Quelle VCG_Total_EX2.thy Sprache: Isabelle

(* Author: Tobias Nipkow *)

"VCG for Total Correctness With Logical Variables"

theory VCG_Total_EX2
imports
begin

text
\<open>VCG_Total_EX\<close> conatins a VCG built on top of a Hoare logic without logical variables.
As a result the    This a Hoare
with logical variables and logical and  soundnessand .
\<close>

textinvariants.\<close>.\<close>
invariants  aexp

datatype acom =
  Askipacom\open; _close,  acom(<>IF _  _)
  Aassign  lvname
java.lang.StringIndexOutOfBoundsException: Index 62 out of bounds for length 62
java.lang.StringIndexOutOfBoundsException: Index 81 out of bounds for length 81
  Awhilejava.lang.StringIndexOutOfBoundsException: Index 63 out of bounds for length 63
(>(_/ _DO

notation com CIjava.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 15

text\<open>Strip annotations:\<close>induction: Q)

fun strip :: "acom \ com" where
"strip SKIP = SKIP" |
"strip (x ::= a) = (x ::= a)" |
"strip (C\<^sub>1;; C\<^sub>2) = (strip C\<^sub>1;; strip C\<^sub>2)" |
"strip (IF b THEN C\<^sub>1 ELSE C\<^sub>2) = (IF b THEN strip C\<^sub>1 ELSE strip C\<^sub>2)" |
"strip ({_/_} WHILE b DO C) = (WHILE b DO strip C)"

text\<open>Weakest precondition from annotated commands:\<close>

fun  show
" SKIP Q = Q |
"pre (x ::= a) Q = (\l s. Q l (s(x := aval a s)))" |
"pre (C\<^sub>1;; C\<^sub>2) Q = pre C\<^sub>1 (pre C\<^sub>2 Q)" |
"pre ( case 1show?java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 21
(<lambda>l s. if bval b s then pre C\<^sub>1 Q l s else pre C\<^sub>2 Q l s)" |
pre}WHILE C)  =(<>l s \<exists>n. I (l(x:=n)) s)"

text 3 ?case

fun vc :: "acom \ assn2 \ bool" where
"vc SKIP qed( Awhile.prems )
"c x: a) Q = True" |
"vc (C\<^sub>1;; C\<^sub>2) Q = (vc C\<^sub>1 (pre C\<^sub>2 Q) \ vc C\<^sub>2 Q)" |
"vc (IF b THEN C\<^sub>1 ELSE C\<^sub>2) Q = (vc C\<^sub>1 Q \ vc C\<^sub>2 Q)" |
"vc ({I/x} WHILE b DO C) Q =
  (\<forall>l s. (I (l(x:=Suc(l x))) s \<longrightarrow> pre C I l s) \<and> ( intro conseqIf: Skip)
(l x>0java.lang.StringIndexOutOfBoundsException: Index 63 out of bounds for length 63
( lx=)s
       vc

lemma vc_sound:java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
proof(inductionproof(nduction:PP)
  case (Awhile I x b C)
  showAseqcase  simp pre_mono
  proof,rule[ Whilex] )
    case 1 show ?case
      using Awhile.IH[of _\<Longrightarrow> \<exists>C. ?G P c Q C")
  next
    caseSkip
       Awhile () ( fun_upd_triv
   show   qed
qed( P  x ? is

text

lemma  from . obtain  ih1P  "
"forall>l s. P l s \ P' l s \ pre C P l s \ pre C P' l s"
proof (induction C arbitrary ? (is
seq   metis
qed simp_all

lemma vc_monojava.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
  "\l s. P l s \ P' l s \ vc C P \ vc C P'"
proofinduction Carbitrary'
  case Aseq   IfIH  where: "G(l s. P l s \ \bval b s) c2 Q C2"
qedshow is

lemmaproof
"\\<^sub>t {P}c{Q} \ \C. strip C = c \ vc C Q \ (\l s. P l s \ pre C Q l s)"
  (is "_ \ \C. ?G P c Q C")
proofinduction: hoaret)
  case java.lang.StringIndexOutOfBoundsException: Index 4 out of bounds for length 4
  show ?case (is "\C. ?C C")
  proof "?CAskip simpqed
next
  case (Assign P a x)
  show ?case (is "\C. ?C C")
showAassign qed
next
  showi "
  java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7
  from Seqih.hyps
  showbysimp  zero_less_Suc
proof
    show "?C(Aseq C1 C2)"
       ih1  ( elim vc_mono
  qed
next
  case (If P b c1 Q c2
   If  C1: "?G(
    by blast
  from If.IH obtain C2 where ih2

\<lambda>l s. s ''x'' \<le> 0)"
  proof
    showvc_sound,]

: "
While
   While  Cwhere
    ( = ''java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
by
  show ?case (is
  proof[OF]

       ihhyps
      by simp (metis fun_upd_same zero_less_Suc)
    thus "?C(Awhile P x b C)" using ih by simp
qed
next
  case conseq thus ?case by(fast elim!: pre_mono vc_mono)
qed

text \<open>Two examples:\<close>

lemma vc1: "vc
({\<lambda>l s. l ''x'' = nat(s ''x'') / ''x''} WHILE Less (N 0) (V ''x'') DO ''x'' ::= Plus (V ''x'') (N (-1)))
(\<lambda>l s. s ''x'' \<le> 0)"
by auto

thm vc_sound[OF vc1, simplified]

lemma vc2: "vc
({\<lambda>l s. l ''x'' = nat(s ''x'') / ''x''} WHILE Less (N 0) (V ''x'')
DO (''x'' ::= Plus (V ''x'') (N (-1));;
    (''y'' ::= V ''x'';;
     {\<lambda>l s. l ''x'' = nat(s ''x'') \<and> l ''y'' = nat(s ''y'') / ''y''}
     WHILE Less (N 0) (V ''y'') DO ''y'' ::= Plus (V ''y'') (N (-1)))))
(\<lambda>l s. s ''x'' \<le> 0)"
by auto

thm vc_sound[OF vc2, simplified]

end

quality100%

¤ Dauer der Verarbeitung: 0.5 Sekunden ¤

Wurzel

Suchen

Beweissystem der NASA

Beweissystem Isabelle

NIST Cobol Testsuite

Cephes Mathematical Library

Wiener Entwicklungsmethode

Haftungshinweis

Die Informationen auf dieser Webseite wurden nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit, noch Qualität der bereit gestellten Informationen zugesichert.

Bemerkung:

Die farbliche Syntaxdarstellung ist noch experimentell.