Inductive Call:Set := Call_M:nat->Call | Call_C:nat->nat->Call | Call_K:nat->nat->Call.
These strange names come from the notations of our paper .
The intention of each construction is the following:
conform: Call->Prop
by cases, such that
(conform c)
means "the parameters of call c
are correct".
Definition conform:Call->Prop:= [c:Call] <Prop>Case c of (* Call_M n *) [n:nat] (lt O n) (* Call_C n p *) [n,p:nat](and (lt (S O) p) (lt p n)) (* Call_K n p *) [n,p:nat](and (lt O p) (lt p n)) end.
Spec:Call->Code->Prop
,
the meaning of which is "The code co is a correct implementation
of the procedure call c".
We express Spec
as an inductive definition, each clause of
which express a part of the specification in terms of
code execution,
register, stack and monoid operations.
Inductive Spec:Call->Code->Prop := m_spec:(n:nat)(c:Code) ((M:Set)(MO:(monoid M)) ((a:M)(s:(Stack M)) (Exec M MO c (config M a s))= (config M (power M MO a n) s))) -> (Spec (Call_M n) c ) | c_spec:(p,q:nat)(c:Code) ((M:Set)(MO:(monoid M)) ((a:M)(s:(Stack M)) (Exec M MO c (config M a s))= (config M (power M MO a p) s))) -> (Spec (Call_C p q) c) | k_spec:(p,q:nat)(c:Code) ((M:Set)(MO:(monoid M)) ((a:M)(s:(Stack M)) (Exec M MO c (config M a s))= (config M (power M MO a p) (push M (power M MO a q) s)))) -> (Spec (Call_K p q) c).
Set
:
Inductive gencode[c:Call]:Set := gencode_intro:(co:Code)(Spec c co)->(gencode c).Typically, the proofs of lemmas of the form
(gencode c)
will be done by a command of the form
"Realizer <Fw-term:Code
>.
", followed
by a proof of a logical goal of the form
(Spec c co)
.
This is done in the module develop
.
Call_M
as an entry point :
Inductive addchain_spec[n:nat]:Set := addchain_spec_intro:(gencode (Call_M n))-> (addchain_spec n).Click here to look at the source .