Let St be a Set
of states,
and precond,postcond:St->Prop
.
In order to prove a result of the form:
(s:St)(precond s)->{s':St | (postcond s')}you may define
Invar:St->Prop
(loop invariant)
term_order:St->St->Prop
(termination order)
LoopExit:St->Prop
(when to stop looping).
LoopExit_dec: (s:St)(Invar s)->{(LoopExit s)}+{~(LoopExit s)}.
Onestep:(s:St)~(LoopExit s)-> (Invar s)-> {s':St|(Invar s') /\ (term_order s' s)}.
LoopExit_ok:(s:St)(LoopExit s)->(Invar s)->(postcond s).
Loopstart:(s:St)(precond s)->(Invar s).
Termi:(well_founded St term_order).
If the current goal is {s':St|(postcond s')}
,
and if precond,invar,term_order, loop_exit are correctly defined, x:St is a variable,
then
the following command will leave you only unresolved logical subgoals:
Apply while_not with precond invar term_order loopexit x; [ Realizer loopexit_dec | Realizer one_step | Auto or Idtac | Auto or Idtac | Auto or Idtac | Auto or Idtac ].where the arguments of the two
Realizer
are respectively of
type St->Prop
and St->St.
An example can be found in the implementation of the logarithm of base 2
Realizer {nat x y; while (zerop x) { ... }; return y;}We hope this will be done in few weeks.