Theory OG_Tactics (Isabelle2005: October 2005)

# Theory OG_Tactics

Up to index of Isabelle/HOL/HoareParallel

theory OG_Tactics
imports OG_Hoare
begin

    header {* \section{Generation of Verification Conditions} *}

    theory OG_Tactics imports OG_Hoare
    begin

    lemmas ann_hoare_intros=AnnBasic AnnSeq AnnCond1 AnnCond2 AnnWhile AnnAwait AnnConseq
    lemmas oghoare_intros=Parallel Basic Seq Cond While Conseq

    lemma ParallelConseqRule:
     "[| p ⊆ (\<Inter>i∈{i. i<length Ts}. pre(the(com(Ts ! i))));
      \<parallel>- (\<Inter>i∈{i. i<length Ts}. pre(the(com(Ts ! i))))
          (Parallel Ts)
         (\<Inter>i∈{i. i<length Ts}. post(Ts ! i));
      (\<Inter>i∈{i. i<length Ts}. post(Ts ! i)) ⊆ q |]
      ==> \<parallel>- p (Parallel Ts) q"
    apply (rule Conseq)
    prefer 2
     apply fast
    apply assumption+
    done

    lemma SkipRule: "p ⊆ q ==> \<parallel>- p (Basic id) q"
    apply(rule oghoare_intros)
      prefer 2 apply(rule Basic)
     prefer 2 apply(rule subset_refl)
    apply(simp add:Id_def)
    done

    lemma BasicRule: "p ⊆ {s. (f s)∈q} ==> \<parallel>- p (Basic f) q"
    apply(rule oghoare_intros)
      prefer 2 apply(rule oghoare_intros)
     prefer 2 apply(rule subset_refl)
    apply assumption
    done

    lemma SeqRule: "[| \<parallel>- p c1 r; \<parallel>- r c2 q |] ==> \<parallel>- p (Seq c1 c2) q"
    apply(rule Seq)
    apply fast+
    done

    lemma CondRule:
     "[| p ⊆ {s. (s∈b --> s∈w) ∧ (s∉b --> s∈w')}; \<parallel>- w c1 q; \<parallel>- w' c2 q |]
      ==> \<parallel>- p (Cond b c1 c2) q"
    apply(rule Cond)
     apply(rule Conseq)
     prefer 4 apply(rule Conseq)
    apply simp_all
    apply force+
    done

    lemma WhileRule: "[| p ⊆ i; \<parallel>- (i ∩ b) c i ; (i ∩ (-b)) ⊆ q |]
            ==> \<parallel>- p (While b i c) q"
    apply(rule Conseq)
     prefer 2 apply(rule While)
    apply assumption+
    done

    text {* Three new proof rules for special instances of the @{text
    AnnBasic} and the @{text AnnAwait} commands when the transformation
    performed on the state is the identity, and for an @{text AnnAwait}
    command where the boolean condition is @{text "{s. True}"}: *}

    lemma AnnatomRule:
      "[| atom_com(c); \<parallel>- r c q |]  ==> \<turnstile> (AnnAwait r {s. True} c) q"
    apply(rule AnnAwait)
    apply simp_all
    done

    lemma AnnskipRule:
      "r ⊆ q ==> \<turnstile> (AnnBasic r id) q"
    apply(rule AnnBasic)
    apply simp
    done

    lemma AnnwaitRule:
      "[| (r ∩ b) ⊆ q |] ==> \<turnstile> (AnnAwait r b (Basic id)) q"
    apply(rule AnnAwait)
     apply simp
    apply(rule BasicRule)
    apply simp
    done

    text {* Lemmata to avoid using the definition of @{text
    map_ann_hoare}, @{text interfree_aux}, @{text interfree_swap} and
    @{text interfree} by splitting it into different cases: *}

    lemma interfree_aux_rule1: "interfree_aux(co, q, None)"
    by(simp add:interfree_aux_def)

    lemma interfree_aux_rule2:
      "∀(R,r)∈(atomics a). \<parallel>- (q ∩ R) r q ==> interfree_aux(None, q, Some a)"
    apply(simp add:interfree_aux_def)
    apply(force elim:oghoare_sound)
    done

    lemma interfree_aux_rule3:
      "(∀(R, r)∈(atomics a). \<parallel>- (q ∩ R) r q ∧ (∀p∈(assertions c). \<parallel>- (p ∩ R) r p))
      ==> interfree_aux(Some c, q, Some a)"
    apply(simp add:interfree_aux_def)
    apply(force elim:oghoare_sound)
    done

    lemma AnnBasic_assertions:
      "[|interfree_aux(None, r, Some a); interfree_aux(None, q, Some a)|] ==>
        interfree_aux(Some (AnnBasic r f), q, Some a)"
    apply(simp add: interfree_aux_def)
    by force

    lemma AnnSeq_assertions:
      "[| interfree_aux(Some c1, q, Some a); interfree_aux(Some c2, q, Some a)|]==>
       interfree_aux(Some (AnnSeq c1 c2), q, Some a)"
    apply(simp add: interfree_aux_def)
    by force

    lemma AnnCond1_assertions:
      "[| interfree_aux(None, r, Some a); interfree_aux(Some c1, q, Some a);
      interfree_aux(Some c2, q, Some a)|]==>
      interfree_aux(Some(AnnCond1 r b c1 c2), q, Some a)"
    apply(simp add: interfree_aux_def)
    by force

    lemma AnnCond2_assertions:
      "[| interfree_aux(None, r, Some a); interfree_aux(Some c, q, Some a)|]==>
      interfree_aux(Some (AnnCond2 r b c), q, Some a)"
    apply(simp add: interfree_aux_def)
    by force

    lemma AnnWhile_assertions:
      "[| interfree_aux(None, r, Some a); interfree_aux(None, i, Some a);
      interfree_aux(Some c, q, Some a)|]==>
      interfree_aux(Some (AnnWhile r b i c), q, Some a)"
    apply(simp add: interfree_aux_def)
    by force

    lemma AnnAwait_assertions:
      "[| interfree_aux(None, r, Some a); interfree_aux(None, q, Some a)|]==>
      interfree_aux(Some (AnnAwait r b c), q, Some a)"
    apply(simp add: interfree_aux_def)
    by force

    lemma AnnBasic_atomics:
      "\<parallel>- (q ∩ r) (Basic f) q ==> interfree_aux(None, q, Some (AnnBasic r f))"
    by(simp add: interfree_aux_def oghoare_sound)

    lemma AnnSeq_atomics:
      "[| interfree_aux(Any, q, Some a1); interfree_aux(Any, q, Some a2)|]==>
      interfree_aux(Any, q, Some (AnnSeq a1 a2))"
    apply(simp add: interfree_aux_def)
    by force

    lemma AnnCond1_atomics:
      "[| interfree_aux(Any, q, Some a1); interfree_aux(Any, q, Some a2)|]==>
       interfree_aux(Any, q, Some (AnnCond1 r b a1 a2))"
    apply(simp add: interfree_aux_def)
    by force

    lemma AnnCond2_atomics:
      "interfree_aux (Any, q, Some a)==> interfree_aux(Any, q, Some (AnnCond2 r b a))"
    by(simp add: interfree_aux_def)

    lemma AnnWhile_atomics: "interfree_aux (Any, q, Some a)
         ==> interfree_aux(Any, q, Some (AnnWhile r b i a))"
    by(simp add: interfree_aux_def)

    lemma Annatom_atomics:
      "\<parallel>- (q ∩ r) a q ==> interfree_aux (None, q, Some (AnnAwait r {x. True} a))"
    by(simp add: interfree_aux_def oghoare_sound)

    lemma AnnAwait_atomics:
      "\<parallel>- (q ∩ (r ∩ b)) a q ==> interfree_aux (None, q, Some (AnnAwait r b a))"
    by(simp add: interfree_aux_def oghoare_sound)

    constdefs
      interfree_swap :: "('a ann_triple_op * ('a ann_triple_op) list) => bool"
      "interfree_swap == λ(x, xs). ∀y∈set xs. interfree_aux (com x, post x, com y)
      ∧ interfree_aux(com y, post y, com x)"

    lemma interfree_swap_Empty: "interfree_swap (x, [])"
    by(simp add:interfree_swap_def)

    lemma interfree_swap_List:
      "[| interfree_aux (com x, post x, com y);
      interfree_aux (com y, post y ,com x); interfree_swap (x, xs) |]
      ==> interfree_swap (x, y#xs)"
    by(simp add:interfree_swap_def)

    lemma interfree_swap_Map: "∀k. i≤k ∧ k<j --> interfree_aux (com x, post x, c k)
     ∧ interfree_aux (c k, Q k, com x)
     ==> interfree_swap (x, map (λk. (c k, Q k)) [i..<j])"
    by(force simp add: interfree_swap_def less_diff_conv)

    lemma interfree_Empty: "interfree []"
    by(simp add:interfree_def)

    lemma interfree_List:
      "[| interfree_swap(x, xs); interfree xs |] ==> interfree (x#xs)"
    apply(simp add:interfree_def interfree_swap_def)
    apply clarify
    apply(case_tac i)
     apply(case_tac j)
      apply simp_all
    apply(case_tac j,simp+)
    done

    lemma interfree_Map:
      "(∀i j. a≤i ∧ i<b ∧ a≤j ∧ j<b  ∧ i≠j --> interfree_aux (c i, Q i, c j))
      ==> interfree (map (λk. (c k, Q k)) [a..<b])"
    by(force simp add: interfree_def less_diff_conv)

    constdefs map_ann_hoare :: "(('a ann_com_op * 'a assn) list) => bool " ("[\<turnstile>] _" [0] 45)
      "[\<turnstile>] Ts == (∀i<length Ts. ∃c q. Ts!i=(Some c, q) ∧ \<turnstile> c q)"

    lemma MapAnnEmpty: "[\<turnstile>] []"
    by(simp add:map_ann_hoare_def)

    lemma MapAnnList: "[| \<turnstile> c q ; [\<turnstile>] xs |] ==> [\<turnstile>] (Some c,q)#xs"
    apply(simp add:map_ann_hoare_def)
    apply clarify
    apply(case_tac i,simp+)
    done

    lemma MapAnnMap:
      "∀k. i≤k ∧ k<j --> \<turnstile> (c k) (Q k) ==> [\<turnstile>] map (λk. (Some (c k), Q k)) [i..<j]"
    apply(simp add: map_ann_hoare_def less_diff_conv)
    done

    lemma ParallelRule:"[| [\<turnstile>] Ts ; interfree Ts |]
      ==> \<parallel>- (\<Inter>i∈{i. i<length Ts}. pre(the(com(Ts!i))))
              Parallel Ts
            (\<Inter>i∈{i. i<length Ts}. post(Ts!i))"
    apply(rule Parallel)
     apply(simp add:map_ann_hoare_def)
    apply simp
    done
    (*
    lemma ParamParallelRule:
     "[| ∀k<n. \<turnstile> (c k) (Q k);
       ∀k l. k<n ∧ l<n  ∧ k≠l --> interfree_aux (Some(c k), Q k, Some(c l)) |]
      ==> \<parallel>- (\<Inter>i∈{i. i<n} . pre(c i)) COBEGIN SCHEME [0≤i<n] (c i) (Q i) COEND  (\<Inter>i∈{i. i<n} . Q i )"
    apply(rule ParallelConseqRule)
      apply simp
      apply clarify
      apply force
     apply(rule ParallelRule)
      apply(rule MapAnnMap)
      apply simp
     apply(rule interfree_Map)
     apply simp
    apply simp
    apply clarify
    apply force
    done
    *)

    text {* The following are some useful lemmas and simplification
    tactics to control which theorems are used to simplify at each moment,
    so that the original input does not suffer any unexpected
    transformation. *}

    lemma Compl_Collect: "-(Collect b) = {x. ¬(b x)}"
    by fast
    lemma list_length: "length []=0 ∧ length (x#xs) = Suc(length xs)"
    by simp
    lemma list_lemmas: "length []=0 ∧ length (x#xs) = Suc(length xs)
    ∧ (x#xs) ! 0=x ∧ (x#xs) ! Suc n = xs ! n"
    by simp
    lemma le_Suc_eq_insert: "{i. i <Suc n} = insert n {i. i< n}"
    by auto
    lemmas primrecdef_list = "pre.simps" "assertions.simps" "atomics.simps" "atom_com.simps"
    lemmas my_simp_list = list_lemmas fst_conv snd_conv
    not_less0 refl le_Suc_eq_insert Suc_not_Zero Zero_not_Suc Suc_Suc_eq
    Collect_mem_eq ball_simps option.simps primrecdef_list
    lemmas ParallelConseq_list = INTER_def Collect_conj_eq length_map length_upt length_append list_length

    ML {*
    val before_interfree_simp_tac = (simp_tac (HOL_basic_ss addsimps [thm "com.simps", thm "post.simps"]))

    val  interfree_simp_tac = (asm_simp_tac (HOL_ss addsimps [thm "split", thm "ball_Un", thm "ball_empty"]@(thms "my_simp_list")))

    val ParallelConseq = (simp_tac (HOL_basic_ss addsimps (thms "ParallelConseq_list")@(thms "my_simp_list")))
    *}

    text {* The following tactic applies @{text tac} to each conjunct in a
    subgoal of the form @{text "A ==> a1 ∧ a2 ∧ .. ∧ an"}  returning
    @{text n} subgoals, one for each conjunct: *}

    ML {*
    fun conjI_Tac tac i st = st |>
           ( (EVERY [rtac conjI i,
              conjI_Tac tac (i+1),
              tac i]) ORELSE (tac i) )
    *}

    subsubsection {* Tactic for the generation of the verification conditions *}

    text {* The tactic basically uses two subtactics:

    \begin{description}

    \item[HoareRuleTac] is called at the level of parallel programs, it
     uses the ParallelTac to solve parallel composition of programs.
     This verification has two parts, namely, (1) all component programs are
     correct and (2) they are interference free.  @{text HoareRuleTac} is
     also called at the level of atomic regions, i.e.  @{text "⟨ ⟩"} and
     @{text "AWAIT b THEN _ END"}, and at each interference freedom test.

    \item[AnnHoareRuleTac] is for component programs which
     are annotated programs and so, there are not unknown assertions
     (no need to use the parameter precond, see NOTE).

     NOTE: precond(::bool) informs if the subgoal has the form @{text "\<parallel>- ?p c q"},
     in this case we have precond=False and the generated  verification
     condition would have the form @{text "?p ⊆ …"} which can be solved by
     @{text "rtac subset_refl"}, if True we proceed to simplify it using
     the simplification tactics above.

    \end{description}
    *}

    ML {*

     fun WlpTac i = (rtac (thm "SeqRule") i) THEN (HoareRuleTac false (i+1))
    and HoareRuleTac precond i st = st |>
        ( (WlpTac i THEN HoareRuleTac precond i)
          ORELSE
          (FIRST[rtac (thm "SkipRule") i,
                 rtac (thm "BasicRule") i,
                 EVERY[rtac (thm "ParallelConseqRule") i,
                       ParallelConseq (i+2),
                       ParallelTac (i+1),
                       ParallelConseq i],
                 EVERY[rtac (thm "CondRule") i,
                       HoareRuleTac false (i+2),
                       HoareRuleTac false (i+1)],
                 EVERY[rtac (thm "WhileRule") i,
                       HoareRuleTac true (i+1)],
                 K all_tac i ]
           THEN (if precond then (K all_tac i) else (rtac (thm "subset_refl") i))))

    and  AnnWlpTac i = (rtac (thm "AnnSeq") i) THEN (AnnHoareRuleTac (i+1))
    and AnnHoareRuleTac i st = st |>
        ( (AnnWlpTac i THEN AnnHoareRuleTac i )
         ORELSE
          (FIRST[(rtac (thm "AnnskipRule") i),
                 EVERY[rtac (thm "AnnatomRule") i,
                       HoareRuleTac true (i+1)],
                 (rtac (thm "AnnwaitRule") i),
                 rtac (thm "AnnBasic") i,
                 EVERY[rtac (thm "AnnCond1") i,
                       AnnHoareRuleTac (i+3),
                       AnnHoareRuleTac (i+1)],
                 EVERY[rtac (thm "AnnCond2") i,
                       AnnHoareRuleTac (i+1)],
                 EVERY[rtac (thm "AnnWhile") i,
                       AnnHoareRuleTac (i+2)],
                 EVERY[rtac (thm "AnnAwait") i,
                       HoareRuleTac true (i+1)],
                 K all_tac i]))

    and ParallelTac i = EVERY[rtac (thm "ParallelRule") i,
                              interfree_Tac (i+1),
                               MapAnn_Tac i]

    and MapAnn_Tac i st = st |>
        (FIRST[rtac (thm "MapAnnEmpty") i,
               EVERY[rtac (thm "MapAnnList") i,
                     MapAnn_Tac (i+1),
                     AnnHoareRuleTac i],
               EVERY[rtac (thm "MapAnnMap") i,
                     rtac (thm "allI") i,rtac (thm "impI") i,
                     AnnHoareRuleTac i]])

    and interfree_swap_Tac i st = st |>
        (FIRST[rtac (thm "interfree_swap_Empty") i,
               EVERY[rtac (thm "interfree_swap_List") i,
                     interfree_swap_Tac (i+2),
                     interfree_aux_Tac (i+1),
                     interfree_aux_Tac i ],
               EVERY[rtac (thm "interfree_swap_Map") i,
                     rtac (thm "allI") i,rtac (thm "impI") i,
                     conjI_Tac (interfree_aux_Tac) i]])

    and interfree_Tac i st = st |>
       (FIRST[rtac (thm "interfree_Empty") i,
              EVERY[rtac (thm "interfree_List") i,
                    interfree_Tac (i+1),
                    interfree_swap_Tac i],
              EVERY[rtac (thm "interfree_Map") i,
                    rtac (thm "allI") i,rtac (thm "allI") i,rtac (thm "impI") i,
                    interfree_aux_Tac i ]])

    and interfree_aux_Tac i = (before_interfree_simp_tac i ) THEN
            (FIRST[rtac (thm "interfree_aux_rule1") i,
                   dest_assertions_Tac i])

    and dest_assertions_Tac i st = st |>
        (FIRST[EVERY[rtac (thm "AnnBasic_assertions") i,
                     dest_atomics_Tac (i+1),
                     dest_atomics_Tac i],
               EVERY[rtac (thm "AnnSeq_assertions") i,
                     dest_assertions_Tac (i+1),
                     dest_assertions_Tac i],
               EVERY[rtac (thm "AnnCond1_assertions") i,
                     dest_assertions_Tac (i+2),
                     dest_assertions_Tac (i+1),
                     dest_atomics_Tac i],
               EVERY[rtac (thm "AnnCond2_assertions") i,
                     dest_assertions_Tac (i+1),
                     dest_atomics_Tac i],
               EVERY[rtac (thm "AnnWhile_assertions") i,
                     dest_assertions_Tac (i+2),
                     dest_atomics_Tac (i+1),
                     dest_atomics_Tac i],
               EVERY[rtac (thm "AnnAwait_assertions") i,
                     dest_atomics_Tac (i+1),
                     dest_atomics_Tac i],
               dest_atomics_Tac i])

    and dest_atomics_Tac i st = st |>
        (FIRST[EVERY[rtac (thm "AnnBasic_atomics") i,
                     HoareRuleTac true i],
               EVERY[rtac (thm "AnnSeq_atomics") i,
                     dest_atomics_Tac (i+1),
                     dest_atomics_Tac i],
               EVERY[rtac (thm "AnnCond1_atomics") i,
                     dest_atomics_Tac (i+1),
                     dest_atomics_Tac i],
               EVERY[rtac (thm "AnnCond2_atomics") i,
                     dest_atomics_Tac i],
               EVERY[rtac (thm "AnnWhile_atomics") i,
                     dest_atomics_Tac i],
               EVERY[rtac (thm "Annatom_atomics") i,
                     HoareRuleTac true i],
               EVERY[rtac (thm "AnnAwait_atomics") i,
                     HoareRuleTac true i],
                     K all_tac i])
    *}

    text {* The final tactic is given the name @{text oghoare}: *}

    ML {*
    fun oghoare_tac i thm = SUBGOAL (fn (term, _) =>
       (HoareRuleTac true i)) i thm
    *}

    text {* Notice that the tactic for parallel programs @{text
    "oghoare_tac"} is initially invoked with the value @{text true} for
    the parameter @{text precond}.

    Parts of the tactic can be also individually used to generate the
    verification conditions for annotated sequential programs and to
    generate verification conditions out of interference freedom tests: *}

    ML {* fun annhoare_tac i thm = SUBGOAL (fn (term, _) =>
      (AnnHoareRuleTac i)) i thm

    fun interfree_aux_tac i thm = SUBGOAL (fn (term, _) =>
       (interfree_aux_Tac i)) i thm
    *}

    text {* The so defined ML tactics are then ``exported'' to be used in
    Isabelle proofs. *}

    method_setup oghoare = {*
      Method.no_args
        (Method.SIMPLE_METHOD' HEADGOAL (oghoare_tac)) *}
      "verification condition generator for the oghoare logic"

    method_setup annhoare = {*
      Method.no_args
        (Method.SIMPLE_METHOD' HEADGOAL (annhoare_tac)) *}
      "verification condition generator for the ann_hoare logic"

    method_setup interfree_aux = {*
      Method.no_args
        (Method.SIMPLE_METHOD' HEADGOAL (interfree_aux_tac)) *}
      "verification condition generator for interference freedom tests"

    text {* Tactics useful for dealing with the generated verification conditions: *}

    method_setup conjI_tac = {*
      Method.no_args
        (Method.SIMPLE_METHOD' HEADGOAL (conjI_Tac (K all_tac))) *}
      "verification condition generator for interference freedom tests"

    ML {*
    fun disjE_Tac tac i st = st |>
           ( (EVERY [etac disjE i,
              disjE_Tac tac (i+1),
              tac i]) ORELSE (tac i) )
    *}

    method_setup disjE_tac = {*
      Method.no_args
        (Method.SIMPLE_METHOD' HEADGOAL (disjE_Tac (K all_tac))) *}
      "verification condition generator for interference freedom tests"

    end

lemmas ann_hoare_intros:

      r ⊆ {s. f s ∈ q} ==> \<turnstile> AnnBasic r f
                              q

      [| \<turnstile> c0.0
            pre c1.0;
         \<turnstile> c1.0
            q |]
      ==> \<turnstile> AnnSeq c0.0 c1.0
             q

      [| r ∩ b ⊆ pre c1.0; \<turnstile> c1.0
                              q;
         r ∩ - b ⊆ pre c2.0; \<turnstile> c2.0
                                q |]
      ==> \<turnstile> AnnCond1 r b c1.0 c2.0
             q

      [| r ∩ b ⊆ pre c; \<turnstile> c
                           q;
         r ∩ - b ⊆ q |]
      ==> \<turnstile> AnnCond2 r b c
             q

      [| r ⊆ i; i ∩ b ⊆ pre c; \<turnstile> c
                                  i;
         i ∩ - b ⊆ q |]
      ==> \<turnstile> AnnWhile r b i c
             q

      [| atom_com c; \<parallel>- (r ∩ b)
                        c
                        q |]
      ==> \<turnstile> AnnAwait r b c
             q

      [| \<turnstile> c
            q;
         q ⊆ q' |]
      ==> \<turnstile> c
             q'

lemmas ann_hoare_intros:

      r ⊆ {s. f s ∈ q} ==> \<turnstile> AnnBasic r f
                              q

      [| \<turnstile> c0.0
            pre c1.0;
         \<turnstile> c1.0
            q |]
      ==> \<turnstile> AnnSeq c0.0 c1.0
             q

      [| r ∩ b ⊆ pre c1.0; \<turnstile> c1.0
                              q;
         r ∩ - b ⊆ pre c2.0; \<turnstile> c2.0
                                q |]
      ==> \<turnstile> AnnCond1 r b c1.0 c2.0
             q

      [| r ∩ b ⊆ pre c; \<turnstile> c
                           q;
         r ∩ - b ⊆ q |]
      ==> \<turnstile> AnnCond2 r b c
             q

      [| r ⊆ i; i ∩ b ⊆ pre c; \<turnstile> c
                                  i;
         i ∩ - b ⊆ q |]
      ==> \<turnstile> AnnWhile r b i c
             q

      [| atom_com c; \<parallel>- (r ∩ b)
                        c
                        q |]
      ==> \<turnstile> AnnAwait r b c
             q

      [| \<turnstile> c
            q;
         q ⊆ q' |]
      ==> \<turnstile> c
             q'

lemmas oghoare_intros:

      [| ∀i<length Ts. ∃c q. Ts ! i = (Some c, q) ∧ \<turnstile> c
               q;
         interfree Ts |]
      ==> \<parallel>- (INT i:{i. i < length Ts}. pre (the (OG_Hoare.com (Ts ! i))))
             Parallel Ts
             (INT i:{i. i < length Ts}. OG_Hoare.post (Ts ! i))

      \<parallel>- {s. f s ∈ q}
         Basic f
         q

      [| \<parallel>- p
            c1.0
            r;
         \<parallel>- r
            c2.0
            q |]
      ==> \<parallel>- p
             Seq c1.0 c2.0
             q

      [| \<parallel>- (p ∩ b)
            c1.0
            q;
         \<parallel>- (p ∩ - b)
            c2.0
            q |]
      ==> \<parallel>- p
             Cond b c1.0 c2.0
             q

      \<parallel>- (p ∩ b)
         c
         p
      ==> \<parallel>- p
             While b i c
             (p ∩ - b)

      [| p' ⊆ p; \<parallel>- p
                    c
                    q;
         q ⊆ q' |]
      ==> \<parallel>- p'
             c
             q'

lemmas oghoare_intros:

      [| ∀i<length Ts. ∃c q. Ts ! i = (Some c, q) ∧ \<turnstile> c
               q;
         interfree Ts |]
      ==> \<parallel>- (INT i:{i. i < length Ts}. pre (the (OG_Hoare.com (Ts ! i))))
             Parallel Ts
             (INT i:{i. i < length Ts}. OG_Hoare.post (Ts ! i))

      \<parallel>- {s. f s ∈ q}
         Basic f
         q

      [| \<parallel>- p
            c1.0
            r;
         \<parallel>- r
            c2.0
            q |]
      ==> \<parallel>- p
             Seq c1.0 c2.0
             q

      [| \<parallel>- (p ∩ b)
            c1.0
            q;
         \<parallel>- (p ∩ - b)
            c2.0
            q |]
      ==> \<parallel>- p
             Cond b c1.0 c2.0
             q

      \<parallel>- (p ∩ b)
         c
         p
      ==> \<parallel>- p
             While b i c
             (p ∩ - b)

      [| p' ⊆ p; \<parallel>- p
                    c
                    q;
         q ⊆ q' |]
      ==> \<parallel>- p'
             c
             q'

lemma ParallelConseqRule:

      [| p ⊆ (INT i:{i. i < length Ts}. pre (the (OG_Hoare.com (Ts ! i))));
         \<parallel>- (INT i:{i. i < length Ts}. pre (the (OG_Hoare.com (Ts ! i))))
            Parallel Ts
            (INT i:{i. i < length Ts}. OG_Hoare.post (Ts ! i));
         (INT i:{i. i < length Ts}. OG_Hoare.post (Ts ! i)) ⊆ q |]
      ==> \<parallel>- p
             Parallel Ts
             q

lemma SkipRule:

      p ⊆ q ==> \<parallel>- p
                   Basic id
                   q

lemma BasicRule:

      p ⊆ {s. f s ∈ q} ==> \<parallel>- p
                              Basic f
                              q

lemma SeqRule:

      [| \<parallel>- p
            c1.0
            r;
         \<parallel>- r
            c2.0
            q |]
      ==> \<parallel>- p
             Seq c1.0 c2.0
             q

lemma CondRule:

      [| p ⊆ {s. (s ∈ b --> s ∈ w) ∧ (s ∉ b --> s ∈ w')}; \<parallel>- w
                     c1.0
                     q;
         \<parallel>- w'
            c2.0
            q |]
      ==> \<parallel>- p
             Cond b c1.0 c2.0
             q

lemma WhileRule:

      [| p ⊆ i; \<parallel>- (i ∩ b)
                   c
                   i;
         i ∩ - b ⊆ q |]
      ==> \<parallel>- p
             While b i c
             q

lemma AnnatomRule:

      [| atom_com c; \<parallel>- r
                        c
                        q |]
      ==> \<turnstile> AnnAwait r {s. True} c
             q

lemma AnnskipRule:

      r ⊆ q ==> \<turnstile> AnnBasic r id
                   q

lemma AnnwaitRule:

      r ∩ b ⊆ q ==> \<turnstile> AnnAwait r b (Basic id)
                       q

lemma interfree_aux_rule1:

      interfree_aux (co, q, None)

lemma interfree_aux_rule2:

      ∀(R, r)∈atomics a. \<parallel>- (q ∩ R)
                            r
                            q
      ==> interfree_aux (None, q, Some a)

lemma interfree_aux_rule3:

      ∀(R, r)∈atomics a.
         \<parallel>- (q ∩ R)
            r
            q ∧
         (∀p∈assertions c. \<parallel>- (p ∩ R)
                              r
                              p)
      ==> interfree_aux (Some c, q, Some a)

lemma AnnBasic_assertions:

      [| interfree_aux (None, r, Some a); interfree_aux (None, q, Some a) |]
      ==> interfree_aux (Some (AnnBasic r f), q, Some a)

lemma AnnSeq_assertions:

      [| interfree_aux (Some c1.0, q, Some a); interfree_aux (Some c2.0, q, Some a) |]
      ==> interfree_aux (Some (AnnSeq c1.0 c2.0), q, Some a)

lemma AnnCond1_assertions:

      [| interfree_aux (None, r, Some a); interfree_aux (Some c1.0, q, Some a);
         interfree_aux (Some c2.0, q, Some a) |]
      ==> interfree_aux (Some (AnnCond1 r b c1.0 c2.0), q, Some a)

lemma AnnCond2_assertions:

      [| interfree_aux (None, r, Some a); interfree_aux (Some c, q, Some a) |]
      ==> interfree_aux (Some (AnnCond2 r b c), q, Some a)

lemma AnnWhile_assertions:

      [| interfree_aux (None, r, Some a); interfree_aux (None, i, Some a);
         interfree_aux (Some c, q, Some a) |]
      ==> interfree_aux (Some (AnnWhile r b i c), q, Some a)

lemma AnnAwait_assertions:

      [| interfree_aux (None, r, Some a); interfree_aux (None, q, Some a) |]
      ==> interfree_aux (Some (AnnAwait r b c), q, Some a)

lemma AnnBasic_atomics:

      \<parallel>- (q ∩ r)
         Basic f
         q
      ==> interfree_aux (None, q, Some (AnnBasic r f))

lemma AnnSeq_atomics:

      [| interfree_aux (Any, q, Some a1.0); interfree_aux (Any, q, Some a2.0) |]
      ==> interfree_aux (Any, q, Some (AnnSeq a1.0 a2.0))

lemma AnnCond1_atomics:

      [| interfree_aux (Any, q, Some a1.0); interfree_aux (Any, q, Some a2.0) |]
      ==> interfree_aux (Any, q, Some (AnnCond1 r b a1.0 a2.0))

lemma AnnCond2_atomics:

      interfree_aux (Any, q, Some a) ==> interfree_aux (Any, q, Some (AnnCond2 r b a))

lemma AnnWhile_atomics:

      interfree_aux (Any, q, Some a)
      ==> interfree_aux (Any, q, Some (AnnWhile r b i a))

lemma Annatom_atomics:

      \<parallel>- (q ∩ r)
         a
         q
      ==> interfree_aux (None, q, Some (AnnAwait r {x. True} a))

lemma AnnAwait_atomics:

      \<parallel>- (q ∩ (r ∩ b))
         a
         q
      ==> interfree_aux (None, q, Some (AnnAwait r b a))

lemma interfree_swap_Empty:

      interfree_swap (x, [])

lemma interfree_swap_List:

      [| interfree_aux (OG_Hoare.com x, OG_Hoare.post x, OG_Hoare.com y);
         interfree_aux (OG_Hoare.com y, OG_Hoare.post y, OG_Hoare.com x);
         interfree_swap (x, xs) |]
      ==> interfree_swap (x, y # xs)

lemma interfree_swap_Map:

      ∀k. i ≤ k ∧ k < j -->
          interfree_aux (OG_Hoare.com x, OG_Hoare.post x, c k) ∧
          interfree_aux (c k, Q k, OG_Hoare.com x)
      ==> interfree_swap (x, map (%k. (c k, Q k)) [i..<j])

lemma interfree_Empty:

      interfree []

lemma interfree_List:

      [| interfree_swap (x, xs); interfree xs |] ==> interfree (x # xs)

lemma interfree_Map:

      ∀i j. a ≤ i ∧ i < b ∧ a ≤ j ∧ j < b ∧ i ≠ j --> interfree_aux (c i, Q i, c j)
      ==> interfree (map (%k. (c k, Q k)) [a..<b])

lemma MapAnnEmpty:

      [\<turnstile>] []

lemma MapAnnList:

      [| \<turnstile> c
            q;
         [\<turnstile>] xs |]
      ==> [\<turnstile>] (Some c, q) # xs

lemma MapAnnMap:

      ∀k. i ≤ k ∧ k < j --> \<turnstile> c k
                               Q k
      ==> [\<turnstile>] map (%k. (Some (c k), Q k)) [i..<j]

lemma ParallelRule:

      [| [\<turnstile>] Ts; interfree Ts |]
      ==> \<parallel>- (INT i:{i. i < length Ts}. pre (the (OG_Hoare.com (Ts ! i))))
             Parallel Ts
             (INT i:{i. i < length Ts}. OG_Hoare.post (Ts ! i))

lemma Compl_Collect:

      - Collect b = {x. ¬ b x}

lemma list_length:

      length [] = 0 ∧ length (x # xs) = Suc (length xs)

lemma list_lemmas:

      length [] = 0 ∧
      length (x # xs) = Suc (length xs) ∧ (x # xs) ! 0 = x ∧ (x # xs) ! Suc n = xs ! n

lemma le_Suc_eq_insert:

      {i. i < Suc n} = insert n {i. i < n}

lemmas primrecdef_list:

      pre (AnnBasic r f) = r

      pre (AnnSeq c1.0 c2.0) = pre c1.0

      pre (AnnCond1 r b c1.0 c2.0) = r

      pre (AnnCond2 r b c) = r

      pre (AnnWhile r b i c) = r

      pre (AnnAwait r b c) = r

      assertions (AnnBasic r f) = {r}

      assertions (AnnSeq c1.0 c2.0) = assertions c1.0 ∪ assertions c2.0

      assertions (AnnCond1 r b c1.0 c2.0) = {r} ∪ assertions c1.0 ∪ assertions c2.0

      assertions (AnnCond2 r b c) = {r} ∪ assertions c

      assertions (AnnWhile r b i c) = {r, i} ∪ assertions c

      assertions (AnnAwait r b c) = {r}

      atomics (AnnBasic r f) = {(r, Basic f)}

      atomics (AnnSeq c1.0 c2.0) = atomics c1.0 ∪ atomics c2.0

      atomics (AnnCond1 r b c1.0 c2.0) = atomics c1.0 ∪ atomics c2.0

      atomics (AnnCond2 r b c) = atomics c

      atomics (AnnWhile r b i c) = atomics c

      atomics (AnnAwait r b c) = {(r ∩ b, c)}

      atom_com (Parallel Ts) = False

      atom_com (Basic f) = True

      atom_com (Seq c1.0 c2.0) = (atom_com c1.0 ∧ atom_com c2.0)

      atom_com (Cond b c1.0 c2.0) = (atom_com c1.0 ∧ atom_com c2.0)

      atom_com (While b i c) = atom_com c

lemmas primrecdef_list:

      pre (AnnBasic r f) = r

      pre (AnnSeq c1.0 c2.0) = pre c1.0

      pre (AnnCond1 r b c1.0 c2.0) = r

      pre (AnnCond2 r b c) = r

      pre (AnnWhile r b i c) = r

      pre (AnnAwait r b c) = r

      assertions (AnnBasic r f) = {r}

      assertions (AnnSeq c1.0 c2.0) = assertions c1.0 ∪ assertions c2.0

      assertions (AnnCond1 r b c1.0 c2.0) = {r} ∪ assertions c1.0 ∪ assertions c2.0

      assertions (AnnCond2 r b c) = {r} ∪ assertions c

      assertions (AnnWhile r b i c) = {r, i} ∪ assertions c

      assertions (AnnAwait r b c) = {r}

      atomics (AnnBasic r f) = {(r, Basic f)}

      atomics (AnnSeq c1.0 c2.0) = atomics c1.0 ∪ atomics c2.0

      atomics (AnnCond1 r b c1.0 c2.0) = atomics c1.0 ∪ atomics c2.0

      atomics (AnnCond2 r b c) = atomics c

      atomics (AnnWhile r b i c) = atomics c

      atomics (AnnAwait r b c) = {(r ∩ b, c)}

      atom_com (Parallel Ts) = False

      atom_com (Basic f) = True

      atom_com (Seq c1.0 c2.0) = (atom_com c1.0 ∧ atom_com c2.0)

      atom_com (Cond b c1.0 c2.0) = (atom_com c1.0 ∧ atom_com c2.0)

      atom_com (While b i c) = atom_com c

lemmas my_simp_list:

      length [] = 0 ∧
      length (x # xs) = Suc (length xs) ∧ (x # xs) ! 0 = x ∧ (x # xs) ! Suc n = xs ! n

      fst (a, b) = a

      snd (a, b) = b

      ¬ n < 0

      t = t

      {i. i < Suc n} = insert n {i. i < n}

      Suc m ≠ 0

      0 ≠ Suc m

      (Suc m = Suc n) = (m = n)

      {x. x ∈ A} = A

      (∀x∈A. P x ∨ Q) = ((∀x∈A. P x) ∨ Q)

      (∀x∈A. P ∨ Q x) = (P ∨ (∀x∈A. Q x))

      (∀x∈A. P --> Q x) = (P --> (∀x∈A. Q x))

      (∀x∈A. P x --> Q) = ((∃x∈A. P x) --> Q)

      (∀x∈{}. P x) = True

      (∀x∈UNIV. P x) = (∀x. P x)

      (∀x∈insert a B. P x) = (P a ∧ (∀x∈B. P x))

      (∀x∈Union A. P x) = (∀y∈A. ∀x∈y. P x)

      (∀x∈UNION A B. P x) = (∀a∈A. ∀x∈B a. P x)

      (∀x∈Collect Q. P x) = (∀x. Q x --> P x)

      (∀x∈f ` A. P x) = (∀x∈A. P (f x))

      (¬ (∀x∈A. P x)) = (∃x∈A. ¬ P x)

      None ≠ Some a'

      Some a' ≠ None

      (Some a = Some a') = (a = a')

      option_case f1.0 f2.0 None = f1.0

      option_case f1.0 f2.0 (Some a) = f2.0 a

      size None = 0

      size (Some a) = 0

      option_rec f1.0 f2.0 None = f1.0

      option_rec f1.0 f2.0 (Some a) = f2.0 a

      pre (AnnBasic r f) = r

      pre (AnnSeq c1.0 c2.0) = pre c1.0

      pre (AnnCond1 r b c1.0 c2.0) = r

      pre (AnnCond2 r b c) = r

      pre (AnnWhile r b i c) = r

      pre (AnnAwait r b c) = r

      assertions (AnnBasic r f) = {r}

      assertions (AnnSeq c1.0 c2.0) = assertions c1.0 ∪ assertions c2.0

      assertions (AnnCond1 r b c1.0 c2.0) = {r} ∪ assertions c1.0 ∪ assertions c2.0

      assertions (AnnCond2 r b c) = {r} ∪ assertions c

      assertions (AnnWhile r b i c) = {r, i} ∪ assertions c

      assertions (AnnAwait r b c) = {r}

      atomics (AnnBasic r f) = {(r, Basic f)}

      atomics (AnnSeq c1.0 c2.0) = atomics c1.0 ∪ atomics c2.0

      atomics (AnnCond1 r b c1.0 c2.0) = atomics c1.0 ∪ atomics c2.0

      atomics (AnnCond2 r b c) = atomics c

      atomics (AnnWhile r b i c) = atomics c

      atomics (AnnAwait r b c) = {(r ∩ b, c)}

      atom_com (Parallel Ts) = False

      atom_com (Basic f) = True

      atom_com (Seq c1.0 c2.0) = (atom_com c1.0 ∧ atom_com c2.0)

      atom_com (Cond b c1.0 c2.0) = (atom_com c1.0 ∧ atom_com c2.0)

      atom_com (While b i c) = atom_com c

lemmas my_simp_list:

      length [] = 0 ∧
      length (x # xs) = Suc (length xs) ∧ (x # xs) ! 0 = x ∧ (x # xs) ! Suc n = xs ! n

      fst (a, b) = a

      snd (a, b) = b

      ¬ n < 0

      t = t

      {i. i < Suc n} = insert n {i. i < n}

      Suc m ≠ 0

      0 ≠ Suc m

      (Suc m = Suc n) = (m = n)

      {x. x ∈ A} = A

      (∀x∈A. P x ∨ Q) = ((∀x∈A. P x) ∨ Q)

      (∀x∈A. P ∨ Q x) = (P ∨ (∀x∈A. Q x))

      (∀x∈A. P --> Q x) = (P --> (∀x∈A. Q x))

      (∀x∈A. P x --> Q) = ((∃x∈A. P x) --> Q)

      (∀x∈{}. P x) = True

      (∀x∈UNIV. P x) = (∀x. P x)

      (∀x∈insert a B. P x) = (P a ∧ (∀x∈B. P x))

      (∀x∈Union A. P x) = (∀y∈A. ∀x∈y. P x)

      (∀x∈UNION A B. P x) = (∀a∈A. ∀x∈B a. P x)

      (∀x∈Collect Q. P x) = (∀x. Q x --> P x)

      (∀x∈f ` A. P x) = (∀x∈A. P (f x))

      (¬ (∀x∈A. P x)) = (∃x∈A. ¬ P x)

      None ≠ Some a'

      Some a' ≠ None

      (Some a = Some a') = (a = a')

      option_case f1.0 f2.0 None = f1.0

      option_case f1.0 f2.0 (Some a) = f2.0 a

      size None = 0

      size (Some a) = 0

      option_rec f1.0 f2.0 None = f1.0

      option_rec f1.0 f2.0 (Some a) = f2.0 a

      pre (AnnBasic r f) = r

      pre (AnnSeq c1.0 c2.0) = pre c1.0

      pre (AnnCond1 r b c1.0 c2.0) = r

      pre (AnnCond2 r b c) = r

      pre (AnnWhile r b i c) = r

      pre (AnnAwait r b c) = r

      assertions (AnnBasic r f) = {r}

      assertions (AnnSeq c1.0 c2.0) = assertions c1.0 ∪ assertions c2.0

      assertions (AnnCond1 r b c1.0 c2.0) = {r} ∪ assertions c1.0 ∪ assertions c2.0

      assertions (AnnCond2 r b c) = {r} ∪ assertions c

      assertions (AnnWhile r b i c) = {r, i} ∪ assertions c

      assertions (AnnAwait r b c) = {r}

      atomics (AnnBasic r f) = {(r, Basic f)}

      atomics (AnnSeq c1.0 c2.0) = atomics c1.0 ∪ atomics c2.0

      atomics (AnnCond1 r b c1.0 c2.0) = atomics c1.0 ∪ atomics c2.0

      atomics (AnnCond2 r b c) = atomics c

      atomics (AnnWhile r b i c) = atomics c

      atomics (AnnAwait r b c) = {(r ∩ b, c)}

      atom_com (Parallel Ts) = False

      atom_com (Basic f) = True

      atom_com (Seq c1.0 c2.0) = (atom_com c1.0 ∧ atom_com c2.0)

      atom_com (Cond b c1.0 c2.0) = (atom_com c1.0 ∧ atom_com c2.0)

      atom_com (While b i c) = atom_com c

lemmas ParallelConseq_list:

      INTER A B == {y. ∀x∈A. y ∈ B x}

      {x. P x ∧ Q x} = {x. P x} ∩ {x. Q x}

      length (map f xs) = length xs

      length [i..<j] = j - i

      length (xs @ ys) = length xs + length ys

      length [] = 0 ∧ length (x # xs) = Suc (length xs)

lemmas ParallelConseq_list:

      INTER A B == {y. ∀x∈A. y ∈ B x}

      {x. P x ∧ Q x} = {x. P x} ∩ {x. Q x}

      length (map f xs) = length xs

      length [i..<j] = j - i

      length (xs @ ys) = length xs + length ys

      length [] = 0 ∧ length (x # xs) = Suc (length xs)

#### Tactic for the generation of the verification conditions