|
25
|
1 |
header {*
|
|
|
2 |
Separation logic for TM
|
|
|
3 |
*}
|
|
|
4 |
|
|
|
5 |
theory Hoare_tm
|
|
|
6 |
imports Hoare_tm_basis My_block Data_slot
|
|
|
7 |
begin
|
|
|
8 |
|
|
|
9 |
|
|
|
10 |
section {* Aux lemmas *}
|
|
|
11 |
|
|
|
12 |
lemma int_add_C :"x + (y::int) = y + x"
|
|
|
13 |
by simp
|
|
|
14 |
|
|
|
15 |
lemma int_add_A : "(x + y) + z = x + (y + (z::int))"
|
|
|
16 |
by simp
|
|
|
17 |
|
|
|
18 |
lemma int_add_LC: "x + (y + (z::int)) = y + (x + z)"
|
|
|
19 |
by simp
|
|
|
20 |
|
|
|
21 |
lemmas int_add_ac = int_add_A int_add_C int_add_LC
|
|
|
22 |
|
|
|
23 |
method_setup prune = {* Scan.succeed (SIMPLE_METHOD' o (K (K prune_params_tac))) *}
|
|
|
24 |
"pruning parameters"
|
|
|
25 |
|
|
|
26 |
ML {*
|
|
|
27 |
structure StepRules = Named_Thms
|
|
|
28 |
(val name = @{binding "step"}
|
|
|
29 |
val description = "Theorems for hoare rules for every step")
|
|
|
30 |
*}
|
|
|
31 |
|
|
|
32 |
ML {*
|
|
|
33 |
structure FwdRules = Named_Thms
|
|
|
34 |
(val name = @{binding "fwd"}
|
|
|
35 |
val description = "Theorems for fwd derivation of seperation implication")
|
|
|
36 |
*}
|
|
|
37 |
|
|
|
38 |
setup {* StepRules.setup *}
|
|
|
39 |
|
|
|
40 |
setup {* FwdRules.setup *}
|
|
|
41 |
|
|
|
42 |
section {* Operational Semantics of TM *}
|
|
|
43 |
|
|
|
44 |
type_synonym tconf = "nat \<times> (nat \<rightharpoonup> tm_inst) \<times> nat \<times> int \<times> (int \<rightharpoonup> Block)"
|
|
|
45 |
|
|
|
46 |
fun next_tape :: "taction \<Rightarrow> (int \<times> (int \<rightharpoonup> Block)) \<Rightarrow> (int \<times> (int \<rightharpoonup> Block))"
|
|
|
47 |
where "next_tape W0 (pos, m) = (pos, m(pos \<mapsto> Bk))" |
|
|
|
48 |
"next_tape W1 (pos, m) = (pos, m(pos \<mapsto> Oc))" |
|
|
|
49 |
"next_tape L (pos, m) = (pos - 1, m)" |
|
|
|
50 |
"next_tape R (pos, m) = (pos + 1, m)"
|
|
|
51 |
|
|
|
52 |
fun tstep :: "tconf \<Rightarrow> tconf"
|
|
|
53 |
where "tstep (faults, prog, pc, pos, m) =
|
|
|
54 |
(case (prog pc) of
|
|
|
55 |
Some ((action0, St pc0), (action1, St pc1)) \<Rightarrow>
|
|
|
56 |
case (m pos) of
|
|
|
57 |
Some Bk \<Rightarrow> (faults, prog, pc0, next_tape action0 (pos, m)) |
|
|
|
58 |
Some Oc \<Rightarrow> (faults, prog, pc1, next_tape action1 (pos, m)) |
|
|
|
59 |
None \<Rightarrow> (faults + 1, prog, pc, pos, m)
|
|
|
60 |
| None \<Rightarrow> (faults + 1, prog, pc, pos, m))"
|
|
|
61 |
|
|
|
62 |
(* lemma tstep_splits:
|
|
|
63 |
"(P (tstep s)) = ((\<forall> faults prog pc pos m action0 pc0 action1 pc1.
|
|
|
64 |
s = (faults, prog, pc, pos, m) \<longrightarrow>
|
|
|
65 |
prog pc = Some ((action0, pc0), (action1, pc1)) \<longrightarrow>
|
|
|
66 |
m pos = Some Bk \<longrightarrow> P (faults, prog, pc0, next_tape action0 (pos, m))) \<and>
|
|
|
67 |
(\<forall> faults prog pc pos m action0 pc0 action1 pc1.
|
|
|
68 |
s = (faults, prog, pc, pos, m) \<longrightarrow>
|
|
|
69 |
prog pc = Some ((action0, pc0), (action1, pc1)) \<longrightarrow>
|
|
|
70 |
m pos = Some Oc \<longrightarrow> P (faults, prog, pc1, next_tape action1 (pos, m))) \<and>
|
|
|
71 |
(\<forall> faults prog pc pos m action0 pc0 action1 pc1.
|
|
|
72 |
s = (faults, prog, pc, pos, m) \<longrightarrow>
|
|
|
73 |
prog pc = Some ((action0, pc0), (action1, pc1)) \<longrightarrow>
|
|
|
74 |
m pos = None \<longrightarrow> P (faults + 1, prog, pc, pos, m)) \<and>
|
|
|
75 |
(\<forall> faults prog pc pos m .
|
|
|
76 |
s = (faults, prog, pc, pos, m) \<longrightarrow>
|
|
|
77 |
prog pc = None \<longrightarrow> P (faults + 1, prog, pc, pos, m))
|
|
|
78 |
)"
|
|
|
79 |
apply (case_tac s, auto split:option.splits Block.splits)
|
|
|
80 |
*)
|
|
|
81 |
|
|
|
82 |
definition "tprog_set prog = {TC i inst | i inst. prog i = Some inst}"
|
|
|
83 |
definition "tpc_set pc = {TAt pc}"
|
|
|
84 |
definition "tmem_set m = {TM i n | i n. m (i) = Some n}"
|
|
|
85 |
definition "tpos_set pos = {TPos pos}"
|
|
|
86 |
definition "tfaults_set faults = {TFaults faults}"
|
|
|
87 |
|
|
|
88 |
lemmas tpn_set_def = tprog_set_def tpc_set_def tmem_set_def tfaults_set_def tpos_set_def
|
|
|
89 |
|
|
|
90 |
fun trset_of :: "tconf \<Rightarrow> tresource set"
|
|
|
91 |
where "trset_of (faults, prog, pc, pos, m) =
|
|
|
92 |
tprog_set prog \<union> tpc_set pc \<union> tpos_set pos \<union> tmem_set m \<union> tfaults_set faults"
|
|
|
93 |
|
|
|
94 |
interpretation tm: sep_exec tstep trset_of .
|
|
|
95 |
|
|
|
96 |
section {* Hoare logic for TM *}
|
|
|
97 |
|
|
|
98 |
abbreviation t_hoare ::
|
|
|
99 |
"tassert \<Rightarrow> tassert \<Rightarrow> tassert \<Rightarrow> bool" ("(\<lbrace>(1_)\<rbrace> / (_)/ \<lbrace>(1_)\<rbrace>)" 50)
|
|
|
100 |
where "\<lbrace> p \<rbrace> c \<lbrace> q \<rbrace> == sep_exec.Hoare_gen tstep trset_of p c q"
|
|
|
101 |
|
|
|
102 |
abbreviation it_hoare ::
|
|
|
103 |
"(('a::sep_algebra) \<Rightarrow> tresource set \<Rightarrow> bool) \<Rightarrow>
|
|
|
104 |
('a \<Rightarrow> bool) \<Rightarrow> (tresource set \<Rightarrow> bool) \<Rightarrow> ('a \<Rightarrow> bool) \<Rightarrow> bool"
|
|
|
105 |
("(1_).(\<lbrace>(1_)\<rbrace> / (_)/ \<lbrace>(1_)\<rbrace>)" 50)
|
|
|
106 |
where "I. \<lbrace>P\<rbrace> c \<lbrace>Q\<rbrace> == sep_exec.IHoare tstep trset_of I P c Q"
|
|
|
107 |
|
|
|
108 |
(*
|
|
|
109 |
primrec tpg_len :: "tpg \<Rightarrow> nat" where
|
|
|
110 |
"tpg_len (TInstr ai) = 1" |
|
|
|
111 |
"tpg_len (TSeq p1 p2) = tpg_len p1 + tpg_len " |
|
|
|
112 |
"tpg_len (TLocal fp) = tpg_len (fp 0)" |
|
|
|
113 |
"tpg_len (TLabel l) = 0" *)
|
|
|
114 |
|
|
|
115 |
lemma tpg_fold_sg: "tpg_fold [tpg] = tpg"
|
|
|
116 |
by (simp add:tpg_fold_def)
|
|
|
117 |
|
|
|
118 |
lemma tpg_fold_cons:
|
|
|
119 |
assumes h: "tpgs \<noteq> []"
|
|
|
120 |
shows "tpg_fold (tpg#tpgs) = (tpg; (tpg_fold tpgs))"
|
|
|
121 |
using h
|
|
|
122 |
proof(induct tpgs arbitrary:tpg)
|
|
|
123 |
case (Cons tpg1 tpgs1)
|
|
|
124 |
thus ?case
|
|
|
125 |
proof(cases "tpgs1 = []")
|
|
|
126 |
case True
|
|
|
127 |
thus ?thesis by (simp add:tpg_fold_def)
|
|
|
128 |
next
|
|
|
129 |
case False
|
|
|
130 |
show ?thesis
|
|
|
131 |
proof -
|
|
|
132 |
have eq_1: "butlast (tpg # tpg1 # tpgs1) = tpg # (butlast (tpg1 # tpgs1))"
|
|
|
133 |
by simp
|
|
|
134 |
from False have eq_2: "last (tpg # tpg1 # tpgs1) = last (tpg1 # tpgs1)"
|
|
|
135 |
by simp
|
|
|
136 |
have eq_3: "foldr (op ;) (tpg # butlast (tpg1 # tpgs1)) (last (tpg1 # tpgs1)) =
|
|
|
137 |
(tpg ; (foldr (op ;) (butlast (tpg1 # tpgs1)) (last (tpg1 # tpgs1))))"
|
|
|
138 |
by simp
|
|
|
139 |
show ?thesis
|
|
|
140 |
apply (subst (1) tpg_fold_def, unfold eq_1 eq_2 eq_3)
|
|
|
141 |
by (fold tpg_fold_def, simp)
|
|
|
142 |
qed
|
|
|
143 |
qed
|
|
|
144 |
qed auto
|
|
|
145 |
|
|
|
146 |
lemmas tpg_fold_simps = tpg_fold_sg tpg_fold_cons
|
|
|
147 |
|
|
|
148 |
lemma tpg_fold_app:
|
|
|
149 |
assumes h1: "tpgs1 \<noteq> []"
|
|
|
150 |
and h2: "tpgs2 \<noteq> []"
|
|
|
151 |
shows "i:[(tpg_fold (tpgs1 @ tpgs2))]:j = i:[(tpg_fold (tpgs1); tpg_fold tpgs2)]:j"
|
|
|
152 |
using h1 h2
|
|
|
153 |
proof(induct tpgs1 arbitrary: i j tpgs2)
|
|
|
154 |
case (Cons tpg1' tpgs1')
|
|
|
155 |
thus ?case (is "?L = ?R")
|
|
|
156 |
proof(cases "tpgs1' = []")
|
|
|
157 |
case False
|
|
|
158 |
from h2 have "(tpgs1' @ tpgs2) \<noteq> []"
|
|
|
159 |
by (metis Cons.prems(2) Nil_is_append_conv)
|
|
|
160 |
have "?L = (i :[ tpg_fold (tpg1' # (tpgs1' @ tpgs2)) ]: j )" by simp
|
|
|
161 |
also have "\<dots> = (i:[(tpg1'; (tpg_fold (tpgs1' @ tpgs2)))]:j )"
|
|
|
162 |
by (simp add:tpg_fold_cons[OF `(tpgs1' @ tpgs2) \<noteq> []`])
|
|
|
163 |
also have "\<dots> = ?R"
|
|
|
164 |
proof -
|
|
|
165 |
have "(EXS j'. i :[ tpg1' ]: j' \<and>* j' :[ tpg_fold (tpgs1' @ tpgs2) ]: j) =
|
|
|
166 |
(EXS j'. (EXS j'a. i :[ tpg1' ]: j'a \<and>* j'a :[ tpg_fold tpgs1' ]: j') \<and>*
|
|
|
167 |
j' :[ tpg_fold tpgs2 ]: j)"
|
|
|
168 |
proof(default+)
|
|
|
169 |
fix s
|
|
|
170 |
assume "(EXS j'. i :[ tpg1' ]: j' \<and>* j' :[ tpg_fold (tpgs1' @ tpgs2) ]: j) s"
|
|
|
171 |
thus "(EXS j'. (EXS j'a. i :[ tpg1' ]: j'a \<and>* j'a :[ tpg_fold tpgs1' ]: j') \<and>*
|
|
|
172 |
j' :[ tpg_fold tpgs2 ]: j) s"
|
|
|
173 |
proof(elim EXS_elim)
|
|
|
174 |
fix j'
|
|
|
175 |
assume "(i :[ tpg1' ]: j' \<and>* j' :[ tpg_fold (tpgs1' @ tpgs2) ]: j) s"
|
|
|
176 |
from this[unfolded Cons(1)[OF False Cons(3)] tassemble_to.simps]
|
|
|
177 |
show "(EXS j'. (EXS j'a. i :[ tpg1' ]: j'a \<and>* j'a :[ tpg_fold tpgs1' ]: j') \<and>*
|
|
|
178 |
j' :[ tpg_fold tpgs2 ]: j) s"
|
|
|
179 |
proof(elim sep_conjE EXS_elim)
|
|
|
180 |
fix x y j'a xa ya
|
|
|
181 |
assume h: "(i :[ tpg1' ]: j') x"
|
|
|
182 |
"x ## y" "s = x + y"
|
|
|
183 |
"(j' :[ tpg_fold tpgs1' ]: j'a) xa"
|
|
|
184 |
"(j'a :[ tpg_fold tpgs2 ]: j) ya"
|
|
|
185 |
" xa ## ya" "y = xa + ya"
|
|
|
186 |
show "(EXS j'. (EXS j'a. i :[ tpg1' ]: j'a \<and>*
|
|
|
187 |
j'a :[ tpg_fold tpgs1' ]: j') \<and>* j' :[ tpg_fold tpgs2 ]: j) s"
|
|
|
188 |
(is "(EXS j'. (?P j' \<and>* ?Q j')) s")
|
|
|
189 |
proof(rule EXS_intro[where x = "j'a"])
|
|
|
190 |
from `(j'a :[ tpg_fold tpgs2 ]: j) ya` have "(?Q j'a) ya" .
|
|
|
191 |
moreover have "(?P j'a) (x + xa)"
|
|
|
192 |
proof(rule EXS_intro[where x = j'])
|
|
|
193 |
have "x + xa = x + xa" by simp
|
|
|
194 |
moreover from `x ## y` `y = xa + ya` `xa ## ya`
|
|
|
195 |
have "x ## xa" by (metis sep_disj_addD)
|
|
|
196 |
moreover note `(i :[ tpg1' ]: j') x` `(j' :[ tpg_fold tpgs1' ]: j'a) xa`
|
|
|
197 |
ultimately show "(i :[ tpg1' ]: j' \<and>* j' :[ tpg_fold tpgs1' ]: j'a) (x + xa)"
|
|
|
198 |
by (auto intro!:sep_conjI)
|
|
|
199 |
qed
|
|
|
200 |
moreover from `x##y` `y = xa + ya` `xa ## ya`
|
|
|
201 |
have "(x + xa) ## ya"
|
|
|
202 |
by (metis sep_disj_addI1 sep_disj_commuteI)
|
|
|
203 |
moreover from `s = x + y` `y = xa + ya`
|
|
|
204 |
have "s = (x + xa) + ya"
|
|
|
205 |
by (metis h(2) h(6) sep_add_assoc sep_disj_addD1 sep_disj_addD2)
|
|
|
206 |
ultimately show "(?P j'a \<and>* ?Q j'a) s"
|
|
|
207 |
by (auto intro!:sep_conjI)
|
|
|
208 |
qed
|
|
|
209 |
qed
|
|
|
210 |
qed
|
|
|
211 |
next
|
|
|
212 |
fix s
|
|
|
213 |
assume "(EXS j'. (EXS j'a. i :[ tpg1' ]: j'a \<and>* j'a :[ tpg_fold tpgs1' ]: j') \<and>*
|
|
|
214 |
j' :[ tpg_fold tpgs2 ]: j) s"
|
|
|
215 |
thus "(EXS j'. i :[ tpg1' ]: j' \<and>* j' :[ tpg_fold (tpgs1' @ tpgs2) ]: j) s"
|
|
|
216 |
proof(elim EXS_elim sep_conjE)
|
|
|
217 |
fix j' x y j'a xa ya
|
|
|
218 |
assume h: "(j' :[ tpg_fold tpgs2 ]: j) y"
|
|
|
219 |
"x ## y" "s = x + y" "(i :[ tpg1' ]: j'a) xa"
|
|
|
220 |
"(j'a :[ tpg_fold tpgs1' ]: j') ya" "xa ## ya" "x = xa + ya"
|
|
|
221 |
show "(EXS j'. i :[ tpg1' ]: j' \<and>* j' :[ tpg_fold (tpgs1' @ tpgs2) ]: j) s"
|
|
|
222 |
proof(rule EXS_intro[where x = j'a])
|
|
|
223 |
from `(i :[ tpg1' ]: j'a) xa` have "(i :[ tpg1' ]: j'a) xa" .
|
|
|
224 |
moreover have "(j'a :[ tpg_fold (tpgs1' @ tpgs2) ]: j) (ya + y)"
|
|
|
225 |
proof(unfold Cons(1)[OF False Cons(3)] tassemble_to.simps)
|
|
|
226 |
show "(EXS j'. j'a :[ tpg_fold tpgs1' ]: j' \<and>* j' :[ tpg_fold tpgs2 ]: j) (ya + y)"
|
|
|
227 |
proof(rule EXS_intro[where x = "j'"])
|
|
|
228 |
from `x ## y` `x = xa + ya` `xa ## ya`
|
|
|
229 |
have "ya ## y" by (metis sep_add_disjD)
|
|
|
230 |
moreover have "ya + y = ya + y" by simp
|
|
|
231 |
moreover note `(j'a :[ tpg_fold tpgs1' ]: j') ya`
|
|
|
232 |
`(j' :[ tpg_fold tpgs2 ]: j) y`
|
|
|
233 |
ultimately show "(j'a :[ tpg_fold tpgs1' ]: j' \<and>*
|
|
|
234 |
j' :[ tpg_fold tpgs2 ]: j) (ya + y)"
|
|
|
235 |
by (auto intro!:sep_conjI)
|
|
|
236 |
qed
|
|
|
237 |
qed
|
|
|
238 |
moreover from `s = x + y` `x = xa + ya`
|
|
|
239 |
have "s = xa + (ya + y)"
|
|
|
240 |
by (metis h(2) h(6) sep_add_assoc sep_add_disjD)
|
|
|
241 |
moreover from `xa ## ya` `x ## y` `x = xa + ya`
|
|
|
242 |
have "xa ## (ya + y)" by (metis sep_disj_addI3)
|
|
|
243 |
ultimately show "(i :[ tpg1' ]: j'a \<and>* j'a :[ tpg_fold (tpgs1' @ tpgs2) ]: j) s"
|
|
|
244 |
by (auto intro!:sep_conjI)
|
|
|
245 |
qed
|
|
|
246 |
qed
|
|
|
247 |
qed
|
|
|
248 |
thus ?thesis
|
|
|
249 |
by (simp add:tassemble_to.simps, unfold tpg_fold_cons[OF False],
|
|
|
250 |
unfold tassemble_to.simps, simp)
|
|
|
251 |
qed
|
|
|
252 |
finally show ?thesis .
|
|
|
253 |
next
|
|
|
254 |
case True
|
|
|
255 |
thus ?thesis
|
|
|
256 |
by (simp add:tpg_fold_cons[OF Cons(3)] tpg_fold_sg)
|
|
|
257 |
qed
|
|
|
258 |
qed auto
|
|
|
259 |
|
|
|
260 |
|
|
|
261 |
subsection {* Assertions and program logic for this assembly language *}
|
|
|
262 |
|
|
|
263 |
definition "st l = sg (tpc_set l)"
|
|
|
264 |
definition "ps p = sg (tpos_set p)"
|
|
|
265 |
definition "tm a v =sg ({TM a v})"
|
|
|
266 |
definition "one i = tm i Oc"
|
|
|
267 |
definition "zero i= tm i Bk"
|
|
|
268 |
definition "any i = (EXS v. tm i v)"
|
|
|
269 |
|
|
|
270 |
declare trset_of.simps[simp del]
|
|
|
271 |
|
|
|
272 |
lemma stimes_sgD: "(sg x ** q) s \<Longrightarrow> q (s - x) \<and> x \<subseteq> s"
|
|
|
273 |
apply(erule_tac sep_conjE)
|
|
|
274 |
apply(unfold set_ins_def sg_def)
|
|
|
275 |
by (metis Diff_Int2 Diff_Int_distrib2 Diff_Un Diff_cancel
|
|
|
276 |
Diff_empty Diff_idemp Diff_triv Int_Diff Un_Diff
|
|
|
277 |
Un_Diff_cancel inf_commute inf_idem sup_bot_right sup_commute sup_ge2)
|
|
|
278 |
|
|
|
279 |
lemma stD: "(st i ** r) (trset_of (ft, prog, i', pos, mem))
|
|
|
280 |
\<Longrightarrow> i' = i"
|
|
|
281 |
proof -
|
|
|
282 |
assume "(st i ** r) (trset_of (ft, prog, i', pos, mem))"
|
|
|
283 |
from stimes_sgD [OF this[unfolded st_def], unfolded trset_of.simps]
|
|
|
284 |
have "tpc_set i \<subseteq> tprog_set prog \<union> tpc_set i' \<union> tpos_set pos \<union>
|
|
|
285 |
tmem_set mem \<union> tfaults_set ft" by auto
|
|
|
286 |
thus ?thesis
|
|
|
287 |
by (unfold tpn_set_def, auto)
|
|
|
288 |
qed
|
|
|
289 |
|
|
|
290 |
lemma psD: "(ps p ** r) (trset_of (ft, prog, i', pos, mem))
|
|
|
291 |
\<Longrightarrow> pos = p"
|
|
|
292 |
proof -
|
|
|
293 |
assume "(ps p ** r) (trset_of (ft, prog, i', pos, mem))"
|
|
|
294 |
from stimes_sgD [OF this[unfolded ps_def], unfolded trset_of.simps]
|
|
|
295 |
have "tpos_set p \<subseteq> tprog_set prog \<union> tpc_set i' \<union>
|
|
|
296 |
tpos_set pos \<union> tmem_set mem \<union> tfaults_set ft"
|
|
|
297 |
by simp
|
|
|
298 |
thus ?thesis
|
|
|
299 |
by (unfold tpn_set_def, auto)
|
|
|
300 |
qed
|
|
|
301 |
|
|
|
302 |
lemma codeD: "(st i ** sg {TC i inst} ** r) (trset_of (ft, prog, i', pos, mem))
|
|
|
303 |
\<Longrightarrow> prog i = Some inst"
|
|
|
304 |
proof -
|
|
|
305 |
assume "(st i ** sg {TC i inst} ** r) (trset_of (ft, prog, i', pos, mem))"
|
|
|
306 |
thus ?thesis
|
|
|
307 |
apply(unfold sep_conj_def set_ins_def sg_def trset_of.simps tpn_set_def)
|
|
|
308 |
by auto
|
|
|
309 |
qed
|
|
|
310 |
|
|
|
311 |
lemma memD: "((tm a v) ** r) (trset_of (ft, prog, i, pos, mem)) \<Longrightarrow> mem a = Some v"
|
|
|
312 |
proof -
|
|
|
313 |
assume "((tm a v) ** r) (trset_of (ft, prog, i, pos, mem))"
|
|
|
314 |
from stimes_sgD[OF this[unfolded trset_of.simps tpn_set_def tm_def]]
|
|
|
315 |
have "{TM a v} \<subseteq> {TC i inst |i inst. prog i = Some inst} \<union> {TAt i} \<union>
|
|
|
316 |
{TPos pos} \<union> {TM i n |i n. mem i = Some n} \<union> {TFaults ft}" by simp
|
|
|
317 |
thus ?thesis by auto
|
|
|
318 |
qed
|
|
|
319 |
|
|
|
320 |
lemma t_hoare_seq:
|
|
|
321 |
"\<lbrakk>\<And> i j. \<lbrace>st i ** p\<rbrace> i:[c1]:j \<lbrace>st j ** q\<rbrace>;
|
|
|
322 |
\<And> j k. \<lbrace>st j ** q\<rbrace> j:[c2]:k \<lbrace>st k ** r\<rbrace>\<rbrakk> \<Longrightarrow> \<lbrace>st i ** p\<rbrace> i:[(c1 ; c2)]:k \<lbrace>st k ** r\<rbrace>"
|
|
|
323 |
proof -
|
|
|
324 |
assume h: "\<And> i j. \<lbrace>st i ** p\<rbrace> i:[c1]:j \<lbrace>st j ** q\<rbrace>"
|
|
|
325 |
"\<And> j k. \<lbrace>st j ** q\<rbrace> j:[c2]:k \<lbrace>st k ** r\<rbrace>"
|
|
|
326 |
show "\<lbrace>st i ** p\<rbrace> i:[(c1 ; c2)]:k \<lbrace>st k ** r\<rbrace>"
|
|
|
327 |
proof(subst tassemble_to.simps, rule tm.code_exI)
|
|
|
328 |
fix j'
|
|
|
329 |
show "\<lbrace>st i \<and>* p\<rbrace> i :[ c1 ]: j' \<and>* j' :[ c2 ]: k \<lbrace>st k \<and>* r\<rbrace>"
|
|
|
330 |
proof(rule tm.composition)
|
|
|
331 |
from h(1) show "\<lbrace>st i \<and>* p\<rbrace> i :[ c1 ]: j' \<lbrace> st j' \<and>* q \<rbrace>" by auto
|
|
|
332 |
next
|
|
|
333 |
from h(2) show "\<lbrace>st j' \<and>* q\<rbrace> j' :[ c2 ]: k \<lbrace>st k \<and>* r\<rbrace>" by auto
|
|
|
334 |
qed
|
|
|
335 |
qed
|
|
|
336 |
qed
|
|
|
337 |
|
|
|
338 |
lemma t_hoare_seq1:
|
|
|
339 |
"\<lbrakk>\<And>j'. \<lbrace>st i ** p\<rbrace> i:[c1]:j' \<lbrace>st j' ** q\<rbrace>;
|
|
|
340 |
\<And>j'. \<lbrace>st j' ** q\<rbrace> j':[c2]:k \<lbrace>st k' ** r\<rbrace>\<rbrakk> \<Longrightarrow>
|
|
|
341 |
\<lbrace>st i ** p\<rbrace> i:[(c1 ; c2)]:k \<lbrace>st k' ** r\<rbrace>"
|
|
|
342 |
proof -
|
|
|
343 |
assume h: "\<And>j'. \<lbrace>st i \<and>* p\<rbrace> i :[ c1 ]: j' \<lbrace>st j' \<and>* q\<rbrace>"
|
|
|
344 |
"\<And>j'. \<lbrace>st j' \<and>* q\<rbrace> j' :[ c2 ]: k \<lbrace>st k' \<and>* r\<rbrace>"
|
|
|
345 |
show "\<lbrace>st i \<and>* p\<rbrace> i :[ (c1 ; c2) ]: k \<lbrace>st k' \<and>* r\<rbrace>"
|
|
|
346 |
proof(subst tassemble_to.simps, rule tm.code_exI)
|
|
|
347 |
fix j'
|
|
|
348 |
show "\<lbrace>st i \<and>* p\<rbrace> i :[ c1 ]: j' \<and>* j' :[ c2 ]: k \<lbrace>st k' \<and>* r\<rbrace>"
|
|
|
349 |
proof(rule tm.composition)
|
|
|
350 |
from h(1) show "\<lbrace>st i \<and>* p\<rbrace> i :[ c1 ]: j' \<lbrace> st j' \<and>* q \<rbrace>" by auto
|
|
|
351 |
next
|
|
|
352 |
from h(2) show " \<lbrace>st j' \<and>* q\<rbrace> j' :[ c2 ]: k \<lbrace>st k' \<and>* r\<rbrace>" by auto
|
|
|
353 |
qed
|
|
|
354 |
qed
|
|
|
355 |
qed
|
|
|
356 |
|
|
|
357 |
lemma t_hoare_seq2:
|
|
|
358 |
assumes h: "\<And>j. \<lbrace>st i ** p\<rbrace> i:[c1]:j \<lbrace>st k' \<and>* r\<rbrace>"
|
|
|
359 |
shows "\<lbrace>st i ** p\<rbrace> i:[(c1 ; c2)]:j \<lbrace>st k' ** r\<rbrace>"
|
|
|
360 |
apply (unfold tassemble_to.simps, rule tm.code_exI)
|
|
|
361 |
by (rule tm.code_extension, rule h)
|
|
|
362 |
|
|
|
363 |
lemma t_hoare_local:
|
|
|
364 |
assumes h: "(\<And> (l::nat). \<lbrace>st i \<and>* p\<rbrace> i :[ c l ]: j \<lbrace>st k \<and>* q\<rbrace>)"
|
|
|
365 |
shows "\<lbrace>st i ** p\<rbrace> i:[TLocal c]:j \<lbrace>st k ** q\<rbrace>" using h
|
|
|
366 |
by (unfold tassemble_to.simps, intro tm.code_exI, case_tac l, simp)
|
|
|
367 |
|
|
|
368 |
lemma t_hoare_label:
|
|
|
369 |
"(\<And>l. (l::nat) = i \<Longrightarrow> \<lbrace>st l \<and>* p\<rbrace> l :[ c (l::tstate) ]: j \<lbrace>st k \<and>* q\<rbrace>) \<Longrightarrow>
|
|
|
370 |
\<lbrace>st i \<and>* p \<rbrace>
|
|
|
371 |
i:[(TLabel l; c l)]:j
|
|
|
372 |
\<lbrace>st k \<and>* q\<rbrace>"
|
|
|
373 |
by (cases l, unfold tassemble_to.simps, intro tm.code_exI tm.code_condI, clarify, auto)
|
|
|
374 |
|
|
|
375 |
primrec t_split_cmd :: "tpg \<Rightarrow> (tpg \<times> tpg option)"
|
|
|
376 |
where "t_split_cmd (\<guillemotright>inst) = (\<guillemotright>inst, None)" |
|
|
|
377 |
"t_split_cmd (TLabel l) = (TLabel l, None)" |
|
|
|
378 |
"t_split_cmd (TSeq c1 c2) = (case (t_split_cmd c2) of
|
|
|
379 |
(c21, Some c22) \<Rightarrow> (TSeq c1 c21, Some c22) |
|
|
|
380 |
(c21, None) \<Rightarrow> (c1, Some c21))" |
|
|
|
381 |
"t_split_cmd (TLocal c) = (TLocal c, None)"
|
|
|
382 |
|
|
|
383 |
definition "t_last_cmd tpg = (snd (t_split_cmd tpg))"
|
|
|
384 |
|
|
|
385 |
declare t_last_cmd_def [simp]
|
|
|
386 |
|
|
|
387 |
definition "t_blast_cmd tpg = (fst (t_split_cmd tpg))"
|
|
|
388 |
|
|
|
389 |
declare t_blast_cmd_def [simp]
|
|
|
390 |
|
|
|
391 |
lemma "t_last_cmd (c1; c2; (TLabel l)) = (Some (TLabel l))"
|
|
|
392 |
by simp
|
|
|
393 |
|
|
|
394 |
lemma "t_blast_cmd (c1; c2; TLabel l) = (c1; c2)"
|
|
|
395 |
by simp
|
|
|
396 |
|
|
|
397 |
lemma t_split_cmd_eq:
|
|
|
398 |
assumes "t_split_cmd c = (c1, Some c2)"
|
|
|
399 |
shows "(i:[c]:j) = (i:[(c1; c2)]:j)"
|
|
|
400 |
using assms
|
|
|
401 |
proof(induct c arbitrary: c1 c2 i j)
|
|
|
402 |
case (TSeq cx cy)
|
|
|
403 |
from `t_split_cmd (cx ; cy) = (c1, Some c2)`
|
|
|
404 |
show ?case
|
|
|
405 |
apply (simp split:prod.splits option.splits)
|
|
|
406 |
apply (cases cy, auto split:prod.splits option.splits)
|
|
|
407 |
proof -
|
|
|
408 |
fix a
|
|
|
409 |
assume h: "t_split_cmd cy = (a, Some c2)"
|
|
|
410 |
show "i :[ (cx ; cy) ]: j = i :[ ((cx ; a) ; c2) ]: j"
|
|
|
411 |
apply (simp only: tassemble_to.simps(2) TSeq(2)[OF h] sep_conj_exists)
|
|
|
412 |
apply (simp add:sep_conj_ac)
|
|
|
413 |
by (simp add:pred_ex_def, default, auto)
|
|
|
414 |
qed
|
|
|
415 |
qed auto
|
|
|
416 |
|
|
|
417 |
lemma t_hoare_label_last_pre:
|
|
|
418 |
fixes l
|
|
|
419 |
assumes h1: "t_split_cmd c = (c', Some (TLabel l))"
|
|
|
420 |
and h2: "l = j \<Longrightarrow> \<lbrace>p\<rbrace> i:[c']:j \<lbrace>q\<rbrace>"
|
|
|
421 |
shows "\<lbrace>p\<rbrace> i:[c]:j \<lbrace>q\<rbrace>"
|
|
|
422 |
by (cases l, unfold t_split_cmd_eq[OF h1],
|
|
|
423 |
simp only:tassemble_to.simps sep_conj_cond,
|
|
|
424 |
intro tm.code_exI tm.code_condI, insert h2, auto)
|
|
|
425 |
|
|
|
426 |
lemma t_hoare_label_last:
|
|
|
427 |
fixes l
|
|
|
428 |
assumes h1: "t_last_cmd c = Some (TLabel l)"
|
|
|
429 |
and h2: "l = j \<Longrightarrow> \<lbrace>p\<rbrace> i:[t_blast_cmd c]:j \<lbrace>q\<rbrace>"
|
|
|
430 |
shows "\<lbrace>p\<rbrace> i:[c]:j \<lbrace>q\<rbrace>"
|
|
|
431 |
proof -
|
|
|
432 |
have "t_split_cmd c = (t_blast_cmd c, t_last_cmd c)"
|
|
|
433 |
by simp
|
|
|
434 |
from t_hoare_label_last_pre[OF this[unfolded h1]] h2
|
|
|
435 |
show ?thesis by auto
|
|
|
436 |
qed
|
|
|
437 |
|
|
|
438 |
subsection {* Basic assertions for TM *}
|
|
|
439 |
|
|
|
440 |
function ones :: "int \<Rightarrow> int \<Rightarrow> tassert" where
|
|
|
441 |
"ones i j = (if j < i then <(i = j + 1)> else
|
|
|
442 |
(one i) ** ones (i + 1) j)"
|
|
|
443 |
by auto
|
|
|
444 |
termination by (relation "measure(\<lambda> (i::int, j). nat (j - i + 1))") auto
|
|
|
445 |
|
|
|
446 |
lemma ones_base_simp: "j < i \<Longrightarrow> ones i j = <(i = j + 1)>"
|
|
|
447 |
by simp
|
|
|
448 |
|
|
|
449 |
lemma ones_step_simp: "\<not> j < i \<Longrightarrow> ones i j = ((one i) ** ones (i + 1) j)"
|
|
|
450 |
by simp
|
|
|
451 |
|
|
|
452 |
lemmas ones_simps = ones_base_simp ones_step_simp
|
|
|
453 |
|
|
|
454 |
declare ones.simps [simp del] ones_simps [simp]
|
|
|
455 |
|
|
|
456 |
lemma ones_induct [case_names Base Step]:
|
|
|
457 |
fixes P i j
|
|
|
458 |
assumes h1: "\<And> i j. j < i \<Longrightarrow> P i j (<(i = j + (1::int))>)"
|
|
|
459 |
and h2: "\<And> i j. \<lbrakk>\<not> j < i; P (i + 1) j (ones (i + 1) j)\<rbrakk> \<Longrightarrow> P i j ((one i) ** ones (i + 1) j)"
|
|
|
460 |
shows "P i j (ones i j)"
|
|
|
461 |
proof(induct i j rule:ones.induct)
|
|
|
462 |
fix i j
|
|
|
463 |
assume ih: "(\<not> j < i \<Longrightarrow> P (i + 1) j (ones (i + 1) j))"
|
|
|
464 |
show "P i j (ones i j)"
|
|
|
465 |
proof(cases "j < i")
|
|
|
466 |
case True
|
|
|
467 |
with h1 [OF True]
|
|
|
468 |
show ?thesis by auto
|
|
|
469 |
next
|
|
|
470 |
case False
|
|
|
471 |
from h2 [OF False] and ih[OF False]
|
|
|
472 |
have "P i j (one i \<and>* ones (i + 1) j)" by blast
|
|
|
473 |
with False show ?thesis by auto
|
|
|
474 |
qed
|
|
|
475 |
qed
|
|
|
476 |
|
|
|
477 |
function ones' :: "int \<Rightarrow> int \<Rightarrow> tassert" where
|
|
|
478 |
"ones' i j = (if j < i then <(i = j + 1)> else
|
|
|
479 |
ones' i (j - 1) ** one j)"
|
|
|
480 |
by auto
|
|
|
481 |
termination by (relation "measure(\<lambda> (i::int, j). nat (j - i + 1))") auto
|
|
|
482 |
|
|
|
483 |
lemma ones_rev: "\<not> j < i \<Longrightarrow> (ones i j) = ((ones i (j - 1)) ** one j)"
|
|
|
484 |
proof(induct i j rule:ones_induct)
|
|
|
485 |
case Base
|
|
|
486 |
thus ?case by auto
|
|
|
487 |
next
|
|
|
488 |
case (Step i j)
|
|
|
489 |
show ?case
|
|
|
490 |
proof(cases "j < i + 1")
|
|
|
491 |
case True
|
|
|
492 |
with Step show ?thesis
|
|
|
493 |
by simp
|
|
|
494 |
next
|
|
|
495 |
case False
|
|
|
496 |
with Step show ?thesis
|
|
|
497 |
by (auto simp:sep_conj_ac)
|
|
|
498 |
qed
|
|
|
499 |
qed
|
|
|
500 |
|
|
|
501 |
lemma ones_rev_induct [case_names Base Step]:
|
|
|
502 |
fixes P i j
|
|
|
503 |
assumes h1: "\<And> i j. j < i \<Longrightarrow> P i j (<(i = j + (1::int))>)"
|
|
|
504 |
and h2: "\<And> i j. \<lbrakk>\<not> j < i; P i (j - 1) (ones i (j - 1))\<rbrakk> \<Longrightarrow> P i j ((ones i (j - 1)) ** one j)"
|
|
|
505 |
shows "P i j (ones i j)"
|
|
|
506 |
proof(induct i j rule:ones'.induct)
|
|
|
507 |
fix i j
|
|
|
508 |
assume ih: "(\<not> j < i \<Longrightarrow> P i (j - 1) (ones i (j - 1)))"
|
|
|
509 |
show "P i j (ones i j)"
|
|
|
510 |
proof(cases "j < i")
|
|
|
511 |
case True
|
|
|
512 |
with h1 [OF True]
|
|
|
513 |
show ?thesis by auto
|
|
|
514 |
next
|
|
|
515 |
case False
|
|
|
516 |
from h2 [OF False] and ih[OF False]
|
|
|
517 |
have "P i j (ones i (j - 1) \<and>* one j)" by blast
|
|
|
518 |
with ones_rev and False
|
|
|
519 |
show ?thesis
|
|
|
520 |
by simp
|
|
|
521 |
qed
|
|
|
522 |
qed
|
|
|
523 |
|
|
|
524 |
function zeros :: "int \<Rightarrow> int \<Rightarrow> tassert" where
|
|
|
525 |
"zeros i j = (if j < i then <(i = j + 1)> else
|
|
|
526 |
(zero i) ** zeros (i + 1) j)"
|
|
|
527 |
by auto
|
|
|
528 |
termination by (relation "measure(\<lambda> (i::int, j). nat (j - i + 1))") auto
|
|
|
529 |
|
|
|
530 |
lemma zeros_base_simp: "j < i \<Longrightarrow> zeros i j = <(i = j + 1)>"
|
|
|
531 |
by simp
|
|
|
532 |
|
|
|
533 |
lemma zeros_step_simp: "\<not> j < i \<Longrightarrow> zeros i j = ((zero i) ** zeros (i + 1) j)"
|
|
|
534 |
by simp
|
|
|
535 |
|
|
|
536 |
declare zeros.simps [simp del]
|
|
|
537 |
lemmas zeros_simps [simp] = zeros_base_simp zeros_step_simp
|
|
|
538 |
|
|
|
539 |
lemma zeros_induct [case_names Base Step]:
|
|
|
540 |
fixes P i j
|
|
|
541 |
assumes h1: "\<And> i j. j < i \<Longrightarrow> P i j (<(i = j + (1::int))>)"
|
|
|
542 |
and h2: "\<And> i j. \<lbrakk>\<not> j < i; P (i + 1) j (zeros (i + 1) j)\<rbrakk> \<Longrightarrow>
|
|
|
543 |
P i j ((zero i) ** zeros (i + 1) j)"
|
|
|
544 |
shows "P i j (zeros i j)"
|
|
|
545 |
proof(induct i j rule:zeros.induct)
|
|
|
546 |
fix i j
|
|
|
547 |
assume ih: "(\<not> j < i \<Longrightarrow> P (i + 1) j (zeros (i + 1) j))"
|
|
|
548 |
show "P i j (zeros i j)"
|
|
|
549 |
proof(cases "j < i")
|
|
|
550 |
case True
|
|
|
551 |
with h1 [OF True]
|
|
|
552 |
show ?thesis by auto
|
|
|
553 |
next
|
|
|
554 |
case False
|
|
|
555 |
from h2 [OF False] and ih[OF False]
|
|
|
556 |
have "P i j (zero i \<and>* zeros (i + 1) j)" by blast
|
|
|
557 |
with False show ?thesis by auto
|
|
|
558 |
qed
|
|
|
559 |
qed
|
|
|
560 |
|
|
|
561 |
lemma zeros_rev: "\<not> j < i \<Longrightarrow> (zeros i j) = ((zeros i (j - 1)) ** zero j)"
|
|
|
562 |
proof(induct i j rule:zeros_induct)
|
|
|
563 |
case (Base i j)
|
|
|
564 |
thus ?case by auto
|
|
|
565 |
next
|
|
|
566 |
case (Step i j)
|
|
|
567 |
show ?case
|
|
|
568 |
proof(cases "j < i + 1")
|
|
|
569 |
case True
|
|
|
570 |
with Step show ?thesis by auto
|
|
|
571 |
next
|
|
|
572 |
case False
|
|
|
573 |
with Step show ?thesis by (auto simp:sep_conj_ac)
|
|
|
574 |
qed
|
|
|
575 |
qed
|
|
|
576 |
|
|
|
577 |
lemma zeros_rev_induct [case_names Base Step]:
|
|
|
578 |
fixes P i j
|
|
|
579 |
assumes h1: "\<And> i j. j < i \<Longrightarrow> P i j (<(i = j + (1::int))>)"
|
|
|
580 |
and h2: "\<And> i j. \<lbrakk>\<not> j < i; P i (j - 1) (zeros i (j - 1))\<rbrakk> \<Longrightarrow>
|
|
|
581 |
P i j ((zeros i (j - 1)) ** zero j)"
|
|
|
582 |
shows "P i j (zeros i j)"
|
|
|
583 |
proof(induct i j rule:ones'.induct)
|
|
|
584 |
fix i j
|
|
|
585 |
assume ih: "(\<not> j < i \<Longrightarrow> P i (j - 1) (zeros i (j - 1)))"
|
|
|
586 |
show "P i j (zeros i j)"
|
|
|
587 |
proof(cases "j < i")
|
|
|
588 |
case True
|
|
|
589 |
with h1 [OF True]
|
|
|
590 |
show ?thesis by auto
|
|
|
591 |
next
|
|
|
592 |
case False
|
|
|
593 |
from h2 [OF False] and ih[OF False]
|
|
|
594 |
have "P i j (zeros i (j - 1) \<and>* zero j)" by blast
|
|
|
595 |
with zeros_rev and False
|
|
|
596 |
show ?thesis by simp
|
|
|
597 |
qed
|
|
|
598 |
qed
|
|
|
599 |
|
|
|
600 |
definition "rep i j k = ((ones i (i + (int k))) ** <(j = i + int k)>)"
|
|
|
601 |
|
|
|
602 |
fun reps :: "int \<Rightarrow> int \<Rightarrow> nat list\<Rightarrow> tassert"
|
|
|
603 |
where
|
|
|
604 |
"reps i j [] = <(i = j + 1)>" |
|
|
|
605 |
"reps i j [k] = (ones i (i + int k) ** <(j = i + int k)>)" |
|
|
|
606 |
"reps i j (k # ks) = (ones i (i + int k) ** zero (i + int k + 1) ** reps (i + int k + 2) j ks)"
|
|
|
607 |
|
|
|
608 |
lemma reps_simp3: "ks \<noteq> [] \<Longrightarrow>
|
|
|
609 |
reps i j (k # ks) = (ones i (i + int k) ** zero (i + int k + 1) ** reps (i + int k + 2) j ks)"
|
|
|
610 |
by (cases ks, auto)
|
|
|
611 |
|
|
|
612 |
definition "reps_sep_len ks = (if length ks \<le> 1 then 0 else (length ks) - 1)"
|
|
|
613 |
|
|
|
614 |
definition "reps_ctnt_len ks = (\<Sum> k \<leftarrow> ks. (1 + k))"
|
|
|
615 |
|
|
|
616 |
definition "reps_len ks = (reps_sep_len ks) + (reps_ctnt_len ks)"
|
|
|
617 |
|
|
|
618 |
definition "splited xs ys zs = ((xs = ys @ zs) \<and> (ys \<noteq> []) \<and> (zs \<noteq> []))"
|
|
|
619 |
|
|
|
620 |
lemma list_split:
|
|
|
621 |
assumes h: "k # ks = ys @ zs"
|
|
|
622 |
and h1: "ys \<noteq> []"
|
|
|
623 |
shows "(ys = [k] \<and> zs = ks) \<or> (\<exists> ys'. ys' \<noteq> [] \<and> ys = k # ys' \<and> ks = ys' @ zs)"
|
|
|
624 |
proof(cases ys)
|
|
|
625 |
case Nil
|
|
|
626 |
with h1 show ?thesis by auto
|
|
|
627 |
next
|
|
|
628 |
case (Cons y' ys')
|
|
|
629 |
with h have "k#ks = y'#(ys' @ zs)" by simp
|
|
|
630 |
hence hh: "y' = k" "ks = ys' @ zs" by auto
|
|
|
631 |
show ?thesis
|
|
|
632 |
proof(cases "ys' = []")
|
|
|
633 |
case False
|
|
|
634 |
show ?thesis
|
|
|
635 |
proof(rule disjI2)
|
|
|
636 |
show " \<exists>ys'. ys' \<noteq> [] \<and> ys = k # ys' \<and> ks = ys' @ zs"
|
|
|
637 |
proof(rule exI[where x = ys'])
|
|
|
638 |
from False hh Cons show "ys' \<noteq> [] \<and> ys = k # ys' \<and> ks = ys' @ zs" by auto
|
|
|
639 |
qed
|
|
|
640 |
qed
|
|
|
641 |
next
|
|
|
642 |
case True
|
|
|
643 |
show ?thesis
|
|
|
644 |
proof(rule disjI1)
|
|
|
645 |
from hh True Cons
|
|
|
646 |
show "ys = [k] \<and> zs = ks" by auto
|
|
|
647 |
qed
|
|
|
648 |
qed
|
|
|
649 |
qed
|
|
|
650 |
|
|
|
651 |
lemma splited_cons[elim_format]:
|
|
|
652 |
assumes h: "splited (k # ks) ys zs"
|
|
|
653 |
shows "(ys = [k] \<and> zs = ks) \<or> (\<exists> ys'. ys' \<noteq> [] \<and> ys = k # ys' \<and> splited ks ys' zs)"
|
|
|
654 |
proof -
|
|
|
655 |
from h have "k # ks = ys @ zs" "ys \<noteq> [] " unfolding splited_def by auto
|
|
|
656 |
from list_split[OF this]
|
|
|
657 |
have "ys = [k] \<and> zs = ks \<or> (\<exists>ys'. ys' \<noteq> [] \<and> ys = k # ys' \<and> ks = ys' @ zs)" .
|
|
|
658 |
thus ?thesis
|
|
|
659 |
proof
|
|
|
660 |
assume " ys = [k] \<and> zs = ks" thus ?thesis by auto
|
|
|
661 |
next
|
|
|
662 |
assume "\<exists>ys'. ys' \<noteq> [] \<and> ys = k # ys' \<and> ks = ys' @ zs"
|
|
|
663 |
then obtain ys' where hh: "ys' \<noteq> []" "ys = k # ys'" "ks = ys' @ zs" by auto
|
|
|
664 |
show ?thesis
|
|
|
665 |
proof(rule disjI2)
|
|
|
666 |
show "\<exists>ys'. ys' \<noteq> [] \<and> ys = k # ys' \<and> splited ks ys' zs"
|
|
|
667 |
proof(rule exI[where x = ys'])
|
|
|
668 |
from h have "zs \<noteq> []" by (unfold splited_def, simp)
|
|
|
669 |
with hh(1) hh(3)
|
|
|
670 |
have "splited ks ys' zs"
|
|
|
671 |
by (unfold splited_def, auto)
|
|
|
672 |
with hh(1) hh(2) show "ys' \<noteq> [] \<and> ys = k # ys' \<and> splited ks ys' zs" by auto
|
|
|
673 |
qed
|
|
|
674 |
qed
|
|
|
675 |
qed
|
|
|
676 |
qed
|
|
|
677 |
|
|
|
678 |
lemma splited_cons_elim:
|
|
|
679 |
assumes h: "splited (k # ks) ys zs"
|
|
|
680 |
and h1: "\<lbrakk>ys = [k]; zs = ks\<rbrakk> \<Longrightarrow> P"
|
|
|
681 |
and h2: "\<And> ys'. \<lbrakk>ys' \<noteq> []; ys = k#ys'; splited ks ys' zs\<rbrakk> \<Longrightarrow> P"
|
|
|
682 |
shows P
|
|
|
683 |
proof(rule splited_cons[OF h])
|
|
|
684 |
assume "ys = [k] \<and> zs = ks \<or> (\<exists>ys'. ys' \<noteq> [] \<and> ys = k # ys' \<and> splited ks ys' zs)"
|
|
|
685 |
thus P
|
|
|
686 |
proof
|
|
|
687 |
assume hh: "ys = [k] \<and> zs = ks"
|
|
|
688 |
show P
|
|
|
689 |
proof(rule h1)
|
|
|
690 |
from hh show "ys = [k]" by simp
|
|
|
691 |
next
|
|
|
692 |
from hh show "zs = ks" by simp
|
|
|
693 |
qed
|
|
|
694 |
next
|
|
|
695 |
assume "\<exists>ys'. ys' \<noteq> [] \<and> ys = k # ys' \<and> splited ks ys' zs"
|
|
|
696 |
then obtain ys' where hh: "ys' \<noteq> []" "ys = k # ys'" "splited ks ys' zs" by auto
|
|
|
697 |
from h2[OF this]
|
|
|
698 |
show P .
|
|
|
699 |
qed
|
|
|
700 |
qed
|
|
|
701 |
|
|
|
702 |
lemma list_nth_expand:
|
|
|
703 |
"i < length xs \<Longrightarrow> xs = take i xs @ [xs!i] @ drop (Suc i) xs"
|
|
|
704 |
by (metis Cons_eq_appendI append_take_drop_id drop_Suc_conv_tl eq_Nil_appendI)
|
|
|
705 |
|
|
|
706 |
lemma reps_len_nil: "reps_len [] = 0"
|
|
|
707 |
by (auto simp:reps_len_def reps_sep_len_def reps_ctnt_len_def)
|
|
|
708 |
|
|
|
709 |
lemma reps_len_sg: "reps_len [k] = 1 + k"
|
|
|
710 |
by (auto simp:reps_len_def reps_sep_len_def reps_ctnt_len_def)
|
|
|
711 |
|
|
|
712 |
lemma reps_len_cons: "ks \<noteq> [] \<Longrightarrow> (reps_len (k # ks)) = 2 + k + reps_len ks "
|
|
|
713 |
proof(induct ks arbitrary:k)
|
|
|
714 |
case (Cons n ns)
|
|
|
715 |
thus ?case
|
|
|
716 |
by(cases "ns = []",
|
|
|
717 |
auto simp:reps_len_def reps_sep_len_def reps_ctnt_len_def)
|
|
|
718 |
qed auto
|
|
|
719 |
|
|
|
720 |
lemma reps_len_correct:
|
|
|
721 |
assumes h: "(reps i j ks) s"
|
|
|
722 |
shows "j = i + int (reps_len ks) - 1"
|
|
|
723 |
using h
|
|
|
724 |
proof(induct ks arbitrary:i j s)
|
|
|
725 |
case Nil
|
|
|
726 |
thus ?case
|
|
|
727 |
by (auto simp:reps_len_nil pasrt_def)
|
|
|
728 |
next
|
|
|
729 |
case (Cons n ns)
|
|
|
730 |
thus ?case
|
|
|
731 |
proof(cases "ns = []")
|
|
|
732 |
case False
|
|
|
733 |
from Cons(2)[unfolded reps_simp3[OF False]]
|
|
|
734 |
obtain s' where "(reps (i + int n + 2) j ns) s'"
|
|
|
735 |
by (auto elim!:sep_conjE)
|
|
|
736 |
from Cons.hyps[OF this]
|
|
|
737 |
show ?thesis
|
|
|
738 |
by (unfold reps_len_cons[OF False], simp)
|
|
|
739 |
next
|
|
|
740 |
case True
|
|
|
741 |
with Cons(2)
|
|
|
742 |
show ?thesis
|
|
|
743 |
by (auto simp:reps_len_sg pasrt_def)
|
|
|
744 |
qed
|
|
|
745 |
qed
|
|
|
746 |
|
|
|
747 |
lemma reps_len_expand:
|
|
|
748 |
shows "(EXS j. (reps i j ks)) = (reps i (i + int (reps_len ks) - 1) ks)"
|
|
|
749 |
proof(default+)
|
|
|
750 |
fix s
|
|
|
751 |
assume "(EXS j. reps i j ks) s"
|
|
|
752 |
with reps_len_correct show "reps i (i + int (reps_len ks) - 1) ks s"
|
|
|
753 |
by (auto simp:pred_ex_def)
|
|
|
754 |
next
|
|
|
755 |
fix s
|
|
|
756 |
assume "reps i (i + int (reps_len ks) - 1) ks s"
|
|
|
757 |
thus "(EXS j. reps i j ks) s" by (auto simp:pred_ex_def)
|
|
|
758 |
qed
|
|
|
759 |
|
|
|
760 |
lemma reps_len_expand1: "(EXS j. (reps i j ks \<and>* r)) = (reps i (i + int (reps_len ks) - 1) ks \<and>* r)"
|
|
|
761 |
by (metis reps_len_def reps_len_expand sep.mult_commute sep_conj_exists1)
|
|
|
762 |
|
|
|
763 |
lemma reps_splited:
|
|
|
764 |
assumes h: "splited xs ys zs"
|
|
|
765 |
shows "reps i j xs = (reps i (i + int (reps_len ys) - 1) ys \<and>*
|
|
|
766 |
zero (i + int (reps_len ys)) \<and>*
|
|
|
767 |
reps (i + int (reps_len ys) + 1) j zs)"
|
|
|
768 |
using h
|
|
|
769 |
proof(induct xs arbitrary: i j ys zs)
|
|
|
770 |
case Nil
|
|
|
771 |
thus ?case
|
|
|
772 |
by (unfold splited_def, auto)
|
|
|
773 |
next
|
|
|
774 |
case (Cons k ks)
|
|
|
775 |
from Cons(2)
|
|
|
776 |
show ?case
|
|
|
777 |
proof(rule splited_cons_elim)
|
|
|
778 |
assume h: "ys = [k]" "zs = ks"
|
|
|
779 |
with Cons(2)
|
|
|
780 |
show ?thesis
|
|
|
781 |
proof(cases "ks = []")
|
|
|
782 |
case True
|
|
|
783 |
with Cons(2) have False
|
|
|
784 |
by (simp add:splited_def, cases ys, auto)
|
|
|
785 |
thus ?thesis by auto
|
|
|
786 |
next
|
|
|
787 |
case False
|
|
|
788 |
have ss: "i + int k + 1 = i + (1 + int k)"
|
|
|
789 |
"i + int k + 2 = 2 + (i + int k)" by auto
|
|
|
790 |
show ?thesis
|
|
|
791 |
by (unfold h(1), unfold reps_simp3[OF False] reps.simps(2)
|
|
|
792 |
reps_len_sg, auto simp:sep_conj_ac,
|
|
|
793 |
unfold ss h(2), simp)
|
|
|
794 |
qed
|
|
|
795 |
next
|
|
|
796 |
fix ys'
|
|
|
797 |
assume h: "ys' \<noteq> []" "ys = k # ys'" "splited ks ys' zs"
|
|
|
798 |
hence nnks: "ks \<noteq> []"
|
|
|
799 |
by (unfold splited_def, auto)
|
|
|
800 |
have ss: "i + int k + 2 + int (reps_len ys') =
|
|
|
801 |
i + (2 + (int k + int (reps_len ys')))" by auto
|
|
|
802 |
show ?thesis
|
|
|
803 |
by (simp add: reps_simp3[OF nnks] reps_simp3[OF h(1)]
|
|
|
804 |
Cons(1)[OF h(3)] h(2)
|
|
|
805 |
reps_len_cons[OF h(1)]
|
|
|
806 |
sep_conj_ac, subst ss, simp)
|
|
|
807 |
qed
|
|
|
808 |
qed
|
|
|
809 |
|
|
|
810 |
subsection {* A theory of list extension *}
|
|
|
811 |
|
|
|
812 |
definition "list_ext n xs = xs @ replicate ((Suc n) - length xs) 0"
|
|
|
813 |
|
|
|
814 |
lemma list_ext_len_eq: "length (list_ext a xs) = length xs + (Suc a - length xs)"
|
|
|
815 |
by (metis length_append length_replicate list_ext_def)
|
|
|
816 |
|
|
|
817 |
lemma list_ext_len: "a < length (list_ext a xs)"
|
|
|
818 |
by (unfold list_ext_len_eq, auto)
|
|
|
819 |
|
|
|
820 |
lemma list_ext_lt: "a < length xs \<Longrightarrow> list_ext a xs = xs"
|
|
|
821 |
by (smt append_Nil2 list_ext_def replicate_0)
|
|
|
822 |
|
|
|
823 |
lemma list_ext_lt_get:
|
|
|
824 |
assumes h: "a' < length xs"
|
|
|
825 |
shows "(list_ext a xs)!a' = xs!a'"
|
|
|
826 |
proof(cases "a < length xs")
|
|
|
827 |
case True
|
|
|
828 |
with h
|
|
|
829 |
show ?thesis by (auto simp:list_ext_lt)
|
|
|
830 |
next
|
|
|
831 |
case False
|
|
|
832 |
with h show ?thesis
|
|
|
833 |
apply (unfold list_ext_def)
|
|
|
834 |
by (metis nth_append)
|
|
|
835 |
qed
|
|
|
836 |
|
|
|
837 |
lemma list_ext_get_upd: "((list_ext a xs)[a:=v])!a = v"
|
|
|
838 |
by (metis list_ext_len nth_list_update_eq)
|
|
|
839 |
|
|
|
840 |
lemma nth_app: "length xs \<le> a \<Longrightarrow> (xs @ ys)!a = ys!(a - length xs)"
|
|
|
841 |
by (metis not_less nth_append)
|
|
|
842 |
|
|
|
843 |
lemma pred_exI:
|
|
|
844 |
assumes "(P(x) \<and>* r) s"
|
|
|
845 |
shows "((EXS x. P(x)) \<and>* r) s"
|
|
|
846 |
by (metis assms pred_ex_def sep_globalise)
|
|
|
847 |
|
|
|
848 |
lemma list_ext_tail:
|
|
|
849 |
assumes h1: "length xs \<le> a"
|
|
|
850 |
and h2: "length xs \<le> a'"
|
|
|
851 |
and h3: "a' \<le> a"
|
|
|
852 |
shows "(list_ext a xs)!a' = 0"
|
|
|
853 |
proof -
|
|
|
854 |
from h1 h2
|
|
|
855 |
have "a' - length xs < length (replicate (Suc a - length xs) 0)"
|
|
|
856 |
by (metis diff_less_mono h3 le_imp_less_Suc length_replicate)
|
|
|
857 |
moreover from h1 have "replicate (Suc a - length xs) 0 \<noteq> []"
|
|
|
858 |
by (smt empty_replicate)
|
|
|
859 |
ultimately have "(replicate (Suc a - length xs) 0)!(a' - length xs) = 0"
|
|
|
860 |
by (metis length_replicate nth_replicate)
|
|
|
861 |
moreover have "(xs @ (replicate (Suc a - length xs) 0))!a' =
|
|
|
862 |
(replicate (Suc a - length xs) 0)!(a' - length xs)"
|
|
|
863 |
by (rule nth_app[OF h2])
|
|
|
864 |
ultimately show ?thesis
|
|
|
865 |
by (auto simp:list_ext_def)
|
|
|
866 |
qed
|
|
|
867 |
|
|
|
868 |
lemmas list_ext_simps = list_ext_lt_get list_ext_lt list_ext_len list_ext_len_eq
|
|
|
869 |
|
|
|
870 |
lemma listsum_upd_suc:
|
|
|
871 |
"a < length ks \<Longrightarrow> listsum (map Suc (ks[a := Suc (ks ! a)]))= (Suc (listsum (map Suc ks)))"
|
|
|
872 |
by (smt Ex_list_of_length Skolem_list_nth elem_le_listsum_nat
|
|
|
873 |
length_induct length_list_update length_map length_splice
|
|
|
874 |
list_eq_iff_nth_eq list_ext_get_upd list_ext_lt_get list_update_beyond
|
|
|
875 |
list_update_id list_update_overwrite list_update_same_conv list_update_swap
|
|
|
876 |
listsum_update_nat map_eq_imp_length_eq map_update neq_if_length_neq
|
|
|
877 |
nth_equalityI nth_list_update nth_list_update_eq nth_list_update_neq nth_map reps_sep_len_def)
|
|
|
878 |
|
|
|
879 |
lemma reps_len_suc:
|
|
|
880 |
assumes "a < length ks"
|
|
|
881 |
shows "reps_len (ks[a:=Suc(ks!a)]) = 1 + reps_len ks"
|
|
|
882 |
proof(cases "length ks \<le> 1")
|
|
|
883 |
case True
|
|
|
884 |
with `a < length ks`
|
|
|
885 |
obtain k where "ks = [k]" "a = 0"
|
|
|
886 |
by (smt length_0_conv length_Suc_conv)
|
|
|
887 |
thus ?thesis
|
|
|
888 |
apply (unfold `ks = [k]` `a = 0`)
|
|
|
889 |
by (unfold reps_len_def reps_sep_len_def reps_ctnt_len_def, auto)
|
|
|
890 |
next
|
|
|
891 |
case False
|
|
|
892 |
have "Suc = (op + (Suc 0))"
|
|
|
893 |
by (default, auto)
|
|
|
894 |
with listsum_upd_suc[OF `a < length ks`] False
|
|
|
895 |
show ?thesis
|
|
|
896 |
by (unfold reps_len_def reps_sep_len_def reps_ctnt_len_def, simp)
|
|
|
897 |
qed
|
|
|
898 |
|
|
|
899 |
lemma ks_suc_len:
|
|
|
900 |
assumes h1: "(reps i j ks) s"
|
|
|
901 |
and h2: "ks!a = v"
|
|
|
902 |
and h3: "a < length ks"
|
|
|
903 |
and h4: "(reps i j' (ks[a:=Suc v])) s'"
|
|
|
904 |
shows "j' = j + int (reps_len (list_ext a ks)) - int (reps_len ks) + 1"
|
|
|
905 |
proof -
|
|
|
906 |
from reps_len_correct[OF h1, unfolded list_ext_len_eq]
|
|
|
907 |
reps_len_correct[OF h4, unfolded list_ext_len_eq]
|
|
|
908 |
reps_len_suc[OF `a < length ks`] h2 h3
|
|
|
909 |
show ?thesis
|
|
|
910 |
by (unfold list_ext_lt[OF `a < length ks`], auto)
|
|
|
911 |
qed
|
|
|
912 |
|
|
|
913 |
lemma ks_ext_len:
|
|
|
914 |
assumes h1: "(reps i j ks) s"
|
|
|
915 |
and h3: "length ks \<le> a"
|
|
|
916 |
and h4: "reps i j' (list_ext a ks) s'"
|
|
|
917 |
shows "j' = j + int (reps_len (list_ext a ks)) - int (reps_len ks)"
|
|
|
918 |
proof -
|
|
|
919 |
from reps_len_correct[OF h1, unfolded list_ext_len_eq]
|
|
|
920 |
and reps_len_correct[OF h4, unfolded list_ext_len_eq]
|
|
|
921 |
h3
|
|
|
922 |
show ?thesis by auto
|
|
|
923 |
qed
|
|
|
924 |
|
|
|
925 |
definition
|
|
|
926 |
"reps' i j ks =
|
|
|
927 |
(if ks = [] then (<(i = j + 1)>) else (reps i (j - 1) ks \<and>* zero j))"
|
|
|
928 |
|
|
|
929 |
lemma reps'_expand:
|
|
|
930 |
assumes h: "ks \<noteq> []"
|
|
|
931 |
shows "(EXS j. reps' i j ks) = reps' i (i + int (reps_len ks)) ks"
|
|
|
932 |
proof -
|
|
|
933 |
show ?thesis
|
|
|
934 |
proof(default+)
|
|
|
935 |
fix s
|
|
|
936 |
assume "(EXS j. reps' i j ks) s"
|
|
|
937 |
with h have "(EXS j. reps i (j - 1) ks \<and>* zero j) s"
|
|
|
938 |
by (simp add:reps'_def)
|
|
|
939 |
hence "(reps i (i + int (reps_len ks) - 1) ks \<and>* zero (i + int (reps_len ks))) s"
|
|
|
940 |
proof(elim EXS_elim)
|
|
|
941 |
fix j
|
|
|
942 |
assume "(reps i (j - 1) ks \<and>* zero j) s"
|
|
|
943 |
then obtain s1 s2 where "s = s1 + s2" "s1 ## s2" "reps i (j - 1) ks s1" "zero j s2"
|
|
|
944 |
by (auto elim!:sep_conjE)
|
|
|
945 |
from reps_len_correct[OF this(3)]
|
|
|
946 |
have "j = i + int (reps_len ks)" by auto
|
|
|
947 |
with `reps i (j - 1) ks s1` have "reps i (i + int (reps_len ks) - 1) ks s1"
|
|
|
948 |
by simp
|
|
|
949 |
moreover from `j = i + int (reps_len ks)` and `zero j s2`
|
|
|
950 |
have "zero (i + int (reps_len ks)) s2" by auto
|
|
|
951 |
ultimately show "(reps i (i + int (reps_len ks) - 1) ks \<and>* zero (i + int (reps_len ks))) s"
|
|
|
952 |
using `s = s1 + s2` `s1 ## s2` by (auto intro!:sep_conjI)
|
|
|
953 |
qed
|
|
|
954 |
thus "reps' i (i + int (reps_len ks)) ks s"
|
|
|
955 |
by (simp add:h reps'_def)
|
|
|
956 |
next
|
|
|
957 |
fix s
|
|
|
958 |
assume "reps' i (i + int (reps_len ks)) ks s"
|
|
|
959 |
thus "(EXS j. reps' i j ks) s"
|
|
|
960 |
by (auto intro!:EXS_intro)
|
|
|
961 |
qed
|
|
|
962 |
qed
|
|
|
963 |
|
|
|
964 |
lemma reps'_len_correct:
|
|
|
965 |
assumes h: "(reps' i j ks) s"
|
|
|
966 |
and h1: "ks \<noteq> []"
|
|
|
967 |
shows "(j = i + int (reps_len ks))"
|
|
|
968 |
proof -
|
|
|
969 |
from h1 have "reps' i j ks s = (reps i (j - 1) ks \<and>* zero j) s" by (simp add:reps'_def)
|
|
|
970 |
from h[unfolded this]
|
|
|
971 |
obtain s' where "reps i (j - 1) ks s'"
|
|
|
972 |
by (auto elim!:sep_conjE)
|
|
|
973 |
from reps_len_correct[OF this]
|
|
|
974 |
show ?thesis by simp
|
|
|
975 |
qed
|
|
|
976 |
|
|
|
977 |
lemma reps'_append:
|
|
|
978 |
"reps' i j (ks1 @ ks2) = (EXS m. (reps' i (m - 1) ks1 \<and>* reps' m j ks2))"
|
|
|
979 |
proof(cases "ks1 = []")
|
|
|
980 |
case True
|
|
|
981 |
thus ?thesis
|
|
|
982 |
by (auto simp:reps'_def pred_ex_def pasrt_def set_ins_def sep_conj_def)
|
|
|
983 |
next
|
|
|
984 |
case False
|
|
|
985 |
show ?thesis
|
|
|
986 |
proof(cases "ks2 = []")
|
|
|
987 |
case False
|
|
|
988 |
from `ks1 \<noteq> []` and `ks2 \<noteq> []`
|
|
|
989 |
have "splited (ks1 @ ks2) ks1 ks2" by (auto simp:splited_def)
|
|
|
990 |
from reps_splited[OF this, of i "j - 1"]
|
|
|
991 |
have eq_1: "reps i (j - 1) (ks1 @ ks2) =
|
|
|
992 |
(reps i (i + int (reps_len ks1) - 1) ks1 \<and>*
|
|
|
993 |
zero (i + int (reps_len ks1)) \<and>*
|
|
|
994 |
reps (i + int (reps_len ks1) + 1) (j - 1) ks2)" .
|
|
|
995 |
from `ks1 \<noteq> []`
|
|
|
996 |
have eq_2: "reps' i j (ks1 @ ks2) = (reps i (j - 1) (ks1 @ ks2) \<and>* zero j)"
|
|
|
997 |
by (unfold reps'_def, simp)
|
|
|
998 |
show ?thesis
|
|
|
999 |
proof(default+)
|
|
|
1000 |
fix s
|
|
|
1001 |
assume "reps' i j (ks1 @ ks2) s"
|
|
|
1002 |
show "(EXS m. reps' i (m - 1) ks1 \<and>* reps' m j ks2) s"
|
|
|
1003 |
proof(rule EXS_intro[where x = "i + int(reps_len ks1) + 1"])
|
|
|
1004 |
from `reps' i j (ks1 @ ks2) s`[unfolded eq_2 eq_1]
|
|
|
1005 |
and `ks1 \<noteq> []` `ks2 \<noteq> []`
|
|
|
1006 |
show "(reps' i (i + int (reps_len ks1) + 1 - 1) ks1 \<and>*
|
|
|
1007 |
reps' (i + int (reps_len ks1) + 1) j ks2) s"
|
|
|
1008 |
by (unfold reps'_def, simp, sep_cancel+)
|
|
|
1009 |
qed
|
|
|
1010 |
next
|
|
|
1011 |
fix s
|
|
|
1012 |
assume "(EXS m. reps' i (m - 1) ks1 \<and>* reps' m j ks2) s"
|
|
|
1013 |
thus "reps' i j (ks1 @ ks2) s"
|
|
|
1014 |
proof(elim EXS_elim)
|
|
|
1015 |
fix m
|
|
|
1016 |
assume "(reps' i (m - 1) ks1 \<and>* reps' m j ks2) s"
|
|
|
1017 |
then obtain s1 s2 where h:
|
|
|
1018 |
"s = s1 + s2" "s1 ## s2" "reps' i (m - 1) ks1 s1"
|
|
|
1019 |
" reps' m j ks2 s2" by (auto elim!:sep_conjE)
|
|
|
1020 |
from reps'_len_correct[OF this(3) `ks1 \<noteq> []`]
|
|
|
1021 |
have eq_m: "m = i + int (reps_len ks1) + 1" by simp
|
|
|
1022 |
have "((reps i (i + int (reps_len ks1) - 1) ks1 \<and>* zero (i + int (reps_len ks1))) \<and>*
|
|
|
1023 |
((reps (i + int (reps_len ks1) + 1) (j - 1) ks2) \<and>* zero j)) s"
|
|
|
1024 |
(is "(?P \<and>* ?Q) s")
|
|
|
1025 |
proof(rule sep_conjI)
|
|
|
1026 |
from h(3) eq_m `ks1 \<noteq> []` show "?P s1"
|
|
|
1027 |
by (simp add:reps'_def)
|
|
|
1028 |
next
|
|
|
1029 |
from h(4) eq_m `ks2 \<noteq> []` show "?Q s2"
|
|
|
1030 |
by (simp add:reps'_def)
|
|
|
1031 |
next
|
|
|
1032 |
from h(2) show "s1 ## s2" .
|
|
|
1033 |
next
|
|
|
1034 |
from h(1) show "s = s1 + s2" .
|
|
|
1035 |
qed
|
|
|
1036 |
thus "reps' i j (ks1 @ ks2) s"
|
|
|
1037 |
by (unfold eq_2 eq_1, auto simp:sep_conj_ac)
|
|
|
1038 |
qed
|
|
|
1039 |
qed
|
|
|
1040 |
next
|
|
|
1041 |
case True
|
|
|
1042 |
have "-1 + j = j - 1" by auto
|
|
|
1043 |
with `ks1 \<noteq> []` True
|
|
|
1044 |
show ?thesis
|
|
|
1045 |
apply (auto simp:reps'_def pred_ex_def pasrt_def)
|
|
|
1046 |
apply (unfold `-1 + j = j - 1`)
|
|
|
1047 |
by (fold sep_empty_def, simp only:sep_conj_empty)
|
|
|
1048 |
qed
|
|
|
1049 |
qed
|
|
|
1050 |
|
|
|
1051 |
lemma reps'_sg:
|
|
|
1052 |
"reps' i j [k] =
|
|
|
1053 |
(<(j = i + int k + 1)> \<and>* ones i (i + int k) \<and>* zero j)"
|
|
|
1054 |
apply (unfold reps'_def, default, auto simp:sep_conj_ac)
|
|
|
1055 |
by (sep_cancel+, simp add:pasrt_def)+
|
|
|
1056 |
|
|
|
1057 |
|
|
|
1058 |
section {* Basic macros for TM *}
|
|
|
1059 |
|
|
|
1060 |
lemma st_upd:
|
|
|
1061 |
assumes pre: "(st i' ** r) (trset_of (f, x, i, y, z))"
|
|
|
1062 |
shows "(st i'' ** r) (trset_of (f, x, i'', y, z))"
|
|
|
1063 |
proof -
|
|
|
1064 |
from stimes_sgD[OF pre[unfolded st_def], unfolded trset_of.simps, unfolded stD[OF pre]]
|
|
|
1065 |
have "r (tprog_set x \<union> tpc_set i' \<union> tpos_set y \<union> tmem_set z \<union> tfaults_set f - tpc_set i')"
|
|
|
1066 |
by blast
|
|
|
1067 |
moreover have
|
|
|
1068 |
"(tprog_set x \<union> tpc_set i' \<union> tpos_set y \<union> tmem_set z \<union> tfaults_set f - tpc_set i') =
|
|
|
1069 |
(tprog_set x \<union> tpos_set y \<union> tmem_set z \<union> tfaults_set f)"
|
|
|
1070 |
by (unfold tpn_set_def, auto)
|
|
|
1071 |
ultimately have r_rest: "r (tprog_set x \<union> tpos_set y \<union> tmem_set z \<union> tfaults_set f)"
|
|
|
1072 |
by auto
|
|
|
1073 |
show ?thesis
|
|
|
1074 |
proof(rule sep_conjI[where Q = r, OF _ r_rest])
|
|
|
1075 |
show "st i'' (tpc_set i'')"
|
|
|
1076 |
by (unfold st_def sg_def, simp)
|
|
|
1077 |
next
|
|
|
1078 |
show "tpc_set i'' ## tprog_set x \<union> tpos_set y \<union> tmem_set z \<union> tfaults_set f"
|
|
|
1079 |
by (unfold tpn_set_def sep_disj_set_def, auto)
|
|
|
1080 |
next
|
|
|
1081 |
show "trset_of (f, x, i'', y, z) =
|
|
|
1082 |
tpc_set i'' + (tprog_set x \<union> tpos_set y \<union> tmem_set z \<union> tfaults_set f)"
|
|
|
1083 |
by (unfold trset_of.simps plus_set_def, auto)
|
|
|
1084 |
qed
|
|
|
1085 |
qed
|
|
|
1086 |
|
|
|
1087 |
lemma pos_upd:
|
|
|
1088 |
assumes pre: "(ps i ** r) (trset_of (f, x, y, i', z))"
|
|
|
1089 |
shows "(ps j ** r) (trset_of (f, x, y, j, z))"
|
|
|
1090 |
proof -
|
|
|
1091 |
from stimes_sgD[OF pre[unfolded ps_def], unfolded trset_of.simps, unfolded psD[OF pre]]
|
|
|
1092 |
have "r (tprog_set x \<union> tpc_set y \<union> tpos_set i \<union> tmem_set z \<union>
|
|
|
1093 |
tfaults_set f - tpos_set i)" (is "r ?xs")
|
|
|
1094 |
by blast
|
|
|
1095 |
moreover have
|
|
|
1096 |
"?xs = tprog_set x \<union> tpc_set y \<union> tmem_set z \<union> tfaults_set f"
|
|
|
1097 |
by (unfold tpn_set_def, auto)
|
|
|
1098 |
ultimately have r_rest: "r \<dots>"
|
|
|
1099 |
by auto
|
|
|
1100 |
show ?thesis
|
|
|
1101 |
proof(rule sep_conjI[where Q = r, OF _ r_rest])
|
|
|
1102 |
show "ps j (tpos_set j)"
|
|
|
1103 |
by (unfold ps_def sg_def, simp)
|
|
|
1104 |
next
|
|
|
1105 |
show "tpos_set j ## tprog_set x \<union> tpc_set y \<union> tmem_set z \<union> tfaults_set f"
|
|
|
1106 |
by (unfold tpn_set_def sep_disj_set_def, auto)
|
|
|
1107 |
next
|
|
|
1108 |
show "trset_of (f, x, y, j, z) =
|
|
|
1109 |
tpos_set j + (tprog_set x \<union> tpc_set y \<union> tmem_set z \<union> tfaults_set f)"
|
|
|
1110 |
by (unfold trset_of.simps plus_set_def, auto)
|
|
|
1111 |
qed
|
|
|
1112 |
qed
|
|
|
1113 |
|
|
|
1114 |
lemma TM_in_simp: "({TM a v} \<subseteq>
|
|
|
1115 |
tprog_set x \<union> tpc_set y \<union> tpos_set z \<union> tmem_set mem \<union> tfaults_set f) =
|
|
|
1116 |
({TM a v} \<subseteq> tmem_set mem)"
|
|
|
1117 |
by (unfold tpn_set_def, auto)
|
|
|
1118 |
|
|
|
1119 |
lemma tmem_set_upd:
|
|
|
1120 |
"{TM a v} \<subseteq> tmem_set mem \<Longrightarrow>
|
|
|
1121 |
tmem_set (mem(a:=Some v')) = ((tmem_set mem) - {TM a v}) \<union> {TM a v'}"
|
|
|
1122 |
by (unfold tpn_set_def, auto)
|
|
|
1123 |
|
|
|
1124 |
lemma tmem_set_disj: "{TM a v} \<subseteq> tmem_set mem \<Longrightarrow>
|
|
|
1125 |
{TM a v'} \<inter> (tmem_set mem - {TM a v}) = {}"
|
|
|
1126 |
by (unfold tpn_set_def, auto)
|
|
|
1127 |
|
|
|
1128 |
lemma smem_upd: "((tm a v) ** r) (trset_of (f, x, y, z, mem)) \<Longrightarrow>
|
|
|
1129 |
((tm a v') ** r) (trset_of (f, x, y, z, mem(a := Some v')))"
|
|
|
1130 |
proof -
|
|
|
1131 |
have eq_s: "(tprog_set x \<union> tpc_set y \<union> tpos_set z \<union> tmem_set mem \<union> tfaults_set f - {TM a v}) =
|
|
|
1132 |
(tprog_set x \<union> tpc_set y \<union> tpos_set z \<union> (tmem_set mem - {TM a v}) \<union> tfaults_set f)"
|
|
|
1133 |
by (unfold tpn_set_def, auto)
|
|
|
1134 |
assume g: "(tm a v \<and>* r) (trset_of (f, x, y, z, mem))"
|
|
|
1135 |
from this[unfolded trset_of.simps tm_def]
|
|
|
1136 |
have h: "(sg {TM a v} \<and>* r) (tprog_set x \<union> tpc_set y \<union> tpos_set z \<union> tmem_set mem \<union> tfaults_set f)" .
|
|
|
1137 |
hence h0: "r (tprog_set x \<union> tpc_set y \<union> tpos_set z \<union> (tmem_set mem - {TM a v}) \<union> tfaults_set f)"
|
|
|
1138 |
by(sep_drule stimes_sgD, clarify, unfold eq_s, auto)
|
|
|
1139 |
from h TM_in_simp have "{TM a v} \<subseteq> tmem_set mem"
|
|
|
1140 |
by(sep_drule stimes_sgD, auto)
|
|
|
1141 |
from tmem_set_upd [OF this] tmem_set_disj[OF this]
|
|
|
1142 |
have h2: "tmem_set (mem(a \<mapsto> v')) = {TM a v'} \<union> (tmem_set mem - {TM a v})"
|
|
|
1143 |
"{TM a v'} \<inter> (tmem_set mem - {TM a v}) = {}" by auto
|
|
|
1144 |
show ?thesis
|
|
|
1145 |
proof -
|
|
|
1146 |
have "(tm a v' ** r) (tmem_set (mem(a \<mapsto> v')) \<union> tprog_set x \<union> tpc_set y \<union> tpos_set z \<union> tfaults_set f)"
|
|
|
1147 |
proof(rule sep_conjI)
|
|
|
1148 |
show "tm a v' ({TM a v'})" by (unfold tm_def sg_def, simp)
|
|
|
1149 |
next
|
|
|
1150 |
from h0 show "r (tprog_set x \<union> tpc_set y \<union> tpos_set z \<union> (tmem_set mem - {TM a v}) \<union> tfaults_set f)" .
|
|
|
1151 |
next
|
|
|
1152 |
show "{TM a v'} ## tprog_set x \<union> tpc_set y \<union> tpos_set z \<union> (tmem_set mem - {TM a v}) \<union> tfaults_set f"
|
|
|
1153 |
proof -
|
|
|
1154 |
from g have " mem a = Some v"
|
|
|
1155 |
by(sep_frule memD, simp)
|
|
|
1156 |
thus "?thesis"
|
|
|
1157 |
by(unfold tpn_set_def set_ins_def, auto)
|
|
|
1158 |
qed
|
|
|
1159 |
next
|
|
|
1160 |
show "tmem_set (mem(a \<mapsto> v')) \<union> tprog_set x \<union> tpc_set y \<union> tpos_set z \<union> tfaults_set f =
|
|
|
1161 |
{TM a v'} + (tprog_set x \<union> tpc_set y \<union> tpos_set z \<union> (tmem_set mem - {TM a v}) \<union> tfaults_set f)"
|
|
|
1162 |
by (unfold h2(1) set_ins_def eq_s, auto)
|
|
|
1163 |
qed
|
|
|
1164 |
thus ?thesis
|
|
|
1165 |
apply (unfold trset_of.simps)
|
|
|
1166 |
by (metis sup_commute sup_left_commute)
|
|
|
1167 |
qed
|
|
|
1168 |
qed
|
|
|
1169 |
|
|
|
1170 |
lemma hoare_write_zero:
|
|
|
1171 |
"\<lbrace>st i ** ps p ** tm p v\<rbrace>
|
|
|
1172 |
i:[write_zero]:j
|
|
|
1173 |
\<lbrace>st j ** ps p ** tm p Bk\<rbrace>"
|
|
|
1174 |
proof(unfold write_zero_def, intro t_hoare_local, rule t_hoare_label_last, simp, simp)
|
|
|
1175 |
show "\<lbrace>st i \<and>* ps p \<and>* tm p v\<rbrace> i :[ \<guillemotright> ((W0, j), W0, j) ]: j \<lbrace>st j \<and>* ps p \<and>* tm p Bk\<rbrace>"
|
|
|
1176 |
proof(unfold tassemble_to.simps, simp only:sep_conj_cond,
|
|
|
1177 |
intro tm.code_condI, simp)
|
|
|
1178 |
assume eq_j: "j = Suc i"
|
|
|
1179 |
show "\<lbrace>st i \<and>* ps p \<and>* tm p v\<rbrace> sg {TC i ((W0, Suc i), W0, Suc i)}
|
|
|
1180 |
\<lbrace>st (Suc i) \<and>* ps p \<and>* tm p Bk\<rbrace>"
|
|
|
1181 |
proof(fold eq_j, unfold tassemble_to.simps tm.Hoare_gen_def sep_conj_ac, clarify)
|
|
|
1182 |
fix ft prog cs i' mem r
|
|
|
1183 |
assume h: "(r \<and>* ps p \<and>* st i \<and>* tm p v \<and>* sg {TC i ((W0, j), W0, j)})
|
|
|
1184 |
(trset_of (ft, prog, cs, i', mem))"
|
|
|
1185 |
from h have "prog i = Some ((W0, j), W0, j)"
|
|
|
1186 |
apply(rule_tac r = "r \<and>* ps p \<and>* tm p v" in codeD)
|
|
|
1187 |
by(simp add: sep_conj_ac)
|
|
|
1188 |
from h and this have stp:
|
|
|
1189 |
"tm.run 1 (ft, prog, cs, i', mem) = (ft, prog, j, i', mem(i'\<mapsto> Bk))" (is "?x = ?y")
|
|
|
1190 |
apply(sep_frule psD)
|
|
|
1191 |
apply(sep_frule stD)
|
|
|
1192 |
apply(sep_frule memD, simp)
|
|
|
1193 |
by(cases v, unfold tm.run_def, auto)
|
|
|
1194 |
from h have "i' = p"
|
|
|
1195 |
by(sep_drule psD, simp)
|
|
|
1196 |
with h
|
|
|
1197 |
have "(r \<and>* ps p \<and>* st j \<and>* tm p Bk \<and>* sg {TC i ((W0, j), W0, j)}) (trset_of ?x)"
|
|
|
1198 |
apply(unfold stp)
|
|
|
1199 |
apply(sep_drule pos_upd, sep_drule st_upd, sep_drule smem_upd)
|
|
|
1200 |
apply(auto simp: sep_conj_ac)
|
|
|
1201 |
done
|
|
|
1202 |
thus "\<exists>k. (r \<and>* ps p \<and>* st j \<and>* tm p Bk \<and>* sg {TC i ((W0, j), W0, j)})
|
|
|
1203 |
(trset_of (tm.run (Suc k) (ft, prog, cs, i', mem)))"
|
|
|
1204 |
apply (rule_tac x = 0 in exI)
|
|
|
1205 |
by auto
|
|
|
1206 |
qed
|
|
|
1207 |
qed
|
|
|
1208 |
qed
|
|
|
1209 |
|
|
|
1210 |
lemma hoare_write_zero_gen[step]:
|
|
|
1211 |
assumes "p = q"
|
|
|
1212 |
shows "\<lbrace>st i ** ps p ** tm q v\<rbrace>
|
|
|
1213 |
i:[write_zero]:j
|
|
|
1214 |
\<lbrace>st j ** ps p ** tm q Bk\<rbrace>"
|
|
|
1215 |
by (unfold assms, rule hoare_write_zero)
|
|
|
1216 |
|
|
|
1217 |
lemma hoare_write_one:
|
|
|
1218 |
"\<lbrace>st i ** ps p ** tm p v\<rbrace>
|
|
|
1219 |
i:[write_one]:j
|
|
|
1220 |
\<lbrace>st j ** ps p ** tm p Oc\<rbrace>"
|
|
|
1221 |
proof(unfold write_one_def, intro t_hoare_local, rule t_hoare_label_last, simp+)
|
|
|
1222 |
fix l
|
|
|
1223 |
show "\<lbrace>st i \<and>* ps p \<and>* tm p v\<rbrace> i :[ \<guillemotright> ((W1, j), W1, j) ]: j \<lbrace>st j \<and>* ps p \<and>* tm p Oc\<rbrace>"
|
|
|
1224 |
proof(unfold tassemble_to.simps, simp only:sep_conj_cond,
|
|
|
1225 |
rule_tac tm.code_condI, simp add: sep_conj_ac)
|
|
|
1226 |
let ?j = "Suc i"
|
|
|
1227 |
show "\<lbrace>ps p \<and>* st i \<and>* tm p v\<rbrace> sg {TC i ((W1, ?j), W1, ?j)}
|
|
|
1228 |
\<lbrace>ps p \<and>* st ?j \<and>* tm p Oc\<rbrace>"
|
|
|
1229 |
proof(unfold tassemble_to.simps tm.Hoare_gen_def sep_conj_ac, clarify)
|
|
|
1230 |
fix ft prog cs i' mem r
|
|
|
1231 |
assume h: "(r \<and>* ps p \<and>* st i \<and>* tm p v \<and>* sg {TC i ((W1, ?j), W1, ?j)})
|
|
|
1232 |
(trset_of (ft, prog, cs, i', mem))"
|
|
|
1233 |
from h have "prog i = Some ((W1, ?j), W1, ?j)"
|
|
|
1234 |
apply(rule_tac r = "r \<and>* ps p \<and>* tm p v" in codeD)
|
|
|
1235 |
by(simp add: sep_conj_ac)
|
|
|
1236 |
from h and this have stp:
|
|
|
1237 |
"tm.run 1 (ft, prog, cs, i', mem) =
|
|
|
1238 |
(ft, prog, ?j, i', mem(i'\<mapsto> Oc))" (is "?x = ?y")
|
|
|
1239 |
apply(sep_frule psD)
|
|
|
1240 |
apply(sep_frule stD)
|
|
|
1241 |
apply(sep_frule memD, simp)
|
|
|
1242 |
by(cases v, unfold tm.run_def, auto)
|
|
|
1243 |
from h have "i' = p"
|
|
|
1244 |
by(sep_drule psD, simp)
|
|
|
1245 |
with h
|
|
|
1246 |
have "(r \<and>* ps p \<and>* st ?j \<and>* tm p Oc \<and>* sg {TC i ((W1, ?j), W1, ?j)}) (trset_of ?x)"
|
|
|
1247 |
apply(unfold stp)
|
|
|
1248 |
apply(sep_drule pos_upd, sep_drule st_upd, sep_drule smem_upd)
|
|
|
1249 |
apply(auto simp: sep_conj_ac)
|
|
|
1250 |
done
|
|
|
1251 |
thus "\<exists>k. (r \<and>* ps p \<and>* st ?j \<and>* tm p Oc \<and>* sg {TC i ((W1, ?j), W1, ?j)})
|
|
|
1252 |
(trset_of (tm.run (Suc k) (ft, prog, cs, i', mem)))"
|
|
|
1253 |
apply (rule_tac x = 0 in exI)
|
|
|
1254 |
by auto
|
|
|
1255 |
qed
|
|
|
1256 |
qed
|
|
|
1257 |
qed
|
|
|
1258 |
|
|
|
1259 |
lemma hoare_write_one_gen[step]:
|
|
|
1260 |
assumes "p = q"
|
|
|
1261 |
shows "\<lbrace>st i ** ps p ** tm q v\<rbrace>
|
|
|
1262 |
i:[write_one]:j
|
|
|
1263 |
\<lbrace>st j ** ps p ** tm q Oc\<rbrace>"
|
|
|
1264 |
by (unfold assms, rule hoare_write_one)
|
|
|
1265 |
|
|
|
1266 |
lemma hoare_move_left:
|
|
|
1267 |
"\<lbrace>st i ** ps p ** tm p v2\<rbrace>
|
|
|
1268 |
i:[move_left]:j
|
|
|
1269 |
\<lbrace>st j ** ps (p - 1) ** tm p v2\<rbrace>"
|
|
|
1270 |
proof(unfold move_left_def, intro t_hoare_local, rule t_hoare_label_last, simp+)
|
|
|
1271 |
fix l
|
|
|
1272 |
show "\<lbrace>st i \<and>* ps p \<and>* tm p v2\<rbrace> i :[ \<guillemotright> ((L, l), L, l) ]: l
|
|
|
1273 |
\<lbrace>st l \<and>* ps (p - 1) \<and>* tm p v2\<rbrace>"
|
|
|
1274 |
proof(unfold tassemble_to.simps, simp only:sep_conj_cond,
|
|
|
1275 |
intro tm.code_condI, simp add: sep_conj_ac)
|
|
|
1276 |
let ?j = "Suc i"
|
|
|
1277 |
show "\<lbrace>ps p \<and>* st i \<and>* tm p v2\<rbrace> sg {TC i ((L, ?j), L, ?j)}
|
|
|
1278 |
\<lbrace>st ?j \<and>* tm p v2 \<and>* ps (p - 1)\<rbrace>"
|
|
|
1279 |
proof(unfold tassemble_to.simps tm.Hoare_gen_def sep_conj_ac, clarify)
|
|
|
1280 |
fix ft prog cs i' mem r
|
|
|
1281 |
assume h: "(r \<and>* ps p \<and>* st i \<and>* tm p v2 \<and>* sg {TC i ((L, ?j), L, ?j)})
|
|
|
1282 |
(trset_of (ft, prog, cs, i', mem))"
|
|
|
1283 |
from h have "prog i = Some ((L, ?j), L, ?j)"
|
|
|
1284 |
apply(rule_tac r = "r \<and>* ps p \<and>* tm p v2" in codeD)
|
|
|
1285 |
by(simp add: sep_conj_ac)
|
|
|
1286 |
from h and this have stp:
|
|
|
1287 |
"tm.run 1 (ft, prog, cs, i', mem) = (ft, prog, ?j, i' - 1, mem)" (is "?x = ?y")
|
|
|
1288 |
apply(sep_frule psD)
|
|
|
1289 |
apply(sep_frule stD)
|
|
|
1290 |
apply(sep_frule memD, simp)
|
|
|
1291 |
apply(unfold tm.run_def, case_tac v2, auto)
|
|
|
1292 |
done
|
|
|
1293 |
from h have "i' = p"
|
|
|
1294 |
by(sep_drule psD, simp)
|
|
|
1295 |
with h
|
|
|
1296 |
have "(r \<and>* st ?j \<and>* tm p v2 \<and>* ps (p - 1) \<and>* sg {TC i ((L, ?j), L, ?j)})
|
|
|
1297 |
(trset_of ?x)"
|
|
|
1298 |
apply(unfold stp)
|
|
|
1299 |
apply(sep_drule pos_upd, sep_drule st_upd, simp)
|
|
|
1300 |
proof -
|
|
|
1301 |
assume "(st ?j \<and>* ps (p - 1) \<and>* r \<and>* tm p v2 \<and>* sg {TC i ((L, ?j), L, ?j)})
|
|
|
1302 |
(trset_of (ft, prog, ?j, p - 1, mem))"
|
|
|
1303 |
thus "(r \<and>* st ?j \<and>* tm p v2 \<and>* ps (p - 1) \<and>* sg {TC i ((L, ?j), L, ?j)})
|
|
|
1304 |
(trset_of (ft, prog, ?j, p - 1, mem))"
|
|
|
1305 |
by(simp add: sep_conj_ac)
|
|
|
1306 |
qed
|
|
|
1307 |
thus "\<exists>k. (r \<and>* st ?j \<and>* tm p v2 \<and>* ps (p - 1) \<and>* sg {TC i ((L, ?j), L, ?j)})
|
|
|
1308 |
(trset_of (tm.run (Suc k) (ft, prog, cs, i', mem)))"
|
|
|
1309 |
apply (rule_tac x = 0 in exI)
|
|
|
1310 |
by auto
|
|
|
1311 |
qed
|
|
|
1312 |
qed
|
|
|
1313 |
qed
|
|
|
1314 |
|
|
|
1315 |
lemma hoare_move_left_gen[step]:
|
|
|
1316 |
assumes "p = q"
|
|
|
1317 |
shows "\<lbrace>st i ** ps p ** tm q v2\<rbrace>
|
|
|
1318 |
i:[move_left]:j
|
|
|
1319 |
\<lbrace>st j ** ps (p - 1) ** tm q v2\<rbrace>"
|
|
|
1320 |
by (unfold assms, rule hoare_move_left)
|
|
|
1321 |
|
|
|
1322 |
lemma hoare_move_right:
|
|
|
1323 |
"\<lbrace>st i ** ps p ** tm p v1 \<rbrace>
|
|
|
1324 |
i:[move_right]:j
|
|
|
1325 |
\<lbrace>st j ** ps (p + 1) ** tm p v1 \<rbrace>"
|
|
|
1326 |
proof(unfold move_right_def, intro t_hoare_local, rule t_hoare_label_last, simp+)
|
|
|
1327 |
fix l
|
|
|
1328 |
show "\<lbrace>st i \<and>* ps p \<and>* tm p v1\<rbrace> i :[ \<guillemotright> ((R, l), R, l) ]: l
|
|
|
1329 |
\<lbrace>st l \<and>* ps (p + 1) \<and>* tm p v1\<rbrace>"
|
|
|
1330 |
proof(unfold tassemble_to.simps, simp only:sep_conj_cond,
|
|
|
1331 |
intro tm.code_condI, simp add: sep_conj_ac)
|
|
|
1332 |
let ?j = "Suc i"
|
|
|
1333 |
show "\<lbrace>ps p \<and>* st i \<and>* tm p v1\<rbrace> sg {TC i ((R, ?j), R, ?j)}
|
|
|
1334 |
\<lbrace>st ?j \<and>* tm p v1 \<and>* ps (p + 1)\<rbrace>"
|
|
|
1335 |
proof(unfold tassemble_to.simps tm.Hoare_gen_def sep_conj_ac, clarify)
|
|
|
1336 |
fix ft prog cs i' mem r
|
|
|
1337 |
assume h: "(r \<and>* ps p \<and>* st i \<and>* tm p v1 \<and>* sg {TC i ((R, ?j), R, ?j)})
|
|
|
1338 |
(trset_of (ft, prog, cs, i', mem))"
|
|
|
1339 |
from h have "prog i = Some ((R, ?j), R, ?j)"
|
|
|
1340 |
apply(rule_tac r = "r \<and>* ps p \<and>* tm p v1" in codeD)
|
|
|
1341 |
by(simp add: sep_conj_ac)
|
|
|
1342 |
from h and this have stp:
|
|
|
1343 |
"tm.run 1 (ft, prog, cs, i', mem) = (ft, prog, ?j, i'+ 1, mem)" (is "?x = ?y")
|
|
|
1344 |
apply(sep_frule psD)
|
|
|
1345 |
apply(sep_frule stD)
|
|
|
1346 |
apply(sep_frule memD, simp)
|
|
|
1347 |
apply(unfold tm.run_def, case_tac v1, auto)
|
|
|
1348 |
done
|
|
|
1349 |
from h have "i' = p"
|
|
|
1350 |
by(sep_drule psD, simp)
|
|
|
1351 |
with h
|
|
|
1352 |
have "(r \<and>* st ?j \<and>* tm p v1 \<and>* ps (p + 1) \<and>*
|
|
|
1353 |
sg {TC i ((R, ?j), R, ?j)}) (trset_of ?x)"
|
|
|
1354 |
apply(unfold stp)
|
|
|
1355 |
apply(sep_drule pos_upd, sep_drule st_upd, simp)
|
|
|
1356 |
proof -
|
|
|
1357 |
assume "(st ?j \<and>* ps (p + 1) \<and>* r \<and>* tm p v1 \<and>* sg {TC i ((R, ?j), R, ?j)})
|
|
|
1358 |
(trset_of (ft, prog, ?j, p + 1, mem))"
|
|
|
1359 |
thus "(r \<and>* st ?j \<and>* tm p v1 \<and>* ps (p + 1) \<and>* sg {TC i ((R, ?j), R, ?j)})
|
|
|
1360 |
(trset_of (ft, prog, ?j, p + 1, mem))"
|
|
|
1361 |
by (simp add: sep_conj_ac)
|
|
|
1362 |
qed
|
|
|
1363 |
thus "\<exists>k. (r \<and>* st ?j \<and>* tm p v1 \<and>* ps (p + 1) \<and>* sg {TC i ((R, ?j), R, ?j)})
|
|
|
1364 |
(trset_of (tm.run (Suc k) (ft, prog, cs, i', mem)))"
|
|
|
1365 |
apply (rule_tac x = 0 in exI)
|
|
|
1366 |
by auto
|
|
|
1367 |
qed
|
|
|
1368 |
qed
|
|
|
1369 |
qed
|
|
|
1370 |
|
|
|
1371 |
lemma hoare_move_right_gen[step]:
|
|
|
1372 |
assumes "p = q"
|
|
|
1373 |
shows "\<lbrace>st i ** ps p ** tm q v1 \<rbrace>
|
|
|
1374 |
i:[move_right]:j
|
|
|
1375 |
\<lbrace>st j ** ps (p + 1) ** tm q v1 \<rbrace>"
|
|
|
1376 |
by (unfold assms, rule hoare_move_right)
|
|
|
1377 |
|
|
|
1378 |
lemma hoare_if_one_true:
|
|
|
1379 |
"\<lbrace>st i ** ps p ** one p\<rbrace>
|
|
|
1380 |
i:[if_one e]:j
|
|
|
1381 |
\<lbrace>st e ** ps p ** one p\<rbrace>"
|
|
|
1382 |
proof(unfold if_one_def, intro t_hoare_local, rule t_hoare_label_last, simp+)
|
|
|
1383 |
fix l
|
|
|
1384 |
show " \<lbrace>st i \<and>* ps p \<and>* one p\<rbrace> i :[ \<guillemotright> ((W0, l), W1, e) ]: l \<lbrace>st e \<and>* ps p \<and>* one p\<rbrace>"
|
|
|
1385 |
proof(unfold tassemble_to.simps, simp only:sep_conj_cond,
|
|
|
1386 |
intro tm.code_condI, simp add: sep_conj_ac)
|
|
|
1387 |
let ?j = "Suc i"
|
|
|
1388 |
show "\<lbrace>one p \<and>* ps p \<and>* st i\<rbrace> sg {TC i ((W0, ?j), W1, e)} \<lbrace>one p \<and>* ps p \<and>* st e\<rbrace>"
|
|
|
1389 |
proof(unfold tassemble_to.simps tm.Hoare_gen_def sep_conj_ac, clarify)
|
|
|
1390 |
fix ft prog cs pc mem r
|
|
|
1391 |
assume h: "(r \<and>* one p \<and>* ps p \<and>* st i \<and>* sg {TC i ((W0, ?j), W1, e)})
|
|
|
1392 |
(trset_of (ft, prog, cs, pc, mem))"
|
|
|
1393 |
from h have k1: "prog i = Some ((W0, ?j), W1, e)"
|
|
|
1394 |
apply(rule_tac r = "r \<and>* one p \<and>* ps p" in codeD)
|
|
|
1395 |
by(simp add: sep_conj_ac)
|
|
|
1396 |
from h have k2: "pc = p"
|
|
|
1397 |
by(sep_drule psD, simp)
|
|
|
1398 |
from h and this have k3: "mem pc = Some Oc"
|
|
|
1399 |
apply(unfold one_def)
|
|
|
1400 |
by(sep_drule memD, simp)
|
|
|
1401 |
from h k1 k2 k3 have stp:
|
|
|
1402 |
"tm.run 1 (ft, prog, cs, pc, mem) = (ft, prog, e, pc, mem)" (is "?x = ?y")
|
|
|
1403 |
apply(sep_drule stD)
|
|
|
1404 |
by(unfold tm.run_def, auto)
|
|
|
1405 |
from h k2
|
|
|
1406 |
have "(r \<and>* one p \<and>* ps p \<and>* st e \<and>* sg {TC i ((W0, ?j), W1, e)}) (trset_of ?x)"
|
|
|
1407 |
apply(unfold stp)
|
|
|
1408 |
by(sep_drule st_upd, simp add: sep_conj_ac)
|
|
|
1409 |
thus "\<exists>k.(r \<and>* one p \<and>* ps p \<and>* st e \<and>* sg {TC i ((W0, ?j), W1, e)})
|
|
|
1410 |
(trset_of (tm.run (Suc k) (ft, prog, cs, pc, mem)))"
|
|
|
1411 |
apply (rule_tac x = 0 in exI)
|
|
|
1412 |
by auto
|
|
|
1413 |
qed
|
|
|
1414 |
qed
|
|
|
1415 |
qed
|
|
|
1416 |
|
|
|
1417 |
text {*
|
|
|
1418 |
The following problematic lemma is not provable now
|
|
|
1419 |
lemma hoare_self: "\<lbrace>p\<rbrace> i :[ap]: j \<lbrace>p\<rbrace>"
|
|
|
1420 |
apply(simp add: tm.Hoare_gen_def, clarify)
|
|
|
1421 |
apply(rule_tac x = 0 in exI, simp add: tm.run_def)
|
|
|
1422 |
done
|
|
|
1423 |
*}
|
|
|
1424 |
|
|
|
1425 |
lemma hoare_if_one_true_gen[step]:
|
|
|
1426 |
assumes "p = q"
|
|
|
1427 |
shows
|
|
|
1428 |
"\<lbrace>st i ** ps p ** one q\<rbrace>
|
|
|
1429 |
i:[if_one e]:j
|
|
|
1430 |
\<lbrace>st e ** ps p ** one q\<rbrace>"
|
|
|
1431 |
by (unfold assms, rule hoare_if_one_true)
|
|
|
1432 |
|
|
|
1433 |
lemma hoare_if_one_true1:
|
|
|
1434 |
"\<lbrace>st i ** ps p ** one p\<rbrace>
|
|
|
1435 |
i:[(if_one e; c)]:j
|
|
|
1436 |
\<lbrace>st e ** ps p ** one p\<rbrace>"
|
|
|
1437 |
proof(unfold tassemble_to.simps, rule tm.code_exI,
|
|
|
1438 |
simp add: sep_conj_ac tm.Hoare_gen_def, clarify)
|
|
|
1439 |
fix j' ft prog cs pos mem r
|
|
|
1440 |
assume h: "(r \<and>* one p \<and>* ps p \<and>* st i \<and>* j' :[ c ]: j \<and>* i :[ if_one e ]: j')
|
|
|
1441 |
(trset_of (ft, prog, cs, pos, mem))"
|
|
|
1442 |
from tm.frame_rule[OF hoare_if_one_true]
|
|
|
1443 |
have "\<And> r. \<lbrace>st i \<and>* ps p \<and>* one p \<and>* r\<rbrace> i :[ if_one e ]: j' \<lbrace>st e \<and>* ps p \<and>* one p \<and>* r\<rbrace>"
|
|
|
1444 |
by(simp add: sep_conj_ac)
|
|
|
1445 |
from this[unfolded tm.Hoare_gen_def tassemble_to.simps, rule_format, of "j' :[ c ]: j"] h
|
|
|
1446 |
have "\<exists> k. (r \<and>* one p \<and>* ps p \<and>* st e \<and>* i :[ if_one e ]: j' \<and>* j' :[ c ]: j)
|
|
|
1447 |
(trset_of (tm.run (Suc k) (ft, prog, cs, pos, mem)))"
|
|
|
1448 |
by(auto simp: sep_conj_ac)
|
|
|
1449 |
thus "\<exists>k. (r \<and>* one p \<and>* ps p \<and>* st e \<and>* j' :[ c ]: j \<and>* i :[ if_one e ]: j')
|
|
|
1450 |
(trset_of (tm.run (Suc k) (ft, prog, cs, pos, mem)))"
|
|
|
1451 |
by(simp add: sep_conj_ac)
|
|
|
1452 |
qed
|
|
|
1453 |
|
|
|
1454 |
lemma hoare_if_one_true1_gen[step]:
|
|
|
1455 |
assumes "p = q"
|
|
|
1456 |
shows
|
|
|
1457 |
"\<lbrace>st i ** ps p ** one q\<rbrace>
|
|
|
1458 |
i:[(if_one e; c)]:j
|
|
|
1459 |
\<lbrace>st e ** ps p ** one q\<rbrace>"
|
|
|
1460 |
by (unfold assms, rule hoare_if_one_true1)
|
|
|
1461 |
|
|
|
1462 |
lemma hoare_if_one_false:
|
|
|
1463 |
"\<lbrace>st i ** ps p ** zero p\<rbrace>
|
|
|
1464 |
i:[if_one e]:j
|
|
|
1465 |
\<lbrace>st j ** ps p ** zero p\<rbrace>"
|
|
|
1466 |
proof(unfold if_one_def, intro t_hoare_local, rule t_hoare_label_last, simp+)
|
|
|
1467 |
show "\<lbrace>st i \<and>* ps p \<and>* zero p\<rbrace> i :[ (\<guillemotright> ((W0, j), W1, e)) ]: j
|
|
|
1468 |
\<lbrace>st j \<and>* ps p \<and>* zero p\<rbrace>"
|
|
|
1469 |
proof(unfold tassemble_to.simps, simp only:sep_conj_cond,
|
|
|
1470 |
intro tm.code_condI, simp add: sep_conj_ac)
|
|
|
1471 |
let ?j = "Suc i"
|
|
|
1472 |
show "\<lbrace>ps p \<and>* st i \<and>* zero p\<rbrace> sg {TC i ((W0, ?j), W1, e)} \<lbrace>ps p \<and>* zero p \<and>* st ?j \<rbrace>"
|
|
|
1473 |
proof(unfold tassemble_to.simps tm.Hoare_gen_def sep_conj_ac, clarify)
|
|
|
1474 |
fix ft prog cs pc mem r
|
|
|
1475 |
assume h: "(r \<and>* ps p \<and>* st i \<and>* zero p \<and>* sg {TC i ((W0, ?j), W1, e)})
|
|
|
1476 |
(trset_of (ft, prog, cs, pc, mem))"
|
|
|
1477 |
from h have k1: "prog i = Some ((W0, ?j), W1, e)"
|
|
|
1478 |
apply(rule_tac r = "r \<and>* zero p \<and>* ps p" in codeD)
|
|
|
1479 |
by(simp add: sep_conj_ac)
|
|
|
1480 |
from h have k2: "pc = p"
|
|
|
1481 |
by(sep_drule psD, simp)
|
|
|
1482 |
from h and this have k3: "mem pc = Some Bk"
|
|
|
1483 |
apply(unfold zero_def)
|
|
|
1484 |
by(sep_drule memD, simp)
|
|
|
1485 |
from h k1 k2 k3 have stp:
|
|
|
1486 |
"tm.run 1 (ft, prog, cs, pc, mem) = (ft, prog, ?j, pc, mem)" (is "?x = ?y")
|
|
|
1487 |
apply(sep_drule stD)
|
|
|
1488 |
by (unfold tm.run_def, auto split:tstate.splits)
|
|
|
1489 |
from h k2
|
|
|
1490 |
have "(r \<and>* zero p \<and>* ps p \<and>* st ?j \<and>* sg {TC i ((W0, ?j), W1, e)}) (trset_of ?x)"
|
|
|
1491 |
apply (unfold stp)
|
|
|
1492 |
by (sep_drule st_upd[where i''="?j"], auto simp:sep_conj_ac)
|
|
|
1493 |
thus "\<exists>k. (r \<and>* ps p \<and>* zero p \<and>* st ?j \<and>* sg {TC i ((W0, ?j), W1, e)})
|
|
|
1494 |
(trset_of (tm.run (Suc k) (ft, prog, cs, pc, mem)))"
|
|
|
1495 |
by(auto simp: sep_conj_ac)
|
|
|
1496 |
qed
|
|
|
1497 |
qed
|
|
|
1498 |
qed
|
|
|
1499 |
|
|
|
1500 |
lemma hoare_if_one_false_gen[step]:
|
|
|
1501 |
assumes "p = q"
|
|
|
1502 |
shows "\<lbrace>st i ** ps p ** zero q\<rbrace>
|
|
|
1503 |
i:[if_one e]:j
|
|
|
1504 |
\<lbrace>st j ** ps p ** zero q\<rbrace>"
|
|
|
1505 |
by (unfold assms, rule hoare_if_one_false)
|
|
|
1506 |
|
|
|
1507 |
lemma hoare_if_zero_true:
|
|
|
1508 |
"\<lbrace>st i ** ps p ** zero p\<rbrace>
|
|
|
1509 |
i:[if_zero e]:j
|
|
|
1510 |
\<lbrace>st e ** ps p ** zero p\<rbrace>"
|
|
|
1511 |
proof(unfold if_zero_def, intro t_hoare_local, rule t_hoare_label_last, simp+)
|
|
|
1512 |
fix l
|
|
|
1513 |
show "\<lbrace>st i \<and>* ps p \<and>* zero p\<rbrace> i :[ \<guillemotright> ((W0, e), W1, l) ]: l \<lbrace>st e \<and>* ps p \<and>* zero p\<rbrace>"
|
|
|
1514 |
proof(unfold tassemble_to.simps, simp only:sep_conj_cond,
|
|
|
1515 |
intro tm.code_condI, simp add: sep_conj_ac)
|
|
|
1516 |
let ?j = "Suc i"
|
|
|
1517 |
show "\<lbrace>ps p \<and>* st i \<and>* zero p\<rbrace> sg {TC i ((W0, e), W1, ?j)} \<lbrace>ps p \<and>* st e \<and>* zero p\<rbrace>"
|
|
|
1518 |
proof(unfold tassemble_to.simps tm.Hoare_gen_def sep_conj_ac, clarify)
|
|
|
1519 |
fix ft prog cs pc mem r
|
|
|
1520 |
assume h: "(r \<and>* ps p \<and>* st i \<and>* zero p \<and>* sg {TC i ((W0, e), W1, ?j)})
|
|
|
1521 |
(trset_of (ft, prog, cs, pc, mem))"
|
|
|
1522 |
from h have k1: "prog i = Some ((W0, e), W1, ?j)"
|
|
|
1523 |
apply(rule_tac r = "r \<and>* zero p \<and>* ps p" in codeD)
|
|
|
1524 |
by(simp add: sep_conj_ac)
|
|
|
1525 |
from h have k2: "pc = p"
|
|
|
1526 |
by(sep_drule psD, simp)
|
|
|
1527 |
from h and this have k3: "mem pc = Some Bk"
|
|
|
1528 |
apply(unfold zero_def)
|
|
|
1529 |
by(sep_drule memD, simp)
|
|
|
1530 |
from h k1 k2 k3 have stp:
|
|
|
1531 |
"tm.run 1 (ft, prog, cs, pc, mem) = (ft, prog, e, pc, mem)" (is "?x = ?y")
|
|
|
1532 |
apply(sep_drule stD)
|
|
|
1533 |
by(unfold tm.run_def, auto)
|
|
|
1534 |
from h k2
|
|
|
1535 |
have "(r \<and>* zero p \<and>* ps p \<and>* st e \<and>* sg {TC i ((W0, e), W1, ?j)}) (trset_of ?x)"
|
|
|
1536 |
apply(unfold stp)
|
|
|
1537 |
by(sep_drule st_upd, simp add: sep_conj_ac)
|
|
|
1538 |
thus "\<exists>k. (r \<and>* ps p \<and>* st e \<and>* zero p \<and>* sg {TC i ((W0, e), W1, ?j)})
|
|
|
1539 |
(trset_of (tm.run (Suc k) (ft, prog, cs, pc, mem)))"
|
|
|
1540 |
by(auto simp: sep_conj_ac)
|
|
|
1541 |
qed
|
|
|
1542 |
qed
|
|
|
1543 |
qed
|
|
|
1544 |
|
|
|
1545 |
lemma hoare_if_zero_true_gen[step]:
|
|
|
1546 |
assumes "p = q"
|
|
|
1547 |
shows
|
|
|
1548 |
"\<lbrace>st i ** ps p ** zero q\<rbrace>
|
|
|
1549 |
i:[if_zero e]:j
|
|
|
1550 |
\<lbrace>st e ** ps p ** zero q\<rbrace>"
|
|
|
1551 |
by (unfold assms, rule hoare_if_zero_true)
|
|
|
1552 |
|
|
|
1553 |
lemma hoare_if_zero_true1:
|
|
|
1554 |
"\<lbrace>st i ** ps p ** zero p\<rbrace>
|
|
|
1555 |
i:[(if_zero e; c)]:j
|
|
|
1556 |
\<lbrace>st e ** ps p ** zero p\<rbrace>"
|
|
|
1557 |
proof(unfold tassemble_to.simps, rule tm.code_exI, simp add: sep_conj_ac
|
|
|
1558 |
tm.Hoare_gen_def, clarify)
|
|
|
1559 |
fix j' ft prog cs pos mem r
|
|
|
1560 |
assume h: "(r \<and>* ps p \<and>* st i \<and>* zero p \<and>* j' :[ c ]: j \<and>* i :[ if_zero e ]: j')
|
|
|
1561 |
(trset_of (ft, prog, cs, pos, mem))"
|
|
|
1562 |
from tm.frame_rule[OF hoare_if_zero_true]
|
|
|
1563 |
have "\<And> r. \<lbrace>st i \<and>* ps p \<and>* zero p \<and>* r\<rbrace> i :[ if_zero e ]: j' \<lbrace>st e \<and>* ps p \<and>* zero p \<and>* r\<rbrace>"
|
|
|
1564 |
by(simp add: sep_conj_ac)
|
|
|
1565 |
from this[unfolded tm.Hoare_gen_def tassemble_to.simps, rule_format, of "j' :[ c ]: j"] h
|
|
|
1566 |
have "\<exists> k. (r \<and>* zero p \<and>* ps p \<and>* st e \<and>* i :[ if_zero e ]: j' \<and>* j' :[ c ]: j)
|
|
|
1567 |
(trset_of (tm.run (Suc k) (ft, prog, cs, pos, mem)))"
|
|
|
1568 |
by(auto simp: sep_conj_ac)
|
|
|
1569 |
thus "\<exists>k. (r \<and>* ps p \<and>* st e \<and>* zero p \<and>* j' :[ c ]: j \<and>* i :[ if_zero e ]: j')
|
|
|
1570 |
(trset_of (tm.run (Suc k) (ft, prog, cs, pos, mem)))"
|
|
|
1571 |
by(simp add: sep_conj_ac)
|
|
|
1572 |
qed
|
|
|
1573 |
|
|
|
1574 |
lemma hoare_if_zero_true1_gen[step]:
|
|
|
1575 |
assumes "p = q"
|
|
|
1576 |
shows
|
|
|
1577 |
"\<lbrace>st i ** ps p ** zero q\<rbrace>
|
|
|
1578 |
i:[(if_zero e; c)]:j
|
|
|
1579 |
\<lbrace>st e ** ps p ** zero q\<rbrace>"
|
|
|
1580 |
by (unfold assms, rule hoare_if_zero_true1)
|
|
|
1581 |
|
|
|
1582 |
lemma hoare_if_zero_false:
|
|
|
1583 |
"\<lbrace>st i ** ps p ** tm p Oc\<rbrace>
|
|
|
1584 |
i:[if_zero e]:j
|
|
|
1585 |
\<lbrace>st j ** ps p ** tm p Oc\<rbrace>"
|
|
|
1586 |
proof(unfold if_zero_def, intro t_hoare_local, rule t_hoare_label_last, simp, simp)
|
|
|
1587 |
fix l
|
|
|
1588 |
show "\<lbrace>st i \<and>* ps p \<and>* tm p Oc\<rbrace> i :[ \<guillemotright> ((W0, e), W1, l) ]: l
|
|
|
1589 |
\<lbrace>st l \<and>* ps p \<and>* tm p Oc\<rbrace>"
|
|
|
1590 |
proof(unfold tassemble_to.simps, simp only:sep_conj_cond,
|
|
|
1591 |
intro tm.code_condI, simp add: sep_conj_ac)
|
|
|
1592 |
let ?j = "Suc i"
|
|
|
1593 |
show "\<lbrace>ps p \<and>* st i \<and>* tm p Oc\<rbrace> sg {TC i ((W0, e), W1, ?j)}
|
|
|
1594 |
\<lbrace>ps p \<and>* st ?j \<and>* tm p Oc\<rbrace>"
|
|
|
1595 |
proof(unfold tassemble_to.simps tm.Hoare_gen_def sep_conj_ac, clarify)
|
|
|
1596 |
fix ft prog cs pc mem r
|
|
|
1597 |
assume h: "(r \<and>* ps p \<and>* st i \<and>* tm p Oc \<and>* sg {TC i ((W0, e), W1, ?j)})
|
|
|
1598 |
(trset_of (ft, prog, cs, pc, mem))"
|
|
|
1599 |
from h have k1: "prog i = Some ((W0, e), W1, ?j)"
|
|
|
1600 |
apply(rule_tac r = "r \<and>* tm p Oc \<and>* ps p" in codeD)
|
|
|
1601 |
by(simp add: sep_conj_ac)
|
|
|
1602 |
from h have k2: "pc = p"
|
|
|
1603 |
by(sep_drule psD, simp)
|
|
|
1604 |
from h and this have k3: "mem pc = Some Oc"
|
|
|
1605 |
by(sep_drule memD, simp)
|
|
|
1606 |
from h k1 k2 k3 have stp:
|
|
|
1607 |
"tm.run 1 (ft, prog, cs, pc, mem) = (ft, prog, ?j, pc, mem)" (is "?x = ?y")
|
|
|
1608 |
apply(sep_drule stD)
|
|
|
1609 |
by(unfold tm.run_def, auto split:tstate.splits)
|
|
|
1610 |
from h k2
|
|
|
1611 |
have "(r \<and>* tm p Oc \<and>* ps p \<and>* st ?j \<and>* sg {TC i ((W0, e), W1, ?j)}) (trset_of ?x)"
|
|
|
1612 |
apply(unfold stp)
|
|
|
1613 |
by(sep_drule st_upd, simp add: sep_conj_ac)
|
|
|
1614 |
thus "\<exists>k. (r \<and>* ps p \<and>* st ?j \<and>* tm p Oc \<and>* sg {TC i ((W0, e), W1, ?j)})
|
|
|
1615 |
(trset_of (tm.run (Suc k) (ft, prog, cs, pc, mem)))"
|
|
|
1616 |
by(auto simp: sep_conj_ac)
|
|
|
1617 |
qed
|
|
|
1618 |
qed
|
|
|
1619 |
qed
|
|
|
1620 |
|
|
|
1621 |
lemma hoare_if_zero_false_gen[step]:
|
|
|
1622 |
assumes "p = q"
|
|
|
1623 |
shows
|
|
|
1624 |
"\<lbrace>st i ** ps p ** tm q Oc\<rbrace>
|
|
|
1625 |
i:[if_zero e]:j
|
|
|
1626 |
\<lbrace>st j ** ps p ** tm q Oc\<rbrace>"
|
|
|
1627 |
by (unfold assms, rule hoare_if_zero_false)
|
|
|
1628 |
|
|
|
1629 |
lemma hoare_jmp:
|
|
|
1630 |
"\<lbrace>st i \<and>* ps p \<and>* tm p v\<rbrace> i:[jmp e]:j \<lbrace>st e \<and>* ps p \<and>* tm p v\<rbrace>"
|
|
|
1631 |
proof(unfold jmp_def tm.Hoare_gen_def tassemble_to.simps sep_conj_ac, clarify)
|
|
|
1632 |
fix ft prog cs pos mem r
|
|
|
1633 |
assume h: "(r \<and>* ps p \<and>* st i \<and>* tm p v \<and>* <(j = i + 1)> \<and>* sg {TC i ((W0, e), W1, e)})
|
|
|
1634 |
(trset_of (ft, prog, cs, pos, mem))"
|
|
|
1635 |
from h have k1: "prog i = Some ((W0, e), W1, e)"
|
|
|
1636 |
apply(rule_tac r = "r \<and>* <(j = i + 1)> \<and>* tm p v \<and>* ps p" in codeD)
|
|
|
1637 |
by(simp add: sep_conj_ac)
|
|
|
1638 |
from h have k2: "p = pos"
|
|
|
1639 |
by(sep_drule psD, simp)
|
|
|
1640 |
from h k2 have k3: "mem pos = Some v"
|
|
|
1641 |
by(sep_drule memD, simp)
|
|
|
1642 |
from h k1 k2 k3 have
|
|
|
1643 |
stp: "tm.run 1 (ft, prog, cs, pos, mem) = (ft, prog, e, pos, mem)" (is "?x = ?y")
|
|
|
1644 |
apply(sep_drule stD)
|
|
|
1645 |
by(unfold tm.run_def, cases "mem pos", simp, cases v, auto)
|
|
|
1646 |
from h k2
|
|
|
1647 |
have "(r \<and>* ps p \<and>* st e \<and>* tm p v \<and>* <(j = i + 1)> \<and>*
|
|
|
1648 |
sg {TC i ((W0, e), W1, e)}) (trset_of ?x)"
|
|
|
1649 |
apply(unfold stp)
|
|
|
1650 |
by(sep_drule st_upd, simp add: sep_conj_ac)
|
|
|
1651 |
thus "\<exists> k. (r \<and>* ps p \<and>* st e \<and>* tm p v \<and>* <(j = i + 1)> \<and>* sg {TC i ((W0, e), W1, e)})
|
|
|
1652 |
(trset_of (tm.run (Suc k) (ft, prog, cs, pos, mem)))"
|
|
|
1653 |
apply (rule_tac x = 0 in exI)
|
|
|
1654 |
by auto
|
|
|
1655 |
qed
|
|
|
1656 |
|
|
|
1657 |
lemma hoare_jmp_gen[step]:
|
|
|
1658 |
assumes "p = q"
|
|
|
1659 |
shows "\<lbrace>st i \<and>* ps p \<and>* tm q v\<rbrace> i:[jmp e]:j \<lbrace>st e \<and>* ps p \<and>* tm q v\<rbrace>"
|
|
|
1660 |
by (unfold assms, rule hoare_jmp)
|
|
|
1661 |
|
|
|
1662 |
lemma hoare_jmp1:
|
|
|
1663 |
"\<lbrace>st i \<and>* ps p \<and>* tm p v\<rbrace>
|
|
|
1664 |
i:[(jmp e; c)]:j
|
|
|
1665 |
\<lbrace>st e \<and>* ps p \<and>* tm p v\<rbrace>"
|
|
|
1666 |
proof(unfold tassemble_to.simps, rule tm.code_exI, simp
|
|
|
1667 |
add: sep_conj_ac tm.Hoare_gen_def, clarify)
|
|
|
1668 |
fix j' ft prog cs pos mem r
|
|
|
1669 |
assume h: "(r \<and>* ps p \<and>* st i \<and>* tm p v \<and>* j' :[ c ]: j \<and>* i :[ jmp e ]: j')
|
|
|
1670 |
(trset_of (ft, prog, cs, pos, mem))"
|
|
|
1671 |
from tm.frame_rule[OF hoare_jmp]
|
|
|
1672 |
have "\<And> r. \<lbrace>st i \<and>* ps p \<and>* tm p v \<and>* r\<rbrace> i :[ jmp e ]: j' \<lbrace>st e \<and>* ps p \<and>* tm p v \<and>* r\<rbrace>"
|
|
|
1673 |
by(simp add: sep_conj_ac)
|
|
|
1674 |
from this[unfolded tm.Hoare_gen_def tassemble_to.simps, rule_format, of "j' :[ c ]: j"] h
|
|
|
1675 |
have "\<exists> k. (r \<and>* tm p v \<and>* ps p \<and>* st e \<and>* i :[ jmp e ]: j' \<and>* j' :[ c ]: j)
|
|
|
1676 |
(trset_of (tm.run (Suc k) (ft, prog, cs, pos, mem)))"
|
|
|
1677 |
by(auto simp: sep_conj_ac)
|
|
|
1678 |
thus "\<exists>k. (r \<and>* ps p \<and>* st e \<and>* tm p v \<and>* j' :[ c ]: j \<and>* i :[ jmp e ]: j')
|
|
|
1679 |
(trset_of (tm.run (Suc k) (ft, prog, cs, pos, mem)))"
|
|
|
1680 |
by(simp add: sep_conj_ac)
|
|
|
1681 |
qed
|
|
|
1682 |
|
|
|
1683 |
|
|
|
1684 |
lemma hoare_jmp1_gen[step]:
|
|
|
1685 |
assumes "p = q"
|
|
|
1686 |
shows "\<lbrace>st i \<and>* ps p \<and>* tm q v\<rbrace>
|
|
|
1687 |
i:[(jmp e; c)]:j
|
|
|
1688 |
\<lbrace>st e \<and>* ps p \<and>* tm q v\<rbrace>"
|
|
|
1689 |
by (unfold assms, rule hoare_jmp1)
|
|
|
1690 |
|
|
|
1691 |
|
|
|
1692 |
lemma condI:
|
|
|
1693 |
assumes h1: b
|
|
|
1694 |
and h2: "b \<Longrightarrow> p s"
|
|
|
1695 |
shows "(<b> \<and>* p) s"
|
|
|
1696 |
by (metis (full_types) cond_true_eq1 h1 h2)
|
|
|
1697 |
|
|
|
1698 |
lemma condE:
|
|
|
1699 |
assumes "(<b> \<and>* p) s"
|
|
|
1700 |
obtains "b" and "p s"
|
|
|
1701 |
proof(atomize_elim)
|
|
|
1702 |
from condD[OF assms]
|
|
|
1703 |
show "b \<and> p s" .
|
|
|
1704 |
qed
|
|
|
1705 |
|
|
|
1706 |
|
|
|
1707 |
section {* Tactics *}
|
|
|
1708 |
|
|
|
1709 |
ML {*
|
|
|
1710 |
val trace_step = Attrib.setup_config_bool @{binding trace_step} (K false)
|
|
|
1711 |
val trace_fwd = Attrib.setup_config_bool @{binding trace_fwd} (K false)
|
|
|
1712 |
*}
|
|
|
1713 |
|
|
|
1714 |
|
|
|
1715 |
ML {*
|
|
|
1716 |
val tracing = (fn ctxt => fn str =>
|
|
|
1717 |
if (Config.get ctxt trace_step) then tracing str else ())
|
|
|
1718 |
fun not_pred p = fn s => not (p s)
|
|
|
1719 |
fun break_sep_conj (Const (@{const_name sep_conj},_) $ t1 $ t2 $ _) =
|
|
|
1720 |
(break_sep_conj t1) @ (break_sep_conj t2)
|
|
|
1721 |
| break_sep_conj (Const (@{const_name sep_conj},_) $ t1 $ t2) =
|
|
|
1722 |
(break_sep_conj t1) @ (break_sep_conj t2)
|
|
|
1723 |
(* dig through eta exanded terms: *)
|
|
|
1724 |
| break_sep_conj (Abs (_, _, t $ Bound 0)) = break_sep_conj t
|
|
|
1725 |
| break_sep_conj t = [t];
|
|
|
1726 |
|
|
|
1727 |
val empty_env = (Vartab.empty, Vartab.empty)
|
|
|
1728 |
|
|
|
1729 |
fun match_env ctxt pat trm env =
|
|
|
1730 |
Pattern.match (ctxt |> Proof_Context.theory_of) (pat, trm) env
|
|
|
1731 |
|
|
|
1732 |
fun match ctxt pat trm = match_env ctxt pat trm empty_env;
|
|
|
1733 |
|
|
|
1734 |
val inst = Envir.subst_term;
|
|
|
1735 |
|
|
|
1736 |
fun term_of_thm thm = thm |> prop_of |> HOLogic.dest_Trueprop
|
|
|
1737 |
|
|
|
1738 |
fun get_cmd ctxt code =
|
|
|
1739 |
let val pat = term_of @{cpat "_:[(?cmd)]:_"}
|
|
|
1740 |
val pat1 = term_of @{cpat "?cmd::tpg"}
|
|
|
1741 |
val env = match ctxt pat code
|
|
|
1742 |
in inst env pat1 end
|
|
|
1743 |
|
|
|
1744 |
fun is_seq_term (Const (@{const_name TSeq}, _) $ _ $ _) = true
|
|
|
1745 |
| is_seq_term _ = false
|
|
|
1746 |
|
|
|
1747 |
fun get_hcmd (Const (@{const_name TSeq}, _) $ hcmd $ _) = hcmd
|
|
|
1748 |
| get_hcmd hcmd = hcmd
|
|
|
1749 |
|
|
|
1750 |
fun last [a] = a |
|
|
|
1751 |
last (a::b) = last b
|
|
|
1752 |
|
|
|
1753 |
fun but_last [a] = [] |
|
|
|
1754 |
but_last (a::b) = a::(but_last b)
|
|
|
1755 |
|
|
|
1756 |
fun foldr f [] = (fn x => x) |
|
|
|
1757 |
foldr f (x :: xs) = (f x) o (foldr f xs)
|
|
|
1758 |
|
|
|
1759 |
fun concat [] = [] |
|
|
|
1760 |
concat (x :: xs) = x @ concat xs
|
|
|
1761 |
|
|
|
1762 |
fun match_any ctxt pats tm =
|
|
|
1763 |
fold
|
|
|
1764 |
(fn pat => fn b => (b orelse Pattern.matches
|
|
|
1765 |
(ctxt |> Proof_Context.theory_of) (pat, tm)))
|
|
|
1766 |
pats false
|
|
|
1767 |
|
|
|
1768 |
fun is_ps_term (Const (@{const_name ps}, _) $ _) = true
|
|
|
1769 |
| is_ps_term _ = false
|
|
|
1770 |
|
|
|
1771 |
fun string_of_term ctxt t = t |> Syntax.pretty_term ctxt |> Pretty.str_of
|
|
|
1772 |
fun string_of_cterm ctxt ct = ct |> term_of |> string_of_term ctxt
|
|
|
1773 |
fun pterm ctxt t =
|
|
|
1774 |
t |> string_of_term ctxt |> tracing ctxt
|
|
|
1775 |
fun pcterm ctxt ct = ct |> string_of_cterm ctxt |> tracing ctxt
|
|
|
1776 |
fun string_for_term ctxt t =
|
|
|
1777 |
Print_Mode.setmp (filter (curry (op =) Symbol.xsymbolsN)
|
|
|
1778 |
(print_mode_value ())) (Syntax.string_of_term ctxt) t
|
|
|
1779 |
|> String.translate (fn c => if Char.isPrint c then str c else "")
|
|
|
1780 |
|> Sledgehammer_Util.simplify_spaces
|
|
|
1781 |
fun string_for_cterm ctxt ct = ct |> term_of |> string_for_term ctxt
|
|
|
1782 |
fun attemp tac = fn i => fn st => (tac i st) handle exn => Seq.empty
|
|
|
1783 |
fun try_tac tac = fn i => fn st => (tac i st) handle exn => (Seq.single st)
|
|
|
1784 |
(* aux end *)
|
|
|
1785 |
*}
|
|
|
1786 |
|
|
|
1787 |
ML {* (* Functions specific to Hoare triples *)
|
|
|
1788 |
fun get_pre ctxt t =
|
|
|
1789 |
let val pat = term_of @{cpat "\<lbrace>?P\<rbrace> ?c \<lbrace>?Q\<rbrace>"}
|
|
|
1790 |
val env = match ctxt pat t
|
|
|
1791 |
in inst env (term_of @{cpat "?P::tresource set \<Rightarrow> bool"}) end
|
|
|
1792 |
|
|
|
1793 |
fun can_process ctxt t = ((get_pre ctxt t; true) handle _ => false)
|
|
|
1794 |
|
|
|
1795 |
fun get_post ctxt t =
|
|
|
1796 |
let val pat = term_of @{cpat "\<lbrace>?P\<rbrace> ?c \<lbrace>?Q\<rbrace>"}
|
|
|
1797 |
val env = match ctxt pat t
|
|
|
1798 |
in inst env (term_of @{cpat "?Q::tresource set \<Rightarrow> bool"}) end;
|
|
|
1799 |
|
|
|
1800 |
fun get_mid ctxt t =
|
|
|
1801 |
let val pat = term_of @{cpat "\<lbrace>?P\<rbrace> ?c \<lbrace>?Q\<rbrace>"}
|
|
|
1802 |
val env = match ctxt pat t
|
|
|
1803 |
in inst env (term_of @{cpat "?c::tresource set \<Rightarrow> bool"}) end;
|
|
|
1804 |
|
|
|
1805 |
fun is_pc_term (Const (@{const_name st}, _) $ _) = true
|
|
|
1806 |
| is_pc_term _ = false
|
|
|
1807 |
|
|
|
1808 |
fun mk_pc_term x =
|
|
|
1809 |
Const (@{const_name st}, @{typ "nat \<Rightarrow> tresource set \<Rightarrow> bool"}) $ Free (x, @{typ "nat"})
|
|
|
1810 |
|
|
|
1811 |
val sconj_term = term_of @{cterm "sep_conj::tassert \<Rightarrow> tassert \<Rightarrow> tassert"}
|
|
|
1812 |
|
|
|
1813 |
fun mk_ps_term x =
|
|
|
1814 |
Const (@{const_name ps}, @{typ "int \<Rightarrow> tresource set \<Rightarrow> bool"}) $ Free (x, @{typ "int"})
|
|
|
1815 |
|
|
|
1816 |
fun atomic tac = ((SOLVED' tac) ORELSE' (K all_tac))
|
|
|
1817 |
|
|
|
1818 |
fun pure_sep_conj_ac_tac ctxt =
|
|
|
1819 |
(auto_tac (ctxt |> Simplifier.map_simpset (fn ss => ss addsimps @{thms sep_conj_ac}))
|
|
|
1820 |
|> SELECT_GOAL)
|
|
|
1821 |
|
|
|
1822 |
|
|
|
1823 |
fun potential_facts ctxt prop = Facts.could_unify (Proof_Context.facts_of ctxt)
|
|
|
1824 |
((Term.strip_all_body prop) |> Logic.strip_imp_concl);
|
|
|
1825 |
|
|
|
1826 |
fun some_fact_tac ctxt = SUBGOAL (fn (goal, i) =>
|
|
|
1827 |
(Method.insert_tac (potential_facts ctxt goal) i) THEN
|
|
|
1828 |
(pure_sep_conj_ac_tac ctxt i));
|
|
|
1829 |
|
|
|
1830 |
fun sep_conj_ac_tac ctxt =
|
|
|
1831 |
(SOLVED' (auto_tac (ctxt |> Simplifier.map_simpset (fn ss => ss addsimps @{thms sep_conj_ac}))
|
|
|
1832 |
|> SELECT_GOAL)) ORELSE' (atomic (some_fact_tac ctxt))
|
|
|
1833 |
*}
|
|
|
1834 |
|
|
|
1835 |
ML {*
|
|
|
1836 |
type HoareTriple = {
|
|
|
1837 |
binding: binding,
|
|
|
1838 |
can_process: Proof.context -> term -> bool,
|
|
|
1839 |
get_pre: Proof.context -> term -> term,
|
|
|
1840 |
get_mid: Proof.context -> term -> term,
|
|
|
1841 |
get_post: Proof.context -> term -> term,
|
|
|
1842 |
is_pc_term: term -> bool,
|
|
|
1843 |
mk_pc_term: string -> term,
|
|
|
1844 |
sconj_term: term,
|
|
|
1845 |
sep_conj_ac_tac: Proof.context -> int -> tactic,
|
|
|
1846 |
hoare_seq1: thm,
|
|
|
1847 |
hoare_seq2: thm,
|
|
|
1848 |
pre_stren: thm,
|
|
|
1849 |
post_weaken: thm,
|
|
|
1850 |
frame_rule: thm
|
|
|
1851 |
}
|
|
|
1852 |
|
|
|
1853 |
val tm_triple = {binding = @{binding "tm_triple"},
|
|
|
1854 |
can_process = can_process,
|
|
|
1855 |
get_pre = get_pre,
|
|
|
1856 |
get_mid = get_mid,
|
|
|
1857 |
get_post = get_post,
|
|
|
1858 |
is_pc_term = is_pc_term,
|
|
|
1859 |
mk_pc_term = mk_pc_term,
|
|
|
1860 |
sconj_term = sconj_term,
|
|
|
1861 |
sep_conj_ac_tac = sep_conj_ac_tac,
|
|
|
1862 |
hoare_seq1 = @{thm t_hoare_seq1},
|
|
|
1863 |
hoare_seq2 = @{thm t_hoare_seq2},
|
|
|
1864 |
pre_stren = @{thm tm.pre_stren},
|
|
|
1865 |
post_weaken = @{thm tm.post_weaken},
|
|
|
1866 |
frame_rule = @{thm tm.frame_rule}
|
|
|
1867 |
}:HoareTriple
|
|
|
1868 |
*}
|
|
|
1869 |
|
|
|
1870 |
ML {*
|
|
|
1871 |
val _ = data_slot "HoareTriples" "HoareTriple list" "[]"
|
|
|
1872 |
*}
|
|
|
1873 |
|
|
|
1874 |
ML {*
|
|
|
1875 |
val _ = HoareTriples_store [tm_triple]
|
|
|
1876 |
*}
|
|
|
1877 |
|
|
|
1878 |
ML {* (* aux1 functions *)
|
|
|
1879 |
|
|
|
1880 |
fun focus_params t ctxt =
|
|
|
1881 |
let
|
|
|
1882 |
val (xs, Ts) =
|
|
|
1883 |
split_list (Term.variant_frees t (Term.strip_all_vars t)); (*as they are printed :-*)
|
|
|
1884 |
(* val (xs', ctxt') = variant_fixes xs ctxt; *)
|
|
|
1885 |
(* val ps = xs' ~~ Ts; *)
|
|
|
1886 |
val ps = xs ~~ Ts
|
|
|
1887 |
val (_, ctxt'') = ctxt |> Variable.add_fixes xs
|
|
|
1888 |
in ((xs, ps), ctxt'') end
|
|
|
1889 |
|
|
|
1890 |
fun focus_concl ctxt t =
|
|
|
1891 |
let
|
|
|
1892 |
val ((xs, ps), ctxt') = focus_params t ctxt
|
|
|
1893 |
val t' = Term.subst_bounds (rev (map Free ps), Term.strip_all_body t);
|
|
|
1894 |
in (t' |> Logic.strip_imp_concl, ctxt') end
|
|
|
1895 |
|
|
|
1896 |
fun get_concl ctxt (i, state) =
|
|
|
1897 |
nth (Thm.prems_of state) (i - 1)
|
|
|
1898 |
|> focus_concl ctxt |> (fn (x, _) => x |> HOLogic.dest_Trueprop)
|
|
|
1899 |
(* aux1 end *)
|
|
|
1900 |
*}
|
|
|
1901 |
|
|
|
1902 |
ML {*
|
|
|
1903 |
fun indexing xs = upto (0, length xs - 1) ~~ xs
|
|
|
1904 |
fun select_idxs idxs ps =
|
|
|
1905 |
map_index (fn (i, e) => if (member (op =) idxs i) then [e] else []) ps |> flat
|
|
|
1906 |
fun select_out_idxs idxs ps =
|
|
|
1907 |
map_index (fn (i, e) => if (member (op =) idxs i) then [] else [e]) ps |> flat
|
|
|
1908 |
fun match_pres ctxt mf env ps qs =
|
|
|
1909 |
let fun sel_match mf env [] qs = [(env, [])]
|
|
|
1910 |
| sel_match mf env (p::ps) qs =
|
|
|
1911 |
let val pm = map (fn (i, q) => [(i,
|
|
|
1912 |
let val _ = tracing ctxt "Matching:"
|
|
|
1913 |
val _ = [p, q] |>
|
|
|
1914 |
(pretty_terms ctxt) |> Pretty.str_of |> tracing ctxt
|
|
|
1915 |
val r = mf p q env
|
|
|
1916 |
in r end)]
|
|
|
1917 |
handle _ => (
|
|
|
1918 |
let val _ = tracing ctxt "Failed matching:"
|
|
|
1919 |
val _ = [p, q] |>
|
|
|
1920 |
(pretty_terms ctxt) |> Pretty.str_of |> tracing ctxt
|
|
|
1921 |
in [] end)) qs |> flat
|
|
|
1922 |
val r = pm |> map (fn (i, env') =>
|
|
|
1923 |
let val qs' = filter_out (fn (j, q) => j = i) qs
|
|
|
1924 |
in sel_match mf env' ps qs' |>
|
|
|
1925 |
map (fn (env'', idxs) => (env'', i::idxs)) end)
|
|
|
1926 |
|> flat
|
|
|
1927 |
in r end
|
|
|
1928 |
in sel_match mf env ps (indexing qs) end
|
|
|
1929 |
|
|
|
1930 |
fun provable tac ctxt goal =
|
|
|
1931 |
let
|
|
|
1932 |
val _ = tracing ctxt "Provable trying to prove:"
|
|
|
1933 |
val _ = [goal] |> (pretty_terms ctxt) |> Pretty.str_of |> tracing ctxt
|
|
|
1934 |
in
|
|
|
1935 |
(Goal.prove ctxt [] [] goal (fn {context, ...} => tac context 1); true)
|
|
|
1936 |
handle exn => false
|
|
|
1937 |
end
|
|
|
1938 |
fun make_sense tac ctxt thm_assms env =
|
|
|
1939 |
thm_assms |> map (inst env) |> forall (provable tac ctxt)
|
|
|
1940 |
*}
|
|
|
1941 |
|
|
|
1942 |
ML {*
|
|
|
1943 |
fun triple_for ctxt goal =
|
|
|
1944 |
filter (fn trpl => (#can_process trpl) ctxt goal) (HoareTriples.get (Proof_Context.theory_of ctxt)) |> hd
|
|
|
1945 |
|
|
|
1946 |
fun step_terms_for thm goal ctxt =
|
|
|
1947 |
let
|
|
|
1948 |
val _ = tracing ctxt "This is the new version of step_terms_for!"
|
|
|
1949 |
val _ = tracing ctxt "Tring to find triple processor: TP"
|
|
|
1950 |
val TP = triple_for ctxt goal
|
|
|
1951 |
val _ = #binding TP |> Binding.name_of |> tracing ctxt
|
|
|
1952 |
fun mk_sep_conj tms = foldr (fn tm => fn rtm =>
|
|
|
1953 |
((#sconj_term TP)$tm$rtm)) (but_last tms) (last tms)
|
|
|
1954 |
val thm_concl = thm |> prop_of
|
|
|
1955 |
|> Logic.strip_imp_concl |> HOLogic.dest_Trueprop
|
|
|
1956 |
val thm_assms = thm |> prop_of
|
|
|
1957 |
|> Logic.strip_imp_prems
|
|
|
1958 |
val cmd_pat = thm_concl |> #get_mid TP ctxt |> get_cmd ctxt
|
|
|
1959 |
val cmd = goal |> #get_mid TP ctxt |> get_cmd ctxt
|
|
|
1960 |
val _ = tracing ctxt "matching command ... "
|
|
|
1961 |
val _ = tracing ctxt "cmd_pat = "
|
|
|
1962 |
val _ = pterm ctxt cmd_pat
|
|
|
1963 |
val (hcmd, env1, is_last) = (cmd, match ctxt cmd_pat cmd, true)
|
|
|
1964 |
handle exn => (cmd |> get_hcmd, match ctxt cmd_pat (cmd |> get_hcmd), false)
|
|
|
1965 |
val _ = tracing ctxt "hcmd ="
|
|
|
1966 |
val _ = pterm ctxt hcmd
|
|
|
1967 |
val _ = tracing ctxt "match command succeed! "
|
|
|
1968 |
val _ = tracing ctxt "pres ="
|
|
|
1969 |
val pres = goal |> #get_pre TP ctxt |> break_sep_conj
|
|
|
1970 |
val _ = pres |> (pretty_terms ctxt) |> Pretty.str_of |> tracing ctxt
|
|
|
1971 |
val _ = tracing ctxt "pre_pats ="
|
|
|
1972 |
val pre_pats = thm_concl |> #get_pre TP ctxt |> inst env1 |> break_sep_conj
|
|
|
1973 |
val _ = pre_pats |> (pretty_terms ctxt) |> Pretty.str_of |> tracing ctxt
|
|
|
1974 |
val _ = tracing ctxt "post_pats ="
|
|
|
1975 |
val post_pats = thm_concl |> #get_post TP ctxt |> inst env1 |> break_sep_conj
|
|
|
1976 |
val _ = post_pats |> (pretty_terms ctxt) |> Pretty.str_of |> tracing ctxt
|
|
|
1977 |
val _ = tracing ctxt "Calculating sols"
|
|
|
1978 |
val sols = match_pres ctxt (match_env ctxt) env1 pre_pats pres
|
|
|
1979 |
val _ = tracing ctxt "End calculating sols, sols ="
|
|
|
1980 |
val _ = tracing ctxt (@{make_string} sols)
|
|
|
1981 |
val _ = tracing ctxt "Calulating env2 and idxs"
|
|
|
1982 |
val (env2, idxs) = filter (fn (env, idxs) => make_sense (#sep_conj_ac_tac TP)
|
|
|
1983 |
ctxt thm_assms env) sols |> hd
|
|
|
1984 |
val _ = tracing ctxt "End calculating env2 and idxs"
|
|
|
1985 |
val _ = tracing ctxt "mterms ="
|
|
|
1986 |
val mterms = select_idxs idxs pres |> map (inst env2)
|
|
|
1987 |
val _ = mterms |> (pretty_terms ctxt) |> Pretty.str_of |> tracing ctxt
|
|
|
1988 |
val _ = tracing ctxt "nmterms = "
|
|
|
1989 |
val nmterms = select_out_idxs idxs pres |> map (inst env2)
|
|
|
1990 |
val _ = nmterms |> (pretty_terms ctxt) |> Pretty.str_of |> tracing ctxt
|
|
|
1991 |
val pre_cond = pre_pats |> map (inst env2) |> mk_sep_conj
|
|
|
1992 |
val post_cond = post_pats |> map (inst env2) |> mk_sep_conj
|
|
|
1993 |
val post_cond_npc =
|
|
|
1994 |
post_cond |> break_sep_conj |> filter (not_pred (#is_pc_term TP))
|
|
|
1995 |
|> (fn x => x @ nmterms) |> mk_sep_conj |> cterm_of (Proof_Context.theory_of ctxt)
|
|
|
1996 |
fun mk_frame cond rest =
|
|
|
1997 |
if rest = [] then cond else ((#sconj_term TP)$ cond) $ (mk_sep_conj rest)
|
|
|
1998 |
val pre_cond_frame = mk_frame pre_cond nmterms |> cterm_of (Proof_Context.theory_of ctxt)
|
|
|
1999 |
fun post_cond_frame j' = post_cond |> break_sep_conj |> filter (not_pred (#is_pc_term TP))
|
|
|
2000 |
|> (fn x => [#mk_pc_term TP j']@x) |> mk_sep_conj
|
|
|
2001 |
|> (fn x => mk_frame x nmterms)
|
|
|
2002 |
|> cterm_of (Proof_Context.theory_of ctxt)
|
|
|
2003 |
val need_frame = (nmterms <> [])
|
|
|
2004 |
in
|
|
|
2005 |
(post_cond_npc,
|
|
|
2006 |
pre_cond_frame,
|
|
|
2007 |
post_cond_frame, need_frame, is_last)
|
|
|
2008 |
end
|
|
|
2009 |
*}
|
|
|
2010 |
|
|
|
2011 |
ML {*
|
|
|
2012 |
fun step_tac ctxt thm i state =
|
|
|
2013 |
let
|
|
|
2014 |
val _ = tracing ctxt "This is the new version of step_tac"
|
|
|
2015 |
val (goal, ctxt) = nth (Thm.prems_of state) (i - 1)
|
|
|
2016 |
|> focus_concl ctxt
|
|
|
2017 |
|> (apfst HOLogic.dest_Trueprop)
|
|
|
2018 |
val _ = tracing ctxt "step_tac: goal = "
|
|
|
2019 |
val _ = goal |> pterm ctxt
|
|
|
2020 |
val _ = tracing ctxt "Start to calculate intermediate terms ... "
|
|
|
2021 |
val (post_cond_npc, pre_cond_frame, post_cond_frame, need_frame, is_last)
|
|
|
2022 |
= step_terms_for thm goal ctxt
|
|
|
2023 |
val _ = tracing ctxt "Tring to find triple processor: TP"
|
|
|
2024 |
val TP = triple_for ctxt goal
|
|
|
2025 |
val _ = #binding TP |> Binding.name_of |> tracing ctxt
|
|
|
2026 |
fun mk_sep_conj tms = foldr (fn tm => fn rtm =>
|
|
|
2027 |
((#sconj_term TP)$tm$rtm)) (but_last tms) (last tms)
|
|
|
2028 |
val _ = tracing ctxt "Calculate intermediate terms finished! "
|
|
|
2029 |
val post_cond_npc_str = post_cond_npc |> string_for_cterm ctxt
|
|
|
2030 |
val pre_cond_frame_str = pre_cond_frame |> string_for_cterm ctxt
|
|
|
2031 |
val _ = tracing ctxt "step_tac: post_cond_npc = "
|
|
|
2032 |
val _ = post_cond_npc |> pcterm ctxt
|
|
|
2033 |
val _ = tracing ctxt "step_tac: pre_cond_frame = "
|
|
|
2034 |
val _ = pre_cond_frame |> pcterm ctxt
|
|
|
2035 |
fun tac1 i state =
|
|
|
2036 |
if is_last then (K all_tac) i state else
|
|
|
2037 |
res_inst_tac ctxt [(("q", 0), post_cond_npc_str)]
|
|
|
2038 |
(#hoare_seq1 TP) i state
|
|
|
2039 |
fun tac2 i state = res_inst_tac ctxt [(("p", 0), pre_cond_frame_str)]
|
|
|
2040 |
(#pre_stren TP) i state
|
|
|
2041 |
fun foc_tac post_cond_frame ctxt i state =
|
|
|
2042 |
let
|
|
|
2043 |
val goal = get_concl ctxt (i, state)
|
|
|
2044 |
val pc_term = goal |> #get_post TP ctxt |> break_sep_conj
|
|
|
2045 |
|> filter (#is_pc_term TP) |> hd
|
|
|
2046 |
val (_$Free(j', _)) = pc_term
|
|
|
2047 |
val psd = post_cond_frame j'
|
|
|
2048 |
val str_psd = psd |> string_for_cterm ctxt
|
|
|
2049 |
val _ = tracing ctxt "foc_tac: psd = "
|
|
|
2050 |
val _ = psd |> pcterm ctxt
|
|
|
2051 |
in
|
|
|
2052 |
res_inst_tac ctxt [(("q", 0), str_psd)]
|
|
|
2053 |
(#post_weaken TP) i state
|
|
|
2054 |
end
|
|
|
2055 |
val frame_tac = if need_frame then (rtac (#frame_rule TP)) else (K all_tac)
|
|
|
2056 |
val print_tac = if (Config.get ctxt trace_step) then Tactical.print_tac else (K all_tac)
|
|
|
2057 |
val tac = (tac1 THEN' (K (print_tac "tac1 success"))) THEN'
|
|
|
2058 |
(tac2 THEN' (K (print_tac "tac2 success"))) THEN'
|
|
|
2059 |
((foc_tac post_cond_frame ctxt) THEN' (K (print_tac "foc_tac success"))) THEN'
|
|
|
2060 |
(frame_tac THEN' (K (print_tac "frame_tac success"))) THEN'
|
|
|
2061 |
(((rtac thm) THEN_ALL_NEW (#sep_conj_ac_tac TP ctxt)) THEN' (K (print_tac "rtac thm success"))) THEN'
|
|
|
2062 |
(K (ALLGOALS (atomic (#sep_conj_ac_tac TP ctxt)))) THEN'
|
|
|
2063 |
(* (#sep_conj_ac_tac TP ctxt) THEN' (#sep_conj_ac_tac TP ctxt) THEN' *)
|
|
|
2064 |
(K prune_params_tac)
|
|
|
2065 |
in
|
|
|
2066 |
tac i state
|
|
|
2067 |
end
|
|
|
2068 |
|
|
|
2069 |
fun unfold_cell_tac ctxt = (Local_Defs.unfold_tac ctxt @{thms one_def zero_def})
|
|
|
2070 |
fun fold_cell_tac ctxt = (Local_Defs.fold_tac ctxt @{thms one_def zero_def})
|
|
|
2071 |
*}
|
|
|
2072 |
|
|
|
2073 |
ML {*
|
|
|
2074 |
fun sg_step_tac thms ctxt =
|
|
|
2075 |
let val sg_step_tac' = (map (fn thm => attemp (step_tac ctxt thm)) thms)
|
|
|
2076 |
(* @ [attemp (goto_tac ctxt)] *)
|
|
|
2077 |
|> FIRST'
|
|
|
2078 |
val sg_step_tac'' = (K (unfold_cell_tac ctxt)) THEN' sg_step_tac' THEN' (K (fold_cell_tac ctxt))
|
|
|
2079 |
in
|
|
|
2080 |
sg_step_tac' ORELSE' sg_step_tac''
|
|
|
2081 |
end
|
|
|
2082 |
fun steps_tac thms ctxt i = REPEAT (sg_step_tac thms ctxt i) THEN (prune_params_tac)
|
|
|
2083 |
*}
|
|
|
2084 |
|
|
|
2085 |
ML {*
|
|
|
2086 |
open StackMonad
|
|
|
2087 |
*}
|
|
|
2088 |
|
|
|
2089 |
method_setup hstep = {*
|
|
|
2090 |
Attrib.thms >> (fn thms => fn ctxt =>
|
|
|
2091 |
(SIMPLE_METHOD' (fn i =>
|
|
|
2092 |
sg_step_tac (thms@(StepRules.get ctxt)) ctxt i)))
|
|
|
2093 |
*}
|
|
|
2094 |
"One step symbolic execution using step theorems."
|
|
|
2095 |
|
|
|
2096 |
method_setup hsteps = {*
|
|
|
2097 |
Attrib.thms >> (fn thms => fn ctxt =>
|
|
|
2098 |
(SIMPLE_METHOD' (fn i =>
|
|
|
2099 |
steps_tac (thms@(StepRules.get ctxt)) ctxt i)))
|
|
|
2100 |
*}
|
|
|
2101 |
"Sequential symbolic execution using step theorems."
|
|
|
2102 |
|
|
|
2103 |
ML {*
|
|
|
2104 |
fun goto_tac ctxt thm i state =
|
|
|
2105 |
let
|
|
|
2106 |
val (goal, ctxt) = nth (Thm.prems_of state) (i - 1)
|
|
|
2107 |
|> focus_concl ctxt |> (apfst HOLogic.dest_Trueprop)
|
|
|
2108 |
val _ = tracing ctxt "goto_tac: goal = "
|
|
|
2109 |
val _ = goal |> string_of_term ctxt |> tracing ctxt
|
|
|
2110 |
val (post_cond_npc, pre_cond_frame, post_cond_frame, need_frame, is_last)
|
|
|
2111 |
= step_terms_for thm goal ctxt
|
|
|
2112 |
val _ = tracing ctxt "Tring to find triple processor: TP"
|
|
|
2113 |
val TP = triple_for ctxt goal
|
|
|
2114 |
val _ = #binding TP |> Binding.name_of |> tracing ctxt
|
|
|
2115 |
val _ = tracing ctxt "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
|
|
2116 |
val post_cond_npc_str = post_cond_npc |> string_for_cterm ctxt
|
|
|
2117 |
val pre_cond_frame_str = pre_cond_frame |> string_for_cterm ctxt
|
|
|
2118 |
val _ = tracing ctxt "goto_tac: post_cond_npc = "
|
|
|
2119 |
val _ = post_cond_npc_str |> tracing ctxt
|
|
|
2120 |
val _ = tracing ctxt "goto_tac: pre_cond_frame = "
|
|
|
2121 |
val _ = pre_cond_frame_str |> tracing ctxt
|
|
|
2122 |
fun tac1 i state =
|
|
|
2123 |
if is_last then (K all_tac) i state else
|
|
|
2124 |
res_inst_tac ctxt []
|
|
|
2125 |
(#hoare_seq2 TP) i state
|
|
|
2126 |
fun tac2 i state = res_inst_tac ctxt [(("p", 0), pre_cond_frame_str)]
|
|
|
2127 |
(#pre_stren TP) i state
|
|
|
2128 |
fun foc_tac post_cond_frame ctxt i state =
|
|
|
2129 |
let
|
|
|
2130 |
val goal = get_concl ctxt (i, state)
|
|
|
2131 |
val pc_term = goal |> #get_post TP ctxt |> break_sep_conj
|
|
|
2132 |
|> filter (#is_pc_term TP) |> hd
|
|
|
2133 |
val (_$Free(j', _)) = pc_term
|
|
|
2134 |
val psd = post_cond_frame j'
|
|
|
2135 |
val str_psd = psd |> string_for_cterm ctxt
|
|
|
2136 |
val _ = tracing ctxt "goto_tac: psd = "
|
|
|
2137 |
val _ = str_psd |> tracing ctxt
|
|
|
2138 |
in
|
|
|
2139 |
res_inst_tac ctxt [(("q", 0), str_psd)]
|
|
|
2140 |
(#post_weaken TP) i state
|
|
|
2141 |
end
|
|
|
2142 |
val frame_tac = if need_frame then (rtac (#frame_rule TP)) else (K all_tac)
|
|
|
2143 |
val _ = tracing ctxt "goto_tac: starting to apply tacs"
|
|
|
2144 |
val print_tac = if (Config.get ctxt trace_step) then Tactical.print_tac else (K all_tac)
|
|
|
2145 |
val tac = (tac1 THEN' (K (print_tac "tac1 success"))) THEN'
|
|
|
2146 |
(tac2 THEN' (K (print_tac "tac2 success"))) THEN'
|
|
|
2147 |
((foc_tac post_cond_frame ctxt) THEN' (K (print_tac "foc_tac success"))) THEN'
|
|
|
2148 |
(frame_tac THEN' (K (print_tac "frame_tac success"))) THEN'
|
|
|
2149 |
((((rtac thm) THEN_ALL_NEW (#sep_conj_ac_tac TP ctxt))) THEN'
|
|
|
2150 |
(K (print_tac "rtac success"))
|
|
|
2151 |
) THEN'
|
|
|
2152 |
(K (ALLGOALS (atomic (#sep_conj_ac_tac TP ctxt)))) THEN'
|
|
|
2153 |
(K prune_params_tac)
|
|
|
2154 |
in
|
|
|
2155 |
tac i state
|
|
|
2156 |
end
|
|
|
2157 |
*}
|
|
|
2158 |
|
|
|
2159 |
ML {*
|
|
|
2160 |
fun sg_goto_tac thms ctxt =
|
|
|
2161 |
let val sg_goto_tac' = (map (fn thm => attemp (goto_tac ctxt thm)) thms)
|
|
|
2162 |
|> FIRST'
|
|
|
2163 |
val sg_goto_tac'' = (K (unfold_cell_tac ctxt)) THEN' sg_goto_tac' THEN' (K (fold_cell_tac ctxt))
|
|
|
2164 |
in
|
|
|
2165 |
sg_goto_tac' ORELSE' sg_goto_tac''
|
|
|
2166 |
end
|
|
|
2167 |
fun gotos_tac thms ctxt i = REPEAT (sg_goto_tac thms ctxt i) THEN (prune_params_tac)
|
|
|
2168 |
*}
|
|
|
2169 |
|
|
|
2170 |
method_setup hgoto = {*
|
|
|
2171 |
Attrib.thms >> (fn thms => fn ctxt =>
|
|
|
2172 |
(SIMPLE_METHOD' (fn i =>
|
|
|
2173 |
sg_goto_tac (thms@(StepRules.get ctxt)) ctxt i)))
|
|
|
2174 |
*}
|
|
|
2175 |
"One step symbolic execution using goto theorems."
|
|
|
2176 |
|
|
|
2177 |
subsection {* Tactic for forward reasoning *}
|
|
|
2178 |
|
|
|
2179 |
ML {*
|
|
|
2180 |
fun mk_msel_rule ctxt conclusion idx term =
|
|
|
2181 |
let
|
|
|
2182 |
val cjt_count = term |> break_sep_conj |> length
|
|
|
2183 |
fun variants nctxt names = fold_map Name.variant names nctxt;
|
|
|
2184 |
|
|
|
2185 |
val (state, nctxt0) = Name.variant "s" (Variable.names_of ctxt);
|
|
|
2186 |
|
|
|
2187 |
fun sep_conj_prop cjts =
|
|
|
2188 |
FunApp.fun_app_free
|
|
|
2189 |
(FunApp.fun_app_foldr SepConj.sep_conj_term cjts) state
|
|
|
2190 |
|> HOLogic.mk_Trueprop;
|
|
|
2191 |
|
|
|
2192 |
(* concatenate string and string of an int *)
|
|
|
2193 |
fun conc_str_int str int = str ^ Int.toString int;
|
|
|
2194 |
|
|
|
2195 |
(* make the conjunct names *)
|
|
|
2196 |
val (cjts, _) = ListExtra.range 1 cjt_count
|
|
|
2197 |
|> map (conc_str_int "a") |> variants nctxt0;
|
|
|
2198 |
|
|
|
2199 |
fun skel_sep_conj names (Const (@{const_name sep_conj}, _) $ t1 $ t2 $ y) =
|
|
|
2200 |
(let val nm1 = take (length (break_sep_conj t1)) names
|
|
|
2201 |
val nm2 = drop (length (break_sep_conj t1)) names
|
|
|
2202 |
val t1' = skel_sep_conj nm1 t1
|
|
|
2203 |
val t2' = skel_sep_conj nm2 t2
|
|
|
2204 |
in (SepConj.sep_conj_term $ t1' $ t2' $ y) end)
|
|
|
2205 |
| skel_sep_conj names (Const (@{const_name sep_conj}, _) $ t1 $ t2) =
|
|
|
2206 |
(let val nm1 = take (length (break_sep_conj t1)) names
|
|
|
2207 |
val nm2 = drop (length (break_sep_conj t1)) names
|
|
|
2208 |
val t1' = skel_sep_conj nm1 t1
|
|
|
2209 |
val t2' = skel_sep_conj nm2 t2
|
|
|
2210 |
in (SepConj.sep_conj_term $ t1' $ t2') end)
|
|
|
2211 |
| skel_sep_conj names (Abs (x, y, t $ Bound 0)) =
|
|
|
2212 |
let val t' = (skel_sep_conj names t)
|
|
|
2213 |
val ty' = t' |> type_of |> domain_type
|
|
|
2214 |
in (Abs (x, ty', (t' $ Bound 0))) end
|
|
|
2215 |
| skel_sep_conj names t = Free (hd names, SepConj.sep_conj_term |> type_of |> domain_type);
|
|
|
2216 |
val _ = tracing ctxt "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
|
|
2217 |
val oskel = skel_sep_conj cjts term;
|
|
|
2218 |
val _ = tracing ctxt "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"
|
|
|
2219 |
val ttt = oskel |> type_of
|
|
|
2220 |
val _ = tracing ctxt "zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"
|
|
|
2221 |
val orig = FunApp.fun_app_free oskel state |> HOLogic.mk_Trueprop
|
|
|
2222 |
val _ = tracing ctxt "uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu"
|
|
|
2223 |
val is_selected = member (fn (x, y) => x = y) idx
|
|
|
2224 |
val all_idx = ListExtra.range 0 cjt_count
|
|
|
2225 |
val selected_idx = idx
|
|
|
2226 |
val unselected_idx = filter_out is_selected all_idx
|
|
|
2227 |
val selected = map (nth cjts) selected_idx
|
|
|
2228 |
val unselected = map (nth cjts) unselected_idx
|
|
|
2229 |
|
|
|
2230 |
fun fun_app_foldr f [a,b] = FunApp.fun_app_free (FunApp.fun_app_free f a) b
|
|
|
2231 |
| fun_app_foldr f [a] = Free (a, SepConj.sep_conj_term |> type_of |> domain_type)
|
|
|
2232 |
| fun_app_foldr f (x::xs) = (FunApp.fun_app_free f x) $ (fun_app_foldr f xs)
|
|
|
2233 |
| fun_app_foldr _ _ = raise Fail "fun_app_foldr";
|
|
|
2234 |
|
|
|
2235 |
val reordered_skel =
|
|
|
2236 |
if unselected = [] then (fun_app_foldr SepConj.sep_conj_term selected)
|
|
|
2237 |
else (SepConj.sep_conj_term $ (fun_app_foldr SepConj.sep_conj_term selected)
|
|
|
2238 |
$ (fun_app_foldr SepConj.sep_conj_term unselected))
|
|
|
2239 |
|
|
|
2240 |
val reordered = FunApp.fun_app_free reordered_skel state |> HOLogic.mk_Trueprop
|
|
|
2241 |
val goal = Logic.mk_implies
|
|
|
2242 |
(if conclusion then (orig, reordered) else (reordered, orig));
|
|
|
2243 |
val rule =
|
|
|
2244 |
Goal.prove ctxt [] [] goal (fn _ =>
|
|
|
2245 |
auto_tac (ctxt |> Simplifier.map_simpset (fn ss => ss addsimps @{thms sep_conj_ac})))
|
|
|
2246 |
|> Drule.export_without_context
|
|
|
2247 |
in
|
|
|
2248 |
rule
|
|
|
2249 |
end
|
|
|
2250 |
*}
|
|
|
2251 |
|
|
|
2252 |
lemma fwd_rule:
|
|
|
2253 |
assumes "\<And> s . U s \<longrightarrow> V s"
|
|
|
2254 |
shows "(U ** RR) s \<Longrightarrow> (V ** RR) s"
|
|
|
2255 |
by (metis assms sep_globalise)
|
|
|
2256 |
|
|
|
2257 |
ML {*
|
|
|
2258 |
fun sg_sg_fwd_tac ctxt thm pos i state =
|
|
|
2259 |
let
|
|
|
2260 |
|
|
|
2261 |
val tracing = (fn str =>
|
|
|
2262 |
if (Config.get ctxt trace_fwd) then Output.tracing str else ())
|
|
|
2263 |
fun pterm t =
|
|
|
2264 |
t |> string_of_term ctxt |> tracing
|
|
|
2265 |
fun pcterm ct = ct |> string_of_cterm ctxt |> tracing
|
|
|
2266 |
|
|
|
2267 |
fun atm thm =
|
|
|
2268 |
let
|
|
|
2269 |
(* val thm = thm |> Drule.forall_intr_vars *)
|
|
|
2270 |
val res = thm |> cprop_of |> Object_Logic.atomize
|
|
|
2271 |
val res' = Raw_Simplifier.rewrite_rule [res] thm
|
|
|
2272 |
in res' end
|
|
|
2273 |
|
|
|
2274 |
fun find_idx ctxt pats terms =
|
|
|
2275 |
let val result =
|
|
|
2276 |
map (fn pat => (find_index (fn trm => ((match ctxt pat trm; true)
|
|
|
2277 |
handle _ => false)) terms)) pats
|
|
|
2278 |
in (assert_all (fn x => x >= 0) result (K "match of precondition failed"));
|
|
|
2279 |
result
|
|
|
2280 |
end
|
|
|
2281 |
|
|
|
2282 |
val goal = nth (Drule.cprems_of state) (i - 1) |> term_of
|
|
|
2283 |
val _ = tracing "goal = "
|
|
|
2284 |
val _ = goal |> pterm
|
|
|
2285 |
|
|
|
2286 |
val ctxt_orig = ctxt
|
|
|
2287 |
|
|
|
2288 |
val ((ps, goal), ctxt) = Variable.focus goal ctxt_orig
|
|
|
2289 |
|
|
|
2290 |
val prems = goal |> Logic.strip_imp_prems
|
|
|
2291 |
|
|
|
2292 |
val cprem = nth prems (pos - 1)
|
|
|
2293 |
val (_ $ (the_prem $ _)) = cprem
|
|
|
2294 |
val cjts = the_prem |> break_sep_conj
|
|
|
2295 |
val thm_prems = thm |> cprems_of |> hd |> Thm.dest_arg |> Thm.dest_fun
|
|
|
2296 |
val thm_assms = thm |> cprems_of |> tl |> map term_of
|
|
|
2297 |
val thm_cjts = thm_prems |> term_of |> break_sep_conj
|
|
|
2298 |
val thm_trm = thm |> prop_of
|
|
|
2299 |
|
|
|
2300 |
val _ = tracing "cjts = "
|
|
|
2301 |
val _ = cjts |> map pterm
|
|
|
2302 |
val _ = tracing "thm_cjts = "
|
|
|
2303 |
val _ = thm_cjts |> map pterm
|
|
|
2304 |
|
|
|
2305 |
val _ = tracing "Calculating sols"
|
|
|
2306 |
val sols = match_pres ctxt (match_env ctxt) empty_env thm_cjts cjts
|
|
|
2307 |
val _ = tracing "End calculating sols, sols ="
|
|
|
2308 |
val _ = tracing (@{make_string} sols)
|
|
|
2309 |
val _ = tracing "Calulating env2 and idxs"
|
|
|
2310 |
val (env2, idx) = filter (fn (env, idxs) => make_sense sep_conj_ac_tac ctxt thm_assms env) sols |> hd
|
|
|
2311 |
val ([thm'_trm], ctxt') = thm_trm |> inst env2 |> single
|
|
|
2312 |
|> (fn trms => Variable.import_terms true trms ctxt)
|
|
|
2313 |
val thm'_prem = Logic.strip_imp_prems thm'_trm |> hd
|
|
|
2314 |
val thm'_concl = Logic.strip_imp_concl thm'_trm
|
|
|
2315 |
val thm'_prem = (Goal.prove ctxt' [] [thm'_prem] thm'_concl
|
|
|
2316 |
(fn {context, prems = [prem]} =>
|
|
|
2317 |
(rtac (prem RS thm) THEN_ALL_NEW (sep_conj_ac_tac ctxt)) 1))
|
|
|
2318 |
val [thm'] = Variable.export ctxt' ctxt_orig [thm'_prem]
|
|
|
2319 |
val trans_rule =
|
|
|
2320 |
mk_msel_rule ctxt true idx the_prem
|
|
|
2321 |
val _ = tracing "trans_rule = "
|
|
|
2322 |
val _ = trans_rule |> cprop_of |> pcterm
|
|
|
2323 |
val app_rule =
|
|
|
2324 |
if (length cjts = length thm_cjts) then thm' else
|
|
|
2325 |
((thm' |> atm) RS @{thm fwd_rule})
|
|
|
2326 |
val _ = tracing "app_rule = "
|
|
|
2327 |
val _ = app_rule |> cprop_of |> pcterm
|
|
|
2328 |
val print_tac = if (Config.get ctxt trace_fwd) then Tactical.print_tac else (K all_tac)
|
|
|
2329 |
val the_tac = (dtac trans_rule THEN' (K (print_tac "dtac1 success"))) THEN'
|
|
|
2330 |
((dtac app_rule THEN' (K (print_tac "dtac2 success"))))
|
|
|
2331 |
in
|
|
|
2332 |
(the_tac i state) handle _ => no_tac state
|
|
|
2333 |
end
|
|
|
2334 |
*}
|
|
|
2335 |
|
|
|
2336 |
ML {*
|
|
|
2337 |
fun sg_fwd_tac ctxt thm i state =
|
|
|
2338 |
let
|
|
|
2339 |
val goal = nth (Drule.cprems_of state) (i - 1)
|
|
|
2340 |
val prems = goal |> term_of |> Term.strip_all_body |> Logic.strip_imp_prems
|
|
|
2341 |
val posx = ListExtra.range 1 (length prems)
|
|
|
2342 |
in
|
|
|
2343 |
((map (fn pos => attemp (sg_sg_fwd_tac ctxt thm pos)) posx) |> FIRST') i state
|
|
|
2344 |
end
|
|
|
2345 |
|
|
|
2346 |
fun fwd_tac ctxt thms i state =
|
|
|
2347 |
((map (fn thm => sg_fwd_tac ctxt thm) thms) |> FIRST') i state
|
|
|
2348 |
*}
|
|
|
2349 |
|
|
|
2350 |
method_setup fwd = {*
|
|
|
2351 |
Attrib.thms >> (fn thms => fn ctxt =>
|
|
|
2352 |
(SIMPLE_METHOD' (fn i =>
|
|
|
2353 |
fwd_tac ctxt (thms@(FwdRules.get ctxt)) i)))
|
|
|
2354 |
*}
|
|
|
2355 |
"Forward derivation of separation implication"
|
|
|
2356 |
|
|
|
2357 |
text {* Testing the fwd tactic *}
|
|
|
2358 |
|
|
|
2359 |
lemma ones_abs:
|
|
|
2360 |
assumes "(ones u v \<and>* ones w x) s" "w = v + 1"
|
|
|
2361 |
shows "ones u x s"
|
|
|
2362 |
using assms(1) unfolding assms(2)
|
|
|
2363 |
proof(induct u v arbitrary: x s rule:ones_induct)
|
|
|
2364 |
case (Base i j x s)
|
|
|
2365 |
thus ?case by (auto elim!:condE)
|
|
|
2366 |
next
|
|
|
2367 |
case (Step i j x s)
|
|
|
2368 |
hence h: "\<And> x s. (ones (i + 1) j \<and>* ones (j + 1) x) s \<longrightarrow> ones (i + 1) x s"
|
|
|
2369 |
by metis
|
|
|
2370 |
hence "(ones (i + 1) x \<and>* one i) s"
|
|
|
2371 |
by (rule fwd_rule, insert Step(3), auto simp:sep_conj_ac)
|
|
|
2372 |
thus ?case
|
|
|
2373 |
by (smt condD ones.simps sep_conj_commute)
|
|
|
2374 |
qed
|
|
|
2375 |
|
|
|
2376 |
lemma one_abs: "(one m) s \<Longrightarrow> (ones m m) s"
|
|
|
2377 |
by (smt cond_true_eq2 ones.simps)
|
|
|
2378 |
|
|
|
2379 |
lemma ones_reps_abs:
|
|
|
2380 |
assumes "ones m n s"
|
|
|
2381 |
"m \<le> n"
|
|
|
2382 |
shows "(reps m n [nat (n - m)]) s"
|
|
|
2383 |
using assms
|
|
|
2384 |
by simp
|
|
|
2385 |
|
|
|
2386 |
lemma reps_reps'_abs:
|
|
|
2387 |
assumes "(reps m n xs \<and>* zero u) s" "u = n + 1" "xs \<noteq> []"
|
|
|
2388 |
shows "(reps' m u xs) s"
|
|
|
2389 |
unfolding assms using assms
|
|
|
2390 |
by (unfold reps'_def, simp)
|
|
|
2391 |
|
|
|
2392 |
lemma reps'_abs:
|
|
|
2393 |
assumes "(reps' m n xs \<and>* reps' u v ys) s" "u = n + 1"
|
|
|
2394 |
shows "(reps' m v (xs @ ys)) s"
|
|
|
2395 |
apply (unfold reps'_append, rule_tac x = u in EXS_intro)
|
|
|
2396 |
by (insert assms, simp)
|
|
|
2397 |
|
|
|
2398 |
lemmas abs_ones = one_abs ones_abs
|
|
|
2399 |
|
|
|
2400 |
lemmas abs_reps' = ones_reps_abs reps_reps'_abs reps'_abs
|
|
|
2401 |
|
|
|
2402 |
|
|
|
2403 |
section {* Modular TM programming and verification *}
|
|
|
2404 |
|
|
|
2405 |
lemma ones_false [simp]: "j < i - 1 \<Longrightarrow> (ones i j) = sep_false"
|
|
|
2406 |
by (simp add:pasrt_def)
|
|
|
2407 |
|
|
|
2408 |
lemma hoare_right_until_zero:
|
|
|
2409 |
"\<lbrace>st i ** ps u ** ones u (v - 1) ** zero v \<rbrace>
|
|
|
2410 |
i:[right_until_zero]:j
|
|
|
2411 |
\<lbrace>st j ** ps v ** ones u (v - 1) ** zero v \<rbrace>"
|
|
|
2412 |
proof(unfold right_until_zero_def,
|
|
|
2413 |
intro t_hoare_local t_hoare_label, clarify,
|
|
|
2414 |
rule t_hoare_label_last, simp, simp)
|
|
|
2415 |
fix la
|
|
|
2416 |
let ?body = "i :[ (if_zero la ; move_right ; jmp i) ]: la"
|
|
|
2417 |
let ?j = la
|
|
|
2418 |
show "\<lbrace>st i \<and>* ps u \<and>* ones u (v - 1) \<and>* zero v\<rbrace> ?body
|
|
|
2419 |
\<lbrace>st ?j \<and>* ps v \<and>* ones u (v - 1) \<and>* zero v\<rbrace>" (is "?P u (v - 1) (ones u (v - 1))")
|
|
|
2420 |
proof(induct "u" "v - 1" rule:ones_induct)
|
|
|
2421 |
case (Base k)
|
|
|
2422 |
moreover have "\<lbrace>st i \<and>* ps v \<and>* zero v\<rbrace> ?body
|
|
|
2423 |
\<lbrace>st ?j \<and>* ps v \<and>* zero v\<rbrace>" by hsteps
|
|
|
2424 |
ultimately show ?case by (auto intro!:tm.pre_condI simp:sep_conj_cond)
|
|
|
2425 |
next
|
|
|
2426 |
case (Step k)
|
|
|
2427 |
moreover have "\<lbrace>st i \<and>* ps k \<and>* (one k \<and>* ones (k + 1) (v - 1)) \<and>* zero v\<rbrace>
|
|
|
2428 |
i :[ (if_zero ?j ; move_right ; jmp i) ]: ?j
|
|
|
2429 |
\<lbrace>st ?j \<and>* ps v \<and>* (one k \<and>* ones (k + 1) (v - 1)) \<and>* zero v\<rbrace>"
|
|
|
2430 |
proof -
|
|
|
2431 |
have s1: "\<lbrace>st i \<and>* ps k \<and>* (one k \<and>* ones (k + 1) (v - 1)) \<and>* zero v\<rbrace>
|
|
|
2432 |
?body
|
|
|
2433 |
\<lbrace>st i \<and>* ps (k + 1) \<and>* one k \<and>* ones (k + 1) (v - 1) \<and>* zero v\<rbrace>"
|
|
|
2434 |
proof(cases "k + 1 \<ge> v")
|
|
|
2435 |
case True
|
|
|
2436 |
with Step(1) have "v = k + 1" by arith
|
|
|
2437 |
thus ?thesis
|
|
|
2438 |
apply(simp add: one_def)
|
|
|
2439 |
by hsteps
|
|
|
2440 |
next
|
|
|
2441 |
case False
|
|
|
2442 |
hence eq_ones: "ones (k + 1) (v - 1) =
|
|
|
2443 |
(one (k + 1) \<and>* ones ((k + 1) + 1) (v - 1))"
|
|
|
2444 |
by simp
|
|
|
2445 |
show ?thesis
|
|
|
2446 |
apply(simp only: eq_ones)
|
|
|
2447 |
by hsteps
|
|
|
2448 |
qed
|
|
|
2449 |
note Step(2)[step]
|
|
|
2450 |
have s2: "\<lbrace>st i \<and>* ps (k + 1) \<and>* one k \<and>* ones (k + 1) (v - 1) \<and>* zero v\<rbrace>
|
|
|
2451 |
?body
|
|
|
2452 |
\<lbrace>st ?j \<and>* ps v \<and>* one k \<and>* ones (k + 1) (v - 1) \<and>* zero v\<rbrace>"
|
|
|
2453 |
by hsteps
|
|
|
2454 |
from tm.sequencing [OF s1 s2, step]
|
|
|
2455 |
show ?thesis
|
|
|
2456 |
by (auto simp:sep_conj_ac)
|
|
|
2457 |
qed
|
|
|
2458 |
ultimately show ?case by simp
|
|
|
2459 |
qed
|
|
|
2460 |
qed
|
|
|
2461 |
|
|
|
2462 |
lemma hoare_right_until_zero_gen[step]:
|
|
|
2463 |
assumes "u = v" "w = x - 1"
|
|
|
2464 |
shows "\<lbrace>st i ** ps u ** ones v w ** zero x \<rbrace>
|
|
|
2465 |
i:[right_until_zero]:j
|
|
|
2466 |
\<lbrace>st j ** ps x ** ones v w ** zero x \<rbrace>"
|
|
|
2467 |
by (unfold assms, rule hoare_right_until_zero)
|
|
|
2468 |
|
|
|
2469 |
lemma hoare_left_until_zero:
|
|
|
2470 |
"\<lbrace>st i ** ps v ** zero u ** ones (u + 1) v \<rbrace>
|
|
|
2471 |
i:[left_until_zero]:j
|
|
|
2472 |
\<lbrace>st j ** ps u ** zero u ** ones (u + 1) v \<rbrace>"
|
|
|
2473 |
proof(unfold left_until_zero_def,
|
|
|
2474 |
intro t_hoare_local t_hoare_label, clarify,
|
|
|
2475 |
rule t_hoare_label_last, simp+)
|
|
|
2476 |
fix la
|
|
|
2477 |
let ?body = "i :[ (if_zero la ; move_left ; jmp i) ]: la"
|
|
|
2478 |
let ?j = la
|
|
|
2479 |
show "\<lbrace>st i \<and>* ps v \<and>* zero u \<and>* ones (u + 1) v\<rbrace> ?body
|
|
|
2480 |
\<lbrace>st ?j \<and>* ps u \<and>* zero u \<and>* ones (u + 1) v\<rbrace>"
|
|
|
2481 |
proof(induct "u+1" v rule:ones_rev_induct)
|
|
|
2482 |
case (Base k)
|
|
|
2483 |
thus ?case
|
|
|
2484 |
by (simp add:sep_conj_cond, intro tm.pre_condI, simp, hstep)
|
|
|
2485 |
next
|
|
|
2486 |
case (Step k)
|
|
|
2487 |
have "\<lbrace>st i \<and>* ps k \<and>* zero u \<and>* ones (u + 1) (k - 1) \<and>* one k\<rbrace>
|
|
|
2488 |
?body
|
|
|
2489 |
\<lbrace>st ?j \<and>* ps u \<and>* zero u \<and>* ones (u + 1) (k - 1) \<and>* one k\<rbrace>"
|
|
|
2490 |
proof(rule tm.sequencing[where q =
|
|
|
2491 |
"st i \<and>* ps (k - 1) \<and>* zero u \<and>* ones (u + 1) (k - 1) \<and>* one k"])
|
|
|
2492 |
show "\<lbrace>st i \<and>* ps k \<and>* zero u \<and>* ones (u + 1) (k - 1) \<and>* one k\<rbrace>
|
|
|
2493 |
?body
|
|
|
2494 |
\<lbrace>st i \<and>* ps (k - 1) \<and>* zero u \<and>* ones (u + 1) (k - 1) \<and>* one k\<rbrace>"
|
|
|
2495 |
proof(induct "u + 1" "k - 1" rule:ones_rev_induct)
|
|
|
2496 |
case Base with Step(1) have "k = u + 1" by arith
|
|
|
2497 |
thus ?thesis
|
|
|
2498 |
by (simp, hsteps)
|
|
|
2499 |
next
|
|
|
2500 |
case Step
|
|
|
2501 |
show ?thesis
|
|
|
2502 |
apply (unfold ones_rev[OF Step(1)], simp)
|
|
|
2503 |
apply (unfold one_def)
|
|
|
2504 |
by hsteps
|
|
|
2505 |
qed
|
|
|
2506 |
next
|
|
|
2507 |
note Step(2) [step]
|
|
|
2508 |
show "\<lbrace>st i \<and>* ps (k - 1) \<and>* zero u \<and>* ones (u + 1) (k - 1) \<and>* one k\<rbrace>
|
|
|
2509 |
?body
|
|
|
2510 |
\<lbrace>st ?j \<and>* ps u \<and>* zero u \<and>* ones (u + 1) (k - 1) \<and>* one k\<rbrace>" by hsteps
|
|
|
2511 |
qed
|
|
|
2512 |
thus ?case by (unfold ones_rev[OF Step(1)], simp)
|
|
|
2513 |
qed
|
|
|
2514 |
qed
|
|
|
2515 |
|
|
|
2516 |
lemma hoare_left_until_zero_gen[step]:
|
|
|
2517 |
assumes "u = x" "w = v + 1"
|
|
|
2518 |
shows "\<lbrace>st i ** ps u ** zero v ** ones w x \<rbrace>
|
|
|
2519 |
i:[left_until_zero]:j
|
|
|
2520 |
\<lbrace>st j ** ps v ** zero v ** ones w x \<rbrace>"
|
|
|
2521 |
by (unfold assms, rule hoare_left_until_zero)
|
|
|
2522 |
|
|
|
2523 |
lemma hoare_right_until_one:
|
|
|
2524 |
"\<lbrace>st i ** ps u ** zeros u (v - 1) ** one v \<rbrace>
|
|
|
2525 |
i:[right_until_one]:j
|
|
|
2526 |
\<lbrace>st j ** ps v ** zeros u (v - 1) ** one v \<rbrace>"
|
|
|
2527 |
proof(unfold right_until_one_def,
|
|
|
2528 |
intro t_hoare_local t_hoare_label, clarify,
|
|
|
2529 |
rule t_hoare_label_last, simp+)
|
|
|
2530 |
fix la
|
|
|
2531 |
let ?body = "i :[ (if_one la ; move_right ; jmp i) ]: la"
|
|
|
2532 |
let ?j = la
|
|
|
2533 |
show "\<lbrace>st i \<and>* ps u \<and>* zeros u (v - 1) \<and>* one v\<rbrace> ?body
|
|
|
2534 |
\<lbrace>st ?j \<and>* ps v \<and>* zeros u (v - 1) \<and>* one v\<rbrace>"
|
|
|
2535 |
proof(induct u "v - 1" rule:zeros_induct)
|
|
|
2536 |
case (Base k)
|
|
|
2537 |
thus ?case
|
|
|
2538 |
by (simp add:sep_conj_cond, intro tm.pre_condI, simp, hsteps)
|
|
|
2539 |
next
|
|
|
2540 |
case (Step k)
|
|
|
2541 |
have "\<lbrace>st i \<and>* ps k \<and>* zero k \<and>* zeros (k + 1) (v - 1) \<and>* one v\<rbrace>
|
|
|
2542 |
?body
|
|
|
2543 |
\<lbrace>st ?j \<and>* ps v \<and>* zero k \<and>* zeros (k + 1) (v - 1) \<and>* one v\<rbrace>"
|
|
|
2544 |
proof(rule tm.sequencing[where q =
|
|
|
2545 |
"st i \<and>* ps (k + 1) \<and>* zero k \<and>* zeros (k + 1) (v - 1) \<and>* one v"])
|
|
|
2546 |
show "\<lbrace>st i \<and>* ps k \<and>* zero k \<and>* zeros (k + 1) (v - 1) \<and>* one v\<rbrace>
|
|
|
2547 |
?body
|
|
|
2548 |
\<lbrace>st i \<and>* ps (k + 1) \<and>* zero k \<and>* zeros (k + 1) (v - 1) \<and>* one v\<rbrace>"
|
|
|
2549 |
proof(induct "k + 1" "v - 1" rule:zeros_induct)
|
|
|
2550 |
case Base
|
|
|
2551 |
with Step(1) have eq_v: "k + 1 = v" by arith
|
|
|
2552 |
from Base show ?thesis
|
|
|
2553 |
apply (simp add:sep_conj_cond, intro tm.pre_condI, simp)
|
|
|
2554 |
apply (hstep, clarsimp)
|
|
|
2555 |
by hsteps
|
|
|
2556 |
next
|
|
|
2557 |
case Step
|
|
|
2558 |
thus ?thesis
|
|
|
2559 |
by (simp, hsteps)
|
|
|
2560 |
qed
|
|
|
2561 |
next
|
|
|
2562 |
note Step(2)[step]
|
|
|
2563 |
show "\<lbrace>st i \<and>* ps (k + 1) \<and>* zero k \<and>* zeros (k + 1) (v - 1) \<and>* one v\<rbrace>
|
|
|
2564 |
?body
|
|
|
2565 |
\<lbrace>st ?j \<and>* ps v \<and>* zero k \<and>* zeros (k + 1) (v - 1) \<and>* one v\<rbrace>"
|
|
|
2566 |
by hsteps
|
|
|
2567 |
qed
|
|
|
2568 |
thus ?case by (auto simp: sep_conj_ac Step(1))
|
|
|
2569 |
qed
|
|
|
2570 |
qed
|
|
|
2571 |
|
|
|
2572 |
lemma hoare_right_until_one_gen[step]:
|
|
|
2573 |
assumes "u = v" "w = x - 1"
|
|
|
2574 |
shows
|
|
|
2575 |
"\<lbrace>st i ** ps u ** zeros v w ** one x \<rbrace>
|
|
|
2576 |
i:[right_until_one]:j
|
|
|
2577 |
\<lbrace>st j ** ps x ** zeros v w ** one x \<rbrace>"
|
|
|
2578 |
by (unfold assms, rule hoare_right_until_one)
|
|
|
2579 |
|
|
|
2580 |
lemma hoare_left_until_one:
|
|
|
2581 |
"\<lbrace>st i ** ps v ** one u ** zeros (u + 1) v \<rbrace>
|
|
|
2582 |
i:[left_until_one]:j
|
|
|
2583 |
\<lbrace>st j ** ps u ** one u ** zeros (u + 1) v \<rbrace>"
|
|
|
2584 |
proof(unfold left_until_one_def,
|
|
|
2585 |
intro t_hoare_local t_hoare_label, clarify,
|
|
|
2586 |
rule t_hoare_label_last, simp+)
|
|
|
2587 |
fix la
|
|
|
2588 |
let ?body = "i :[ (if_one la ; move_left ; jmp i) ]: la"
|
|
|
2589 |
let ?j = la
|
|
|
2590 |
show "\<lbrace>st i \<and>* ps v \<and>* one u \<and>* zeros (u + 1) v\<rbrace> ?body
|
|
|
2591 |
\<lbrace>st ?j \<and>* ps u \<and>* one u \<and>* zeros (u + 1) v\<rbrace>"
|
|
|
2592 |
proof(induct u v rule: ones'.induct)
|
|
|
2593 |
fix ia ja
|
|
|
2594 |
assume h: "\<not> ja < ia \<Longrightarrow>
|
|
|
2595 |
\<lbrace>st i \<and>* ps (ja - 1) \<and>* one ia \<and>* zeros (ia + 1) (ja - 1)\<rbrace> ?body
|
|
|
2596 |
\<lbrace>st ?j \<and>* ps ia \<and>* one ia \<and>* zeros (ia + 1) (ja - 1)\<rbrace>"
|
|
|
2597 |
show "\<lbrace>st i \<and>* ps ja \<and>* one ia \<and>* zeros (ia + 1) ja\<rbrace> ?body
|
|
|
2598 |
\<lbrace>st ?j \<and>* ps ia \<and>* one ia \<and>* zeros (ia + 1) ja\<rbrace>"
|
|
|
2599 |
proof(cases "ja < ia")
|
|
|
2600 |
case False
|
|
|
2601 |
note lt = False
|
|
|
2602 |
from h[OF this] have [step]:
|
|
|
2603 |
"\<lbrace>st i \<and>* ps (ja - 1) \<and>* one ia \<and>* zeros (ia + 1) (ja - 1)\<rbrace> ?body
|
|
|
2604 |
\<lbrace>st ?j \<and>* ps ia \<and>* one ia \<and>* zeros (ia + 1) (ja - 1)\<rbrace>" .
|
|
|
2605 |
show ?thesis
|
|
|
2606 |
proof(cases "ja = ia")
|
|
|
2607 |
case True
|
|
|
2608 |
moreover
|
|
|
2609 |
have "\<lbrace>st i \<and>* ps ja \<and>* one ja\<rbrace> ?body \<lbrace>st ?j \<and>* ps ja \<and>* one ja\<rbrace>"
|
|
|
2610 |
by hsteps
|
|
|
2611 |
ultimately show ?thesis by auto
|
|
|
2612 |
next
|
|
|
2613 |
case False
|
|
|
2614 |
with lt have k1: "ia < ja" by auto
|
|
|
2615 |
from zeros_rev[of "ja" "ia + 1"] this
|
|
|
2616 |
have eq_zeros: "zeros (ia + 1) ja = (zeros (ia + 1) (ja - 1) \<and>* zero ja)"
|
|
|
2617 |
by simp
|
|
|
2618 |
have s1: "\<lbrace>st i \<and>* ps ja \<and>* one ia \<and>* zeros (ia + 1) (ja - 1) \<and>* zero ja\<rbrace>
|
|
|
2619 |
?body
|
|
|
2620 |
\<lbrace>st i \<and>* ps (ja - 1) \<and>* one ia \<and>* zeros (ia + 1) (ja - 1) \<and>* zero ja\<rbrace>"
|
|
|
2621 |
proof(cases "ia + 1 \<ge> ja")
|
|
|
2622 |
case True
|
|
|
2623 |
from k1 True have "ja = ia + 1" by arith
|
|
|
2624 |
moreover have "\<lbrace>st i \<and>* ps (ia + 1) \<and>* one (ia + 1 - 1) \<and>* zero (ia + 1)\<rbrace>
|
|
|
2625 |
i :[ (if_one ?j ; move_left ; jmp i) ]: ?j
|
|
|
2626 |
\<lbrace>st i \<and>* ps (ia + 1 - 1) \<and>* one (ia + 1 - 1) \<and>* zero (ia + 1)\<rbrace>"
|
|
|
2627 |
by (hsteps)
|
|
|
2628 |
ultimately show ?thesis
|
|
|
2629 |
by (simp)
|
|
|
2630 |
next
|
|
|
2631 |
case False
|
|
|
2632 |
from zeros_rev[of "ja - 1" "ia + 1"] False
|
|
|
2633 |
have k: "zeros (ia + 1) (ja - 1) =
|
|
|
2634 |
(zeros (ia + 1) (ja - 1 - 1) \<and>* zero (ja - 1))"
|
|
|
2635 |
by auto
|
|
|
2636 |
show ?thesis
|
|
|
2637 |
apply (unfold k, simp)
|
|
|
2638 |
by hsteps
|
|
|
2639 |
qed
|
|
|
2640 |
have s2: "\<lbrace>st i \<and>* ps (ja - 1) \<and>* one ia \<and>* zeros (ia + 1) (ja - 1) \<and>* zero ja\<rbrace>
|
|
|
2641 |
?body
|
|
|
2642 |
\<lbrace>st ?j \<and>* ps ia \<and>* one ia \<and>* zeros (ia + 1) (ja - 1) \<and>* zero ja\<rbrace>"
|
|
|
2643 |
by hsteps
|
|
|
2644 |
from tm.sequencing[OF s1 s2, step]
|
|
|
2645 |
show ?thesis
|
|
|
2646 |
apply (unfold eq_zeros)
|
|
|
2647 |
by hstep
|
|
|
2648 |
qed (* ccc *)
|
|
|
2649 |
next
|
|
|
2650 |
case True
|
|
|
2651 |
thus ?thesis by (auto intro:tm.hoare_sep_false)
|
|
|
2652 |
qed
|
|
|
2653 |
qed
|
|
|
2654 |
qed
|
|
|
2655 |
|
|
|
2656 |
lemma hoare_left_until_one_gen[step]:
|
|
|
2657 |
assumes "u = x" "w = v + 1"
|
|
|
2658 |
shows "\<lbrace>st i ** ps u ** one v ** zeros w x \<rbrace>
|
|
|
2659 |
i:[left_until_one]:j
|
|
|
2660 |
\<lbrace>st j ** ps v ** one v ** zeros w x \<rbrace>"
|
|
|
2661 |
by (unfold assms, rule hoare_left_until_one)
|
|
|
2662 |
|
|
|
2663 |
declare ones.simps[simp del]
|
|
|
2664 |
|
|
|
2665 |
lemma reps_simps3: "ks \<noteq> [] \<Longrightarrow>
|
|
|
2666 |
reps i j (k # ks) = (ones i (i + int k) ** zero (i + int k + 1) ** reps (i + int k + 2) j ks)"
|
|
|
2667 |
by(case_tac ks, simp, simp add: reps.simps)
|
|
|
2668 |
|
|
|
2669 |
lemma cond_eqI:
|
|
|
2670 |
assumes h: "b \<Longrightarrow> r = s"
|
|
|
2671 |
shows "(<b> ** r) = (<b> ** s)"
|
|
|
2672 |
proof(cases b)
|
|
|
2673 |
case True
|
|
|
2674 |
from h[OF this] show ?thesis by simp
|
|
|
2675 |
next
|
|
|
2676 |
case False
|
|
|
2677 |
thus ?thesis
|
|
|
2678 |
by (unfold sep_conj_def set_ins_def pasrt_def, auto)
|
|
|
2679 |
qed
|
|
|
2680 |
|
|
|
2681 |
lemma reps_rev: "ks \<noteq> []
|
|
|
2682 |
\<Longrightarrow> reps i j (ks @ [k]) = (reps i (j - int (k + 1) - 1 ) ks \<and>*
|
|
|
2683 |
zero (j - int (k + 1)) \<and>* ones (j - int k) j)"
|
|
|
2684 |
proof(induct ks arbitrary: i j)
|
|
|
2685 |
case Nil
|
|
|
2686 |
thus ?case by simp
|
|
|
2687 |
next
|
|
|
2688 |
case (Cons a ks)
|
|
|
2689 |
show ?case
|
|
|
2690 |
proof(cases "ks = []")
|
|
|
2691 |
case True
|
|
|
2692 |
thus ?thesis
|
|
|
2693 |
proof -
|
|
|
2694 |
have eq_cond: "(j = i + int a + 2 + int k) = (-2 + (j - int k) = i + int a)" by auto
|
|
|
2695 |
have "(<(-2 + (j - int k) = i + int a)> \<and>*
|
|
|
2696 |
one i \<and>* ones (i + 1) (i + int a) \<and>*
|
|
|
2697 |
zero (i + int a + 1) \<and>* one (i + int a + 2) \<and>* ones (3 + (i + int a)) (i + int a + 2 + int k))
|
|
|
2698 |
=
|
|
|
2699 |
(<(-2 + (j - int k) = i + int a)> \<and>* one i \<and>* ones (i + 1) (i + int a) \<and>*
|
|
|
2700 |
zero (j - (1 + int k)) \<and>* one (j - int k) \<and>* ones (j - int k + 1) j)"
|
|
|
2701 |
(is "(<?X> \<and>* ?L) = (<?X> \<and>* ?R)")
|
|
|
2702 |
proof(rule cond_eqI)
|
|
|
2703 |
assume h: "-2 + (j - int k) = i + int a"
|
|
|
2704 |
hence eqs: "i + int a + 1 = j - (1 + int k)"
|
|
|
2705 |
"i + int a + 2 = j - int k"
|
|
|
2706 |
"3 + (i + int a) = j - int k + 1"
|
|
|
2707 |
"(i + int a + 2 + int k) = j"
|
|
|
2708 |
by auto
|
|
|
2709 |
show "?L = ?R"
|
|
|
2710 |
by (unfold eqs, auto simp:sep_conj_ac)
|
|
|
2711 |
qed
|
|
|
2712 |
with True
|
|
|
2713 |
show ?thesis
|
|
|
2714 |
apply (simp del:ones_simps reps.simps)
|
|
|
2715 |
apply (simp add:sep_conj_cond eq_cond)
|
|
|
2716 |
by (auto simp:sep_conj_ac)
|
|
|
2717 |
qed
|
|
|
2718 |
next
|
|
|
2719 |
case False
|
|
|
2720 |
from Cons(1)[OF False, of "i + int a + 2" j] this
|
|
|
2721 |
show ?thesis
|
|
|
2722 |
by(simp add: reps_simps3 sep_conj_ac)
|
|
|
2723 |
qed
|
|
|
2724 |
qed
|
|
|
2725 |
|
|
|
2726 |
lemma hoare_if_one_reps:
|
|
|
2727 |
assumes nn: "ks \<noteq> []"
|
|
|
2728 |
shows "\<lbrace>st i ** ps v ** reps u v ks\<rbrace>
|
|
|
2729 |
i:[if_one e]:j
|
|
|
2730 |
\<lbrace>st e ** ps v ** reps u v ks\<rbrace>"
|
|
|
2731 |
proof(rule rev_exhaust[of ks])
|
|
|
2732 |
assume "ks = []" with nn show ?thesis by simp
|
|
|
2733 |
next
|
|
|
2734 |
fix y ys
|
|
|
2735 |
assume eq_ks: "ks = ys @ [y]"
|
|
|
2736 |
show " \<lbrace>st i \<and>* ps v \<and>* reps u v ks\<rbrace> i :[ if_one e ]: j \<lbrace>st e \<and>* ps v \<and>* reps u v ks\<rbrace>"
|
|
|
2737 |
proof(cases "ys = []")
|
|
|
2738 |
case False
|
|
|
2739 |
have "\<lbrace>st i \<and>* ps v \<and>* reps u v (ys @ [y])\<rbrace> i :[ if_one e ]: j \<lbrace>st e \<and>* ps v \<and>* reps u v (ys @ [y])\<rbrace>"
|
|
|
2740 |
apply(unfold reps_rev[OF False], simp del:ones_simps add:ones_rev)
|
|
|
2741 |
by hstep
|
|
|
2742 |
thus ?thesis
|
|
|
2743 |
by (simp add:eq_ks)
|
|
|
2744 |
next
|
|
|
2745 |
case True
|
|
|
2746 |
with eq_ks
|
|
|
2747 |
show ?thesis
|
|
|
2748 |
apply (simp del:ones_simps add:ones_rev sep_conj_cond, intro tm.pre_condI, simp)
|
|
|
2749 |
by hstep
|
|
|
2750 |
qed
|
|
|
2751 |
qed
|
|
|
2752 |
|
|
|
2753 |
lemma hoare_if_one_reps_gen[step]:
|
|
|
2754 |
assumes nn: "ks \<noteq> []" "u = w"
|
|
|
2755 |
shows "\<lbrace>st i ** ps u ** reps v w ks\<rbrace>
|
|
|
2756 |
i:[if_one e]:j
|
|
|
2757 |
\<lbrace>st e ** ps u ** reps v w ks\<rbrace>"
|
|
|
2758 |
by (unfold `u = w`, rule hoare_if_one_reps[OF `ks \<noteq> []`])
|
|
|
2759 |
|
|
|
2760 |
lemma hoare_if_zero_ones_false[step]:
|
|
|
2761 |
assumes "\<not> w < u" "v = w"
|
|
|
2762 |
shows "\<lbrace>st i \<and>* ps v \<and>* ones u w\<rbrace>
|
|
|
2763 |
i :[if_zero e]: j
|
|
|
2764 |
\<lbrace>st j \<and>* ps v \<and>* ones u w\<rbrace>"
|
|
|
2765 |
by (unfold `v = w` ones_rev[OF `\<not> w < u`], hstep)
|
|
|
2766 |
|
|
|
2767 |
lemma hoare_left_until_double_zero_nil[step]:
|
|
|
2768 |
assumes "u = v"
|
|
|
2769 |
shows "\<lbrace>st i ** ps u ** zero v\<rbrace>
|
|
|
2770 |
i:[left_until_double_zero]:j
|
|
|
2771 |
\<lbrace>st j ** ps u ** zero v\<rbrace>"
|
|
|
2772 |
apply (unfold `u = v` left_until_double_zero_def,
|
|
|
2773 |
intro t_hoare_local t_hoare_label, clarsimp,
|
|
|
2774 |
rule t_hoare_label_last, simp+)
|
|
|
2775 |
by (hsteps)
|
|
|
2776 |
|
|
|
2777 |
lemma hoare_if_zero_reps_false:
|
|
|
2778 |
assumes nn: "ks \<noteq> []"
|
|
|
2779 |
shows "\<lbrace>st i ** ps v ** reps u v ks\<rbrace>
|
|
|
2780 |
i:[if_zero e]:j
|
|
|
2781 |
\<lbrace>st j ** ps v ** reps u v ks\<rbrace>"
|
|
|
2782 |
proof(rule rev_exhaust[of ks])
|
|
|
2783 |
assume "ks = []" with nn show ?thesis by simp
|
|
|
2784 |
next
|
|
|
2785 |
fix y ys
|
|
|
2786 |
assume eq_ks: "ks = ys @ [y]"
|
|
|
2787 |
show " \<lbrace>st i \<and>* ps v \<and>* reps u v ks\<rbrace> i :[ if_zero e ]: j \<lbrace>st j \<and>* ps v \<and>* reps u v ks\<rbrace>"
|
|
|
2788 |
proof(cases "ys = []")
|
|
|
2789 |
case False
|
|
|
2790 |
have "\<lbrace>st i \<and>* ps v \<and>* reps u v (ys @ [y])\<rbrace> i :[ if_zero e ]: j \<lbrace>st j \<and>* ps v \<and>* reps u v (ys @ [y])\<rbrace>"
|
|
|
2791 |
apply(unfold reps_rev[OF False], simp del:ones_simps add:ones_rev)
|
|
|
2792 |
by hstep
|
|
|
2793 |
thus ?thesis
|
|
|
2794 |
by (simp add:eq_ks)
|
|
|
2795 |
next
|
|
|
2796 |
case True
|
|
|
2797 |
with eq_ks
|
|
|
2798 |
show ?thesis
|
|
|
2799 |
apply (simp del:ones_simps add:ones_rev sep_conj_cond, intro tm.pre_condI, simp)
|
|
|
2800 |
by hstep
|
|
|
2801 |
qed
|
|
|
2802 |
qed
|
|
|
2803 |
|
|
|
2804 |
lemma hoare_if_zero_reps_false_gen[step]:
|
|
|
2805 |
assumes "ks \<noteq> []" "u = w"
|
|
|
2806 |
shows "\<lbrace>st i ** ps u ** reps v w ks\<rbrace>
|
|
|
2807 |
i:[if_zero e]:j
|
|
|
2808 |
\<lbrace>st j ** ps u ** reps v w ks\<rbrace>"
|
|
|
2809 |
by (unfold `u = w`, rule hoare_if_zero_reps_false[OF `ks \<noteq> []`])
|
|
|
2810 |
|
|
|
2811 |
|
|
|
2812 |
lemma hoare_if_zero_reps_false1:
|
|
|
2813 |
assumes nn: "ks \<noteq> []"
|
|
|
2814 |
shows "\<lbrace>st i ** ps u ** reps u v ks\<rbrace>
|
|
|
2815 |
i:[if_zero e]:j
|
|
|
2816 |
\<lbrace>st j ** ps u ** reps u v ks\<rbrace>"
|
|
|
2817 |
proof -
|
|
|
2818 |
from nn obtain y ys where eq_ys: "ks = y#ys"
|
|
|
2819 |
by (metis neq_Nil_conv)
|
|
|
2820 |
show ?thesis
|
|
|
2821 |
apply (unfold eq_ys)
|
|
|
2822 |
by (case_tac ys, (simp, hsteps)+)
|
|
|
2823 |
qed
|
|
|
2824 |
|
|
|
2825 |
lemma hoare_if_zero_reps_false1_gen[step]:
|
|
|
2826 |
assumes nn: "ks \<noteq> []"
|
|
|
2827 |
and h: "u = w"
|
|
|
2828 |
shows "\<lbrace>st i ** ps u ** reps w v ks\<rbrace>
|
|
|
2829 |
i:[if_zero e]:j
|
|
|
2830 |
\<lbrace>st j ** ps u ** reps w v ks\<rbrace>"
|
|
|
2831 |
by (unfold h, rule hoare_if_zero_reps_false1[OF `ks \<noteq> []`])
|
|
|
2832 |
|
|
|
2833 |
lemma hoare_left_until_double_zero:
|
|
|
2834 |
assumes h: "ks \<noteq> []"
|
|
|
2835 |
shows "\<lbrace>st i ** ps v ** zero u ** zero (u + 1) ** reps (u+2) v ks\<rbrace>
|
|
|
2836 |
i:[left_until_double_zero]:j
|
|
|
2837 |
\<lbrace>st j ** ps u ** zero u ** zero (u + 1) ** reps (u+2) v ks\<rbrace>"
|
|
|
2838 |
proof(unfold left_until_double_zero_def,
|
|
|
2839 |
intro t_hoare_local t_hoare_label, clarsimp,
|
|
|
2840 |
rule t_hoare_label_last, simp+)
|
|
|
2841 |
fix la
|
|
|
2842 |
let ?body = "i :[ (if_zero la ; left_until_zero ; move_left ; if_one i) ]: j"
|
|
|
2843 |
let ?j = j
|
|
|
2844 |
show "\<lbrace>st i \<and>* ps v \<and>* zero u \<and>* zero (u + 1) \<and>* reps (u + 2) v ks\<rbrace>
|
|
|
2845 |
?body
|
|
|
2846 |
\<lbrace>st ?j \<and>* ps u \<and>* zero u \<and>* zero (u + 1) \<and>* reps (u + 2) v ks\<rbrace>"
|
|
|
2847 |
using h
|
|
|
2848 |
proof(induct ks arbitrary: v rule:rev_induct)
|
|
|
2849 |
case Nil
|
|
|
2850 |
with h show ?case by auto
|
|
|
2851 |
next
|
|
|
2852 |
case (snoc k ks)
|
|
|
2853 |
show ?case
|
|
|
2854 |
proof(cases "ks = []")
|
|
|
2855 |
case True
|
|
|
2856 |
have eq_ones:
|
|
|
2857 |
"ones (u + 2) (u + 2 + int k) = (ones (u + 2) (u + 1 + int k) \<and>* one (u + 2 + int k))"
|
|
|
2858 |
by (smt ones_rev)
|
|
|
2859 |
have eq_ones': "(one (u + 2) \<and>* ones (3 + u) (u + 2 + int k)) =
|
|
|
2860 |
(one (u + 2 + int k) \<and>* ones (u + 2) (u + 1 + int k))"
|
|
|
2861 |
by (smt eq_ones ones.simps sep.mult_commute)
|
|
|
2862 |
thus ?thesis
|
|
|
2863 |
apply (insert True, simp del:ones_simps add:sep_conj_cond)
|
|
|
2864 |
apply (rule tm.pre_condI, simp del:ones_simps, unfold eq_ones)
|
|
|
2865 |
apply hsteps
|
|
|
2866 |
apply (rule_tac p = "st j' \<and>* ps (u + 2 + int k) \<and>* zero u \<and>*
|
|
|
2867 |
zero (u + 1) \<and>* ones (u + 2) (u + 2 + int k)"
|
|
|
2868 |
in tm.pre_stren)
|
|
|
2869 |
by (hsteps)
|
|
|
2870 |
next
|
|
|
2871 |
case False
|
|
|
2872 |
from False have spt: "splited (ks @ [k]) ks [k]" by (unfold splited_def, auto)
|
|
|
2873 |
show ?thesis
|
|
|
2874 |
apply (unfold reps_splited[OF spt], simp del:ones_simps add:sep_conj_cond)
|
|
|
2875 |
apply (rule tm.pre_condI, simp del:ones_simps)
|
|
|
2876 |
apply (rule_tac q = "st i \<and>*
|
|
|
2877 |
ps (1 + (u + int (reps_len ks))) \<and>*
|
|
|
2878 |
zero u \<and>*
|
|
|
2879 |
zero (u + 1) \<and>*
|
|
|
2880 |
reps (u + 2) (1 + (u + int (reps_len ks))) ks \<and>*
|
|
|
2881 |
zero (u + 2 + int (reps_len ks)) \<and>*
|
|
|
2882 |
ones (3 + (u + int (reps_len ks))) (3 + (u + int (reps_len ks)) + int k)" in
|
|
|
2883 |
tm.sequencing)
|
|
|
2884 |
apply hsteps[1]
|
|
|
2885 |
by (hstep snoc(1))
|
|
|
2886 |
qed
|
|
|
2887 |
qed
|
|
|
2888 |
qed
|
|
|
2889 |
|
|
|
2890 |
lemma hoare_left_until_double_zero_gen[step]:
|
|
|
2891 |
assumes h1: "ks \<noteq> []"
|
|
|
2892 |
and h: "u = y" "w = v + 1" "x = v + 2"
|
|
|
2893 |
shows "\<lbrace>st i ** ps u ** zero v ** zero w ** reps x y ks\<rbrace>
|
|
|
2894 |
i:[left_until_double_zero]:j
|
|
|
2895 |
\<lbrace>st j ** ps v ** zero v ** zero w ** reps x y ks\<rbrace>"
|
|
|
2896 |
by (unfold h, rule hoare_left_until_double_zero[OF h1])
|
|
|
2897 |
|
|
|
2898 |
lemma hoare_jmp_reps1:
|
|
|
2899 |
assumes "ks \<noteq> []"
|
|
|
2900 |
shows "\<lbrace> st i \<and>* ps u \<and>* reps u v ks\<rbrace>
|
|
|
2901 |
i:[jmp e]:j
|
|
|
2902 |
\<lbrace> st e \<and>* ps u \<and>* reps u v ks\<rbrace>"
|
|
|
2903 |
proof -
|
|
|
2904 |
from assms obtain k ks' where Cons:"ks = k#ks'"
|
|
|
2905 |
by (metis neq_Nil_conv)
|
|
|
2906 |
thus ?thesis
|
|
|
2907 |
proof(cases "ks' = []")
|
|
|
2908 |
case True with Cons
|
|
|
2909 |
show ?thesis
|
|
|
2910 |
apply(simp add:sep_conj_cond reps.simps, intro tm.pre_condI, simp add:ones_simps)
|
|
|
2911 |
by (hgoto hoare_jmp_gen)
|
|
|
2912 |
next
|
|
|
2913 |
case False
|
|
|
2914 |
show ?thesis
|
|
|
2915 |
apply (unfold `ks = k#ks'` reps_simp3[OF False], simp add:ones_simps)
|
|
|
2916 |
by (hgoto hoare_jmp[where p = u])
|
|
|
2917 |
qed
|
|
|
2918 |
qed
|
|
|
2919 |
|
|
|
2920 |
lemma hoare_jmp_reps1_gen[step]:
|
|
|
2921 |
assumes "ks \<noteq> []" "u = v"
|
|
|
2922 |
shows "\<lbrace> st i \<and>* ps u \<and>* reps v w ks\<rbrace>
|
|
|
2923 |
i:[jmp e]:j
|
|
|
2924 |
\<lbrace> st e \<and>* ps u \<and>* reps v w ks\<rbrace>"
|
|
|
2925 |
by (unfold assms, rule hoare_jmp_reps1[OF `ks \<noteq> []`])
|
|
|
2926 |
|
|
|
2927 |
lemma hoare_jmp_reps:
|
|
|
2928 |
"\<lbrace> st i \<and>* ps u \<and>* reps u v ks \<and>* tm (v + 1) x \<rbrace>
|
|
|
2929 |
i:[(jmp e; c)]:j
|
|
|
2930 |
\<lbrace> st e \<and>* ps u \<and>* reps u v ks \<and>* tm (v + 1) x \<rbrace>"
|
|
|
2931 |
proof(cases "ks")
|
|
|
2932 |
case Nil
|
|
|
2933 |
thus ?thesis
|
|
|
2934 |
by (simp add:sep_conj_cond, intro tm.pre_condI, simp, hsteps)
|
|
|
2935 |
next
|
|
|
2936 |
case (Cons k ks')
|
|
|
2937 |
thus ?thesis
|
|
|
2938 |
proof(cases "ks' = []")
|
|
|
2939 |
case True with Cons
|
|
|
2940 |
show ?thesis
|
|
|
2941 |
apply(simp add:sep_conj_cond, intro tm.pre_condI, simp)
|
|
|
2942 |
by (hgoto hoare_jmp[where p = u])
|
|
|
2943 |
next
|
|
|
2944 |
case False
|
|
|
2945 |
show ?thesis
|
|
|
2946 |
apply (unfold `ks = k#ks'` reps_simp3[OF False], simp)
|
|
|
2947 |
by (hgoto hoare_jmp[where p = u])
|
|
|
2948 |
qed
|
|
|
2949 |
qed
|
|
|
2950 |
|
|
|
2951 |
lemma hoare_shift_right_cons:
|
|
|
2952 |
assumes h: "ks \<noteq> []"
|
|
|
2953 |
shows "\<lbrace>st i \<and>* ps u ** reps u v ks \<and>* zero (v + 1) \<and>* zero (v + 2) \<rbrace>
|
|
|
2954 |
i:[shift_right]:j
|
|
|
2955 |
\<lbrace>st j ** ps (v + 2) ** zero u ** reps (u + 1) (v + 1) ks ** zero (v + 2) \<rbrace>"
|
|
|
2956 |
proof(unfold shift_right_def, intro t_hoare_local t_hoare_label, clarify,
|
|
|
2957 |
rule t_hoare_label_last, auto)
|
|
|
2958 |
fix la
|
|
|
2959 |
have eq_ones: "\<And> u k. (one (u + int k + 1) \<and>* ones (u + 1) (u + int k)) =
|
|
|
2960 |
(one (u + 1) \<and>* ones (2 + u) (u + 1 + int k))"
|
|
|
2961 |
by (smt cond_true_eq2 ones.simps ones_rev sep.mult_assoc sep.mult_commute
|
|
|
2962 |
sep.mult_left_commute sep_conj_assoc sep_conj_commute
|
|
|
2963 |
sep_conj_cond1 sep_conj_cond2 sep_conj_cond3 sep_conj_left_commute
|
|
|
2964 |
sep_conj_trivial_strip2)
|
|
|
2965 |
show "\<lbrace>st i \<and>* ps u \<and>* reps u v ks \<and>* zero (v + 1) \<and>* zero (v + 2)\<rbrace>
|
|
|
2966 |
i :[ (if_zero la ;
|
|
|
2967 |
write_zero ; move_right ; right_until_zero ; write_one ; move_right ; jmp i) ]: la
|
|
|
2968 |
\<lbrace>st la \<and>* ps (v + 2) \<and>* zero u \<and>* reps (u + 1) (v + 1) ks \<and>* zero (v + 2)\<rbrace>"
|
|
|
2969 |
using h
|
|
|
2970 |
proof(induct ks arbitrary:i u v)
|
|
|
2971 |
case (Cons k ks)
|
|
|
2972 |
thus ?case
|
|
|
2973 |
proof(cases "ks = []")
|
|
|
2974 |
let ?j = la
|
|
|
2975 |
case True
|
|
|
2976 |
let ?body = "i :[ (if_zero ?j ;
|
|
|
2977 |
write_zero ;
|
|
|
2978 |
move_right ;
|
|
|
2979 |
right_until_zero ;
|
|
|
2980 |
write_one ; move_right ; jmp i) ]: ?j"
|
|
|
2981 |
have first_interation:
|
|
|
2982 |
"\<lbrace>st i \<and>* ps u \<and>* one u \<and>* ones (u + 1) (u + int k) \<and>* zero (u + int k + 1) \<and>*
|
|
|
2983 |
zero (u + int k + 2)\<rbrace>
|
|
|
2984 |
?body
|
|
|
2985 |
\<lbrace>st i \<and>*
|
|
|
2986 |
ps (u + int k + 2) \<and>*
|
|
|
2987 |
one (u + int k + 1) \<and>* ones (u + 1) (u + int k) \<and>* zero u \<and>* zero (u + int k + 2)\<rbrace>"
|
|
|
2988 |
apply (hsteps)
|
|
|
2989 |
by (simp add:sep_conj_ac, sep_cancel+, smt)
|
|
|
2990 |
hence "\<lbrace>st i \<and>* ps u \<and>* one u \<and>* ones (u + 1) (u + int k) \<and>* zero (u + int k + 1) \<and>*
|
|
|
2991 |
zero (u + int k + 2)\<rbrace>
|
|
|
2992 |
?body
|
|
|
2993 |
\<lbrace>st ?j \<and>* ps (u + int k + 2) \<and>* zero u \<and>* one (u + 1) \<and>*
|
|
|
2994 |
ones (2 + u) (u + 1 + int k) \<and>* zero (u + int k + 2)\<rbrace>"
|
|
|
2995 |
proof(rule tm.sequencing)
|
|
|
2996 |
show "\<lbrace>st i \<and>*
|
|
|
2997 |
ps (u + int k + 2) \<and>*
|
|
|
2998 |
one (u + int k + 1) \<and>* ones (u + 1) (u + int k) \<and>* zero u \<and>* zero (u + int k + 2)\<rbrace>
|
|
|
2999 |
?body
|
|
|
3000 |
\<lbrace>st ?j \<and>*
|
|
|
3001 |
ps (u + int k + 2) \<and>*
|
|
|
3002 |
zero u \<and>* one (u + 1) \<and>* ones (2 + u) (u + 1 + int k) \<and>* zero (u + int k + 2)\<rbrace>"
|
|
|
3003 |
apply (hgoto hoare_if_zero_true_gen)
|
|
|
3004 |
by (simp add:sep_conj_ac eq_ones)
|
|
|
3005 |
qed
|
|
|
3006 |
with True
|
|
|
3007 |
show ?thesis
|
|
|
3008 |
by (simp, simp only:sep_conj_cond, intro tm.pre_condI, auto simp:sep_conj_ac)
|
|
|
3009 |
next
|
|
|
3010 |
case False
|
|
|
3011 |
let ?j = la
|
|
|
3012 |
let ?body = "i :[ (if_zero ?j ;
|
|
|
3013 |
write_zero ;
|
|
|
3014 |
move_right ; right_until_zero ;
|
|
|
3015 |
write_one ; move_right ; jmp i) ]: ?j"
|
|
|
3016 |
have eq_ones':
|
|
|
3017 |
"(one (u + int k + 1) \<and>*
|
|
|
3018 |
ones (u + 1) (u + int k) \<and>*
|
|
|
3019 |
zero u \<and>* reps (u + int k + 2) v ks \<and>* zero (v + 1) \<and>* zero (v + 2))
|
|
|
3020 |
=
|
|
|
3021 |
(zero u \<and>*
|
|
|
3022 |
ones (u + 1) (u + int k) \<and>*
|
|
|
3023 |
one (u + int k + 1) \<and>* reps (u + int k + 2) v ks \<and>* zero (v + 1) \<and>* zero (v + 2))"
|
|
|
3024 |
by (simp add:eq_ones sep_conj_ac)
|
|
|
3025 |
have "\<lbrace>st i \<and>* ps u \<and>* one u \<and>* ones (u + 1) (u + int k) \<and>* zero (u + int k + 1) \<and>*
|
|
|
3026 |
reps (u + int k + 2) v ks \<and>* zero (v + 1) \<and>* zero (v + 2)\<rbrace>
|
|
|
3027 |
?body
|
|
|
3028 |
\<lbrace>st i \<and>* ps (u + int k + 2) \<and>* zero u \<and>* ones (u + 1) (u + int k) \<and>*
|
|
|
3029 |
one (u + int k + 1) \<and>* reps (u + int k + 2) v ks \<and>* zero (v + 1) \<and>* zero (v + 2)\<rbrace>"
|
|
|
3030 |
apply (hsteps)
|
|
|
3031 |
by (auto simp:sep_conj_ac, sep_cancel+, smt)
|
|
|
3032 |
hence "\<lbrace>st i \<and>* ps u \<and>* one u \<and>* ones (u + 1) (u + int k) \<and>* zero (u + int k + 1) \<and>*
|
|
|
3033 |
reps (u + int k + 2) v ks \<and>* zero (v + 1) \<and>* zero (v + 2)\<rbrace>
|
|
|
3034 |
?body
|
|
|
3035 |
\<lbrace>st ?j \<and>* ps (v + 2) \<and>* zero u \<and>* one (u + 1) \<and>* ones (2 + u) (u + 1 + int k) \<and>*
|
|
|
3036 |
zero (2 + (u + int k)) \<and>* reps (3 + (u + int k)) (v + 1) ks \<and>* zero (v + 2)\<rbrace>"
|
|
|
3037 |
proof(rule tm.sequencing)
|
|
|
3038 |
have eq_ones':
|
|
|
3039 |
"\<And> u k. (one (u + int k + 1) \<and>* ones (u + 1) (u + int k) \<and>* zero (u + int k + 2)) =
|
|
|
3040 |
(one (u + 1) \<and>* zero (2 + (u + int k)) \<and>* ones (2 + u) (u + 1 + int k))"
|
|
|
3041 |
by (smt eq_ones sep.mult_assoc sep_conj_commute)
|
|
|
3042 |
show "\<lbrace>st i \<and>* ps (u + int k + 2) \<and>* zero u \<and>*
|
|
|
3043 |
ones (u + 1) (u + int k) \<and>* one (u + int k + 1) \<and>* reps (u + int k + 2) v ks \<and>*
|
|
|
3044 |
zero (v + 1) \<and>* zero (v + 2)\<rbrace>
|
|
|
3045 |
?body
|
|
|
3046 |
\<lbrace>st ?j \<and>* ps (v + 2) \<and>* zero u \<and>* one (u + 1) \<and>* ones (2 + u) (u + 1 + int k) \<and>*
|
|
|
3047 |
zero (2 + (u + int k)) \<and>* reps (3 + (u + int k)) (v + 1) ks \<and>* zero (v + 2)\<rbrace>"
|
|
|
3048 |
apply (hsteps Cons.hyps)
|
|
|
3049 |
by (simp add:sep_conj_ac eq_ones, sep_cancel+, smt)
|
|
|
3050 |
qed
|
|
|
3051 |
thus ?thesis
|
|
|
3052 |
by (unfold reps_simp3[OF False], auto simp:sep_conj_ac)
|
|
|
3053 |
qed
|
|
|
3054 |
qed auto
|
|
|
3055 |
qed
|
|
|
3056 |
|
|
|
3057 |
lemma hoare_shift_right_cons_gen[step]:
|
|
|
3058 |
assumes h: "ks \<noteq> []"
|
|
|
3059 |
and h1: "u = v" "x = w + 1" "y = w + 2"
|
|
|
3060 |
shows "\<lbrace>st i \<and>* ps u ** reps v w ks \<and>* zero x \<and>* zero y \<rbrace>
|
|
|
3061 |
i:[shift_right]:j
|
|
|
3062 |
\<lbrace>st j ** ps y ** zero v ** reps (v + 1) x ks ** zero y\<rbrace>"
|
|
|
3063 |
by (unfold h1, rule hoare_shift_right_cons[OF h])
|
|
|
3064 |
|
|
|
3065 |
lemma shift_right_nil [step]:
|
|
|
3066 |
assumes "u = v"
|
|
|
3067 |
shows
|
|
|
3068 |
"\<lbrace> st i \<and>* ps u \<and>* zero v \<rbrace>
|
|
|
3069 |
i:[shift_right]:j
|
|
|
3070 |
\<lbrace> st j \<and>* ps u \<and>* zero v \<rbrace>"
|
|
|
3071 |
by (unfold assms shift_right_def, intro t_hoare_local t_hoare_label, clarify,
|
|
|
3072 |
rule t_hoare_label_last, simp+, hstep)
|
|
|
3073 |
|
|
|
3074 |
|
|
|
3075 |
text {*
|
|
|
3076 |
@{text "clear_until_zero"} is useful to implement @{text "drag"}.
|
|
|
3077 |
*}
|
|
|
3078 |
|
|
|
3079 |
lemma hoare_clear_until_zero[step]:
|
|
|
3080 |
"\<lbrace>st i ** ps u ** ones u v ** zero (v + 1)\<rbrace>
|
|
|
3081 |
i :[clear_until_zero]: j
|
|
|
3082 |
\<lbrace>st j ** ps (v + 1) ** zeros u v ** zero (v + 1)\<rbrace> "
|
|
|
3083 |
proof(unfold clear_until_zero_def, intro t_hoare_local, rule t_hoare_label,
|
|
|
3084 |
rule t_hoare_label_last, simp+)
|
|
|
3085 |
let ?body = "i :[ (if_zero j ; write_zero ; move_right ; jmp i) ]: j"
|
|
|
3086 |
show "\<lbrace>st i \<and>* ps u \<and>* ones u v \<and>* zero (v + 1)\<rbrace> ?body
|
|
|
3087 |
\<lbrace>st j \<and>* ps (v + 1) \<and>* zeros u v \<and>* zero (v + 1)\<rbrace>"
|
|
|
3088 |
proof(induct u v rule: zeros.induct)
|
|
|
3089 |
fix ia ja
|
|
|
3090 |
assume h: "\<not> ja < ia \<Longrightarrow>
|
|
|
3091 |
\<lbrace>st i \<and>* ps (ia + 1) \<and>* ones (ia + 1) ja \<and>* zero (ja + 1)\<rbrace> ?body
|
|
|
3092 |
\<lbrace>st j \<and>* ps (ja + 1) \<and>* zeros (ia + 1) ja \<and>* zero (ja + 1)\<rbrace>"
|
|
|
3093 |
show "\<lbrace>st i \<and>* ps ia \<and>* ones ia ja \<and>* zero (ja + 1)\<rbrace> ?body
|
|
|
3094 |
\<lbrace>st j \<and>* ps (ja + 1) \<and>* zeros ia ja \<and>* zero (ja + 1)\<rbrace>"
|
|
|
3095 |
proof(cases "ja < ia")
|
|
|
3096 |
case True
|
|
|
3097 |
thus ?thesis
|
|
|
3098 |
by (simp add: ones.simps zeros.simps sep_conj_ac, simp only:sep_conj_cond,
|
|
|
3099 |
intro tm.pre_condI, simp, hsteps)
|
|
|
3100 |
next
|
|
|
3101 |
case False
|
|
|
3102 |
note h[OF False, step]
|
|
|
3103 |
from False have ones_eq: "ones ia ja = (one ia \<and>* ones (ia + 1) ja)"
|
|
|
3104 |
by(simp add: ones.simps)
|
|
|
3105 |
from False have zeros_eq: "zeros ia ja = (zero ia \<and>* zeros (ia + 1) ja)"
|
|
|
3106 |
by(simp add: zeros.simps)
|
|
|
3107 |
have s1: "\<lbrace>st i \<and>* ps ia \<and>* one ia \<and>* ones (ia + 1) ja \<and>* zero (ja + 1)\<rbrace> ?body
|
|
|
3108 |
\<lbrace>st i \<and>* ps (ia + 1) \<and>* zero ia \<and>* ones (ia + 1) ja \<and>* zero (ja + 1)\<rbrace>"
|
|
|
3109 |
proof(cases "ja < ia + 1")
|
|
|
3110 |
case True
|
|
|
3111 |
from True False have "ja = ia" by auto
|
|
|
3112 |
thus ?thesis
|
|
|
3113 |
apply(simp add: ones.simps)
|
|
|
3114 |
by (hsteps)
|
|
|
3115 |
next
|
|
|
3116 |
case False
|
|
|
3117 |
from False have "ones (ia + 1) ja = (one (ia + 1) \<and>* ones (ia + 1 + 1) ja)"
|
|
|
3118 |
by(simp add: ones.simps)
|
|
|
3119 |
thus ?thesis
|
|
|
3120 |
by (simp, hsteps)
|
|
|
3121 |
qed
|
|
|
3122 |
have s2: "\<lbrace>st i \<and>* ps (ia + 1) \<and>* zero ia \<and>* ones (ia + 1) ja \<and>* zero (ja + 1)\<rbrace>
|
|
|
3123 |
?body
|
|
|
3124 |
\<lbrace>st j \<and>* ps (ja + 1) \<and>* zero ia \<and>* zeros (ia + 1) ja \<and>* zero (ja + 1)\<rbrace>"
|
|
|
3125 |
by hsteps
|
|
|
3126 |
from tm.sequencing[OF s1 s2] have
|
|
|
3127 |
"\<lbrace>st i \<and>* ps ia \<and>* one ia \<and>* ones (ia + 1) ja \<and>* zero (ja + 1)\<rbrace> ?body
|
|
|
3128 |
\<lbrace>st j \<and>* ps (ja + 1) \<and>* zero ia \<and>* zeros (ia + 1) ja \<and>* zero (ja + 1)\<rbrace>" .
|
|
|
3129 |
thus ?thesis
|
|
|
3130 |
unfolding ones_eq zeros_eq by(simp add: sep_conj_ac)
|
|
|
3131 |
qed
|
|
|
3132 |
qed
|
|
|
3133 |
qed
|
|
|
3134 |
|
|
|
3135 |
lemma hoare_clear_until_zero_gen[step]:
|
|
|
3136 |
assumes "u = v" "x = w + 1"
|
|
|
3137 |
shows "\<lbrace>st i ** ps u ** ones v w ** zero x\<rbrace>
|
|
|
3138 |
i :[clear_until_zero]: j
|
|
|
3139 |
\<lbrace>st j ** ps x ** zeros v w ** zero x\<rbrace>"
|
|
|
3140 |
by (unfold assms, rule hoare_clear_until_zero)
|
|
|
3141 |
|
|
|
3142 |
declare ones_simps[simp del]
|
|
|
3143 |
|
|
|
3144 |
lemma hoare_move_left_reps[step]:
|
|
|
3145 |
assumes "ks \<noteq> []" "u = v"
|
|
|
3146 |
shows
|
|
|
3147 |
"\<lbrace>st i ** ps u ** reps v w ks\<rbrace>
|
|
|
3148 |
i:[move_left]:j
|
|
|
3149 |
\<lbrace>st j ** ps (u - 1) ** reps v w ks\<rbrace>"
|
|
|
3150 |
proof -
|
|
|
3151 |
from `ks \<noteq> []` obtain y ys where eq_ks: "ks = y#ys"
|
|
|
3152 |
by (metis neq_Nil_conv)
|
|
|
3153 |
show ?thesis
|
|
|
3154 |
apply (unfold assms eq_ks)
|
|
|
3155 |
apply (case_tac ys, simp)
|
|
|
3156 |
my_block
|
|
|
3157 |
have "(ones v (v + int y)) = (one v \<and>* ones (v + 1) (v + int y))"
|
|
|
3158 |
by (smt ones_step_simp)
|
|
|
3159 |
my_block_end
|
|
|
3160 |
apply (unfold this, hsteps)
|
|
|
3161 |
by (simp add:this, hsteps)
|
|
|
3162 |
qed
|
|
|
3163 |
|
|
|
3164 |
lemma hoare_shift_left_cons:
|
|
|
3165 |
assumes h: "ks \<noteq> []"
|
|
|
3166 |
shows "\<lbrace>st i \<and>* ps u \<and>* tm (u - 1) x \<and>* reps u v ks \<and>* zero (v + 1) \<and>* zero (v + 2) \<rbrace>
|
|
|
3167 |
i:[shift_left]:j
|
|
|
3168 |
\<lbrace>st j \<and>* ps (v + 2) \<and>* reps (u - 1) (v - 1) ks \<and>* zero v \<and>* zero (v + 1) \<and>* zero (v + 2) \<rbrace>"
|
|
|
3169 |
proof(unfold shift_left_def, intro t_hoare_local t_hoare_label, clarify,
|
|
|
3170 |
rule t_hoare_label_last, simp+, clarify, prune)
|
|
|
3171 |
show " \<lbrace>st i \<and>* ps u \<and>* tm (u - 1) x \<and>* reps u v ks \<and>* zero (v + 1) \<and>* zero (v + 2)\<rbrace>
|
|
|
3172 |
i :[ (if_zero j ;
|
|
|
3173 |
move_left ;
|
|
|
3174 |
write_one ;
|
|
|
3175 |
right_until_zero ;
|
|
|
3176 |
move_left ; write_zero ;
|
|
|
3177 |
move_right ; move_right ; jmp i) ]: j
|
|
|
3178 |
\<lbrace>st j \<and>* ps (v + 2) \<and>* reps (u - 1) (v - 1) ks \<and>* zero v \<and>* zero (v + 1) \<and>* zero (v + 2)\<rbrace>"
|
|
|
3179 |
using h
|
|
|
3180 |
proof(induct ks arbitrary:i u v x)
|
|
|
3181 |
case (Cons k ks)
|
|
|
3182 |
thus ?case
|
|
|
3183 |
proof(cases "ks = []")
|
|
|
3184 |
let ?body = "i :[ (if_zero j ; move_left ; write_one ; right_until_zero ;
|
|
|
3185 |
move_left ; write_zero ; move_right ; move_right ; jmp i) ]: j"
|
|
|
3186 |
case True
|
|
|
3187 |
have "\<lbrace>st i \<and>* ps u \<and>* tm (u - 1) x \<and>* (one u \<and>* ones (u + 1) (u + int k)) \<and>*
|
|
|
3188 |
zero (u + int k + 1) \<and>* zero (u + int k + 2)\<rbrace>
|
|
|
3189 |
?body
|
|
|
3190 |
\<lbrace>st j \<and>* ps (u + int k + 2) \<and>* (one (u - 1) \<and>* ones u (u - 1 + int k)) \<and>*
|
|
|
3191 |
zero (u + int k) \<and>* zero (u + int k + 1) \<and>* zero (u + int k + 2)\<rbrace>"
|
|
|
3192 |
apply(rule tm.sequencing [where q = "st i \<and>* ps (u + int k + 2) \<and>*
|
|
|
3193 |
(one (u - 1) \<and>* ones u (u - 1 + int k)) \<and>*
|
|
|
3194 |
zero (u + int k) \<and>* zero (u + int k + 1) \<and>* zero (u + int k + 2)"])
|
|
|
3195 |
apply (hsteps)
|
|
|
3196 |
apply (rule_tac p = "st j' \<and>* ps (u - 1) \<and>* ones (u - 1) (u + int k) \<and>*
|
|
|
3197 |
zero (u + int k + 1) \<and>* zero (u + int k + 2)"
|
|
|
3198 |
in tm.pre_stren)
|
|
|
3199 |
apply (hsteps)
|
|
|
3200 |
my_block
|
|
|
3201 |
have "(ones (u - 1) (u + int k)) = (ones (u - 1) (u + int k - 1) \<and>* one (u + int k))"
|
|
|
3202 |
by (smt ones_rev)
|
|
|
3203 |
my_block_end
|
|
|
3204 |
apply (unfold this)
|
|
|
3205 |
apply hsteps
|
|
|
3206 |
apply (simp add:sep_conj_ac, sep_cancel+)
|
|
|
3207 |
apply (smt ones.simps sep.mult_assoc sep_conj_commuteI)
|
|
|
3208 |
apply (simp add:sep_conj_ac)+
|
|
|
3209 |
apply (sep_cancel+)
|
|
|
3210 |
apply (smt ones.simps sep.mult_left_commute sep_conj_commuteI this)
|
|
|
3211 |
by hstep
|
|
|
3212 |
with True show ?thesis
|
|
|
3213 |
by (simp add:ones_simps, simp only:sep_conj_cond, intro tm.pre_condI, simp)
|
|
|
3214 |
next
|
|
|
3215 |
case False
|
|
|
3216 |
let ?body = "i :[ (if_zero j ; move_left ; write_one ;right_until_zero ; move_left ;
|
|
|
3217 |
write_zero ; move_right ; move_right ; jmp i) ]: j"
|
|
|
3218 |
have "\<lbrace>st i \<and>* ps u \<and>* tm (u - 1) x \<and>* one u \<and>* ones (u + 1) (u + int k) \<and>*
|
|
|
3219 |
zero (u + int k + 1) \<and>* reps (u + int k + 2) v ks \<and>* zero (v + 1) \<and>* zero (v + 2)\<rbrace>
|
|
|
3220 |
?body
|
|
|
3221 |
\<lbrace>st j \<and>* ps (v + 2) \<and>* one (u - 1) \<and>* ones u (u - 1 + int k) \<and>*
|
|
|
3222 |
zero (u + int k) \<and>* reps (1 + (u + int k)) (v - 1) ks \<and>*
|
|
|
3223 |
zero v \<and>* zero (v + 1) \<and>* zero (v + 2)\<rbrace>"
|
|
|
3224 |
apply (rule tm.sequencing[where q = "st i \<and>* ps (u + int k + 2) \<and>*
|
|
|
3225 |
zero (u + int k + 1) \<and>* reps (u + int k + 2) v ks \<and>* zero (v + 1) \<and>*
|
|
|
3226 |
zero (v + 2) \<and>* one (u - 1) \<and>* ones u (u - 1 + int k) \<and>* zero (u + int k)"])
|
|
|
3227 |
apply (hsteps)
|
|
|
3228 |
apply (rule_tac p = "st j' \<and>* ps (u - 1) \<and>*
|
|
|
3229 |
ones (u - 1) (u + int k) \<and>*
|
|
|
3230 |
zero (u + int k + 1) \<and>*
|
|
|
3231 |
reps (u + int k + 2) v ks \<and>* zero (v + 1) \<and>* zero (v + 2)
|
|
|
3232 |
" in tm.pre_stren)
|
|
|
3233 |
apply hsteps
|
|
|
3234 |
my_block
|
|
|
3235 |
have "(ones (u - 1) (u + int k)) =
|
|
|
3236 |
(ones (u - 1) (u + int k - 1) \<and>* one (u + int k))"
|
|
|
3237 |
by (smt ones_rev)
|
|
|
3238 |
my_block_end
|
|
|
3239 |
apply (unfold this)
|
|
|
3240 |
apply (hsteps)
|
|
|
3241 |
apply (sep_cancel+)
|
|
|
3242 |
apply (smt ones.simps sep.mult_assoc sep_conj_commuteI)
|
|
|
3243 |
apply (sep_cancel+)
|
|
|
3244 |
apply (smt ones.simps this)
|
|
|
3245 |
my_block
|
|
|
3246 |
have eq_u: "1 + (u + int k) = u + int k + 1" by simp
|
|
|
3247 |
from Cons.hyps[OF `ks \<noteq> []`, of i "u + int k + 2" Bk v, folded zero_def]
|
|
|
3248 |
have "\<lbrace>st i \<and>* ps (u + int k + 2) \<and>* zero (u + int k + 1) \<and>*
|
|
|
3249 |
reps (u + int k + 2) v ks \<and>* zero (v + 1) \<and>* zero (v + 2)\<rbrace>
|
|
|
3250 |
?body
|
|
|
3251 |
\<lbrace>st j \<and>* ps (v + 2) \<and>* reps (1 + (u + int k)) (v - 1) ks \<and>*
|
|
|
3252 |
zero v \<and>* zero (v + 1) \<and>* zero (v + 2)\<rbrace>"
|
|
|
3253 |
by (simp add:eq_u)
|
|
|
3254 |
my_block_end my_note hh[step] = this
|
|
|
3255 |
by hsteps
|
|
|
3256 |
thus ?thesis
|
|
|
3257 |
by (unfold reps_simp3[OF False], auto simp:sep_conj_ac ones_simps)
|
|
|
3258 |
qed
|
|
|
3259 |
qed auto
|
|
|
3260 |
qed
|
|
|
3261 |
|
|
|
3262 |
lemma hoare_shift_left_cons_gen[step]:
|
|
|
3263 |
assumes h: "ks \<noteq> []"
|
|
|
3264 |
"v = u - 1" "w = u" "y = x + 1" "z = x + 2"
|
|
|
3265 |
shows "\<lbrace>st i \<and>* ps u \<and>* tm v vv \<and>* reps w x ks \<and>* tm y Bk \<and>* tm z Bk\<rbrace>
|
|
|
3266 |
i:[shift_left]:j
|
|
|
3267 |
\<lbrace>st j \<and>* ps z \<and>* reps v (x - 1) ks \<and>* zero x \<and>* zero y \<and>* zero z \<rbrace>"
|
|
|
3268 |
by (unfold assms, fold zero_def, rule hoare_shift_left_cons[OF `ks \<noteq> []`])
|
|
|
3269 |
|
|
|
3270 |
lemma hoare_bone_1_out:
|
|
|
3271 |
assumes h:
|
|
|
3272 |
"\<And> i j . \<lbrace>st i \<and>* ps u \<and>* zero u \<and>* p \<rbrace>
|
|
|
3273 |
i:[c1]:j
|
|
|
3274 |
\<lbrace>st e \<and>* q \<rbrace>
|
|
|
3275 |
"
|
|
|
3276 |
shows "\<lbrace>st i \<and>* ps u \<and>* zero u \<and>* p \<rbrace>
|
|
|
3277 |
i:[(bone c1 c2)]:j
|
|
|
3278 |
\<lbrace>st e \<and>* q \<rbrace>
|
|
|
3279 |
"
|
|
|
3280 |
apply (unfold bone_def, intro t_hoare_local)
|
|
|
3281 |
apply hsteps
|
|
|
3282 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, rule tm.code_extension)
|
|
|
3283 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, rule tm.code_extension)
|
|
|
3284 |
by (rule h)
|
|
|
3285 |
|
|
|
3286 |
lemma hoare_bone_1:
|
|
|
3287 |
assumes h:
|
|
|
3288 |
"\<And> i j . \<lbrace>st i \<and>* ps u \<and>* zero u \<and>* p \<rbrace>
|
|
|
3289 |
i:[c1]:j
|
|
|
3290 |
\<lbrace>st j \<and>* ps v \<and>* tm v x \<and>* q \<rbrace>
|
|
|
3291 |
"
|
|
|
3292 |
shows "\<lbrace>st i \<and>* ps u \<and>* zero u \<and>* p \<rbrace>
|
|
|
3293 |
i:[(bone c1 c2)]:j
|
|
|
3294 |
\<lbrace>st j \<and>* ps v \<and>* tm v x \<and>* q \<rbrace>
|
|
|
3295 |
"
|
|
|
3296 |
proof -
|
|
|
3297 |
note h[step]
|
|
|
3298 |
show ?thesis
|
|
|
3299 |
apply (unfold bone_def, intro t_hoare_local)
|
|
|
3300 |
apply (rule t_hoare_label_last, auto)
|
|
|
3301 |
apply hsteps
|
|
|
3302 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, rule tm.code_extension)
|
|
|
3303 |
by hsteps
|
|
|
3304 |
qed
|
|
|
3305 |
|
|
|
3306 |
lemma hoare_bone_2:
|
|
|
3307 |
assumes h:
|
|
|
3308 |
"\<And> i j . \<lbrace>st i \<and>* ps u \<and>* one u \<and>* p \<rbrace>
|
|
|
3309 |
i:[c2]:j
|
|
|
3310 |
\<lbrace>st j \<and>* q \<rbrace>
|
|
|
3311 |
"
|
|
|
3312 |
shows "\<lbrace>st i \<and>* ps u \<and>* one u \<and>* p \<rbrace>
|
|
|
3313 |
i:[(bone c1 c2)]:j
|
|
|
3314 |
\<lbrace>st j \<and>* q \<rbrace>
|
|
|
3315 |
"
|
|
|
3316 |
apply (unfold bone_def, intro t_hoare_local)
|
|
|
3317 |
apply (rule_tac q = "st la \<and>* ps u \<and>* one u \<and>* p" in tm.sequencing)
|
|
|
3318 |
apply hsteps
|
|
|
3319 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, intro tm.code_extension1)
|
|
|
3320 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, intro tm.code_extension1)
|
|
|
3321 |
apply (subst tassemble_to.simps(2), intro tm.code_exI)
|
|
|
3322 |
apply (subst tassemble_to.simps(4), intro tm.code_condI, simp)
|
|
|
3323 |
apply (subst tassemble_to.simps(2), intro tm.code_exI)
|
|
|
3324 |
apply (subst tassemble_to.simps(4), simp add:sep_conj_cond, rule tm.code_condI, simp )
|
|
|
3325 |
by (rule h)
|
|
|
3326 |
|
|
|
3327 |
lemma hoare_bone_2_out:
|
|
|
3328 |
assumes h:
|
|
|
3329 |
"\<And> i j . \<lbrace>st i \<and>* ps u \<and>* one u \<and>* p \<rbrace>
|
|
|
3330 |
i:[c2]:j
|
|
|
3331 |
\<lbrace>st e \<and>* q \<rbrace>
|
|
|
3332 |
"
|
|
|
3333 |
shows "\<lbrace>st i \<and>* ps u \<and>* one u \<and>* p \<rbrace>
|
|
|
3334 |
i:[(bone c1 c2)]:j
|
|
|
3335 |
\<lbrace>st e \<and>* q \<rbrace>
|
|
|
3336 |
"
|
|
|
3337 |
apply (unfold bone_def, intro t_hoare_local)
|
|
|
3338 |
apply (rule_tac q = "st la \<and>* ps u \<and>* one u \<and>* p" in tm.sequencing)
|
|
|
3339 |
apply hsteps
|
|
|
3340 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, rule tm.code_extension1)
|
|
|
3341 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, rule tm.code_extension1)
|
|
|
3342 |
apply (subst tassemble_to.simps(2), intro tm.code_exI)
|
|
|
3343 |
apply (subst tassemble_to.simps(4), rule tm.code_condI, simp)
|
|
|
3344 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, rule tm.code_extension)
|
|
|
3345 |
by (rule h)
|
|
|
3346 |
|
|
|
3347 |
lemma hoare_bzero_1:
|
|
|
3348 |
assumes h[step]:
|
|
|
3349 |
"\<And> i j . \<lbrace>st i \<and>* ps u \<and>* one u \<and>* p \<rbrace>
|
|
|
3350 |
i:[c1]:j
|
|
|
3351 |
\<lbrace>st j \<and>* ps v \<and>* tm v x \<and>* q \<rbrace>
|
|
|
3352 |
"
|
|
|
3353 |
shows "\<lbrace>st i \<and>* ps u \<and>* one u \<and>* p \<rbrace>
|
|
|
3354 |
i:[(bzero c1 c2)]:j
|
|
|
3355 |
\<lbrace>st j \<and>* ps v \<and>* tm v x \<and>* q \<rbrace>
|
|
|
3356 |
"
|
|
|
3357 |
apply (unfold bzero_def, intro t_hoare_local)
|
|
|
3358 |
apply hsteps
|
|
|
3359 |
apply (rule_tac c = " ((c1 ; jmp l) ; TLabel la ; c2 ; TLabel l)" in t_hoare_label_last, auto)
|
|
|
3360 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, intro tm.code_extension)
|
|
|
3361 |
by hsteps
|
|
|
3362 |
|
|
|
3363 |
lemma hoare_bzero_1_out:
|
|
|
3364 |
assumes h[step]:
|
|
|
3365 |
"\<And> i j . \<lbrace>st i \<and>* ps u \<and>* one u \<and>* p \<rbrace>
|
|
|
3366 |
i:[c1]:j
|
|
|
3367 |
\<lbrace>st e \<and>* q \<rbrace>
|
|
|
3368 |
"
|
|
|
3369 |
shows "\<lbrace>st i \<and>* ps u \<and>* one u \<and>* p \<rbrace>
|
|
|
3370 |
i:[(bzero c1 c2)]:j
|
|
|
3371 |
\<lbrace>st e \<and>* q \<rbrace>
|
|
|
3372 |
"
|
|
|
3373 |
apply (unfold bzero_def, intro t_hoare_local)
|
|
|
3374 |
apply hsteps
|
|
|
3375 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, rule tm.code_extension)
|
|
|
3376 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, rule tm.code_extension)
|
|
|
3377 |
by (rule h)
|
|
|
3378 |
|
|
|
3379 |
lemma hoare_bzero_2:
|
|
|
3380 |
assumes h:
|
|
|
3381 |
"\<And> i j. \<lbrace>st i \<and>* ps u \<and>* zero u \<and>* p \<rbrace>
|
|
|
3382 |
i:[c2]:j
|
|
|
3383 |
\<lbrace>st j \<and>* q \<rbrace>
|
|
|
3384 |
"
|
|
|
3385 |
shows "\<lbrace>st i \<and>* ps u \<and>* zero u \<and>* p \<rbrace>
|
|
|
3386 |
i:[(bzero c1 c2)]:j
|
|
|
3387 |
\<lbrace>st j \<and>* q \<rbrace>
|
|
|
3388 |
"
|
|
|
3389 |
apply (unfold bzero_def, intro t_hoare_local)
|
|
|
3390 |
apply (rule_tac q = "st la \<and>* ps u \<and>* zero u \<and>* p" in tm.sequencing)
|
|
|
3391 |
apply hsteps
|
|
|
3392 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, intro tm.code_extension1)
|
|
|
3393 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, intro tm.code_extension1)
|
|
|
3394 |
apply (subst tassemble_to.simps(2), intro tm.code_exI)
|
|
|
3395 |
apply (subst tassemble_to.simps(4))
|
|
|
3396 |
apply (rule tm.code_condI, simp)
|
|
|
3397 |
apply (subst tassemble_to.simps(2))
|
|
|
3398 |
apply (rule tm.code_exI)
|
|
|
3399 |
apply (subst tassemble_to.simps(4), simp add:sep_conj_cond)
|
|
|
3400 |
apply (rule tm.code_condI, simp)
|
|
|
3401 |
by (rule h)
|
|
|
3402 |
|
|
|
3403 |
lemma hoare_bzero_2_out:
|
|
|
3404 |
assumes h:
|
|
|
3405 |
"\<And> i j . \<lbrace>st i \<and>* ps u \<and>* zero u \<and>* p \<rbrace>
|
|
|
3406 |
i:[c2]:j
|
|
|
3407 |
\<lbrace>st e \<and>* q \<rbrace>
|
|
|
3408 |
"
|
|
|
3409 |
shows "\<lbrace>st i \<and>* ps u \<and>* zero u \<and>* p\<rbrace>
|
|
|
3410 |
i:[(bzero c1 c2)]:j
|
|
|
3411 |
\<lbrace>st e \<and>* q \<rbrace>
|
|
|
3412 |
"
|
|
|
3413 |
apply (unfold bzero_def, intro t_hoare_local)
|
|
|
3414 |
apply (rule_tac q = "st la \<and>* ps u \<and>* zero u \<and>* p" in tm.sequencing)
|
|
|
3415 |
apply hsteps
|
|
|
3416 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, rule tm.code_extension1)
|
|
|
3417 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, rule tm.code_extension1)
|
|
|
3418 |
apply (subst tassemble_to.simps(2), intro tm.code_exI)
|
|
|
3419 |
apply (subst tassemble_to.simps(4), rule tm.code_condI, simp)
|
|
|
3420 |
apply (subst tassemble_to.simps(2), intro tm.code_exI, rule tm.code_extension)
|
|
|
3421 |
by (rule h)
|
|
|
3422 |
|
|
|
3423 |
lemma reps_len_split:
|
|
|
3424 |
assumes "xs \<noteq> []" "ys \<noteq> []"
|
|
|
3425 |
shows "reps_len (xs @ ys) = reps_len xs + reps_len ys + 1"
|
|
|
3426 |
using assms
|
|
|
3427 |
proof(induct xs arbitrary:ys)
|
|
|
3428 |
case (Cons x1 xs1)
|
|
|
3429 |
show ?case
|
|
|
3430 |
proof(cases "xs1 = []")
|
|
|
3431 |
case True
|
|
|
3432 |
thus ?thesis
|
|
|
3433 |
by (simp add:reps_len_cons[OF `ys \<noteq> []`] reps_len_sg)
|
|
|
3434 |
next
|
|
|
3435 |
case False
|
|
|
3436 |
hence " xs1 @ ys \<noteq> []" by simp
|
|
|
3437 |
thus ?thesis
|
|
|
3438 |
apply (simp add:reps_len_cons[OF `xs1@ys \<noteq> []`] reps_len_cons[OF `xs1 \<noteq> []`])
|
|
|
3439 |
by (simp add: Cons.hyps[OF `xs1 \<noteq> []` `ys \<noteq> []`])
|
|
|
3440 |
qed
|
|
|
3441 |
qed auto
|
|
|
3442 |
|
|
|
3443 |
lemma hoare_skip_or_set_set:
|
|
|
3444 |
"\<lbrace> st i \<and>* ps u \<and>* zero u \<and>* zero (u + 1) \<and>* tm (u + 2) x\<rbrace>
|
|
|
3445 |
i:[skip_or_set]:j
|
|
|
3446 |
\<lbrace> st j \<and>* ps (u + 2) \<and>* one u \<and>* zero (u + 1) \<and>* tm (u + 2) x\<rbrace>"
|
|
|
3447 |
apply(unfold skip_or_set_def)
|
|
|
3448 |
apply(rule_tac q = "st j \<and>* ps (u + 2) \<and>* tm (u + 2) x \<and>* one u \<and>* zero (u + 1)"
|
|
|
3449 |
in tm.post_weaken)
|
|
|
3450 |
apply(rule hoare_bone_1)
|
|
|
3451 |
apply hsteps
|
|
|
3452 |
by (auto simp:sep_conj_ac, sep_cancel+, smt)
|
|
|
3453 |
|
|
|
3454 |
lemma hoare_skip_or_set_set_gen[step]:
|
|
|
3455 |
assumes "u = v" "w = v + 1" "x = v + 2"
|
|
|
3456 |
shows "\<lbrace>st i \<and>* ps u \<and>* zero v \<and>* zero w \<and>* tm x xv\<rbrace>
|
|
|
3457 |
i:[skip_or_set]:j
|
|
|
3458 |
\<lbrace>st j \<and>* ps x \<and>* one v \<and>* zero w \<and>* tm x xv\<rbrace>"
|
|
|
3459 |
by (unfold assms, rule hoare_skip_or_set_set)
|
|
|
3460 |
|
|
|
3461 |
lemma hoare_skip_or_set_skip:
|
|
|
3462 |
"\<lbrace> st i \<and>* ps u \<and>* reps u v [k] \<and>* zero (v + 1)\<rbrace>
|
|
|
3463 |
i:[skip_or_set]:j
|
|
|
3464 |
\<lbrace> st j \<and>* ps (v + 2) \<and>* reps u v [k] \<and>* zero (v + 1)\<rbrace>"
|
|
|
3465 |
proof -
|
|
|
3466 |
show ?thesis
|
|
|
3467 |
apply(unfold skip_or_set_def, unfold reps.simps, simp add:sep_conj_cond)
|
|
|
3468 |
apply(rule tm.pre_condI, simp)
|
|
|
3469 |
apply(rule_tac p = "st i \<and>* ps u \<and>* one u \<and>* ones (u + 1) (u + int k) \<and>*
|
|
|
3470 |
zero (u + int k + 1)"
|
|
|
3471 |
in tm.pre_stren)
|
|
|
3472 |
apply (rule_tac q = "st j \<and>* ps (u + int k + 2) \<and>*
|
|
|
3473 |
one u \<and>* ones (u + 1) (u + int k) \<and>* zero (u + int k + 1)
|
|
|
3474 |
" in tm.post_weaken)
|
|
|
3475 |
apply (rule hoare_bone_2)
|
|
|
3476 |
apply (rule_tac p = " st i \<and>* ps u \<and>* ones u (u + int k) \<and>* zero (u + int k + 1)
|
|
|
3477 |
" in tm.pre_stren)
|
|
|
3478 |
apply hsteps
|
|
|
3479 |
apply (simp add:sep_conj_ac, sep_cancel+, auto simp:sep_conj_ac ones_simps)
|
|
|
3480 |
by (sep_cancel+, smt)
|
|
|
3481 |
qed
|
|
|
3482 |
|
|
|
3483 |
lemma hoare_skip_or_set_skip_gen[step]:
|
|
|
3484 |
assumes "u = v" "x = w + 1"
|
|
|
3485 |
shows "\<lbrace> st i \<and>* ps u \<and>* reps v w [k] \<and>* zero x\<rbrace>
|
|
|
3486 |
i:[skip_or_set]:j
|
|
|
3487 |
\<lbrace> st j \<and>* ps (w + 2) \<and>* reps v w [k] \<and>* zero x\<rbrace>"
|
|
|
3488 |
by (unfold assms, rule hoare_skip_or_set_skip)
|
|
|
3489 |
|
|
|
3490 |
lemma hoare_if_reps_z_true:
|
|
|
3491 |
assumes h: "k = 0"
|
|
|
3492 |
shows
|
|
|
3493 |
"\<lbrace>st i \<and>* ps u \<and>* reps u v [k] \<and>* zero (v + 1)\<rbrace>
|
|
|
3494 |
i:[if_reps_z e]:j
|
|
|
3495 |
\<lbrace>st e \<and>* ps u \<and>* reps u v [k] \<and>* zero (v + 1)\<rbrace>"
|
|
|
3496 |
apply (unfold reps.simps, simp add:sep_conj_cond)
|
|
|
3497 |
apply (rule tm.pre_condI, simp add:h)
|
|
|
3498 |
apply (unfold if_reps_z_def)
|
|
|
3499 |
apply (simp add:ones_simps)
|
|
|
3500 |
apply (hsteps)
|
|
|
3501 |
apply (rule_tac p = "st j' \<and>* ps (u + 1) \<and>* zero (u + 1) \<and>* one u" in tm.pre_stren)
|
|
|
3502 |
apply (rule hoare_bone_1_out)
|
|
|
3503 |
by (hsteps)
|
|
|
3504 |
|
|
|
3505 |
lemma hoare_if_reps_z_true_gen[step]:
|
|
|
3506 |
assumes "k = 0" "u = v" "x = w + 1"
|
|
|
3507 |
shows "\<lbrace>st i \<and>* ps u \<and>* reps v w [k] \<and>* zero x\<rbrace>
|
|
|
3508 |
i:[if_reps_z e]:j
|
|
|
3509 |
\<lbrace>st e \<and>* ps u \<and>* reps v w [k] \<and>* zero x\<rbrace>"
|
|
|
3510 |
by (unfold assms, rule hoare_if_reps_z_true, simp)
|
|
|
3511 |
|
|
|
3512 |
lemma hoare_if_reps_z_false:
|
|
|
3513 |
assumes h: "k \<noteq> 0"
|
|
|
3514 |
shows
|
|
|
3515 |
"\<lbrace>st i \<and>* ps u \<and>* reps u v [k]\<rbrace>
|
|
|
3516 |
i:[if_reps_z e]:j
|
|
|
3517 |
\<lbrace>st j \<and>* ps u \<and>* reps u v [k]\<rbrace>"
|
|
|
3518 |
proof -
|
|
|
3519 |
from h obtain k' where "k = Suc k'" by (metis not0_implies_Suc)
|
|
|
3520 |
show ?thesis
|
|
|
3521 |
apply (unfold `k = Suc k'`)
|
|
|
3522 |
apply (simp add:sep_conj_cond, rule tm.pre_condI, simp)
|
|
|
3523 |
apply (unfold if_reps_z_def)
|
|
|
3524 |
apply (simp add:ones_simps)
|
|
|
3525 |
apply hsteps
|
|
|
3526 |
apply (rule_tac p = "st j' \<and>* ps (u + 1) \<and>* one (u + 1) \<and>* one u \<and>*
|
|
|
3527 |
ones (2 + u) (u + (1 + int k'))" in tm.pre_stren)
|
|
|
3528 |
apply (rule_tac hoare_bone_2)
|
|
|
3529 |
by (hsteps)
|
|
|
3530 |
qed
|
|
|
3531 |
|
|
|
3532 |
lemma hoare_if_reps_z_false_gen[step]:
|
|
|
3533 |
assumes h: "k \<noteq> 0" "u = v"
|
|
|
3534 |
shows
|
|
|
3535 |
"\<lbrace>st i \<and>* ps u \<and>* reps v w [k]\<rbrace>
|
|
|
3536 |
i:[if_reps_z e]:j
|
|
|
3537 |
\<lbrace>st j \<and>* ps u \<and>* reps v w [k]\<rbrace>"
|
|
|
3538 |
by (unfold assms, rule hoare_if_reps_z_false[OF `k \<noteq> 0`])
|
|
|
3539 |
|
|
|
3540 |
lemma EXS_postI:
|
|
|
3541 |
assumes "\<lbrace>P\<rbrace>
|
|
|
3542 |
c
|
|
|
3543 |
\<lbrace>Q x\<rbrace>"
|
|
|
3544 |
shows "\<lbrace>P\<rbrace>
|
|
|
3545 |
c
|
|
|
3546 |
\<lbrace>EXS x. Q x\<rbrace>"
|
|
|
3547 |
by (metis EXS_intro assms tm.hoare_adjust)
|
|
|
3548 |
|
|
|
3549 |
lemma hoare_if_reps_nz_true:
|
|
|
3550 |
assumes h: "k \<noteq> 0"
|
|
|
3551 |
shows
|
|
|
3552 |
"\<lbrace>st i \<and>* ps u \<and>* reps u v [k]\<rbrace>
|
|
|
3553 |
i:[if_reps_nz e]:j
|
|
|
3554 |
\<lbrace>st e \<and>* ps u \<and>* reps u v [k]\<rbrace>"
|
|
|
3555 |
proof -
|
|
|
3556 |
from h obtain k' where "k = Suc k'" by (metis not0_implies_Suc)
|
|
|
3557 |
show ?thesis
|
|
|
3558 |
apply (unfold `k = Suc k'`)
|
|
|
3559 |
apply (unfold reps.simps, simp add:sep_conj_cond, rule tm.pre_condI, simp)
|
|
|
3560 |
apply (unfold if_reps_nz_def)
|
|
|
3561 |
apply (simp add:ones_simps)
|
|
|
3562 |
apply hsteps
|
|
|
3563 |
apply (rule_tac p = "st j' \<and>* ps (u + 1) \<and>* one (u + 1) \<and>* one u \<and>*
|
|
|
3564 |
ones (2 + u) (u + (1 + int k'))" in tm.pre_stren)
|
|
|
3565 |
apply (rule hoare_bzero_1_out)
|
|
|
3566 |
by hsteps
|
|
|
3567 |
qed
|
|
|
3568 |
|
|
|
3569 |
|
|
|
3570 |
lemma hoare_if_reps_nz_true_gen[step]:
|
|
|
3571 |
assumes h: "k \<noteq> 0" "u = v"
|
|
|
3572 |
shows
|
|
|
3573 |
"\<lbrace>st i \<and>* ps u \<and>* reps v w [k]\<rbrace>
|
|
|
3574 |
i:[if_reps_nz e]:j
|
|
|
3575 |
\<lbrace>st e \<and>* ps u \<and>* reps v w [k]\<rbrace>"
|
|
|
3576 |
by (unfold assms, rule hoare_if_reps_nz_true[OF `k\<noteq> 0`])
|
|
|
3577 |
|
|
|
3578 |
lemma hoare_if_reps_nz_false:
|
|
|
3579 |
assumes h: "k = 0"
|
|
|
3580 |
shows
|
|
|
3581 |
"\<lbrace>st i \<and>* ps u \<and>* reps u v [k] \<and>* zero (v + 1)\<rbrace>
|
|
|
3582 |
i:[if_reps_nz e]:j
|
|
|
3583 |
\<lbrace>st j \<and>* ps u \<and>* reps u v [k] \<and>* zero (v + 1)\<rbrace>"
|
|
|
3584 |
apply (simp add:h sep_conj_cond)
|
|
|
3585 |
apply (rule tm.pre_condI, simp)
|
|
|
3586 |
apply (unfold if_reps_nz_def)
|
|
|
3587 |
apply (simp add:ones_simps)
|
|
|
3588 |
apply (hsteps)
|
|
|
3589 |
apply (rule_tac p = "st j' \<and>* ps (u + 1) \<and>* zero (u + 1) \<and>* one u" in tm.pre_stren)
|
|
|
3590 |
apply (rule hoare_bzero_2)
|
|
|
3591 |
by (hsteps)
|
|
|
3592 |
|
|
|
3593 |
lemma hoare_if_reps_nz_false_gen[step]:
|
|
|
3594 |
assumes h: "k = 0" "u = v" "x = w + 1"
|
|
|
3595 |
shows
|
|
|
3596 |
"\<lbrace>st i \<and>* ps u \<and>* reps v w [k] \<and>* zero x\<rbrace>
|
|
|
3597 |
i:[if_reps_nz e]:j
|
|
|
3598 |
\<lbrace>st j \<and>* ps u \<and>* reps v w [k] \<and>* zero x\<rbrace>"
|
|
|
3599 |
by (unfold assms, rule hoare_if_reps_nz_false, simp)
|
|
|
3600 |
|
|
|
3601 |
lemma hoare_skip_or_sets_set:
|
|
|
3602 |
shows "\<lbrace>st i \<and>* ps u \<and>* zeros u (u + int (reps_len (replicate (Suc n) 0))) \<and>*
|
|
|
3603 |
tm (u + int (reps_len (replicate (Suc n) 0)) + 1) x\<rbrace>
|
|
|
3604 |
i:[skip_or_sets (Suc n)]:j
|
|
|
3605 |
\<lbrace>st j \<and>* ps (u + int (reps_len (replicate (Suc n) 0)) + 1) \<and>*
|
|
|
3606 |
reps' u (u + int (reps_len (replicate (Suc n) 0))) (replicate (Suc n) 0) \<and>*
|
|
|
3607 |
tm (u + int (reps_len (replicate (Suc n) 0)) + 1) x \<rbrace>"
|
|
|
3608 |
proof(induct n arbitrary:i j u x)
|
|
|
3609 |
case 0
|
|
|
3610 |
from 0 show ?case
|
|
|
3611 |
apply (simp add:reps'_def reps_len_def reps_ctnt_len_def reps_sep_len_def reps.simps)
|
|
|
3612 |
apply (unfold skip_or_sets_def, simp add:tpg_fold_sg)
|
|
|
3613 |
apply hsteps
|
|
|
3614 |
by (auto simp:sep_conj_ac, smt cond_true_eq2 ones.simps sep_conj_left_commute)
|
|
|
3615 |
next
|
|
|
3616 |
case (Suc n)
|
|
|
3617 |
{ fix n
|
|
|
3618 |
have "listsum (replicate n (Suc 0)) = n"
|
|
|
3619 |
by (induct n, auto)
|
|
|
3620 |
} note eq_sum = this
|
|
|
3621 |
have eq_len: "\<And>n. n \<noteq> 0 \<Longrightarrow> reps_len (replicate (Suc n) 0) = reps_len (replicate n 0) + 2"
|
|
|
3622 |
by (simp add:reps_len_def reps_sep_len_def reps_ctnt_len_def)
|
|
|
3623 |
have eq_zero: "\<And> u v. (zeros u (u + int (v + 2))) =
|
|
|
3624 |
(zeros u (u + (int v)) \<and>* zero (u + (int v) + 1) \<and>* zero (u + (int v) + 2))"
|
|
|
3625 |
by (smt sep.mult_assoc zeros_rev)
|
|
|
3626 |
hence eq_z:
|
|
|
3627 |
"zeros u (u + int (reps_len (replicate (Suc (Suc n)) 0))) =
|
|
|
3628 |
(zeros u (u + int (reps_len (replicate (Suc n) 0))) \<and>*
|
|
|
3629 |
zero ((u + int (reps_len (replicate (Suc n) 0))) + 1) \<and>*
|
|
|
3630 |
zero ((u + int (reps_len (replicate (Suc n) 0))) + 2))
|
|
|
3631 |
" by (simp only:eq_len)
|
|
|
3632 |
have hh: "\<And>x. (replicate (Suc (Suc n)) x) = (replicate (Suc n) x) @ [x]"
|
|
|
3633 |
by (metis replicate_Suc replicate_append_same)
|
|
|
3634 |
have hhh: "replicate (Suc n) skip_or_set \<noteq> []" "[skip_or_set] \<noteq> []" by auto
|
|
|
3635 |
have eq_code:
|
|
|
3636 |
"(i :[ skip_or_sets (Suc (Suc n)) ]: j) =
|
|
|
3637 |
(i :[ (skip_or_sets (Suc n); skip_or_set) ]: j)"
|
|
|
3638 |
proof(unfold skip_or_sets_def)
|
|
|
3639 |
show "i :[ tpg_fold (replicate (Suc (Suc n)) skip_or_set) ]: j =
|
|
|
3640 |
i :[ (tpg_fold (replicate (Suc n) skip_or_set) ; skip_or_set) ]: j"
|
|
|
3641 |
apply (insert tpg_fold_app[OF hhh, of i j], unfold hh)
|
|
|
3642 |
by (simp only:tpg_fold_sg)
|
|
|
3643 |
qed
|
|
|
3644 |
have "Suc n \<noteq> 0" by simp
|
|
|
3645 |
show ?case
|
|
|
3646 |
apply (unfold eq_z eq_code)
|
|
|
3647 |
apply (hstep Suc(1))
|
|
|
3648 |
apply (unfold eq_len[OF `Suc n \<noteq> 0`])
|
|
|
3649 |
apply hstep
|
|
|
3650 |
apply (auto simp:sep_conj_ac)[1]
|
|
|
3651 |
apply (sep_cancel+, prune)
|
|
|
3652 |
apply (fwd abs_ones)
|
|
|
3653 |
apply ((fwd abs_reps')+, simp add:int_add_ac)
|
|
|
3654 |
by (metis replicate_append_same)
|
|
|
3655 |
qed
|
|
|
3656 |
|
|
|
3657 |
lemma hoare_skip_or_sets_set_gen[step]:
|
|
|
3658 |
assumes h: "p2 = p1"
|
|
|
3659 |
"p3 = p1 + int (reps_len (replicate (Suc n) 0))"
|
|
|
3660 |
"p4 = p3 + 1"
|
|
|
3661 |
shows "\<lbrace>st i \<and>* ps p1 \<and>* zeros p2 p3 \<and>* tm p4 x\<rbrace>
|
|
|
3662 |
i:[skip_or_sets (Suc n)]:j
|
|
|
3663 |
\<lbrace>st j \<and>* ps p4 \<and>* reps' p2 p3 (replicate (Suc n) 0) \<and>* tm p4 x\<rbrace>"
|
|
|
3664 |
apply (unfold h)
|
|
|
3665 |
by (rule hoare_skip_or_sets_set)
|
|
|
3666 |
|
|
|
3667 |
declare reps.simps[simp del]
|
|
|
3668 |
|
|
|
3669 |
lemma hoare_skip_or_sets_skip:
|
|
|
3670 |
assumes h: "n < length ks"
|
|
|
3671 |
shows "\<lbrace>st i \<and>* ps u \<and>* reps' u v (take n ks) \<and>* reps' (v + 1) w [ks!n] \<rbrace>
|
|
|
3672 |
i:[skip_or_sets (Suc n)]:j
|
|
|
3673 |
\<lbrace>st j \<and>* ps (w+1) \<and>* reps' u v (take n ks) \<and>* reps' (v + 1) w [ks!n]\<rbrace>"
|
|
|
3674 |
using h
|
|
|
3675 |
proof(induct n arbitrary: i j u v w ks)
|
|
|
3676 |
case 0
|
|
|
3677 |
show ?case
|
|
|
3678 |
apply (subst (1 5) reps'_def, simp add:sep_conj_cond, intro tm.pre_condI, simp)
|
|
|
3679 |
apply (unfold skip_or_sets_def, simp add:tpg_fold_sg)
|
|
|
3680 |
apply (unfold reps'_def, simp del:reps.simps)
|
|
|
3681 |
apply hsteps
|
|
|
3682 |
by (sep_cancel+, smt+)
|
|
|
3683 |
next
|
|
|
3684 |
case (Suc n)
|
|
|
3685 |
from `Suc n < length ks` have "n < length ks" by auto
|
|
|
3686 |
note h = Suc(1) [OF this]
|
|
|
3687 |
show ?case
|
|
|
3688 |
my_block
|
|
|
3689 |
from `Suc n < length ks`
|
|
|
3690 |
have eq_take: "take (Suc n) ks = take n ks @ [ks!n]"
|
|
|
3691 |
by (metis not_less_eq not_less_iff_gr_or_eq take_Suc_conv_app_nth)
|
|
|
3692 |
my_block_end
|
|
|
3693 |
apply (unfold this)
|
|
|
3694 |
apply (subst reps'_append, simp add:sep_conj_exists, rule tm.precond_exI)
|
|
|
3695 |
my_block
|
|
|
3696 |
have "(i :[ skip_or_sets (Suc (Suc n)) ]: j) =
|
|
|
3697 |
(i :[ (skip_or_sets (Suc n); skip_or_set )]: j)"
|
|
|
3698 |
proof -
|
|
|
3699 |
have eq_rep:
|
|
|
3700 |
"(replicate (Suc (Suc n)) skip_or_set) = ((replicate (Suc n) skip_or_set) @ [skip_or_set])"
|
|
|
3701 |
by (metis replicate_Suc replicate_append_same)
|
|
|
3702 |
have "replicate (Suc n) skip_or_set \<noteq> []" "[skip_or_set] \<noteq> []" by auto
|
|
|
3703 |
from tpg_fold_app[OF this]
|
|
|
3704 |
show ?thesis
|
|
|
3705 |
by (unfold skip_or_sets_def eq_rep, simp del:replicate.simps add:tpg_fold_sg)
|
|
|
3706 |
qed
|
|
|
3707 |
my_block_end
|
|
|
3708 |
apply (unfold this)
|
|
|
3709 |
my_block
|
|
|
3710 |
fix i j m
|
|
|
3711 |
have "\<lbrace>st i \<and>* ps u \<and>* (reps' u (m - 1) (take n ks) \<and>* reps' m v [ks ! n])\<rbrace>
|
|
|
3712 |
i :[ (skip_or_sets (Suc n)) ]: j
|
|
|
3713 |
\<lbrace>st j \<and>* ps (v + 1) \<and>* (reps' u (m - 1) (take n ks) \<and>* reps' m v [ks ! n])\<rbrace>"
|
|
|
3714 |
apply (rule h[THEN tm.hoare_adjust])
|
|
|
3715 |
by (sep_cancel+, auto)
|
|
|
3716 |
my_block_end my_note h_c1 = this
|
|
|
3717 |
my_block
|
|
|
3718 |
fix j' j m
|
|
|
3719 |
have "\<lbrace>st j' \<and>* ps (v + 1) \<and>* reps' (v + 1) w [ks ! Suc n]\<rbrace>
|
|
|
3720 |
j' :[ skip_or_set ]: j
|
|
|
3721 |
\<lbrace>st j \<and>* ps (w + 1) \<and>* reps' (v + 1) w [ks ! Suc n]\<rbrace>"
|
|
|
3722 |
apply (unfold reps'_def, simp)
|
|
|
3723 |
apply (rule hoare_skip_or_set_skip[THEN tm.hoare_adjust])
|
|
|
3724 |
by (sep_cancel+, smt)+
|
|
|
3725 |
my_block_end
|
|
|
3726 |
apply (hstep h_c1 this)+
|
|
|
3727 |
by ((fwd abs_reps'), simp, sep_cancel+)
|
|
|
3728 |
qed
|
|
|
3729 |
|
|
|
3730 |
lemma hoare_skip_or_sets_skip_gen[step]:
|
|
|
3731 |
assumes h: "n < length ks" "u = v" "x = w + 1"
|
|
|
3732 |
shows "\<lbrace>st i \<and>* ps u \<and>* reps' v w (take n ks) \<and>* reps' x y [ks!n] \<rbrace>
|
|
|
3733 |
i:[skip_or_sets (Suc n)]:j
|
|
|
3734 |
\<lbrace>st j \<and>* ps (y+1) \<and>* reps' v w (take n ks) \<and>* reps' x y [ks!n]\<rbrace>"
|
|
|
3735 |
by (unfold assms, rule hoare_skip_or_sets_skip[OF `n < length ks`])
|
|
|
3736 |
|
|
|
3737 |
lemma fam_conj_interv_simp:
|
|
|
3738 |
"(fam_conj {(ia::int)<..} p) = ((p (ia + 1)) \<and>* fam_conj {ia + 1 <..} p)"
|
|
|
3739 |
by (smt Collect_cong fam_conj_insert_simp greaterThan_def
|
|
|
3740 |
greaterThan_eq_iff greaterThan_iff insertI1
|
|
|
3741 |
insert_compr lessThan_iff mem_Collect_eq)
|
|
|
3742 |
|
|
|
3743 |
lemma zeros_fam_conj:
|
|
|
3744 |
assumes "u \<le> v"
|
|
|
3745 |
shows "(zeros u v \<and>* fam_conj {v<..} zero) = fam_conj {u - 1<..} zero"
|
|
|
3746 |
proof -
|
|
|
3747 |
have "{u - 1<..v} ## {v <..}" by (auto simp:set_ins_def)
|
|
|
3748 |
from fam_conj_disj_simp[OF this, symmetric]
|
|
|
3749 |
have "(fam_conj {u - 1<..v} zero \<and>* fam_conj {v<..} zero) = fam_conj ({u - 1<..v} + {v<..}) zero" .
|
|
|
3750 |
moreover
|
|
|
3751 |
from `u \<le> v` have eq_set: "{u - 1 <..} = {u - 1 <..v} + {v <..}" by (auto simp:set_ins_def)
|
|
|
3752 |
moreover have "fam_conj {u - 1<..v} zero = zeros u v"
|
|
|
3753 |
proof -
|
|
|
3754 |
have "({u - 1<..v}) = ({u .. v})" by auto
|
|
|
3755 |
moreover {
|
|
|
3756 |
fix u v
|
|
|
3757 |
assume "u \<le> (v::int)"
|
|
|
3758 |
hence "fam_conj {u .. v} zero = zeros u v"
|
|
|
3759 |
proof(induct rule:ones_induct)
|
|
|
3760 |
case (Base i j)
|
|
|
3761 |
thus ?case by auto
|
|
|
3762 |
next
|
|
|
3763 |
case (Step i j)
|
|
|
3764 |
thus ?case
|
|
|
3765 |
proof(cases "i = j")
|
|
|
3766 |
case True
|
|
|
3767 |
show ?thesis
|
|
|
3768 |
by (unfold True, simp add:fam_conj_simps)
|
|
|
3769 |
next
|
|
|
3770 |
case False
|
|
|
3771 |
with `i \<le> j` have hh: "i + 1 \<le> j" by auto
|
|
|
3772 |
hence eq_set: "{i..j} = (insert i {i + 1 .. j})"
|
|
|
3773 |
by (smt simp_from_to)
|
|
|
3774 |
have "i \<notin> {i + 1 .. j}" by simp
|
|
|
3775 |
from fam_conj_insert_simp[OF this, folded eq_set]
|
|
|
3776 |
have "fam_conj {i..j} zero = (zero i \<and>* fam_conj {i + 1..j} zero)" .
|
|
|
3777 |
with Step(2)[OF hh] Step
|
|
|
3778 |
show ?thesis by simp
|
|
|
3779 |
qed
|
|
|
3780 |
qed
|
|
|
3781 |
}
|
|
|
3782 |
moreover note this[OF `u \<le> v`]
|
|
|
3783 |
ultimately show ?thesis by simp
|
|
|
3784 |
qed
|
|
|
3785 |
ultimately show ?thesis by smt
|
|
|
3786 |
qed
|
|
|
3787 |
|
|
|
3788 |
declare replicate.simps [simp del]
|
|
|
3789 |
|
|
|
3790 |
lemma hoare_skip_or_sets_comb:
|
|
|
3791 |
assumes "length ks \<le> n"
|
|
|
3792 |
shows "\<lbrace>st i \<and>* ps u \<and>* reps u v ks \<and>* fam_conj {v<..} zero\<rbrace>
|
|
|
3793 |
i:[skip_or_sets (Suc n)]:j
|
|
|
3794 |
\<lbrace>st j \<and>* ps ((v + int (reps_len (list_ext n ks)) - int (reps_len ks))+ 2) \<and>*
|
|
|
3795 |
reps' u (v + int (reps_len (list_ext n ks)) - int (reps_len ks) + 1) (list_ext n ks) \<and>*
|
|
|
3796 |
fam_conj {(v + int (reps_len (list_ext n ks)) - int (reps_len ks) + 1)<..} zero \<rbrace>"
|
|
|
3797 |
proof(cases "ks = []")
|
|
|
3798 |
case True
|
|
|
3799 |
show ?thesis
|
|
|
3800 |
apply (subst True, simp only:reps.simps sep_conj_cond)
|
|
|
3801 |
apply (rule tm.pre_condI, simp)
|
|
|
3802 |
apply (rule_tac p = "st i \<and>* ps (v + 1) \<and>*
|
|
|
3803 |
zeros (v + 1) (v + 1 + int (reps_len (replicate (Suc n) 0))) \<and>*
|
|
|
3804 |
tm (v + 2 + int (reps_len (replicate (Suc n) 0))) Bk \<and>*
|
|
|
3805 |
fam_conj {(v + 2 + int (reps_len (replicate (Suc n) 0)))<..} zero
|
|
|
3806 |
" in tm.pre_stren)
|
|
|
3807 |
apply hsteps
|
|
|
3808 |
apply (auto simp:sep_conj_ac)[1]
|
|
|
3809 |
apply (auto simp:sep_conj_ac)[2]
|
|
|
3810 |
my_block
|
|
|
3811 |
from True have "(list_ext n ks) = (replicate (Suc n) 0)"
|
|
|
3812 |
by (metis append_Nil diff_zero list.size(3) list_ext_def)
|
|
|
3813 |
my_block_end my_note le_red = this
|
|
|
3814 |
my_block
|
|
|
3815 |
from True have "(reps_len ks) = 0"
|
|
|
3816 |
by (metis reps_len_nil)
|
|
|
3817 |
my_block_end
|
|
|
3818 |
apply (unfold this le_red, simp)
|
|
|
3819 |
my_block
|
|
|
3820 |
have "v + 2 + int (reps_len (replicate (Suc n) 0)) =
|
|
|
3821 |
v + int (reps_len (replicate (Suc n) 0)) + 2" by smt
|
|
|
3822 |
my_block_end my_note eq_len = this
|
|
|
3823 |
apply (unfold this)
|
|
|
3824 |
apply (sep_cancel+)
|
|
|
3825 |
apply (fold zero_def)
|
|
|
3826 |
apply (subst fam_conj_interv_simp, simp)
|
|
|
3827 |
apply (simp only:int_add_ac)
|
|
|
3828 |
apply (simp only:sep_conj_ac, sep_cancel+)
|
|
|
3829 |
my_block
|
|
|
3830 |
have "v + 1 \<le> (2 + (v + int (reps_len (replicate (Suc n) 0))))" by simp
|
|
|
3831 |
from zeros_fam_conj[OF this]
|
|
|
3832 |
have "(fam_conj {v<..} zero) = (zeros (v + 1) (2 + (v + int (reps_len (replicate (Suc n) 0)))) \<and>*
|
|
|
3833 |
fam_conj {2 + (v + int (reps_len (replicate (Suc n) 0)))<..} zero)"
|
|
|
3834 |
by simp
|
|
|
3835 |
my_block_end
|
|
|
3836 |
apply (subst (asm) this, simp only:int_add_ac, sep_cancel+)
|
|
|
3837 |
by (smt cond_true_eq2 sep.mult_assoc sep.mult_commute
|
|
|
3838 |
sep.mult_left_commute sep_conj_assoc sep_conj_commute
|
|
|
3839 |
sep_conj_left_commute zeros.simps zeros_rev)
|
|
|
3840 |
next
|
|
|
3841 |
case False
|
|
|
3842 |
show ?thesis
|
|
|
3843 |
my_block
|
|
|
3844 |
have "(i:[skip_or_sets (Suc n)]:j) =
|
|
|
3845 |
(i:[(skip_or_sets (length ks); skip_or_sets (Suc n - length ks))]:j)"
|
|
|
3846 |
apply (unfold skip_or_sets_def)
|
|
|
3847 |
my_block
|
|
|
3848 |
have "(replicate (Suc n) skip_or_set) =
|
|
|
3849 |
(replicate (length ks) skip_or_set @ (replicate (Suc n - length ks) skip_or_set))"
|
|
|
3850 |
by (smt assms replicate_add)
|
|
|
3851 |
my_block_end
|
|
|
3852 |
apply (unfold this, rule tpg_fold_app, simp add:False)
|
|
|
3853 |
by (insert `length ks \<le> n`, simp)
|
|
|
3854 |
my_block_end
|
|
|
3855 |
apply (unfold this)
|
|
|
3856 |
my_block
|
|
|
3857 |
from False have "length ks = (Suc (length ks - 1))" by simp
|
|
|
3858 |
my_block_end
|
|
|
3859 |
apply (subst (1) this)
|
|
|
3860 |
my_block
|
|
|
3861 |
from False
|
|
|
3862 |
have "(reps u v ks \<and>* fam_conj {v<..} zero) =
|
|
|
3863 |
(reps' u (v + 1) ks \<and>* fam_conj {v+1<..} zero)"
|
|
|
3864 |
apply (unfold reps'_def, simp)
|
|
|
3865 |
by (subst fam_conj_interv_simp, simp add:sep_conj_ac)
|
|
|
3866 |
my_block_end
|
|
|
3867 |
apply (unfold this)
|
|
|
3868 |
my_block
|
|
|
3869 |
fix i j
|
|
|
3870 |
have "\<lbrace>st i \<and>* ps u \<and>* reps' u (v + 1) ks \<rbrace>
|
|
|
3871 |
i :[ skip_or_sets (Suc (length ks - 1))]: j
|
|
|
3872 |
\<lbrace>st j \<and>* ps (v + 2) \<and>* reps' u (v + 1) ks \<rbrace>"
|
|
|
3873 |
my_block
|
|
|
3874 |
have "ks = take (length ks - 1) ks @ [ks!(length ks - 1)]"
|
|
|
3875 |
by (smt False drop_0 drop_eq_Nil id_take_nth_drop)
|
|
|
3876 |
my_block_end my_note eq_ks = this
|
|
|
3877 |
apply (subst (1) this)
|
|
|
3878 |
apply (unfold reps'_append, simp add:sep_conj_exists, rule tm.precond_exI)
|
|
|
3879 |
my_block
|
|
|
3880 |
from False have "(length ks - Suc 0) < length ks"
|
|
|
3881 |
by (smt `length ks = Suc (length ks - 1)`)
|
|
|
3882 |
my_block_end
|
|
|
3883 |
apply hsteps
|
|
|
3884 |
apply (subst eq_ks, unfold reps'_append, simp only:sep_conj_exists)
|
|
|
3885 |
by (rule_tac x = m in EXS_intro, simp add:sep_conj_ac, sep_cancel+, smt)
|
|
|
3886 |
my_block_end
|
|
|
3887 |
apply (hstep this)
|
|
|
3888 |
my_block
|
|
|
3889 |
fix u n
|
|
|
3890 |
have "(fam_conj {u <..} zero) =
|
|
|
3891 |
(zeros (u + 1) (u + int n + 1) \<and>* tm (u + int n + 2) Bk \<and>* fam_conj {(u + int n + 2)<..} zero)"
|
|
|
3892 |
my_block
|
|
|
3893 |
have "u + 1 \<le> (u + int n + 2)" by auto
|
|
|
3894 |
from zeros_fam_conj[OF this, symmetric]
|
|
|
3895 |
have "fam_conj {u<..} zero = (zeros (u + 1) (u + int n + 2) \<and>* fam_conj {u + int n + 2<..} zero)"
|
|
|
3896 |
by simp
|
|
|
3897 |
my_block_end
|
|
|
3898 |
apply (subst this)
|
|
|
3899 |
my_block
|
|
|
3900 |
have "(zeros (u + 1) (u + int n + 2)) =
|
|
|
3901 |
((zeros (u + 1) (u + int n + 1) \<and>* tm (u + int n + 2) Bk))"
|
|
|
3902 |
by (smt zero_def zeros_rev)
|
|
|
3903 |
my_block_end
|
|
|
3904 |
by (unfold this, auto simp:sep_conj_ac)
|
|
|
3905 |
my_block_end
|
|
|
3906 |
apply (subst (1) this[of _ "(reps_len (replicate (Suc (n - length ks)) 0))"])
|
|
|
3907 |
my_block
|
|
|
3908 |
from `length ks \<le> n`
|
|
|
3909 |
have "Suc n - length ks = Suc (n - length ks)" by auto
|
|
|
3910 |
my_block_end my_note eq_suc = this
|
|
|
3911 |
apply (subst this)
|
|
|
3912 |
apply hsteps
|
|
|
3913 |
apply (simp add: sep_conj_ac this, sep_cancel+)
|
|
|
3914 |
apply (fwd abs_reps')+
|
|
|
3915 |
my_block
|
|
|
3916 |
have "(int (reps_len (replicate (Suc (n - length ks)) 0))) =
|
|
|
3917 |
(int (reps_len (list_ext n ks)) - int (reps_len ks) - 1)"
|
|
|
3918 |
apply (unfold list_ext_def eq_suc)
|
|
|
3919 |
my_block
|
|
|
3920 |
have "replicate (Suc (n - length ks)) 0 \<noteq> []" by simp
|
|
|
3921 |
my_block_end
|
|
|
3922 |
by (unfold reps_len_split[OF False this], simp)
|
|
|
3923 |
my_block_end
|
|
|
3924 |
apply (unfold this)
|
|
|
3925 |
my_block
|
|
|
3926 |
from `length ks \<le> n`
|
|
|
3927 |
have "(ks @ replicate (Suc (n - length ks)) 0) = (list_ext n ks)"
|
|
|
3928 |
by (unfold list_ext_def, simp)
|
|
|
3929 |
my_block_end
|
|
|
3930 |
apply (unfold this, simp)
|
|
|
3931 |
apply (subst fam_conj_interv_simp, unfold zero_def, simp, simp add:int_add_ac sep_conj_ac)
|
|
|
3932 |
by (sep_cancel+, smt)
|
|
|
3933 |
qed
|
|
|
3934 |
|
|
|
3935 |
lemma hoare_skip_or_sets_comb_gen:
|
|
|
3936 |
assumes "length ks \<le> n" "u = v" "w = x"
|
|
|
3937 |
shows "\<lbrace>st i \<and>* ps u \<and>* reps v w ks \<and>* fam_conj {x<..} zero\<rbrace>
|
|
|
3938 |
i:[skip_or_sets (Suc n)]:j
|
|
|
3939 |
\<lbrace>st j \<and>* ps ((x + int (reps_len (list_ext n ks)) - int (reps_len ks))+ 2) \<and>*
|
|
|
3940 |
reps' u (x + int (reps_len (list_ext n ks)) - int (reps_len ks) + 1) (list_ext n ks) \<and>*
|
|
|
3941 |
fam_conj {(x + int (reps_len (list_ext n ks)) - int (reps_len ks) + 1)<..} zero \<rbrace>"
|
|
|
3942 |
by (unfold assms, rule hoare_skip_or_sets_comb[OF `length ks \<le> n`])
|
|
|
3943 |
|
|
|
3944 |
lemma list_ext_tail_expand:
|
|
|
3945 |
assumes h: "length ks \<le> a"
|
|
|
3946 |
shows "list_ext a ks = take a (list_ext a ks) @ [(list_ext a ks)!a]"
|
|
|
3947 |
proof -
|
|
|
3948 |
let ?l = "list_ext a ks"
|
|
|
3949 |
from h have eq_len: "length ?l = Suc a"
|
|
|
3950 |
by (smt list_ext_len_eq)
|
|
|
3951 |
hence "?l \<noteq> []" by auto
|
|
|
3952 |
hence "?l = take (length ?l - 1) ?l @ [?l!(length ?l - 1)]"
|
|
|
3953 |
by (metis `length (list_ext a ks) = Suc a` diff_Suc_1 le_refl
|
|
|
3954 |
lessI take_Suc_conv_app_nth take_all)
|
|
|
3955 |
from this[unfolded eq_len]
|
|
|
3956 |
show ?thesis by simp
|
|
|
3957 |
qed
|
|
|
3958 |
|
|
|
3959 |
lemma reps'_nn_expand:
|
|
|
3960 |
assumes "xs \<noteq> []"
|
|
|
3961 |
shows "(reps' u v xs) = (reps u (v - 1) xs \<and>* zero v)"
|
|
|
3962 |
by (metis assms reps'_def)
|
|
|
3963 |
|
|
|
3964 |
lemma sep_conj_st1: "(p \<and>* st t \<and>* q) = (st t \<and>* p \<and>* q)"
|
|
|
3965 |
by (simp only:sep_conj_ac)
|
|
|
3966 |
|
|
|
3967 |
lemma sep_conj_st2: "(p \<and>* st t) = (st t \<and>* p)"
|
|
|
3968 |
by (simp only:sep_conj_ac)
|
|
|
3969 |
|
|
|
3970 |
lemma sep_conj_st3: "((st t \<and>* p) \<and>* r) = (st t \<and>* p \<and>* r)"
|
|
|
3971 |
by (simp only:sep_conj_ac)
|
|
|
3972 |
|
|
|
3973 |
lemma sep_conj_st4: "(EXS x. (st t \<and>* r x)) = ((st t) \<and>* (EXS x. r x))"
|
|
|
3974 |
apply (unfold pred_ex_def, default+)
|
|
|
3975 |
apply (safe)
|
|
|
3976 |
apply (sep_cancel, auto)
|
|
|
3977 |
by (auto elim!: sep_conjE intro!:sep_conjI)
|
|
|
3978 |
|
|
|
3979 |
lemmas sep_conj_st = sep_conj_st1 sep_conj_st2 sep_conj_st3 sep_conj_st4
|
|
|
3980 |
|
|
|
3981 |
lemma sep_conj_cond3 : "(<cond1> \<and>* <cond2>) = <(cond1 \<and> cond2)>"
|
|
|
3982 |
by (smt cond_eqI cond_true_eq sep_conj_commute sep_conj_empty)
|
|
|
3983 |
|
|
|
3984 |
lemma sep_conj_cond4 : "(<cond1> \<and>* <cond2> \<and>* r) = (<(cond1 \<and> cond2)> \<and>* r)"
|
|
|
3985 |
by (metis Hoare_gen.sep_conj_cond3 Hoare_tm.sep_conj_cond3)
|
|
|
3986 |
|
|
|
3987 |
lemmas sep_conj_cond = sep_conj_cond3 sep_conj_cond4 sep_conj_cond
|
|
|
3988 |
|
|
|
3989 |
lemma hoare_left_until_zero_reps:
|
|
|
3990 |
"\<lbrace>st i ** ps v ** zero u ** reps (u + 1) v [k]\<rbrace>
|
|
|
3991 |
i:[left_until_zero]:j
|
|
|
3992 |
\<lbrace>st j ** ps u ** zero u ** reps (u + 1) v [k]\<rbrace>"
|
|
|
3993 |
apply (unfold reps.simps, simp only:sep_conj_cond)
|
|
|
3994 |
apply (rule tm.pre_condI, simp)
|
|
|
3995 |
by hstep
|
|
|
3996 |
|
|
|
3997 |
lemma hoare_left_until_zero_reps_gen[step]:
|
|
|
3998 |
assumes "u = x" "w = v + 1"
|
|
|
3999 |
shows "\<lbrace>st i ** ps u ** zero v ** reps w x [k]\<rbrace>
|
|
|
4000 |
i:[left_until_zero]:j
|
|
|
4001 |
\<lbrace>st j ** ps v ** zero v ** reps w x [k]\<rbrace>"
|
|
|
4002 |
by (unfold assms, rule hoare_left_until_zero_reps)
|
|
|
4003 |
|
|
|
4004 |
lemma reps_lenE:
|
|
|
4005 |
assumes "reps u v ks s"
|
|
|
4006 |
shows "( <(v = u + int (reps_len ks) - 1)> \<and>* reps u v ks ) s"
|
|
|
4007 |
proof(rule condI)
|
|
|
4008 |
from reps_len_correct[OF assms] show "v = u + int (reps_len ks) - 1" .
|
|
|
4009 |
next
|
|
|
4010 |
from assms show "reps u v ks s" .
|
|
|
4011 |
qed
|
|
|
4012 |
|
|
|
4013 |
lemma condI1:
|
|
|
4014 |
assumes "p s" "b"
|
|
|
4015 |
shows "(<b> \<and>* p) s"
|
|
|
4016 |
proof(rule condI[OF assms(2)])
|
|
|
4017 |
from assms(1) show "p s" .
|
|
|
4018 |
qed
|
|
|
4019 |
|
|
|
4020 |
lemma hoare_locate_set:
|
|
|
4021 |
assumes "length ks \<le> n"
|
|
|
4022 |
shows "\<lbrace>st i \<and>* zero (u - 1) \<and>* ps u \<and>* reps u v ks \<and>* fam_conj {v<..} zero\<rbrace>
|
|
|
4023 |
i:[locate n]:j
|
|
|
4024 |
\<lbrace>st j \<and>* zero (u - 1) \<and>*
|
|
|
4025 |
(EXS m w. ps m \<and>* reps' u (m - 1) (take n (list_ext n ks)) \<and>*
|
|
|
4026 |
reps m w [(list_ext n ks)!n] \<and>* fam_conj {w<..} zero)\<rbrace>"
|
|
|
4027 |
proof(cases "take n (list_ext n ks) = []")
|
|
|
4028 |
case False
|
|
|
4029 |
show ?thesis
|
|
|
4030 |
apply (unfold locate_def)
|
|
|
4031 |
apply (hstep hoare_skip_or_sets_comb_gen)
|
|
|
4032 |
apply (subst (3) list_ext_tail_expand[OF `length ks \<le> n`])
|
|
|
4033 |
apply (subst (1) reps'_append, simp add:sep_conj_exists)
|
|
|
4034 |
apply (rule tm.precond_exI)
|
|
|
4035 |
apply (subst (1) reps'_nn_expand[OF False])
|
|
|
4036 |
apply (rule_tac p = "st j' \<and>* <(m = u + int (reps_len (take n (list_ext n ks))) + 1)> \<and>*
|
|
|
4037 |
ps (v + int (reps_len (list_ext n ks)) - int (reps_len ks) + 2) \<and>*
|
|
|
4038 |
((reps u (m - 1 - 1) (take n (list_ext n ks)) \<and>* zero (m - 1)) \<and>*
|
|
|
4039 |
reps' m (v + int (reps_len (list_ext n ks)) - int (reps_len ks) + 1)
|
|
|
4040 |
[list_ext n ks ! n]) \<and>*
|
|
|
4041 |
fam_conj
|
|
|
4042 |
{v + int (reps_len (list_ext n ks)) - int (reps_len ks) + 1<..}
|
|
|
4043 |
zero \<and>*
|
|
|
4044 |
zero (u - 1)"
|
|
|
4045 |
in tm.pre_stren)
|
|
|
4046 |
my_block
|
|
|
4047 |
have "[list_ext n ks ! n] \<noteq> []" by simp
|
|
|
4048 |
from reps'_nn_expand[OF this]
|
|
|
4049 |
have "(reps' m (v + int (reps_len (list_ext n ks)) - int (reps_len ks) + 1) [list_ext n ks ! n]) =
|
|
|
4050 |
(reps m (v + (int (reps_len (list_ext n ks)) - int (reps_len ks))) [list_ext n ks ! n] \<and>*
|
|
|
4051 |
zero (v + int (reps_len (list_ext n ks)) - int (reps_len ks) + 1))"
|
|
|
4052 |
by simp
|
|
|
4053 |
my_block_end
|
|
|
4054 |
apply (subst this)
|
|
|
4055 |
my_block
|
|
|
4056 |
have "(fam_conj {v + int (reps_len (list_ext n ks)) - int (reps_len ks) + 1<..} zero) =
|
|
|
4057 |
(zero (v + int (reps_len (list_ext n ks)) - int (reps_len ks) + 2) \<and>*
|
|
|
4058 |
fam_conj {v + int (reps_len (list_ext n ks)) - int (reps_len ks) + 2<..} zero)"
|
|
|
4059 |
by (subst fam_conj_interv_simp, smt)
|
|
|
4060 |
my_block_end
|
|
|
4061 |
apply (unfold this)
|
|
|
4062 |
apply (simp only:sep_conj_st)
|
|
|
4063 |
apply hsteps
|
|
|
4064 |
apply (auto simp:sep_conj_ac)[1]
|
|
|
4065 |
apply (sep_cancel+)
|
|
|
4066 |
apply (rule_tac x = m in EXS_intro)
|
|
|
4067 |
apply (rule_tac x = "m + int (list_ext n ks ! n)" in EXS_intro)
|
|
|
4068 |
apply (simp add:sep_conj_ac del:ones_simps, sep_cancel+)
|
|
|
4069 |
apply (subst (asm) sep_conj_cond)+
|
|
|
4070 |
apply (erule_tac condE, clarsimp, simp add:sep_conj_ac int_add_ac)
|
|
|
4071 |
apply (fwd abs_reps')
|
|
|
4072 |
apply (fwd abs_reps')
|
|
|
4073 |
apply (simp add:sep_conj_ac int_add_ac)
|
|
|
4074 |
apply (sep_cancel+)
|
|
|
4075 |
apply (subst (asm) reps'_def, subst fam_conj_interv_simp, subst fam_conj_interv_simp,
|
|
|
4076 |
simp add:sep_conj_ac int_add_ac)
|
|
|
4077 |
my_block
|
|
|
4078 |
fix s
|
|
|
4079 |
assume h: "(reps (1 + (u + int (reps_len (take n (list_ext n ks)))))
|
|
|
4080 |
(v + (- int (reps_len ks) + int (reps_len (list_ext n ks)))) [list_ext n ks ! n]) s"
|
|
|
4081 |
(is "?P s")
|
|
|
4082 |
from reps_len_correct[OF this] list_ext_tail_expand[OF `length ks \<le> n`]
|
|
|
4083 |
have hh: "v + (- int (reps_len ks) +
|
|
|
4084 |
int (reps_len (take n (list_ext n ks) @ [list_ext n ks ! n]))) =
|
|
|
4085 |
1 + (u + int (reps_len (take n (list_ext n ks)))) +
|
|
|
4086 |
int (reps_len [list_ext n ks ! n]) - 1"
|
|
|
4087 |
by metis
|
|
|
4088 |
have "[list_ext n ks ! n] \<noteq> []" by simp
|
|
|
4089 |
from hh[unfolded reps_len_split[OF False this]]
|
|
|
4090 |
have "v = u + (int (reps_len ks)) - 1"
|
|
|
4091 |
by simp
|
|
|
4092 |
from condI1[where p = ?P, OF h this]
|
|
|
4093 |
have "(<(v = u + int (reps_len ks) - 1)> \<and>*
|
|
|
4094 |
reps (1 + (u + int (reps_len (take n (list_ext n ks)))))
|
|
|
4095 |
(v + (- int (reps_len ks) + int (reps_len (list_ext n ks)))) [list_ext n ks ! n]) s" .
|
|
|
4096 |
my_block_end
|
|
|
4097 |
apply (fwd this, (subst (asm) sep_conj_cond)+, erule condE, simp add:sep_conj_ac int_add_ac
|
|
|
4098 |
reps_len_sg)
|
|
|
4099 |
apply (fwd reps_lenE, (subst (asm) sep_conj_cond)+, erule condE, simp add:sep_conj_ac int_add_ac
|
|
|
4100 |
reps_len_sg)
|
|
|
4101 |
by (fwd reps_lenE, (subst (asm) sep_conj_cond)+, erule condE, simp add:sep_conj_ac)
|
|
|
4102 |
next
|
|
|
4103 |
case True
|
|
|
4104 |
show ?thesis
|
|
|
4105 |
apply (unfold locate_def)
|
|
|
4106 |
apply (hstep hoare_skip_or_sets_comb)
|
|
|
4107 |
apply (subst (3) list_ext_tail_expand[OF `length ks \<le> n`])
|
|
|
4108 |
apply (subst (1) reps'_append, simp add:sep_conj_exists)
|
|
|
4109 |
apply (rule tm.precond_exI)
|
|
|
4110 |
my_block
|
|
|
4111 |
from True `length ks \<le> n`
|
|
|
4112 |
have "ks = []" "n = 0"
|
|
|
4113 |
apply (metis le0 le_antisym length_0_conv less_nat_zero_code list_ext_len take_eq_Nil)
|
|
|
4114 |
by (smt True length_take list.size(3) list_ext_len)
|
|
|
4115 |
my_block_end
|
|
|
4116 |
apply (unfold True this)
|
|
|
4117 |
apply (simp add:reps'_def list_ext_def reps.simps reps_len_def reps_sep_len_def
|
|
|
4118 |
reps_ctnt_len_def
|
|
|
4119 |
del:ones_simps)
|
|
|
4120 |
apply (subst sep_conj_cond)+
|
|
|
4121 |
apply (rule tm.pre_condI, simp del:ones_simps)
|
|
|
4122 |
apply (subst fam_conj_interv_simp, simp add:sep_conj_st del:ones_simps)
|
|
|
4123 |
apply (hsteps)
|
|
|
4124 |
apply (auto simp:sep_conj_ac)[1]
|
|
|
4125 |
apply (sep_cancel+)
|
|
|
4126 |
apply (rule_tac x = "(v + int (listsum (replicate (Suc 0) (Suc 0))))" in EXS_intro)+
|
|
|
4127 |
apply (simp only:sep_conj_ac, sep_cancel+)
|
|
|
4128 |
apply (auto)
|
|
|
4129 |
apply (subst fam_conj_interv_simp)
|
|
|
4130 |
apply (subst fam_conj_interv_simp)
|
|
|
4131 |
by smt
|
|
|
4132 |
qed
|
|
|
4133 |
|
|
|
4134 |
lemma hoare_locate_set_gen[step]:
|
|
|
4135 |
assumes "length ks \<le> n"
|
|
|
4136 |
"u = v - 1" "v = w" "x = y"
|
|
|
4137 |
shows "\<lbrace>st i \<and>* zero u \<and>* ps v \<and>* reps w x ks \<and>* fam_conj {y<..} zero\<rbrace>
|
|
|
4138 |
i:[locate n]:j
|
|
|
4139 |
\<lbrace>st j \<and>* zero u \<and>*
|
|
|
4140 |
(EXS m w. ps m \<and>* reps' v (m - 1) (take n (list_ext n ks)) \<and>*
|
|
|
4141 |
reps m w [(list_ext n ks)!n] \<and>* fam_conj {w<..} zero)\<rbrace>"
|
|
|
4142 |
by (unfold assms, rule hoare_locate_set[OF `length ks \<le> n`])
|
|
|
4143 |
|
|
|
4144 |
lemma hoare_locate_skip:
|
|
|
4145 |
assumes h: "n < length ks"
|
|
|
4146 |
shows
|
|
|
4147 |
"\<lbrace>st i \<and>* ps u \<and>* zero (u - 1) \<and>* reps' u (v - 1) (take n ks) \<and>* reps' v w [ks!n] \<and>* tm (w + 1) x\<rbrace>
|
|
|
4148 |
i:[locate n]:j
|
|
|
4149 |
\<lbrace>st j \<and>* ps v \<and>* zero (u - 1) \<and>* reps' u (v - 1) (take n ks) \<and>* reps' v w [ks!n] \<and>* tm (w + 1) x\<rbrace>"
|
|
|
4150 |
proof -
|
|
|
4151 |
show ?thesis
|
|
|
4152 |
apply (unfold locate_def)
|
|
|
4153 |
apply hsteps
|
|
|
4154 |
apply (subst (2 4) reps'_def, simp add:reps.simps sep_conj_cond del:ones_simps)
|
|
|
4155 |
apply (intro tm.pre_condI, simp del:ones_simps)
|
|
|
4156 |
apply hsteps
|
|
|
4157 |
apply (case_tac "(take n ks) = []", simp add:reps'_def sep_conj_cond del:ones_simps)
|
|
|
4158 |
apply (rule tm.pre_condI, simp del:ones_simps)
|
|
|
4159 |
apply hsteps
|
|
|
4160 |
apply (simp del:ones_simps add:reps'_def)
|
|
|
4161 |
by hsteps
|
|
|
4162 |
qed
|
|
|
4163 |
|
|
|
4164 |
|
|
|
4165 |
lemma hoare_locate_skip_gen[step]:
|
|
|
4166 |
assumes "n < length ks"
|
|
|
4167 |
"v = u - 1" "w = u" "x = y - 1" "z' = z + 1"
|
|
|
4168 |
shows
|
|
|
4169 |
"\<lbrace>st i \<and>* ps u \<and>* tm v Bk \<and>* reps' w x (take n ks) \<and>* reps' y z [ks!n] \<and>* tm z' vx\<rbrace>
|
|
|
4170 |
i:[locate n]:j
|
|
|
4171 |
\<lbrace>st j \<and>* ps y \<and>* tm v Bk \<and>* reps' w x (take n ks) \<and>* reps' y z [ks!n] \<and>* tm z' vx\<rbrace>"
|
|
|
4172 |
by (unfold assms, fold zero_def, rule hoare_locate_skip[OF `n < length ks`])
|
|
|
4173 |
|
|
|
4174 |
lemma ones_int_expand: "(ones m (m + int k)) = (one m \<and>* ones (m + 1) (m + int k))"
|
|
|
4175 |
by (simp add:ones_simps)
|
|
|
4176 |
|
|
|
4177 |
lemma reps_splitedI:
|
|
|
4178 |
assumes h1: "(reps u v ks1 \<and>* zero (v + 1) \<and>* reps (v + 2) w ks2) s"
|
|
|
4179 |
and h2: "ks1 \<noteq> []"
|
|
|
4180 |
and h3: "ks2 \<noteq> []"
|
|
|
4181 |
shows "(reps u w (ks1 @ ks2)) s"
|
|
|
4182 |
proof -
|
|
|
4183 |
from h2 h3
|
|
|
4184 |
have "splited (ks1 @ ks2) ks1 ks2" by (auto simp:splited_def)
|
|
|
4185 |
from h1 obtain s1 where
|
|
|
4186 |
"(reps u v ks1) s1" by (auto elim:sep_conjE)
|
|
|
4187 |
from h1 obtain s2 where
|
|
|
4188 |
"(reps (v + 2) w ks2) s2" by (auto elim:sep_conjE)
|
|
|
4189 |
from reps_len_correct[OF `(reps u v ks1) s1`]
|
|
|
4190 |
have eq_v: "v = u + int (reps_len ks1) - 1" .
|
|
|
4191 |
from reps_len_correct[OF `(reps (v + 2) w ks2) s2`]
|
|
|
4192 |
have eq_w: "w = v + 2 + int (reps_len ks2) - 1" .
|
|
|
4193 |
from h1
|
|
|
4194 |
have "(reps u (u + int (reps_len ks1) - 1) ks1 \<and>*
|
|
|
4195 |
zero (u + int (reps_len ks1)) \<and>* reps (u + int (reps_len ks1) + 1) w ks2) s"
|
|
|
4196 |
apply (unfold eq_v eq_w[unfolded eq_v])
|
|
|
4197 |
by (sep_cancel+, smt)
|
|
|
4198 |
thus ?thesis
|
|
|
4199 |
by(unfold reps_splited[OF `splited (ks1 @ ks2) ks1 ks2`], simp)
|
|
|
4200 |
qed
|
|
|
4201 |
|
|
|
4202 |
lemma reps_sucI:
|
|
|
4203 |
assumes h: "(reps u v (xs@[x]) \<and>* one (1 + v)) s"
|
|
|
4204 |
shows "(reps u (1 + v) (xs@[Suc x])) s"
|
|
|
4205 |
proof(cases "xs = []")
|
|
|
4206 |
case True
|
|
|
4207 |
from h obtain s' where "(reps u v (xs@[x])) s'" by (auto elim:sep_conjE)
|
|
|
4208 |
from reps_len_correct[OF this] have " v = u + int (reps_len (xs @ [x])) - 1" .
|
|
|
4209 |
with True have eq_v: "v = u + int x" by (simp add:reps_len_sg)
|
|
|
4210 |
have eq_one1: "(one (1 + (u + int x)) \<and>* ones (u + 1) (u + int x)) = ones (u + 1) (1 + (u + int x))"
|
|
|
4211 |
by (smt ones_rev sep.mult_commute)
|
|
|
4212 |
from h show ?thesis
|
|
|
4213 |
apply (unfold True, simp add:eq_v reps.simps sep_conj_cond sep_conj_ac ones_rev)
|
|
|
4214 |
by (sep_cancel+, simp add: eq_one1, smt)
|
|
|
4215 |
next
|
|
|
4216 |
case False
|
|
|
4217 |
from h obtain s1 s2 where hh: "(reps u v (xs@[x])) s1" "s = s1 + s2" "s1 ## s2" "one (1 + v) s2"
|
|
|
4218 |
by (auto elim:sep_conjE)
|
|
|
4219 |
from hh(1)[unfolded reps_rev[OF False]]
|
|
|
4220 |
obtain s11 s12 s13 where hhh:
|
|
|
4221 |
"(reps u (v - int (x + 1) - 1) xs) s11"
|
|
|
4222 |
"(zero (v - int (x + 1))) s12" "(ones (v - int x) v) s13"
|
|
|
4223 |
"s11 ## (s12 + s13)" "s12 ## s13" "s1 = s11 + s12 + s13"
|
|
|
4224 |
apply (atomize_elim)
|
|
|
4225 |
apply(elim sep_conjE)+
|
|
|
4226 |
apply (rule_tac x = xa in exI)
|
|
|
4227 |
apply (rule_tac x = xaa in exI)
|
|
|
4228 |
apply (rule_tac x = ya in exI)
|
|
|
4229 |
apply (intro conjI, assumption+)
|
|
|
4230 |
by (auto simp:set_ins_def)
|
|
|
4231 |
show ?thesis
|
|
|
4232 |
proof(rule reps_splitedI[where v = "(v - int (x + 1) - 1)"])
|
|
|
4233 |
show "(reps u (v - int (x + 1) - 1) xs \<and>* zero (v - int (x + 1) - 1 + 1) \<and>*
|
|
|
4234 |
reps (v - int (x + 1) - 1 + 2) (1 + v) [Suc x]) s"
|
|
|
4235 |
proof(rule sep_conjI)
|
|
|
4236 |
from hhh(1) show "reps u (v - int (x + 1) - 1) xs s11" .
|
|
|
4237 |
next
|
|
|
4238 |
show "(zero (v - int (x + 1) - 1 + 1) \<and>* reps (v - int (x + 1) - 1 + 2) (1 + v) [Suc x]) (s12 + (s13 + s2))"
|
|
|
4239 |
proof(rule sep_conjI)
|
|
|
4240 |
from hhh(2) show "zero (v - int (x + 1) - 1 + 1) s12" by smt
|
|
|
4241 |
next
|
|
|
4242 |
from hh(4) hhh(3)
|
|
|
4243 |
show "reps (v - int (x + 1) - 1 + 2) (1 + v) [Suc x] (s13 + s2)"
|
|
|
4244 |
apply (simp add:reps.simps del:ones_simps add:ones_rev)
|
|
|
4245 |
by (smt hh(3) hh(4) hhh(4) hhh(5) hhh(6) sep_add_disjD sep_conjI sep_disj_addI1)
|
|
|
4246 |
next
|
|
|
4247 |
show "s12 ## s13 + s2"
|
|
|
4248 |
by (metis hh(3) hhh(4) hhh(5) hhh(6) sep_add_commute sep_add_disjD
|
|
|
4249 |
sep_add_disjI2 sep_disj_addD sep_disj_addD1 sep_disj_addI1 sep_disj_commuteI)
|
|
|
4250 |
next
|
|
|
4251 |
show "s12 + (s13 + s2) = s12 + (s13 + s2)" by metis
|
|
|
4252 |
qed
|
|
|
4253 |
next
|
|
|
4254 |
show "s11 ## s12 + (s13 + s2)"
|
|
|
4255 |
by (metis hh(3) hhh(4) hhh(5) hhh(6) sep_disj_addD1 sep_disj_addI1 sep_disj_addI3)
|
|
|
4256 |
next
|
|
|
4257 |
show "s = s11 + (s12 + (s13 + s2))"
|
|
|
4258 |
by (smt hh(2) hh(3) hhh(4) hhh(5) hhh(6) sep_add_assoc sep_add_commute
|
|
|
4259 |
sep_add_disjD sep_add_disjI2 sep_disj_addD1 sep_disj_addD2
|
|
|
4260 |
sep_disj_addI1 sep_disj_addI3 sep_disj_commuteI)
|
|
|
4261 |
qed
|
|
|
4262 |
next
|
|
|
4263 |
from False show "xs \<noteq> []" .
|
|
|
4264 |
next
|
|
|
4265 |
show "[Suc x] \<noteq> []" by simp
|
|
|
4266 |
qed
|
|
|
4267 |
qed
|
|
|
4268 |
|
|
|
4269 |
lemma cond_expand: "(<cond> \<and>* p) s = (cond \<and> (p s))"
|
|
|
4270 |
by (metis (full_types) condD pasrt_def sep_conj_commuteI
|
|
|
4271 |
sep_conj_sep_emptyI sep_empty_def sep_globalise)
|
|
|
4272 |
|
|
|
4273 |
lemma ones_rev1:
|
|
|
4274 |
assumes "\<not> (1 + n) < m"
|
|
|
4275 |
shows "(ones m n \<and>* one (1 + n)) = (ones m (1 + n))"
|
|
|
4276 |
by (insert ones_rev[OF assms, simplified], simp)
|
|
|
4277 |
|
|
|
4278 |
lemma reps_one_abs:
|
|
|
4279 |
assumes "(reps u v [k] \<and>* one w) s"
|
|
|
4280 |
"w = v + 1"
|
|
|
4281 |
shows "(reps u w [Suc k]) s"
|
|
|
4282 |
using assms unfolding assms
|
|
|
4283 |
apply (simp add:reps.simps sep_conj_ac)
|
|
|
4284 |
apply (subst (asm) sep_conj_cond)+
|
|
|
4285 |
apply (erule condE, simp)
|
|
|
4286 |
by (simp add:ones_rev sep_conj_ac, sep_cancel+, smt)
|
|
|
4287 |
|
|
|
4288 |
lemma reps'_reps_abs:
|
|
|
4289 |
assumes "(reps' u v xs \<and>* reps w x ys) s"
|
|
|
4290 |
"w = v + 1" "ys \<noteq> []"
|
|
|
4291 |
shows "(reps u x (xs@ys)) s"
|
|
|
4292 |
proof(cases "xs = []")
|
|
|
4293 |
case False
|
|
|
4294 |
with assms
|
|
|
4295 |
have h: "splited (xs@ys) xs ys" by (simp add:splited_def)
|
|
|
4296 |
from assms(1)[unfolded assms(2)]
|
|
|
4297 |
show ?thesis
|
|
|
4298 |
apply (unfold reps_splited[OF h])
|
|
|
4299 |
apply (insert False, unfold reps'_def, simp)
|
|
|
4300 |
apply (fwd reps_lenE, (subst (asm) sep_conj_cond)+)
|
|
|
4301 |
by (erule condE, simp)
|
|
|
4302 |
next
|
|
|
4303 |
case True
|
|
|
4304 |
with assms
|
|
|
4305 |
show ?thesis
|
|
|
4306 |
apply (simp add:reps'_def)
|
|
|
4307 |
by (erule condE, simp)
|
|
|
4308 |
qed
|
|
|
4309 |
|
|
|
4310 |
lemma reps_one_abs1:
|
|
|
4311 |
assumes "(reps u v (xs@[k]) \<and>* one w) s"
|
|
|
4312 |
"w = v + 1"
|
|
|
4313 |
shows "(reps u w (xs@[Suc k])) s"
|
|
|
4314 |
proof(cases "xs = []")
|
|
|
4315 |
case True
|
|
|
4316 |
with assms reps_one_abs
|
|
|
4317 |
show ?thesis by simp
|
|
|
4318 |
next
|
|
|
4319 |
case False
|
|
|
4320 |
hence "splited (xs@[k]) xs [k]" by (simp add:splited_def)
|
|
|
4321 |
from assms(1)[unfolded reps_splited[OF this] assms(2)]
|
|
|
4322 |
show ?thesis
|
|
|
4323 |
apply (fwd reps_one_abs)
|
|
|
4324 |
apply (fwd reps_reps'_abs)
|
|
|
4325 |
apply (fwd reps'_reps_abs)
|
|
|
4326 |
by (simp add:assms)
|
|
|
4327 |
qed
|
|
|
4328 |
|
|
|
4329 |
lemma tm_hoare_inc00:
|
|
|
4330 |
assumes h: "a < length ks \<and> ks ! a = v"
|
|
|
4331 |
shows "\<lbrace>st i \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>* reps u ia ks \<and>* fam_conj {ia<..} zero\<rbrace>
|
|
|
4332 |
i :[ Inc a ]: j
|
|
|
4333 |
\<lbrace>st j \<and>*
|
|
|
4334 |
ps u \<and>*
|
|
|
4335 |
zero (u - 2) \<and>*
|
|
|
4336 |
zero (u - 1) \<and>*
|
|
|
4337 |
reps u (ia + int (reps_len (list_ext a ks)) - int (reps_len ks) + 1) (ks[a := Suc v]) \<and>*
|
|
|
4338 |
fam_conj {(ia + int (reps_len (list_ext a ks)) - int (reps_len ks) + 1)<..} zero\<rbrace>"
|
|
|
4339 |
(is "\<lbrace> ?P \<rbrace> ?code \<lbrace> ?Q \<rbrace>")
|
|
|
4340 |
proof -
|
|
|
4341 |
from h have "a < length ks" "ks ! a = v" by auto
|
|
|
4342 |
from list_nth_expand[OF `a < length ks`]
|
|
|
4343 |
have eq_ks: "ks = take a ks @ [ks!a] @ drop (Suc a) ks" .
|
|
|
4344 |
from `a < length ks` have "ks \<noteq> []" by auto
|
|
|
4345 |
hence "(reps u ia ks \<and>* zero (ia + 1)) = reps' u (ia + 1) ks"
|
|
|
4346 |
by (simp add:reps'_def)
|
|
|
4347 |
also from eq_ks have "\<dots> = reps' u (ia + 1) (take a ks @ [ks!a] @ drop (Suc a) ks)" by simp
|
|
|
4348 |
also have "\<dots> = (EXS m. reps' u (m - 1) (take a ks) \<and>*
|
|
|
4349 |
reps' m (ia + 1) (ks ! a # drop (Suc a) ks))"
|
|
|
4350 |
by (simp add:reps'_append)
|
|
|
4351 |
also have "\<dots> = (EXS m. reps' u (m - 1) (take a ks) \<and>*
|
|
|
4352 |
reps' m (ia + 1) ([ks ! a] @ drop (Suc a) ks))"
|
|
|
4353 |
by simp
|
|
|
4354 |
also have "\<dots> = (EXS m ma. reps' u (m - 1) (take a ks) \<and>*
|
|
|
4355 |
reps' m (ma - 1) [ks ! a] \<and>* reps' ma (ia + 1) (drop (Suc a) ks))"
|
|
|
4356 |
by (simp only:reps'_append sep_conj_exists)
|
|
|
4357 |
finally have eq_s: "(reps u ia ks \<and>* zero (ia + 1)) = \<dots>" .
|
|
|
4358 |
{ fix m ma
|
|
|
4359 |
have eq_u: "-1 + u = u - 1" by smt
|
|
|
4360 |
have " \<lbrace>st i \<and>*
|
|
|
4361 |
ps u \<and>*
|
|
|
4362 |
zero (u - 2) \<and>*
|
|
|
4363 |
zero (u - 1) \<and>*
|
|
|
4364 |
(reps' u (m - 1) (take a ks) \<and>*
|
|
|
4365 |
reps' m (ma - 1) [ks ! a] \<and>* reps' ma (ia + 1) (drop (Suc a) ks)) \<and>*
|
|
|
4366 |
fam_conj {ia + 1<..} zero\<rbrace>
|
|
|
4367 |
i :[ Inc a ]: j
|
|
|
4368 |
\<lbrace>st j \<and>*
|
|
|
4369 |
ps u \<and>*
|
|
|
4370 |
zero (u - 2) \<and>*
|
|
|
4371 |
zero (u - 1) \<and>*
|
|
|
4372 |
reps u (ia + int (reps_len (list_ext a ks)) - int (reps_len ks) + 1) (ks[a := Suc v]) \<and>*
|
|
|
4373 |
fam_conj {ia + int (reps_len (list_ext a ks)) - int (reps_len ks) + 1<..} zero\<rbrace>"
|
|
|
4374 |
proof(cases "(drop (Suc a) ks) = []")
|
|
|
4375 |
case True
|
|
|
4376 |
{ fix hc
|
|
|
4377 |
have eq_1: "(1 + (m + int (ks ! a))) = (m + int (ks ! a) + 1)" by simp
|
|
|
4378 |
have eq_2: "take a ks @ [Suc (ks ! a)] = ks[a := Suc v]"
|
|
|
4379 |
apply (subst (3) eq_ks, unfold True, simp)
|
|
|
4380 |
by (metis True append_Nil2 eq_ks h upd_conv_take_nth_drop)
|
|
|
4381 |
assume h: "(fam_conj {1 + (m + int (ks ! a))<..} zero \<and>*
|
|
|
4382 |
reps u (1 + (m + int (ks ! a))) (take a ks @ [Suc (ks ! a)])) hc"
|
|
|
4383 |
hence "(fam_conj {m + int (ks ! a) + 1<..} zero \<and>* reps u (m + int (ks ! a) + 1) (ks[a := Suc v])) hc"
|
|
|
4384 |
by (unfold eq_1 eq_2 , sep_cancel+)
|
|
|
4385 |
} note eq_fam = this
|
|
|
4386 |
show ?thesis
|
|
|
4387 |
apply (unfold Inc_def, subst (3) reps'_def, simp add:True sep_conj_cond)
|
|
|
4388 |
apply (intro tm.pre_condI, simp)
|
|
|
4389 |
apply (subst fam_conj_interv_simp, simp, subst (3) zero_def)
|
|
|
4390 |
apply hsteps
|
|
|
4391 |
apply (subst reps'_sg, simp add:sep_conj_cond del:ones_simps)
|
|
|
4392 |
apply (rule tm.pre_condI, simp del:ones_simps)
|
|
|
4393 |
apply hsteps
|
|
|
4394 |
apply (rule_tac p = "
|
|
|
4395 |
st j' \<and>* ps (1 + (m + int (ks ! a))) \<and>* zero (u - 1) \<and>* zero (u - 2) \<and>*
|
|
|
4396 |
reps u (1 + (m + int (ks ! a))) (take a ks @ [Suc (ks!a)])
|
|
|
4397 |
\<and>* fam_conj {1 + (m + int (ks ! a))<..} zero
|
|
|
4398 |
" in tm.pre_stren)
|
|
|
4399 |
apply (hsteps)
|
|
|
4400 |
apply (simp add:sep_conj_ac list_ext_lt[OF `a < length ks`], sep_cancel+)
|
|
|
4401 |
apply (fwd eq_fam, sep_cancel+)
|
|
|
4402 |
apply (simp del:ones_simps add:sep_conj_ac)
|
|
|
4403 |
apply (sep_cancel+, prune)
|
|
|
4404 |
apply ((fwd abs_reps')+, simp)
|
|
|
4405 |
apply (fwd reps_one_abs abs_reps')+
|
|
|
4406 |
apply (subst (asm) reps'_def, simp)
|
|
|
4407 |
by (subst fam_conj_interv_simp, simp add:sep_conj_ac)
|
|
|
4408 |
next
|
|
|
4409 |
case False
|
|
|
4410 |
then obtain k' ks' where eq_drop: "drop (Suc a) ks = [k']@ks'"
|
|
|
4411 |
by (metis append_Cons append_Nil list.exhaust)
|
|
|
4412 |
from `a < length ks`
|
|
|
4413 |
have eq_ks: "ks[a := Suc v] = (take a ks @ [Suc (ks ! a)]) @ (drop (Suc a) ks)"
|
|
|
4414 |
apply (fold `ks!a = v`)
|
|
|
4415 |
by (metis append_Cons append_Nil append_assoc upd_conv_take_nth_drop)
|
|
|
4416 |
show ?thesis
|
|
|
4417 |
apply (unfold Inc_def)
|
|
|
4418 |
apply (unfold Inc_def eq_drop reps'_append, simp add:sep_conj_exists del:ones_simps)
|
|
|
4419 |
apply (rule tm.precond_exI, subst (2) reps'_sg)
|
|
|
4420 |
apply (subst sep_conj_cond)+
|
|
|
4421 |
apply (subst (1) ones_int_expand)
|
|
|
4422 |
apply (rule tm.pre_condI, simp del:ones_simps)
|
|
|
4423 |
apply hsteps
|
|
|
4424 |
(* apply (hsteps hoare_locate_skip_gen[OF `a < length ks`]) *)
|
|
|
4425 |
apply (subst reps'_sg, simp add:sep_conj_cond del:ones_simps)
|
|
|
4426 |
apply (rule tm.pre_condI, simp del:ones_simps)
|
|
|
4427 |
apply hsteps
|
|
|
4428 |
apply (rule_tac p = "st j' \<and>*
|
|
|
4429 |
ps (2 + (m + int (ks ! a))) \<and>*
|
|
|
4430 |
reps (2 + (m + int (ks ! a))) ia (drop (Suc a) ks) \<and>* zero (ia + 1) \<and>* zero (ia + 2) \<and>*
|
|
|
4431 |
reps u (m + int (ks ! a)) (take a ks @ [ks!a]) \<and>* zero (1 + (m + int (ks ! a))) \<and>*
|
|
|
4432 |
zero (u - 2) \<and>* zero (u - 1) \<and>* fam_conj {ia + 2<..} zero
|
|
|
4433 |
" in tm.pre_stren)
|
|
|
4434 |
apply (hsteps hoare_shift_right_cons_gen[OF False]
|
|
|
4435 |
hoare_left_until_double_zero_gen[OF False])
|
|
|
4436 |
apply (rule_tac p =
|
|
|
4437 |
"st j' \<and>* ps (1 + (m + int (ks ! a))) \<and>*
|
|
|
4438 |
zero (u - 2) \<and>* zero (u - 1) \<and>*
|
|
|
4439 |
reps u (1 + (m + int (ks ! a))) (take a ks @ [Suc (ks ! a)]) \<and>*
|
|
|
4440 |
zero (2 + (m + int (ks ! a))) \<and>*
|
|
|
4441 |
reps (3 + (m + int (ks ! a))) (ia + 1) (drop (Suc a) ks) \<and>* fam_conj {ia + 1<..} zero
|
|
|
4442 |
" in tm.pre_stren)
|
|
|
4443 |
apply (hsteps)
|
|
|
4444 |
apply (simp add:sep_conj_ac, sep_cancel+)
|
|
|
4445 |
apply (unfold list_ext_lt[OF `a < length ks`], simp)
|
|
|
4446 |
apply (fwd abs_reps')+
|
|
|
4447 |
apply(fwd reps'_reps_abs)
|
|
|
4448 |
apply (subst eq_ks, simp)
|
|
|
4449 |
apply (sep_cancel+)
|
|
|
4450 |
apply (thin_tac "mb = 4 + (m + (int (ks ! a) + int k'))")
|
|
|
4451 |
apply (thin_tac "ma = 2 + (m + int (ks ! a))", prune)
|
|
|
4452 |
apply (simp add: int_add_ac sep_conj_ac, sep_cancel+)
|
|
|
4453 |
apply (fwd reps_one_abs1, subst fam_conj_interv_simp, simp, sep_cancel+, smt)
|
|
|
4454 |
apply (fwd abs_ones)+
|
|
|
4455 |
apply (fwd abs_reps')
|
|
|
4456 |
apply (fwd abs_reps')
|
|
|
4457 |
apply (fwd abs_reps')
|
|
|
4458 |
apply (fwd abs_reps')
|
|
|
4459 |
apply (unfold eq_drop, simp add:int_add_ac sep_conj_ac)
|
|
|
4460 |
apply (sep_cancel+)
|
|
|
4461 |
apply (fwd reps'_abs[where xs = "take a ks"])
|
|
|
4462 |
apply (fwd reps'_abs[where xs = "[k']"])
|
|
|
4463 |
apply (unfold reps'_def, simp add:int_add_ac sep_conj_ac)
|
|
|
4464 |
apply (sep_cancel+)
|
|
|
4465 |
by (subst (asm) fam_conj_interv_simp, simp, smt)
|
|
|
4466 |
qed
|
|
|
4467 |
} note h = this
|
|
|
4468 |
show ?thesis
|
|
|
4469 |
apply (subst fam_conj_interv_simp)
|
|
|
4470 |
apply (rule_tac p = "st i \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>*
|
|
|
4471 |
(reps u ia ks \<and>* zero (ia + 1)) \<and>* fam_conj {ia + 1<..} zero"
|
|
|
4472 |
in tm.pre_stren)
|
|
|
4473 |
apply (unfold eq_s, simp only:sep_conj_exists)
|
|
|
4474 |
apply (intro tm.precond_exI h)
|
|
|
4475 |
by (sep_cancel+, unfold eq_s, simp)
|
|
|
4476 |
qed
|
|
|
4477 |
|
|
|
4478 |
declare ones_simps [simp del]
|
|
|
4479 |
|
|
|
4480 |
lemma tm_hoare_inc01:
|
|
|
4481 |
assumes "length ks \<le> a \<and> v = 0"
|
|
|
4482 |
shows
|
|
|
4483 |
"\<lbrace>st i \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>* reps u ia ks \<and>* fam_conj {ia<..} zero\<rbrace>
|
|
|
4484 |
i :[ Inc a ]: j
|
|
|
4485 |
\<lbrace>st j \<and>*
|
|
|
4486 |
ps u \<and>*
|
|
|
4487 |
zero (u - 2) \<and>*
|
|
|
4488 |
zero (u - 1) \<and>*
|
|
|
4489 |
reps u (ia + int (reps_len (list_ext a ks)) - int (reps_len ks) + 1) ((list_ext a ks)[a := Suc v]) \<and>*
|
|
|
4490 |
fam_conj {(ia + int (reps_len (list_ext a ks)) - int (reps_len ks) + 1)<..} zero\<rbrace>"
|
|
|
4491 |
proof -
|
|
|
4492 |
from assms have "length ks \<le> a" "v = 0" by auto
|
|
|
4493 |
show ?thesis
|
|
|
4494 |
apply (rule_tac p = "
|
|
|
4495 |
st i \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>* (reps u ia ks \<and>* <(ia = u + int (reps_len ks) - 1)>) \<and>*
|
|
|
4496 |
fam_conj {ia<..} zero
|
|
|
4497 |
" in tm.pre_stren)
|
|
|
4498 |
apply (subst sep_conj_cond)+
|
|
|
4499 |
apply (rule tm.pre_condI, simp)
|
|
|
4500 |
apply (unfold Inc_def)
|
|
|
4501 |
apply hstep
|
|
|
4502 |
(* apply (hstep hoare_locate_set_gen[OF `length ks \<le> a`]) *)
|
|
|
4503 |
apply (simp only:sep_conj_exists)
|
|
|
4504 |
apply (intro tm.precond_exI)
|
|
|
4505 |
my_block
|
|
|
4506 |
fix m w
|
|
|
4507 |
have "reps m w [list_ext a ks ! a] =
|
|
|
4508 |
(ones m (m + int (list_ext a ks ! a)) \<and>* <(w = m + int (list_ext a ks ! a))>)"
|
|
|
4509 |
by (simp add:reps.simps)
|
|
|
4510 |
my_block_end
|
|
|
4511 |
apply (unfold this)
|
|
|
4512 |
apply (subst sep_conj_cond)+
|
|
|
4513 |
apply (rule tm.pre_condI, simp)
|
|
|
4514 |
apply (subst fam_conj_interv_simp)
|
|
|
4515 |
apply (hsteps)
|
|
|
4516 |
apply (subst fam_conj_interv_simp, simp)
|
|
|
4517 |
apply (hsteps)
|
|
|
4518 |
apply (rule_tac p = "st j' \<and>* ps (m + int (list_ext a ks ! a) + 1) \<and>*
|
|
|
4519 |
zero (u - 2) \<and>* zero (u - 1) \<and>*
|
|
|
4520 |
reps u (m + int (list_ext a ks ! a) + 1)
|
|
|
4521 |
((take a (list_ext a ks))@[Suc (list_ext a ks ! a)]) \<and>*
|
|
|
4522 |
fam_conj {(m + int (list_ext a ks ! a) + 1)<..} zero
|
|
|
4523 |
" in tm.pre_stren)
|
|
|
4524 |
apply (hsteps)
|
|
|
4525 |
apply (simp add:sep_conj_ac, sep_cancel+)
|
|
|
4526 |
apply (unfold `v = 0`, prune)
|
|
|
4527 |
my_block
|
|
|
4528 |
from `length ks \<le> a` have "list_ext a ks ! a = 0"
|
|
|
4529 |
by (metis le_refl list_ext_tail)
|
|
|
4530 |
from `length ks \<le> a` have "a < length (list_ext a ks)"
|
|
|
4531 |
by (metis list_ext_len)
|
|
|
4532 |
from reps_len_suc[OF this]
|
|
|
4533 |
have eq_len: "int (reps_len (list_ext a ks)) =
|
|
|
4534 |
int (reps_len (list_ext a ks[a := Suc (list_ext a ks ! a)])) - 1"
|
|
|
4535 |
by smt
|
|
|
4536 |
fix m w hc
|
|
|
4537 |
assume h: "(fam_conj {m + int (list_ext a ks ! a) + 1<..} zero \<and>*
|
|
|
4538 |
reps u (m + int (list_ext a ks ! a) + 1) (take a (list_ext a ks) @ [Suc (list_ext a ks ! a)]))
|
|
|
4539 |
hc"
|
|
|
4540 |
then obtain s where
|
|
|
4541 |
"(reps u (m + int (list_ext a ks ! a) + 1) (take a (list_ext a ks) @ [Suc (list_ext a ks ! a)])) s"
|
|
|
4542 |
by (auto dest!:sep_conjD)
|
|
|
4543 |
from reps_len_correct[OF this]
|
|
|
4544 |
have "m = u + int (reps_len (take a (list_ext a ks) @ [Suc (list_ext a ks ! a)]))
|
|
|
4545 |
- int (list_ext a ks ! a) - 2" by smt
|
|
|
4546 |
from h [unfolded this]
|
|
|
4547 |
have "(fam_conj {u + int (reps_len (list_ext a ks))<..} zero \<and>*
|
|
|
4548 |
reps u (u + int (reps_len (list_ext a ks))) (list_ext a ks[a := Suc 0]))
|
|
|
4549 |
hc"
|
|
|
4550 |
apply (unfold eq_len, simp)
|
|
|
4551 |
my_block
|
|
|
4552 |
from `a < length (list_ext a ks)`
|
|
|
4553 |
have "take a (list_ext a ks) @ [Suc (list_ext a ks ! a)] =
|
|
|
4554 |
list_ext a ks[a := Suc (list_ext a ks ! a)]"
|
|
|
4555 |
by (smt `list_ext a ks ! a = 0` assms length_take list_ext_tail_expand list_update_length)
|
|
|
4556 |
my_block_end
|
|
|
4557 |
apply (unfold this)
|
|
|
4558 |
my_block
|
|
|
4559 |
have "-1 + (u + int (reps_len (list_ext a ks[a := Suc (list_ext a ks ! a)]))) =
|
|
|
4560 |
u + (int (reps_len (list_ext a ks[a := Suc (list_ext a ks ! a)])) - 1)" by simp
|
|
|
4561 |
my_block_end
|
|
|
4562 |
apply (unfold this)
|
|
|
4563 |
apply (sep_cancel+)
|
|
|
4564 |
by (unfold `(list_ext a ks ! a) = 0`, simp)
|
|
|
4565 |
my_block_end
|
|
|
4566 |
apply (rule this, assumption)
|
|
|
4567 |
apply (simp only:sep_conj_ac, sep_cancel+)+
|
|
|
4568 |
apply (fwd abs_reps')+
|
|
|
4569 |
apply (fwd reps_one_abs)
|
|
|
4570 |
apply (fwd reps'_reps_abs)
|
|
|
4571 |
apply (simp add:int_add_ac sep_conj_ac)
|
|
|
4572 |
apply (sep_cancel+)
|
|
|
4573 |
apply (subst fam_conj_interv_simp, simp add:sep_conj_ac, smt)
|
|
|
4574 |
apply (fwd reps_lenE, (subst (asm) sep_conj_cond)+, erule condE, simp)
|
|
|
4575 |
by (sep_cancel+)
|
|
|
4576 |
qed
|
|
|
4577 |
|
|
|
4578 |
lemma cond_eq: "((<b> \<and>* p) s) = (b \<and> (p s))"
|
|
|
4579 |
proof
|
|
|
4580 |
assume "(<b> \<and>* p) s"
|
|
|
4581 |
from condD[OF this] show " b \<and> p s" .
|
|
|
4582 |
next
|
|
|
4583 |
assume "b \<and> p s"
|
|
|
4584 |
hence b and "p s" by auto
|
|
|
4585 |
from `b` have "(<b>) 0" by (auto simp:pasrt_def)
|
|
|
4586 |
moreover have "s = 0 + s" by auto
|
|
|
4587 |
moreover have "0 ## s" by auto
|
|
|
4588 |
moreover note `p s`
|
|
|
4589 |
ultimately show "(<b> \<and>* p) s" by (auto intro!:sep_conjI)
|
|
|
4590 |
qed
|
|
|
4591 |
|
|
|
4592 |
lemma tm_hoare_dec_fail00:
|
|
|
4593 |
assumes "a < length ks \<and> ks ! a = 0"
|
|
|
4594 |
shows "\<lbrace>st i \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>* reps u ia ks \<and>* fam_conj {ia<..} zero\<rbrace>
|
|
|
4595 |
i :[ Dec a e ]: j
|
|
|
4596 |
\<lbrace>st e \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>*
|
|
|
4597 |
reps u (ia + int (reps_len (list_ext a ks)) - int (reps_len ks)) (list_ext a ks[a := 0]) \<and>*
|
|
|
4598 |
fam_conj {ia + int (reps_len (list_ext a ks)) - int (reps_len ks) <..} zero\<rbrace>"
|
|
|
4599 |
proof -
|
|
|
4600 |
from assms have "a < length ks" "ks!a = 0" by auto
|
|
|
4601 |
from list_nth_expand[OF `a < length ks`]
|
|
|
4602 |
have eq_ks: "ks = take a ks @ [ks ! a] @ drop (Suc a) ks" .
|
|
|
4603 |
show ?thesis
|
|
|
4604 |
proof(cases " drop (Suc a) ks = []")
|
|
|
4605 |
case False
|
|
|
4606 |
then obtain k' ks' where eq_drop: "drop (Suc a) ks = [k']@ks'"
|
|
|
4607 |
by (metis append_Cons append_Nil list.exhaust)
|
|
|
4608 |
show ?thesis
|
|
|
4609 |
apply (unfold Dec_def, intro t_hoare_local)
|
|
|
4610 |
apply (subst tassemble_to.simps(2), rule tm.code_exI, rule tm.code_extension)
|
|
|
4611 |
apply (subst (1) eq_ks)
|
|
|
4612 |
my_block
|
|
|
4613 |
have "(reps u ia (take a ks @ [ks ! a] @ drop (Suc a) ks) \<and>* fam_conj {ia<..} zero) =
|
|
|
4614 |
(reps' u (ia + 1) ((take a ks @ [ks ! a]) @ drop (Suc a) ks) \<and>* fam_conj {ia + 1<..} zero)"
|
|
|
4615 |
apply (subst fam_conj_interv_simp)
|
|
|
4616 |
by (unfold reps'_def, simp add:sep_conj_ac)
|
|
|
4617 |
my_block_end
|
|
|
4618 |
apply (unfold this)
|
|
|
4619 |
apply (subst reps'_append)
|
|
|
4620 |
apply (unfold eq_drop)
|
|
|
4621 |
apply (subst (2) reps'_append)
|
|
|
4622 |
apply (simp only:sep_conj_exists, intro tm.precond_exI)
|
|
|
4623 |
apply (subst (2) reps'_def, simp add:reps.simps ones_simps)
|
|
|
4624 |
apply (subst reps'_append, simp only:sep_conj_exists, intro tm.precond_exI)
|
|
|
4625 |
apply hstep
|
|
|
4626 |
(* apply (hstep hoare_locate_skip_gen[OF `a < length ks`]) *)
|
|
|
4627 |
my_block
|
|
|
4628 |
fix m mb
|
|
|
4629 |
have "(reps' mb (m - 1) [ks ! a]) = (reps mb (m - 2) [ks!a] \<and>* zero (m - 1))"
|
|
|
4630 |
by (simp add:reps'_def, smt)
|
|
|
4631 |
my_block_end
|
|
|
4632 |
apply (unfold this)
|
|
|
4633 |
apply hstep
|
|
|
4634 |
(* apply (hstep hoare_if_reps_nz_false_gen[OF `ks!a = 0`]) *)
|
|
|
4635 |
apply (simp only:reps.simps(2), simp add:`ks!a = 0`)
|
|
|
4636 |
apply (rule_tac p = "st j'b \<and>*
|
|
|
4637 |
ps mb \<and>*
|
|
|
4638 |
reps u mb ((take a ks)@[ks ! a]) \<and>* <(m - 2 = mb)> \<and>*
|
|
|
4639 |
zero (m - 1) \<and>*
|
|
|
4640 |
zero (u - 1) \<and>*
|
|
|
4641 |
one m \<and>*
|
|
|
4642 |
zero (u - 2) \<and>*
|
|
|
4643 |
ones (m + 1) (m + int k') \<and>*
|
|
|
4644 |
<(-2 + ma = m + int k')> \<and>* zero (ma - 1) \<and>* reps' ma (ia + 1) ks' \<and>* fam_conj {ia + 1<..} zero"
|
|
|
4645 |
in tm.pre_stren)
|
|
|
4646 |
apply hsteps
|
|
|
4647 |
apply (simp add:sep_conj_ac, sep_cancel+)
|
|
|
4648 |
apply (subgoal_tac "m + int k' = ma - 2", simp)
|
|
|
4649 |
apply (fwd abs_ones)+
|
|
|
4650 |
apply (subst (asm) sep_conj_cond)+
|
|
|
4651 |
apply (erule condE, auto)
|
|
|
4652 |
apply (fwd abs_reps')+
|
|
|
4653 |
apply (subgoal_tac "ma = m + int k' + 2", simp)
|
|
|
4654 |
apply (fwd abs_reps')+
|
|
|
4655 |
my_block
|
|
|
4656 |
from `a < length ks`
|
|
|
4657 |
have "list_ext a ks = ks" by (auto simp:list_ext_def)
|
|
|
4658 |
my_block_end
|
|
|
4659 |
apply (simp add:this)
|
|
|
4660 |
apply (subst eq_ks, simp add:eq_drop `ks!a = 0`)
|
|
|
4661 |
apply (subst (asm) reps'_def, simp)
|
|
|
4662 |
apply (subst fam_conj_interv_simp, simp add:sep_conj_ac, sep_cancel+)
|
|
|
4663 |
apply (metis append_Cons assms eq_Nil_appendI eq_drop eq_ks list_update_id)
|
|
|
4664 |
apply (clarsimp)
|
|
|
4665 |
apply (subst (asm) sep_conj_cond)+
|
|
|
4666 |
apply (erule condE, clarsimp)
|
|
|
4667 |
apply (subst (asm) sep_conj_cond)+
|
|
|
4668 |
apply (erule condE, clarsimp)
|
|
|
4669 |
apply (simp add:sep_conj_ac, sep_cancel+)
|
|
|
4670 |
apply (fwd abs_reps')+
|
|
|
4671 |
by (fwd reps'_reps_abs, simp add:`ks!a = 0`)
|
|
|
4672 |
next
|
|
|
4673 |
case True
|
|
|
4674 |
show ?thesis
|
|
|
4675 |
apply (unfold Dec_def, intro t_hoare_local)
|
|
|
4676 |
apply (subst tassemble_to.simps(2), rule tm.code_exI, rule tm.code_extension)
|
|
|
4677 |
apply (subst (1) eq_ks, unfold True, simp)
|
|
|
4678 |
my_block
|
|
|
4679 |
have "(reps u ia (take a ks @ [ks ! a]) \<and>* fam_conj {ia<..} zero) =
|
|
|
4680 |
(reps' u (ia + 1) (take a ks @ [ks ! a]) \<and>* fam_conj {ia + 1<..} zero)"
|
|
|
4681 |
apply (unfold reps'_def, subst fam_conj_interv_simp)
|
|
|
4682 |
by (simp add:sep_conj_ac)
|
|
|
4683 |
my_block_end
|
|
|
4684 |
apply (subst (1) this)
|
|
|
4685 |
apply (subst reps'_append)
|
|
|
4686 |
apply (simp only:sep_conj_exists, intro tm.precond_exI)
|
|
|
4687 |
apply (subst fam_conj_interv_simp, simp)
|
|
|
4688 |
my_block
|
|
|
4689 |
have "(zero (2 + ia)) = (tm (2 + ia) Bk)"
|
|
|
4690 |
by (simp add:zero_def)
|
|
|
4691 |
my_block_end my_note eq_z = this
|
|
|
4692 |
apply hstep
|
|
|
4693 |
(* apply (hstep hoare_locate_skip_gen[OF `a < length ks`]) *)
|
|
|
4694 |
my_block
|
|
|
4695 |
fix m
|
|
|
4696 |
have "(reps' m (ia + 1) [ks ! a]) = (reps m ia [ks!a] \<and>* zero (ia + 1))"
|
|
|
4697 |
by (simp add:reps'_def)
|
|
|
4698 |
my_block_end
|
|
|
4699 |
apply (unfold this, prune)
|
|
|
4700 |
apply hstep
|
|
|
4701 |
(* apply (hstep hoare_if_reps_nz_false_gen[OF `ks!a = 0`]) *)
|
|
|
4702 |
apply (simp only:reps.simps(2), simp add:`ks!a = 0`)
|
|
|
4703 |
apply (rule_tac p = "st j'b \<and>* ps m \<and>* (reps u m ((take a ks)@[ks!a]) \<and>* <(ia = m)>)
|
|
|
4704 |
\<and>* zero (ia + 1) \<and>* zero (u - 1) \<and>*
|
|
|
4705 |
zero (2 + ia) \<and>* zero (u - 2) \<and>* fam_conj {2 + ia<..} zero"
|
|
|
4706 |
in tm.pre_stren)
|
|
|
4707 |
apply hsteps
|
|
|
4708 |
apply (simp add:sep_conj_ac)
|
|
|
4709 |
apply ((subst (asm) sep_conj_cond)+, erule condE, simp)
|
|
|
4710 |
my_block
|
|
|
4711 |
from `a < length ks` have "list_ext a ks = ks" by (metis list_ext_lt)
|
|
|
4712 |
my_block_end
|
|
|
4713 |
apply (unfold this, simp)
|
|
|
4714 |
apply (subst fam_conj_interv_simp)
|
|
|
4715 |
apply (subst fam_conj_interv_simp, simp)
|
|
|
4716 |
apply (simp only:sep_conj_ac, sep_cancel+)
|
|
|
4717 |
apply (subst eq_ks, unfold True `ks!a = 0`, simp)
|
|
|
4718 |
apply (metis True append_Nil2 assms eq_ks list_update_same_conv)
|
|
|
4719 |
apply (simp add:sep_conj_ac)
|
|
|
4720 |
apply (subst (asm) sep_conj_cond)+
|
|
|
4721 |
apply (erule condE, simp, thin_tac "ia = m")
|
|
|
4722 |
apply (fwd abs_reps')+
|
|
|
4723 |
apply (simp add:sep_conj_ac int_add_ac, sep_cancel+)
|
|
|
4724 |
apply (unfold reps'_def, simp)
|
|
|
4725 |
by (metis sep.mult_commute)
|
|
|
4726 |
qed
|
|
|
4727 |
qed
|
|
|
4728 |
|
|
|
4729 |
lemma tm_hoare_dec_fail01:
|
|
|
4730 |
assumes "length ks \<le> a"
|
|
|
4731 |
shows "\<lbrace>st i \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>* reps u ia ks \<and>* fam_conj {ia<..} zero\<rbrace>
|
|
|
4732 |
i :[ Dec a e ]: j
|
|
|
4733 |
\<lbrace>st e \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>*
|
|
|
4734 |
reps u (ia + int (reps_len (list_ext a ks)) - int (reps_len ks)) (list_ext a ks[a := 0]) \<and>*
|
|
|
4735 |
fam_conj {ia + int (reps_len (list_ext a ks)) - int (reps_len ks) <..} zero\<rbrace>"
|
|
|
4736 |
apply (unfold Dec_def, intro t_hoare_local)
|
|
|
4737 |
apply (subst tassemble_to.simps(2), rule tm.code_exI, rule tm.code_extension)
|
|
|
4738 |
apply (rule_tac p = "st i \<and>* ps u \<and>* zero (u - 2) \<and>*
|
|
|
4739 |
zero (u - 1) \<and>* reps u ia ks \<and>* fam_conj {ia<..} zero \<and>*
|
|
|
4740 |
<(ia = u + int (reps_len ks) - 1)>" in tm.pre_stren)
|
|
|
4741 |
apply hstep
|
|
|
4742 |
(* apply (hstep hoare_locate_set_gen[OF `length ks \<le> a`]) *)
|
|
|
4743 |
apply (simp only:sep_conj_exists, intro tm.precond_exI)
|
|
|
4744 |
my_block
|
|
|
4745 |
from assms
|
|
|
4746 |
have "list_ext a ks ! a = 0" by (metis le_refl list_ext_tail)
|
|
|
4747 |
my_block_end my_note is_z = this
|
|
|
4748 |
apply (subst fam_conj_interv_simp)
|
|
|
4749 |
apply hstep
|
|
|
4750 |
(* apply (hstep hoare_if_reps_nz_false_gen[OF is_z]) *)
|
|
|
4751 |
apply (unfold is_z)
|
|
|
4752 |
apply (subst (1) reps.simps)
|
|
|
4753 |
apply (rule_tac p = "st j'b \<and>* ps m \<and>* reps u m (take a (list_ext a ks) @ [0]) \<and>* zero (w + 1) \<and>*
|
|
|
4754 |
<(w = m + int 0)> \<and>* zero (u - 1) \<and>*
|
|
|
4755 |
fam_conj {w + 1<..} zero \<and>* zero (u - 2) \<and>*
|
|
|
4756 |
<(ia = u + int (reps_len ks) - 1)>" in tm.pre_stren)
|
|
|
4757 |
my_block
|
|
|
4758 |
have "(take a (list_ext a ks)) @ [0] \<noteq> []" by simp
|
|
|
4759 |
my_block_end
|
|
|
4760 |
apply hsteps
|
|
|
4761 |
(* apply (hsteps hoare_left_until_double_zero_gen[OF this]) *)
|
|
|
4762 |
apply (simp add:sep_conj_ac)
|
|
|
4763 |
apply prune
|
|
|
4764 |
apply (subst (asm) sep_conj_cond)+
|
|
|
4765 |
apply (elim condE, simp add:sep_conj_ac, prune)
|
|
|
4766 |
my_block
|
|
|
4767 |
fix m w ha
|
|
|
4768 |
assume h1: "w = m \<and> ia = u + int (reps_len ks) - 1"
|
|
|
4769 |
and h: "(ps u \<and>*
|
|
|
4770 |
st e \<and>*
|
|
|
4771 |
zero (u - 1) \<and>*
|
|
|
4772 |
zero (m + 1) \<and>*
|
|
|
4773 |
fam_conj {m + 1<..} zero \<and>* zero (u - 2) \<and>* reps u m (take a (list_ext a ks) @ [0])) ha"
|
|
|
4774 |
from h1 have eq_w: "w = m" and eq_ia: "ia = u + int (reps_len ks) - 1" by auto
|
|
|
4775 |
from h obtain s' where "reps u m (take a (list_ext a ks) @ [0]) s'"
|
|
|
4776 |
by (auto dest!:sep_conjD)
|
|
|
4777 |
from reps_len_correct[OF this]
|
|
|
4778 |
have eq_m: "m = u + int (reps_len (take a (list_ext a ks) @ [0])) - 1" .
|
|
|
4779 |
from h[unfolded eq_m, simplified]
|
|
|
4780 |
have "(ps u \<and>*
|
|
|
4781 |
st e \<and>*
|
|
|
4782 |
zero (u - 1) \<and>*
|
|
|
4783 |
zero (u - 2) \<and>*
|
|
|
4784 |
fam_conj {u + (-1 + int (reps_len (list_ext a ks)))<..} zero \<and>*
|
|
|
4785 |
reps u (u + (-1 + int (reps_len (list_ext a ks)))) (list_ext a ks[a := 0])) ha"
|
|
|
4786 |
apply (sep_cancel+)
|
|
|
4787 |
apply (subst fam_conj_interv_simp, simp)
|
|
|
4788 |
my_block
|
|
|
4789 |
from `length ks \<le> a` have "list_ext a ks[a := 0] = list_ext a ks"
|
|
|
4790 |
by (metis is_z list_update_id)
|
|
|
4791 |
my_block_end
|
|
|
4792 |
apply (unfold this)
|
|
|
4793 |
my_block
|
|
|
4794 |
from `length ks \<le> a` is_z
|
|
|
4795 |
have "take a (list_ext a ks) @ [0] = list_ext a ks"
|
|
|
4796 |
by (metis list_ext_tail_expand)
|
|
|
4797 |
my_block_end
|
|
|
4798 |
apply (unfold this)
|
|
|
4799 |
by (simp add:sep_conj_ac, sep_cancel+, smt)
|
|
|
4800 |
my_block_end
|
|
|
4801 |
apply (rule this, assumption)
|
|
|
4802 |
apply (sep_cancel+)[1]
|
|
|
4803 |
apply (subst (asm) sep_conj_cond)+
|
|
|
4804 |
apply (erule condE, prune, simp)
|
|
|
4805 |
my_block
|
|
|
4806 |
fix s m
|
|
|
4807 |
assume "(reps' u (m - 1) (take a (list_ext a ks)) \<and>* ones m m \<and>* zero (m + 1)) s"
|
|
|
4808 |
hence "reps' u (m + 1) (take a (list_ext a ks) @ [0]) s"
|
|
|
4809 |
apply (unfold reps'_append)
|
|
|
4810 |
apply (rule_tac x = m in EXS_intro)
|
|
|
4811 |
by (subst (2) reps'_def, simp add:reps.simps)
|
|
|
4812 |
my_block_end
|
|
|
4813 |
apply (rotate_tac 1, fwd this)
|
|
|
4814 |
apply (subst (asm) reps'_def, simp add:sep_conj_ac)
|
|
|
4815 |
my_block
|
|
|
4816 |
fix s
|
|
|
4817 |
assume h: "(st i \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>*
|
|
|
4818 |
reps u ia ks \<and>* fam_conj {ia<..} zero) s"
|
|
|
4819 |
then obtain s' where "reps u ia ks s'" by (auto dest!:sep_conjD)
|
|
|
4820 |
from reps_len_correct[OF this] have eq_ia: "ia = u + int (reps_len ks) - 1" .
|
|
|
4821 |
from h
|
|
|
4822 |
have "(st i \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>* reps u ia ks \<and>*
|
|
|
4823 |
fam_conj {ia<..} zero \<and>* <(ia = u + int (reps_len ks) - 1)>) s"
|
|
|
4824 |
by (unfold eq_ia, simp)
|
|
|
4825 |
my_block_end
|
|
|
4826 |
by (rule this, assumption)
|
|
|
4827 |
|
|
|
4828 |
lemma t_hoare_label1:
|
|
|
4829 |
"(\<And>l. l = i \<Longrightarrow> \<lbrace>st l \<and>* p\<rbrace> l :[ c l ]: j \<lbrace>st k \<and>* q\<rbrace>) \<Longrightarrow>
|
|
|
4830 |
\<lbrace>st l \<and>* p \<rbrace>
|
|
|
4831 |
i:[(TLabel l; c l)]:j
|
|
|
4832 |
\<lbrace>st k \<and>* q\<rbrace>"
|
|
|
4833 |
by (unfold tassemble_to.simps, intro tm.code_exI tm.code_condI, clarify, auto)
|
|
|
4834 |
|
|
|
4835 |
lemma tm_hoare_dec_fail1:
|
|
|
4836 |
assumes "a < length ks \<and> ks ! a = 0 \<or> length ks \<le> a"
|
|
|
4837 |
shows "\<lbrace>st i \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>* reps u ia ks \<and>* fam_conj {ia<..} zero\<rbrace>
|
|
|
4838 |
i :[ Dec a e ]: j
|
|
|
4839 |
\<lbrace>st e \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>*
|
|
|
4840 |
reps u (ia + int (reps_len (list_ext a ks)) - int (reps_len ks)) (list_ext a ks[a := 0]) \<and>*
|
|
|
4841 |
fam_conj {ia + int (reps_len (list_ext a ks)) - int (reps_len ks) <..} zero\<rbrace>"
|
|
|
4842 |
using assms
|
|
|
4843 |
proof
|
|
|
4844 |
assume "a < length ks \<and> ks ! a = 0"
|
|
|
4845 |
thus ?thesis
|
|
|
4846 |
by (rule tm_hoare_dec_fail00)
|
|
|
4847 |
next
|
|
|
4848 |
assume "length ks \<le> a"
|
|
|
4849 |
thus ?thesis
|
|
|
4850 |
by (rule tm_hoare_dec_fail01)
|
|
|
4851 |
qed
|
|
|
4852 |
|
|
|
4853 |
lemma shift_left_nil_gen[step]:
|
|
|
4854 |
assumes "u = v"
|
|
|
4855 |
shows "\<lbrace>st i \<and>* ps u \<and>* zero v\<rbrace>
|
|
|
4856 |
i :[shift_left]:j
|
|
|
4857 |
\<lbrace>st j \<and>* ps u \<and>* zero v\<rbrace>"
|
|
|
4858 |
apply(unfold assms shift_left_def, intro t_hoare_local t_hoare_label, clarify,
|
|
|
4859 |
rule t_hoare_label_last, simp, clarify, prune, simp)
|
|
|
4860 |
by hstep
|
|
|
4861 |
|
|
|
4862 |
lemma tm_hoare_dec_suc1:
|
|
|
4863 |
assumes "a < length ks \<and> ks ! a = Suc v"
|
|
|
4864 |
shows "\<lbrace>st i \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>* reps u ia ks \<and>* fam_conj {ia<..} zero\<rbrace>
|
|
|
4865 |
i :[ Dec a e ]: j
|
|
|
4866 |
\<lbrace>st j \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>*
|
|
|
4867 |
reps u (ia - 1) (list_ext a ks[a := v]) \<and>*
|
|
|
4868 |
fam_conj {ia - 1<..} zero\<rbrace>"
|
|
|
4869 |
proof -
|
|
|
4870 |
from assms have "a < length ks" " ks ! a = Suc v" by auto
|
|
|
4871 |
from list_nth_expand[OF `a < length ks`]
|
|
|
4872 |
have eq_ks: "ks = take a ks @ [ks ! a] @ drop (Suc a) ks" .
|
|
|
4873 |
show ?thesis
|
|
|
4874 |
proof(cases " drop (Suc a) ks = []")
|
|
|
4875 |
case False
|
|
|
4876 |
then obtain k' ks' where eq_drop: "drop (Suc a) ks = [k']@ks'"
|
|
|
4877 |
by (metis append_Cons append_Nil list.exhaust)
|
|
|
4878 |
show ?thesis
|
|
|
4879 |
apply (unfold Dec_def, intro t_hoare_local)
|
|
|
4880 |
apply (subst tassemble_to.simps(2), rule tm.code_exI)
|
|
|
4881 |
apply (subst (1) eq_ks)
|
|
|
4882 |
my_block
|
|
|
4883 |
have "(reps u ia (take a ks @ [ks ! a] @ drop (Suc a) ks) \<and>* fam_conj {ia<..} zero) =
|
|
|
4884 |
(reps' u (ia + 1) ((take a ks @ [ks ! a]) @ drop (Suc a) ks) \<and>* fam_conj {ia + 1<..} zero)"
|
|
|
4885 |
apply (subst fam_conj_interv_simp)
|
|
|
4886 |
by (unfold reps'_def, simp add:sep_conj_ac)
|
|
|
4887 |
my_block_end
|
|
|
4888 |
apply (unfold this)
|
|
|
4889 |
apply (subst reps'_append)
|
|
|
4890 |
apply (unfold eq_drop)
|
|
|
4891 |
apply (subst (2) reps'_append)
|
|
|
4892 |
apply (simp only:sep_conj_exists, intro tm.precond_exI)
|
|
|
4893 |
apply (subst (2) reps'_def, simp add:reps.simps ones_simps)
|
|
|
4894 |
apply (subst reps'_append, simp only:sep_conj_exists, intro tm.precond_exI)
|
|
|
4895 |
apply (rule_tac q =
|
|
|
4896 |
"st l \<and>*
|
|
|
4897 |
ps mb \<and>*
|
|
|
4898 |
zero (u - 1) \<and>*
|
|
|
4899 |
reps' u (mb - 1) (take a ks) \<and>*
|
|
|
4900 |
reps' mb (m - 1) [ks ! a] \<and>*
|
|
|
4901 |
one m \<and>*
|
|
|
4902 |
zero (u - 2) \<and>*
|
|
|
4903 |
ones (m + 1) (m + int k') \<and>*
|
|
|
4904 |
<(-2 + ma = m + int k')> \<and>* zero (ma - 1) \<and>* reps' ma (ia + 1) ks' \<and>* fam_conj {ia + 1<..} zero"
|
|
|
4905 |
in tm.sequencing)
|
|
|
4906 |
apply (rule tm.code_extension)
|
|
|
4907 |
apply hstep
|
|
|
4908 |
(* apply (hstep hoare_locate_skip_gen[OF `a < length ks`]) *)
|
|
|
4909 |
apply (subst (2) reps'_def, simp)
|
|
|
4910 |
my_block
|
|
|
4911 |
fix i j l m mb
|
|
|
4912 |
from `ks!a = (Suc v)` have "ks!a \<noteq> 0" by simp
|
|
|
4913 |
from hoare_if_reps_nz_true[OF this, where u = mb and v = "m - 2"]
|
|
|
4914 |
have "\<lbrace>st i \<and>* ps mb \<and>* reps mb (-2 + m) [ks ! a]\<rbrace>
|
|
|
4915 |
i :[ if_reps_nz l ]: j
|
|
|
4916 |
\<lbrace>st l \<and>* ps mb \<and>* reps mb (-2 + m) [ks ! a]\<rbrace>"
|
|
|
4917 |
by smt
|
|
|
4918 |
my_block_end
|
|
|
4919 |
apply (hgoto this)
|
|
|
4920 |
apply (simp add:sep_conj_ac, sep_cancel+)
|
|
|
4921 |
apply (subst reps'_def, simp add:sep_conj_ac)
|
|
|
4922 |
apply (rule tm.code_extension1)
|
|
|
4923 |
apply (rule t_hoare_label1, simp, prune)
|
|
|
4924 |
apply (subst (2) reps'_def, simp add:reps.simps)
|
|
|
4925 |
apply (rule_tac p = "st j' \<and>* ps mb \<and>* zero (u - 1) \<and>* reps' u (mb - 1) (take a ks) \<and>*
|
|
|
4926 |
((ones mb (mb + int (ks ! a)) \<and>* <(-2 + m = mb + int (ks ! a))>) \<and>* zero (mb + int (ks ! a) + 1)) \<and>*
|
|
|
4927 |
one (mb + int (ks ! a) + 2) \<and>* zero (u - 2) \<and>*
|
|
|
4928 |
ones (mb + int (ks ! a) + 3) (mb + int (ks ! a) + int k' + 2) \<and>*
|
|
|
4929 |
<(-2 + ma = m + int k')> \<and>* zero (ma - 1) \<and>* reps' ma (ia + 1) ks' \<and>* fam_conj {ia + 1<..} zero
|
|
|
4930 |
" in tm.pre_stren)
|
|
|
4931 |
apply hsteps
|
|
|
4932 |
(* apply (simp add:sep_conj_ac) *)
|
|
|
4933 |
apply (unfold `ks!a = Suc v`)
|
|
|
4934 |
my_block
|
|
|
4935 |
fix mb
|
|
|
4936 |
have "(ones mb (mb + int (Suc v))) = (ones mb (mb + int v) \<and>* one (mb + int (Suc v)))"
|
|
|
4937 |
by (simp add:ones_rev)
|
|
|
4938 |
my_block_end
|
|
|
4939 |
apply (unfold this, prune)
|
|
|
4940 |
apply hsteps
|
|
|
4941 |
apply (rule_tac p = "st j'a \<and>*
|
|
|
4942 |
ps (mb + int (Suc v) + 2) \<and>* zero (mb + int (Suc v) + 1) \<and>*
|
|
|
4943 |
reps (mb + int (Suc v) + 2) ia (drop (Suc a) ks) \<and>* zero (ia + 1) \<and>* zero (ia + 2) \<and>*
|
|
|
4944 |
zero (mb + int (Suc v)) \<and>*
|
|
|
4945 |
ones mb (mb + int v) \<and>*
|
|
|
4946 |
zero (u - 1) \<and>*
|
|
|
4947 |
reps' u (mb - 1) (take a ks) \<and>*
|
|
|
4948 |
zero (u - 2) \<and>* fam_conj {ia + 2<..} zero
|
|
|
4949 |
" in tm.pre_stren)
|
|
|
4950 |
apply hsteps
|
|
|
4951 |
(* apply (hsteps hoare_shift_left_cons_gen[OF False]) *)
|
|
|
4952 |
apply (rule_tac p = "st j'a \<and>* ps (ia - 1) \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>*
|
|
|
4953 |
reps u (ia - 1) (take a ks @ [v] @ drop (Suc a) ks) \<and>*
|
|
|
4954 |
zero ia \<and>* zero (ia + 1) \<and>* zero (ia + 2) \<and>*
|
|
|
4955 |
fam_conj {ia + 2<..} zero
|
|
|
4956 |
" in tm.pre_stren)
|
|
|
4957 |
apply hsteps
|
|
|
4958 |
apply (simp add:sep_conj_ac)
|
|
|
4959 |
apply (subst fam_conj_interv_simp)
|
|
|
4960 |
apply (subst fam_conj_interv_simp)
|
|
|
4961 |
apply (subst fam_conj_interv_simp)
|
|
|
4962 |
apply (simp add:sep_conj_ac)
|
|
|
4963 |
apply (sep_cancel+)
|
|
|
4964 |
my_block
|
|
|
4965 |
have "take a ks @ v # drop (Suc a) ks = list_ext a ks[a := v]"
|
|
|
4966 |
proof -
|
|
|
4967 |
from `a < length ks` have "list_ext a ks = ks" by (metis list_ext_lt)
|
|
|
4968 |
hence "list_ext a ks[a:=v] = ks[a:=v]" by simp
|
|
|
4969 |
moreover from `a < length ks` have "ks[a:=v] = take a ks @ v # drop (Suc a) ks"
|
|
|
4970 |
by (metis upd_conv_take_nth_drop)
|
|
|
4971 |
ultimately show ?thesis by metis
|
|
|
4972 |
qed
|
|
|
4973 |
my_block_end
|
|
|
4974 |
apply (unfold this, sep_cancel+, smt)
|
|
|
4975 |
apply (simp add:sep_conj_ac)
|
|
|
4976 |
apply (fwd abs_reps')+
|
|
|
4977 |
apply (simp add:sep_conj_ac int_add_ac)
|
|
|
4978 |
apply (sep_cancel+)
|
|
|
4979 |
apply (subst (asm) reps'_def, simp add:sep_conj_ac)
|
|
|
4980 |
apply (subst (asm) sep_conj_cond)+
|
|
|
4981 |
apply (erule condE, clarsimp)
|
|
|
4982 |
apply (simp add:sep_conj_ac, sep_cancel+)
|
|
|
4983 |
apply (fwd abs_ones)+
|
|
|
4984 |
apply (fwd abs_reps')+
|
|
|
4985 |
apply (subst (asm) reps'_def, simp)
|
|
|
4986 |
apply (subst (asm) fam_conj_interv_simp)
|
|
|
4987 |
apply (simp add:sep_conj_ac int_add_ac eq_drop reps'_def)
|
|
|
4988 |
apply (subst (asm) sep_conj_cond)+
|
|
|
4989 |
apply (erule condE, clarsimp)
|
|
|
4990 |
by (simp add:sep_conj_ac int_add_ac)
|
|
|
4991 |
next
|
|
|
4992 |
case True
|
|
|
4993 |
show ?thesis
|
|
|
4994 |
apply (unfold Dec_def, intro t_hoare_local)
|
|
|
4995 |
apply (subst tassemble_to.simps(2), rule tm.code_exI)
|
|
|
4996 |
apply (subst (1) eq_ks, simp add:True)
|
|
|
4997 |
my_block
|
|
|
4998 |
have "(reps u ia (take a ks @ [ks ! a]) \<and>* fam_conj {ia<..} zero) =
|
|
|
4999 |
(reps' u (ia + 1) (take a ks @ [ks ! a]) \<and>* fam_conj {ia + 1<..} zero)"
|
|
|
5000 |
apply (subst fam_conj_interv_simp)
|
|
|
5001 |
by (unfold reps'_def, simp add:sep_conj_ac)
|
|
|
5002 |
my_block_end
|
|
|
5003 |
apply (unfold this)
|
|
|
5004 |
apply (subst reps'_append)
|
|
|
5005 |
apply (simp only:sep_conj_exists, intro tm.precond_exI)
|
|
|
5006 |
apply (rule_tac q = "st l \<and>* ps m \<and>* zero (u - 1) \<and>* reps' u (m - 1) (take a ks) \<and>*
|
|
|
5007 |
reps' m (ia + 1) [ks ! a] \<and>* zero (2 + ia) \<and>* zero (u - 2) \<and>* fam_conj {2 + ia<..} zero"
|
|
|
5008 |
in tm.sequencing)
|
|
|
5009 |
apply (rule tm.code_extension)
|
|
|
5010 |
apply (subst fam_conj_interv_simp, simp)
|
|
|
5011 |
apply hsteps
|
|
|
5012 |
(* apply (hstep hoare_locate_skip_gen[OF `a < length ks`]) *)
|
|
|
5013 |
my_block
|
|
|
5014 |
fix m
|
|
|
5015 |
have "(reps' m (ia + 1) [ks ! a]) =
|
|
|
5016 |
(reps m ia [ks!a] \<and>* zero (ia + 1))"
|
|
|
5017 |
by (unfold reps'_def, simp)
|
|
|
5018 |
my_block_end
|
|
|
5019 |
apply (unfold this)
|
|
|
5020 |
my_block
|
|
|
5021 |
fix i j l m
|
|
|
5022 |
from `ks!a = (Suc v)` have "ks!a \<noteq> 0" by simp
|
|
|
5023 |
my_block_end
|
|
|
5024 |
apply (hgoto hoare_if_reps_nz_true_gen)
|
|
|
5025 |
apply (rule tm.code_extension1)
|
|
|
5026 |
apply (rule t_hoare_label1, simp)
|
|
|
5027 |
apply (thin_tac "la = j'", prune)
|
|
|
5028 |
apply (subst (1) reps.simps)
|
|
|
5029 |
apply (subst sep_conj_cond)+
|
|
|
5030 |
apply (rule tm.pre_condI, simp)
|
|
|
5031 |
apply hsteps
|
|
|
5032 |
apply (unfold `ks!a = Suc v`)
|
|
|
5033 |
my_block
|
|
|
5034 |
fix m
|
|
|
5035 |
have "(ones m (m + int (Suc v))) = (ones m (m + int v) \<and>* one (m + int (Suc v)))"
|
|
|
5036 |
by (simp add:ones_rev)
|
|
|
5037 |
my_block_end
|
|
|
5038 |
apply (unfold this)
|
|
|
5039 |
apply hsteps
|
|
|
5040 |
apply (rule_tac p = "st j'a \<and>* ps (m + int v) \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>*
|
|
|
5041 |
reps u (m + int v) (take a ks @ [v]) \<and>* zero (m + (1 + int v)) \<and>*
|
|
|
5042 |
zero (2 + (m + int v)) \<and>* zero (3 + (m + int v)) \<and>*
|
|
|
5043 |
fam_conj {3 + (m + int v)<..} zero
|
|
|
5044 |
" in tm.pre_stren)
|
|
|
5045 |
apply hsteps
|
|
|
5046 |
apply (simp add:sep_conj_ac, sep_cancel+)
|
|
|
5047 |
my_block
|
|
|
5048 |
have "take a ks @ [v] = list_ext a ks[a := v]"
|
|
|
5049 |
proof -
|
|
|
5050 |
from True `a < length ks` have "ks = take a ks @ [ks!a]"
|
|
|
5051 |
by (metis append_Nil2 eq_ks)
|
|
|
5052 |
hence "ks[a:=v] = take a ks @ [v]"
|
|
|
5053 |
by (metis True `a < length ks` upd_conv_take_nth_drop)
|
|
|
5054 |
moreover from `a < length ks` have "list_ext a ks = ks"
|
|
|
5055 |
by (metis list_ext_lt)
|
|
|
5056 |
ultimately show ?thesis by simp
|
|
|
5057 |
qed
|
|
|
5058 |
my_block_end my_note eq_l = this
|
|
|
5059 |
apply (unfold this)
|
|
|
5060 |
apply (subst fam_conj_interv_simp)
|
|
|
5061 |
apply (subst fam_conj_interv_simp)
|
|
|
5062 |
apply (subst fam_conj_interv_simp)
|
|
|
5063 |
apply (simp add:sep_conj_ac, sep_cancel, smt)
|
|
|
5064 |
apply (simp add:sep_conj_ac int_add_ac)+
|
|
|
5065 |
apply (sep_cancel+)
|
|
|
5066 |
apply (fwd abs_reps')+
|
|
|
5067 |
apply (fwd reps'_reps_abs)
|
|
|
5068 |
by (simp add:eq_l)
|
|
|
5069 |
qed
|
|
|
5070 |
qed
|
|
|
5071 |
|
|
|
5072 |
lemma hoare_cfill_until_one:
|
|
|
5073 |
"\<lbrace>st i \<and>* ps v \<and>* one (u - 1) \<and>* zeros u v\<rbrace>
|
|
|
5074 |
i :[ cfill_until_one ]: j
|
|
|
5075 |
\<lbrace>st j \<and>* ps (u - 1) \<and>* ones (u - 1) v \<rbrace>"
|
|
|
5076 |
proof(induct u v rule:zeros_rev_induct)
|
|
|
5077 |
case (Base x y)
|
|
|
5078 |
thus ?case
|
|
|
5079 |
apply (subst sep_conj_cond)+
|
|
|
5080 |
apply (rule tm.pre_condI, simp add:ones_simps)
|
|
|
5081 |
apply (unfold cfill_until_one_def, intro t_hoare_local t_hoare_label, rule t_hoare_label_last, simp+)
|
|
|
5082 |
by hstep
|
|
|
5083 |
next
|
|
|
5084 |
case (Step x y)
|
|
|
5085 |
show ?case
|
|
|
5086 |
apply (rule_tac q = "st i \<and>* ps (y - 1) \<and>* one (x - 1) \<and>* zeros x (y - 1) \<and>* one y" in tm.sequencing)
|
|
|
5087 |
apply (subst cfill_until_one_def, intro t_hoare_local t_hoare_label, rule t_hoare_label_last, simp+)
|
|
|
5088 |
apply hsteps
|
|
|
5089 |
my_block
|
|
|
5090 |
fix i j l
|
|
|
5091 |
have "\<lbrace>st i \<and>* ps (y - 1) \<and>* one (x - 1) \<and>* zeros x (y - 1)\<rbrace>
|
|
|
5092 |
i :[ jmp l ]: j
|
|
|
5093 |
\<lbrace>st l \<and>* ps (y - 1) \<and>* one (x - 1) \<and>* zeros x (y - 1)\<rbrace>"
|
|
|
5094 |
apply (case_tac "(y - 1) < x", simp add:zeros_simps)
|
|
|
5095 |
apply (subst sep_conj_cond)+
|
|
|
5096 |
apply (rule tm.pre_condI, simp)
|
|
|
5097 |
apply hstep
|
|
|
5098 |
apply (drule_tac zeros_rev, simp)
|
|
|
5099 |
by hstep
|
|
|
5100 |
my_block_end
|
|
|
5101 |
apply (hstep this)
|
|
|
5102 |
(* The next half *)
|
|
|
5103 |
apply (hstep Step(2), simp add:sep_conj_ac, sep_cancel+)
|
|
|
5104 |
by (insert Step(1), simp add:ones_rev sep_conj_ac)
|
|
|
5105 |
qed
|
|
|
5106 |
|
|
|
5107 |
declare zeros.simps [simp del] zeros_simps[simp del]
|
|
|
5108 |
|
|
|
5109 |
lemma hoare_cmove:
|
|
|
5110 |
assumes "w \<le> k"
|
|
|
5111 |
shows "\<lbrace>st i \<and>* ps (v + 2 + int w) \<and>* zero (u - 1) \<and>*
|
|
|
5112 |
reps u (v - int w) [k - w] \<and>* zeros (v - int w + 1) (v + 1) \<and>*
|
|
|
5113 |
one (v + 2) \<and>* ones (v + 3) (v + 2 + int w) \<and>* zeros (v + 3 + int w) (v + int(reps_len [k]) + 1)\<rbrace>
|
|
|
5114 |
i :[cmove]: j
|
|
|
5115 |
\<lbrace>st j \<and>* ps (u - 1) \<and>* zero (u - 1) \<and>* reps u u [0] \<and>* zeros (u + 1) (v + 1) \<and>*
|
|
|
5116 |
reps (v + 2) (v + int (reps_len [k]) + 1) [k]\<rbrace>"
|
|
|
5117 |
using assms
|
|
|
5118 |
proof(induct "k - w" arbitrary: w)
|
|
|
5119 |
case (0 w)
|
|
|
5120 |
hence "w = k" by auto
|
|
|
5121 |
show ?case
|
|
|
5122 |
apply (simp add: `w = k` del:zeros.simps zeros_simps)
|
|
|
5123 |
apply (unfold cmove_def, intro t_hoare_local t_hoare_label, rule t_hoare_label_last, simp+)
|
|
|
5124 |
apply (simp add:reps_len_def reps_sep_len_def reps_ctnt_len_def del:zeros_simps zeros.simps)
|
|
|
5125 |
apply (rule_tac p = "st i \<and>* ps (v + 2 + int k) \<and>* zero (u - 1) \<and>*
|
|
|
5126 |
reps u u [0] \<and>* zeros (u + 1) (v + 1) \<and>*
|
|
|
5127 |
ones (v + 2) (v + 2 + int k) \<and>* zeros (v + 3 + int k) (2 + (v + int k)) \<and>*
|
|
|
5128 |
<(u = v - int k)>"
|
|
|
5129 |
in tm.pre_stren)
|
|
|
5130 |
my_block
|
|
|
5131 |
fix i j
|
|
|
5132 |
have "\<lbrace>st i \<and>* ps (v + 2 + int k) \<and>* zeros (u + 1) (v + 1) \<and>* ones (v + 2) (v + 2 + int k)
|
|
|
5133 |
\<and>* <(u = v - int k)>\<rbrace>
|
|
|
5134 |
i :[ left_until_zero ]: j
|
|
|
5135 |
\<lbrace>st j \<and>* ps (v + 1) \<and>* zeros (u + 1) (v + 1) \<and>* ones (v + 2) (v + 2 + int k)
|
|
|
5136 |
\<and>* <(u = v - int k)>\<rbrace>"
|
|
|
5137 |
apply (subst sep_conj_cond)+
|
|
|
5138 |
apply (rule tm.pre_condI, simp)
|
|
|
5139 |
my_block
|
|
|
5140 |
have "(zeros (v - int k + 1) (v + 1)) = (zeros (v - int k + 1) v \<and>* zero (v + 1))"
|
|
|
5141 |
by (simp only:zeros_rev, smt)
|
|
|
5142 |
my_block_end
|
|
|
5143 |
apply (unfold this)
|
|
|
5144 |
by hsteps
|
|
|
5145 |
my_block_end
|
|
|
5146 |
apply (hstep this)
|
|
|
5147 |
my_block
|
|
|
5148 |
fix i j
|
|
|
5149 |
have "\<lbrace>st i \<and>* ps (v + 1) \<and>* reps u u [0] \<and>* zeros (u + 1) (v + 1)\<rbrace>
|
|
|
5150 |
i :[left_until_one]:j
|
|
|
5151 |
\<lbrace>st j \<and>* ps u \<and>* reps u u [0] \<and>* zeros (u + 1) (v + 1)\<rbrace>"
|
|
|
5152 |
apply (simp add:reps.simps ones_simps)
|
|
|
5153 |
by hsteps
|
|
|
5154 |
my_block_end
|
|
|
5155 |
apply (hsteps this)
|
|
|
5156 |
apply ((subst (asm) sep_conj_cond)+, erule condE, clarsimp)
|
|
|
5157 |
apply (fwd abs_reps')+
|
|
|
5158 |
apply (simp only:sep_conj_ac int_add_ac, sep_cancel+)
|
|
|
5159 |
apply (simp add:int_add_ac sep_conj_ac zeros_simps)
|
|
|
5160 |
apply (simp add:sep_conj_ac int_add_ac, sep_cancel+)
|
|
|
5161 |
apply (fwd reps_lenE)
|
|
|
5162 |
apply (subst (asm) sep_conj_cond)+
|
|
|
5163 |
apply (erule condE, clarsimp)
|
|
|
5164 |
apply (subgoal_tac "v = u + int k + int (reps_len [0]) - 1", clarsimp)
|
|
|
5165 |
apply (simp add:reps_len_sg)
|
|
|
5166 |
apply (fwd abs_ones)+
|
|
|
5167 |
apply (fwd abs_reps')+
|
|
|
5168 |
apply (simp add:sep_conj_ac int_add_ac)
|
|
|
5169 |
apply (sep_cancel+)
|
|
|
5170 |
apply (simp add:reps.simps, smt)
|
|
|
5171 |
by (clarsimp)
|
|
|
5172 |
next
|
|
|
5173 |
case (Suc k' w)
|
|
|
5174 |
from `Suc k' = k - w` `w \<le> k`
|
|
|
5175 |
have h: "k' = k - (Suc w)" "Suc w \<le> k" by auto
|
|
|
5176 |
show ?case
|
|
|
5177 |
apply (rule tm.sequencing[OF _ Suc(1)[OF h(1, 2)]])
|
|
|
5178 |
apply (unfold cmove_def, intro t_hoare_local t_hoare_label, rule t_hoare_label_last, simp+)
|
|
|
5179 |
apply (simp add:reps_len_def reps_sep_len_def reps_ctnt_len_def del:zeros_simps zeros.simps)
|
|
|
5180 |
my_block
|
|
|
5181 |
fix i j
|
|
|
5182 |
have "\<lbrace>st i \<and>* ps (v + 2 + int w) \<and>* zeros (v - int w + 1) (v + 1) \<and>*
|
|
|
5183 |
one (v + 2) \<and>* ones (v + 3) (v + 2 + int w) \<rbrace>
|
|
|
5184 |
i :[left_until_zero]: j
|
|
|
5185 |
\<lbrace>st j \<and>* ps (v + 1) \<and>* zeros (v - int w + 1) (v + 1) \<and>*
|
|
|
5186 |
one (v + 2) \<and>* ones (v + 3) (v + 2 + int w) \<rbrace>"
|
|
|
5187 |
my_block
|
|
|
5188 |
have "(one (v + 2) \<and>* ones (v + 3) (v + 2 + int w)) =
|
|
|
5189 |
ones (v + 2) (v + 2 + int w)"
|
|
|
5190 |
by (simp only:ones_simps, smt)
|
|
|
5191 |
my_block_end
|
|
|
5192 |
apply (unfold this)
|
|
|
5193 |
my_block
|
|
|
5194 |
have "(zeros (v - int w + 1) (v + 1)) = (zeros (v - int w + 1) v \<and>* zero (v + 1))"
|
|
|
5195 |
by (simp only:zeros_rev, simp)
|
|
|
5196 |
my_block_end
|
|
|
5197 |
apply (unfold this)
|
|
|
5198 |
by hsteps
|
|
|
5199 |
my_block_end
|
|
|
5200 |
apply (hstep this)
|
|
|
5201 |
my_block
|
|
|
5202 |
fix i j
|
|
|
5203 |
have "\<lbrace>st i \<and>* ps (v + 1) \<and>* reps u (v - int w) [k - w] \<and>* zeros (v - int w + 1) (v + 1)\<rbrace>
|
|
|
5204 |
i :[left_until_one]: j
|
|
|
5205 |
\<lbrace>st j \<and>* ps (v - int w) \<and>* reps u (v - int w) [k - w] \<and>* zeros (v - int w + 1) (v + 1)\<rbrace>"
|
|
|
5206 |
apply (simp add:reps.simps ones_rev)
|
|
|
5207 |
apply (subst sep_conj_cond)+
|
|
|
5208 |
apply (rule tm.pre_condI, clarsimp)
|
|
|
5209 |
apply (subgoal_tac "u + int (k - w) = v - int w", simp)
|
|
|
5210 |
defer
|
|
|
5211 |
apply simp
|
|
|
5212 |
by hsteps
|
|
|
5213 |
my_block_end
|
|
|
5214 |
apply (hstep this)
|
|
|
5215 |
my_block
|
|
|
5216 |
have "(reps u (v - int w) [k - w]) = (reps u (v - (1 + int w)) [k - Suc w] \<and>* one (v - int w))"
|
|
|
5217 |
apply (subst (1 2) reps.simps)
|
|
|
5218 |
apply (subst sep_conj_cond)+
|
|
|
5219 |
my_block
|
|
|
5220 |
have "((v - int w = u + int (k - w))) =
|
|
|
5221 |
(v - (1 + int w) = u + int (k - Suc w))"
|
|
|
5222 |
apply auto
|
|
|
5223 |
apply (smt Suc.prems h(2))
|
|
|
5224 |
by (smt Suc.prems h(2))
|
|
|
5225 |
my_block_end
|
|
|
5226 |
apply (simp add:this)
|
|
|
5227 |
my_block
|
|
|
5228 |
fix b p q
|
|
|
5229 |
assume "(b \<Longrightarrow> (p::tassert) = q)"
|
|
|
5230 |
have "(<b> \<and>* p) = (<b> \<and>* q)"
|
|
|
5231 |
by (metis `b \<Longrightarrow> p = q` cond_eqI)
|
|
|
5232 |
my_block_end
|
|
|
5233 |
apply (rule this)
|
|
|
5234 |
my_block
|
|
|
5235 |
assume "v - (1 + int w) = u + int (k - Suc w)"
|
|
|
5236 |
hence "v = 1 + int w + u + int (k - Suc w)" by auto
|
|
|
5237 |
my_block_end
|
|
|
5238 |
apply (simp add:this)
|
|
|
5239 |
my_block
|
|
|
5240 |
have "\<not> (u + int (k - w)) < u" by auto
|
|
|
5241 |
my_block_end
|
|
|
5242 |
apply (unfold ones_rev[OF this])
|
|
|
5243 |
my_block
|
|
|
5244 |
from Suc (2, 3) have "(u + int (k - w) - 1) = (u + int (k - Suc w))"
|
|
|
5245 |
by auto
|
|
|
5246 |
my_block_end
|
|
|
5247 |
apply (unfold this)
|
|
|
5248 |
my_block
|
|
|
5249 |
from Suc (2, 3) have "(u + int (k - w)) = (1 + (u + int (k - Suc w)))"
|
|
|
5250 |
by auto
|
|
|
5251 |
my_block_end
|
|
|
5252 |
by (unfold this, simp)
|
|
|
5253 |
my_block_end
|
|
|
5254 |
apply (unfold this)
|
|
|
5255 |
my_block
|
|
|
5256 |
fix i j
|
|
|
5257 |
have "\<lbrace>st i \<and>* ps (v - int w) \<and>*
|
|
|
5258 |
(reps u (v - (1 + int w)) [k - Suc w] \<and>* one (v - int w))\<rbrace>
|
|
|
5259 |
i :[ move_left]: j
|
|
|
5260 |
\<lbrace>st j \<and>* ps (v - (1 + int w)) \<and>*
|
|
|
5261 |
(reps u (v - (1 + int w)) [k - Suc w] \<and>* one (v - int w))\<rbrace>"
|
|
|
5262 |
apply (simp add:reps.simps ones_rev)
|
|
|
5263 |
apply (subst sep_conj_cond)+
|
|
|
5264 |
apply (rule tm.pre_condI, clarsimp)
|
|
|
5265 |
apply (subgoal_tac " u + int (k - Suc w) = v - (1 + int w)", simp)
|
|
|
5266 |
defer
|
|
|
5267 |
apply simp
|
|
|
5268 |
apply hsteps
|
|
|
5269 |
by (simp add:sep_conj_ac, sep_cancel+, smt)
|
|
|
5270 |
my_block_end
|
|
|
5271 |
apply (hstep this)
|
|
|
5272 |
my_block
|
|
|
5273 |
fix i' j'
|
|
|
5274 |
have "\<lbrace>st i' \<and>* ps (v - (1 + int w)) \<and>* reps u (v - (1 + int w)) [k - Suc w]\<rbrace>
|
|
|
5275 |
i' :[ if_zero j ]: j'
|
|
|
5276 |
\<lbrace>st j' \<and>* ps (v - (1 + int w)) \<and>* reps u (v - (1 + int w)) [k - Suc w]\<rbrace>"
|
|
|
5277 |
apply (simp add:reps.simps ones_rev)
|
|
|
5278 |
apply (subst sep_conj_cond)+
|
|
|
5279 |
apply (rule tm.pre_condI, clarsimp)
|
|
|
5280 |
apply (subgoal_tac " u + int (k - Suc w) = v - (1 + int w)", simp)
|
|
|
5281 |
defer
|
|
|
5282 |
apply simp
|
|
|
5283 |
by hstep
|
|
|
5284 |
my_block_end
|
|
|
5285 |
apply (hstep this)
|
|
|
5286 |
my_block
|
|
|
5287 |
fix i j
|
|
|
5288 |
have "\<lbrace>st i \<and>* ps (v - (1 + int w)) \<and>* reps u (v - (1 + int w)) [k - Suc w]\<rbrace>
|
|
|
5289 |
i :[ move_right ]: j
|
|
|
5290 |
\<lbrace>st j \<and>* ps (v - int w) \<and>* reps u (v - (1 + int w)) [k - Suc w] \<rbrace>"
|
|
|
5291 |
apply (simp add:reps.simps ones_rev)
|
|
|
5292 |
apply (subst sep_conj_cond)+
|
|
|
5293 |
apply (rule tm.pre_condI, clarsimp)
|
|
|
5294 |
apply (subgoal_tac " u + int (k - Suc w) = v - (1 + int w)", simp)
|
|
|
5295 |
defer
|
|
|
5296 |
apply simp
|
|
|
5297 |
by hstep
|
|
|
5298 |
my_block_end
|
|
|
5299 |
apply (hsteps this)
|
|
|
5300 |
my_block
|
|
|
5301 |
fix i j
|
|
|
5302 |
have "\<lbrace>st i \<and>* ps (v - int w) \<and>* one (v + 2) \<and>*
|
|
|
5303 |
zero (v - int w) \<and>* zeros (v - int w + 1) (v + 1)\<rbrace>
|
|
|
5304 |
i :[right_until_one]: j
|
|
|
5305 |
\<lbrace>st j \<and>* ps (v + 2) \<and>* one (v + 2) \<and>* zero (v - int w) \<and>* zeros (v - int w + 1) (v + 1)\<rbrace>"
|
|
|
5306 |
my_block
|
|
|
5307 |
have "(zero (v - int w) \<and>* zeros (v - int w + 1) (v + 1)) =
|
|
|
5308 |
(zeros (v - int w) (v + 1))"
|
|
|
5309 |
by (simp add:zeros_simps)
|
|
|
5310 |
my_block_end
|
|
|
5311 |
apply (unfold this)
|
|
|
5312 |
by hsteps
|
|
|
5313 |
my_block_end
|
|
|
5314 |
apply (hstep this)
|
|
|
5315 |
my_block
|
|
|
5316 |
from Suc(2, 3) have "w < k" by auto
|
|
|
5317 |
hence "(zeros (v + 3 + int w) (2 + (v + int k))) =
|
|
|
5318 |
(zero (v + 3 + int w) \<and>* zeros (4 + (v + int w)) (2 + (v + int k)))"
|
|
|
5319 |
by (simp add:zeros_simps)
|
|
|
5320 |
my_block_end
|
|
|
5321 |
apply (unfold this)
|
|
|
5322 |
my_block
|
|
|
5323 |
fix i j
|
|
|
5324 |
have "\<lbrace>st i \<and>* ps (v + 2) \<and>* zero (v + 3 + int w) \<and>* zeros (4 + (v + int w)) (2 + (v + int k)) \<and>*
|
|
|
5325 |
one (v + 2) \<and>* ones (v + 3) (v + 2 + int w)\<rbrace>
|
|
|
5326 |
i :[right_until_zero]: j
|
|
|
5327 |
\<lbrace>st j \<and>* ps (v + 3 + int w) \<and>* zero (v + 3 + int w) \<and>* zeros (4 + (v + int w)) (2 + (v + int k)) \<and>*
|
|
|
5328 |
one (v + 2) \<and>* ones (v + 3) (v + 2 + int w)\<rbrace>"
|
|
|
5329 |
my_block
|
|
|
5330 |
have "(one (v + 2) \<and>* ones (v + 3) (v + 2 + int w)) =
|
|
|
5331 |
(ones (v + 2) (v + 2 + int w))"
|
|
|
5332 |
by (simp add:ones_simps, smt)
|
|
|
5333 |
my_block_end
|
|
|
5334 |
apply (unfold this)
|
|
|
5335 |
by hsteps
|
|
|
5336 |
my_block_end
|
|
|
5337 |
apply (hsteps this, simp only:sep_conj_ac)
|
|
|
5338 |
apply (sep_cancel+, simp add:sep_conj_ac)
|
|
|
5339 |
my_block
|
|
|
5340 |
fix s
|
|
|
5341 |
assume "(zero (v - int w) \<and>* zeros (v - int w + 1) (v + 1)) s"
|
|
|
5342 |
hence "zeros (v - int w) (v + 1) s"
|
|
|
5343 |
by (simp add:zeros_simps)
|
|
|
5344 |
my_block_end
|
|
|
5345 |
apply (fwd this)
|
|
|
5346 |
my_block
|
|
|
5347 |
fix s
|
|
|
5348 |
assume "(one (v + 3 + int w) \<and>* ones (v + 3) (v + 2 + int w)) s"
|
|
|
5349 |
hence "ones (v + 3) (3 + (v + int w)) s"
|
|
|
5350 |
by (simp add:ones_rev sep_conj_ac, smt)
|
|
|
5351 |
my_block_end
|
|
|
5352 |
apply (fwd this)
|
|
|
5353 |
by (simp add:sep_conj_ac, smt)
|
|
|
5354 |
qed
|
|
|
5355 |
|
|
|
5356 |
lemma hoare_copy:
|
|
|
5357 |
shows
|
|
|
5358 |
"\<lbrace>st i \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>* reps u v [k] \<and>* zero (v + 1) \<and>*
|
|
|
5359 |
zeros (v + 2) (v + int(reps_len [k]) + 1)\<rbrace>
|
|
|
5360 |
i :[copy]: j
|
|
|
5361 |
\<lbrace>st j \<and>* ps u \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>* reps u v [k] \<and>* zero (v + 1) \<and>*
|
|
|
5362 |
reps (v + 2) (v + int (reps_len [k]) + 1) [k]\<rbrace>"
|
|
|
5363 |
apply (unfold copy_def)
|
|
|
5364 |
my_block
|
|
|
5365 |
fix i j
|
|
|
5366 |
have
|
|
|
5367 |
"\<lbrace>st i \<and>* ps u \<and>* reps u v [k] \<and>* zero (v + 1) \<and>* zeros (v + 2) (v + int(reps_len [k]) + 1)\<rbrace>
|
|
|
5368 |
i :[cinit]: j
|
|
|
5369 |
\<lbrace>st j \<and>* ps (v + 2) \<and>* reps u v [k] \<and>* zero (v + 1) \<and>*
|
|
|
5370 |
one (v + 2) \<and>* zeros (v + 3) (v + int(reps_len [k]) + 1)\<rbrace>"
|
|
|
5371 |
apply (unfold cinit_def)
|
|
|
5372 |
apply (simp add:reps.simps)
|
|
|
5373 |
apply (subst sep_conj_cond)+
|
|
|
5374 |
apply (rule tm.pre_condI, simp)
|
|
|
5375 |
apply hsteps
|
|
|
5376 |
apply (simp add:sep_conj_ac)
|
|
|
5377 |
my_block
|
|
|
5378 |
have "(zeros (u + int k + 2) (u + int k + int (reps_len [k]) + 1)) =
|
|
|
5379 |
(zero (u + int k + 2) \<and>* zeros (u + int k + 3) (u + int k + int (reps_len [k]) + 1))"
|
|
|
5380 |
by (smt reps_len_sg zeros_step_simp)
|
|
|
5381 |
my_block_end
|
|
|
5382 |
apply (unfold this)
|
|
|
5383 |
apply hstep
|
|
|
5384 |
by (simp add:sep_conj_ac, sep_cancel+, smt)
|
|
|
5385 |
my_block_end
|
|
|
5386 |
apply (hstep this)
|
|
|
5387 |
apply (rule_tac p = "st j' \<and>* ps (v + 2) \<and>* reps u v [k] \<and>* zero (v + 1) \<and>*
|
|
|
5388 |
one (v + 2) \<and>* zeros (v + 3) (v + int (reps_len [k]) + 1) \<and>* zero (u - 2) \<and>* zero (u - 1) \<and>*
|
|
|
5389 |
<(v = u + int (reps_len [k]) - 1)>
|
|
|
5390 |
" in tm.pre_stren)
|
|
|
5391 |
my_block
|
|
|
5392 |
fix i j
|
|
|
5393 |
from hoare_cmove[where w = 0 and k = k and i = i and j = j and v = v and u = u]
|
|
|
5394 |
have "\<lbrace>st i \<and>* ps (v + 2) \<and>* zero (u - 1) \<and>* reps u v [k] \<and>* zero (v + 1) \<and>*
|
|
|
5395 |
one (v + 2) \<and>* zeros (v + 3) (v + int(reps_len [k]) + 1)\<rbrace>
|
|
|
5396 |
i :[cmove]: j
|
|
|
5397 |
\<lbrace>st j \<and>* ps (u - 1) \<and>* zero (u - 1) \<and>* reps u u [0] \<and>* zeros (u + 1) (v + 1) \<and>*
|
|
|
5398 |
reps (v + 2) (v + int (reps_len [k]) + 1) [k]\<rbrace>"
|
|
|
5399 |
by (auto simp:ones_simps zeros_simps)
|
|
|
5400 |
my_block_end
|
|
|
5401 |
apply (hstep this)
|
|
|
5402 |
apply (hstep, simp)
|
|
|
5403 |
my_block
|
|
|
5404 |
have "reps u u [0] = one u" by (simp add:reps.simps ones_simps)
|
|
|
5405 |
my_block_end my_note eq_repsz = this
|
|
|
5406 |
apply (unfold this)
|
|
|
5407 |
apply (hstep)
|
|
|
5408 |
apply (subst reps.simps, simp add: ones_simps)
|
|
|
5409 |
apply hsteps
|
|
|
5410 |
apply (subst sep_conj_cond)+
|
|
|
5411 |
apply (rule tm.pre_condI, simp del:zeros.simps zeros_simps)
|
|
|
5412 |
apply (thin_tac "int (reps_len [k]) = 1 + int k \<and> v = u + int (reps_len [k]) - 1")
|
|
|
5413 |
my_block
|
|
|
5414 |
have "(zeros (u + 1) (u + int k + 1)) = (zeros (u + 1) (u + int k) \<and>* zero (u + int k + 1))"
|
|
|
5415 |
by (simp only:zeros_rev, smt)
|
|
|
5416 |
my_block_end
|
|
|
5417 |
apply (unfold this)
|
|
|
5418 |
apply (hstep, simp)
|
|
|
5419 |
my_block
|
|
|
5420 |
fix i j
|
|
|
5421 |
from hoare_cfill_until_one[where v = "u + int k" and u = "u + 1"]
|
|
|
5422 |
have "\<lbrace>st i \<and>* ps (u + int k) \<and>* one u \<and>* zeros (u + 1) (u + int k)\<rbrace>
|
|
|
5423 |
i :[ cfill_until_one ]: j
|
|
|
5424 |
\<lbrace>st j \<and>* ps u \<and>* ones u (u + int k) \<rbrace>"
|
|
|
5425 |
by simp
|
|
|
5426 |
my_block_end
|
|
|
5427 |
apply (hstep this, simp add:sep_conj_ac reps.simps ones_simps)
|
|
|
5428 |
apply (simp add:sep_conj_ac reps.simps ones_simps)
|
|
|
5429 |
apply (subst sep_conj_cond)+
|
|
|
5430 |
apply (subst (asm) sep_conj_cond)+
|
|
|
5431 |
apply (rule condI)
|
|
|
5432 |
apply (erule condE, simp)
|
|
|
5433 |
apply (simp add: reps_len_def reps_sep_len_def reps_ctnt_len_def)
|
|
|
5434 |
apply (sep_cancel+)
|
|
|
5435 |
by (erule condE, simp)
|
|
|
5436 |
|
|
|
5437 |
end
|
|
|
5438 |
|