- WEAKER_ANTISYM
-
|- !p1 p2. WEAKER p1 p2 /\ WEAKER p2 p1 ==> (p1 = p2)
- WEAKEST_UNIQUE_LEMMA
-
|- !P p1 p2.
(P p1 /\ (!p'. P p' ==> WEAKER p1 p')) /\
P p2 /\
(!p'. P p' ==> WEAKER p2 p') ==>
(p1 = p2)
- WEAKEST_UNIQUE
-
|- !P p. P p /\ (!p'. P p' ==> WEAKER p p') ==> (p = WEAKEST P)
- WP1_T_SPEC
-
|- !c q. T_SPEC (WP1 (c,q),c,q)
- WLP1_MK_SPEC
-
|- !c q. MK_SPEC (WLP1 (c,q),c,q)
- WP1_WEAKEST
-
|- !p c q. T_SPEC (p,c,q) ==> WEAKER (WP1 (c,q)) p
- WLP1_WEAKEST
-
|- !p c q. MK_SPEC (p,c,q) ==> WEAKER (WLP1 (c,q)) p
- WP_WP1
-
|- !c q. WP (c,q) = WP1 (c,q)
- WLP_WLP1
-
|- !c q. WLP (c,q) = WLP1 (c,q)
- WP_THM
-
|- !c q. WP (c,q) = (\s. (?s'. c (s,s')) /\ (!s'. c (s,s') ==> q s'))
- WLP_THM
-
|- !c q. WLP (c,q) = (\s. !s'. c (s,s') ==> q s')
- WP_T_SPEC
-
|- !c q. (?s. WP (c,q) s) ==> T_SPEC (WP (c,q),c,q)
- WLP_MK_SPEC
-
|- !c q. (?s. WLP (c,q) s) ==> MK_SPEC (WLP (c,q),c,q)
- WP_WEAKEST
-
|- !p c q. T_SPEC (p,c,q) ==> WEAKER (WP (c,q)) p
- WLP_WEAKEST
-
|- !p c q. MK_SPEC (p,c,q) ==> WEAKER (WLP (c,q)) p
- T_SPEC_WP
-
|- !p c q. T_SPEC (p,c,q) = (!s. p s ==> WP (c,q) s)
- MK_SPEC_WLP
-
|- !p c q. MK_SPEC (p,c,q) = (!s. p s ==> WLP (c,q) s)
- WP_PROP1
-
|- !c. WP (c,(\s. F)) = (\s. F)
- WLP_PROP1
-
|- !c. WLP (c,(\s. F)) = (\s. ~(?s'. c (s,s')))
- WP_PROP2
-
|- !p q c. (!s. p s ==> q s) ==> (!s. WP (c,p) s ==> WP (c,q) s)
- WLP_PROP2
-
|- !p q c. (!s. p s ==> q s) ==> (!s. WLP (c,p) s ==> WLP (c,q) s)
- WP_PROP3
-
|- !p q c s. WP (c,p) s /\ WP (c,q) s = WP (c,(\s. p s /\ q s)) s
- WLP_PROP3
-
|- !p q c s. WLP (c,p) s /\ WLP (c,q) s = WLP (c,(\s. p s /\ q s)) s
- WP_PROP4
-
|- !p q c s. WP (c,p) s \/ WP (c,q) s ==> WP (c,(\s. p s \/ q s)) s
- WLP_PROP4
-
|- !p q c s. WLP (c,p) s \/ WLP (c,q) s ==> WLP (c,(\s. p s \/ q s)) s
- WP_PROP4'
-
|- !p q c.
DET c ==> (!s. WP (c,p) s \/ WP (c,q) s = WP (c,(\s. p s \/ q s)) s)
- WLP_PROP4'
-
|- !p q c.
DET c ==> (!s. WLP (c,p) s \/ WLP (c,q) s = WLP (c,(\s. p s \/ q s)) s)
- SKIP_WP
-
|- !p. WP (MK_SKIP,p) = p
- SKIP_WLP
-
|- !p. WLP (MK_SKIP,p) = p
- ABORT_WP
-
|- !p. WP (MK_ABORT,p) = (\s. F)
- ABORT_WLP
-
|- !p. WLP (MK_ABORT,p) = (\s. T)
- ASSIGN_WP
-
|- !x f p. WP (MK_ASSIGN (x,f),p) = (\s. p (BND x (f s) s))
- ASSIGN_WLP
-
|- !x f p. WLP (MK_ASSIGN (x,f),p) = (\s. p (BND x (f s) s))
- SEQ_WP
-
|- !c c' p. DET c ==> (!s. WP (MK_SEQ (c,c'),p) s = WP (c,WP (c',p)) s)
- SEQ_WLP
-
|- !c c' p s. WLP (MK_SEQ (c,c'),p) s = WLP (c,WLP (c',p)) s
- IF1_WP
-
|- !c b p s. WP (MK_IF1 (b,c),p) s = ((b s) => (WP (c,p) s) | (p s))
- IF1_WLP
-
|- !c b p s. WLP (MK_IF1 (b,c),p) s = ((b s) => (WLP (c,p) s) | (p s))
- IF2_WP
-
|- !c c' p s.
WP (MK_IF2 (b,c,c'),p) s = ((b s) => (WP (c,p) s) | (WP (c',p) s))
- IF2_WLP
-
|- !c c' p s.
WLP (MK_IF2 (b,c,c'),p) s = ((b s) => (WLP (c,p) s) | (WLP (c',p) s))
- ITER_CLAUSES
-
|- (ITER 0 (b,c) (s,s') = ~(b s) /\ (s = s')) /\
(ITER (SUC n) (b,c) (s,s') = b s /\ MK_SEQ (c,ITER n (b,c)) (s,s'))
- WHILE_ITER1
-
|- MK_WHILE (b,c) (s,s') ==> (?n. ITER n (b,c) (s,s'))
- WHILE_ITER2
-
|- !n s s'. ITER n (b,c) (s,s') ==> MK_WHILE (b,c) (s,s')
- WHILE_ITER
-
|- MK_WHILE (b,c) (s,s') = (?n. ITER n (b,c) (s,s'))
- ITER_UNIQUE
-
|- DET c ==>
(!n s s'.
ITER n (b,c) (s,s') ==> (!n' s''. ITER n' (b,c) (s,s'') ==> (n = n')))
- DET_ITER
-
|- DET c ==> (!n. DET (ITER n (b,c)))
- WP_ITER
-
|- DET c ==> (!n s. WP (ITER n (b,c),p) s = ITER_WP n b c p s)
- WHILE_WP
-
|- !c. DET c ==> (!b p s. WP (MK_WHILE (b,c),p) s = (?n. ITER_WP n b c p s))
- FINITE_WHILE_WP_0
-
|- WP (MK_FINITE_WHILE 0 (b,c),p) s = F
- FINITE_WHILE_WP_SUC
-
|- WP (MK_FINITE_WHILE (SUC n) (b,c),p) s =
((b s) => (WP (MK_SEQ (c,MK_FINITE_WHILE n (b,c)),p) s) | (p s))
- WLP_ITER
-
|- !n s. WLP (ITER n (b,c),p) s = ITER_WLP n b c p s
- WHILE_WLP
-
|- !c b p s. WLP (MK_WHILE (b,c),p) s = (!n. ITER_WLP n b c p s)