(* Title: HOL/UNITY/Network ID: $Id: Network.thy,v 1.4 2005/06/17 14:13:10 haftmann Exp $ Author: Lawrence C Paulson, Cambridge University Computer Laboratory Copyright 1998 University of Cambridge The Communication Network From Misra, "A Logic for Concurrent Programming" (1994), section 5.7 *) theory Network imports UNITY begin (*The state assigns a number to each process variable*) datatype pvar = Sent | Rcvd | Idle datatype pname = Aproc | Bproc types state = "pname * pvar => nat" locale F_props = fixes F assumes rsA: "F ∈ stable {s. s(Bproc,Rcvd) ≤ s(Aproc,Sent)}" and rsB: "F ∈ stable {s. s(Aproc,Rcvd) ≤ s(Bproc,Sent)}" and sent_nondec: "F ∈ stable {s. m ≤ s(proc,Sent)}" and rcvd_nondec: "F ∈ stable {s. n ≤ s(proc,Rcvd)}" and rcvd_idle: "F ∈ {s. s(proc,Idle) = Suc 0 & s(proc,Rcvd) = m} co {s. s(proc,Rcvd) = m --> s(proc,Idle) = Suc 0}" and sent_idle: "F ∈ {s. s(proc,Idle) = Suc 0 & s(proc,Sent) = n} co {s. s(proc,Sent) = n}" lemmas (in F_props) sent_nondec_A = sent_nondec [of _ Aproc] and sent_nondec_B = sent_nondec [of _ Bproc] and rcvd_nondec_A = rcvd_nondec [of _ Aproc] and rcvd_nondec_B = rcvd_nondec [of _ Bproc] and rcvd_idle_A = rcvd_idle [of Aproc] and rcvd_idle_B = rcvd_idle [of Bproc] and sent_idle_A = sent_idle [of Aproc] and sent_idle_B = sent_idle [of Bproc] and rs_AB = stable_Int [OF rsA rsB] and sent_nondec_AB = stable_Int [OF sent_nondec_A sent_nondec_B] and rcvd_nondec_AB = stable_Int [OF rcvd_nondec_A rcvd_nondec_B] and rcvd_idle_AB = constrains_Int [OF rcvd_idle_A rcvd_idle_B] and sent_idle_AB = constrains_Int [OF sent_idle_A sent_idle_B] and nondec_AB = stable_Int [OF sent_nondec_AB rcvd_nondec_AB] and idle_AB = constrains_Int [OF rcvd_idle_AB sent_idle_AB] and nondec_idle = constrains_Int [OF nondec_AB [unfolded stable_def] idle_AB] lemma (in F_props) shows "F ∈ stable {s. s(Aproc,Idle) = Suc 0 & s(Bproc,Idle) = Suc 0 & s(Aproc,Sent) = s(Bproc,Rcvd) & s(Bproc,Sent) = s(Aproc,Rcvd) & s(Aproc,Rcvd) = m & s(Bproc,Rcvd) = n}" apply (unfold stable_def) apply (rule constrainsI) apply (drule constrains_Int [OF rs_AB [unfolded stable_def] nondec_idle, THEN constrainsD], assumption) apply simp_all apply (blast del: le0, clarify) apply (subgoal_tac "s' (Aproc, Rcvd) = s (Aproc, Rcvd)") apply (subgoal_tac "s' (Bproc, Rcvd) = s (Bproc, Rcvd)") apply simp apply (blast intro: order_antisym le_trans eq_imp_le)+ done end
lemma sent_nondec_A:
F ∈ stable {s. m ≤ s (Aproc, Sent)}
and sent_nondec_B:
F ∈ stable {s. m ≤ s (Bproc, Sent)}
and rcvd_nondec_A:
F ∈ stable {s. n ≤ s (Aproc, Rcvd)}
and rcvd_nondec_B:
F ∈ stable {s. n ≤ s (Bproc, Rcvd)}
and rcvd_idle_A:
F ∈ {s. s (Aproc, Idle) = Suc 0 ∧ s (Aproc, Rcvd) = m} co
{s. s (Aproc, Rcvd) = m --> s (Aproc, Idle) = Suc 0}
and rcvd_idle_B:
F ∈ {s. s (Bproc, Idle) = Suc 0 ∧ s (Bproc, Rcvd) = m} co
{s. s (Bproc, Rcvd) = m --> s (Bproc, Idle) = Suc 0}
and sent_idle_A:
F ∈ {s. s (Aproc, Idle) = Suc 0 ∧ s (Aproc, Sent) = n} co
{s. s (Aproc, Sent) = n}
and sent_idle_B:
F ∈ {s. s (Bproc, Idle) = Suc 0 ∧ s (Bproc, Sent) = n} co
{s. s (Bproc, Sent) = n}
and rs_AB:
F ∈ stable
({s. s (Bproc, Rcvd) ≤ s (Aproc, Sent)} ∩
{s. s (Aproc, Rcvd) ≤ s (Bproc, Sent)})
and sent_nondec_AB:
F ∈ stable ({s. m2 ≤ s (Aproc, Sent)} ∩ {s. m1 ≤ s (Bproc, Sent)})
and rcvd_nondec_AB:
F ∈ stable ({s. n2 ≤ s (Aproc, Rcvd)} ∩ {s. n1 ≤ s (Bproc, Rcvd)})
and rcvd_idle_AB:
F ∈ {s. s (Aproc, Idle) = Suc 0 ∧ s (Aproc, Rcvd) = m2} ∩
{s. s (Bproc, Idle) = Suc 0 ∧ s (Bproc, Rcvd) = m1} co
{s. s (Aproc, Rcvd) = m2 --> s (Aproc, Idle) = Suc 0} ∩
{s. s (Bproc, Rcvd) = m1 --> s (Bproc, Idle) = Suc 0}
and sent_idle_AB:
F ∈ {s. s (Aproc, Idle) = Suc 0 ∧ s (Aproc, Sent) = n2} ∩
{s. s (Bproc, Idle) = Suc 0 ∧ s (Bproc, Sent) = n1} co
{s. s (Aproc, Sent) = n2} ∩ {s. s (Bproc, Sent) = n1}
and nondec_AB:
F ∈ stable
({s. m6 ≤ s (Aproc, Sent)} ∩ {s. m5 ≤ s (Bproc, Sent)} ∩
({s. n3 ≤ s (Aproc, Rcvd)} ∩ {s. n2 ≤ s (Bproc, Rcvd)}))
and idle_AB:
F ∈ {s. s (Aproc, Idle) = Suc 0 ∧ s (Aproc, Rcvd) = m6} ∩
{s. s (Bproc, Idle) = Suc 0 ∧ s (Bproc, Rcvd) = m5} ∩
({s. s (Aproc, Idle) = Suc 0 ∧ s (Aproc, Sent) = n3} ∩
{s. s (Bproc, Idle) = Suc 0 ∧ s (Bproc, Sent) = n2}) co
{s. s (Aproc, Rcvd) = m6 --> s (Aproc, Idle) = Suc 0} ∩
{s. s (Bproc, Rcvd) = m5 --> s (Bproc, Idle) = Suc 0} ∩
({s. s (Aproc, Sent) = n3} ∩ {s. s (Bproc, Sent) = n2})
and nondec_idle:
F ∈ {s. m14 ≤ s (Aproc, Sent)} ∩ {s. m13 ≤ s (Bproc, Sent)} ∩
({s. n11 ≤ s (Aproc, Rcvd)} ∩ {s. n10 ≤ s (Bproc, Rcvd)}) ∩
({s. s (Aproc, Idle) = Suc 0 ∧ s (Aproc, Rcvd) = m7} ∩
{s. s (Bproc, Idle) = Suc 0 ∧ s (Bproc, Rcvd) = m6} ∩
({s. s (Aproc, Idle) = Suc 0 ∧ s (Aproc, Sent) = n4} ∩
{s. s (Bproc, Idle) = Suc 0 ∧ s (Bproc, Sent) = n3})) co
{s. m14 ≤ s (Aproc, Sent)} ∩ {s. m13 ≤ s (Bproc, Sent)} ∩
({s. n11 ≤ s (Aproc, Rcvd)} ∩ {s. n10 ≤ s (Bproc, Rcvd)}) ∩
({s. s (Aproc, Rcvd) = m7 --> s (Aproc, Idle) = Suc 0} ∩
{s. s (Bproc, Rcvd) = m6 --> s (Bproc, Idle) = Suc 0} ∩
({s. s (Aproc, Sent) = n4} ∩ {s. s (Bproc, Sent) = n3}))
lemma
F ∈ stable
{s. s (Aproc, Idle) = Suc 0 ∧
s (Bproc, Idle) = Suc 0 ∧
s (Aproc, Sent) = s (Bproc, Rcvd) ∧
s (Bproc, Sent) = s (Aproc, Rcvd) ∧
s (Aproc, Rcvd) = m ∧ s (Bproc, Rcvd) = n}