completed proof session for library array

in particular, consistency of ArrayPermut is now ensured
parent 87354afa
This source diff could not be displayed because it is too large. You can view the blob instead.
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
This diff is collapsed.
This source diff could not be displayed because it is too large. You can view the blob instead.
This diff is collapsed.
(* This file is generated by Why3's Coq 8.4 driver *)
(* Beware! Only edit allowed sections below *)
Require Import BuiltIn.
Require BuiltIn.
Require int.Int.
Require map.Map.
Require map.Occ.
Require map.MapPermut.
(* Why3 assumption *)
Definition unit := unit.
(* Why3 assumption *)
Inductive array
(a:Type) {a_WT:WhyType a} :=
| mk_array : Z -> (@map.Map.map Z _ a a_WT) -> array a.
Axiom array_WhyType : forall (a:Type) {a_WT:WhyType a}, WhyType (array a).
Existing Instance array_WhyType.
Implicit Arguments mk_array [[a] [a_WT]].
(* Why3 assumption *)
Definition elts {a:Type} {a_WT:WhyType a} (v:(@array a a_WT)): (@map.Map.map
Z _ a a_WT) := match v with
| (mk_array x x1) => x1
end.
(* Why3 assumption *)
Definition length {a:Type} {a_WT:WhyType a} (v:(@array a a_WT)): Z :=
match v with
| (mk_array x x1) => x
end.
(* Why3 assumption *)
Definition get {a:Type} {a_WT:WhyType a} (a1:(@array a a_WT)) (i:Z): a :=
(map.Map.get (elts a1) i).
(* Why3 assumption *)
Definition set {a:Type} {a_WT:WhyType a} (a1:(@array a a_WT)) (i:Z)
(v:a): (@array a a_WT) := (mk_array (length a1) (map.Map.set (elts a1) i
v)).
(* Why3 assumption *)
Definition make {a:Type} {a_WT:WhyType a} (n:Z) (v:a): (@array a a_WT) :=
(mk_array n (map.Map.const v: (@map.Map.map Z _ a a_WT))).
(* Why3 assumption *)
Definition map_eq_sub {a:Type} {a_WT:WhyType a} (a1:(@map.Map.map Z _
a a_WT)) (a2:(@map.Map.map Z _ a a_WT)) (l:Z) (u:Z): Prop := forall (i:Z),
((l <= i)%Z /\ (i < u)%Z) -> ((map.Map.get a1 i) = (map.Map.get a2 i)).
(* Why3 assumption *)
Definition array_eq_sub {a:Type} {a_WT:WhyType a} (a1:(@array a a_WT))
(a2:(@array a a_WT)) (l:Z) (u:Z): Prop := ((length a1) = (length a2)) /\
(((0%Z <= l)%Z /\ (l <= (length a1))%Z) /\ (((0%Z <= u)%Z /\
(u <= (length a1))%Z) /\ (map_eq_sub (elts a1) (elts a2) l u))).
(* Why3 assumption *)
Definition array_eq {a:Type} {a_WT:WhyType a} (a1:(@array a a_WT))
(a2:(@array a a_WT)): Prop := ((length a1) = (length a2)) /\ (map_eq_sub
(elts a1) (elts a2) 0%Z (length a1)).
(* Why3 assumption *)
Definition exchange {a:Type} {a_WT:WhyType a} (a1:(@map.Map.map Z _ a a_WT))
(a2:(@map.Map.map Z _ a a_WT)) (l:Z) (u:Z) (i:Z) (j:Z): Prop :=
((l <= i)%Z /\ (i < u)%Z) /\ (((l <= j)%Z /\ (j < u)%Z) /\
(((map.Map.get a1 i) = (map.Map.get a2 j)) /\ (((map.Map.get a1
j) = (map.Map.get a2 i)) /\ forall (k:Z), ((l <= k)%Z /\ (k < u)%Z) ->
((~ (k = i)) -> ((~ (k = j)) -> ((map.Map.get a1 k) = (map.Map.get a2
k))))))).
Axiom exchange_set : forall {a:Type} {a_WT:WhyType a},
forall (a1:(@map.Map.map Z _ a a_WT)) (l:Z) (u:Z) (i:Z) (j:Z),
((l <= i)%Z /\ (i < u)%Z) -> (((l <= j)%Z /\ (j < u)%Z) -> (exchange a1
(map.Map.set (map.Map.set a1 i (map.Map.get a1 j)) j (map.Map.get a1 i)) l
u i j)).
(* Why3 assumption *)
Definition exchange1 {a:Type} {a_WT:WhyType a} (a1:(@array a a_WT))
(a2:(@array a a_WT)) (i:Z) (j:Z): Prop := ((length a1) = (length a2)) /\
(exchange (elts a1) (elts a2) 0%Z (length a1) i j).
(* Why3 assumption *)
Definition permut {a:Type} {a_WT:WhyType a} (a1:(@array a a_WT)) (a2:(@array
a a_WT)) (l:Z) (u:Z): Prop := ((length a1) = (length a2)) /\
(((0%Z <= l)%Z /\ (l <= (length a1))%Z) /\ (((0%Z <= u)%Z /\
(u <= (length a1))%Z) /\ (map.MapPermut.permut (elts a1) (elts a2) l u))).
(* Why3 assumption *)
Definition permut_sub {a:Type} {a_WT:WhyType a} (a1:(@array a a_WT))
(a2:(@array a a_WT)) (l:Z) (u:Z): Prop := (map_eq_sub (elts a1) (elts a2)
0%Z l) /\ ((permut a1 a2 l u) /\ (map_eq_sub (elts a1) (elts a2) u
(length a1))).
(* Why3 assumption *)
Definition permut_all {a:Type} {a_WT:WhyType a} (a1:(@array a a_WT))
(a2:(@array a a_WT)): Prop := ((length a1) = (length a2)) /\
(map.MapPermut.permut (elts a1) (elts a2) 0%Z (length a1)).
(* Why3 goal *)
Theorem exchange_permut_sub : forall {a:Type} {a_WT:WhyType a},
forall (a1:(@array a a_WT)) (a2:(@array a a_WT)) (i:Z) (j:Z) (l:Z) (u:Z),
(exchange1 a1 a2 i j) -> (((l <= i)%Z /\ (i < u)%Z) -> (((l <= j)%Z /\
(j < u)%Z) -> ((0%Z <= l)%Z -> ((u <= (length a1))%Z -> (permut_sub a1 a2 l
u))))).
intros a a_WT a1 a2 i j l u h1 (h2,h3) (h4,h5) h6 h7.
destruct h1 as (h11,h12).
destruct h12 as (ha,(hb,(hc,(hd,he)))).
red. repeat split.
(* eq_sub *)
red. intros. apply he; omega.
assumption. assumption. omega. omega. assumption.
(* permut *)
red. intro v.
assert (Occ.occ v (elts a1) i (i+1) + Occ.occ v (elts a1) j (j+1)
= Occ.occ v (elts a2) i (i+1) + Occ.occ v (elts a2) j (j+1))%Z.
destruct (why_decidable_eq (Map.get (elts a1) i) v).
rewrite Occ.occ_right_add. 2: omega. 2: ring_simplify (i+1-1)%Z; assumption.
rewrite (Occ.occ_right_add v (elts a2) j). 2: omega.
2: ring_simplify (j+1-1)%Z; rewrite <- hc; assumption.
ring_simplify (i+1-1)%Z. ring_simplify (j+1-1)%Z.
rewrite Occ.occ_empty. 2: omega. rewrite (Occ.occ_empty v (elts a2) j). 2: omega.
destruct (why_decidable_eq (Map.get (elts a1) j) v).
rewrite Occ.occ_right_add. 2: omega. 2: ring_simplify (j+1-1)%Z; assumption.
rewrite (Occ.occ_right_add v (elts a2) i). 2: omega.
2: ring_simplify (i+1-1)%Z; rewrite <- hd; assumption.
ring_simplify (i+1-1)%Z. ring_simplify (j+1-1)%Z.
rewrite Occ.occ_empty. 2: omega. rewrite (Occ.occ_empty v (elts a2) i). 2: omega.
ring.
rewrite Occ.occ_right_no_add. 2: omega. 2: ring_simplify (j+1-1)%Z; assumption.
rewrite (Occ.occ_right_no_add v (elts a2) i). 2: omega.
2: ring_simplify (i+1-1)%Z; rewrite <- hd; assumption.
ring_simplify (i+1-1)%Z. ring_simplify (j+1-1)%Z.
rewrite Occ.occ_empty. 2: omega. rewrite (Occ.occ_empty v (elts a2) i). 2: omega.
ring.
rewrite Occ.occ_right_no_add. 2: omega. 2: ring_simplify (i+1-1)%Z; assumption.
rewrite (Occ.occ_right_no_add v (elts a2) j). 2: omega.
2: ring_simplify (j+1-1)%Z; rewrite <- hc; assumption.
rewrite Occ.occ_empty. 2: omega. rewrite (Occ.occ_empty v (elts a2) j). 2: omega.
destruct (why_decidable_eq (Map.get (elts a1) j) v).
rewrite Occ.occ_right_add. 2: omega. 2: ring_simplify (j+1-1)%Z; assumption.
rewrite (Occ.occ_right_add v (elts a2) i). 2: omega.
2: ring_simplify (i+1-1)%Z; rewrite <- hd; assumption.
ring_simplify (i+1-1)%Z. ring_simplify (j+1-1)%Z.
rewrite Occ.occ_empty. 2: omega. rewrite (Occ.occ_empty v (elts a2) i). 2: omega.
ring.
rewrite Occ.occ_right_no_add. 2: omega. 2: ring_simplify (j+1-1)%Z; assumption.
rewrite (Occ.occ_right_no_add v (elts a2) i). 2: omega.
2: ring_simplify (i+1-1)%Z; rewrite <- hd; assumption.
ring_simplify (i+1-1)%Z. ring_simplify (j+1-1)%Z.
rewrite Occ.occ_empty. 2: omega. rewrite (Occ.occ_empty v (elts a2) i). 2: omega.
ring.
assert (c: (i < j \/ i = j \/ j < i)%Z) by omega. destruct c as [c|c].
(* i < j *)
assert (Occ.occ v (elts a1) l u = Occ.occ v (elts a1) l i + Occ.occ v (elts a1) i u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a1) i u = Occ.occ v (elts a1) i (i+1) + Occ.occ v (elts a1) (i+1) u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a1) (i+1) u = Occ.occ v (elts a1) (i+1) j + Occ.occ v (elts a1) j u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a1) j u = Occ.occ v (elts a1) j (j+1) + Occ.occ v (elts a1) (j+1) u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a2) l u = Occ.occ v (elts a2) l i + Occ.occ v (elts a2) i u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a2) i u = Occ.occ v (elts a2) i (i+1) + Occ.occ v (elts a2) (i+1) u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a2) (i+1) u = Occ.occ v (elts a2) (i+1) j + Occ.occ v (elts a2) j u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a2) j u = Occ.occ v (elts a2) j (j+1) + Occ.occ v (elts a2) (j+1) u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a1) l i = Occ.occ v (elts a2) l i).
apply Occ.occ_eq. intros. apply he; omega.
assert (Occ.occ v (elts a1) (i+1) j = Occ.occ v (elts a2) (i+1) j).
apply Occ.occ_eq. intros; apply he; omega.
assert (Occ.occ v (elts a1) (j+1) u = Occ.occ v (elts a2) (j+1) u).
apply Occ.occ_eq. intros; apply he; omega.
omega.
(* i = j *)
destruct c.
subst j.
apply Occ.occ_eq.
intros k hk.
assert (c: (k=i \/ k <>i)%Z) by omega. destruct c.
subst k. assumption.
apply he. omega. assumption. assumption.
(* j < i *)
assert (Occ.occ v (elts a1) l u = Occ.occ v (elts a1) l j + Occ.occ v (elts a1) j u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a1) j u = Occ.occ v (elts a1) j (j+1) + Occ.occ v (elts a1) (j+1) u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a1) (j+1) u = Occ.occ v (elts a1) (j+1) i + Occ.occ v (elts a1) i u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a1) i u = Occ.occ v (elts a1) i (i+1) + Occ.occ v (elts a1) (i+1) u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a2) l u = Occ.occ v (elts a2) l j + Occ.occ v (elts a2) j u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a2) j u = Occ.occ v (elts a2) j (j+1) + Occ.occ v (elts a2) (j+1) u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a2) (j+1) u = Occ.occ v (elts a2) (j+1) i + Occ.occ v (elts a2) i u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a2) i u = Occ.occ v (elts a2) i (i+1) + Occ.occ v (elts a2) (i+1) u)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a1) l j = Occ.occ v (elts a2) l j).
apply Occ.occ_eq. intros. apply he; omega.
assert (Occ.occ v (elts a1) (j+1) i = Occ.occ v (elts a2) (j+1) i).
apply Occ.occ_eq. intros; apply he; omega.
assert (Occ.occ v (elts a1) (i+1) u = Occ.occ v (elts a2) (i+1) u).
apply Occ.occ_eq. intros; apply he; omega.
omega.
(* eq_sub *)
red. intros. apply he; omega.
Qed.
......@@ -96,52 +96,54 @@ Definition permut_all {a:Type} {a_WT:WhyType a} (a1:(@array a a_WT))
(a2:(@array a a_WT)): Prop := ((length a1) = (length a2)) /\
(map.MapPermut.permut (elts a1) (elts a2) 0%Z (length a1)).
(* Require Import Why3. Ltac ae := why3 "Alt-Ergo,0.95.2," timelimit 3. *)
(* Why3 goal *)
Theorem exchange_permut_sub : forall {a:Type} {a_WT:WhyType a},
Axiom exchange_permut_sub : forall {a:Type} {a_WT:WhyType a},
forall (a1:(@array a a_WT)) (a2:(@array a a_WT)) (i:Z) (j:Z) (l:Z) (u:Z),
(exchange1 a1 a2 i j) -> (((l <= i)%Z /\ (i < u)%Z) -> (((l <= j)%Z /\
(j < u)%Z) -> ((0%Z <= l)%Z -> ((u <= (length a1))%Z -> (permut_sub a1 a2 l
u))))).
(* Why3 intros a a_WT a1 a2 i j l u h1 (h2,h3) (h4,h5) h6 h7. *)
intros a a_WT a1 a2 i j l u h1 (h2,h3) (h4,h5) h6 h7.
destruct h1 as (h11,h12).
destruct h12 as (ha,(hb,(hc,(hd,he)))).
red. repeat split.
(* eq_sub *)
red. intros. apply he; omega.
assumption. assumption. omega. omega. assumption.
(* Why3 goal *)
Theorem permut_sub_weakening : forall {a:Type} {a_WT:WhyType a},
forall (a1:(@array a a_WT)) (a2:(@array a a_WT)) (l1:Z) (u1:Z) (l2:Z)
(u2:Z), (permut_sub a1 a2 l1 u1) -> (((0%Z <= l2)%Z /\ (l2 <= l1)%Z) ->
(((u1 <= u2)%Z /\ (u2 <= (length a1))%Z) -> (permut_sub a1 a2 l2 u2))).
(* Why3 intros a a_WT a1 a2 l1 u1 l2 u2 h1 (h2,h3) (h4,h5). *)
intros a a_WT a1 a2 l1 u1 l2 u2 h1 (h2,h3) (h4,h5).
unfold permut_sub in *.
destruct h1 as (eql,(h1,eqr)).
unfold map_eq_sub in *.
split.
(* eq left *)
intros. apply eql; omega.
split.
(* permut *)
red. intro v.
assert (c: (i < j \/ i = j \/ j < i)%Z) by omega. destruct c as [c|c].
(* i < j *)
assert (Occ.occ v (elts a1) l u = Occ.occ v (elts a1) l i + Occ.occ v (elts a1) i u)%Z.
unfold permut in *.
destruct h1 as (h1,(h1a,(h1b,h1c))).
repeat split; try assumption. omega. omega.
unfold MapPermut.permut in *.
intros v.
assert (c: (l1 <= u1 \/ u1 < l1)%Z) by omega. destruct c.
(* l1 <= u1 *)
assert (Occ.occ v (elts a1) l2 u2 = Occ.occ v (elts a1) l2 l1 + Occ.occ v (elts a1) l1 u2)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a1) i u = Occ.occ v (elts a1) i (i+1) + Occ.occ v (elts a1) (i+1) u)%Z.
assert (Occ.occ v (elts a1) l1 u2 = Occ.occ v (elts a1) l1 u1 + Occ.occ v (elts a1) u1 u2)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a1) (i+1) u = Occ.occ v (elts a1) (i+1) j + Occ.occ v (elts a1) j u)%Z.
assert (Occ.occ v (elts a2) l2 u2 = Occ.occ v (elts a2) l2 l1 + Occ.occ v (elts a2) l1 u2)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a1) j u = Occ.occ v (elts a1) j (j+1) + Occ.occ v (elts a1) (j+1) u)%Z.
assert (Occ.occ v (elts a2) l1 u2 = Occ.occ v (elts a2) l1 u1 + Occ.occ v (elts a2) u1 u2)%Z.
apply Occ.occ_append. omega.
assert (Occ.occ v (elts a1) l i = Occ.occ v (elts a2) l i).
apply Occ.occ_eq. intros. apply he; omega.
admit. (*TODO*)
(* i = j *)
destruct c.
subst j.
assert (Occ.occ v (elts a1) l2 l1 = Occ.occ v (elts a2) l2 l1).
apply Occ.occ_eq. intros; apply eql; omega.
assert (Occ.occ v (elts a1) u1 u2 = Occ.occ v (elts a2) u1 u2).
apply Occ.occ_eq. intros; apply eqr; omega.
generalize (h1c v); omega.
(* u1 < l1 *)
apply Occ.occ_eq.
intros k hk.
assert (c: (k=i \/ k <>i)%Z) by omega. destruct c.
subst k. assumption.
apply he. omega. assumption. assumption.
(* j < i *)
admit. (*TODO*)
(* eq_sub *)
red. intros. apply he; omega.
intros i hi.
assert (c: (i < l1 \/ u1 <= i)%Z) by omega. destruct c.
apply eql; omega.
apply eqr; omega.
(* eq right *)
intros; apply eqr; omega.
Qed.
This diff is collapsed.
......@@ -199,12 +199,6 @@ module ArrayPermut
permut_sub a1 a2 l1 u1 -> 0 <= l2 <= l1 -> u1 <= u2 <= length a1 ->
permut_sub a1 a2 l2 u2
lemma permut_sub_compose:
forall a1 a2 a3: array 'a, l1 u1 l2 u2: int. u1 <= l2 ->
permut_sub a1 a2 l1 u1 ->
permut_sub a2 a3 l2 u2 ->
permut_sub a1 a3 l1 u2
(** {3 lemmas about [permut_all]} *)
lemma exchange_permut_all:
......
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE why3session PUBLIC "-//Why3//proof session v2//EN" "http://why3.lri.fr/why3session.dtd">
<why3session shape_version="4">
<prover
id="0"
name="Alt-Ergo"
version="0.95.2"/>
<prover
id="1"
name="CVC3"
version="2.4.1"/>
<prover
id="2"
name="CVC4"
version="1.3"/>
<prover
id="3"
name="Coq"
version="8.4pl2"/>
<prover
id="4"
name="Z3"
version="3.2"/>
<prover
id="5"
name="Z3"
version="4.3.1"/>
<file
name="../array.mlw"
verified="false"
expanded="true">
<theory
name="Array"
locfile="../array.mlw"
loclnum="10" loccnumb="7" loccnume="12"
verified="true"
expanded="false">
<goal
name="WP_parameter defensive_get"
locfile="../array.mlw"
loclnum="40" loccnumb="6" loccnume="19"
expl="VC for defensive_get"
sum="417b50dd6c746afcd074c39a87c22b33"
proved="true"
expanded="false"
shape="iiainfix &lt;V1V0Aainfix &lt;=c0V1Aainfix &lt;V1V0Aainfix &lt;=c0V1ainfix &gt;=V1V0Oainfix &lt;V1c0ainfix &gt;=V1V0ainfix &gt;=V1V0Oainfix &lt;V1c0ainfix &lt;V1c0Iainfix &lt;=c0V0F">
<label
name="expl:VC for defensive_get"/>
<proof
prover="0"
timelimit="6"
memlimit="1000"
obsolete="false"
archived="false">
<result status="valid" time="0.01"/>
</proof>
</goal>
<goal
name="WP_parameter defensive_set"
locfile="../array.mlw"
loclnum="46" loccnumb="6" loccnume="19"
expl="VC for defensive_set"
sum="fa98a75c669382d0f728114285407406"
proved="true"
expanded="false"
shape="iiainfix =asetV1V2V3V4Aainfix &lt;V2V0Aainfix &lt;=c0V2Iainfix =V4asetV1V2V3Aainfix &lt;=c0V0FAainfix &lt;V2V0Aainfix &lt;=c0V2ainfix &gt;=V2V0Oainfix &lt;V2c0ainfix &gt;=V2V0ainfix &gt;=V2V0Oainfix &lt;V2c0ainfix &lt;V2c0Iainfix &lt;=c0V0F">
<label
name="expl:VC for defensive_set"/>
<proof
prover="0"
timelimit="6"
memlimit="1000"
obsolete="false"
archived="false">
<result status="valid" time="0.01"/>
</proof>
</goal>
<goal
name="WP_parameter fill"
locfile="../array.mlw"
loclnum="73" loccnumb="6" loccnume="10"
expl="VC for fill"
sum="66669ba1682a1bf957739087e768c993"
proved="true"
expanded="false"
shape="ainfix =agetV6V7V4Iainfix &lt;V7ainfix +V2V3Aainfix &lt;=V2V7FAainfix =agetV6V8agetV1V8Iainfix &lt;V8V0Aainfix &lt;=ainfix +V2V3V8Oainfix &lt;V8V2Aainfix &lt;=c0V8FAainfix &lt;=c0V0Iainfix =agetV6V9V4Iainfix &lt;V9ainfix +V2ainfix +V5c1Aainfix &lt;=V2V9FAainfix =agetV6V10agetV1V10Iainfix &lt;V10V0Aainfix &lt;=ainfix +V2V3V10Oainfix &lt;V10V2Aainfix &lt;=c0V10FAainfix =agetV13V14V4Iainfix &lt;V14ainfix +V2ainfix +V11c1Aainfix &lt;=V2V14FAainfix =agetV13V15agetV1V15Iainfix &lt;V15V0Aainfix &lt;=ainfix +V2V3V15Oainfix &lt;V15V2Aainfix &lt;=c0V15FIainfix =V13asetV6V12V4Aainfix &lt;=c0V0FAainfix &lt;V12V0Aainfix &lt;=c0V12Aainfix &lt;=c0V0Lainfix +V2V11Iainfix =agetV6V16V4Iainfix &lt;V16ainfix +V2V11Aainfix &lt;=V2V16FAainfix =agetV6V17agetV1V17Iainfix &lt;V17V0Aainfix &lt;=ainfix +V2V3V17Oainfix &lt;V17V2Aainfix &lt;=c0V17FIainfix &lt;=V11V5Aainfix &lt;=c0V11FFAainfix =agetV1V18V4Iainfix &lt;V18ainfix +V2c0Aainfix &lt;=V2V18FIainfix &lt;=c0V5Aainfix =agetV1V19V4Iainfix &lt;V19ainfix +V2V3Aainfix &lt;=V2V19FIainfix &gt;c0V5Lainfix -V3c1Iainfix &lt;=ainfix +V2V3V0Aainfix &lt;=c0V3Aainfix &lt;=c0V2Aainfix &lt;=c0V0F">
<label
name="expl:VC for fill"/>
<proof
prover="0"
timelimit="6"
memlimit="1000"
obsolete="false"
archived="false">
<result status="valid" time="0.03"/>
</proof>
</goal>
</theory>
<theory
name="ArraySorted"
locfile="../array.mlw"
loclnum="114" loccnumb="7" loccnume="18"
verified="true"
expanded="true">
</theory>
<theory
name="ArrayEq"
locfile="../array.mlw"
loclnum="130" loccnumb="7" loccnume="14"
verified="true"
expanded="true">
</theory>
<theory
name="ArrayExchange"
locfile="../array.mlw"
loclnum="145" loccnumb="7" loccnume="20"
verified="true"
expanded="true">
</theory>
<theory
name="ArrayPermut"
locfile="../array.mlw"
loclnum="161" loccnumb="7" loccnume="18"
verified="false"
expanded="true">
<goal
name="exchange_permut_sub"
locfile="../array.mlw"
loclnum="190" loccnumb="8" loccnume="27"
sum="cb24596c6160655798eb2561e3379057"
proved="true"
expanded="true"
shape="apermut_subV0V1V4V5Iainfix &lt;=V5alengthV0Iainfix &lt;=c0V4Iainfix &lt;V3V5Aainfix &lt;=V4V3Iainfix &lt;V2V5Aainfix &lt;=V4V2IaexchangeV0V1V2V3F">
<proof
prover="3"
timelimit="30"
memlimit="1000"
edited="array_ArrayPermut_exchange_permut_sub_1.v"
obsolete="false"
archived="false">
<result status="valid" time="2.07"/>
</proof>
</goal>
<goal
name="permut_sub_weakening"
locfile="../array.mlw"
loclnum="197" loccnumb="8" loccnume="28"
sum="1bc160562527e4713ee7654de1e90377"
proved="false"
expanded="true"
shape="apermut_subV0V1V4V5Iainfix &lt;=V5alengthV0Aainfix &lt;=V3V5Iainfix &lt;=V4V2Aainfix &lt;=c0V4Iapermut_subV0V1V2V3F">
</goal>
<goal
name="permut_sub_compose"
locfile="../array.mlw"
loclnum="202" loccnumb="8" loccnume="26"
sum="136a7250026ea9a04b66c0c2413d542b"
proved="false"
expanded="true"
shape="apermut_subV0V2V3V6Iapermut_subV1V2V5V6Iapermut_subV0V1V3V4Iainfix &lt;=V4V5F">
</goal>
<goal
name="exchange_permut_all"
locfile="../array.mlw"
loclnum="210" loccnumb="8" loccnume="27"
sum="1f3f8188d66a6d0be1e6fcda85a90b38"
proved="true"
expanded="false"
shape="apermut_allV0V1IaexchangeV0V1V2V3F">
<proof
prover="1"
timelimit="6"
memlimit="1000"
obsolete="false"
archived="false">
<result status="valid" time="0.04"/>
</proof>
<proof
prover="2"
timelimit="6"
memlimit="1000"
obsolete="false"
archived="false">
<result status="valid" time="0.28"/>
</proof>
<proof
prover="4"
timelimit="6"
memlimit="1000"
obsolete="false"
archived="false">
<result status="valid" time="0.04"/>
</proof>
<proof
prover="5"
timelimit="6"
memlimit="1000"
obsolete="false"
archived="false">
<result status="valid" time="0.02"/>
</proof>
</goal>
</theory>
<theory
name="ArraySwap"
locfile="../array.mlw"
loclnum="216" loccnumb="7" loccnume="16"
verified="true"
expanded="false">
<goal
name="WP_parameter swap"
locfile="../array.mlw"
loclnum="222" loccnumb="6" loccnume="10"
expl="VC for swap"
sum="5e54f2889debe7787a9278286b940deb"
proved="true"
expanded="false"
shape="aexchangeamk arrayV0V1amk arrayV0V5V2V3Iainfix =V5asetV4V3agetV1V2Aainfix &lt;=c0V0FAainfix &lt;V3V0Aainfix &lt;=c0V3Iainfix =V4asetV1V2agetV1V3Aainfix &lt;=c0V0FAainfix &lt;V2V0Aainfix &lt;=c0V2Aainfix &lt;V3V0Aainfix &lt;=c0V3Aainfix &lt;V2V0Aainfix &lt;=c0V2Iainfix &lt;V3V0Aainfix &lt;=c0V3Aainfix &lt;V2V0Aainfix &lt;=c0V2Aainfix &lt;=c0V0F">
<label
name="expl:VC for swap"/>
<proof
prover="0"
timelimit="6"
memlimit="1000"
obsolete="false"
archived="false">
<result status="valid" time="0.03"/>
</proof>
</goal>
</theory>
<theory
name="ArraySum"
locfile="../array.mlw"
loclnum="234" loccnumb="7" loccnume="15"
verified="true"
expanded="true">
</theory>
<theory
name="NumOfParam"
locfile="../array.mlw"
loclnum="252" loccnumb="7" loccnume="17"
verified="true"
expanded="true">
</theory>
<theory
name="NumOfEq"
locfile="../array.mlw"
loclnum="268" loccnumb="7" loccnume="14"
verified="true"
expanded="true">
</theory>
<theory
name="NumOf"
locfile="../array.mlw"
loclnum="281" loccnumb="7" loccnume="12"
verified="true"
expanded="true">
</theory>
</file>
</why3session>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment