(* halting case *)

definition

  Hoare :: "assert \<Rightarrow> tprog0 \<Rightarrow> assert \<Rightarrow> bool" ("({(1_)}/ (_)/ {(1_)})" [50, 49] 50)

where

  "{P} p {Q} \<equiv> 

     (\<forall>tp. P tp \<longrightarrow> (\<exists>n. is_final (steps0 (1, tp) p n) \<and> Q holds_for (steps0 (1, tp) p n)))"

(* not halting case *)

definition

  Hoare_unhalt :: "assert \<Rightarrow> tprog0 \<Rightarrow> bool" ("({(1_)}/ (_)) \<up>" [50, 49] 50)

where

  "{P} p \<up> \<equiv> (\<forall>tp. P tp \<longrightarrow> (\<forall> n . \<not> (is_final (steps0 (1, tp) p n))))"

lemma HoareI:

  assumes "\<And>l r. P (l, r) \<Longrightarrow> \<exists>n. is_final (steps0 (1, (l, r)) p n) \<and> Q holds_for (steps0 (1, (l, r)) p n)"

  shows "{P} p {Q}"

unfolding Hoare_def 

using assms by auto

lemma Hoare_unhalt_I:

  assumes "\<And>l r n. P (l, r) \<Longrightarrow> \<not> is_final (steps0 (1, (l, r)) p n)"

  shows "{P} p \<up>"

unfolding Hoare_unhalt_def 

using assms by auto

  shows "Q holds_for (steps c p n) = Q holds_for c"

  assumes a_imp: "Q1 \<mapsto> P2"

  then obtain n1 l' r' 

    where "is_final (steps0 (1, l, r) A n1)"  

      and a1: "Q1 holds_for (steps0 (1, l, r) A n1)"

      and a2: "steps0 (1, l, r) A n1 = (0, l', r')"

    using A_halt unfolding Hoare_def

    by (metis is_final_eq surj_pair) 

  then obtain n2 

    where "steps0 (1, l, r) (A |+| B) n2 = (Suc (length A div 2), l', r')"

    using A_wf by (rule_tac tm_comp_pre_halt_same) 

  from a1 a2 a_imp have "P2 (l', r')" by (simp add: assert_imp_def)

  then obtain n3 l'' r''

    where "is_final (steps0 (1, l', r') B n3)" 

    and b1: "Q2 holds_for (steps0 (1, l', r') B n3)"

    and b2: "steps0 (1, l', r') B n3 = (0, l'', r'')"

    using B_halt unfolding Hoare_def 

    by (metis is_final_eq surj_pair) 

  then have "steps0 (Suc (length A div 2), l', r')  (A |+| B) n3 = (0, l'', r'')"

    using A_wf by (rule_tac t_merge_second_halt_same) 

    using b1 b2 by (rule_tac x = "n2 + n3" in exI) (simp)

text {*

  {P1} A {Q1}   {P2} B loops    Q1 \<mapsto> P2   A well-formed

  ------------------------------------------------------

          {P1} A |+| B  loops

*}

  assumes a_imp: "Q1 \<mapsto> P2"

  and B_uhalt : "{P2} B \<up>"

  shows "{P1} (A |+| B) \<up>"

  fix n l r 

  then obtain n1 l' r'

    where a: "is_final (steps0 (1, l, r) A n1)" 

    and b: "Q1 holds_for (steps0 (1, l, r) A n1)"

    and c: "steps0 (1, l, r) A n1 = (0, l', r')"

    using A_halt unfolding Hoare_def 

    by (metis is_final_eq surj_pair) 

  then obtain n2 where eq: "steps0 (1, l, r) (A |+| B) n2 = (Suc (length A div 2), l', r')"

    using A_wf by (rule_tac tm_comp_pre_halt_same)

  then show "\<not> is_final (steps0 (1, l, r) (A |+| B) n)"

  proof(cases "n2 \<le> n")

    case True

    from b c a_imp have "P2 (l', r')" by (simp add: assert_imp_def)

    then have "\<forall> n. \<not> is_final (steps0 (1, l', r') B n)  "

      using B_uhalt unfolding Hoare_unhalt_def by simp

    then have "\<not> is_final (steps0 (Suc 0, l', r') B (n - n2))" by auto

    then obtain s'' l'' r'' 

      where "steps0 (Suc 0, l', r') B (n - n2) = (s'', l'', r'')" 

      and "\<not> is_final (s'', l'', r'')" by (metis surj_pair)

    then have "steps0 (Suc (length A div 2), l', r') (A |+| B) (n - n2) = (s''+ length A div 2, l'', r'')"

      using A_wf by (auto dest: t_merge_second_same simp del: steps.simps)

    then have "\<not> is_final (steps0 (1, l, r) (A |+| B) (n2 + (n  - n2)))"

      using A_wf by (simp only: steps_add eq) (simp add: tm_wf.simps)

    then show "\<not> is_final (steps0 (1, l, r) (A |+| B) n)" 

      using `n2 \<le> n` by simp

  next 

    case False

    then obtain n3 where "n = n2 - n3"

      by (metis diff_le_self le_imp_diff_is_add nat_add_commute nat_le_linear)

    moreover

    with eq show "\<not> is_final (steps0 (1, l, r) (A |+| B) n)"

      by (simp add: not_is_final[where ?n1.0="n2"])

by (metis holds_for.simps surj_pair)

declare step.simps[simp del]

declare steps.simps[simp del]

declare tm_comp.simps [simp del] adjust.simps[simp del] shift.simps[simp del]

declare tm_wf.simps[simp del]