module NDL

  use int.Int

  type state
  type var

  function read (w : state) (x : var) : int
  function write (w : state) (x : var) (a : int) : state

  axiom row_eq : forall w x y a .
    x = y -> read (write w x a) y = a

  axiom row_neq : forall w x y a .
    x <> y -> read (write w x a) y = read w y

  axiom extensionality : forall w w' .
    (forall x . read w x = read w' x) <-> w = w'

  goal test1 : forall w x . write w x (read w x) = w

  type exp =
  | Const int
  | Var var
  | Plus exp exp

  function eval (w : state) (e : exp) : int =
  match e with
  | Const a -> a
  | Var x -> read w x
  | Plus e e' -> (eval w e) + (eval w e')
  end

  type prog =
  | Asgn var exp
  | Seq prog prog
  | Test ndl
  | Union prog prog
  | Star prog
  with ndl =
  | Equals exp exp
  | Not ndl
  | And ndl ndl
  | Or ndl ndl
  | Implies ndl ndl
  | Forall var ndl
  | Box prog ndl
  | Dia prog ndl

  predicate run (w : state) (alpha : prog) (v : state)
  predicate models (w : state) (p : ndl)

  axiom run_asgn : forall w x e v .
    run w (Asgn x e) v <-> v = write w x (eval w e)

  axiom run_seq : forall w alpha beta v .
    run w (Seq alpha beta) v <-> exists u . run w alpha u /\ run u beta v
  
  axiom run_test : forall w p v .
    run w (Test p) v <-> w = v /\ models w p
  
  axiom run_union : forall w alpha beta v .
    run w (Union alpha beta) v <-> run w alpha v \/ run w beta v
  
  axiom run_star : forall w alpha v .
    run w (Star alpha) v <-> w = v \/ exists u . run w alpha u /\ run u (Star alpha) v
  
  axiom models_eq : forall w e e' .
    models w (Equals e e') <-> (eval w e) = (eval w e')
  
  axiom models_not : forall w p .
    models w (Not p) <-> not (models w p)
  
  axiom models_and : forall w p q .
    models w (And p q) <-> models w p /\ models w q

  axiom models_or : forall w p q .
    models w (Or p q) <-> models w p \/ models w q
  
  axiom models_imp : forall w p q .
    models w (Implies p q) <-> (models w p -> models w q)
  
  axiom models_forall : forall w x p .
    models w (Forall x p) <-> (forall a . models (write w x a) p)
  
  axiom models_box : forall w alpha p .
    models w (Box alpha p) <-> (forall v . run w alpha v -> models v p)
  
  axiom models_dia : forall w alpha p .
    models w (Dia alpha p) <-> (exists v . run w alpha v /\ models v p)
  
  lemma box_seq : forall w alpha beta p .
    models w (Box (Seq alpha beta) p) <-> models w (Box alpha (Box beta p))
  
  lemma box_test : forall w p q .
    models w (Box (Test p) q) <-> models w (Implies p q)
  
  lemma box_union : forall w alpha beta p .
    models w (Box (Union alpha beta) p) <-> models w (And (Box alpha p) (Box beta p))
  
  (*
  [x <- e]P(x) <-> forall x' . x' = e -> P(x')      (x' fresh)
  *)
  predicate fresh (e : exp) (x : var)
  predicate rename (x x' : var) (p p' : ndl)

  axiom fresh_s : forall e x .
    fresh e x <-> forall w a . eval (write w x a) e = eval w e
  
  axiom rename_s : forall x x' p p' .
    rename x x' p p' <-> forall w a . models (write w x a) p <-> models (write w x' a) p'
  
  lemma box_asgn : forall x x' e p p' w .
    fresh e x' /\ rename x x' p p' ->
      (models w (Box (Asgn x e) p) <-> models w (Forall x' (Implies (Equals (Var x') e) p')))


  goal smoke : false

end