Theory: dijkstra

Parents


Type constants


Term constants


Axioms


Definitions

DET
|- !c. DET c = (!s s' s''. c (s,s') /\ c (s,s'') ==> (s' = s''))
WEAKER
|- !p' p. WEAKER p' p = (!s. p s ==> p' s)
WEAKEST
|- !P. WEAKEST P = (@p. P p /\ (!p'. P p' ==> WEAKER p p'))
WP
|- !c q. WP (c,q) = WEAKEST (\p. T_SPEC (p,c,q))
WLP
|- !c q. WLP (c,q) = WEAKEST (\p. MK_SPEC (p,c,q))
WP1
|- !c q s. WP1 (c,q) s = (?s'. c (s,s')) /\ (!s'. c (s,s') ==> q s')
WLP1
|- !c q s. WLP1 (c,q) s = (!s'. c (s,s') ==> q s')
ITER
|- (ITER 0 = (\(b,c) (s,s'). ~(b s) /\ (s = s'))) /\
   (!n. ITER (SUC n) = (\(b,c) (s,s'). b s /\ MK_SEQ (c,ITER n (b,c)) (s,s')))
ITER_WP
|- (!b c p s. ITER_WP 0 b c p s = ~(b s) /\ p s) /\
   (!n b c p s. ITER_WP (SUC n) b c p s = b s /\ WP (c,ITER_WP n b c p) s)
ITER_WLP
|- (!b c p s. ITER_WLP 0 b c p s = ~(b s) ==> p s) /\
   (!n b c p s. ITER_WLP (SUC n) b c p s = b s ==> WLP (c,ITER_WLP n b c p) s)

Theorems

WEAKER_ANTISYM
|- !p1 p2. WEAKER p1 p2 /\ WEAKER p2 p1 ==> (p1 = p2)
WEAKEST_UNIQUE_LEMMA
|- !P p1 p2.
     (P p1 /\ (!p'. P p' ==> WEAKER p1 p')) /\
     P p2 /\
     (!p'. P p' ==> WEAKER p2 p') ==>
     (p1 = p2)
WEAKEST_UNIQUE
|- !P p. P p /\ (!p'. P p' ==> WEAKER p p') ==> (p = WEAKEST P)
WP1_T_SPEC
|- !c q. T_SPEC (WP1 (c,q),c,q)
WLP1_MK_SPEC
|- !c q. MK_SPEC (WLP1 (c,q),c,q)
WP1_WEAKEST
|- !p c q. T_SPEC (p,c,q) ==> WEAKER (WP1 (c,q)) p
WLP1_WEAKEST
|- !p c q. MK_SPEC (p,c,q) ==> WEAKER (WLP1 (c,q)) p
WP_WP1
|- !c q. WP (c,q) = WP1 (c,q)
WLP_WLP1
|- !c q. WLP (c,q) = WLP1 (c,q)
WP_THM
|- !c q. WP (c,q) = (\s. (?s'. c (s,s')) /\ (!s'. c (s,s') ==> q s'))
WLP_THM
|- !c q. WLP (c,q) = (\s. !s'. c (s,s') ==> q s')
WP_T_SPEC
|- !c q. (?s. WP (c,q) s) ==> T_SPEC (WP (c,q),c,q)
WLP_MK_SPEC
|- !c q. (?s. WLP (c,q) s) ==> MK_SPEC (WLP (c,q),c,q)
WP_WEAKEST
|- !p c q. T_SPEC (p,c,q) ==> WEAKER (WP (c,q)) p
WLP_WEAKEST
|- !p c q. MK_SPEC (p,c,q) ==> WEAKER (WLP (c,q)) p
T_SPEC_WP
|- !p c q. T_SPEC (p,c,q) = (!s. p s ==> WP (c,q) s)
MK_SPEC_WLP
|- !p c q. MK_SPEC (p,c,q) = (!s. p s ==> WLP (c,q) s)
WP_PROP1
|- !c. WP (c,(\s. F)) = (\s. F)
WLP_PROP1
|- !c. WLP (c,(\s. F)) = (\s. ~(?s'. c (s,s')))
WP_PROP2
|- !p q c. (!s. p s ==> q s) ==> (!s. WP (c,p) s ==> WP (c,q) s)
WLP_PROP2
|- !p q c. (!s. p s ==> q s) ==> (!s. WLP (c,p) s ==> WLP (c,q) s)
WP_PROP3
|- !p q c s. WP (c,p) s /\ WP (c,q) s = WP (c,(\s. p s /\ q s)) s
WLP_PROP3
|- !p q c s. WLP (c,p) s /\ WLP (c,q) s = WLP (c,(\s. p s /\ q s)) s
WP_PROP4
|- !p q c s. WP (c,p) s \/ WP (c,q) s ==> WP (c,(\s. p s \/ q s)) s
WLP_PROP4
|- !p q c s. WLP (c,p) s \/ WLP (c,q) s ==> WLP (c,(\s. p s \/ q s)) s
WP_PROP4'
|- !p q c.
     DET c ==> (!s. WP (c,p) s \/ WP (c,q) s = WP (c,(\s. p s \/ q s)) s)
WLP_PROP4'
|- !p q c.
     DET c ==> (!s. WLP (c,p) s \/ WLP (c,q) s = WLP (c,(\s. p s \/ q s)) s)
SKIP_WP
|- !p. WP (MK_SKIP,p) = p
SKIP_WLP
|- !p. WLP (MK_SKIP,p) = p
ABORT_WP
|- !p. WP (MK_ABORT,p) = (\s. F)
ABORT_WLP
|- !p. WLP (MK_ABORT,p) = (\s. T)
ASSIGN_WP
|- !x f p. WP (MK_ASSIGN (x,f),p) = (\s. p (BND x (f s) s))
ASSIGN_WLP
|- !x f p. WLP (MK_ASSIGN (x,f),p) = (\s. p (BND x (f s) s))
SEQ_WP
|- !c c' p. DET c ==> (!s. WP (MK_SEQ (c,c'),p) s = WP (c,WP (c',p)) s)
SEQ_WLP
|- !c c' p s. WLP (MK_SEQ (c,c'),p) s = WLP (c,WLP (c',p)) s
IF1_WP
|- !c b p s. WP (MK_IF1 (b,c),p) s = ((b s) => (WP (c,p) s) | (p s))
IF1_WLP
|- !c b p s. WLP (MK_IF1 (b,c),p) s = ((b s) => (WLP (c,p) s) | (p s))
IF2_WP
|- !c c' p s.
     WP (MK_IF2 (b,c,c'),p) s = ((b s) => (WP (c,p) s) | (WP (c',p) s))
IF2_WLP
|- !c c' p s.
     WLP (MK_IF2 (b,c,c'),p) s = ((b s) => (WLP (c,p) s) | (WLP (c',p) s))
ITER_CLAUSES
|- (ITER 0 (b,c) (s,s') = ~(b s) /\ (s = s')) /\
   (ITER (SUC n) (b,c) (s,s') = b s /\ MK_SEQ (c,ITER n (b,c)) (s,s'))
WHILE_ITER1
|- MK_WHILE (b,c) (s,s') ==> (?n. ITER n (b,c) (s,s'))
WHILE_ITER2
|- !n s s'. ITER n (b,c) (s,s') ==> MK_WHILE (b,c) (s,s')
WHILE_ITER
|- MK_WHILE (b,c) (s,s') = (?n. ITER n (b,c) (s,s'))
ITER_UNIQUE
|- DET c ==>
   (!n s s'.
     ITER n (b,c) (s,s') ==> (!n' s''. ITER n' (b,c) (s,s'') ==> (n = n')))
DET_ITER
|- DET c ==> (!n. DET (ITER n (b,c)))
WP_ITER
|- DET c ==> (!n s. WP (ITER n (b,c),p) s = ITER_WP n b c p s)
WHILE_WP
|- !c. DET c ==> (!b p s. WP (MK_WHILE (b,c),p) s = (?n. ITER_WP n b c p s))
FINITE_WHILE_WP_0
|- WP (MK_FINITE_WHILE 0 (b,c),p) s = F
FINITE_WHILE_WP_SUC
|- WP (MK_FINITE_WHILE (SUC n) (b,c),p) s =
   ((b s) => (WP (MK_SEQ (c,MK_FINITE_WHILE n (b,c)),p) s) | (p s))
WLP_ITER
|- !n s. WLP (ITER n (b,c),p) s = ITER_WLP n b c p s
WHILE_WLP
|- !c b p s. WLP (MK_WHILE (b,c),p) s = (!n. ITER_WLP n b c p s)