Module HLD:=HD.Definition sem_wp := wp.(** * Syntactic definition of the weakest precondition.

 In the following, we show that this definition is logically
 equivalent to [wp].
 *)
Fixpoint synt_wp (prog: ImpProg) : Pred -> Pred 
 := fun post e =>
  match prog with
  | Iskip => post e
  | (Iset A x expr) => post (E.upd x (E.eval expr e) e)
  | (Iif cond p1 p2) =>
          ((E.eval cond e)=true -> (synt_wp p1 post e))
       /\ ((E.eval cond e)=false -> (synt_wp p2 post e))
  | (Iseq p1 p2) => synt_wp p1 (synt_wp p2 post) e
  | (Iwhile cond p) =>  
        exists inv:Pred,
        exists R:E.Env -> E.Env -> Prop,
             (well_founded R)
          /\ (inv e)
          /\ (forall e', (inv e') 
                  -> (E.eval cond e')=false -> post e')
          /\ (forall e', (inv e') 
                  -> (E.eval cond e')=true -> synt_wp p inv e')
          /\ (forall e0, (inv e0)
                  -> (E.eval cond e0)=true -> synt_wp p (fun e1 => R e1 e0) e0)
  end.

(* Specifications: *)
Lemma synt_wp_monotonic: forall (p: ImpProg) (post1 post2: Pred), (forall e, post1 e -> post2 e) -> forall e, (synt_wp p post1 e) -> (synt_wp p post2 e).