Commit 878754c5 by Jean-Christophe Filliâtre

dijkstra: proof completed

parent 7c252cb1
 ... ... @@ -123,7 +123,9 @@ module DijkstraShortestPath lemma Main_lemma: forall src v: vertex. forall d: int. path src v d -> not shortest_path src v d -> path src v d -> not (shortest_path src v d) -> v = src /\ d > 0 \/ exists v': vertex. exists d': int. shortest_path src v' d' /\ S.mem v (g_succ v') /\ d' + weight v' v < d ... ... @@ -152,24 +154,22 @@ module DijkstraShortestPath (* we already found the shortest paths for vertices in S *) (forall v: vertex. S.mem v s -> shortest_path src v d[v]) /\ (* there are paths for vertices in Q *) (forall v: vertex. S.mem v q -> path src v d[v]) /\ (* vertices at distance < min(Q) are already in S *) (forall m: vertex. min m q d -> forall x: vertex. forall dx: int. (*shortest_*)path src x dx -> dx < d[m] -> S.mem x s) (forall v: vertex. S.mem v q -> path src v d[v]) predicate inv_succ (src: vertex) (s q: S.set vertex) = predicate inv_succ (src: vertex) (s q: S.set vertex) (d: M.map vertex int) = (* successors of vertices in S are either in S or in Q *) (forall x: vertex. S.mem x s -> forall y: vertex. S.mem y (g_succ x) -> S.mem y s \/ S.mem y q) forall x: vertex. S.mem x s -> forall y: vertex. S.mem y (g_succ x) -> (S.mem y s \/ S.mem y q) /\ d[y] <= d[x] + weight x y predicate inv_succ2 (src: vertex) (s q: S.set vertex) predicate inv_succ2 (src: vertex) (s q: S.set vertex) (d: M.map vertex int) (u: vertex) (su: S.set vertex) = (* successors of vertices in S are either in S or in Q, unless they are successors of u still in su *) (forall x: vertex. S.mem x s -> forall y: vertex. S.mem y (g_succ x) -> (x<>u \/ (x=u /\ not S.mem y su)) -> S.mem y s \/ S.mem y q) forall x: vertex. S.mem x s -> forall y: vertex. S.mem y (g_succ x) -> (x<>u \/ (x=u /\ not (S.mem y su))) -> (S.mem y s \/ S.mem y q) /\ d[y] <= d[x] + weight x y (* Iteration on a set *) ... ... @@ -192,7 +192,11 @@ module DijkstraShortestPath = init src; while not (q_is_empty ()) do invariant { inv src !visited !q !d } invariant { inv_succ src !visited !q } invariant { inv_succ src !visited !q !d } invariant { (* vertices at distance < min(Q) are already in S *) forall m: vertex. min m !q !d -> forall x: vertex. forall dx: int. path src x dx -> dx < !d[m] -> S.mem x !visited } variant { S.cardinal v - S.cardinal !visited } let u = q_extract_min () in assert { shortest_path src u !d[u] }; ... ... @@ -201,10 +205,11 @@ module DijkstraShortestPath while set_has_next su do invariant { S.subset !su (g_succ u) } invariant { inv src !visited !q !d } invariant { inv_succ2 src !visited !q u !su } invariant { inv_succ2 src !visited !q !d u !su } variant { S.cardinal !su } let v = set_next su in relax u v relax u v; assert { !d[v] <= !d[u] + weight u v } done done ... ...
 (* This file is generated by Why3's Coq driver *) (* Beware! Only edit allowed sections below *) Require Import BuiltIn. Require BuiltIn. Require int.Int. (* Why3 assumption *) Definition unit := unit. (* Why3 assumption *) Inductive ref (a:Type) {a_WT:WhyType a} := | mk_ref : a -> ref a. Axiom ref_WhyType : forall (a:Type) {a_WT:WhyType a}, WhyType (ref a). Existing Instance ref_WhyType. Implicit Arguments mk_ref [[a] [a_WT]]. (* Why3 assumption *) Definition contents {a:Type} {a_WT:WhyType a}(v:(ref a)): a := match v with | (mk_ref x) => x end. Axiom set : forall (a:Type) {a_WT:WhyType a}, Type. Parameter set_WhyType : forall (a:Type) {a_WT:WhyType a}, WhyType (set a). Existing Instance set_WhyType. Parameter mem: forall {a:Type} {a_WT:WhyType a}, a -> (set a) -> Prop. (* Why3 assumption *) Definition infix_eqeq {a:Type} {a_WT:WhyType a}(s1:(set a)) (s2:(set a)): Prop := forall (x:a), (mem x s1) <-> (mem x s2). Axiom extensionality : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)), (infix_eqeq s1 s2) -> (s1 = s2). (* Why3 assumption *) Definition subset {a:Type} {a_WT:WhyType a}(s1:(set a)) (s2:(set a)): Prop := forall (x:a), (mem x s1) -> (mem x s2). Axiom subset_refl : forall {a:Type} {a_WT:WhyType a}, forall (s:(set a)), (subset s s). Axiom subset_trans : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)) (s3:(set a)), (subset s1 s2) -> ((subset s2 s3) -> (subset s1 s3)). Parameter empty: forall {a:Type} {a_WT:WhyType a}, (set a). (* Why3 assumption *) Definition is_empty {a:Type} {a_WT:WhyType a}(s:(set a)): Prop := forall (x:a), ~ (mem x s). Axiom empty_def1 : forall {a:Type} {a_WT:WhyType a}, (is_empty (empty :(set a))). Axiom mem_empty : forall {a:Type} {a_WT:WhyType a}, forall (x:a), ~ (mem x (empty :(set a))). Parameter add: forall {a:Type} {a_WT:WhyType a}, a -> (set a) -> (set a). Axiom add_def1 : forall {a:Type} {a_WT:WhyType a}, forall (x:a) (y:a), forall (s:(set a)), (mem x (add y s)) <-> ((x = y) \/ (mem x s)). Parameter remove: forall {a:Type} {a_WT:WhyType a}, a -> (set a) -> (set a). Axiom remove_def1 : forall {a:Type} {a_WT:WhyType a}, forall (x:a) (y:a) (s:(set a)), (mem x (remove y s)) <-> ((~ (x = y)) /\ (mem x s)). Axiom subset_remove : forall {a:Type} {a_WT:WhyType a}, forall (x:a) (s:(set a)), (subset (remove x s) s). Parameter union: forall {a:Type} {a_WT:WhyType a}, (set a) -> (set a) -> (set a). Axiom union_def1 : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)) (x:a), (mem x (union s1 s2)) <-> ((mem x s1) \/ (mem x s2)). Parameter inter: forall {a:Type} {a_WT:WhyType a}, (set a) -> (set a) -> (set a). Axiom inter_def1 : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)) (x:a), (mem x (inter s1 s2)) <-> ((mem x s1) /\ (mem x s2)). Parameter diff: forall {a:Type} {a_WT:WhyType a}, (set a) -> (set a) -> (set a). Axiom diff_def1 : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)) (x:a), (mem x (diff s1 s2)) <-> ((mem x s1) /\ ~ (mem x s2)). Axiom subset_diff : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)), (subset (diff s1 s2) s1). Parameter choose: forall {a:Type} {a_WT:WhyType a}, (set a) -> a. Axiom choose_def : forall {a:Type} {a_WT:WhyType a}, forall (s:(set a)), (~ (is_empty s)) -> (mem (choose s) s). Parameter cardinal: forall {a:Type} {a_WT:WhyType a}, (set a) -> Z. Axiom cardinal_nonneg : forall {a:Type} {a_WT:WhyType a}, forall (s:(set a)), (0%Z <= (cardinal s))%Z. Axiom cardinal_empty : forall {a:Type} {a_WT:WhyType a}, forall (s:(set a)), ((cardinal s) = 0%Z) <-> (is_empty s). Axiom cardinal_add : forall {a:Type} {a_WT:WhyType a}, forall (x:a), forall (s:(set a)), (~ (mem x s)) -> ((cardinal (add x s)) = (1%Z + (cardinal s))%Z). Axiom cardinal_remove : forall {a:Type} {a_WT:WhyType a}, forall (x:a), forall (s:(set a)), (mem x s) -> ((cardinal s) = (1%Z + (cardinal (remove x s)))%Z). Axiom cardinal_subset : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)), (subset s1 s2) -> ((cardinal s1) <= (cardinal s2))%Z. Axiom cardinal1 : forall {a:Type} {a_WT:WhyType a}, forall (s:(set a)), ((cardinal s) = 1%Z) -> forall (x:a), (mem x s) -> (x = (choose s)). Axiom map : forall (a:Type) {a_WT:WhyType a} (b:Type) {b_WT:WhyType b}, Type. Parameter map_WhyType : forall (a:Type) {a_WT:WhyType a} (b:Type) {b_WT:WhyType b}, WhyType (map a b). Existing Instance map_WhyType. Parameter get: forall {a:Type} {a_WT:WhyType a} {b:Type} {b_WT:WhyType b}, (map a b) -> a -> b. Parameter set1: forall {a:Type} {a_WT:WhyType a} {b:Type} {b_WT:WhyType b}, (map a b) -> a -> b -> (map a b). Axiom Select_eq : forall {a:Type} {a_WT:WhyType a} {b:Type} {b_WT:WhyType b}, forall (m:(map a b)), forall (a1:a) (a2:a), forall (b1:b), (a1 = a2) -> ((get (set1 m a1 b1) a2) = b1). Axiom Select_neq : forall {a:Type} {a_WT:WhyType a} {b:Type} {b_WT:WhyType b}, forall (m:(map a b)), forall (a1:a) (a2:a), forall (b1:b), (~ (a1 = a2)) -> ((get (set1 m a1 b1) a2) = (get m a2)). Parameter const: forall {a:Type} {a_WT:WhyType a} {b:Type} {b_WT:WhyType b}, b -> (map a b). Axiom Const : forall {a:Type} {a_WT:WhyType a} {b:Type} {b_WT:WhyType b}, forall (b1:b) (a1:a), ((get (const b1:(map a b)) a1) = b1). Axiom vertex : Type. Parameter vertex_WhyType : WhyType vertex. Existing Instance vertex_WhyType. Parameter v: (set vertex). Parameter g_succ: vertex -> (set vertex). Axiom G_succ_sound : forall (x:vertex), (subset (g_succ x) v). Parameter weight: vertex -> vertex -> Z. Axiom Weight_nonneg : forall (x:vertex) (y:vertex), (0%Z <= (weight x y))%Z. (* Why3 assumption *) Definition min(m:vertex) (q:(set vertex)) (d:(map vertex Z)): Prop := (mem m q) /\ forall (x:vertex), (mem x q) -> ((get d m) <= (get d x))%Z. (* Why3 assumption *) Inductive path : vertex -> vertex -> Z -> Prop := | Path_nil : forall (x:vertex), (path x x 0%Z) | Path_cons : forall (x:vertex) (y:vertex) (z:vertex), forall (d:Z), (path x y d) -> ((mem z (g_succ y)) -> (path x z (d + (weight y z))%Z)). Axiom Length_nonneg : forall (x:vertex) (y:vertex), forall (d:Z), (path x y d) -> (0%Z <= d)%Z. (* Why3 assumption *) Definition shortest_path(x:vertex) (y:vertex) (d:Z): Prop := (path x y d) /\ forall (d':Z), (path x y d') -> (d <= d')%Z. Axiom Path_inversion : forall (src:vertex) (v1:vertex), forall (d:Z), (path src v1 d) -> (((v1 = src) /\ (d = 0%Z)) \/ exists v':vertex, (path src v' (d - (weight v' v1))%Z) /\ (mem v1 (g_succ v'))). Axiom Path_shortest_path : forall (src:vertex) (v1:vertex), forall (d:Z), (path src v1 d) -> exists d':Z, (shortest_path src v1 d') /\ (d' <= d)%Z. Axiom Main_lemma : forall (src:vertex) (v1:vertex), forall (d:Z), (path src v1 d) -> ((~ (shortest_path src v1 d)) -> exists v':vertex, exists d':Z, (shortest_path src v' d') /\ ((mem v1 (g_succ v')) /\ ((d' + (weight v' v1))%Z < d)%Z)). Require Import Why3. Ltac ae := why3 "alt-ergo". (* Why3 goal *) Theorem Completeness_lemma : forall (s:(set vertex)), (forall (v1:vertex), (mem v1 s) -> forall (w:vertex), (mem w (g_succ v1)) -> (mem w s)) -> forall (src:vertex), (mem src s) -> forall (dst:vertex), forall (d:Z), (path src dst d) -> (mem dst s). intros s h1 src h2 dst d h3. induction h3; trivial. ae. Qed.
 ... ... @@ -181,9 +181,9 @@ Axiom Path_shortest_path : forall (src:vertex) (v1:vertex), forall (d:Z), (path src v1 d) -> exists d':Z, (shortest_path src v1 d') /\ (d' <= d)%Z. Axiom Main_lemma : forall (src:vertex) (v1:vertex), forall (d:Z), (path src v1 d) -> ((~ (shortest_path src v1 d)) -> exists v':vertex, exists d':Z, (shortest_path src v' d') /\ ((mem v1 (g_succ v')) /\ ((d' + (weight v' v1))%Z < d)%Z)). v1 d) -> ((~ (shortest_path src v1 d)) -> (((v1 = src) /\ (0%Z < d)%Z) \/ exists v':vertex, exists d':Z, (shortest_path src v' d') /\ ((mem v1 (g_succ v')) /\ ((d' + (weight v' v1))%Z < d)%Z))). Axiom Completeness_lemma : forall (s:(set vertex)), (forall (v1:vertex), (mem v1 s) -> forall (w:vertex), (mem w (g_succ v1)) -> (mem w s)) -> ... ... @@ -252,7 +252,6 @@ intros dx IH x pathx hdx. destruct (Path_inversion _ _ _ pathx). ae. ae. Qed. ... ...
 ... ... @@ -181,9 +181,9 @@ Axiom Path_shortest_path : forall (src:vertex) (v1:vertex), forall (d:Z), (path src v1 d) -> exists d':Z, (shortest_path src v1 d') /\ (d' <= d)%Z. Axiom Main_lemma : forall (src:vertex) (v1:vertex), forall (d:Z), (path src v1 d) -> ((~ (shortest_path src v1 d)) -> exists v':vertex, exists d':Z, (shortest_path src v' d') /\ ((mem v1 (g_succ v')) /\ ((d' + (weight v' v1))%Z < d)%Z)). v1 d) -> ((~ (shortest_path src v1 d)) -> (((v1 = src) /\ (0%Z < d)%Z) \/ exists v':vertex, exists d':Z, (shortest_path src v' d') /\ ((mem v1 (g_succ v')) /\ ((d' + (weight v' v1))%Z < d)%Z))). Axiom Completeness_lemma : forall (s:(set vertex)), (forall (v1:vertex), (mem v1 s) -> forall (w:vertex), (mem w (g_succ v1)) -> (mem w s)) -> ... ... @@ -199,20 +199,20 @@ Definition inv(src:vertex) (s:(set vertex)) (q:(set vertex)) (d:(map vertex Z)): Prop := (inv_src src s q) /\ (((get d src) = 0%Z) /\ ((subset s v) /\ ((subset q v) /\ ((forall (v1:vertex), (mem v1 q) -> ~ (mem v1 s)) /\ ((forall (v1:vertex), (mem v1 s) -> (shortest_path src v1 (get d v1))) /\ ((forall (v1:vertex), (mem v1 q) -> (path src v1 (get d v1))) /\ forall (m:vertex), (min m q d) -> forall (x:vertex), forall (dx:Z), (path src x dx) -> ((dx < (get d m))%Z -> (mem x s)))))))). forall (v1:vertex), (mem v1 q) -> (path src v1 (get d v1))))))). (* Why3 assumption *) Definition inv_succ(src:vertex) (s:(set vertex)) (q:(set vertex)): Prop := forall (x:vertex), (mem x s) -> forall (y:vertex), (mem y (g_succ x)) -> ((mem y s) \/ (mem y q)). Definition inv_succ(src:vertex) (s:(set vertex)) (q:(set vertex)) (d:(map vertex Z)): Prop := forall (x:vertex), (mem x s) -> forall (y:vertex), (mem y (g_succ x)) -> (((mem y s) \/ (mem y q)) /\ ((get d y) <= ((get d x) + (weight x y))%Z)%Z). (* Why3 assumption *) Definition inv_succ2(src:vertex) (s:(set vertex)) (q:(set vertex)) (u:vertex) (su:(set vertex)): Prop := forall (x:vertex), (mem x s) -> forall (y:vertex), (mem y (g_succ x)) -> (((~ (x = u)) \/ ((x = u) /\ ~ (mem y su))) -> ((mem y s) \/ (mem y q))). Definition inv_succ2(src:vertex) (s:(set vertex)) (q:(set vertex)) (d:(map vertex Z)) (u:vertex) (su:(set vertex)): Prop := forall (x:vertex), (mem x s) -> forall (y:vertex), (mem y (g_succ x)) -> (((~ (x = u)) \/ ((x = u) /\ ~ (mem y su))) -> (((mem y s) \/ (mem y q)) /\ ((get d y) <= ((get d x) + (weight x y))%Z)%Z)). Require Import Why3. Ltac ae := why3 "alt-ergo". ... ... @@ -222,16 +222,18 @@ Theorem WP_parameter_shortest_path_code : forall (src:vertex) (dst:vertex), vertex)) (d1:(map vertex Z)) (visited:(set vertex)), (((forall (x:vertex), ~ (mem x visited)) /\ (q = (add src (empty :(set vertex))))) /\ (d1 = (set1 d src 0%Z))) -> forall (q1:(set vertex)) (d2:(map vertex Z)) (visited1:(set vertex)), (((inv_src src visited1 q1) /\ (((get d2 (visited1:(set vertex)), ((((inv_src src visited1 q1) /\ (((get d2 src) = 0%Z) /\ ((subset visited1 v) /\ ((subset q1 v) /\ ((forall (v1:vertex), (mem v1 q1) -> ~ (mem v1 visited1)) /\ ((forall (v1:vertex), (mem v1 visited1) -> (shortest_path src v1 (get d2 v1))) /\ ((forall (v1:vertex), (mem v1 q1) -> (path src v1 (get d2 v1))) /\ forall (m:vertex), (min m q1 d2) -> forall (x:vertex), forall (dx:Z), (path src x dx) -> ((dx < (get d2 m))%Z -> (mem x visited1))))))))) /\ forall (x:vertex), (mem x visited1) -> forall (y:vertex), (mem y (g_succ x)) -> ((mem y visited1) \/ (mem y q1))) -> forall (o:bool), ((o = true) <-> forall (x:vertex), ~ (mem x q1)) -> ((~ (o = true)) -> v1))) /\ forall (v1:vertex), (mem v1 q1) -> (path src v1 (get d2 v1)))))))) /\ forall (x:vertex), (mem x visited1) -> forall (y:vertex), (mem y (g_succ x)) -> (((mem y visited1) \/ (mem y q1)) /\ ((get d2 y) <= ((get d2 x) + (weight x y))%Z)%Z)) /\ forall (m:vertex), ((mem m q1) /\ forall (x:vertex), (mem x q1) -> ((get d2 m) <= (get d2 x))%Z) -> forall (x:vertex), forall (dx:Z), (path src x dx) -> ((dx < (get d2 m))%Z -> (mem x visited1))) -> forall (o:bool), ((o = true) <-> forall (x:vertex), ~ (mem x q1)) -> ((~ (o = true)) -> ((~ forall (x:vertex), ~ (mem x q1)) -> forall (q2:(set vertex)), forall (u:vertex), (((mem u q1) /\ forall (x:vertex), (mem x q1) -> ((get d2 u) <= (get d2 x))%Z) /\ (q2 = (remove u q1))) -> (((path src u ... ... @@ -242,35 +244,33 @@ Theorem WP_parameter_shortest_path_code : forall (src:vertex) (dst:vertex), visited2 q3) /\ (((get d3 src) = 0%Z) /\ ((subset visited2 v) /\ ((subset q3 v) /\ ((forall (v1:vertex), (mem v1 q3) -> ~ (mem v1 visited2)) /\ ((forall (v1:vertex), (mem v1 visited2) -> (shortest_path src v1 (get d3 v1))) /\ ((forall (v1:vertex), (mem v1 q3) -> (path src v1 (get d3 v1))) /\ forall (m:vertex), (min m q3 d3) -> forall (x:vertex), forall (dx:Z), (path src x dx) -> ((dx < (get d3 m))%Z -> (mem x visited2)))))))))) /\ forall (x:vertex), (mem x visited2) -> forall (y:vertex), (mem y (g_succ x)) -> (((~ (x = u)) \/ ((x = u) /\ ~ (mem y su))) -> ((mem y visited2) \/ (mem y q3)))) -> forall (result:bool), ((result = true) <-> ~ forall (x:vertex), ~ (mem x su)) -> ((result = true) -> ((~ forall (x:vertex), ~ (mem x su)) -> forall (su1:(set vertex)), forall (v1:vertex), ((mem v1 su) /\ (su1 = (remove v1 su))) -> forall (q4:(set vertex)) (d4:(map vertex Z)), (((mem v1 visited2) /\ ((q4 = q3) /\ (d4 = d3))) \/ (((mem v1 q4) /\ (((get d4 v1) <= ((get d4 u) + (weight u v1))%Z)%Z /\ ((q4 = q3) /\ (d4 = d3)))) \/ (((mem v1 q4) /\ ((((get d3 u) + (weight u v1))%Z < (get d3 v1))%Z /\ ((q4 = q3) /\ (d4 = (set1 d3 v1 ((get d3 u) + (weight u v1))%Z))))) \/ ((~ (mem v1 visited2)) /\ ((~ (mem v1 q3)) /\ ((q4 = (add v1 q3)) /\ (d4 = (set1 d3 v1 ((get d3 u) + (weight u v1))%Z)))))))) -> forall (v2:vertex), (mem v2 q4) -> (path src v2 (get d4 v2))))))). v1 (get d3 v1))) /\ forall (v1:vertex), (mem v1 q3) -> (path src v1 (get d3 v1))))))))) /\ forall (x:vertex), (mem x visited2) -> forall (y:vertex), (mem y (g_succ x)) -> (((~ (x = u)) \/ ((x = u) /\ ~ (mem y su))) -> (((mem y visited2) \/ (mem y q3)) /\ ((get d3 y) <= ((get d3 x) + (weight x y))%Z)%Z))) -> forall (result:bool), ((result = true) <-> ~ forall (x:vertex), ~ (mem x su)) -> ((result = true) -> ((~ forall (x:vertex), ~ (mem x su)) -> forall (su1:(set vertex)), forall (v1:vertex), ((mem v1 su) /\ (su1 = (remove v1 su))) -> forall (q4:(set vertex)) (d4:(map vertex Z)), (((mem v1 visited2) /\ ((q4 = q3) /\ (d4 = d3))) \/ (((mem v1 q4) /\ (((get d4 v1) <= ((get d4 u) + (weight u v1))%Z)%Z /\ ((q4 = q3) /\ (d4 = d3)))) \/ (((mem v1 q4) /\ ((((get d3 u) + (weight u v1))%Z < (get d3 v1))%Z /\ ((q4 = q3) /\ (d4 = (set1 d3 v1 ((get d3 u) + (weight u v1))%Z))))) \/ ((~ (mem v1 visited2)) /\ ((~ (mem v1 q3)) /\ ((q4 = (add v1 q3)) /\ (d4 = (set1 d3 v1 ((get d3 u) + (weight u v1))%Z)))))))) -> ((((get d4 v1) < ((get d4 u) + (weight u v1))%Z)%Z \/ ((get d4 v1) = ((get d4 u) + (weight u v1))%Z)) -> forall (v2:vertex), (mem v2 q4) -> (path src v2 (get d4 v2)))))))). (* intros src dst d (h1,h2) q d1 visited ((h3,h4),h5) q1 d2 visited1 ((h6,(h7,(h8,(h9,(h10,(h11,(h12,h13))))))),h14) o h15 h16 h17 q2 u ((h6,(h7,(h8,(h9,(h10,(h11,h12)))))),h14) o h15 h16 h17 q2 u ((h18,h19),h20) (h21,h22) visited2 h23 su q3 d3 ((h24,(h25,(h26,(h27,(h28,(h29,(h30,(h31,h32)))))))),h33) result h34 h35 h36 su1 v1 (h37,h38) q4 d4 h39 v2 h40. *) intuition; try ae. destruct h39. ae. destruct H. ae. destruct H. decompose [and] H; clear H. assert (case: (v2 = v1 \/ v2 <> v1)) by ae. destruct case. subst v2 d4; rewrite Select_eq. apply Path_cons. ... ... @@ -280,11 +280,11 @@ trivial. subst d4; rewrite Select_neq. ae. ae. decompose [and] H; clear H. assert (case: (v2 = v1 \/ v2 <> v1)) by ae. destruct case. subst v2 d4; rewrite Select_eq. apply Path_cons. ae. why3 "z3". ae. trivial. ae. ... ...
 (* This file is generated by Why3's Coq driver *) (* Beware! Only edit allowed sections below *) Require Import BuiltIn. Require BuiltIn. Require int.Int. (* Why3 assumption *) Definition unit := unit. (* Why3 assumption *) Inductive ref (a:Type) {a_WT:WhyType a} := | mk_ref : a -> ref a. Axiom ref_WhyType : forall (a:Type) {a_WT:WhyType a}, WhyType (ref a). Existing Instance ref_WhyType. Implicit Arguments mk_ref [[a] [a_WT]]. (* Why3 assumption *) Definition contents {a:Type} {a_WT:WhyType a}(v:(ref a)): a := match v with | (mk_ref x) => x end. Axiom set : forall (a:Type) {a_WT:WhyType a}, Type. Parameter set_WhyType : forall (a:Type) {a_WT:WhyType a}, WhyType (set a). Existing Instance set_WhyType. Parameter mem: forall {a:Type} {a_WT:WhyType a}, a -> (set a) -> Prop. (* Why3 assumption *) Definition infix_eqeq {a:Type} {a_WT:WhyType a}(s1:(set a)) (s2:(set a)): Prop := forall (x:a), (mem x s1) <-> (mem x s2). Axiom extensionality : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)), (infix_eqeq s1 s2) -> (s1 = s2). (* Why3 assumption *) Definition subset {a:Type} {a_WT:WhyType a}(s1:(set a)) (s2:(set a)): Prop := forall (x:a), (mem x s1) -> (mem x s2). Axiom subset_refl : forall {a:Type} {a_WT:WhyType a}, forall (s:(set a)), (subset s s). Axiom subset_trans : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)) (s3:(set a)), (subset s1 s2) -> ((subset s2 s3) -> (subset s1 s3)). Parameter empty: forall {a:Type} {a_WT:WhyType a}, (set a). (* Why3 assumption *) Definition is_empty {a:Type} {a_WT:WhyType a}(s:(set a)): Prop := forall (x:a), ~ (mem x s). Axiom empty_def1 : forall {a:Type} {a_WT:WhyType a}, (is_empty (empty :(set a))). Axiom mem_empty : forall {a:Type} {a_WT:WhyType a}, forall (x:a), ~ (mem x (empty :(set a))). Parameter add: forall {a:Type} {a_WT:WhyType a}, a -> (set a) -> (set a). Axiom add_def1 : forall {a:Type} {a_WT:WhyType a}, forall (x:a) (y:a), forall (s:(set a)), (mem x (add y s)) <-> ((x = y) \/ (mem x s)). Parameter remove: forall {a:Type} {a_WT:WhyType a}, a -> (set a) -> (set a). Axiom remove_def1 : forall {a:Type} {a_WT:WhyType a}, forall (x:a) (y:a) (s:(set a)), (mem x (remove y s)) <-> ((~ (x = y)) /\ (mem x s)). Axiom subset_remove : forall {a:Type} {a_WT:WhyType a}, forall (x:a) (s:(set a)), (subset (remove x s) s). Parameter union: forall {a:Type} {a_WT:WhyType a}, (set a) -> (set a) -> (set a). Axiom union_def1 : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)) (x:a), (mem x (union s1 s2)) <-> ((mem x s1) \/ (mem x s2)). Parameter inter: forall {a:Type} {a_WT:WhyType a}, (set a) -> (set a) -> (set a). Axiom inter_def1 : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)) (x:a), (mem x (inter s1 s2)) <-> ((mem x s1) /\ (mem x s2)). Parameter diff: forall {a:Type} {a_WT:WhyType a}, (set a) -> (set a) -> (set a). Axiom diff_def1 : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)) (x:a), (mem x (diff s1 s2)) <-> ((mem x s1) /\ ~ (mem x s2)). Axiom subset_diff : forall {a:Type} {a_WT:WhyType a}, forall (s1:(set a)) (s2:(set a)), (subset (diff s1 s2) s1). Parameter choose: forall {a:Type} {a_WT:WhyType a}, (set a) -> a. Axiom choose_def : forall {a:Type} {a_WT:WhyType a}, forall (s:(set a)), (~ (is_empty s)) -> (mem (choose s) s). Parameter cardinal: forall {a:Type} {a_WT:WhyType a}, (set a) -> Z.