- Next_def
-
|- !R B state. Next R B state = ?state_. B state_ /\ R (state_,state)
- Prev_def
-
|- !R Q state. Prev R Q state = ?state'. R (state,state') /\ Q state'
- Eq_def
-
|- !state0 state. Eq state0 state = (state0 = state)
- ReachIn_def
-
|- (!R B. ReachIn R B 0 = B) /\
!R B n. ReachIn R B (SUC n) = Next R (ReachIn R B n)
- Reachable_def
-
|- !R B state. Reachable R B state = ?n. ReachIn R B n state
- ReachBy_def
-
|- !R B n state. ReachBy R B n state = ?m. m <= n /\ ReachIn R B m state
- IsTrace_tupled_primitive_def
-
|- IsTrace_tupled =
WFREC
(@R'. WF R' /\ !s0 B tr Q s1 R. R' (R,Eq s1,Q,s1::tr) (R,B,Q,s0::s1::tr))
(\IsTrace_tupled' a.
case a of
(v,v1) ->
case v1 of
(v2,v3) ->
case v3 of
(v4,v5) ->
case v5 of
[] -> F
|| v6::v7 ->
case v7 of
[] -> v2 v6 /\ v4 v6
|| v8::v9 ->
v2 v6 /\ v (v6,v8) /\
IsTrace_tupled' (v,Eq v8,v4,v8::v9))
- IsTrace_curried_def
-
|- !x x1 x2 x3. IsTrace x x1 x2 x3 = IsTrace_tupled (x,x1,x2,x3)
- Stable_def
-
|- !R state. Stable R state = !state'. R (state,state') ==> (state' = state)
- Live_def
-
|- !R. Live R = !state. ?state'. R (state,state')
- FnPair_def
-
|- !f g x. FnPair f g x = (f x,g x)
- Path_def
-
|- !R s f. Path (R,s) f = (f 0 = s) /\ !n. R (f n,f (n + 1))
- FinPath_tupled_primitive_def
-
|- FinPath_tupled =
WFREC (@R'. WF R' /\ !n f s R. R' ((R,s),f,n) ((R,s),f,SUC n))
(\FinPath_tupled' a.
case a of
(v,v1) ->
case v of
(v2,v3) ->
case v1 of
(v4,v5) ->
case v5 of
0 -> v4 0 = v3
|| SUC v6 ->
FinPath_tupled' ((v2,v3),v4,v6) /\
v2 (v4 v6,v4 (v6 + 1)))
- FinPath_curried_def
-
|- !x x1 x2. FinPath x x1 x2 = FinPath_tupled (x,x1,x2)
- Total_def
-
|- !R. Total R = !s. ?s'. R (s,s')
- ChoosePath_def
-
|- (!R s. ChoosePath R s 0 = s) /\
!R s n. ChoosePath R s (SUC n) = @s'. R (ChoosePath R s n,s')
- Totalise_def
-
|- !R s s'. Totalise R (s,s') = R (s,s') \/ ~(?s''. R (s,s'')) /\ (s = s')
- Moore_def
-
|- !nextfn inputs states.
Moore nextfn (inputs,states) =
!t. states (t + 1) = nextfn (inputs t,states t)
- MooreTrans_def
-
|- !nextfn input state input' state'.
MooreTrans nextfn ((input,state),input',state') =
(state' = nextfn (input,state))
- ReachIn_rec
-
|- (!R B state. ReachIn R B 0 state = B state) /\
!R B n state.
ReachIn R B (SUC n) state =
?state_. ReachIn R B n state_ /\ R (state_,state)
- ReachBy_rec
-
|- (!R B state. ReachBy R B 0 state = B state) /\
!R B n state.
ReachBy R B (SUC n) state =
ReachBy R B n state \/ ?state_. ReachBy R B n state_ /\ R (state_,state)
- ReachBy_ReachIn
-
|- (!R B state. ReachBy R B 0 state = B state) /\
!R B n state.
ReachBy R B (SUC n) state =
ReachBy R B n state \/ ReachIn R B (SUC n) state
- Reachable_ReachBy
-
|- Reachable R B state = ?n. ReachBy R B n state
- ReachBy_fixedpoint
-
|- !R B n.
(ReachBy R B n = ReachBy R B (SUC n)) ==> (Reachable R B = ReachBy R B n)
- EXISTS_IMP_EQ
-
|- (?x. P x) ==> Q = !x. P x ==> Q
- EQ_COND
-
|- ((x = (if b then y else z)) = (if b then x = y else x = z)) /\
(((if b then y else z) = x) = (if b then y = x else z = x))
- COND_SIMP
-
|- ((if b then F else F) = F) /\ ((if b then F else T) = ~b) /\
((if b then T else F) = b) /\ ((if b then T else T) = T) /\
((if b then x else x) = x) /\ ((if b then b' else ~b') = (b = b')) /\
((if b then ~b' else b') = (b = ~b'))
- IsTrace_ind
-
|- !P.
(!R B Q. P R B Q []) /\ (!R B Q s. P R B Q [s]) /\
(!R B Q s0 s1 tr. P R (Eq s1) Q (s1::tr) ==> P R B Q (s0::s1::tr)) ==>
!v v1 v2 v3. P v v1 v2 v3
- IsTrace_def
-
|- (IsTrace R B Q [] = F) /\ (IsTrace R B Q [s] = B s /\ Q s) /\
(IsTrace R B Q (s0::s1::tr) =
B s0 /\ R (s0,s1) /\ IsTrace R (Eq s1) Q (s1::tr))
- Reachable_Stable
-
|- Live R /\ (!state. ReachIn R B n state ==> Stable R state) ==>
!state. Reachable R B state /\ Stable R state = ReachIn R B n state
- TraceReachIn
-
|- !R B tr. B (tr 0) /\ (!n. R (tr n,tr (n + 1))) ==> !n. ReachIn R B n (tr n)
- ModelCheckAlways
-
|- !R B P.
(!s. Reachable R B s ==> P s) ==>
!tr. B (tr 0) /\ (!t. R (tr t,tr (t + 1))) ==> !t. P (tr t)
- ModelCheckAlwaysCor1
-
|- (!s1 s2. Reachable R B (s1,s2) ==> P s1) ==>
!tr. B (tr 0) /\ (!t. R (tr t,tr (t + 1))) ==> !t. P (FST (tr t))
- ModelCheckAlwaysCor2
-
|- !R B P.
(!s1 s2. Reachable R B (s1,s2) ==> P s1) ==>
!tr1.
(?tr2.
B (tr1 0,tr2 0) /\
!t. R ((tr1 t,tr2 t),tr1 (t + 1),tr2 (t + 1))) ==>
!t. P (tr1 t)
- FnPairAbs
-
|- (!tr. FnPair (\n. FST (tr n)) (\n. SND (tr n)) = tr) /\
!tr1 tr2. (\n. (tr1 n,tr2 n)) = FnPair tr1 tr2
- FnPairExists
-
|- !P. (?tr. P tr) = ?tr1 tr2. P (FnPair tr1 tr2)
- FnPairForall
-
|- !P. (!tr. P tr) = !tr1 tr2. P (FnPair tr1 tr2)
- ABS_EXISTS_THM
-
|- !P rep.
TYPE_DEFINITION P rep ==>
?abs. (!a. abs (rep a) = a) /\ !r. P r = (rep (abs r) = r)
- FORALL_REP
-
|- !abs rep P Q.
(!a. abs (rep a) = a) /\ (!r. P r = (rep (abs r) = r)) ==>
((!a. Q a) = !r. P r ==> Q (abs r))
- EXISTS_REP
-
|- !abs rep P Q.
(!a. abs (rep a) = a) /\ (!r. P r = (rep (abs r) = r)) ==>
((?a. Q a) = ?r. P r /\ Q (abs r))
- ABS_ONE_ONE
-
|- !abs rep.
(!a. abs (rep a) = a) /\ (!r. range r = (rep (abs r) = r)) ==>
!r. range r /\ range r' ==> ((abs r = abs r') = (r = r'))
- FinPath_ind
-
|- !P.
(!R s f. P (R,s) f 0) /\
(!R s f n. P (R,s) f n ==> P (R,s) f (SUC n)) ==>
!v v1 v2. P v v1 v2
- FinPath_def
-
|- (FinPath (R,s) f 0 = (f 0 = s)) /\
(FinPath (R,s) f (SUC n) = FinPath (R,s) f n /\ R (f n,f (n + 1)))
- FinFunEq
-
|- (!m. m <= n + 1 ==> (f1 m = f2 m)) =
(!m. m <= n ==> (f1 m = f2 m)) /\ (f1 (n + 1) = f2 (n + 1))
- FinPathThm
-
|- !n. FinPath (R,s) f n = (f 0 = s) /\ !m. m < n ==> R (f m,f (m + 1))
- FinPathLemma
-
|- !f1 f2 n.
(!m. m <= n ==> (f1 m = f2 m)) ==>
(FinPath (R,s) f1 n = FinPath (R,s) f2 n)
- ReachInFinPath
-
|- !R B n s. ReachIn R B n s = ?f s0. B s0 /\ FinPath (R,s0) f n /\ (s = f n)
- ReachableFinPath
-
|- !R B s. Reachable R B s = ?f s0 n. B s0 /\ FinPath (R,s0) f n /\ (s = f n)
- ReachIn_revrec
-
|- (!R B state. ReachIn R B 0 state = B state) /\
!R B n state.
ReachIn R B (SUC n) state =
?state1 state2.
B state1 /\ R (state1,state2) /\ ReachIn R (Eq state2) n state
- TotalPathExists
-
|- Total R ==> !s. Path (R,s) (ChoosePath R s)
- FinPathPathExists
-
|- !R B f s n.
Total R /\ FinPath (R,s) f n ==>
?g. (!m. m <= n ==> (f m = g m)) /\ Path (R,s) g
- ReachInPath
-
|- !R B n s.
Total R ==> (ReachIn R B n s = ?f s0. B s0 /\ Path (R,s0) f /\ (s = f n))
- ReachablePath
-
|- !R B s.
Total R ==>
(Reachable R B s = ?f s0. B s0 /\ Path (R,s0) f /\ ?n. s = f n)
- TotalTotalise
-
|- Total (Totalise R)
- TotalImpTotaliseLemma
-
|- Total R ==> !s s'. R (s,s') = Totalise R (s,s')
- TotalImpTotalise
-
|- Total R ==> (Totalise R = R)
- TotaliseReachBy
-
|- !n s. ReachBy (Totalise R) B n s = ReachBy R B n s
- ReachableTotalise
-
|- Reachable (Totalise R) = Reachable R
- ReachablePathThm
-
|- !R B s.
Reachable R B s = ?f s0. B s0 /\ Path (Totalise R,s0) f /\ ?n. s = f n
- MooreTransEq
-
|- MooreTrans nextfn =
(\((input,state),input',state'). state' = nextfn (input,state))
- MoorePath
-
|- Moore nextfn (inputs,states) =
Path (MooreTrans nextfn,inputs 0,states 0) (\t. (inputs t,states t))
- TotalMooreTrans
-
|- Total (MooreTrans nextfn)
- ReachableMooreTrans
-
|- !B s.
Reachable (MooreTrans nextfn) B s =
?f s0. B s0 /\ Path (MooreTrans nextfn,s0) f /\ ?n. s = f n
- MooreReachable1
-
|- (!inputs states.
B (inputs 0,states 0) /\ Moore nextfn (inputs,states) ==>
!t. P (inputs t,states t)) ==>
!s. Reachable (MooreTrans nextfn) B s ==> P s
- MooreReachable2
-
|- (!s. Reachable (MooreTrans nextfn) B s ==> P s) ==>
!inputs states.
B (inputs 0,states 0) /\ Moore nextfn (inputs,states) ==>
!t. P (inputs t,states t)
- MooreReachable
-
|- !B nextfn P.
(!inputs states.
B (inputs 0,states 0) /\ Moore nextfn (inputs,states) ==>
!t. P (inputs t,states t)) =
!s. Reachable (MooreTrans nextfn) B s ==> P s
- MooreReachableExists
-
|- (?inputs states.
(B (inputs 0,states 0) /\ Moore nextfn (inputs,states)) /\
?t. P (inputs t,states t)) =
?s. Reachable (MooreTrans nextfn) B s /\ P s
- MooreReachableCor1
-
|- !B nextfn.
(!inputs states.
B (inputs 0,states 0) /\
(!t. states (t + 1) = nextfn (inputs t,states t)) ==>
!t. P (inputs t,states t)) =
!s. Reachable (\((i,s),i',s'). s' = nextfn (i,s)) B s ==> P s