Module HLD:=HD.
Definition sem_wp := wlp.
(** * Syntactic definition of the weakest liberal precondition.  In the following, we show that this definition is logically equivalent to [wlp]. *)
Fixpoint synt_wp (prog: ImpProg) : Pred -> Pred
:= fun post e =>
match prog with
| Iskip => post e
| (Iset A x expr) => post (E.upd x (E.eval expr e) e)
| (Iif cond p1 p2) =>
((E.eval cond e)=true -> (synt_wp p1 post e))
/\ ((E.eval cond e)=false -> (synt_wp p2 post e))
| (Iseq p1 p2) => synt_wp p1 (synt_wp p2 post) e
| (Iwhile cond p) =>
exists inv:Pred,
(inv e)
/\ (forall e', (inv e')
-> (E.eval cond e')=false -> (post e'))
/\ (forall e', (inv e')
-> (E.eval cond e')=true -> (synt_wp p inv e'))
end.
Hint Resolve synt_wp_monotonic: hoare.

(** * Soundness  The proof of soundness proceeds by induction over the derivation [exec ... prog ...] in implicit hypothesis induced by [wlp] definition.  Please, notice that coq performs the [exec_Iwhile] case alone (that's where monotonicity is used). Unfortunately, the case [exec_Iif] which seems trivial to a human is not discharged by Coq. *)
Lemma wp_sound: forall prog post, synt_wp prog post |= prog{=post=}.