theory Atomicity_Lib

lemma shuttle_gets_interference[simplified K_bind_def]:
  "equivp sr \<Longrightarrow> \<forall>s t. P s \<longrightarrow> R s t \<longrightarrow> f s = f t
    \<Longrightarrow> (\<forall>s s' t. sr s s' \<longrightarrow> R s t = R s' t)
    \<Longrightarrow> \<forall>s t. P s \<longrightarrow> R\<^sup>*\<^sup>* s t \<longrightarrow> P t
    \<Longrightarrow> rel_tr_refinement sr P R C
        (do x \<leftarrow> interference; gets f od) (do x \<leftarrow> gets f; interference; return x od)" apply (simp add: interference_def bind_assoc env_steps_repeat) apply (rule rel_tr_refinement_trans) apply (metis equivpE) apply (rule rel_tr_refinement_bind_right_general[where C'=True and Q=P]) apply (metis equivpE) apply (rule allI) apply (rule rel_tr_refinement_comm_repeat, assumption) apply (rule shuttle_gets_env_step) apply (metis equivpE) apply simp apply simp apply wpsimp apply (clarsimp simp: r_into_rtranclp) apply (simp add: commit_step_def, wp put_trace_elem_twp) apply (simp add: drop_Cons' guar_cond_def) apply (rule shuttle_gets_commit_step[THEN
    rel_tr_refinement_bind_left_general[rotated -1], simplified bind_assoc return_bind]) apply (metis equivpE) apply (metis equivpE) apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>equivp sr; \<forall>s t. P s \<longrightarrow> R s t \<longrightarrow> f s = f t; \<forall>s s' t. sr s s' \<longrightarrow> R s t = R s' t; \<forall>s t. P s \<longrightarrow> R\<^sup>*\<^sup>* s t \<longrightarrow> P t\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- interference;
gets f
od) (do x <- gets f;
interference;
return x
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- commit_step;
x <- repeat env_step;
gets f
od) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> transp sr
 2. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- commit_step;
x <- repeat env_step;
gets f
od) ?g3
 3. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C ?g3 (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- commit_step;
x <- repeat env_step;
gets f
od) ?g3
 2. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C ?g3 (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> reflp sr
 2. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<forall>x. rel_tr_refinement sr P R True (do x <- repeat env_step;
gets f
od) (?h11 x)
 3. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (C \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> commit_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 4. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (commit_step >>= ?h11) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<forall>x. rel_tr_refinement sr P R True (do x <- repeat env_step;
gets f
od) (?h11 x)
 2. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (C \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> commit_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 3. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (commit_step >>= ?h11) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R True (do x <- repeat env_step;
gets f
od) (?h11 x)
 2. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (C \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> commit_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 3. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (commit_step >>= ?h11) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R True (do x <- env_step;
gets f
od) (do x <- gets f;
xa <- env_step;
return x
od)
 2. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> not_env_steps_first env_step \<or> (\<forall>s s' t. sr s s' \<longrightarrow> R s t = R s' t)
 3. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> env_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 4. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (C \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> commit_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 5. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- commit_step;
x <- gets f;
y <- repeat env_step;
return x
od) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> reflp sr
 2. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<forall>s t. P s \<longrightarrow> R s t \<longrightarrow> f s = f t
 3. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> not_env_steps_first env_step \<or> (\<forall>s s' t. sr s s' \<longrightarrow> R s t = R s' t)
 4. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> env_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 5. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (C \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> commit_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 6. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- commit_step;
x <- gets f;
y <- repeat env_step;
return x
od) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<forall>s t. P s \<longrightarrow> R s t \<longrightarrow> f s = f t
 2. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> not_env_steps_first env_step \<or> (\<forall>s s' t. sr s s' \<longrightarrow> R s t = R s' t)
 3. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> env_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 4. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (C \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> commit_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 5. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- commit_step;
x <- gets f;
y <- repeat env_step;
return x
od) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> not_env_steps_first env_step \<or> (\<forall>s s' t. sr s s' \<longrightarrow> R s t = R s' t)
 2. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> env_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 3. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (C \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> commit_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 4. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- commit_step;
x <- gets f;
y <- repeat env_step;
return x
od) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> env_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 2. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (C \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> commit_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 3. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- commit_step;
x <- gets f;
y <- repeat env_step;
return x
od) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (3 subgoals):
 1. \<And>s0 s'. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t); P s0; R s0 s'\<rbrakk> \<Longrightarrow> P s'
 2. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (C \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> commit_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 3. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- commit_step;
x <- gets f;
y <- repeat env_step;
return x
od) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s0 s. (C \<longrightarrow> s0 = s) \<and> P s\<rbrace>, \<lbrace>R\<rbrace> commit_step -, \<lbrace>\<lambda>_ s0 s. (True \<longrightarrow> s0 = s) \<and> P s\<rbrace>
 2. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- commit_step;
x <- gets f;
y <- repeat env_step;
return x
od) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (2 subgoals):
 1. \<And>s0 s. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t); (C \<longrightarrow> s0 = s) \<and> P s\<rbrakk> \<Longrightarrow> (\<forall>n. rely_cond R s0 (drop n [(Me, s)]) \<longrightarrow> guar_cond (\<lambda>_ _. True) s0 (drop n [(Me, s)])) \<and> (rely_cond R s0 [(Me, s)] \<longrightarrow> snd (Me, s) = s \<and> P s)
 2. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- commit_step;
x <- gets f;
y <- repeat env_step;
return x
od) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> rel_tr_refinement sr P R C (do x <- commit_step;
x <- gets f;
y <- repeat env_step;
return x
od) (do x <- gets f;
xa <- commit_step;
y <- repeat env_step;
return x
od) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> reflp sr
 2. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> reflp sr
 3. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> (\<forall>x. not_env_steps_first (do y <- repeat env_step;
return x
od)) \<or> (\<forall>s s' t. sr s s' \<longrightarrow> R s t = R s' t) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> reflp sr
 2. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> (\<forall>x. not_env_steps_first (do y <- repeat env_step;
return x
od)) \<or> (\<forall>s s' t. sr s s' \<longrightarrow> R s t = R s' t) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>equivp sr; \<forall>s. P s \<longrightarrow> (\<forall>t. R s t \<longrightarrow> f s = f t); \<forall>s s'. sr s s' \<longrightarrow> (\<forall>t. R s t = R s' t); \<forall>s. P s \<longrightarrow> (\<forall>t. R\<^sup>*\<^sup>* s t \<longrightarrow> P t)\<rbrakk> \<Longrightarrow> (\<forall>x. not_env_steps_first (do y <- repeat env_step;
return x
od)) \<or> (\<forall>s s' t. sr s s' \<longrightarrow> R s t = R s' t) proof (prove)
goal:
No subgoals!