Module HLD:=HD.
Definition sem_wp := wp.
Export Wf.
(** * Syntactic definition of the weakest precondition.  In the following, we show that this definition is logically equivalent to [wp]. *)
Fixpoint synt_wp (prog: ImpProg) : Pred -> Pred
:= fun post e =>
match prog with
| Iskip => post e
| (Iset A x expr) => post (E.upd x (E.eval expr e) e)
| (Iif cond p1 p2) =>
((E.eval cond e)=true -> (synt_wp p1 post e))
/\ ((E.eval cond e)=false -> (synt_wp p2 post e))
| (Iseq p1 p2) => synt_wp p1 (synt_wp p2 post) e
| (Iwhile cond p) =>
exists inv:Pred,
exists R:E.Env -> E.Env -> Prop,
(well_founded R)
/\ (inv e)
/\ (forall e', (inv e')
-> (E.eval cond e')=false -> post e')
/\ (forall e', (inv e')
-> (E.eval cond e')=true -> synt_wp p inv e')
/\ (forall e0, (inv e0)
-> (E.eval cond e0)=true -> synt_wp p (fun e1 => R e1 e0) e0)
end.
(** * Soundness *)
Hint Resolve synt_wp_monotonic: hoare.
(** Below, a little tactic to decompose a pair in hypothesis [H] by giving the name [n] to the first component. *)
Ltac dec2 n H := case H; clear H; intros n H.
(** * Auxiliary lemmas for completeness  The proof of completeness requires to exhibit a variant. The purpose of the following lemmas is to build this variant. *)
(** ** A technical issue: the inversion of [exec]  If your are not interested in Coq details, you may skip this part which only explains how to avoid the assumption of a (consistent and standard) axiom to prove the completeness.  Because the use of dependent types in constructor [exec_Iset], the standard inversion of Coq may fail on [exec] (see [exec_test_inversion] below).  This comes from the fact the following property is not provable in the core theory of Coq (although it is consistent with it) :  [forall A (x1 x2:E.Var A) e1 e2, (Iset x1 e1)=(Iset x2 e2) -> x1=x2 /\ e1=e2.]  To deal with this problem, we may assume a (consistent) axiom given in #<a href=http://coq.inria.fr/V8.1/stdlib/Coq.Logic.EqdepFacts.html># [EqdepFacts]#</a>#. But here, we can avoid this axiom.  Indeed, I define an ad-hoc inversion lemma for [exec] called [exec_inversion] below. This lemma is directly derived from the notion of weakest liberal precondition: [aux_wlp] is an other alternative definition of [wlp].  *)
Definition aux_wlp (prog: ImpProg) : Pred -> Pred
:= fun post e =>
match prog with
| Iskip => post e
| (Iset A x expr) => post (E.upd x (E.eval expr e) e)
| (Iif cond p1 p2) =>
forall e', exec e (if E.eval cond e then p1 else p2) e'
-> post e'
| (Iseq p1 p2) => forall e1 e2, exec e p1 e1 -> exec e1 p2 e2 -> post e2
| (Iwhile cond p) => forall e', exec e (Iif cond (Iseq p (Iwhile cond p)) Iskip) e' -> post e'
end.
(** Below, a little tactic to helps in applying [exec_inversion]. *)
Ltac exec_inversion H :=
match type of H with
| (exec ?e ?p ?e') => pattern e'; apply (exec_inversion H); simpl; clear H
end.

(** ** The programming language is deterministic  This property is probably not necessary to prove the correctness of my variant, but it simplifies the proof a lot.  This lemma is a trivial induction over the first [exec] derivation, provided the ad-hoc inversion tactic on the second [exec] derivation. *)
Lemma exec_deterministic: forall ei p ef,
(exec ei p ef) -> forall ef', (exec ei p ef') -> ef=ef'.