(** Now we prove the hoare rules. **)

(* Specifications: *)
(* exps in the precondition are equivalant to allps bound outside the hoare tuple. *)
Lemma hoare_ex : forall ps R A (P:A->pred world) c Q,
hoare_ ps R (exp P) c Q =
(All x:A, hoare_ ps R (P x) c Q).
Lemma hoare_fact1 : forall ps X R P c Q,
X --> hoare_ ps R P c Q |-- hoare_ ps R (lift_nat X * P) c Q.
Lemma hoare_fact2 : forall ps X R P c Q,
hoare_ ps R (lift_nat X * P) c Q |-- X --> hoare_ ps R P c Q.
(* Lifted facts in the precondition can be pulled outside, or outside facts can be pushed inside. *)
Lemma hoare_fact : forall ps X R P c Q,
hoare_ ps R (lift_nat X * P) c Q = X --> hoare_ ps R P c Q.
(* Lemma for proving the correctness of straight-line instructions. The sufficent condition is : If the state before satisfies the precondition then there exists a post state satisfiing the postcondition. *)
Lemma hoare_straight : forall pu R c P Q n,
(forall k rho m F n', n' <= n ->
proj1_sig (P * F) (n',(rho,m)) ->
exists rho', exists m',
step pu k rho m c k rho' m' /\
proj1_sig (Q * F) (n',(rho',m'))) ->
hoare_ pu R P c Q n.