# Theory Err

(*  Title:      HOL/MicroJava/BV/Err.thy
Author:     Tobias Nipkow

The error type.
*)

section ‹The Error Type›

theory Err
imports Semilat
begin

datatype 'a err = Err | OK 'a

type_synonym 'a ebinop = "'a  'a  'a err"
type_synonym 'a esl = "'a set × 'a ord × 'a ebinop"

primrec ok_val :: "'a err  'a"
where
"ok_val (OK x) = x"

definition lift :: "('a  'b err)  ('a err  'b err)"
where
"lift f e = (case e of Err  Err | OK x  f x)"

definition lift2 :: "('a  'b  'c err)  'a err  'b err  'c err"
where
"lift2 f e1 e2 =
(case e1 of Err   Err | OK x  (case e2 of Err  Err | OK y  f x y))"

definition le :: "'a ord  'a err ord"
where
"le r e1 e2 =
(case e2 of Err  True | OK y  (case e1 of Err  False | OK x  x ⊑⇩r y))"

definition sup :: "('a  'b  'c)  ('a err  'b err  'c err)"
where
"sup f = lift2 (λx y. OK (x ⊔⇩f y))"

definition err :: "'a set  'a err set"
where
"err A = insert Err {OK x|x. xA}"

definition esl :: "'a sl  'a esl"
where
"esl = (λ(A,r,f). (A, r, λx y. OK(f x y)))"

definition sl :: "'a esl  'a err sl"
where
"sl = (λ(A,r,f). (err A, le r, lift2 f))"

abbreviation
err_semilat :: "'a esl  bool" where
"err_semilat L == semilat(sl L)"

primrec strict  :: "('a  'b err)  ('a err  'b err)"
where
"strict f Err    = Err"
| "strict f (OK x) = f x"

lemma err_def':
"err A = insert Err {x. yA. x = OK y}"
(*<*)
proof -
have eq: "err A = insert Err {x. yA. x = OK y}"
by (unfold err_def) blast
show "err A = insert Err {x. yA. x = OK y}" by (simp add: eq)
qed
(*>*)

lemma strict_Some [simp]:
"(strict f x = OK y) = (z. x = OK z  f z = OK y)"
(*<*) by (cases x, auto) (*>*)

lemma not_Err_eq: "(x  Err) = (a. x = OK a)"
(*<*) by (cases x) auto (*>*)

lemma not_OK_eq: "(y. x  OK y) = (x = Err)"
(*<*) by (cases x) auto   (*>*)

lemma unfold_lesub_err: "e1 ⊑⇘le re2 = le r e1 e2"
(*<*) by (simp add: lesub_def) (*>*)

lemma le_err_refl: "x. x ⊑⇩r x  e ⊑⇘le re"
(*<*)
apply (unfold lesub_def le_def)
apply (simp split: err.split)
done
(*>*)

lemma le_err_refl': "(xA. x ⊑⇩r x)  e  err A   e ⊑⇘le re"
(*<*)
apply (unfold lesub_def le_def err_def)
apply (auto  split: err.split)
done

lemma le_err_trans [rule_format]:
"order r A  e1  err A  e2  err A  e3  err  A  e1 ⊑⇘le re2  e2 ⊑⇘le re3  e1 ⊑⇘le re3"
(*<*)
apply (unfold unfold_lesub_err le_def err_def)
apply (simp split: err.split)
apply (blast intro: order_trans)
done
(*>*)

lemma le_err_antisym [rule_format]:
"order r A  e1  err A  e2  err A  e3  err A  e1 ⊑⇘le re2  e2 ⊑⇘le re1  e1=e2"
(*<*)
apply (unfold unfold_lesub_err le_def err_def)
apply (simp split: err.split)
apply (blast intro: order_antisym)
done
(*>*)

lemma OK_le_err_OK: "(OK x ⊑⇘le rOK y) = (x ⊑⇩r y)"
(*<*) by (simp add: unfold_lesub_err le_def) (*>*)

lemma order_le_err [iff]: "order (le r) (err A) = order r A"
(*<*)
apply (rule iffI)
apply (subst order_def)
apply (simp only: err_def)
apply (blast dest: order_antisym OK_le_err_OK [THEN iffD2]
intro: order_trans OK_le_err_OK [THEN iffD1])
apply (subst order_def)
apply (blast intro: le_err_refl' le_err_trans le_err_antisym
dest: order_refl)
done
(*>*)

lemma le_Err [iff]: "e ⊑⇘le rErr"
(*<*) by (simp add: unfold_lesub_err le_def) (*>*)

lemma Err_le_conv [iff]: "Err ⊑⇘le re  = (e = Err)"
(*<*) by (simp add: unfold_lesub_err le_def  split: err.split) (*>*)

lemma le_OK_conv [iff]: "e ⊑⇘le rOK x  =  (y. e = OK y  y ⊑⇩r x)"
(*<*) by (simp add: unfold_lesub_err le_def split: err.split) (*>*)

lemma OK_le_conv: "OK x ⊑⇘le re = (e = Err  (y. e = OK y  x ⊑⇩r y))"
(*<*) by (simp add: unfold_lesub_err le_def split: err.split) (*>*)

lemma top_Err [iff]: "top (le r) Err"
(*<*) by (simp add: top_def) (*>*)

lemma OK_less_conv [rule_format, iff]:
"OK x ⊏⇘le re = (e=Err  (y. e = OK y  x ⊏⇩r y))"
(*<*) by (simp add: lesssub_def lesub_def le_def split: err.split) (*>*)

lemma not_Err_less [rule_format, iff]: "¬(Err ⊏⇘le rx)"
(*<*) by (simp add: lesssub_def lesub_def le_def split: err.split) (*>*)

lemma semilat_errI [intro]: assumes "Semilat A r f"
shows "semilat(err A, le r, lift2(λx y. OK(f x y)))"
(*<*)
proof -
interpret Semilat A r f by fact
show ?thesis
apply(insert semilat)
apply (simp only: semilat_Def closed_def plussub_def lesub_def
lift2_def le_def)
apply(rule conjI)
apply simp
apply (simp add: err_def' split: err.split)
done
qed
(*>*)

lemma err_semilat_eslI_aux:
assumes "Semilat A r f" shows "err_semilat(esl(A,r,f))"
(*<*)
proof -
interpret Semilat A r f by fact
show ?thesis
apply (unfold sl_def esl_def)
apply (simp add: semilat_errI [OF Semilat A r f])
done
qed
(*>*)

lemma err_semilat_eslI [intro, simp]:
"semilat L  err_semilat (esl L)"
(*<*) apply (cases L) apply simp
apply (drule Semilat.intro)
done (*>*)

lemma acc_err [simp, intro!]:  "acc r  acc(le r)"
(*<*)
apply (unfold acc_def lesub_def le_def lesssub_def)
apply (simp add: wf_eq_minimal split: err.split)
apply clarify
apply (case_tac "Err : Q")
apply blast
apply (erule_tac x = "{a . OK a : Q}" in allE)
apply (case_tac "x")
apply fast
apply blast
done
(*>*)

lemma Err_in_err [iff]: "Err : err A"
(*<*) by (simp add: err_def') (*>*)

lemma Ok_in_err [iff]: "(OK x  err A) = (xA)"
(*<*) by (auto simp add: err_def') (*>*)

subsection ‹lift›

lemma lift_in_errI:
" e  err S; xS. e = OK x  f x  err S   lift f e  err S"
(*<*)
apply (unfold lift_def)
apply (simp split: err.split)
apply blast
done
(*>*)

lemma Err_lift2 [simp]: "Err ⊔⇘lift2 fx = Err"
(*<*) by (simp add: lift2_def plussub_def) (*>*)

lemma lift2_Err [simp]: "x ⊔⇘lift2 fErr = Err"
(*<*) by (simp add: lift2_def plussub_def split: err.split) (*>*)

lemma OK_lift2_OK [simp]: "OK x ⊔⇘lift2 fOK y = x ⊔⇩f y"
(*<*) by (simp add: lift2_def plussub_def split: err.split) (*>*)

subsection ‹sup›

lemma Err_sup_Err [simp]: "Err ⊔⇘sup fx = Err"
(*<*) by (simp add: plussub_def sup_def lift2_def) (*>*)

lemma Err_sup_Err2 [simp]: "x ⊔⇘sup fErr = Err"
(*<*) by (simp add: plussub_def sup_def lift2_def split: err.split) (*>*)

lemma Err_sup_OK [simp]: "OK x ⊔⇘sup fOK y = OK (x ⊔⇩f y)"
(*<*) by (simp add: plussub_def sup_def lift2_def) (*>*)

lemma Err_sup_eq_OK_conv [iff]:
"(sup f ex ey = OK z) = (x y. ex = OK x  ey = OK y  f x y = z)"
(*<*)
apply (unfold sup_def lift2_def plussub_def)
apply (rule iffI)
apply (simp split: err.split_asm)
apply clarify
apply simp
done
(*>*)

lemma Err_sup_eq_Err [iff]: "(sup f ex ey = Err) = (ex=Err  ey=Err)"
(*<*)
apply (unfold sup_def lift2_def plussub_def)
apply (simp split: err.split)
done
(*>*)

subsection ‹semilat (err A) (le r) f›

lemma semilat_le_err_Err_plus [simp]:
" x err A; semilat(err A, le r, f)   Err ⊔⇩f x = Err"
(*<*) by (blast intro: Semilat.le_iff_plus_unchanged [THEN iffD1, OF Semilat.intro]
Semilat.le_iff_plus_unchanged2 [THEN iffD1, OF Semilat.intro]) (*>*)

lemma semilat_le_err_plus_Err [simp]:
" x err A; semilat(err A, le r, f)   x ⊔⇩f Err = Err"
(*<*) by (blast intro: Semilat.le_iff_plus_unchanged [THEN iffD1, OF Semilat.intro]
Semilat.le_iff_plus_unchanged2 [THEN iffD1, OF Semilat.intro]) (*>*)

lemma semilat_le_err_OK1:
" xA; yA; semilat(err A, le r, f); OK x ⊔⇩f OK y = OK z
x ⊑⇩r z"
(*<*)
apply (rule OK_le_err_OK [THEN iffD1])
apply (erule subst)
apply (simp add: Semilat.ub1 [OF Semilat.intro])
done
(*>*)

lemma semilat_le_err_OK2:
" xA; yA; semilat(err A, le r, f); OK x ⊔⇩f OK y = OK z
y ⊑⇩r z"
(*<*)
apply (rule OK_le_err_OK [THEN iffD1])
apply (erule subst)
apply (simp add: Semilat.ub2 [OF Semilat.intro])
done
(*>*)

lemma eq_order_le:
" x=y; order r A; x A ; y  A   x ⊑⇩r y"
(*<*)
apply (unfold order_def)
apply blast
done
(*>*)

lemma OK_plus_OK_eq_Err_conv [simp]:
assumes "xA"  "yA"  "semilat(err A, le r, fe)"
shows "(OK x ⊔⇘feOK y = Err) = (¬(zA. x ⊑⇩r z  y ⊑⇩r z))"
(*<*)
proof -
have plus_le_conv3: "A x y z f r.
semilat (A,r,f); x ⊔⇩f y ⊑⇩r z; xA; yA; zA
x ⊑⇩r z  y ⊑⇩r z"
(*<*) by (rule Semilat.plus_le_conv [OF Semilat.intro, THEN iffD1]) (*>*)
from assms show ?thesis
apply (rule_tac iffI)
apply clarify
apply (drule OK_le_err_OK [THEN iffD2])
apply (drule OK_le_err_OK [THEN iffD2])
apply (drule Semilat.lub[OF Semilat.intro, of _ _ _ "OK x" _ "OK y"])
apply assumption
apply assumption
apply simp
apply simp
apply simp
apply simp
apply (case_tac "OK x ⊔⇘feOK y")
apply assumption
apply (rename_tac z)
apply (subgoal_tac "OK z err A")
apply (drule eq_order_le)
apply (erule Semilat.orderI [OF Semilat.intro])
apply (blast intro: Semilat.closedI [OF Semilat.intro] closedD)
apply simp
apply (blast dest: plus_le_conv3)
apply (erule subst)
apply (blast intro: Semilat.closedI [OF Semilat.intro] closedD)
done
qed
(*>*)

subsection ‹semilat (err(Union AS))›

(* FIXME? *)
lemma all_bex_swap_lemma [iff]:
"(x. (yA. x = f y)  P x) = (yA. P(f y))"
(*<*) by blast (*>*)

lemma closed_err_Union_lift2I:
" AAS. closed (err A) (lift2 f); AS  {};
AAS.BAS. AB  (aA.bB. a ⊔⇩f b = Err)
closed (err(Union AS)) (lift2 f)"
(*<*)
apply (unfold closed_def err_def')
apply simp
apply clarify
apply simp
apply fast
done
(*>*)

text ‹
If @{term "AS = {}"} the thm collapses to
@{prop "order r A  closed {Err} f  Err ⊔⇩f Err = Err"}
which may not hold
›

lemma err_semilat_UnionI_auxi:
assumes "AAS. order r A "
and "AAS. BAS. A  B  (aA. bB. ¬ a ⊑⇘rb  a ⊔⇘fb = Err)"
shows "order r ( AS)"
proof-
from assms(1) have "A. A  AS  order r A" by auto
then have "A x. A  AS  x  A  x ⊑⇩r x"
and g1: "A x y. A  AS  x  A  y  A x ⊑⇩r y  y ⊑⇩r x  x=y"
and g2: "A x y z. A  AS  x  A  y  A z  A x ⊑⇩r y  y ⊑⇩r z  x ⊑⇩r z"  by (auto dest:order_antisym order_trans)
then have "x( AS). x ⊑⇩r x" by blast
moreover from g1 have "x( AS). y( AS). x ⊑⇩r y  y ⊑⇩r x  x=y" using assms(2) by blast
moreover from g2 have "x( AS). y( AS). z( AS). x ⊑⇩r y  y ⊑⇩r z  x ⊑⇩r z" using assms(2) by blast
ultimately show "order r ( AS)" using order_def by blast
qed

lemma err_semilat_UnionI:
" AAS. err_semilat(A, r, f); AS  {};
AAS.BAS. AB  (aA.bB. ¬a ⊑⇩r b  a ⊔⇩f b = Err)
err_semilat(Union AS, r, f)"
(*<*)
apply (unfold semilat_def sl_def)
apply (rule conjI)
apply (blast intro: err_semilat_UnionI_auxi)
apply (rule conjI)
apply clarify
apply (rename_tac A a u B b)
apply (case_tac "A = B")
apply simp
apply simp
apply (rule conjI)
apply clarify
apply (rename_tac A a u B b)
apply (case_tac "A = B")
apply simp
apply simp
apply clarify
apply (rename_tac A ya yb B yd z C c a b)
apply (case_tac "A = B")
apply (case_tac "A = C")
apply simp
apply simp
apply (case_tac "B = C")
apply simp
apply simp
done
(*>*)

end