Theory utp_pred

section ‹ Alphabetised Predicates ›

theory utp_pred
imports
  utp_expr_funcs
  utp_subst
  utp_meta_subst
  utp_tactics
begin
  
text ‹ In this theory we begin to create an Isabelle version of the alphabetised predicate calculus
  that is described in Chapter 1 of the UTP book~\<^cite>‹"Hoare&98"›. ›
  
subsection ‹ Predicate type and syntax ›
  
text ‹ An alphabetised predicate is a simply a boolean valued expression. ›

type_synonym 'α upred = "(bool, 'α) uexpr"

translations
  (type) "'α upred" <= (type) "(bool, 'α) uexpr"

text ‹ We want to remain as close as possible to the mathematical UTP syntax, but also
        want to be conservative with HOL. For this reason we chose not to steal syntax
        from HOL, but where possible use polymorphism to allow selection of the appropriate
        operator (UTP vs. HOL). Thus we will first remove the standard syntax for conjunction,
        disjunction, and negation, and replace these with adhoc overloaded definitions. We
        similarly use polymorphic constants for the other predicate calculus operators. ›

purge_notation
  conj (infixr "∧" 35) and
  disj (infixr "∨" 30) and
  Not ("¬ _" [40] 40)

consts
  utrue  :: "'a" ("true")
  ufalse :: "'a" ("false")
  uconj  :: "'a ⇒ 'a ⇒ 'a" (infixr "∧" 35)
  udisj  :: "'a ⇒ 'a ⇒ 'a" (infixr "∨" 30)
  uimpl  :: "'a ⇒ 'a ⇒ 'a" (infixr "⇒" 25)
  uiff   :: "'a ⇒ 'a ⇒ 'a" (infixr "⇔" 25)
  unot   :: "'a ⇒ 'a" ("¬ _" [40] 40)
  uex    :: "('a ⟹ 'α) ⇒ 'p ⇒ 'p"
  uall   :: "('a ⟹ 'α) ⇒ 'p ⇒ 'p"
  ushEx  :: "['a ⇒ 'p] ⇒ 'p"
  ushAll :: "['a ⇒ 'p] ⇒ 'p"
  
adhoc_overloading
  uconj conj and
  udisj disj and
  unot Not

text ‹ We set up two versions of each of the quantifiers: @{const uex} / @{const uall} and
        @{const ushEx} / @{const ushAll}. The former pair allows quantification of UTP variables,
        whilst the latter allows quantification of HOL variables in concert with the literal
        expression constructor @{term "«x»"}. Both varieties will be needed at various points. 
        Syntactically they are distinguished by a boldface quantifier
        for the HOL versions (achieved by the "bold" escape in Isabelle). ›

nonterminal idt_list

syntax
  "_idt_el"  :: "idt ⇒ idt_list" ("_")
  "_idt_list" :: "idt ⇒ idt_list ⇒ idt_list" ("(_,/ _)" [0, 1])
  "_uex"     :: "salpha ⇒ logic ⇒ logic" ("∃ _ ∙ _" [0, 10] 10)
  "_uall"    :: "salpha ⇒ logic ⇒ logic" ("∀ _ ∙ _" [0, 10] 10)
  "_ushEx"   :: "pttrn ⇒ logic ⇒ logic"   ("❙∃ _ ∙ _" [0, 10] 10)
  "_ushAll"  :: "pttrn ⇒ logic ⇒ logic"   ("❙∀ _ ∙ _" [0, 10] 10)
  "_ushBEx"  :: "pttrn ⇒ logic ⇒ logic ⇒ logic"   ("❙∃ _ ∈ _ ∙ _" [0, 0, 10] 10)
  "_ushBAll" :: "pttrn ⇒ logic ⇒ logic ⇒ logic"   ("❙∀ _ ∈ _ ∙ _" [0, 0, 10] 10)
  "_ushGAll" :: "pttrn ⇒ logic ⇒ logic ⇒ logic"   ("❙∀ _ | _ ∙ _" [0, 0, 10] 10)
  "_ushGtAll" :: "idt ⇒ logic ⇒ logic ⇒ logic" ("❙∀ _ > _ ∙ _" [0, 0, 10] 10)
  "_ushLtAll" :: "idt ⇒ logic ⇒ logic ⇒ logic" ("❙∀ _ < _ ∙ _" [0, 0, 10] 10)
  "_uvar_res" :: "logic ⇒ salpha ⇒ logic" (infixl "↾⇩v" 90)
  
translations
  "_uex x P"                   == "CONST uex x P"
  "_uex (_salphaset (_salphamk (x +⇩L y))) P"  <= "_uex (x +⇩L y) P"
  "_uall x P"                  == "CONST uall x P"
  "_uall (_salphaset (_salphamk (x +⇩L y))) P"  <= "_uall (x +⇩L y) P"
  "_ushEx x P"                 == "CONST ushEx (λ x. P)"
  "❙∃ x ∈ A ∙ P"                => "❙∃ x ∙ «x» ∈⇩u A ∧ P"
  "_ushAll x P"                == "CONST ushAll (λ x. P)"
  "❙∀ x ∈ A ∙ P"                => "❙∀ x ∙ «x» ∈⇩u A ⇒ P"
  "❙∀ x | P ∙ Q"                => "❙∀ x ∙ P ⇒ Q"
  "❙∀ x > y ∙ P"                => "❙∀ x ∙ «x» >⇩u y ⇒ P"
  "❙∀ x < y ∙ P"                => "❙∀ x ∙ «x» <⇩u y ⇒ P"

subsection ‹ Predicate operators ›

text ‹ We chose to maximally reuse definitions and laws built into HOL. For this reason,
        when introducing the core operators we proceed by lifting operators from the
        polymorphic algebraic hierarchy of HOL. Thus the initial definitions take
        place in the context of type class instantiations. We first introduce our own
        class called \emph{refine} that will add the refinement operator syntax to
        the HOL partial order class. ›

class refine = order

abbreviation refineBy :: "'a::refine ⇒ 'a ⇒ bool"  (infix "⊑" 50) where
"P ⊑ Q ≡ less_eq Q P"

text ‹ Since, on the whole, lattices in UTP are the opposite way up to the standard definitions
        in HOL, we syntactically invert the lattice operators. This is the one exception where
        we do steal HOL syntax, but I think it makes sense for UTP. Indeed we make this
        inversion for all of the lattice operators. ›

purge_notation Lattices.inf (infixl "⊓" 70)
notation Lattices.inf (infixl "⊔" 70)
purge_notation Lattices.sup (infixl "⊔" 65)
notation Lattices.sup (infixl "⊓" 65)
  
purge_notation Inf ("⨅_" [900] 900)
notation Inf ("⨆_" [900] 900)
purge_notation Sup ("⨆_" [900] 900)
notation Sup ("⨅_" [900] 900)
  
purge_notation Orderings.bot ("⊥")
notation Orderings.bot ("⊤")
purge_notation Orderings.top ("⊤")
notation Orderings.top ("⊥")

purge_syntax
  "_INF1"     :: "pttrns ⇒ 'b ⇒ 'b"           ("(3⨅_./ _)" [0, 10] 10)
  "_INF"      :: "pttrn ⇒ 'a set ⇒ 'b ⇒ 'b"  ("(3⨅_∈_./ _)" [0, 0, 10] 10)
  "_SUP1"     :: "pttrns ⇒ 'b ⇒ 'b"           ("(3⨆_./ _)" [0, 10] 10)
  "_SUP"      :: "pttrn ⇒ 'a set ⇒ 'b ⇒ 'b"  ("(3⨆_∈_./ _)" [0, 0, 10] 10)

syntax
  "_INF1"     :: "pttrns ⇒ 'b ⇒ 'b"           ("(3⨆_./ _)" [0, 10] 10)
  "_INF"      :: "pttrn ⇒ 'a set ⇒ 'b ⇒ 'b"  ("(3⨆_∈_./ _)" [0, 0, 10] 10)
  "_SUP1"     :: "pttrns ⇒ 'b ⇒ 'b"           ("(3⨅_./ _)" [0, 10] 10)
  "_SUP"      :: "pttrn ⇒ 'a set ⇒ 'b ⇒ 'b"  ("(3⨅_∈_./ _)" [0, 0, 10] 10)

text ‹ We trivially instantiate our refinement class ›

instance uexpr :: (order, type) refine ..

― ‹ Configure transfer law for refinement for the fast relational tactics. ›

theorem upred_ref_iff [uexpr_transfer_laws]:
"(P ⊑ Q) = (∀b. ⟦Q⟧⇩e b ⟶ ⟦P⟧⇩e b)"
  apply (transfer)
  apply (clarsimp)
  done

text ‹ Next we introduce the lattice operators, which is again done by lifting. ›

instantiation uexpr :: (lattice, type) lattice
begin
  lift_definition sup_uexpr :: "('a, 'b) uexpr ⇒ ('a, 'b) uexpr ⇒ ('a, 'b) uexpr"
  is "λP Q A. Lattices.sup (P A) (Q A)" .
  lift_definition inf_uexpr :: "('a, 'b) uexpr ⇒ ('a, 'b) uexpr ⇒ ('a, 'b) uexpr"
  is "λP Q A. Lattices.inf (P A) (Q A)" .
instance
  by (intro_classes) (transfer, auto)+
end

instantiation uexpr :: (bounded_lattice, type) bounded_lattice
begin
  lift_definition bot_uexpr :: "('a, 'b) uexpr" is "λ A. Orderings.bot" .
  lift_definition top_uexpr :: "('a, 'b) uexpr" is "λ A. Orderings.top" .
instance
  by (intro_classes) (transfer, auto)+
end

lemma top_uexpr_rep_eq [simp]: 
  "⟦Orderings.bot⟧⇩e b = False"
  by (transfer, auto)

lemma bot_uexpr_rep_eq [simp]: 
  "⟦Orderings.top⟧⇩e b = True"
  by (transfer, auto)
    
instance uexpr :: (distrib_lattice, type) distrib_lattice
  by (intro_classes) (transfer, rule ext, auto simp add: sup_inf_distrib1)

text ‹ Finally we show that predicates form a Boolean algebra (under the lattice operators),
  a complete lattice, a completely distribute lattice, and a complete boolean algebra. This
  equip us with a very complete theory for basic logical propositions. ›

instance uexpr :: (boolean_algebra, type) boolean_algebra
  apply (intro_classes, unfold uexpr_defs; transfer, rule ext)
    apply (simp_all add: sup_inf_distrib1 diff_eq)
  done

instantiation uexpr :: (complete_lattice, type) complete_lattice
begin
  lift_definition Inf_uexpr :: "('a, 'b) uexpr set ⇒ ('a, 'b) uexpr"
  is "λ PS A. INF P∈PS. P(A)" .
  lift_definition Sup_uexpr :: "('a, 'b) uexpr set ⇒ ('a, 'b) uexpr"
  is "λ PS A. SUP P∈PS. P(A)" .
instance
  by (intro_classes)
     (transfer, auto intro: INF_lower SUP_upper simp add: INF_greatest SUP_least)+
end

instance uexpr :: (complete_distrib_lattice, type) complete_distrib_lattice
  by (intro_classes; transfer; auto simp add: INF_SUP_set)

instance uexpr :: (complete_boolean_algebra, type) complete_boolean_algebra ..
  
text ‹ From the complete lattice, we can also define and give syntax for the fixed-point operators. 
  Like the lattice operators, these are reversed in UTP. ›

syntax
  "_mu" :: "pttrn ⇒ logic ⇒ logic" ("μ _ ∙ _" [0, 10] 10)
  "_nu" :: "pttrn ⇒ logic ⇒ logic" ("ν _ ∙ _" [0, 10] 10)

notation gfp ("μ")
notation lfp ("ν")

translations
  "ν X ∙ P" == "CONST lfp (λ X. P)"
  "μ X ∙ P" == "CONST gfp (λ X. P)"

text ‹ With the lattice operators defined, we can proceed to give definitions for the
        standard predicate operators in terms of them. ›

definition "true_upred  = (Orderings.top :: 'α upred)"
definition "false_upred = (Orderings.bot :: 'α upred)"
definition "conj_upred  = (Lattices.inf :: 'α upred ⇒ 'α upred ⇒ 'α upred)"
definition "disj_upred  = (Lattices.sup :: 'α upred ⇒ 'α upred ⇒ 'α upred)"
definition "not_upred   = (uminus :: 'α upred ⇒ 'α upred)"
definition "diff_upred  = (minus :: 'α upred ⇒ 'α upred ⇒ 'α upred)"

abbreviation Conj_upred :: "'α upred set ⇒ 'α upred" ("⋀_" [900] 900) where
"⋀ A ≡ ⨆ A"

abbreviation Disj_upred :: "'α upred set ⇒ 'α upred" ("⋁_" [900] 900) where
"⋁ A ≡ ⨅ A"

notation
  conj_upred (infixr "∧⇩p" 35) and
  disj_upred (infixr "∨⇩p" 30)

text ‹ Perhaps slightly confusingly, the UTP infimum is the HOL supremum and vice-versa. This is
  because, again, in UTP the lattice is inverted due to the definition of refinement and a desire
  to have miracle at the top, and abort at the bottom. ›
  
lift_definition UINF :: "('a ⇒ 'α upred) ⇒ ('a ⇒ ('b::complete_lattice, 'α) uexpr) ⇒ ('b, 'α) uexpr"
is "λ P F b. Sup {⟦F x⟧⇩eb | x. ⟦P x⟧⇩eb}" .

lift_definition USUP :: "('a ⇒ 'α upred) ⇒ ('a ⇒ ('b::complete_lattice, 'α) uexpr) ⇒ ('b, 'α) uexpr"
is "λ P F b. Inf {⟦F x⟧⇩eb | x. ⟦P x⟧⇩eb}" .
  
syntax
  "_USup"     :: "pttrn ⇒ logic ⇒ logic"            ("⋀ _ ∙ _" [0, 10] 10)
  "_USup"     :: "pttrn ⇒ logic ⇒ logic"            ("⨆ _ ∙ _" [0, 10] 10)
  "_USup_mem" :: "pttrn ⇒ logic ⇒ logic ⇒ logic"   ("⋀ _ ∈ _ ∙ _" [0, 10] 10)
  "_USup_mem" :: "pttrn ⇒ logic ⇒ logic ⇒ logic"   ("⨆ _ ∈ _ ∙ _" [0, 10] 10)
  "_USUP"     :: "pttrn ⇒ logic ⇒ logic ⇒ logic"   ("⋀ _ | _ ∙ _" [0, 0, 10] 10)
  "_USUP"     :: "pttrn ⇒ logic ⇒ logic ⇒ logic"   ("⨆ _ | _ ∙ _" [0, 0, 10] 10)
  "_UInf"     :: "pttrn ⇒ logic ⇒ logic"            ("⋁ _ ∙ _" [0, 10] 10)
  "_UInf"     :: "pttrn ⇒ logic ⇒ logic"            ("⨅ _ ∙ _" [0, 10] 10)
  "_UInf_mem" :: "pttrn ⇒ logic ⇒ logic ⇒ logic"   ("⋁ _ ∈ _ ∙ _" [0, 10] 10)
  "_UInf_mem" :: "pttrn ⇒ logic ⇒ logic ⇒ logic"   ("⨅ _ ∈ _ ∙ _" [0, 10] 10)
  "_UINF"     :: "pttrn ⇒ logic ⇒ logic ⇒ logic"   ("⋁ _ | _ ∙ _" [0, 10] 10)
  "_UINF"     :: "pttrn ⇒ logic ⇒ logic ⇒ logic"   ("⨅ _ | _ ∙ _" [0, 10] 10)

translations
  "⨅ x | P ∙ F" => "CONST UINF (λ x. P) (λ x. F)"
  "⨅ x ∙ F"     == "⨅ x | true ∙ F"
  "⨅ x ∙ F"     == "⨅ x | true ∙ F"
  "⨅ x ∈ A ∙ F" => "⨅ x | «x» ∈⇩u «A» ∙ F"
  "⨅ x ∈ A ∙ F" <= "⨅ x | «y» ∈⇩u «A» ∙ F"
  "⨅ x | P ∙ F" <= "CONST UINF (λ y. P) (λ x. F)"
  "⨅ x | P ∙ F(x)" <= "CONST UINF (λ x. P) F"
  "⨆ x | P ∙ F" => "CONST USUP (λ x. P) (λ x. F)"
  "⨆ x ∙ F"     == "⨆ x | true ∙ F"
  "⨆ x ∈ A ∙ F" => "⨆ x | «x» ∈⇩u «A» ∙ F"
  "⨆ x ∈ A ∙ F" <= "⨆ x | «y» ∈⇩u «A» ∙ F"
  "⨆ x | P ∙ F" <= "CONST USUP (λ y. P) (λ x. F)"
  "⨆ x | P ∙ F(x)" <= "CONST USUP (λ x. P) F"

text ‹ We also define the other predicate operators ›

lift_definition impl::"'α upred ⇒ 'α upred ⇒ 'α upred" is
"λ P Q A. P A ⟶ Q A" .

lift_definition iff_upred ::"'α upred ⇒ 'α upred ⇒ 'α upred" is
"λ P Q A. P A ⟷ Q A" .

lift_definition ex :: "('a ⟹ 'α) ⇒ 'α upred ⇒ 'α upred" is
"λ x P b. (∃ v. P(put⇘x⇙ b v))" .

lift_definition shEx ::"['β ⇒'α upred] ⇒ 'α upred" is
"λ P A. ∃ x. (P x) A" .

lift_definition all :: "('a ⟹ 'α) ⇒ 'α upred ⇒ 'α upred" is
"λ x P b. (∀ v. P(put⇘x⇙ b v))" .

lift_definition shAll ::"['β ⇒'α upred] ⇒ 'α upred" is
"λ P A. ∀ x. (P x) A" .
    
text ‹ We define the following operator which is dual of existential quantification. It hides the
  valuation of variables other than $x$ through existential quantification. ›
    
lift_definition var_res :: "'α upred ⇒ ('a ⟹ 'α) ⇒ 'α upred" is
"λ P x b. ∃ b'. P (b' ⊕⇩L b on x)" .
    
translations
  "_uvar_res P a" ⇌ "CONST var_res P a"

text ‹ We have to add a u subscript to the closure operator as I don't want to override the syntax
        for HOL lists (we'll be using them later). ›

lift_definition closure::"'α upred ⇒ 'α upred" ("[_]⇩u") is
"λ P A. ∀A'. P A'" .

lift_definition taut :: "'α upred ⇒ bool" ("`_`")
is "λ P. ∀ A. P A" .

text ‹ Configuration for UTP tactics ›

update_uexpr_rep_eq_thms ― ‹ Reread @{text rep_eq} theorems. ›

declare utp_pred.taut.rep_eq [upred_defs]

adhoc_overloading
  utrue "true_upred" and
  ufalse "false_upred" and
  unot "not_upred" and
  uconj "conj_upred" and
  udisj "disj_upred" and
  uimpl impl and
  uiff iff_upred and
  uex ex and
  uall all and
  ushEx shEx and
  ushAll shAll

syntax
  "_uneq"       :: "logic ⇒ logic ⇒ logic" (infixl "≠⇩u" 50)
  "_unmem"      :: "('a, 'α) uexpr ⇒ ('a set, 'α) uexpr ⇒ (bool, 'α) uexpr" (infix "∉⇩u" 50)

translations
  "x ≠⇩u y" == "CONST unot (x =⇩u y)"
  "x ∉⇩u A" == "CONST unot (CONST bop (∈) x A)"

declare true_upred_def [upred_defs]
declare false_upred_def [upred_defs]
declare conj_upred_def [upred_defs]
declare disj_upred_def [upred_defs]
declare not_upred_def [upred_defs]
declare diff_upred_def [upred_defs]
declare subst_upd_uvar_def [upred_defs]
declare cond_subst_def [upred_defs]
declare par_subst_def [upred_defs]
declare subst_del_def [upred_defs]
declare unrest_usubst_def [upred_defs]
declare uexpr_defs [upred_defs]

lemma true_alt_def: "true = «True»"
  by (pred_auto)

lemma false_alt_def: "false = «False»"
  by (pred_auto)

declare true_alt_def[THEN sym,simp]
declare false_alt_def[THEN sym,simp]

subsection ‹ Unrestriction Laws ›

lemma unrest_allE:
  "⟦ Σ ♯ P; P = true ⟹ Q; P = false ⟹ Q ⟧ ⟹ Q"
  by (pred_auto)
  
lemma unrest_true [unrest]: "x ♯ true"
  by (pred_auto)

lemma unrest_false [unrest]: "x ♯ false"
  by (pred_auto)

lemma unrest_conj [unrest]: "⟦ x ♯ (P :: 'α upred); x ♯ Q ⟧ ⟹ x ♯ P ∧ Q"
  by (pred_auto)

lemma unrest_disj [unrest]: "⟦ x ♯ (P :: 'α upred); x ♯ Q ⟧ ⟹ x ♯ P ∨ Q"
  by (pred_auto)

lemma unrest_UINF [unrest]:
  "⟦ (⋀ i. x ♯ P(i)); (⋀ i. x ♯ Q(i)) ⟧ ⟹ x ♯ (⨅ i | P(i) ∙ Q(i))"
  by (pred_auto)

lemma unrest_USUP [unrest]:
  "⟦ (⋀ i. x ♯ P(i)); (⋀ i. x ♯ Q(i)) ⟧ ⟹ x ♯ (⨆ i | P(i) ∙ Q(i))"
  by (pred_auto)

lemma unrest_UINF_mem [unrest]:
  "⟦(⋀ i. i ∈ A ⟹ x ♯ P(i)) ⟧ ⟹ x ♯ (⨅ i∈A ∙ P(i))"
  by (pred_simp, metis)

lemma unrest_USUP_mem [unrest]:
  "⟦(⋀ i. i ∈ A ⟹ x ♯ P(i)) ⟧ ⟹ x ♯ (⨆ i∈A ∙ P(i))"
  by (pred_simp, metis)

lemma unrest_impl [unrest]: "⟦ x ♯ P; x ♯ Q ⟧ ⟹ x ♯ P ⇒ Q"
  by (pred_auto)

lemma unrest_iff [unrest]: "⟦ x ♯ P; x ♯ Q ⟧ ⟹ x ♯ P ⇔ Q"
  by (pred_auto)

lemma unrest_not [unrest]: "x ♯ (P :: 'α upred) ⟹ x ♯ (¬ P)"
  by (pred_auto)

text ‹ The sublens proviso can be thought of as membership below. ›

lemma unrest_ex_in [unrest]:
  "⟦ mwb_lens y; x ⊆⇩L y ⟧ ⟹ x ♯ (∃ y ∙ P)"
  by (pred_auto)

declare sublens_refl [simp]
declare lens_plus_ub [simp]
declare lens_plus_right_sublens [simp]
declare comp_wb_lens [simp]
declare comp_mwb_lens [simp]
declare plus_mwb_lens [simp]

lemma unrest_ex_diff [unrest]:
  assumes "x ⨝ y" "y ♯ P"
  shows "y ♯ (∃ x ∙ P)"
  using assms lens_indep_comm 
  by (rel_simp', fastforce)
  
lemma unrest_all_in [unrest]:
  "⟦ mwb_lens y; x ⊆⇩L y ⟧ ⟹ x ♯ (∀ y ∙ P)"
  by (pred_auto)

lemma unrest_all_diff [unrest]:
  assumes "x ⨝ y" "y ♯ P"
  shows "y ♯ (∀ x ∙ P)"
  using assms
  by (pred_simp, simp_all add: lens_indep_comm)

lemma unrest_var_res_diff [unrest]:
  assumes "x ⨝ y"
  shows "y ♯ (P ↾⇩v x)"
  using assms by (pred_auto)

lemma unrest_var_res_in [unrest]:
  assumes "mwb_lens x" "y ⊆⇩L x" "y ♯ P"
  shows "y ♯ (P ↾⇩v x)"
  using assms 
  apply (pred_auto)
   apply fastforce
  apply (metis (no_types, lifting) mwb_lens_weak weak_lens.put_get)
  done

lemma unrest_shEx [unrest]:
  assumes "⋀ y. x ♯ P(y)"
  shows "x ♯ (❙∃ y ∙ P(y))"
  using assms by (pred_auto)

lemma unrest_shAll [unrest]:
  assumes "⋀ y. x ♯ P(y)"
  shows "x ♯ (❙∀ y ∙ P(y))"
  using assms by (pred_auto)

lemma unrest_closure [unrest]:
  "x ♯ [P]⇩u"
  by (pred_auto)

subsection ‹ Used-by laws ›

lemma usedBy_not [unrest]:
  "⟦ x ♮ P ⟧ ⟹ x ♮ (¬ P)"
  by (pred_simp)
    
lemma usedBy_conj [unrest]:
  "⟦ x ♮ P; x ♮ Q ⟧ ⟹ x ♮ (P ∧ Q)"
  by (pred_simp)

lemma usedBy_disj [unrest]:
  "⟦ x ♮ P; x ♮ Q ⟧ ⟹ x ♮ (P ∨ Q)"
  by (pred_simp)

lemma usedBy_impl [unrest]:
  "⟦ x ♮ P; x ♮ Q ⟧ ⟹ x ♮ (P ⇒ Q)"
  by (pred_simp)

lemma usedBy_iff [unrest]:
  "⟦ x ♮ P; x ♮ Q ⟧ ⟹ x ♮ (P ⇔ Q)"
  by (pred_simp)
    
subsection ‹ Substitution Laws ›

text ‹ Substitution is monotone ›

lemma subst_mono: "P ⊑ Q ⟹ (σ † P) ⊑ (σ † Q)"
  by (pred_auto)

lemma subst_true [usubst]: "σ † true = true"
  by (pred_auto)

lemma subst_false [usubst]: "σ † false = false"
  by (pred_auto)

lemma subst_not [usubst]: "σ † (¬ P) = (¬ σ † P)"
  by (pred_auto)

lemma subst_impl [usubst]: "σ † (P ⇒ Q) = (σ † P ⇒ σ † Q)"
  by (pred_auto)

lemma subst_iff [usubst]: "σ † (P ⇔ Q) = (σ † P ⇔ σ † Q)"
  by (pred_auto)

lemma subst_disj [usubst]: "σ † (P ∨ Q) = (σ † P ∨ σ † Q)"
  by (pred_auto)

lemma subst_conj [usubst]: "σ † (P ∧ Q) = (σ † P ∧ σ † Q)"
  by (pred_auto)
    
lemma subst_sup [usubst]: "σ † (P ⊓ Q) = (σ † P ⊓ σ † Q)"
  by (pred_auto)

lemma subst_inf [usubst]: "σ † (P ⊔ Q) = (σ † P ⊔ σ † Q)"
  by (pred_auto)

lemma subst_UINF [usubst]: "σ † (⨅ i | P(i) ∙ Q(i)) = (⨅ i | (σ † P(i)) ∙ (σ † Q(i)))"
  by (pred_auto)

lemma subst_USUP [usubst]: "σ † (⨆ i | P(i) ∙ Q(i)) = (⨆ i | (σ † P(i)) ∙ (σ † Q(i)))"
  by (pred_auto)

lemma subst_closure [usubst]: "σ † [P]⇩u = [P]⇩u"
  by (pred_auto)

lemma subst_shEx [usubst]: "σ † (❙∃ x ∙ P(x)) = (❙∃ x ∙ σ † P(x))"
  by (pred_auto)

lemma subst_shAll [usubst]: "σ † (❙∀ x ∙ P(x)) = (❙∀ x ∙ σ † P(x))"
  by (pred_auto)

text ‹ TODO: Generalise the quantifier substitution laws to n-ary substitutions ›

lemma subst_ex_same [usubst]:
  "mwb_lens x ⟹ σ(x ↦⇩s v) † (∃ x ∙ P) = σ † (∃ x ∙ P)"
  by (pred_auto)

lemma subst_ex_same' [usubst]:
  "mwb_lens x ⟹ σ(x ↦⇩s v) † (∃ &x ∙ P) = σ † (∃ &x ∙ P)"
  by (pred_auto)
    
lemma subst_ex_indep [usubst]:
  assumes "x ⨝ y" "y ♯ v"
  shows "(∃ y ∙ P)⟦v/x⟧ = (∃ y ∙ P⟦v/x⟧)"
  using assms
  apply (pred_auto)
  using lens_indep_comm apply fastforce+
  done

lemma subst_ex_unrest [usubst]:
  "x ♯ σ ⟹ σ † (∃ x ∙ P) = (∃ x ∙ σ † P)"
  by (pred_auto)

lemma subst_all_same [usubst]:
  "mwb_lens x ⟹ σ(x ↦⇩s v) † (∀ x ∙ P) = σ † (∀ x ∙ P)"
  by (simp add: id_subst subst_unrest unrest_all_in)

lemma subst_all_indep [usubst]:
  assumes "x ⨝ y" "y ♯ v"
  shows "(∀ y ∙ P)⟦v/x⟧ = (∀ y ∙ P⟦v/x⟧)"
  using assms
  by (pred_simp, simp_all add: lens_indep_comm)

lemma msubst_true [usubst]: "true⟦x→v⟧ = true"
  by (pred_auto)

lemma msubst_false [usubst]: "false⟦x→v⟧ = false"
  by (pred_auto)
lemma msubst_not [usubst]: "(¬ P(x))⟦x→v⟧ = (¬ ((P x)⟦x→v⟧))"
  by (pred_auto)

lemma msubst_not_2 [usubst]: "(¬ P x y)⟦(x,y)→v⟧ = (¬ ((P x y)⟦(x,y)→v⟧))"
  by (pred_auto)+

lemma msubst_disj [usubst]: "(P(x) ∨ Q(x))⟦x→v⟧ = ((P(x))⟦x→v⟧ ∨ (Q(x))⟦x→v⟧)"
  by (pred_auto)

lemma msubst_disj_2 [usubst]: "(P x y ∨ Q x y)⟦(x,y)→v⟧ = ((P x y)⟦(x,y)→v⟧ ∨ (Q x y)⟦(x,y)→v⟧)"
  by (pred_auto)+

lemma msubst_conj [usubst]: "(P(x) ∧ Q(x))⟦x→v⟧ = ((P(x))⟦x→v⟧ ∧ (Q(x))⟦x→v⟧)"
  by (pred_auto)

lemma msubst_conj_2 [usubst]: "(P x y ∧ Q x y)⟦(x,y)→v⟧ = ((P x y)⟦(x,y)→v⟧ ∧ (Q x y)⟦(x,y)→v⟧)"
  by (pred_auto)+

lemma msubst_implies [usubst]:
  "(P x ⇒ Q x)⟦x→v⟧ = ((P x)⟦x→v⟧ ⇒ (Q x)⟦x→v⟧)"
  by (pred_auto)

lemma msubst_implies_2 [usubst]:
  "(P x y ⇒ Q x y)⟦(x,y)→v⟧ = ((P x y)⟦(x,y)→v⟧ ⇒ (Q x y)⟦(x,y)→v⟧)"
  by (pred_auto)+

lemma msubst_shAll [usubst]:
  "(❙∀ x ∙ P x y)⟦y→v⟧ = (❙∀ x ∙ (P x y)⟦y→v⟧)"
  by (pred_auto)

lemma msubst_shAll_2 [usubst]:
  "(❙∀ x ∙ P x y z)⟦(y,z)→v⟧ = (❙∀ x ∙ (P x y z)⟦(y,z)→v⟧)"
  by (pred_auto)+

subsection ‹ Sandbox for conjectures ›

definition utp_sandbox :: "'α upred ⇒ bool" ("TRY'(_')") where
"TRY(P) = (P = undefined)"

translations
  "P" <= "CONST utp_sandbox P"

end