6.368 +      show ?thesis
   6.369 +      proof (cases ys)
   6.370 +	case Nil  with a b Cons.prems show ?thesis by (simp add: sublist'_Nil3)
   6.371 +      next
   6.372 +	case (Cons y ys)
   6.373 +	show ?thesis
   6.374 +	proof (cases j)
   6.375 +	  case 0 with a b Cons.prems show ?thesis by simp
   6.376 +	next
   6.377 +	  case (Suc j') with a b Cons.prems Cons show ?thesis 
   6.378 +	    apply -
   6.379 +	    apply (simp, rule Cons.hyps [of "0" "j'" "ys" "0" "m'"], auto)
   6.380 +	    done
   6.381 +	qed
   6.382 +      qed
   6.383 +    next
   6.384 +      case (Suc n')
   6.385 +      show ?thesis
   6.386 +      proof (cases ys)
   6.387 +	case Nil with Suc a Cons.prems show ?thesis by (auto simp add: sublist'_Nil3)
   6.388 +      next
   6.389 +	case (Cons y ys) with Suc a Cons.prems show ?thesis
   6.390 +	  apply -
   6.391 +	  apply simp
   6.392 +	  apply (cases j)
   6.393 +	  apply simp
   6.394 +	  apply (cases i)
   6.395 +	  apply simp
   6.396 +	  apply (rule_tac j="nat" in Cons.hyps [of "0" _ "ys" "n'" "m'"])
   6.397 +	  apply simp
   6.398 +	  apply simp
   6.399 +	  apply simp
   6.400 +	  apply simp
   6.401 +	  apply (rule_tac i="nata" and j="nat" in Cons.hyps [of _ _ "ys" "n'" "m'"])
   6.402 +	  apply simp
   6.403 +	  apply simp
   6.404 +	  apply simp
   6.405 +	  done
   6.406 +      qed
   6.407 +    qed
   6.408 +  qed
   6.409 +qed
   6.410 +
   6.411 +lemma length_sublist': "j \<le> length xs \<Longrightarrow> length (sublist' i j xs) = j - i"
   6.412 +by (induct xs arbitrary: i j, auto)
   6.413 +
   6.414 +lemma sublist'_front: "\<lbrakk> i < j; i < length xs \<rbrakk> \<Longrightarrow> sublist' i j xs = xs ! i # sublist' (Suc i) j xs"
   6.415 +apply (induct xs arbitrary: a i j)
   6.416 +apply simp
   6.417 +apply (case_tac j)
   6.418 +apply simp
   6.419 +apply (case_tac i)
   6.420 +apply simp
   6.421 +apply simp
   6.422 +done
   6.423 +
   6.424 +lemma sublist'_back: "\<lbrakk> i < j; j \<le> length xs \<rbrakk> \<Longrightarrow> sublist' i j xs = sublist' i (j - 1) xs @ [xs ! (j - 1)]"
   6.425 +apply (induct xs arbitrary: a i j)
   6.426 +apply simp
   6.427 +apply simp
   6.428 +apply (case_tac j)
   6.429 +apply simp
   6.430 +apply auto
   6.431 +apply (case_tac nat)
   6.432 +apply auto
   6.433 +done
   6.434 +
   6.435 +(* suffices that j \<le> length xs and length ys *) 
   6.436 +lemma sublist'_eq_samelength_iff: "length xs = length ys \<Longrightarrow> (sublist' i j xs  = sublist' i j ys) = (\<forall>i'. i \<le> i' \<and> i' < j \<longrightarrow> xs ! i' = ys ! i')"
   6.437 +proof (induct xs arbitrary: ys i j)
   6.438 +  case Nil thus ?case by simp
   6.439 +next
   6.440 +  case (Cons x xs)
   6.441 +  thus ?case
   6.442 +    apply -
   6.443 +    apply (cases ys)
   6.444 +    apply simp
   6.445 +    apply simp
   6.446 +    apply auto
   6.447 +    apply (case_tac i', auto)
   6.448 +    apply (erule_tac x="Suc i'" in allE, auto)
   6.449 +    apply (erule_tac x="i' - 1" in allE, auto)
   6.450 +    apply (case_tac i', auto)
   6.451 +    apply (erule_tac x="Suc i'" in allE, auto)
   6.452 +    done
   6.453 +qed
   6.454 +
   6.455 +lemma sublist'_all[simp]: "sublist' 0 (length xs) xs = xs"
   6.456 +by (induct xs, auto)
   6.457 +
   6.458 +lemma sublist'_sublist': "sublist' n m (sublist' i j xs) = sublist' (i + n) (min (i + m) j) xs" 
   6.459 +by (induct xs arbitrary: i j n m) (auto simp add: min_diff)
   6.460 +
   6.461 +lemma sublist'_append: "\<lbrakk> i \<le> j; j \<le> k \<rbrakk> \<Longrightarrow>(sublist' i j xs) @ (sublist' j k xs) = sublist' i k xs"
   6.462 +by (induct xs arbitrary: i j k) auto
   6.463 +
   6.464 +lemma nth_sublist': "\<lbrakk> k < j - i; j \<le> length xs \<rbrakk> \<Longrightarrow> (sublist' i j xs) ! k = xs ! (i + k)"
   6.465 +apply (induct xs arbitrary: i j k)
   6.466 +apply auto
   6.467 +apply (case_tac k)
   6.468 +apply auto
   6.469 +apply (case_tac i)
   6.470 +apply auto
   6.471 +done
   6.472 +
   6.473 +lemma set_sublist': "set (sublist' i j xs) = {x. \<exists>k. i \<le> k \<and> k < j \<and> k < List.length xs \<and> x = xs ! k}"
   6.474 +apply (simp add: sublist'_sublist)
   6.475 +apply (simp add: set_sublist)
   6.476 +apply auto
   6.477 +done
   6.478 +
   6.479 +lemma all_in_set_sublist'_conv: "(\<forall>j. j \<in> set (sublist' l r xs) \<longrightarrow> P j) = (\<forall>k. l \<le> k \<and> k < r \<and> k < List.length xs \<longrightarrow> P (xs ! k))"
   6.480 +unfolding set_sublist' by blast
   6.481 +
   6.482 +lemma ball_in_set_sublist'_conv: "(\<forall>j \<in> set (sublist' l r xs). P j) = (\<forall>k. l \<le> k \<and> k < r \<and> k < List.length xs \<longrightarrow> P (xs ! k))"
   6.483 +unfolding set_sublist' by blast
   6.484 +
   6.485 +
   6.486 +lemma multiset_of_sublist:
   6.487 +assumes l_r: "l \<le> r \<and> r \<le> List.length xs"
   6.488 +assumes left: "\<forall> i. i < l \<longrightarrow> (xs::'a list) ! i = ys ! i"
   6.489 +assumes right: "\<forall> i. i \<ge> r \<longrightarrow> (xs::'a list) ! i = ys ! i"
   6.490 +assumes multiset: "multiset_of xs = multiset_of ys"
   6.491 +  shows "multiset_of (sublist' l r xs) = multiset_of (sublist' l r ys)"
   6.492 +proof -
   6.493 +  from l_r have xs_def: "xs = (sublist' 0 l xs) @ (sublist' l r xs) @ (sublist' r (List.length xs) xs)" (is "_ = ?xs_long") 
   6.494 +    by (simp add: sublist'_append)
   6.495 +  from multiset have length_eq: "List.length xs = List.length ys" by (rule multiset_of_eq_length)
   6.496 +  with l_r have ys_def: "ys = (sublist' 0 l ys) @ (sublist' l r ys) @ (sublist' r (List.length ys) ys)" (is "_ = ?ys_long") 
   6.497 +    by (simp add: sublist'_append)
   6.498 +  from xs_def ys_def multiset have "multiset_of ?xs_long = multiset_of ?ys_long" by simp
   6.499 +  moreover
   6.500 +  from left l_r length_eq have "sublist' 0 l xs = sublist' 0 l ys"
   6.501 +    by (auto simp add: length_sublist' nth_sublist' intro!: nth_equalityI)
   6.502 +  moreover
   6.503 +  from right l_r length_eq have "sublist' r (List.length xs) xs = sublist' r (List.length ys) ys"
   6.504 +    by (auto simp add: length_sublist' nth_sublist' intro!: nth_equalityI)
   6.505 +  moreover
   6.506 +  ultimately show ?thesis by (simp add: multiset_of_append)
   6.507 +qed
   6.508 +
   6.509 +
   6.510 +end
     7.1 --- a/src/HOL/SetInterval.thy	Sat Jul 19 11:05:18 2008 +0200
     7.2 +++ b/src/HOL/SetInterval.thy	Sat Jul 19 19:27:13 2008 +0200
     7.3 @@ -558,6 +558,54 @@
     7.4  lemma card_greaterThanLessThan_int [simp]: "card {l<..<u} = nat (u - (l + 1))"
     7.5    by (subst atLeastPlusOneLessThan_greaterThanLessThan_int [THEN sym], simp)
     7.6  
     7.7 +lemma finite_M_bounded_by_nat: "finite {k. P k \<and> k < (i::nat)}"
     7.8 +proof -
     7.9 +  have "{k. P k \<and> k < i} \<subseteq> {..<i}" by auto
    7.10 +  with finite_lessThan[of "i"] show ?thesis by (simp add: finite_subset)
    7.11 +qed
    7.12 +
    7.13 +lemma card_less:
    7.14 +assumes zero_in_M: "0 \<in> M"
    7.15 +shows "card {k \<in> M. k < Suc i} \<noteq> 0"
    7.16 +proof -
    7.17 +  from zero_in_M have "{k \<in> M. k < Suc i} \<noteq> {}" by auto
    7.18 +  with finite_M_bounded_by_nat show ?thesis by (auto simp add: card_eq_0_iff)
    7.19 +qed
    7.20 +
    7.21 +lemma card_less_Suc2: "0 \<notin> M \<Longrightarrow> card {k. Suc k \<in> M \<and> k < i} = card {k \<in> M. k < Suc i}"
    7.22 +apply (rule card_bij_eq [of "Suc" _ _ "\<lambda>x. x - 1"])
    7.23 +apply simp
    7.24 +apply fastsimp
    7.25 +apply auto
    7.26 +apply (rule inj_on_diff_nat)
    7.27 +apply auto
    7.28 +apply (case_tac x)
    7.29 +apply auto
    7.30 +apply (case_tac xa)
    7.31 +apply auto
    7.32 +apply (case_tac xa)
    7.33 +apply auto
    7.34 +apply (auto simp add: finite_M_bounded_by_nat)
    7.35 +done
    7.36 +
    7.37 +lemma card_less_Suc:
    7.38 +  assumes zero_in_M: "0 \<in> M"
    7.39 +    shows "Suc (card {k. Suc k \<in> M \<and> k < i}) = card {k \<in> M. k < Suc i}"
    7.40 +proof -
    7.41 +  from assms have a: "0 \<in> {k \<in> M. k < Suc i}" by simp
    7.42 +  hence c: "{k \<in> M. k < Suc i} = insert 0 ({k \<in> M. k < Suc i} - {0})"
    7.43 +    by (auto simp only: insert_Diff)
    7.44 +  have b: "{k \<in> M. k < Suc i} - {0} = {k \<in> M - {0}. k < Suc i}"  by auto
    7.45 +  from finite_M_bounded_by_nat[of "\<lambda>x. x \<in> M" "Suc i"] have "Suc (card {k. Suc k \<in> M \<and> k < i}) = card (insert 0 ({k \<in> M. k < Suc i} - {0}))"
    7.46 +    apply (subst card_insert)
    7.47 +    apply simp_all
    7.48 +    apply (subst b)
    7.49 +    apply (subst card_less_Suc2[symmetric])
    7.50 +    apply simp_all
    7.51 +    done
    7.52 +  with c show ?thesis by simp
    7.53 +qed
    7.54 +
    7.55  
    7.56  subsection {*Lemmas useful with the summation operator setsum*}
    7.57  
     8.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     8.2 +++ b/src/HOL/ex/ImperativeQuicksort.thy	Sat Jul 19 19:27:13 2008 +0200
     8.3 @@ -0,0 +1,622 @@
     8.4 +theory ImperativeQuickSort
     8.5 +imports Imperative_HOL Subarray Multiset
     8.6 +begin
     8.7 +
     8.8 +text {* We prove QuickSort correct in the Relational Calculus. *}
     8.9 +
    8.10 +
    8.11 +definition swap :: "nat array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> unit Heap"
    8.12 +where
    8.13 +  "swap arr i j = (
    8.14 +     do
    8.15 +       x \<leftarrow> nth arr i;
    8.16 +       y \<leftarrow> nth arr j;
    8.17 +       upd i y arr;
    8.18 +       upd j x arr;
    8.19 +       return ()
    8.20 +     done)"
    8.21 +
    8.22 +lemma swap_permutes:
    8.23 +  assumes "crel (swap a i j) h h' rs"
    8.24 +  shows "multiset_of (get_array a h') 
    8.25 +  = multiset_of (get_array a h)"
    8.26 +  using assms
    8.27 +  unfolding swap_def run_drop
    8.28 +  by (auto simp add: Heap.length_def multiset_of_swap dest: sym [of _ "h'"] elim!: crelE crel_nth crel_return crel_upd)
    8.29 +
    8.30 +function part1 :: "nat array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat Heap"
    8.31 +where
    8.32 +  "part1 a left right p = (
    8.33 +     if (right \<le> left) then return right
    8.34 +     else (do
    8.35 +       v \<leftarrow> nth a left;
    8.36 +       (if (v \<le> p) then (part1 a (left + 1) right p)
    8.37 +                    else (do swap a left right;
    8.38 +  part1 a left (right - 1) p done))
    8.39 +     done))"
    8.40 +by pat_completeness auto
    8.41 +
    8.42 +termination
    8.43 +by (relation "measure (\<lambda>(_,l,r,_). r - l )") auto
    8.44 +
    8.45 +declare part1.simps[simp del]
    8.46 +
    8.47 +lemma part_permutes:
    8.48 +  assumes "crel (part1 a l r p) h h' rs"
    8.49 +  shows "multiset_of (get_array a h') 
    8.50 +  = multiset_of (get_array a h)"
    8.51 +  using assms
    8.52 +proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
    8.53 +  case (1 a l r p h h' rs)
    8.54 +  thus ?case
    8.55 +    unfolding part1.simps [of a l r p] run_drop
    8.56 +    by (elim crelE crel_if crel_return crel_nth) (auto simp add: swap_permutes)
    8.57 +qed
    8.58 +
    8.59 +lemma part_returns_index_in_bounds:
    8.60 +  assumes "crel (part1 a l r p) h h' rs"
    8.61 +  assumes "l \<le> r"
    8.62 +  shows "l \<le> rs \<and> rs \<le> r"
    8.63 +using assms
    8.64 +proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
    8.65 +  case (1 a l r p h h' rs)
    8.66 +  note cr = `crel (part1 a l r p) h h' rs`
    8.67 +  show ?case
    8.68 +  proof (cases "r \<le> l")
    8.69 +    case True (* Terminating case *)
    8.70 +    with cr `l \<le> r` show ?thesis
    8.71 +      unfolding part1.simps[of a l r p] run_drop
    8.72 +      by (elim crelE crel_if crel_return crel_nth) auto
    8.73 +  next
    8.74 +    case False (* recursive case *)
    8.75 +    note rec_condition = this
    8.76 +    let ?v = "get_array a h ! l"
    8.77 +    show ?thesis
    8.78 +    proof (cases "?v \<le> p")
    8.79 +      case True
    8.80 +      with cr False
    8.81 +      have rec1: "crel (part1 a (l + 1) r p) h h' rs"
    8.82 +        unfolding part1.simps[of a l r p] run_drop
    8.83 +        by (elim crelE crel_nth crel_if crel_return) auto
    8.84 +      from rec_condition have "l + 1 \<le> r" by arith
    8.85 +      from 1(1)[OF rec_condition True rec1 `l + 1 \<le> r`]
    8.86 +      show ?thesis by simp
    8.87 +    next
    8.88 +      case False
    8.89 +      with rec_condition cr
    8.90 +      obtain h1 where swp: "crel (swap a l r) h h1 ()"
    8.91 +        and rec2: "crel (part1 a l (r - 1) p) h1 h' rs"
    8.92 +        unfolding part1.simps[of a l r p] run_drop
    8.93 +        by (elim crelE crel_nth crel_if crel_return) auto
    8.94 +      from rec_condition have "l \<le> r - 1" by arith
    8.95 +      from 1(2) [OF rec_condition False rec2 `l \<le> r - 1`] show ?thesis by fastsimp
    8.96 +    qed
    8.97 +  qed
    8.98 +qed
    8.99 +
   8.100 +lemma part_length_remains:
   8.101 +  assumes "crel (part1 a l r p) h h' rs"
   8.102 +  shows "Heap.length a h = Heap.length a h'"
   8.103 +using assms
   8.104 +proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
   8.105 +  case (1 a l r p h h' rs)
   8.106 +  note cr = `crel (part1 a l r p) h h' rs`
   8.107 +  
   8.108 +  show ?case
   8.109 +  proof (cases "r \<le> l")
   8.110 +    case True (* Terminating case *)
   8.111 +    with cr show ?thesis
   8.112 +      unfolding part1.simps[of a l r p] run_drop
   8.113 +      by (elim crelE crel_if crel_return crel_nth) auto
   8.114 +  next
   8.115 +    case False (* recursive case *)
   8.116 +    with cr 1 show ?thesis
   8.117 +      unfolding part1.simps [of a l r p] swap_def run_drop
   8.118 +      by (auto elim!: crelE crel_if crel_nth crel_return crel_upd) fastsimp
   8.119 +  qed
   8.120 +qed
   8.121 +
   8.122 +lemma part_outer_remains:
   8.123 +  assumes "crel (part1 a l r p) h h' rs"
   8.124 +  shows "\<forall>i. i < l \<or> r < i \<longrightarrow> get_array (a::nat array) h ! i = get_array a h' ! i"
   8.125 +  using assms
   8.126 +proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
   8.127 +  case (1 a l r p h h' rs)
   8.128 +  note cr = `crel (part1 a l r p) h h' rs`
   8.129 +  
   8.130 +  show ?case
   8.131 +  proof (cases "r \<le> l")
   8.132 +    case True (* Terminating case *)
   8.133 +    with cr show ?thesis
   8.134 +      unfolding part1.simps[of a l r p] run_drop
   8.135 +      by (elim crelE crel_if crel_return crel_nth) auto
   8.136 +  next
   8.137 +    case False (* recursive case *)
   8.138 +    note rec_condition = this
   8.139 +    let ?v = "get_array a h ! l"
   8.140 +    show ?thesis
   8.141 +    proof (cases "?v \<le> p")
   8.142 +      case True
   8.143 +      with cr False
   8.144 +      have rec1: "crel (part1 a (l + 1) r p) h h' rs"
   8.145 +        unfolding part1.simps[of a l r p] run_drop
   8.146 +        by (elim crelE crel_nth crel_if crel_return) auto
   8.147 +      from 1(1)[OF rec_condition True rec1]
   8.148 +      show ?thesis by fastsimp
   8.149 +    next
   8.150 +      case False
   8.151 +      with rec_condition cr
   8.152 +      obtain h1 where swp: "crel (swap a l r) h h1 ()"
   8.153 +        and rec2: "crel (part1 a l (r - 1) p) h1 h' rs"
   8.154 +        unfolding part1.simps[of a l r p] run_drop
   8.155 +        by (elim crelE crel_nth crel_if crel_return) auto
   8.156 +      from swp rec_condition have
   8.157 +	"\<forall>i. i < l \<or> r < i \<longrightarrow> get_array a h ! i = get_array a h1 ! i"
   8.158 +	unfolding swap_def run_drop
   8.159 +	by (elim crelE crel_nth crel_upd crel_return) auto
   8.160 +      with 1(2) [OF rec_condition False rec2] show ?thesis by fastsimp
   8.161 +    qed
   8.162 +  qed
   8.163 +qed
   8.164 +
   8.165 +
   8.166 +lemma part_partitions:
   8.167 +  assumes "crel (part1 a l r p) h h' rs"
   8.168 +  shows "(\<forall>i. l \<le> i \<and> i < rs \<longrightarrow> get_array (a::nat array) h' ! i \<le> p)
   8.169 +  \<and> (\<forall>i. rs < i \<and> i \<le> r \<longrightarrow> get_array a h' ! i \<ge> p)"
   8.170 +  using assms
   8.171 +proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
   8.172 +  case (1 a l r p h h' rs)
   8.173 +  note cr = `crel (part1 a l r p) h h' rs`
   8.174 +  
   8.175 +  show ?case
   8.176 +  proof (cases "r \<le> l")
   8.177 +    case True (* Terminating case *)
   8.178 +    with cr have "rs = r"
   8.179 +      unfolding part1.simps[of a l r p] run_drop
   8.180 +      by (elim crelE crel_if crel_return crel_nth) auto
   8.181 +    with True
   8.182 +    show ?thesis by auto
   8.183 +  next
   8.184 +    case False (* recursive case *)
   8.185 +    note lr = this
   8.186 +    let ?v = "get_array a h ! l"
   8.187 +    show ?thesis
   8.188 +    proof (cases "?v \<le> p")
   8.189 +      case True
   8.190 +      with lr cr
   8.191 +      have rec1: "crel (part1 a (l + 1) r p) h h' rs"
   8.192 +        unfolding part1.simps[of a l r p] run_drop
   8.193 +        by (elim crelE crel_nth crel_if crel_return) auto
   8.194 +      from True part_outer_remains[OF rec1] have a_l: "get_array a h' ! l \<le> p"
   8.195 +	by fastsimp
   8.196 +      have "\<forall>i. (l \<le> i = (l = i \<or> Suc l \<le> i))" by arith
   8.197 +      with 1(1)[OF False True rec1] a_l show ?thesis
   8.198 +	by auto
   8.199 +    next
   8.200 +      case False
   8.201 +      with lr cr
   8.202 +      obtain h1 where swp: "crel (swap a l r) h h1 ()"
   8.203 +        and rec2: "crel (part1 a l (r - 1) p) h1 h' rs"
   8.204 +        unfolding part1.simps[of a l r p] run_drop
   8.205 +        by (elim crelE crel_nth crel_if crel_return) auto
   8.206 +      from swp False have "get_array a h1 ! r \<ge> p"
   8.207 +	unfolding swap_def run_drop
   8.208 +	by (auto simp add: Heap.length_def elim!: crelE crel_nth crel_upd crel_return)
   8.209 +      with part_outer_remains [OF rec2] lr have a_r: "get_array a h' ! r \<ge> p"
   8.210 +	by fastsimp
   8.211 +      have "\<forall>i. (i \<le> r = (i = r \<or> i \<le> r - 1))" by arith
   8.212 +      with 1(2)[OF lr False rec2] a_r show ?thesis
   8.213 +	by auto
   8.214 +    qed
   8.215 +  qed
   8.216 +qed
   8.217 +
   8.218 +
   8.219 +fun partition :: "nat array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat Heap"
   8.220 +where
   8.221 +  "partition a left right = (do
   8.222 +     pivot \<leftarrow> nth a right;
   8.223 +     middle \<leftarrow> part1 a left (right - 1) pivot;
   8.224 +     v \<leftarrow> nth a middle;
   8.225 +     m \<leftarrow> return (if (v \<le> pivot) then (middle + 1) else middle);
   8.226 +     swap a m right;
   8.227 +     return m
   8.228 +   done)"
   8.229 +
   8.230 +declare partition.simps[simp del]
   8.231 +
   8.232 +lemma partition_permutes:
   8.233 +  assumes "crel (partition a l r) h h' rs"
   8.234 +  shows "multiset_of (get_array a h') 
   8.235 +  = multiset_of (get_array a h)"
   8.236 +proof -
   8.237 +    from assms part_permutes swap_permutes show ?thesis
   8.238 +      unfolding partition.simps run_drop
   8.239 +      by (elim crelE crel_return crel_nth crel_if crel_upd) auto
   8.240 +qed
   8.241 +
   8.242 +lemma partition_length_remains:
   8.243 +  assumes "crel (partition a l r) h h' rs"
   8.244 +  shows "Heap.length a h = Heap.length a h'"
   8.245 +proof -
   8.246 +  from assms part_length_remains show ?thesis
   8.247 +    unfolding partition.simps run_drop swap_def
   8.248 +    by (elim crelE crel_return crel_nth crel_if crel_upd) auto
   8.249 +qed
   8.250 +
   8.251 +lemma partition_outer_remains:
   8.252 +  assumes "crel (partition a l r) h h' rs"
   8.253 +  assumes "l < r"
   8.254 +  shows "\<forall>i. i < l \<or> r < i \<longrightarrow> get_array (a::nat array) h ! i = get_array a h' ! i"
   8.255 +proof -
   8.256 +  from assms part_outer_remains part_returns_index_in_bounds show ?thesis
   8.257 +    unfolding partition.simps swap_def run_drop
   8.258 +    by (elim crelE crel_return crel_nth crel_if crel_upd) fastsimp
   8.259 +qed
   8.260 +
   8.261 +lemma partition_returns_index_in_bounds:
   8.262 +  assumes crel: "crel (partition a l r) h h' rs"
   8.263 +  assumes "l < r"
   8.264 +  shows "l \<le> rs \<and> rs \<le> r"
   8.265 +proof -
   8.266 +  from crel obtain middle h'' p where part: "crel (part1 a l (r - 1) p) h h'' middle"
   8.267 +    and rs_equals: "rs = (if get_array a h'' ! middle \<le> get_array a h ! r then middle + 1
   8.268 +         else middle)"
   8.269 +    unfolding partition.simps run_drop
   8.270 +    by (elim crelE crel_return crel_nth crel_if crel_upd) simp
   8.271 +  from `l < r` have "l \<le> r - 1" by arith
   8.272 +  from part_returns_index_in_bounds[OF part this] rs_equals `l < r` show ?thesis by auto
   8.273 +qed
   8.274 +
   8.275 +lemma partition_partitions:
   8.276 +  assumes crel: "crel (partition a l r) h h' rs"
   8.277 +  assumes "l < r"
   8.278 +  shows "(\<forall>i. l \<le> i \<and> i < rs \<longrightarrow> get_array (a::nat array) h' ! i \<le> get_array a h' ! rs) \<and>
   8.279 +  (\<forall>i. rs < i \<and> i \<le> r \<longrightarrow> get_array a h' ! rs \<le> get_array a h' ! i)"
   8.280 +proof -
   8.281 +  let ?pivot = "get_array a h ! r" 
   8.282 +  from crel obtain middle h1 where part: "crel (part1 a l (r - 1) ?pivot) h h1 middle"
   8.283 +    and swap: "crel (swap a rs r) h1 h' ()"
   8.284 +    and rs_equals: "rs = (if get_array a h1 ! middle \<le> ?pivot then middle + 1
   8.285 +         else middle)"
   8.286 +    unfolding partition.simps run_drop
   8.287 +    by (elim crelE crel_return crel_nth crel_if crel_upd) simp
   8.288 +  from swap have h'_def: "h' = Heap.upd a r (get_array a h1 ! rs)
   8.289 +    (Heap.upd a rs (get_array a h1 ! r) h1)"
   8.290 +    unfolding swap_def run_drop
   8.291 +    by (elim crelE crel_return crel_nth crel_upd) simp
   8.292 +  from swap have in_bounds: "r < Heap.length a h1 \<and> rs < Heap.length a h1"
   8.293 +    unfolding swap_def run_drop
   8.294 +    by (elim crelE crel_return crel_nth crel_upd) simp
   8.295 +  from swap have swap_length_remains: "Heap.length a h1 = Heap.length a h'"
   8.296 +    unfolding swap_def run_drop by (elim crelE crel_return crel_nth crel_upd) auto
   8.297 +  from `l < r` have "l \<le> r - 1" by simp 
   8.298 +  note middle_in_bounds = part_returns_index_in_bounds[OF part this]
   8.299 +  from part_outer_remains[OF part] `l < r`
   8.300 +  have "get_array a h ! r = get_array a h1 ! r"
   8.301 +    by fastsimp
   8.302 +  with swap
   8.303 +  have right_remains: "get_array a h ! r = get_array a h' ! rs"
   8.304 +    unfolding swap_def run_drop
   8.305 +    by (auto simp add: Heap.length_def elim!: crelE crel_return crel_nth crel_upd) (cases "r = rs", auto)
   8.306 +  from part_partitions [OF part]
   8.307 +  show ?thesis
   8.308 +  proof (cases "get_array a h1 ! middle \<le> ?pivot")
   8.309 +    case True
   8.310 +    with rs_equals have rs_equals: "rs = middle + 1" by simp
   8.311 +    { 
   8.312 +      fix i
   8.313 +      assume i_is_left: "l \<le> i \<and> i < rs"
   8.314 +      with swap_length_remains in_bounds middle_in_bounds rs_equals `l < r`
   8.315 +      have i_props: "i < Heap.length a h'" "i \<noteq> r" "i \<noteq> rs" by auto
   8.316 +      from i_is_left rs_equals have "l \<le> i \<and> i < middle \<or> i = middle" by arith
   8.317 +      with part_partitions[OF part] right_remains True
   8.318 +      have "get_array a h1 ! i \<le> get_array a h' ! rs" by fastsimp
   8.319 +      with i_props h'_def in_bounds have "get_array a h' ! i \<le> get_array a h' ! rs"
   8.320 +	unfolding Heap.upd_def Heap.length_def by simp
   8.321 +    }
   8.322 +    moreover
   8.323 +    {
   8.324 +      fix i
   8.325 +      assume "rs < i \<and> i \<le> r"
   8.326 +
   8.327 +      hence "(rs < i \<and> i \<le> r - 1) \<or> (rs < i \<and> i = r)" by arith
   8.328 +      hence "get_array a h' ! rs \<le> get_array a h' ! i"
   8.329 +      proof
   8.330 +	assume i_is: "rs < i \<and> i \<le> r - 1"
   8.331 +	with swap_length_remains in_bounds middle_in_bounds rs_equals
   8.332 +	have i_props: "i < Heap.length a h'" "i \<noteq> r" "i \<noteq> rs" by auto
   8.333 +	from part_partitions[OF part] rs_equals right_remains i_is
   8.334 +	have "get_array a h' ! rs \<le> get_array a h1 ! i"
   8.335 +	  by fastsimp
   8.336 +	with i_props h'_def show ?thesis by fastsimp
   8.337 +      next
   8.338 +	assume i_is: "rs < i \<and> i = r"
   8.339 +	with rs_equals have "Suc middle \<noteq> r" by arith
   8.340 +	with middle_in_bounds `l < r` have "Suc middle \<le> r - 1" by arith
   8.341 +	with part_partitions[OF part] right_remains 
   8.342 +	have "get_array a h' ! rs \<le> get_array a h1 ! (Suc middle)"
   8.343 +	  by fastsimp
   8.344 +	with i_is True rs_equals right_remains h'_def
   8.345 +	show ?thesis using in_bounds
   8.346 +	  unfolding Heap.upd_def Heap.length_def
   8.347 +	  by auto
   8.348 +      qed
   8.349 +    }
   8.350 +    ultimately show ?thesis by auto
   8.351 +  next
   8.352 +    case False
   8.353 +    with rs_equals have rs_equals: "middle = rs" by simp
   8.354 +    { 
   8.355 +      fix i
   8.356 +      assume i_is_left: "l \<le> i \<and> i < rs"
   8.357 +      with swap_length_remains in_bounds middle_in_bounds rs_equals
   8.358 +      have i_props: "i < Heap.length a h'" "i \<noteq> r" "i \<noteq> rs" by auto
   8.359 +      from part_partitions[OF part] rs_equals right_remains i_is_left
   8.360 +      have "get_array a h1 ! i \<le> get_array a h' ! rs" by fastsimp
   8.361 +      with i_props h'_def have "get_array a h' ! i \<le> get_array a h' ! rs"
   8.362 +	unfolding Heap.upd_def by simp
   8.363 +    }
   8.364 +    moreover
   8.365 +    {
   8.366 +      fix i
   8.367 +      assume "rs < i \<and> i \<le> r"
   8.368 +      hence "(rs < i \<and> i \<le> r - 1) \<or> i = r" by arith
   8.369 +      hence "get_array a h' ! rs \<le> get_array a h' ! i"
   8.370 +      proof
   8.371 +	assume i_is: "rs < i \<and> i \<le> r - 1"
   8.372 +	with swap_length_remains in_bounds middle_in_bounds rs_equals
   8.373 +	have i_props: "i < Heap.length a h'" "i \<noteq> r" "i \<noteq> rs" by auto
   8.374 +	from part_partitions[OF part] rs_equals right_remains i_is
   8.375 +	have "get_array a h' ! rs \<le> get_array a h1 ! i"
   8.376 +	  by fastsimp
   8.377 +	with i_props h'_def show ?thesis by fastsimp
   8.378 +      next
   8.379 +	assume i_is: "i = r"
   8.380 +	from i_is False rs_equals right_remains h'_def
   8.381 +	show ?thesis using in_bounds
   8.382 +	  unfolding Heap.upd_def Heap.length_def
   8.383 +	  by auto
   8.384 +      qed
   8.385 +    }
   8.386 +    ultimately
   8.387 +    show ?thesis by auto
   8.388 +  qed
   8.389 +qed
   8.390 +
   8.391 +
   8.392 +function quicksort :: "nat array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> unit Heap"
   8.393 +where
   8.394 +  "quicksort arr left right =
   8.395 +     (if (right > left)  then
   8.396 +        do
   8.397 +          pivotNewIndex \<leftarrow> partition arr left right;
   8.398 +          pivotNewIndex \<leftarrow> assert (\<lambda>x. left \<le> x \<and> x \<le> right) pivotNewIndex;
   8.399 +          quicksort arr left (pivotNewIndex - 1);
   8.400 +          quicksort arr (pivotNewIndex + 1) right
   8.401 +        done
   8.402 +     else return ())"
   8.403 +by pat_completeness auto
   8.404 +
   8.405 +(* For termination, we must show that the pivotNewIndex is between left and right *) 
   8.406 +termination
   8.407 +by (relation "measure (\<lambda>(a, l, r). (r - l))") auto
   8.408 +
   8.409 +declare quicksort.simps[simp del]
   8.410 +
   8.411 +
   8.412 +lemma quicksort_permutes:
   8.413 +  assumes "crel (quicksort a l r) h h' rs"
   8.414 +  shows "multiset_of (get_array a h') 
   8.415 +  = multiset_of (get_array a h)"
   8.416 +  using assms
   8.417 +proof (induct a l r arbitrary: h h' rs rule: quicksort.induct)
   8.418 +  case (1 a l r h h' rs)
   8.419 +  with partition_permutes show ?case
   8.420 +    unfolding quicksort.simps [of a l r] run_drop
   8.421 +    by (elim crel_if crelE crel_assert crel_return) auto
   8.422 +qed
   8.423 +
   8.424 +lemma length_remains:
   8.425 +  assumes "crel (quicksort a l r) h h' rs"
   8.426 +  shows "Heap.length a h = Heap.length a h'"
   8.427 +using assms
   8.428 +proof (induct a l r arbitrary: h h' rs rule: quicksort.induct)
   8.429 +  case (1 a l r h h' rs)
   8.430 +  with partition_length_remains show ?case
   8.431 +    unfolding quicksort.simps [of a l r] run_drop
   8.432 +    by (elim crel_if crelE crel_assert crel_return) auto
   8.433 +qed
   8.434 +
   8.435 +lemma quicksort_outer_remains:
   8.436 +  assumes "crel (quicksort a l r) h h' rs"
   8.437 +   shows "\<forall>i. i < l \<or> r < i \<longrightarrow> get_array (a::nat array) h ! i = get_array a h' ! i"
   8.438 +  using assms
   8.439 +proof (induct a l r arbitrary: h h' rs rule: quicksort.induct)
   8.440 +  case (1 a l r h h' rs)
   8.441 +  note cr = `crel (quicksort a l r) h h' rs`
   8.442 +  thus ?case
   8.443 +  proof (cases "r > l")
   8.444 +    case False
   8.445 +    with cr have "h' = h"
   8.446 +      unfolding quicksort.simps [of a l r]
   8.447 +      by (elim crel_if crel_return) auto
   8.448 +    thus ?thesis by simp
   8.449 +  next
   8.450 +  case True
   8.451 +   { 
   8.452 +      fix h1 h2 p ret1 ret2 i
   8.453 +      assume part: "crel (partition a l r) h h1 p"
   8.454 +      assume qs1: "crel (quicksort a l (p - 1)) h1 h2 ret1"
   8.455 +      assume qs2: "crel (quicksort a (p + 1) r) h2 h' ret2"
   8.456 +      assume pivot: "l \<le> p \<and> p \<le> r"
   8.457 +      assume i_outer: "i < l \<or> r < i"
   8.458 +      from  partition_outer_remains [OF part True] i_outer
   8.459 +      have "get_array a h !i = get_array a h1 ! i" by fastsimp
   8.460 +      moreover
   8.461 +      with 1(1) [OF True pivot qs1] pivot i_outer
   8.462 +      have "get_array a h1 ! i = get_array a h2 ! i" by auto
   8.463 +      moreover
   8.464 +      with qs2 1(2) [of p h2 h' ret2] True pivot i_outer
   8.465 +      have "get_array a h2 ! i = get_array a h' ! i" by auto
   8.466 +      ultimately have "get_array a h ! i= get_array a h' ! i" by simp
   8.467 +    }
   8.468 +    with cr show ?thesis
   8.469 +      unfolding quicksort.simps [of a l r] run_drop
   8.470 +      by (elim crel_if crelE crel_assert crel_return) auto
   8.471 +  qed
   8.472 +qed
   8.473 +
   8.474 +lemma quicksort_is_skip:
   8.475 +  assumes "crel (quicksort a l r) h h' rs"
   8.476 +  shows "r \<le> l \<longrightarrow> h = h'"
   8.477 +  using assms
   8.478 +  unfolding quicksort.simps [of a l r] run_drop
   8.479 +  by (elim crel_if crel_return) auto
   8.480 + 
   8.481 +lemma quicksort_sorts:
   8.482 +  assumes "crel (quicksort a l r) h h' rs"
   8.483 +  assumes l_r_length: "l < Heap.length a h" "r < Heap.length a h" 
   8.484 +  shows "sorted (subarray l (r + 1) a h')"
   8.485 +  using assms
   8.486 +proof (induct a l r arbitrary: h h' rs rule: quicksort.induct)
   8.487 +  case (1 a l r h h' rs)
   8.488 +  note cr = `crel (quicksort a l r) h h' rs`
   8.489 +  thus ?case
   8.490 +  proof (cases "r > l")
   8.491 +    case False
   8.492 +    hence "l \<ge> r + 1 \<or> l = r" by arith 
   8.493 +    with length_remains[OF cr] 1(5) show ?thesis
   8.494 +      by (auto simp add: subarray_Nil subarray_single)
   8.495 +  next
   8.496 +    case True
   8.497 +    { 
   8.498 +      fix h1 h2 p
   8.499 +      assume part: "crel (partition a l r) h h1 p"
   8.500 +      assume qs1: "crel (quicksort a l (p - 1)) h1 h2 ()"
   8.501 +      assume qs2: "crel (quicksort a (p + 1) r) h2 h' ()"
   8.502 +      from partition_returns_index_in_bounds [OF part True]
   8.503 +      have pivot: "l\<le> p \<and> p \<le> r" .
   8.504 +     note length_remains = length_remains[OF qs2] length_remains[OF qs1] partition_length_remains[OF part]
   8.505 +      from quicksort_outer_remains [OF qs2] quicksort_outer_remains [OF qs1] pivot quicksort_is_skip[OF qs1]
   8.506 +      have pivot_unchanged: "get_array a h1 ! p = get_array a h' ! p" by (cases p, auto)
   8.507 +	(*-- First of all, by induction hypothesis both sublists are sorted. *)
   8.508 +      from 1(1)[OF True pivot qs1] length_remains pivot 1(5) 
   8.509 +      have IH1: "sorted (subarray l p a h2)"  by (cases p, auto simp add: subarray_Nil)
   8.510 +      from quicksort_outer_remains [OF qs2] length_remains
   8.511 +      have left_subarray_remains: "subarray l p a h2 = subarray l p a h'"
   8.512 +	by (simp add: subarray_eq_samelength_iff)
   8.513 +      with IH1 have IH1': "sorted (subarray l p a h')" by simp
   8.514 +      from 1(2)[OF True pivot qs2] pivot 1(5) length_remains
   8.515 +      have IH2: "sorted (subarray (p + 1) (r + 1) a h')"
   8.516 +	by (cases "Suc p \<le> r", auto simp add: subarray_Nil)
   8.517 +	  (* -- Secondly, both sublists remain partitioned. *)
   8.518 +      from partition_partitions[OF part True]
   8.519 +      have part_conds1: "\<forall>j. j \<in> set (subarray l p a h1) \<longrightarrow> j \<le> get_array a h1 ! p "
   8.520 +	and part_conds2: "\<forall>j. j \<in> set (subarray (p + 1) (r + 1) a h1) \<longrightarrow> get_array a h1 ! p \<le> j"
   8.521 +	by (auto simp add: all_in_set_subarray_conv)
   8.522 +      from quicksort_outer_remains [OF qs1] quicksort_permutes [OF qs1] True
   8.523 +	length_remains 1(5) pivot multiset_of_sublist [of l p "get_array a h1" "get_array a h2"]
   8.524 +      have multiset_partconds1: "multiset_of (subarray l p a h2) = multiset_of (subarray l p a h1)"
   8.525 +	unfolding Heap.length_def subarray_def by (cases p, auto)
   8.526 +      with left_subarray_remains part_conds1 pivot_unchanged
   8.527 +      have part_conds2': "\<forall>j. j \<in> set (subarray l p a h') \<longrightarrow> j \<le> get_array a h' ! p"
   8.528 +	by (simp, subst set_of_multiset_of[symmetric], simp)
   8.529 +	  (* -- These steps are the analogous for the right sublist \<dots> *)
   8.530 +      from quicksort_outer_remains [OF qs1] length_remains
   8.531 +      have right_subarray_remains: "subarray (p + 1) (r + 1) a h1 = subarray (p + 1) (r + 1) a h2"
   8.532 +	by (auto simp add: subarray_eq_samelength_iff)
   8.533 +      from quicksort_outer_remains [OF qs2] quicksort_permutes [OF qs2] True
   8.534 +	length_remains 1(5) pivot multiset_of_sublist [of "p + 1" "r + 1" "get_array a h2" "get_array a h'"]
   8.535 +      have multiset_partconds2: "multiset_of (subarray (p + 1) (r + 1) a h') = multiset_of (subarray (p + 1) (r + 1) a h2)"
   8.536 +	unfolding Heap.length_def subarray_def by auto
   8.537 +      with right_subarray_remains part_conds2 pivot_unchanged
   8.538 +      have part_conds1': "\<forall>j. j \<in> set (subarray (p + 1) (r + 1) a h') \<longrightarrow> get_array a h' ! p \<le> j"
   8.539 +	by (simp, subst set_of_multiset_of[symmetric], simp)
   8.540 +	  (* -- Thirdly and finally, we show that the array is sorted
   8.541 +	  following from the facts above. *)
   8.542 +      from True pivot 1(5) length_remains have "subarray l (r + 1) a h' = subarray l p a h' @ [get_array a h' ! p] @ subarray (p + 1) (r + 1) a h'"
   8.543 +	by (simp add: subarray_nth_array_Cons, cases "l < p") (auto simp add: subarray_append subarray_Nil)
   8.544 +      with IH1' IH2 part_conds1' part_conds2' pivot have ?thesis
   8.545 +	unfolding subarray_def
   8.546 +	apply (auto simp add: sorted_append sorted_Cons all_in_set_sublist'_conv)
   8.547 +	by (auto simp add: set_sublist' dest: le_trans [of _ "get_array a h' ! p"])
   8.548 +    }
   8.549 +    with True cr show ?thesis
   8.550 +      unfolding quicksort.simps [of a l r] run_drop
   8.551 +      by (elim crel_if crel_return crelE crel_assert) auto
   8.552 +  qed
   8.553 +qed
   8.554 +
   8.555 +
   8.556 +lemma quicksort_is_sort:
   8.557 +  assumes crel: "crel (quicksort a 0 (Heap.length a h - 1)) h h' rs"
   8.558 +  shows "get_array a h' = sort (get_array a h)"
   8.559 +proof (cases "get_array a h = []")
   8.560 +  case True
   8.561 +  with quicksort_is_skip[OF crel] show ?thesis
   8.562 +  unfolding Heap.length_def by simp
   8.563 +next
   8.564 +  case False
   8.565 +  from quicksort_sorts [OF crel] False have "sorted (sublist' 0 (List.length (get_array a h)) (get_array a h'))"
   8.566 +    unfolding Heap.length_def subarray_def by auto
   8.567 +  with length_remains[OF crel] have "sorted (get_array a h')"
   8.568 +    unfolding Heap.length_def by simp
   8.569 +  with quicksort_permutes [OF crel] properties_for_sort show ?thesis by fastsimp
   8.570 +qed
   8.571 +
   8.572 +subsection {* No Errors in quicksort *}
   8.573 +text {* We have proved that quicksort sorts (if no exceptions occur).
   8.574 +We will now show that exceptions do not occur. *}
   8.575 +
   8.576 +lemma noError_part1: 
   8.577 +  assumes "l < Heap.length a h" "r < Heap.length a h"
   8.578 +  shows "noError (part1 a l r p) h"
   8.579 +  using assms
   8.580 +proof (induct a l r p arbitrary: h rule: part1.induct)
   8.581 +  case (1 a l r p)
   8.582 +  thus ?case
   8.583 +    unfolding part1.simps [of a l r] swap_def run_drop
   8.584 +    by (auto intro!: noError_if noErrorI noError_return noError_nth noError_upd elim!: crelE crel_upd crel_nth crel_return)
   8.585 +qed
   8.586 +
   8.587 +lemma noError_partition:
   8.588 +  assumes "l < r" "l < Heap.length a h" "r < Heap.length a h"
   8.589 +  shows "noError (partition a l r) h"
   8.590 +using assms
   8.591 +unfolding partition.simps swap_def run_drop
   8.592 +apply (auto intro!: noError_if noErrorI noError_return noError_nth noError_upd noError_part1 elim!: crelE crel_upd crel_nth crel_return)
   8.593 +apply (frule part_length_remains)
   8.594 +apply (frule part_returns_index_in_bounds)
   8.595 +apply auto
   8.596 +apply (frule part_length_remains)
   8.597 +apply (frule part_returns_index_in_bounds)
   8.598 +apply auto
   8.599 +apply (frule part_length_remains)
   8.600 +apply auto
   8.601 +done
   8.602 +
   8.603 +lemma noError_quicksort:
   8.604 +  assumes "l < Heap.length a h" "r < Heap.length a h"
   8.605 +  shows "noError (quicksort a l r) h"
   8.606 +using assms
   8.607 +proof (induct a l r arbitrary: h rule: quicksort.induct)
   8.608 +  case (1 a l ri h)
   8.609 +  thus ?case
   8.610 +    unfolding quicksort.simps [of a l ri] run_drop
   8.611 +    apply (auto intro!: noError_if noErrorI noError_return noError_nth noError_upd noError_assert noError_partition)
   8.612 +    apply (frule partition_returns_index_in_bounds)
   8.613 +    apply auto
   8.614 +    apply (frule partition_returns_index_in_bounds)
   8.615 +    apply auto
   8.616 +    apply (auto elim!: crel_assert dest!: partition_length_remains length_remains)
   8.617 +    apply (subgoal_tac "Suc r \<le> ri \<or> r = ri") 
   8.618 +    apply (erule disjE)
   8.619 +    apply auto
   8.620 +    unfolding quicksort.simps [of a "Suc ri" ri] run_drop
   8.621 +    apply (auto intro!: noError_if noError_return)
   8.622 +    done
   8.623 +qed
   8.624 +
   8.625 +end
   8.626 \ No newline at end of file