(* Author: David Cock - David.Cock@nicta.com.au *)
section‹Sublinearity›
theory Sublinearity imports Embedding Healthiness LoopInduction begin
subsection‹Nonrecursive Primitives›
text‹Sublinearity of non-recursive programs is generally straightforward, and follows from the
properties of the underlying operations, together with healthiness.›
with slx hy have"a * wp x (wp y P) s + b * wp x (wp y Q) s ⊖ c ≤ wp x (λs. a * wp y P s + b * wp y Q s ⊖ c) s" by(blast intro:sublinearD) also { from sP sQ nna nnb nnc sly have"∧s. a * wp y P s + b * wp y Q s ⊖ c ≤ wp y (λs. a * P s + b * Q s ⊖ c) s" by(blast intro:sublinearD) moreoverfrom sP sQ hy have"sound (wp y P)"and"sound (wp y Q)"by(auto) moreoverwith nna nnb nnc have"sound (λs. a * wp y P s + b * wp y Q s ⊖ c)" by(auto intro!:sound_intros tminus_sound) moreoverfrom sP sQ nna nnb nnc have"sound (λs. a * P s + b * Q s ⊖ c)" by(auto intro!:sound_intros tminus_sound) moreoverwith hy have"sound (wp y (λs. a * P s + b * Q s ⊖ c))" by(blast) ultimately have"wp x (λs. a * wp y P s + b * wp y Q s ⊖ c) s ≤ wp x (wp y (λs. a * P s + b * Q s ⊖ c)) s" by(blast intro!:le_funD[OF mono_transD[OF healthy_monoD[OF hx]]])
} finallyshow"a * wp x (wp y P) s + b * wp x (wp y Q) s ⊖ c ≤ wp x (wp y (λs. a * P s + b * Q s ⊖ c)) s" . qed
have"a * (P s * wp x Q s + (1 - P s) * wp y Q s) + b * (P s * wp x R s + (1 - P s) * wp y R s) ⊖ c = (P s * a * wp x Q s + (1 - P s) * a * wp y Q s) + (P s * b * wp x R s + (1 - P s) * b * wp y R s) ⊖ c" by(simp add:field_simps) also have"... = (P s * a * wp x Q s + P s * b * wp x R s) + ((1 - P s) * a * wp y Q s + (1 - P s) * b * wp y R s) ⊖ c" by(simp add:ac_simps) also have"... = P s * (a * wp x Q s + b * wp x R s) + (1 - P s) * (a * wp y Q s + b * wp y R s) ⊖ (P s * c + (1 - P s) * c)" by(simp add:field_simps) also have"... ≤ (P s * (a * wp x Q s + b * wp x R s) ⊖ P s * c) + ((1 - P s) * (a * wp y Q s + b * wp y R s) ⊖ (1 - P s) * c)" by(rule tminus_add_mono) also { from uP have"0 ≤ P s"and"0 ≤ 1 - P s" by auto hence"(P s * (a * wp x Q s + b * wp x R s) ⊖ P s * c) + ((1 - P s) * (a * wp y Q s + b * wp y R s) ⊖ (1 - P s) * c) = P s * (a * wp x Q s + b * wp x R s ⊖ c) + (1 - P s) * (a * wp y Q s + b * wp y R s ⊖ c)" by(simp add:tminus_left_distrib)
} also { from sQ sR nna nnb nnc slx have"a * wp x Q s + b * wp x R s ⊖ c ≤ wp x (λs. a * Q s + b * R s ⊖ c) s" by(blast) moreover from sQ sR nna nnb nnc sly have"a * wp y Q s + b * wp y R s ⊖ c ≤ wp y (λs. a * Q s + b * R s ⊖ c) s" by(blast) moreover from uP have"0 ≤ P s"and"0 ≤ 1 - P s" by auto ultimately have"P s * (a * wp x Q s + b * wp x R s ⊖ c) + (1 - P s) * (a * wp y Q s + b * wp y R s ⊖ c) ≤ P s * wp x (λs. a * Q s + b * R s ⊖ c) s + (1 - P s) * wp y (λs. a * Q s + b * R s ⊖ c) s" by(blast intro:add_mono mult_left_mono)
} finally show" a * (P s * wp x Q s + (1 - P s) * wp y Q s) + b * (P s * wp x R s + (1 - P s) * wp y R s) ⊖ c ≤ P s * wp x (λs. a * Q s + b * R s ⊖ c) s + (1 - P s) * wp y (λs. a * Q s + b * R s ⊖ c) s" . qed
from nna nnb have"a * min (wp x Q s) (wp y Q s) + b * min (wp x R s) (wp y R s) ⊖ c = min (a * wp x Q s) (a * wp y Q s) + min (b * wp x R s) (b * wp y R s) ⊖ c" by(simp add:min_distrib) also have"... ≤ min (a * wp x Q s + b * wp x R s) (a * wp y Q s + b * wp y R s) ⊖ c" by(auto intro!:tminus_left_mono) also have"... = min (a * wp x Q s + b * wp x R s ⊖ c) (a * wp y Q s + b * wp y R s ⊖ c)" by(rule min_tminus_distrib) also { from slx sQ sR nna nnb nnc have"a * wp x Q s + b * wp x R s ⊖ c ≤ wp x (λs. a * Q s + b * R s ⊖ c) s" by(blast) moreover from sly sQ sR nna nnb nnc have"a * wp y Q s + b * wp y R s ⊖ c ≤ wp y (λs. a * Q s + b * R s ⊖ c) s" by(blast) ultimately have"min (a * wp x Q s + b * wp x R s ⊖ c) (a * wp y Q s + b * wp y R s ⊖ c) ≤ min (wp x (λs. a * Q s + b * R s ⊖ c) s) (wp y (λs. a * Q s + b * R s ⊖ c) s)" by(auto)
} finallyshow"a * min (wp x Q s) (wp y Q s) + b * min (wp x R s) (wp y R s) ⊖ c ≤ min (wp x (λs. a * Q s + b * R s ⊖ c) s) (wp y (λs. a * Q s + b * R s ⊖ c) s)" . qed
text‹As for continuity, we insist on a finite support.› lemma sublinear_wp_SetPC: fixes p::"'a ==> 's prog" assumes slp: "∧s a. a ∈ supp (P s) ==> sublinear (wp (p a))" and sum: "∧s. (∑a∈supp (P s). P s a) ≤ 1" and nnP: "∧s a. 0 ≤ P s a" and fin: "∧s. finite (supp (P s))" shows"sublinear (wp (SetPC p P))" proof(rule sublinearI, simp add:wp_eval) fix R::"'s ==> real"and Q::"'s ==> real"and s::'s and a::real and b::real and c::real assume sR: "sound R"and sQ: "sound Q" and nna: "0 ≤ a"and nnb: "0 ≤ b"and nnc: "0 ≤ c" have"a * (∑a'∈supp (P s). P s a' * wp (p a') Q s) + b * (∑a'∈supp (P s). P s a' * wp (p a') R s) ⊖ c = (∑a'∈supp (P s). P s a' * (a * wp (p a') Q s + b * wp (p a') R s)) ⊖ c" by(simp add:field_simps sum_distrib_left sum.distrib) alsohave"... ≤ (∑a'∈supp (P s). P s a' * (a * wp (p a') Q s + b * wp (p a') R s)) ⊖ (∑a'∈supp (P s). P s a' * c)" proof(rule tminus_right_antimono) have"(∑a'∈supp (P s). P s a' * c) ≤ (∑a'∈supp (P s). P s a') * c" by(simp add:sum_distrib_right) alsofrom sum and nnc have"... ≤ 1 * c" by(rule mult_right_mono) finallyshow"(∑a'∈supp (P s). P s a' * c) ≤ c"by(simp) qed alsofrom fin have"... ≤ (∑a'∈supp (P s). P s a' * (a * wp (p a') Q s + b * wp (p a') R s) ⊖ P s a' * c)" by(blast intro:tminus_sum_mono) alsohave"... = (∑a'∈supp (P s). P s a' * (a * wp (p a') Q s + b * wp (p a') R s ⊖ c))" by(simp add:nnP tminus_left_distrib) also { from slp sQ sR nna nnb nnc have"∧a'. a' ∈ supp (P s) ==> a * wp (p a') Q s + b * wp (p a') R s ⊖ c ≤ wp (p a') (λs. a * Q s + b * R s ⊖ c) s" by(blast) with nnP have"(∑a'∈supp (P s). P s a' * (a * wp (p a') Q s + b * wp (p a') R s ⊖ c)) ≤ (∑a'∈supp (P s). P s a' * wp (p a') (λs. a * Q s + b * R s ⊖ c) s)" by(blast intro:sum_mono mult_left_mono)
} finally show"a * (∑a'∈supp (P s). P s a' * wp (p a') Q s) + b * (∑a'∈supp (P s). P s a' * wp (p a') R s) ⊖ c ≤ (∑a'∈supp (P s). P s a' * wp (p a') (λs. a * Q s + b * R s ⊖ c) s)" . qed
lemma sublinear_wp_SetDC: fixes p::"'a ==> 's prog" assumes slp: "∧s a. a ∈ S s ==> sublinear (wp (p a))" and hp: "∧s a. a ∈ S s ==> healthy (wp (p a))" and ne: "∧s. S s ≠ {}" shows"sublinear (wp (SetDC p S))" proof(rule sublinearI, simp add:wp_eval, rule cInf_greatest) fix P::"'s ==> real"and Q::"'s ==> real"and s::'s and x y and a::real and b::real and c::real assume sP: "sound P"and sQ: "sound Q" and nna: "0 ≤ a"and nnb: "0 ≤ b"and nnc: "0 ≤ c"
from ne show"(λpr. wp (p pr) (λs. a * P s + b * Q s ⊖ c) s) ` S s ≠ {}"by(auto)
assume yin: "y ∈ (λpr. wp (p pr) (λs. a * P s + b * Q s ⊖ c) s) ` S s" thenobtain x where xin: "x ∈ S s"and rwy: "y = wp (p x) (λs. a * P s + b * Q s ⊖ c) s" by(auto)
from xin hp sP nna have"a * Inf ((λa. wp (p a) P s) ` S s) ≤ a * wp (p x) P s" by(intro mult_left_mono[OF cInf_lower] bdd_belowI[where m=0], blast+) moreoverfrom xin hp sQ nnb have"b * Inf ((λa. wp (p a) Q s) ` S s) ≤ b * wp (p x) Q s" by(intro mult_left_mono[OF cInf_lower] bdd_belowI[where m=0], blast+) ultimately have"a * Inf ((λa. wp (p a) P s) ` S s) + b * Inf ((λa. wp (p a) Q s) ` S s) ⊖ c ≤ a * wp (p x) P s + b * wp (p x) Q s ⊖ c" by(blast intro:tminus_left_mono add_mono)
alsofrom xin slp sP sQ nna nnb nnc have"... ≤ wp (p x) (λs. a * P s + b * Q s ⊖ c) s" by(blast)
finallyshow"a * Inf ((λa. wp (p a) P s) ` S s) + b * Inf ((λa. wp (p a) Q s) ` S s) ⊖ c ≤ y" by(simp add:rwy) qed
lemma sublinear_wp_Bind: "[∧s. sublinear (wp (a (f s))) ]==> sublinear (wp (Bind f a))" by(rule sublinearI, simp add:wp_eval, auto)
subsection‹Sublinearity for Loops›
text‹We break the proof of sublinearity loops into separate proofs of sub-distributivity and
-additivity. The first follows by transfinite induction.› lemma sub_distrib_wp_loop: fixes body::"'s prog" assumes sdb: "sub_distrib (wp body)" and hb: "healthy (wp body)" and nhb: "nearly_healthy (wlp body)" shows"sub_distrib (wp (do G ⟶ body od))" proof - have"∀P s. sound P ⟶ wp (do G ⟶ body od) P s ⊖ 1 ≤ wp (do G ⟶ body od) (λs. P s ⊖ 1) s" proof(rule loop_induct[OF hb nhb], safe) fix S::"('s trans × 's trans) set"and P::"'s expect"and s::'s assume saS: "∀x∈S. ∀P s. sound P ⟶ fst x P s ⊖ 1 ≤ fst x (λs. P s ⊖ 1) s" and sP: "sound P" and fS: "∀x∈S. feasible (fst x)"
from sP have sPm: "sound (λs. P s ⊖ 1)"by(auto intro:tminus_sound)
have nnSup: "∧s. 0 ≤ Sup_trans (fst ` S) (λs. P s ⊖ 1) s" proof(cases "S={}", simp add:Sup_trans_def Sup_exp_def) fix s assume"S ≠ {}" thenobtain x where xin: "x∈S"by(auto) with fS sPm have"0 ≤ fst x (λs. P s ⊖ 1) s"by(auto) alsofrom xin fS sPm have"... ≤ Sup_trans (fst ` S) (λs. P s ⊖ 1) s" by(auto intro!: le_funD[OF Sup_trans_upper2]) finallyshow"?thesis s" . qed
have"∧x s. fst x P s ≤ (fst x P s ⊖ 1) + 1"by(simp add:tminus_def) alsofrom saS sP have"∧x s. x∈S ==> (fst x P s ⊖ 1) + 1 ≤ fst x (λs. P s ⊖ 1) s + 1" by(auto intro:add_right_mono) also { from sP have"sound (λs. P s ⊖ 1)"by(auto intro:tminus_sound) with fS have"∧x s. x∈S ==> fst x (λs. P s ⊖ 1) s + 1 ≤ Sup_trans (fst ` S) (λs. P s ⊖ 1) s + 1" by(blast intro!: add_right_mono le_funD[OF Sup_trans_upper2])
} finallyhave le: "∧s. ∀x∈S. fst x P s ≤ Sup_trans (fst ` S) (λs. P s ⊖ 1) s + 1" by(auto) moreoverfrom nnSup have nn: "∧s. 0 ≤ Sup_trans (fst ` S) (λs. P s ⊖ 1) s + 1" by(auto intro:add_nonneg_nonneg) ultimately have leSup: "Sup_trans (fst ` S) P s ≤ Sup_trans (fst ` S) (λs. P s ⊖ 1) s + 1" unfolding Sup_trans_def by(intro le_funD[OF Sup_exp_least], auto)
show"Sup_trans (fst ` S) P s ⊖ 1 ≤ Sup_trans (fst ` S) (λs. P s ⊖ 1) s" proof(cases "Sup_trans (fst ` S) P s ≤ 1", simp_all add:nnSup) from leSup have"Sup_trans (fst ` S) P s - 1 ≤ Sup_trans (fst ` S) (λs. P s ⊖ 1) s + 1 - 1" by(auto) thus"Sup_trans (fst ` S) P s - 1 ≤ Sup_trans (fst ` S) (λs. P s ⊖ 1) s"by(simp) qed next fix t::"'s trans"and P::"'s expect"and s::'s assume IH: "∀P s. sound P ⟶ t P s ⊖ 1 ≤ t (λa. P a ⊖ 1) s" and ft: "feasible t" and sP: "sound P"
from sP have"sound (λs. P s ⊖ 1)"by(auto intro:tminus_sound) with ft have s2: "sound (t (λs. P s ⊖ 1))"by(auto) from sP ft have"sound (t P)"by(auto) hence s3: "sound (λs. t P s ⊖ 1)"by(auto intro!:tminus_sound)
show"wp (body ;; Embed t <guillemotleft> G ¬⊕ Skip) P s ⊖ 1 ≤ wp (body ;; Embed t <guillemotleft> G ¬⊕ Skip) (λa. P a ⊖ 1) s" proof(simp add:wp_eval) have"«G¬ s * wp body (t P) s + (1 - «G¬ s) * P s ⊖ 1 = «G¬ s * wp body (t P) s + (1 - «G¬ s) * P s ⊖ («G¬ s + (1 - «G¬ s))" by(simp) alsohave"... ≤ («G¬ s * wp body (t P) s ⊖«G¬ s) + ((1 - «G¬ s) * P s ⊖ (1 - «G¬ s))" by(rule tminus_add_mono) alsohave"... = «G¬ s * (wp body (t P) s ⊖ 1) + (1 - «G¬ s) * (P s ⊖ 1)" by(simp add:tminus_left_distrib) also { from ft sP have"wp body (t P) s ⊖ 1 ≤ wp body (λs. t P s ⊖ 1) s" by(auto intro:sub_distribD[OF sdb]) also { from IH sP have"λs. t P s ⊖ 1 ⊨!!! t (λs. P s ⊖ 1)"by(auto) with sP ft s2 s3 have"wp body (λs. t P s ⊖ 1) s ≤ wp body (t (λs. P s ⊖ 1)) s" by(blast intro:le_funD[OF mono_transD, OF healthy_monoD, OF hb])
} finallyhave"«G¬ s * (wp body (t P) s ⊖ 1) + (1 - «G¬ s) * (P s ⊖ 1) ≤ «G¬ s * wp body (t (λs. P s ⊖ 1)) s + (1 - «G¬ s) * (P s ⊖ 1)" by(auto intro:add_right_mono mult_left_mono)
} finallyshow"«G¬ s * wp body (t P) s + (1 - «G¬ s) * P s ⊖ 1 ≤ «G¬ s * wp body (t (λs. P s ⊖ 1)) s + (1 - «G¬ s) * (P s ⊖ 1)" . qed next fix t t'::"'s trans"and P::"'s expect"and s::'s assume IH: "∀P s. sound P ⟶ t P s ⊖ 1 ≤ t (λa. P a ⊖ 1) s" and eq: "equiv_trans t t'"and sP: "sound P"
from sP have"t' P s ⊖ 1 = t P s ⊖ 1"by(simp add:equiv_transD[OF eq]) alsofrom sP IH have"... ≤ t (λs. P s ⊖ 1) s"by(auto) also { from sP have"sound (λs. P s ⊖ 1)"by(simp add:tminus_sound) hence"t (λs. P s ⊖ 1) s = t' (λs. P s ⊖ 1) s"by(simp add:equiv_transD[OF eq])
} finallyshow"t' P s ⊖ 1 ≤ t' (λs. P s ⊖ 1) s" . qed thus ?thesis by(auto intro!:sub_distribI) qed
text‹For sub-additivity, we again use the limit-of-iterates characterisation. Firstly, all
are sublinear:› lemma sublinear_iterates: assumes hb: "healthy (wp body)" and sb: "sublinear (wp body)" shows"sublinear (iterates body G i)" by(induct i, auto intro!:sublinear_wp_PC sublinear_wp_Seq sublinear_wp_Skip sublinear_wp_Embed
assms healthy_intros iterates_healthy)
text‹From this, sub-additivity follows for the limit (i.e. the loop), by appealing to the
at all steps.› lemma sub_add_wp_loop: fixes body::"'s prog" assumes sb: "sublinear (wp body)" and cb: "bd_cts (wp body)" and hwp: "healthy (wp body)" shows"sub_add (wp (do G ⟶ body od))" proof fix P Q::"'s expect"and s::'s assume sP: "sound P"and sQ: "sound Q"
from hwp cb sP have"(λi. iterates body G i P s) <---- wp do G ⟶ body od P s" by(rule loop_iterates) moreover from hwp cb sQ have"(λi. iterates body G i Q s) <---- wp do G ⟶ body od Q s" by(rule loop_iterates) ultimately have"(λi. iterates body G i P s + iterates body G i Q s) <---- wp do G ⟶ body od P s + wp do G ⟶ body od Q s" by(rule tendsto_add) moreover { from sublinear_subadd[OF sublinear_iterates, OF hwp sb,
OF healthy_feasibleD[OF iterates_healthy, OF hwp]] sP sQ have"∧i. iterates body G i P s + iterates body G i Q s ≤ iterates body G i (λs. P s + Q s) s" by(rule sub_addD)
} moreover { from sP sQ have"sound (λs. P s + Q s)"by(blast intro:sound_intros) with hwp cb have"(λi. iterates body G i (λs. P s + Q s) s) <---- wp do G ⟶ body od (λs. P s + Q s) s" by(blast intro:loop_iterates)
} ultimately show"wp do G ⟶ body od P s + wp do G ⟶ body od Q s ≤ wp do G ⟶ body od (λs. P s + Q s) s" by(blast intro:LIMSEQ_le) qed
lemma sublinear_wp_loop: fixes body::"'s prog" assumes hb: "healthy (wp body)" and nhb: "nearly_healthy (wlp body)" and sb: "sublinear (wp body)" and cb: "bd_cts (wp body)" shows"sublinear (wp (do G ⟶ body od))" using sublinear_sub_distrib[OF sb] sublinear_subadd[OF sb]
hb healthy_feasibleD[OF hb] by(iprover intro:sd_sa_sublinear[OF _ _ healthy_wp_loop[OF hb]]
sub_distrib_wp_loop sub_add_wp_loop assms)
¤ Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.0.11Bemerkung:
(vorverarbeitet am 2026-06-10)
¤
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.