(* Title: HOL/Library/Heap.thy ID: $Id: Heap.thy,v 1.5 2008/05/17 19:46:22 wenzelm Exp $ Author: John Matthews, Galois Connections; Alexander Krauss, TU Muenchen *) header {* A polymorphic heap based on cantor encodings *} theory Heap imports Main Countable RType begin subsection {* Representable types *} text {* The type class of representable types *} class heap = rtype + countable text {* Instances for common HOL types *} instance nat :: heap .. instance "*" :: (heap, heap) heap .. instance "+" :: (heap, heap) heap .. instance list :: (heap) heap .. instance option :: (heap) heap .. instance int :: heap .. instance message_string :: countable by (rule countable_classI [of "message_string_case to_nat"]) (auto split: message_string.splits) instance message_string :: heap .. text {* Reflected types themselves are heap-representable *} instantiation rtype :: countable begin lemma list_size_size_append: "list_size size (xs @ ys) = list_size size xs + list_size size ys" by (induct xs, auto) lemma rtype_size: "t = RType.RType c ts ==> t' ∈ set ts ==> size t' < size t" by (frule split_list) (auto simp add: list_size_size_append) function to_nat_rtype :: "rtype => nat" where "to_nat_rtype (RType.RType c ts) = to_nat (to_nat c, to_nat (map to_nat_rtype ts))" by pat_completeness auto termination by (relation "measure (λx. size x)") (simp, simp only: in_measure rtype_size) instance proof (rule countable_classI) fix t t' :: rtype and ts have "(∀t'. to_nat_rtype t = to_nat_rtype t' --> t = t') ∧ (∀ts'. map to_nat_rtype ts = map to_nat_rtype ts' --> ts = ts')" proof (induct rule: rtype.induct) case (RType c ts) show ?case proof (rule allI, rule impI) fix t' assume hyp: "to_nat_rtype (rtype.RType c ts) = to_nat_rtype t'" then obtain c' ts' where t': "t' = (rtype.RType c' ts')" by (cases t') auto with RType hyp have "c = c'" and "ts = ts'" by simp_all with t' show "rtype.RType c ts = t'" by simp qed next case Nil_rtype then show ?case by simp next case (Cons_rtype t ts) then show ?case by auto qed then have "to_nat_rtype t = to_nat_rtype t' ==> t = t'" by auto moreover assume "to_nat_rtype t = to_nat_rtype t'" ultimately show "t = t'" by simp qed end instance rtype :: heap .. subsection {* A polymorphic heap with dynamic arrays and references *} types addr = nat -- "untyped heap references" datatype 'a array = Array addr datatype 'a ref = Ref addr -- "note the phantom type 'a " primrec addr_of_array :: "'a array => addr" where "addr_of_array (Array x) = x" primrec addr_of_ref :: "'a ref => addr" where "addr_of_ref (Ref x) = x" lemma addr_of_array_inj [simp]: "addr_of_array a = addr_of_array a' <-> a = a'" by (cases a, cases a') simp_all lemma addr_of_ref_inj [simp]: "addr_of_ref r = addr_of_ref r' <-> r = r'" by (cases r, cases r') simp_all instance array :: (type) countable by (rule countable_classI [of addr_of_array]) simp instance ref :: (type) countable by (rule countable_classI [of addr_of_ref]) simp setup {* Sign.add_const_constraint (@{const_name Array}, SOME @{typ "nat => 'a::heap array"}) #> Sign.add_const_constraint (@{const_name Ref}, SOME @{typ "nat => 'a::heap ref"}) #> Sign.add_const_constraint (@{const_name addr_of_array}, SOME @{typ "'a::heap array => nat"}) #> Sign.add_const_constraint (@{const_name addr_of_ref}, SOME @{typ "'a::heap ref => nat"}) *} types heap_rep = nat -- "representable values" record heap = arrays :: "rtype => addr => heap_rep list" refs :: "rtype => addr => heap_rep" lim :: addr definition empty :: heap where "empty = (|arrays = (λ_. arbitrary), refs = (λ_. arbitrary), lim = 0|))," -- "why arbitrary?" subsection {* Imperative references and arrays *} text {* References and arrays are developed in parallel, but keeping them separate makes some later proofs simpler. *} subsubsection {* Primitive operations *} definition new_ref :: "heap => ('a::heap) ref × heap" where "new_ref h = (let l = lim h in (Ref l, h(|lim := l + 1|)),))" definition new_array :: "heap => ('a::heap) array × heap" where "new_array h = (let l = lim h in (Array l, h(|lim := l + 1|)),))" definition ref_present :: "'a::heap ref => heap => bool" where "ref_present r h <-> addr_of_ref r < lim h" definition array_present :: "'a::heap array => heap => bool" where "array_present a h <-> addr_of_array a < lim h" definition get_ref :: "'a::heap ref => heap => 'a" where "get_ref r h = from_nat (refs h (RTYPE('a)) (addr_of_ref r))" definition get_array :: "'a::heap array => heap => 'a list" where "get_array a h = map from_nat (arrays h (RTYPE('a)) (addr_of_array a))" definition set_ref :: "'a::heap ref => 'a => heap => heap" where "set_ref r x = refs_update (λh. h( RTYPE('a) := ((h (RTYPE('a))) (addr_of_ref r:=to_nat x))))" definition set_array :: "'a::heap array => 'a list => heap => heap" where "set_array a x = arrays_update (λh. h( RTYPE('a) := ((h (RTYPE('a))) (addr_of_array a:=map to_nat x))))" subsubsection {* Interface operations *} definition ref :: "'a => heap => 'a::heap ref × heap" where "ref x h = (let (r, h') = new_ref h; h'' = set_ref r x h' in (r, h''))" definition array :: "nat => 'a => heap => 'a::heap array × heap" where "array n x h = (let (r, h') = new_array h; h'' = set_array r (replicate n x) h' in (r, h''))" definition array_of_list :: "'a list => heap => 'a::heap array × heap" where "array_of_list xs h = (let (r, h') = new_array h; h'' = set_array r xs h' in (r, h''))" definition upd :: "'a::heap array => nat => 'a => heap => heap" where "upd a i x h = set_array a ((get_array a h)[i:=x]) h" definition length :: "'a::heap array => heap => nat" where "length a h = size (get_array a h)" definition array_ran :: "('a::heap) option array => heap => 'a set" where "array_ran a h = {e. Some e ∈ set (get_array a h)}" -- {*FIXME*} subsubsection {* Reference equality *} text {* The following relations are useful for comparing arrays and references. *} definition noteq_refs :: "('a::heap) ref => ('b::heap) ref => bool" (infix "=!=" 70) where "r =!= s <-> RTYPE('a) ≠ RTYPE('b) ∨ addr_of_ref r ≠ addr_of_ref s" definition noteq_arrs :: "('a::heap) array => ('b::heap) array => bool" (infix "=!!=" 70) where "r =!!= s <-> RTYPE('a) ≠ RTYPE('b) ∨ addr_of_array r ≠ addr_of_array s" lemma noteq_refs_sym: "r =!= s ==> s =!= r" and noteq_arrs_sym: "a =!!= b ==> b =!!= a" and unequal_refs [simp]: "r ≠ r' <-> r =!= r'" -- "same types!" and unequal_arrs [simp]: "a ≠ a' <-> a =!!= a'" unfolding noteq_refs_def noteq_arrs_def by auto lemma present_new_ref: "ref_present r h ==> r =!= fst (ref v h)" by (simp add: ref_present_def new_ref_def ref_def Let_def noteq_refs_def) lemma present_new_arr: "array_present a h ==> a =!!= fst (array v x h)" by (simp add: array_present_def noteq_arrs_def new_array_def array_def Let_def) subsubsection {* Properties of heap containers *} text {* Properties of imperative arrays *} text {* FIXME: Does there exist a "canonical" array axiomatisation in the literature? *} lemma array_get_set_eq [simp]: "get_array r (set_array r x h) = x" by (simp add: get_array_def set_array_def) lemma array_get_set_neq [simp]: "r =!!= s ==> get_array r (set_array s x h) = get_array r h" by (simp add: noteq_arrs_def get_array_def set_array_def) lemma set_array_same [simp]: "set_array r x (set_array r y h) = set_array r x h" by (simp add: set_array_def) lemma array_set_set_swap: "r =!!= r' ==> set_array r x (set_array r' x' h) = set_array r' x' (set_array r x h)" by (simp add: Let_def expand_fun_eq noteq_arrs_def set_array_def) lemma array_ref_set_set_swap: "set_array r x (set_ref r' x' h) = set_ref r' x' (set_array r x h)" by (simp add: Let_def expand_fun_eq set_array_def set_ref_def) lemma get_array_upd_eq [simp]: "get_array a (upd a i v h) = (get_array a h) [i := v]" by (simp add: upd_def) lemma nth_upd_array_neq_array [simp]: "a =!!= b ==> get_array a (upd b j v h) ! i = get_array a h ! i" by (simp add: upd_def noteq_arrs_def) lemma get_arry_array_upd_elem_neqIndex [simp]: "i ≠ j ==> get_array a (upd a j v h) ! i = get_array a h ! i" by simp lemma length_upd_eq [simp]: "length a (upd a i v h) = length a h" by (simp add: length_def upd_def) lemma length_upd_neq [simp]: "length a (upd b i v h) = length a h" by (simp add: upd_def length_def set_array_def get_array_def) lemma upd_swap_neqArray: "a =!!= a' ==> upd a i v (upd a' i' v' h) = upd a' i' v' (upd a i v h)" apply (unfold upd_def) apply simp apply (subst array_set_set_swap, assumption) apply (subst array_get_set_neq) apply (erule noteq_arrs_sym) apply (simp) done lemma upd_swap_neqIndex: "[| i ≠ i' |] ==> upd a i v (upd a i' v' h) = upd a i' v' (upd a i v h)" by (auto simp add: upd_def array_set_set_swap list_update_swap) lemma get_array_init_array_list: "get_array (fst (array_of_list ls h)) (snd (array_of_list ls' h)) = ls'" by (simp add: Let_def split_def array_of_list_def) lemma set_array: "set_array (fst (array_of_list ls h)) new_ls (snd (array_of_list ls h)) = snd (array_of_list new_ls h)" by (simp add: Let_def split_def array_of_list_def) lemma array_present_upd [simp]: "array_present a (upd b i v h) = array_present a h" by (simp add: upd_def array_present_def set_array_def get_array_def) lemma array_of_list_replicate: "array_of_list (replicate n x) = array n x" by (simp add: expand_fun_eq array_of_list_def array_def) text {* Properties of imperative references *} lemma next_ref_fresh [simp]: assumes "(r, h') = new_ref h" shows "¬ ref_present r h" using assms by (cases h) (auto simp add: new_ref_def ref_present_def Let_def) lemma next_ref_present [simp]: assumes "(r, h') = new_ref h" shows "ref_present r h'" using assms by (cases h) (auto simp add: new_ref_def ref_present_def Let_def) lemma ref_get_set_eq [simp]: "get_ref r (set_ref r x h) = x" by (simp add: get_ref_def set_ref_def) lemma ref_get_set_neq [simp]: "r =!= s ==> get_ref r (set_ref s x h) = get_ref r h" by (simp add: noteq_refs_def get_ref_def set_ref_def) (* FIXME: We need some infrastructure to infer that locally generated new refs (by new_ref(_no_init), new_array(')) are distinct from all existing refs. *) lemma ref_set_get: "set_ref r (get_ref r h) h = h" apply (simp add: set_ref_def get_ref_def) oops lemma set_ref_same[simp]: "set_ref r x (set_ref r y h) = set_ref r x h" by (simp add: set_ref_def) lemma ref_set_set_swap: "r =!= r' ==> set_ref r x (set_ref r' x' h) = set_ref r' x' (set_ref r x h)" by (simp add: Let_def expand_fun_eq noteq_refs_def set_ref_def) lemma ref_new_set: "fst (ref v (set_ref r v' h)) = fst (ref v h)" by (simp add: ref_def new_ref_def set_ref_def Let_def) lemma ref_get_new [simp]: "get_ref (fst (ref v h)) (snd (ref v' h)) = v'" by (simp add: ref_def Let_def split_def) lemma ref_set_new [simp]: "set_ref (fst (ref v h)) new_v (snd (ref v h)) = snd (ref new_v h)" by (simp add: ref_def Let_def split_def) lemma ref_get_new_neq: "r =!= (fst (ref v h)) ==> get_ref r (snd (ref v h)) = get_ref r h" by (simp add: get_ref_def set_ref_def ref_def Let_def new_ref_def noteq_refs_def) lemma lim_set_ref [simp]: "lim (set_ref r v h) = lim h" by (simp add: set_ref_def) lemma ref_present_new_ref [simp]: "ref_present r h ==> ref_present r (snd (ref v h))" by (simp add: new_ref_def ref_present_def ref_def Let_def) lemma ref_present_set_ref [simp]: "ref_present r (set_ref r' v h) = ref_present r h" by (simp add: set_ref_def ref_present_def) lemma array_ranI: "[| Some b = get_array a h ! i; i < Heap.length a h |] ==> b ∈ array_ran a h" unfolding array_ran_def Heap.length_def by simp lemma array_ran_upd_array_Some: assumes "cl ∈ array_ran a (Heap.upd a i (Some b) h)" shows "cl ∈ array_ran a h ∨ cl = b" proof - have "set (get_array a h[i := Some b]) ⊆ insert (Some b) (set (get_array a h))" by (rule set_update_subset_insert) with assms show ?thesis unfolding array_ran_def Heap.upd_def by fastsimp qed lemma array_ran_upd_array_None: assumes "cl ∈ array_ran a (Heap.upd a i None h)" shows "cl ∈ array_ran a h" proof - have "set (get_array a h[i := None]) ⊆ insert None (set (get_array a h))" by (rule set_update_subset_insert) with assms show ?thesis unfolding array_ran_def Heap.upd_def by auto qed text {* Non-interaction between imperative array and imperative references *} lemma get_array_set_ref [simp]: "get_array a (set_ref r v h) = get_array a h" by (simp add: get_array_def set_ref_def) lemma nth_set_ref [simp]: "get_array a (set_ref r v h) ! i = get_array a h ! i" by simp lemma get_ref_upd [simp]: "get_ref r (upd a i v h) = get_ref r h" by (simp add: get_ref_def set_array_def upd_def) lemma new_ref_upd: "fst (ref v (upd a i v' h)) = fst (ref v h)" by (simp add: set_array_def get_array_def Let_def ref_new_set upd_def ref_def new_ref_def) text {*not actually true ???*} lemma upd_set_ref_swap: "upd a i v (set_ref r v' h) = set_ref r v' (upd a i v h)" apply (case_tac a) apply (simp add: Let_def upd_def) apply auto oops lemma length_new_ref[simp]: "length a (snd (ref v h)) = length a h" by (simp add: get_array_def set_ref_def length_def new_ref_def ref_def Let_def) lemma get_array_new_ref [simp]: "get_array a (snd (ref v h)) = get_array a h" by (simp add: new_ref_def ref_def set_ref_def get_array_def Let_def) lemma ref_present_upd [simp]: "ref_present r (upd a i v h) = ref_present r h" by (simp add: upd_def ref_present_def set_array_def get_array_def) lemma array_present_set_ref [simp]: "array_present a (set_ref r v h) = array_present a h" by (simp add: array_present_def set_ref_def) lemma array_present_new_ref [simp]: "array_present a h ==> array_present a (snd (ref v h))" by (simp add: array_present_def new_ref_def ref_def Let_def) hide (open) const empty array array_of_list upd length ref end
lemma list_size_size_append:
list_size size (xs @ ys) = list_size size xs + list_size size ys
lemma rtype_size:
[| t = rtype.RType c ts; t' ∈ set ts |] ==> size t' < size t
lemma addr_of_array_inj:
(addr_of_array a = addr_of_array a') = (a = a')
lemma addr_of_ref_inj:
(addr_of_ref r = addr_of_ref r') = (r = r')
lemma noteq_refs_sym:
r =!= s ==> s =!= r
and noteq_arrs_sym:
a =!!= b ==> b =!!= a
and unequal_refs:
(r ≠ r') = r =!= r'
and unequal_arrs:
(a ≠ a') = a =!!= a'
lemma present_new_ref:
ref_present r h ==> r =!= fst (ref v h)
lemma present_new_arr:
array_present a h ==> a =!!= fst (array v x h)
lemma array_get_set_eq:
get_array r (set_array r x h) = x
lemma array_get_set_neq:
r =!!= s ==> get_array r (set_array s x h) = get_array r h
lemma set_array_same:
set_array r x (set_array r y h) = set_array r x h
lemma array_set_set_swap:
r =!!= r'
==> set_array r x (set_array r' x' h) = set_array r' x' (set_array r x h)
lemma array_ref_set_set_swap:
set_array r x (set_ref r' x' h) = set_ref r' x' (set_array r x h)
lemma get_array_upd_eq:
get_array a (upd a i v h) = get_array a h[i := v]
lemma nth_upd_array_neq_array:
a =!!= b ==> get_array a (upd b j v h) ! i = get_array a h ! i
lemma get_arry_array_upd_elem_neqIndex:
i ≠ j ==> get_array a (upd a j v h) ! i = get_array a h ! i
lemma length_upd_eq:
Heap.length a (upd a i v h) = Heap.length a h
lemma length_upd_neq:
Heap.length a (upd b i v h) = Heap.length a h
lemma upd_swap_neqArray:
a =!!= a' ==> upd a i v (upd a' i' v' h) = upd a' i' v' (upd a i v h)
lemma upd_swap_neqIndex:
i ≠ i' ==> upd a i v (upd a i' v' h) = upd a i' v' (upd a i v h)
lemma get_array_init_array_list:
get_array (fst (array_of_list ls h)) (snd (array_of_list ls' h)) = ls'
lemma set_array:
set_array (fst (array_of_list ls h)) new_ls (snd (array_of_list ls h)) =
snd (array_of_list new_ls h)
lemma array_present_upd:
array_present a (upd b i v h) = array_present a h
lemma array_of_list_replicate:
array_of_list (replicate n x) = array n x
lemma next_ref_fresh:
(r, h') = new_ref h ==> ¬ ref_present r h
lemma next_ref_present:
(r, h') = new_ref h ==> ref_present r h'
lemma ref_get_set_eq:
get_ref r (set_ref r x h) = x
lemma ref_get_set_neq:
r =!= s ==> get_ref r (set_ref s x h) = get_ref r h
lemma set_ref_same:
set_ref r x (set_ref r y h) = set_ref r x h
lemma ref_set_set_swap:
r =!= r' ==> set_ref r x (set_ref r' x' h) = set_ref r' x' (set_ref r x h)
lemma ref_new_set:
fst (ref v (set_ref r v' h)) = fst (ref v h)
lemma ref_get_new:
get_ref (fst (ref v h)) (snd (ref v' h)) = v'
lemma ref_set_new:
set_ref (fst (ref v h)) new_v (snd (ref v h)) = snd (ref new_v h)
lemma ref_get_new_neq:
r =!= fst (ref v h) ==> get_ref r (snd (ref v h)) = get_ref r h
lemma lim_set_ref:
lim (set_ref r v h) = lim h
lemma ref_present_new_ref:
ref_present r h ==> ref_present r (snd (ref v h))
lemma ref_present_set_ref:
ref_present r (set_ref r' v h) = ref_present r h
lemma array_ranI:
[| Some b = get_array a h ! i; i < Heap.length a h |] ==> b ∈ array_ran a h
lemma array_ran_upd_array_Some:
cl ∈ array_ran a (upd a i (Some b) h) ==> cl ∈ array_ran a h ∨ cl = b
lemma array_ran_upd_array_None:
cl ∈ array_ran a (upd a i None h) ==> cl ∈ array_ran a h
lemma get_array_set_ref:
get_array a (set_ref r v h) = get_array a h
lemma nth_set_ref:
get_array a (set_ref r v h) ! i = get_array a h ! i
lemma get_ref_upd:
get_ref r (upd a i v h) = get_ref r h
lemma new_ref_upd:
fst (ref v (upd a i v' h)) = fst (ref v h)
lemma length_new_ref:
Heap.length a (snd (ref v h)) = Heap.length a h
lemma get_array_new_ref:
get_array a (snd (ref v h)) = get_array a h
lemma ref_present_upd:
ref_present r (upd a i v h) = ref_present r h
lemma array_present_set_ref:
array_present a (set_ref r v h) = array_present a h
lemma array_present_new_ref:
array_present a h ==> array_present a (snd (ref v h))