(* *********************************************************************)
(*                                                                     *)
(*              The Compcert verified compiler                         *)
(*                                                                     *)
(*          Jacques-Henri Jourdan, INRIA Paris-Rocquencourt            *)
(*                                                                     *)
(*  Copyright Institut National de Recherche en Informatique et en     *)
(*  Automatique.  All rights reserved.  This file is distributed       *)
(*  under the terms of the GNU General Public License as published by  *)
(*  the Free Software Foundation, either version 2 of the License, or  *)
(*  (at your option) any later version.  This file is also distributed *)
(*  under the terms of the INRIA Non-Commercial License Agreement.     *)
(*                                                                     *)
(* *********************************************************************)
Require Grammar.
Require Automaton.
Require Validator_safe.
Require Interpreter.
Module Make(Import A:Automaton.T) (Import Inter:Interpreter.T A).
Module Import Valid := Validator_safe.Make A.
(** * A correct automaton does not crash **)
Section Safety_proof.
Hypothesis safe: safe.

(* Specifications: *)
Proposition shift_head_symbs: shift_head_symbs.
(** [prefix] is associative **)
Lemma prefix_ass:
forall (l1 l2 l3:list symbol), prefix l1 l2 -> prefix l2 l3 -> prefix l1 l3.
(** [prefix_pred] is associative **)
Lemma prefix_pred_ass:
forall (l1 l2 l3:list (state->bool)),
prefix_pred l1 l2 -> prefix_pred l2 l3 -> prefix_pred l1 l3.
(** If we have the right to reduce at this state, then the stack invariant is conserved by [reduce_step] and [reduce_step] does not crash. **)
Lemma reduce_step_stack_invariant_conserved stack prod buff:
stack_invariant stack ->
valid_for_reduce (state_of_stack init stack) prod ->
match reduce_step init stack prod buff with
| OK (Fail_sr | Accept_sr _ _) => True
| OK (Progress_sr stack_new _) => stack_invariant stack_new
| Err => False
end.