source: C-semantics/CexecIOcomplete.ma @ 385

Last change on this file since 385 was 385, checked in by campbell, 9 years ago

Almost finished whole program equivalence.

File size: 42.9 KB
Line 
1include "CexecIO.ma".
2include "Plogic/connectives.ma".
3
4ndefinition yields : ∀A,P. res (Σx:A. P x) → A → Prop ≝
5λA,P,e,v. match e with [ OK v' ⇒ match v' with [ sig_intro v'' _ ⇒ v = v'' ] | _ ⇒ False].
6
7(* This tells us that some execution of e results in v.
8   (There may be many possible executions due to I/O, but we're trying to prove
9   that one particular one exists corresponding to a derivation in the inductive
10   semantics.) *)
11nlet rec yieldsIO (A:Type) (P:A → Prop) (e:IO io_out io_in (Σx:A. P x)) (v:A) on e : Prop ≝
12match e with
13[ Value v' ⇒ match v' with [ sig_intro v'' _ ⇒ v = v'' ]
14| Interact _ k ⇒ ∃r.yieldsIO A P (k r) v
15| _ ⇒ False].
16
17nlemma is_pointer_compat_true: ∀m,b,sp.
18  pointer_compat (block_space m b) sp →
19  is_pointer_compat (block_space m b) sp = true.
20#m b sp H; nwhd in ⊢ (??%?);
21nelim (pointer_compat_dec (block_space m b) sp);
22##[ //
23##| #H'; napply False_ind; napply (absurd … H H');
24##] nqed.
25
26nlemma ms_eq_dec_true: ∀s. ms_eq_dec s s = inl ???.
27##[ #s; ncases s; napply refl;
28##| ##skip
29##] nqed.
30
31notation < "vbox( e break ↓ break e')" with precedence 99 for @{'yields ${e} ${e'}}.
32interpretation "yields" 'yields e e' = (yields ?? e e').
33interpretation "yields IO" 'yields e e' = (yieldsIO ?? e e').
34
35ntheorem is_det: ∀p,s,s'.
36initial_state p s → initial_state p s' → s = s'.
37#p s s' H1 H2;
38ninversion H1; #b1 f1 e11 e12 e13;
39ninversion H2; #b2 f2 e21 e22 e23;
40nrewrite > e11 in e21;
41#e1; nrewrite > (?:b1 = b2) in e12;
42##[ nrewrite > e22; #e2; nrewrite > (?:f2 = f1);
43  ##[ //;
44  ##| ndestruct (e2) skip (e22 e23); //;
45  ##]
46##| ndestruct (e1) skip (e11); //
47##] nqed.
48
49nlet rec yieldsIObare (A:Type) (a:IO io_out io_in A) (v':A) on a : Prop ≝
50match a with [ Value v ⇒ v' = v | Interact _ k ⇒ ∃r.yieldsIObare A (k r) v' | _ ⇒ False ].
51
52nlemma remove_io_sig: ∀A. ∀P:A → Prop. ∀a,v',p.
53yieldsIObare A a v' →
54yieldsIO A P (io_inject io_out io_in A (λx.P x) (Some ? a) p) v'.
55#A P a; nelim a;
56##[ #a k IH v' p H; nwhd in H ⊢ %; nelim H; #r H'; @ r; napply IH; napply H';
57##| #v v' p H; napply H;
58##| #a b; *;
59##] nqed.
60
61ndefinition yieldsbare ≝ λA.λa:res A.λv':A.
62match a with [ OK v ⇒ v' = v | _ ⇒ False ].
63
64nlemma yieldsbare_eq: ∀A,a,v'. yieldsbare A a v' → a = OK ? v'.
65#A a v'; ncases a; //; nwhd in ⊢ (% → ?); *;
66nqed.
67
68nlemma remove_res_sig: ∀A. ∀P:A → Prop. ∀a,v',p.
69yieldsbare A a v' →
70yields A P (err_inject A (λx.P x) (Some ? a) p) v'.
71#A P a; ncases a;
72##[ #v v' p H; napply H;
73##| #a b; *;
74##] nqed.
75
76
77ntheorem the_initial_state:
78  ∀p,s. initial_state p s → yieldsbare ? (make_initial_state p) s.
79#p s; ncases p; #fns main globs H;
80ninversion H;
81#b f e1 e2 e3;
82nwhd in ⊢ (??%?);
83nrewrite > e1;
84nwhd in ⊢ (??%?);
85nrewrite > e2;
86nwhd; napply refl;
87nqed.
88
89nlemma cast_complete: ∀m,v,ty,ty',v'.
90  cast m v ty ty' v' → yieldsbare ? (exec_cast m v ty ty') v'.
91#m v ty ty' v' H;
92nelim H;
93##[ #m i sz1 sz2 sg1 sg2; napply refl;
94##| #m f sz szi sg; napply refl;
95##| #m i sz sz' sg; napply refl;
96##| #m f sz sz'; napply refl;
97##| #m sp sp' ty ty' b ofs H1 H2 H3;
98    nelim H1; ##[ #sp1 ty1 ##| #sp1 ty1 n1 ##| #tys1 ty1; nletin sp1 ≝ Code ##]
99    nwhd in ⊢ (??%?);
100    ##[ ##1,2: nrewrite > (ms_eq_dec_true …); nwhd in ⊢ (??%?); ##]
101    nelim H2 in H3 ⊢ %; ##[ ##1,4,7: #sp2 ty2 ##| ##2,5,8: #sp2 ty2 n2 ##| ##3,6,9: #tys2 ty2; nletin sp2 ≝ Code ##]
102    #H3; nwhd in ⊢ (??%?);
103    nrewrite > (is_pointer_compat_true …); //;
104##| #m sz si ty'' H; ncases H; ##[ #sp1 ty1 ##| #sp1 ty1 n1 ##| #args rty ##] napply refl;
105##| #m t t' H H'; ncases H; ncases H'; //;
106##] nqed.
107
108nlemma yields_eq: ∀A,P,e,v. yields A P e v → ∃p. e = OK ? (sig_intro … v p).
109#A P e v; ncases e;
110##[ #vp; ncases vp; #v' p H; nwhd in H; nrewrite > H; @ p; napply refl;
111##| *;
112##] nqed.
113
114(* Use to narrow down the choice of expression to just the lvalues. *)
115nlemma lvalue_expr: ∀ge,env,m,e,ty,sp,l,ofs,tr. ∀P:expr_descr → Prop.
116  eval_lvalue ge env m (Expr e ty) sp l ofs tr →
117  (∀id. P (Evar id)) → (∀e'. P (Ederef e')) → (∀e',id. P (Efield e' id)) →
118  P e.
119#ge env m e ty sp l ofs tr P H; napply (eval_lvalue_inv_ind … H);
120##[ #id l ty e1 e2 e3 e4 e5 e6; ndestruct; //
121##| #id sp l ty e1 e2 e3 e4 e5 e6 e7; ndestruct; //
122##| #e ty sp l ofs tr H e1 e2 e3 e4 e5; ndestruct; //
123##| #e id ty sp l ofs id' fs d tr H e1 e2;(* bogus? *) #_; #e3 e4 e5 e6 e7; ndestruct; //
124##| #e id ty sp l ofs id' fs tr H e1;(* bogus? *) #_; #e2 e3 e4 e5 e6; ndestruct; //
125##] nqed.
126
127nlemma bool_of_val_3_complete : ∀v,ty,r. bool_of_val v ty r → ∃b. r = of_bool b ∧ yieldsbare ? (exec_bool_of_val v ty) b.
128#v ty r H; nelim H; #v t H'; nelim H';
129  ##[ #i is s ne; @ true; @; //; nwhd; nrewrite > (eq_false … ne); //;
130  ##| #p b i i0 s; @ true; @; //
131  ##| #i p t ne; @ true; @; //; nwhd; nrewrite > (eq_false … ne); //;
132  ##| #p b i p0 t0; @ true; @; //
133  ##| #f s ne; @ true; @; //; nwhd; nrewrite > (Feq_zero_false … ne); //;
134  ##| #i s; @ false; @; //;
135  ##| #p t; @ false; @; //;
136  ##| #s; @ false; @; //; nwhd; nrewrite > (Feq_zero_true …); //;
137  ##]
138nqed.
139
140nlemma bool_of_true: ∀v,ty. is_true v ty → yieldsbare ? (exec_bool_of_val v ty) true.
141#v ty H; nelim H;
142  ##[ #i is s ne; nwhd; nrewrite > (eq_false … ne); //;
143  ##| #p b i i0 s; //
144  ##| #i p t ne; nwhd; nrewrite > (eq_false … ne); //;
145  ##| #p b i p0 t0; //
146  ##| #f s ne; nwhd; nrewrite > (Feq_zero_false … ne); //;
147  ##]
148nqed.
149
150nlemma bool_of_false: ∀v,ty. is_false v ty → yieldsbare ? (exec_bool_of_val v ty) false.
151#v ty H; nelim H;
152  ##[ #i s; //;
153  ##| #p t; //;
154  ##| #s; nwhd; nrewrite > (Feq_zero_true …); //;
155  ##]
156nqed.
157
158nremark eq_to_jmeq: ∀A. ∀a,b:A. a = b → a ≃ b.
159#A a b H; nrewrite > H; //; nqed.
160
161nlemma dep_option_rewrite: ∀A,B:Type. ∀e:option A. ∀r:B. ∀P:B → Prop. ∀Q:e ≃ None A → res (Σx:B. P x). ∀R:∀v. e ≃ Some A v → res (Σx:B. P x). ∀h: e = None A.
162 yields ?? (Q (eq_to_jmeq ??? h)) r →
163 yields ?? ((match e return λe'.e ≃ e' → ? with [ None ⇒ λp.Q p | Some v ⇒ λp.R v p ]) (refl_jmeq (option A) e)) r.
164#A B e; ncases e;
165##[ #r P Q R h; nwhd in ⊢ (? → ???%?);
166napply (streicherKjmeq ?? (λe. yields ?? (Q e) r → yields ?? (Q (refl_jmeq (option A) (None A))) r));
167//;
168##| #v r P Q R h; ndestruct (h);
169##] nqed.
170
171nlemma expr_lvalue_complete: ∀ge,env,m.
172(∀e,v,tr. eval_expr ge env m e v tr → yieldsbare ? (exec_expr ge env m e) (〈v,tr〉)) ∧
173(∀e,sp,l,off,tr. eval_lvalue ge env m e sp l off tr → yieldsbare ? (exec_lvalue ge env m e) (〈〈〈sp,l〉,off〉,tr〉)).
174#ge env m;
175napply (combined_expr_lvalue_ind ge env m
176  (λe,v,tr,H. yieldsbare ? (exec_expr ge env m e) (〈v,tr〉))
177  (λe,sp,l,off,tr,H. yieldsbare ? (exec_lvalue ge env m e) (〈〈〈sp,l〉,off〉,tr〉)));
178##[ #i ty; napply refl;
179##| #f ty; napply refl;
180##| #e ty sp l off v tr H1 H2; napply (lvalue_expr … H1);
181    ##[ #id ##| #e' ##| #e' id ##] #H3;
182    nwhd in ⊢ (??%?);
183    nrewrite > (yieldsbare_eq ??? H3);
184    nwhd in ⊢ (??%?); nrewrite > H2; napply refl;
185##| #e ty sp l off tr H1 H2; nwhd in ⊢ (??%?);
186    nrewrite > (yieldsbare_eq ??? H2);
187    napply refl;
188##| #ty' ty; napply refl;
189##| #op e ty v1 v tr H1 H2 H3; nwhd in ⊢ (??%?);
190    nrewrite > (yieldsbare_eq ??? H3);
191    nwhd in ⊢ (??%?); nrewrite > H2; napply refl;
192##| #op e1 e2 ty v1 v2 v tr1 tr2 H1 H2 e3 H4 H5; nwhd in ⊢ (??%?);
193    nrewrite > (yieldsbare_eq ??? H4); nwhd in ⊢ (??%?);
194    nrewrite > (yieldsbare_eq ??? H5); nwhd in ⊢ (??%?);
195    nrewrite > e3; napply refl;
196##| #e1 e2 e3 ty v1 v2 tr1 tr2 H1 H2 H3 H4 H5; nwhd in ⊢ (??%?);
197    nrewrite > (yieldsbare_eq ??? H4); nwhd in ⊢ (??%?);
198    nrewrite > (yieldsbare_eq ??? (bool_of_true ?? H2));
199    nrewrite > (yieldsbare_eq ??? H5);
200    napply refl;
201##| #e1 e2 e3 ty v1 v2 tr1 tr2 H1 H2 H3 H4 H5; nwhd in ⊢ (??%?);
202    nrewrite > (yieldsbare_eq ??? H4); nwhd in ⊢ (??%?);
203    nrewrite > (yieldsbare_eq ??? (bool_of_false ?? H2));
204    nrewrite > (yieldsbare_eq ??? H5);
205    napply refl;
206##| #e1 e2 ty v1 tr H1 H2 H3; nwhd in ⊢ (??%?);
207    nrewrite > (yieldsbare_eq ??? H3); nwhd in ⊢ (??%?);
208    nrewrite > (yieldsbare_eq ??? (bool_of_true ?? H2));
209    napply refl;   
210##| #e1 e2 ty v1 v2 v tr1 tr2 H1 H2 H3 H4 H5 H6; nwhd in ⊢ (??%?);
211    nrewrite > (yieldsbare_eq ??? H5); nwhd in ⊢ (??%?);
212    nrewrite > (yieldsbare_eq ??? (bool_of_false ?? H2));
213    nrewrite > (yieldsbare_eq ??? H6); nwhd in ⊢ (??%?);
214    nelim (bool_of_val_3_complete … H4); #b; *; #evb Hb;
215    nrewrite > (yieldsbare_eq ??? Hb); nwhd in ⊢ (??%?); nrewrite < evb;
216    napply refl;   
217##| #e1 e2 ty v1 tr H1 H2 H3; nwhd in ⊢ (??%?);
218    nrewrite > (yieldsbare_eq ??? H3); nwhd in ⊢ (??%?);
219    nrewrite > (yieldsbare_eq ??? (bool_of_false ?? H2));
220    napply refl;   
221##| #e1 e2 ty v1 v2 v tr1 tr2 H1 H2 H3 H4 H5 H6; nwhd in ⊢ (??%?);
222    nrewrite > (yieldsbare_eq ??? H5); nwhd in ⊢ (??%?);
223    nrewrite > (yieldsbare_eq ??? (bool_of_true ?? H2));
224    nrewrite > (yieldsbare_eq ??? H6); nwhd in ⊢ (??%?);
225    nelim (bool_of_val_3_complete … H4); #b; *; #evb Hb;
226    nrewrite > (yieldsbare_eq ??? Hb); nwhd in ⊢ (??%?); nrewrite < evb;
227    napply refl;
228##| #e ty ty' v1 v tr H1 H2 H3; nwhd in ⊢ (??%?);
229    nrewrite > (yieldsbare_eq ??? H3); nwhd in ⊢ (??%?);
230    nrewrite > (yieldsbare_eq ??? (cast_complete … H2));
231    napply refl;
232##| #e ty v l tr H1 H2; nwhd in ⊢ (??%?);
233    nrewrite > (yieldsbare_eq ??? H2); nwhd in ⊢ (??%?);
234    napply refl;
235   
236  (* lvalues *)
237##| #id l ty e1; nwhd in ⊢ (??%?); nrewrite > e1; napply refl;
238##| #id sp l ty e1 e2; nwhd in ⊢ (??%?); nrewrite > e1;
239    nrewrite > e2; napply refl;
240##| #e ty sp l ofs tr H1 H2; nwhd in ⊢ (??%?);
241    nrewrite > (yieldsbare_eq ??? H2);
242    napply refl;
243##| #e i ty sp l ofs id fList delta tr H1 H2 H3 H4; ncases e in H2 H4 ⊢ %;
244    #e' ty' H2; nwhd in H2:(??%?); nrewrite > H2; #H4; nwhd in ⊢ (??%?);
245    nrewrite > (yieldsbare_eq ??? H4); nwhd in ⊢ (??%?);
246    nrewrite > H3; napply refl;
247##| #e i ty sp l ofs id fList tr; ncases e; #e' ty' H1 H2;
248    nwhd in H2:(??%?); nrewrite > H2; #H3; nwhd in ⊢ (??%?);
249    nrewrite > (yieldsbare_eq ??? H3); napply refl;
250##] nqed.
251
252ntheorem expr_complete:  ∀ge,env,m.
253 ∀e,v,tr. eval_expr ge env m e v tr → yieldsbare ? (exec_expr ge env m e) (〈v,tr〉).
254#ge env m; nelim (expr_lvalue_complete ge env m); /2/; nqed.
255
256ntheorem exprlist_complete: ∀ge,env,m,es,vs,tr.
257  eval_exprlist ge env m es vs tr → yieldsbare ? (exec_exprlist ge env m es) (〈vs,tr〉).
258#ge env m es vs tr H; nelim H;
259##[ napply refl;
260##| #e et v vt tr trt H1 H2 H3; nwhd in ⊢ (??%?);
261    nrewrite > (yieldsbare_eq ??? (expr_complete … H1)); nwhd in ⊢ (??%?);
262    nrewrite > (yieldsbare_eq ??? H3);
263    napply refl;
264##] nqed.
265
266ntheorem lvalue_complete: ∀ge,env,m.
267 ∀e,sp,l,off,tr. eval_lvalue ge env m e sp l off tr → yieldsbare ? (exec_lvalue ge env m e) (〈〈〈sp,l〉,off〉,tr〉).
268#ge env m; nelim (expr_lvalue_complete ge env m); /2/; nqed.
269
270nlet rec P_typelist (P:type → Prop) (l:typelist) on l : Prop ≝
271match l with
272[ Tnil ⇒ True
273| Tcons h t ⇒ P h ∧ P_typelist P t
274].
275
276nlet rec type_ind2l
277  (P:type → Prop) (Q:typelist → Prop)
278  (vo:P Tvoid)
279  (it:∀i,s. P (Tint i s))
280  (fl:∀f. P (Tfloat f))
281  (pt:∀s,t. P t → P (Tpointer s t))
282  (ar:∀s,t,n. P t → P (Tarray s t n))
283  (fn:∀tl,t. Q tl → P t → P (Tfunction tl t))
284  (st:∀i,fl. P (Tstruct i fl))
285  (un:∀i,fl. P (Tunion i fl))
286  (cp:∀i. P (Tcomp_ptr i))
287  (nl:Q Tnil)
288  (cs:∀t,tl. P t → Q tl → Q (Tcons t tl))
289 (t:type) on t : P t ≝
290  match t return λt'.P t' with
291  [ Tvoid ⇒ vo
292  | Tint i s ⇒ it i s
293  | Tfloat s ⇒ fl s
294  | Tpointer s t' ⇒ pt s t' (type_ind2l P Q vo it fl pt ar fn st un cp nl cs t')
295  | Tarray s t' n ⇒ ar s t' n (type_ind2l P Q vo it fl pt ar fn st un cp nl cs t')
296  | Tfunction tl t' ⇒ fn tl t' (typelist_ind2l P Q vo it fl pt ar fn st un cp nl cs tl) (type_ind2l P Q vo it fl pt ar fn st un cp nl cs t')
297  | Tstruct i fs ⇒ st i fs
298  | Tunion i fs ⇒ un i fs
299  | Tcomp_ptr i ⇒ cp i
300  ]
301and typelist_ind2l
302  (P:type → Prop) (Q:typelist → Prop)
303  (vo:P Tvoid)
304  (it:∀i,s. P (Tint i s))
305  (fl:∀f. P (Tfloat f))
306  (pt:∀s,t. P t → P (Tpointer s t))
307  (ar:∀s,t,n. P t → P (Tarray s t n))
308  (fn:∀tl,t. Q tl → P t → P (Tfunction tl t))
309  (st:∀i,fl. P (Tstruct i fl))
310  (un:∀i,fl. P (Tunion i fl))
311  (cp:∀i. P (Tcomp_ptr i))
312  (nl:Q Tnil)
313  (cs:∀t,tl. P t → Q tl → Q (Tcons t tl))
314  (ts:typelist) on ts : Q ts ≝
315  match ts return λts'.Q ts' with
316  [ Tnil ⇒ nl
317  | Tcons t tl ⇒ cs t tl (type_ind2l P Q vo it fl pt ar fn st un cp nl cs t)
318                     (typelist_ind2l P Q vo it fl pt ar fn st un cp nl cs tl)
319  ].
320
321naxiom assert_type_eq_true: ∀t. ∃p.assert_type_eq t t = OK ? p.
322(*nlemma assert_type_eq_true: ∀t. ∃p.assert_type_eq t t = OK ? p.
323#t; napply (type_ind2l ? (λtl. ∃p.assert_typelist_eq tl tl = OK ? p) … t);
324##[ @ (refl ??); // ##| #sz si; ncases sz; ncases si; @ (refl ??); //;
325##| #sz; ncases sz; @ ?; //;
326##| #sp ty IH; ncases sp; nwhd in ⊢ (??(λ_.??%?)); nelim IH; #p IH; nrewrite > IH; @ ?; //;
327##| #sp ty n IH; ncases sp; nwhd in ⊢ (??(λ_.??%?)); nelim IH; #p IH; nrewrite > IH;
328    nwhd in ⊢ (??(λ_.??%?)); ncases (decidable_eq_Z_Type n n);
329    ##[ ##1,3,5,7,9,11: #H; nwhd in ⊢ (??(λ_.??%?)); @ ?; //;
330    ##| ##*: #H; napply False_ind; /2/;
331    ##]
332##| #tys ty IH1 IH2; @ ?;
333    ##[ ##2: nwhd in ⊢ (??%?); nelim IH1; #p1 e1;
334    nrewrite > e1; nwhd in ⊢ (??%?);
335    nelim IH2;
336    *)
337
338nlemma is_not_void_true: ∀f. ¬fn_return f = Tvoid → ∃p. is_not_void (fn_return f) = OK ? p.
339#f; ncases f; #ty; #_; #_; #_; ncases ty;
340##[ #H; napply False_ind; /2/;
341##| #sz sg e; @ ?; //; ##| #sz e; @ ?; // ##| #sp ty e; @ ?; // ##| #sp ty n e; @ ?; // ##|
342    #tys ty e; @ ?; // ##| #id fs e; @ ?; // ##| #id fs e; @ ?; // ##| #id e; @ ?; // ##]
343nqed.
344
345nlemma alloc_vars_complete: ∀env,m,l,env',m'.
346  alloc_variables env m l env' m' →
347  ∃p.exec_alloc_variables env m l = sig_intro ?? (Some ? 〈env', m'〉) p.
348#env m l env' m' H; nelim H;
349##[ #env'' m''; @ ?; nwhd; //;
350##| #env1 m1 id ty l1 m2 loc m3 env2 H1 H2 H3;
351    nwhd in H1:(??%?) ⊢ (??(λ_.??%?));
352    ndestruct (H1);
353    nelim H3; #p3 e3; nrewrite > e3; nwhd in ⊢ (??(λ_.??%?)); @ ?; //;
354##] nqed.
355
356nlemma bind_params_complete: ∀e,m,params,vs,m2.
357  bind_parameters e m params vs m2 →
358  yields ?? (exec_bind_parameters e m params vs) m2.
359#e m params vs m2 H; nelim H;
360##[ //;
361##| #env1 m1 id ty l v tl loc m2 m3 H1 H2 H3 H4;
362    napply remove_res_sig;
363    nrewrite > H1; nwhd in ⊢ (??%?);
364    nrewrite > H2; nwhd in ⊢ (??%?);
365    nelim (yields_eq ???? H4); #p4 e4; nrewrite > e4;
366    napply refl;
367##] nqed.
368
369nlemma eventval_match_complete': ∀ev,ty,v.
370  eventval_match ev ty v → yields ?? (check_eventval' v ty) ev.
371#ev ty v H; nelim H; //; nqed.
372
373nlemma eventval_list_match_complete: ∀vs,tys,evs.
374  eventval_list_match evs tys vs → yields ?? (check_eventval_list vs tys) evs.
375#vs tys evs H; nelim H;
376##[ //
377##| #e etl ty tytl v vtl H1 H2 H3; napply remove_res_sig;
378    nelim (yields_eq ???? (eventval_match_complete' … H1)); #p1 e1; nrewrite > e1; nwhd in ⊢ (??%?);
379    nelim (yields_eq ???? H3); #p3 e3; nrewrite > e3; nwhd in ⊢ (??%?);
380    napply refl;
381##] nqed.   
382
383
384ntheorem step_complete: ∀ge,s,tr,s'.
385  step ge s tr s' → yieldsIObare ? (exec_step ge s) 〈tr,s'〉.
386#ge s tr s' H; nelim H;
387##[ #f e e1 k e2 m sp loc ofs v m' tr1 tr2 H1 H2 H3; nwhd in ⊢ (??%?);
388    nrewrite > (yieldsbare_eq ??? (lvalue_complete … H1)); nwhd in ⊢ (??%?);
389    nrewrite > (yieldsbare_eq ??? (expr_complete … H2)); nwhd in ⊢ (??%?);
390    nrewrite > H3; napply refl;
391##| #f e eargs k ef m vf vargs f' tr1 tr2 H1 H2 H3 H4; nwhd in ⊢ (??%?);
392    nrewrite > (yieldsbare_eq ??? (expr_complete … H1)); nwhd in ⊢ (??%?);
393    nrewrite > (yieldsbare_eq ??? (exprlist_complete … H2)); nwhd in ⊢ (??%?);
394    nrewrite > H3; nwhd in ⊢ (??%?);
395    nrewrite > H4; nelim (assert_type_eq_true (typeof e)); #pty ety; nrewrite > ety;
396    napply refl;
397##| #f el ef eargs k env m sp loc ofs vf vargs f' tr1 tr2 tr3 H1 H2 H3 H4 H5; nwhd in ⊢ (??%?);
398    nrewrite > (yieldsbare_eq ??? (expr_complete … H2)); nwhd in ⊢ (??%?);
399    nrewrite > (yieldsbare_eq ??? (exprlist_complete … H3)); nwhd in ⊢ (??%?);
400    nrewrite > H4; nwhd in ⊢ (??%?);
401    nrewrite > H5; nelim (assert_type_eq_true (typeof ef)); #pty ety; nrewrite > ety;
402    nwhd in ⊢ (??%?);
403    nrewrite > (yieldsbare_eq ??? (lvalue_complete … H1)); nwhd in ⊢ (??%?);
404    napply refl;
405##| #f s1 s2 k env m; napply refl
406##| ##5,6,7: #f s k env m; napply refl
407##| #f e s1 s2 k env m v tr H1 H2; nwhd in ⊢ (??%?);
408    nrewrite > (yieldsbare_eq ??? (expr_complete … H1)); nwhd in ⊢ (??%?);
409    nrewrite > (yieldsbare_eq ??? (bool_of_true ?? H2));
410    napply refl
411##| #f e s1 s2 k env m v tr H1 H2; nwhd in ⊢ (??%?);
412    nrewrite > (yieldsbare_eq ??? (expr_complete … H1)); nwhd in ⊢ (??%?);
413    nrewrite > (yieldsbare_eq ??? (bool_of_false ?? H2));
414    napply refl
415##| #f e s k env m v tr H1 H2; nwhd in ⊢ (??%?);
416    nrewrite > (yieldsbare_eq ??? (expr_complete … H1)); nwhd in ⊢ (??%?);
417    nrewrite > (yieldsbare_eq ??? (bool_of_false ?? H2));
418    napply refl
419##| #f e s k env m v tr H1 H2; nwhd in ⊢ (??%?);
420    nrewrite > (yieldsbare_eq ??? (expr_complete … H1)); nwhd in ⊢ (??%?);
421    nrewrite > (yieldsbare_eq ??? (bool_of_true ?? H2));
422    napply refl
423##| #f s1 e s2 k env m H; ncases H; #es1; nrewrite > es1; napply refl;
424##| ##13,14: #f e s k env m; napply refl
425##| #f s1 e s2 k env m v tr; *; #es1; nrewrite > es1; #H1 H2; nwhd in ⊢ (??%?);
426    nrewrite > (yieldsbare_eq ??? (expr_complete … H1)); nwhd in ⊢ (??%?);
427    nrewrite > (yieldsbare_eq ??? (bool_of_false ?? H2));
428    napply refl
429##| #f s1 e s2 k env m v tr; *; #es1; nrewrite > es1; #H1 H2; nwhd in ⊢ (??%?);
430    nrewrite > (yieldsbare_eq ??? (expr_complete … H1)); nwhd in ⊢ (??%?);
431    nrewrite > (yieldsbare_eq ??? (bool_of_true ?? H2));
432    napply refl
433##| #f e s k env m; napply refl;
434##| #f s1 e s2 s3 k env m nskip; nwhd in ⊢ (??%?); ncases (is_Sskip s1);
435    ##[ #H; napply False_ind; /2/;
436    ##| #H; nwhd in ⊢ (??%?); napply refl ##]
437##| #f e s1 s2 k env m v tr H1 H2; nwhd in ⊢ (??%?);
438    nrewrite > (yieldsbare_eq ??? (expr_complete … H1)); nwhd in ⊢ (??%?);
439    nrewrite > (yieldsbare_eq ??? (bool_of_false ?? H2));
440    napply refl;
441##| #f e s1 s2 k env m v tr H1 H2; nwhd in ⊢ (??%?);
442    nrewrite > (yieldsbare_eq ??? (expr_complete … H1)); nwhd in ⊢ (??%?);
443    nrewrite > (yieldsbare_eq ??? (bool_of_true ?? H2));
444    napply refl;
445##| #f s1 e s2 s3 k env m; *; #es1; nrewrite > es1; napply refl;
446##| ##22,23: #f e s1 s2 k env m; napply refl;
447##| #f k env m H; nwhd in ⊢ (??%?); nrewrite > H; napply refl;
448##| #f e k env m v tr H1 H2; nwhd in ⊢ (??%?);
449    nelim (is_not_void_true f H1); #pf ef; nrewrite > ef; nwhd in ⊢ (??%?);
450    nrewrite > (yieldsbare_eq ??? (expr_complete … H2)); nwhd in ⊢ (??%?);
451    napply refl;
452##| #f k env m; ncases k;
453    ##[ #H1 H2; nwhd in ⊢ (??%?); nrewrite > H2; napply refl;
454    ##| #s' k'; nwhd in ⊢ (% → ?); *;
455    ##| ##3,4: #e' s' k'; nwhd in ⊢ (% → ?); *;
456    ##| ##5,6: #e' s1' s2' k'; nwhd in ⊢ (% → ?); *;
457    ##| #k'; nwhd in ⊢ (% → ?); *;
458    ##| #r f' env' k' H1 H2; nwhd in ⊢ (??%?); nrewrite > H2; napply refl
459    ##]
460##| #f e s k env m i tr H1; nwhd in ⊢ (??%?);
461    nrewrite > (yieldsbare_eq ??? (expr_complete … H1)); nwhd in ⊢ (??%?);
462    napply refl
463##| #f s k env m; *; #es; nrewrite > es; napply refl;
464##| #f k env m; napply refl
465##| #f l s k env m; napply refl
466##| #f l k env m s k' H1; nwhd in ⊢ (??%?); nrewrite > H1; napply refl;
467##| #f args k m1 env m2 m3 H1 H2; nwhd in ⊢ (??%?);
468    nelim (alloc_vars_complete … H1); #p1 e1; nrewrite > e1; nwhd in ⊢ (??%?);
469    nelim (yields_eq ???? (bind_params_complete … H2)); #p2 e2; nrewrite > e2;
470    napply refl;
471##| #id tys rty args k m rv tr H; nwhd in ⊢ (??%?);
472    ninversion H; #f' args' rv' eargs erv H1 H2 e1 e2 e3 e4; nrewrite < e1 in H1 H2;
473    #H1 H2;
474    nelim (yields_eq ???? (eventval_list_match_complete … H1)); #p1 e1; nrewrite > e1; nwhd in ⊢ (??%?);
475    nwhd; ninversion H2; #x e5 e6 e7; @ x; nwhd in ⊢ (??%?);
476    napply refl
477##| #v f env k m; nwhd in ⊢ (??%?); napply daemon (* FIXME: inductive semantics allows any value ?! *)
478##| #v f env k m1 m2 sp loc ofs ty H; nwhd in ⊢ (??%?);
479    nrewrite > H; napply refl
480##| #f l s k env m; napply refl
481##] nqed.
482 
483nlemma wrong_sound: ∀ge,tr,s,s',e.
484  execution_goes_wrong tr s (e_step E0 s e) s' →
485  exec_inf_aux ge (Value ??? 〈E0, s〉) = e_step E0 s e →
486  star (mk_transrel … step) ge s tr s' ∧
487  nostep (mk_transrel … step) ge s' ∧
488  (¬∃r. final_state s' r).
489#ge tr0 s0 s0' e0 WRONG; ncases WRONG;
490#tr s s' e ESTEPS EXEC;
491ncases (several_steps … ESTEPS EXEC);
492#STAR EXEC'; @;
493##[ @; ##[ napply STAR;
494       ##| #badtr bads; @; #badSTEP;
495           nlapply (step_complete … badSTEP);
496           nlapply (exec_e_step … EXEC');
497           ncases (exec_step ge s');
498           ##[ #o k; nrewrite > (execution_cases (exec_inf_aux …)); #E; nwhd in E:(??%?);
499               ndestruct
500           ##| #x; ncases x; #trx stx; nrewrite > (exec_inf_aux_unfold …);
501               nwhd in ⊢ (??%? → ?); ncases (is_final_state stx);
502               #FINAL E; nwhd in E:(??%?); ndestruct
503           ##| #E H; nwhd in H; napply H
504           ##]
505       ##]
506##| @; #FINAL;
507    nrewrite > (exec_inf_aux_unfold …) in EXEC';
508    nwhd in ⊢ (??%? → ?);
509    ncases (is_final_state s'); #FINAL';
510    ##[ nwhd in ⊢ (??%? → ?); #E; ndestruct;
511    ##| napply False_ind; napply (absurd … FINAL FINAL');
512    ##]
513##] nqed.
514
515ninductive execution_characterisation : state → execution → Prop ≝
516| ec_terminates: ∀s,r,m,e,tr.
517    execution_terminates tr s e r m →
518    execution_characterisation s e
519| ec_diverges: ∀s,e,tr.
520    execution_diverges tr s e →
521    execution_characterisation s e
522| ec_reacts: ∀s,e,tr.
523    execution_reacts tr s e →
524    execution_characterisation s e
525| ec_wrong: ∀e,s,s',tr.
526    execution_goes_wrong tr s e s' →
527    execution_characterisation s e.
528
529(* bit of a hack to avoid inability to reduce term in match *)
530ndefinition interact_prop : ∀A:Type.(∀o:io_out. (io_in o → IO io_out io_in A) → Prop) → IO io_out io_in A → Prop ≝
531λA,P,e. match e return λ_.Prop with [ Interact o k ⇒ P o k | _ ⇒ True ].
532
533nlemma err_does_not_interact: ∀A,B,P,e1,e2.
534  (∀x:B.interact_prop A P (e2 x)) →
535  interact_prop A P (bindIO ?? B A (err_to_io ??? e1) e2).
536#A B P e1 e2 H;
537ncases e1; //; nqed.
538
539nlemma err2_does_not_interact: ∀A,B,C,P,e1,e2.
540  (∀x,y.interact_prop A P (e2 x y)) →
541  interact_prop A P (bindIO2 ?? B C A (err_to_io ??? e1) e2).
542#A B C P e1 e2 H;
543ncases e1; ##[ #z; ncases z; ##] //; nqed.
544
545nlemma err_sig_does_not_interact: ∀A,B,P.∀Q:B→Prop.∀e1,e2.
546  (∀x.interact_prop A P (e2 x)) →
547  interact_prop A P (bindIO ?? (sigma B Q) A (err_to_io_sig ??? Q e1) e2).
548#A B P Q e1 e2 H;
549ncases e1; //; nqed.
550
551nlemma opt_does_not_interact: ∀A,B,P,e1,e2.
552  (∀x:B.interact_prop A P (e2 x)) →
553  interact_prop A P (bindIO ?? B A (opt_to_io ??? e1) e2).
554#A B P e1 e2 H;
555ncases e1; //; nqed.
556
557nlemma exec_step_interaction:
558  ∀ge,s. interact_prop ? (λo,k. ∀i.∃tr.∃s'. k i = Value ??? 〈tr,s'〉 ∧ tr ≠ E0) (exec_step ge s).
559#ge s; ncases s;
560##[ #f st kk e m; ncases st;
561  ##[ ##11,14: #a ##| ##2,4,6,7,12,13,15: #a b ##| ##3,5: #a b c ##| ##8: #a b c d ##]
562  ##[ ##4,6,8,9: napply I ##]
563  nwhd in ⊢ (???%);
564  ##[ ncases a; ##[ ncases (fn_return f); //; ##| #e; nwhd nodelta in ⊢ (???%);
565                    napply err_sig_does_not_interact; #x; napply err2_does_not_interact; // ##]
566  ##| ncases (find_label a (fn_body f) (call_cont kk)); ##[ napply I ##| #z; ncases z; #x y; napply I ##]
567  ##| napply err2_does_not_interact; #x1 x2; napply err2_does_not_interact; #x3 x4; napply opt_does_not_interact; #x5; napply I
568  ##| ##4,7: napply err2_does_not_interact; #x1 x2; napply err_does_not_interact; #x3; napply I
569  ##| napply err2_does_not_interact; #x1 x2; ncases x1; //;
570  ##| napply err2_does_not_interact; #x1 x2; napply err2_does_not_interact; #x3 x4; napply opt_does_not_interact; #x5;  napply err_does_not_interact; #x6; ncases a;
571      ##[ napply I; ##| #x7; napply err2_does_not_interact; #x8 x9; napply I ##]
572  ##| ncases (is_Sskip a); #H; ##[ napply err2_does_not_interact; #x1 x2; napply err_does_not_interact; #x3; napply I
573      ##| napply I ##]
574  ##| ncases kk; ##[ ##1,8: ncases (fn_return f); //; ##| ##2,3,5,6,7: //;
575      ##| #z1 z2 z3; napply err2_does_not_interact; #x1 x2; napply err_does_not_interact; #x3; ncases x3; napply I ##]
576  ##| ncases kk; //;
577  ##| ncases kk; ##[ ##4: #z1 z2 z3;  napply err2_does_not_interact; #x1 x2; napply err_does_not_interact; #x3; ncases x3; napply I
578      ##| ##*: // ##]
579  ##]
580##| #f args kk m; ncases f;
581  ##[ #f'; nwhd in ⊢ (???%); ncases (exec_alloc_variables empty_env m (fn_params f'@fn_vars f'));
582      #x; ncases x; ##[ *; ##| #z; ncases z; #x1 x2 H;
583                        napply err_sig_does_not_interact; //; ##]
584  (* This is the only case that actually matters! *)
585  ##| #fn argtys rty; nwhd in ⊢ (???%);
586      napply  err_sig_does_not_interact; #x1;
587      nwhd; #i; @; ##[ ##2: @; ##[ ##2: @; ##[ @; nwhd in ⊢ (??%?); napply refl;
588        ##| @; #E; nwhd in E:(??%%); ndestruct (E); ##] ##] ##]
589  ##]
590##| #v kk m; nwhd in ⊢ (???%); ncases kk;
591    ##[ ##8: #x1 x2 x3 x4; ncases x1;
592      ##[ nwhd in ⊢ (???%); ncases v; // ##| #x5; nwhd in ⊢ (???%); ncases x5;
593          #x6 x7; napply opt_does_not_interact; // ##]
594    ##| ##*: // ##]
595##] nqed.
596
597
598(* Some classical logic (roughly like a fragment of Coq's library) *)
599nlemma classical_doubleneg:
600  ∀classic:(∀P:Prop.P ∨ ¬P).
601  ∀P:Prop. ¬ (¬ P) → P.
602#classic P; *; #H;
603ncases (classic P);
604##[ // ##| #H'; napply False_ind; /2/; ##]
605nqed.
606
607nlemma classical_not_all_not_ex:
608  ∀classic:(∀P:Prop.P ∨ ¬P).
609  ∀A:Type.∀P:A → Prop. ¬ (∀x. ¬ P x) → ∃x. P x.
610#classic A P; *; #H;
611napply (classical_doubleneg classic); @; *; #H';
612napply H; #x; @; #H''; napply H'; @x; napply H'';
613nqed.
614
615nlemma classical_not_all_ex_not:
616  ∀classic:(∀P:Prop.P ∨ ¬P).
617  ∀A:Type.∀P:A → Prop. ¬ (∀x. P x) → ∃x. ¬ P x.
618#classic A P; *; #H;
619napply (classical_not_all_not_ex classic A (λx.¬ P x));
620@; #H'; napply H; #x; napply (classical_doubleneg classic);
621napply H';
622nqed.
623
624nlemma not_ex_all_not:
625  ∀A:Type.∀P:A → Prop. ¬ (∃x. P x) → ∀x. ¬ P x.
626#A P; *; #H x; @; #H';
627napply H; @ x; napply H';
628nqed.
629
630nlemma not_imply_elim:
631  ∀classic:(∀P:Prop.P ∨ ¬P).
632  ∀P,Q:Prop. ¬ (P → Q) → P.
633#classic P Q; *; #H;
634napply (classical_doubleneg classic); @; *; #H';
635napply H; #H''; napply False_ind; napply H'; napply H'';
636nqed.
637
638nlemma not_imply_elim2:
639  ∀P,Q:Prop. ¬ (P → Q) → ¬ Q.
640#P Q; *; #H; @; #H';
641napply H; #_; napply H';
642nqed.
643
644nlemma imply_to_and:
645  ∀classic:(∀P:Prop.P ∨ ¬P).
646  ∀P,Q:Prop. ¬ (P → Q) → P ∧ ¬Q.
647#classic P Q H; @;
648##[ napply (not_imply_elim classic P Q H);
649##| napply (not_imply_elim2 P Q H);
650##] nqed.
651
652nlemma not_and_to_imply:
653  ∀classic:(∀P:Prop.P ∨ ¬P).
654  ∀P,Q:Prop. ¬ (P ∧ Q) → P → ¬Q.
655#classic P Q; *; #H H';
656@; #H''; napply H; @; //;
657nqed.
658
659ninductive execution_not_over : execution → Prop ≝
660| eno_step: ∀tr,s,e. execution_not_over (e_step tr s e)
661| eno_interact: ∀o,k,tr,s,e,i.
662    k i = e_step tr s e →
663    execution_not_over (e_interact o k).
664
665nlemma eno_stop: ∀tr,r,m. execution_not_over (e_stop tr r m) → False.
666#tr0 r0 m0 H; ninversion H;
667##[ #tr s e E; ndestruct
668##| #o k tr s e i K E; ndestruct
669##] nqed.
670
671nlemma eno_wrong: execution_not_over e_wrong → False.
672#H; ninversion H;
673##[ #tr s e E; ndestruct
674##| #o k tr s e i K E; ndestruct
675##] nqed.
676
677nlet corec show_divergence s e
678 (NONTERMINATING:∀tr1,s1,e1. execution_isteps tr1 s e s1 e1 →
679                 execution_not_over e1)
680 (UNREACTIVE:∀tr2,s2,e2. execution_isteps tr2 s e s2 e2 → tr2 = E0)
681 (CONTINUES:∀tr2,s2,o,k. execution_isteps tr2 s e s2 (e_interact o k) → ∃i.∃tr3.∃s3.∃e3. k i = e_step tr3 s3 e3 ∧ tr3 ≠ E0)
682 : execution_diverging e ≝ ?.
683nlapply (NONTERMINATING E0 s e ?); //;
684ncases e in UNREACTIVE NONTERMINATING CONTINUES ⊢ %;
685##[ #tr i m; #_; #_; #_; #ENO; nelim (eno_stop … ENO);
686##| #tr s' e' UNREACTIVE; nlapply (UNREACTIVE tr s' e' ?);
687  ##[ nrewrite < (E0_right tr) in ⊢ (?%????);
688      napply isteps_one; napply isteps_none;
689  ##| #TR; napply (match sym_eq ??? TR with [ refl ⇒ ? ]); (* nrewrite > TR in UNREACTIVE ⊢ %;*)
690      #NONTERMINATING CONTINUES; #_; @;
691      napply (show_divergence s');
692      ##[ #tr1 s1 e1 S; napply (NONTERMINATING tr1 s1 e1);
693        nchange in ⊢ (?%????) with (Eapp E0 tr1); napply isteps_one;
694        napply S;
695      ##| #tr2 s2 e2 S; nrewrite > TR in UNREACTIVE; #UNREACTIVE; napply (UNREACTIVE tr2 s2 e2);
696          nchange in ⊢ (?%????) with (Eapp E0 tr2);
697          napply isteps_one; napply S;
698      ##| #tr2 s2 o k S; napply (CONTINUES tr2 s2 o k);
699          nchange in ⊢ (?%????) with (Eapp E0 tr2);
700          napply isteps_one; napply S;
701      ##]
702  ##]
703##| #_; #_; #_; #ENO; nelim (eno_wrong … ENO);
704##| #o k UNREACTIVE NONTERMINATING CONTINUES; #_;
705    nlapply (CONTINUES E0 s o k ?);
706    ##[ napply isteps_none;
707    ##| *; #i; *; #tr'; *; #s'; *; #e'; *; #EXEC NOTSILENT;
708        napply False_ind; napply (absurd ?? NOTSILENT);
709        napply (UNREACTIVE … s' e');
710        nrewrite < (E0_right tr') in ⊢ (?%????);
711        napply (isteps_interact … EXEC); //;
712    ##]
713##] nqed.
714
715nlemma exec_over_isteps: ∀ge,tr,s,s',e,e'.
716  execution_isteps tr s e s' e' →
717  e = (exec_inf_aux ge (exec_step ge s)) →
718  exec_inf_aux ge (exec_step ge s') = e'.
719#ge tr0 s0 s0' e0 e0';
720#ISTEPS; nelim ISTEPS;
721##[ #s e E; nrewrite > E; napply refl;
722##| #e1 e2 tr1 tr2 s1 s2 s3 ISTEPS' IH E;
723    napply IH; napply sym_eq; napply exec_e_step;
724    ##[ ##3: napply sym_eq; napply E ##]
725##| #e1 e2 o k i s1 s2 s3 tr1 tr2 ISTEPS' EXECK IH E;
726    napply IH;
727    ncases (exec_step ge s3) in E;
728    ##[ #o' k'; nrewrite > (exec_inf_aux_unfold …) in ⊢ (% → ?);
729        #E'; nwhd in E':(???%); ndestruct (E');
730        napply sym_eq; napply exec_e_step;
731        ##[ ##3: napply EXECK; ##]
732    ##| #z; ncases z; #tr' s';
733        nrewrite > (exec_inf_aux_unfold …) in ⊢ (% → ?);
734        nwhd in ⊢ (???% → ?); ncases (is_final_state s');
735        #F E'; nwhd in E':(???%); ndestruct (E');
736    ##| nrewrite > (exec_inf_aux_unfold …) in ⊢ (% → ?);
737        #E'; nwhd in E':(???%); ndestruct (E');
738    ##]
739##] nqed.
740
741nlemma exec_over_isteps': ∀ge,tr,s,s',e'.
742  execution_isteps tr s (exec_inf_aux ge (exec_step ge s)) s' e' →
743  exec_inf_aux ge (exec_step ge s') = e'.
744#ge tr s s' e'; nletin e ≝ (exec_inf_aux ge (exec_step ge s)); #H;
745napply (exec_over_isteps … H (refl ??));
746nqed.
747
748nlemma interaction_is_not_silent: ∀ge,o,k,i,tr,s,s',e.
749  exec_inf_aux ge (exec_step ge s) = e_interact o k →
750  k i = e_step tr s' e →
751  tr ≠ E0.
752#ge o k i tr s s' e; nrewrite > (exec_inf_aux_unfold …);
753nlapply (exec_step_interaction ge s);
754ncases (exec_step ge s);
755##[ #o' k' ; nwhd in ⊢ (% → ??%? → ?); #H E K; ndestruct (E);
756    nlapply (H i); *; #tr'; *; #s''; *; #K' TR;
757    nrewrite > K' in K; nrewrite > (exec_inf_aux_unfold …);
758    nwhd in ⊢ (??%? → ?);
759    ncases (is_final_state s'');
760    ##[ #F; nwhd in ⊢ (??%? → ?); #E; ndestruct (E);
761    ##| #F; nwhd in ⊢ (??%? → ?); #E; ndestruct (E);
762        napply TR
763    ##]
764##| #x; ncases x; #tr' s'' H; nwhd in ⊢ (??%? → ?);
765    ncases (is_final_state s''); #F E; nwhd in E:(??%?); ndestruct (E);
766##| #_; #E; nwhd in E:(??%?); ndestruct (E);
767##] nqed.
768
769nlet corec reactive_traceinf' ge s
770  (REACTIVE: ∀tr,s1,e1.
771    execution_isteps tr s (exec_inf_aux ge (exec_step ge s)) s1 e1 →
772    Σx.execution_isteps (\fst x) s1 e1 (\fst (\snd x)) (\snd (\snd x)) ∧ (\fst x) ≠ E0)
773  : traceinf' ≝ ?.
774nlapply (REACTIVE E0 s (exec_inf_aux ge (exec_step ge s)) ?);
775##[ napply isteps_none
776##| *; #x; ncases x; #tr; #y; ncases y; #s' e; *; #STEPS H;
777    @ tr ? H;
778    napply (reactive_traceinf' ge s');
779    #tr1 s1 e1 STEPS1;
780    napply REACTIVE;
781    ##[ ##2: nrewrite > (exec_over_isteps' … STEPS) in STEPS1; #STEPS1;
782        napply (isteps_trans … STEPS STEPS1);
783    ##| ##skip
784    ##]
785##]
786nqed.
787
788nlet corec show_reactive ge s
789  (REACTIVE: ∀tr,s1,e1.
790    execution_isteps tr s (exec_inf_aux ge (exec_step ge s)) s1 e1 →
791    Σx.execution_isteps (\fst x) s1 e1 (\fst (\snd x)) (\snd (\snd x)) ∧ (\fst x) ≠ E0)
792  : execution_reacting (traceinf_of_traceinf' (reactive_traceinf' ge s REACTIVE)) s (exec_inf_aux ge (exec_step ge s)) ≝ ?.
793napply daemon; (*
794nrewrite > (unroll_traceinf' (reactive_traceinf' …));
795(* FIXME: want to unfold and do case analysis on REACTIVE …, but can't until bug is fixed. *)
796ncases (reactive_traceinf' ge s REACTIVE);
797#tr tr' NE; nwhd in ⊢ (?(?%)??); nrewrite > (traceinf_traceinfp_app …);
798napply (reacting … NE);
799*)
800nqed.
801
802nlemma execution_characterisation_complete:
803  ∀classic:(∀P:Prop.P ∨ ¬P).
804  ∀constructive_indefinite_description:(∀A:Type. ∀P:A→Prop. (∃x. P x) → Σx : A. P x).
805   ∀ge,s. ¬ (∃r. final_state s r) →
806   execution_characterisation s (exec_inf_aux ge (Value ??? 〈E0,s〉)).
807#classic constructive_indefinite_description ge s; *; #NOTFINAL;
808nrewrite > (exec_inf_aux_unfold ge ?); nwhd in ⊢ (??%);
809ncases (is_final_state s); ##[ #x; ncases x; #r FINAL; napply False_rect_Type0; napply NOTFINAL; @r; napply FINAL ##]
810#NOTFINAL'; nwhd in ⊢ (??%);
811ncases (classic (∀tr1,s1,e1. execution_isteps tr1 s (exec_inf_aux ge (exec_step ge s)) s1 e1 →
812                 execution_not_over e1));
813##[ #NONTERMINATING;
814    ncases (classic (∃tr,s1,e1. execution_isteps tr s (exec_inf_aux ge (exec_step ge s)) s1 e1 ∧
815                     ∀tr2,s2,e2. execution_isteps tr2 s1 e1 s2 e2 → tr2 = E0));
816  ##[ *; #tr; *; #s1; *; #e1; *; #INITIAL UNREACTIVE;
817      napply (ec_diverges … s ? tr);
818      napply (diverges_diverging … INITIAL);
819      napply (show_divergence s1);
820      ##[ #tr2 s2 e2 S; napply (NONTERMINATING (Eapp tr tr2) s2 e2);
821          napply (isteps_trans … INITIAL S);
822      ##| #tr2 s2 e2 S; napply (UNREACTIVE … S);
823      ##| #tr2 s2 o; ncases o; #o_id o_args o_typ; ncases o_typ; #k S;
824          nlapply (exec_over_isteps … INITIAL (refl ??)); #EXEC1;
825          nlapply (exec_over_isteps … S (sym_eq … EXEC1));
826          nlapply (NONTERMINATING (Eapp tr tr2) s2 (e_interact (mk_io_out o_id o_args ?) k) ?);
827          ##[ ##1,3: napply (isteps_trans … INITIAL S); ##]
828          #NOTOVER; ninversion NOTOVER;
829          ##[ ##1,3: #tr' s' e' E; ndestruct (E);
830          ##| ##*: #o' k' tr' s' e' i' KR E; ndestruct (E);
831              #EXEC;
832              @ i'; @ tr'; @s'; @e'; @;//; napply (interaction_is_not_silent … EXEC KR);
833          ##]
834      ##]
835
836  ##| *; #NOTUNREACTIVE;
837      ncut (∀tr,s1,e1.execution_isteps tr s (exec_inf_aux ge (exec_step ge s)) s1 e1 →
838            ∃x.execution_isteps (\fst x) s1 e1 (\fst (\snd x)) (\snd (\snd x)) ∧ (\fst x) ≠ E0);
839      ##[ #tr s1 e1 STEPS;
840          napply (classical_doubleneg classic); @; #NOREACTION;
841          napply NOTUNREACTIVE;
842          @ tr; @s1; @e1; @; //;
843          #tr2 s2 e2 STEPS2;
844          nlapply (not_ex_all_not … NOREACTION); #NR1;
845          nlapply (not_and_to_imply classic … (NR1 〈tr2,〈s2,e2〉〉)); #NR2;
846          napply (classical_doubleneg classic);
847          napply NR2; //;
848      ##| #REACTIVE;
849          napply ec_reacts;
850          ##[ ##2: napply reacts;
851                   napply (show_reactive ge s …);
852                   #tr s1 e1 STEPS;
853                   napply constructive_indefinite_description;
854                   napply (REACTIVE … tr s1 e1 STEPS);
855          ##| ##skip
856          ##]
857      ##]
858  ##]
859 
860##| #NOTNONTERMINATING; nlapply (classical_not_all_ex_not classic … NOTNONTERMINATING);
861    *; #tr NNT2; nlapply (classical_not_all_ex_not classic … NNT2);
862    *; #s' NNT3; nlapply (classical_not_all_ex_not classic … NNT3);
863    *; #e NNT4; nelim (imply_to_and classic … NNT4);
864    ncases e;
865    ##[ #tr' r m; #STEPS NOSTEP;
866        napply (ec_terminates s r m ? (Eapp tr tr')); @;
867        ##[ napply s'
868        ##| napply STEPS
869        ##]
870    ##| #tr' s'' e' STEPS; *; #NOSTEP; napply False_rect_Type0;
871        napply NOSTEP; //
872    ##| #STEPS NOSTEP;
873        napply (ec_wrong ? s s' tr); @; //;
874    (* The following is stupidly complicated when most of the cases are impossible.
875       It ought to be simplified. *)
876    ##| #o; ncases o; #o_id o_args o_rty; ncases o_rty; #k STEPS NOSTEP;
877        ##[ nletin i ≝ (repr 0) ##| nletin i ≝ Fzero ##]
878        nlapply (refl ? (k i));
879        ncases (k i) in ⊢ (???% → ?);
880        ##[ ##1,5: #tr' r m K;
881                   napply (ec_terminates s ???);
882                   ##[ ##4,8: napply (annoying_corner_case_terminates … STEPS K);
883                   ##| ##*: ##skip
884                   ##]
885        ##| ##2,6: #tr' s'' e' K; napply False_rect_Type0;
886            napply (absurd ?? NOSTEP);
887            napply (eno_interact … K);
888        ##| ##3,7: #K;
889            nlapply (exec_step_interaction ge s');
890            nlapply (exec_over_isteps … STEPS (refl ??));
891            nrewrite > (exec_inf_aux_unfold …); ncases (exec_step ge s');
892            ##[ ##1,4: #o k E H; nwhd in E:(??%?) H;
893                ndestruct (E);
894                nlapply (H i); *; #tr'; *; #s'; *; #K'; nrewrite > K' in K;
895                nrewrite > (exec_inf_aux_unfold …); nwhd in ⊢ (??%? → ?);
896                ncases (is_final_state s'); #F E; nwhd in E:(??%?);
897                ndestruct (E);
898            ##| ##2,5: #z; ncases z; #tr s; nwhd in ⊢ (??%? → ?);
899                ncases (is_final_state s); #F E; nwhd in E:(??%?);
900                ndestruct (E);
901            ##| ##3,6: #E; nwhd in E:(??%?); ndestruct (E);
902            ##]
903        ##| ##4,8: #o0 k0 K;
904            nlapply (exec_step_interaction ge s');
905            nlapply (exec_over_isteps … STEPS (refl ??));
906            nrewrite > (exec_inf_aux_unfold …); ncases (exec_step ge s');
907            ##[ ##1,4: #o k E H; nwhd in E:(??%?) H;
908                ndestruct (E);
909                nlapply (H i); *; #tr'; *; #s'; *; #K'; nrewrite > K' in K;
910                nrewrite > (exec_inf_aux_unfold …); nwhd in ⊢ (??%? → ?);
911                ncases (is_final_state s'); #F E; nwhd in E:(??%?);
912                ndestruct (E);
913            ##| ##2,5: #z; ncases z; #tr s; nwhd in ⊢ (??%? → ?);
914                ncases (is_final_state s); #F E; nwhd in E:(??%?);
915                ndestruct (E);
916            ##| ##3,6: #E; nwhd in E:(??%?); ndestruct (E);
917            ##]
918        ##]
919    ##]
920##]
921nqed.   
922
923nlemma behavior_of_execution: ∀s,e.
924  execution_characterisation s e →
925  ∃b:program_behavior. execution_matches_behavior s e b.
926#s0 e0 exec;
927ncases exec;
928##[ #s r m e tr TERM;
929    @ (Terminates tr r);
930    napply (emb_terminates … TERM);
931##| #s e tr DIV;
932    @ (Diverges tr);
933    napply (emb_diverges … DIV);
934##| #s e tr REACTS;
935    @ (Reacts tr);
936    napply (emb_reacts … REACTS);
937##| #e s s' tr WRONG;
938    @ (Goes_wrong tr);
939    napply (emb_wrong … WRONG);
940##] nqed.
941
942nlemma initial_state_not_final: ∀ge,s.
943  initial_state ge s →
944  ¬ ∃r.final_state s r.
945#ge s H; ncases H;
946#b f E1 E2; @; *; #r H2;
947ninversion H2;
948#r' m E3 E4; ndestruct (E3);
949nqed.
950
951nlemma initial_step: ∀ge,s,e.
952  exec_inf_aux ge (Value ??? 〈E0,s〉) = e →
953  ¬(∃r.final_state s r) →
954  ∃e'.e = e_step E0 s e'.
955#ge s e; nrewrite > (exec_inf_aux_unfold …);
956nwhd in ⊢ (??%? → ?); ncases (is_final_state s);
957##[ #FINAL EXEC NOTFINAL;
958    napply False_ind; napply (absurd ?? NOTFINAL);
959    ncases FINAL;
960    #r F; @r; napply F;
961##| #F1 EXEC F2; nwhd in EXEC:(??%?); @; ##[ ##2: nrewrite < EXEC; napply refl ##]
962nqed.
963
964ntheorem exec_inf_sound:
965  ∀classic:(∀P:Prop.P ∨ ¬P).
966  ∀constructive_indefinite_description:(∀A:Type. ∀P:A→Prop. (∃x. P x) → Σx : A. P x).
967  ∀p. ∃s,b.execution_matches_behavior s (exec_inf p) b ∧ exec_program p b.
968#classic constructive_indefinite_description p;
969nwhd in ⊢ (??(λ_.??(λ_.?(??%?)%))); nletin ge ≝ (globalenv Genv fundef type p);
970nlapply (make_initial_state_sound p);
971ncases (make_initial_state p);
972##[ #s INITIAL; @s; nwhd in INITIAL ⊢ (??(λ_.?(??(??%)?)?));
973    nlapply (behavior_of_execution ??
974              (execution_characterisation_complete classic constructive_indefinite_description ge s ?));
975    ##[ napply (initial_state_not_final … INITIAL);
976    ##| *; #b MATCHES; @b; @; //;
977        ninversion MATCHES;
978        ##[ #s0 e tr r m TERM E1 EXEC BEHAVES;
979            nrewrite < E1 in TERM; #TERM;
980            nlapply (initial_step … EXEC ?);
981            ##[ napply initial_state_not_final; //; ##]
982            *; #e' E2; nrewrite > E2 in EXEC TERM; #EXEC TERM;
983            napply (program_terminates (mk_transrel … step) ?? ge s);
984            ##[ ##2: napply INITIAL
985            ##| ##3: napply (terminates_sound … TERM EXEC);
986            ##| ##skip
987            ##| //;
988            ##]
989        ##| #s0 e tr DIVERGES E1 EXEC E2;
990            nlapply (initial_step … EXEC ?);
991            ##[ napply initial_state_not_final; //; ##]
992            *; #e' E3; nrewrite < E1 in DIVERGES; nrewrite > E3 in EXEC ⊢ %;
993            #EXEC DIVERGES;
994            ninversion DIVERGES; #tr' s1 s2 e1 e2 INITSTEPS DIVERGING E4 E5 E6;
995            nrewrite < E4 in INITSTEPS ⊢ %; nrewrite < E5 in E6 ⊢ %; #E6 INITSTEPS;
996            ncut (e' = e1); ##[ ndestruct (E6) skip (MATCHES EXEC); // ##]
997            #E7; nrewrite < E7 in INITSTEPS; #INITSTEPS;
998            ncases (several_steps … INITSTEPS EXEC); #INITSTAR EXECDIV;
999            napply (program_diverges (mk_transrel … step) ?? ge s … INITIAL INITSTAR);
1000            napply (silent_sound … DIVERGING EXECDIV);
1001        ##| #s0 e tr REACTS E1 EXEC E2;
1002            nlapply (initial_step … EXEC ?);
1003            ##[ napply initial_state_not_final; //; ##]
1004            *; #e' E3; nrewrite < E1 in REACTS; nrewrite > E3 in EXEC ⊢ %;
1005            #EXEC REACTS;
1006            ninversion REACTS; #tr' s' e'' REACTING E4 E5;
1007            nrewrite < E4 in REACTING ⊢ %; nrewrite < E5; #REACTING E6;
1008            ncut (e' = e''); ##[ ndestruct (E6) skip (MATCHES EXEC); // ##]
1009            #E7; nrewrite < E7 in REACTING; #REACTING;
1010            napply (program_reacts (mk_transrel … step) ?? ge s … INITIAL);
1011            napply (reacts_sound … REACTING EXEC);
1012        ##| #e s1 s2 tr WRONG E1 EXEC E2;
1013            nlapply (initial_step … EXEC ?);
1014            ##[ napply initial_state_not_final; //; ##]
1015            *; #e' E3; nrewrite < E1 in WRONG; nrewrite > E3 in EXEC ⊢ %;
1016            #EXEC WRONG;
1017            ninversion WRONG; #tr' s1' s2' e'' GOESWRONG E4 E5 E6 E7;
1018            nrewrite < E4 in GOESWRONG ⊢ %; nrewrite < E5; nrewrite < E7; #GOESWRONG;
1019            ncut (e' = e''); ##[ ndestruct (E6) skip (MATCHES EXEC); // ##]
1020            #E8; nrewrite < E8 in GOESWRONG; #GOESWRONG;
1021            nelim (wrong_sound … WRONG EXEC); *; #STAR STOP FINAL;
1022            napply (program_goes_wrong (mk_transrel … step) ?? ge s … INITIAL STAR STOP);
1023            #r; @; #F; napply (absurd ?? FINAL); @r; napply F;
1024        ##]
1025   ##]
1026##| #_;
1027
1028ndefinition behaviour_of_execution: ∀e.
1029 execution_characterisation e → program_behavior ≝
1030λe,exec.match exec with
1031[ ec_terminates s r m e tr H ⇒ Terminates tr r
1032| ec_diverges _ e tr H ⇒ Diverges tr
1033| ec_reacts s e tr H ⇒ Reacts tr
1034| ec_wrong e s s' tr H ⇒ Goes_wrong tr
1035].
1036
Note: See TracBrowser for help on using the repository browser.