\documentstyle[makeidx]{article}
\makeindex
%\setlength{\oddsidemargin}{.5in}
%\setlength{\evensidemargin}{.5in}
%\setlength{\textwidth}{5.8in}
\begin{document}
%\setlength{\parindent}{0pt}
%\newcounter{bean}
%\begin{list}{\arabic{bean}.}{\usecounter{bean}\setlength{\leftmargin}{0pt}\setlength{\rightmargin}{0pt}\setlength{\listparindent}{20pt}\setlength{\parsep}{5pt}}
%\item[]

\begin{verbatim}#|

 Copyright (C) 1994 by Alex Bronstein and Carolyn Talcott.  All Rights
 Reserved.

 You may copy and distribute verbatim copies of this Nqthm-1992 event script as
 you receive it, in any medium, including embedding it verbatim in derivative
 works, provided that you conspicuously and appropriately publish on each copy
 a valid copyright notice "Copyright (C) 1994 by Alex Bronstein and Carolyn
 Talcott.  All Rights Reserved."

 NO WARRANTY

 Alex Bronstein and Carolyn Talcott PROVIDE ABSOLUTELY NO WARRANTY.  THE EVENT
 SCRIPT IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR
 IMPLIED, INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS TO
 THE QUALITY AND PERFORMANCE OF THE SCRIPT IS WITH YOU.  SHOULD THE SCRIPT
 PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR
 CORRECTION.

 IN NO EVENT WILL Alex Bronstein or Carolyn Talcott BE LIABLE TO YOU FOR ANY
 DAMAGES, ANY LOST PROFITS, LOST MONIES, OR OTHER SPECIAL, INCIDENTAL OR
 CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THIS SCRIPT
 (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE
 OR LOSSES SUSTAINED BY THIRD PARTIES), EVEN IF YOU HAVE ADVISED US OF THE
 POSSIBILITY OF SUCH DAMAGES, OR FOR ANY CLAIM BY ANY OTHER PARTY.

|#

\end{verbatim}
\noindent{\sc Event}:   Start with the library {\tt{"mlp"}} using the compiled version.

\addvspace{18pt}

\begin{verbatim}; counter.bm: a simple clock counter, x is the clock.
;     similar to acc when we take our output from the combinational elt.
;
; RESULTS:
; if we look at the combinational output (Ycomb)
;   with initial value of reg: 0 , OK can prove Ycomb = len . [log: counter]
;   with initial value of reg: 1 , fails (expectedly) in COUNT-CORRECT-AX
;        in case p x = e, [log: counter2] 
; if we look at Yreg (i.e. register output) then:
;   with initial value of reg: 0 , fails (expectedly) in COUNT-CORRECT-AX
;        in case p x = e, [log: counter4] 
;   with initial value of reg: 1 , OK can prove Yreg = len . [log: counter3]
; ANALYSIS:
;   The issue is a confusion of the intent of the SPEC: if we are counting the
; number of "pulses" then indeed we can look at the Reg-output, and initialize
; it with zero, because #pulse = len(clk) - 1 = len(any input string) - 1 .
; In other words, the issue is with NUMER-COUNT x =LEN x.  If we want to count
; the number of pulses, then we should have number-count x = len x -1, and
; then initialize w/ 0 and look at Reg-out. Check: OK!
; CONCLUSION:
;   The model (essentially Mealy) is fine even for looking at Reg-outs, but
; be careful of translating specs involving number of "clock ticks".  My tics
; are really "periods", and the engineer's tick are "pulses" of which there are
; always one less when based on an operational semantics looking at things 
; "at the end of clock periods".
;
; COMPARISON w/ PAILLET, and PAILLET inferred spec:

;;; DEFINITION OF CIRCUIT:
#|
(setq sysd '(sy-count (x)
(Ycomb S Inc Yreg)
(Yreg R 0 Ycomb)
))

(setq counter '( |#
; BM DEFINITIONS and A2 LEMMAS, generated by BMSYSD:
; comb_inc.bm: INCrement combinational element
; U7-DONE

\end{verbatim}\begin{tabbing}{\sc Definition}:\index{inc}$\;\;$
{\rm{inc}}\,({\it{u\/}})\index{inc} $=$ ($1\;+$ {\it{u\/}})
\end{tabbing}

\begin{verbatim}; Everything below generated by: (bmcomb 'inc '() '(x))

\end{verbatim}\begin{tabbing}{\sc Definition}:\index{s-inc} \\  
\=\+{\rm{s-inc}}\,({\it{x\/}})\index{s-inc} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{empty}}\,({\it{x\/}})\index{empty}$\;\;${\bf then }{\sc{e}}\index{e} \\ 
{\bf else }{\rm{a}}\,({\rm{s-inc}}\,({\rm{p}}\,({\it{x\/}})\index{p})\index{s-inc}, {\rm{inc}}\,({\rm{l}}\,({\it{x\/}})\index{l})\index{inc})\index{a}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim};; A2-Begin-S-INC

\end{verbatim}\begin{tabbing}{\sc Theorem}:  a2-empty-s-inc \\ \index{a2-empty-s-inc}
{\rm{empty}}\,({\rm{s-inc}}\,({\it{x\/}})\index{s-inc})\index{empty} $=$ {\rm{empty}}\,({\it{x\/}})\index{empty}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-e-s-inc \\ \index{a2-e-s-inc}
({\rm{s-inc}}\,({\it{x\/}})\index{s-inc} $=$ {\sc{e}}\index{e}) $=$ {\rm{empty}}\,({\it{x\/}})\index{empty}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-lp-s-inc \\ \index{a2-lp-s-inc}
{\rm{len}}\,({\rm{s-inc}}\,({\it{x\/}})\index{s-inc})\index{len} $=$ {\rm{len}}\,({\it{x\/}})\index{len}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-lpe-s-inc \\ \index{a2-lpe-s-inc}
{\rm{eqlen}}\,({\rm{s-inc}}\,({\it{x\/}})\index{s-inc}, {\it{x\/}})\index{eqlen}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-ic-s-inc \\ \index{a2-ic-s-inc}
{\rm{s-inc}}\,({\rm{i}}\,({\it{c\_x\/}}, {\it{x\/}})\index{i})\index{s-inc} $=$ {\rm{i}}\,({\rm{inc}}\,({\it{c\_x\/}})\index{inc}, {\rm{s-inc}}\,({\it{x\/}})\index{s-inc})\index{i}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-lc-s-inc \\ \index{a2-lc-s-inc}
($\neg$ {\rm{empty}}\,({\it{x\/}})\index{empty}) $\rightarrow$ ({\rm{l}}\,({\rm{s-inc}}\,({\it{x\/}})\index{s-inc})\index{l} $=$ {\rm{inc}}\,({\rm{l}}\,({\it{x\/}})\index{l})\index{inc})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-pc-s-inc \\ \index{a2-pc-s-inc}
{\rm{p}}\,({\rm{s-inc}}\,({\it{x\/}})\index{s-inc})\index{p} $=$ {\rm{s-inc}}\,({\rm{p}}\,({\it{x\/}})\index{p})\index{s-inc}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-hc-s-inc \\ \index{a2-hc-s-inc}
($\neg$ {\rm{empty}}\,({\it{x\/}})\index{empty}) $\rightarrow$ ({\rm{h}}\,({\rm{s-inc}}\,({\it{x\/}})\index{s-inc})\index{h} $=$ {\rm{inc}}\,({\rm{h}}\,({\it{x\/}})\index{h})\index{inc})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-bc-s-inc \\ \index{a2-bc-s-inc}
{\rm{b}}\,({\rm{s-inc}}\,({\it{x\/}})\index{s-inc})\index{b} $=$ {\rm{s-inc}}\,({\rm{b}}\,({\it{x\/}})\index{b})\index{s-inc}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-bnc-s-inc \\ \index{a2-bnc-s-inc}
{\rm{bn}}\,({\it{n\/}}, {\rm{s-inc}}\,({\it{x\/}})\index{s-inc})\index{bn} $=$ {\rm{s-inc}}\,({\rm{bn}}\,({\it{n\/}}, {\it{x\/}})\index{bn})\index{s-inc}
\end{tabbing}

\begin{verbatim};; A2-End-S-INC

; eof:comb_inc.bm


\end{verbatim}\begin{tabbing}{\sc Definition}:\index{topor-sy-count} \\  
\=\+{\rm{topor-sy-count}}\,({\it{ln\/}})\index{topor-sy-count} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{ln\/}} $=$ {\tt{'}}{\tt{ycomb}}$\;\;${\bf then }{\tt{1}} \\ 
{\bf elseif }{\it{ln\/}} $=$ {\tt{'}}{\tt{yreg}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{sy-count} \\  
\=\+{\rm{sy-count}}\,({\it{ln\/}}, {\it{x\/}})\index{sy-count} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{ln\/}} $=$ {\tt{'}}{\tt{ycomb}}$\;\;${\bf then }{\rm{s-inc}}\,({\rm{sy-count}}\,({\tt{'}}{\tt{yreg}}, {\it{x\/}})\index{sy-count})\index{s-inc} \\ 
{\bf elseif }{\it{ln\/}} $=$ {\tt{'}}{\tt{yreg}} \\ 
{\bf then }\=\+{\bf if }{\rm{empty}}\,({\it{x\/}})\index{empty}$\;\;${\bf then }{\sc{e}}\index{e} \\ 
{\bf else }{\rm{i}}\,({\tt{0}}, {\rm{sy-count}}\,({\tt{'}}{\tt{ycomb}}, {\rm{p}}\,({\it{x\/}})\index{p})\index{sy-count})\index{i}$\;${\bf  endif}\- \\ 
{\bf else }{\rm{sfix}}\,({\it{x\/}})\index{sfix}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim};; A2-Begin-SY-COUNT

\end{verbatim}\begin{tabbing}{\sc Theorem}:  a2-empty-sy-count \\ \index{a2-empty-sy-count}
{\rm{empty}}\,({\rm{sy-count}}\,({\it{ln\/}}, {\it{x\/}})\index{sy-count})\index{empty} $=$ {\rm{empty}}\,({\it{x\/}})\index{empty}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-e-sy-count \\ \index{a2-e-sy-count}
({\rm{sy-count}}\,({\it{ln\/}}, {\it{x\/}})\index{sy-count} $=$ {\sc{e}}\index{e}) $=$ {\rm{empty}}\,({\it{x\/}})\index{empty}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-lp-sy-count \\ \index{a2-lp-sy-count}
{\rm{len}}\,({\rm{sy-count}}\,({\it{ln\/}}, {\it{x\/}})\index{sy-count})\index{len} $=$ {\rm{len}}\,({\it{x\/}})\index{len}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-lpe-sy-count \\ \index{a2-lpe-sy-count}
{\rm{eqlen}}\,({\rm{sy-count}}\,({\it{ln\/}}, {\it{x\/}})\index{sy-count}, {\it{x\/}})\index{eqlen}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  a2-pc-sy-count \\ \index{a2-pc-sy-count}
{\rm{p}}\,({\rm{sy-count}}\,({\it{ln\/}}, {\it{x\/}})\index{sy-count})\index{p} $=$ {\rm{sy-count}}\,({\it{ln\/}}, {\rm{p}}\,({\it{x\/}})\index{p})\index{sy-count}
\end{tabbing}

\begin{verbatim};; A2-End-SY-COUNT

;;; SPEC definition:
; FIRST (misunderstood) spec:
; note: written when looking at the combinational output..
;
;(defn numer-count (x)
;  (if (empty x)
;      0
;      (inc (numer-count (p x)) )))
;
; intent verification: should have numer-count = len; prove but don't use.
;(prove-lemma numer-count-len ()
;(equal (numer-count x) (len x))
;)

\end{verbatim}\begin{tabbing}{\sc Definition}:\index{numer-count} \\  
\=\+{\rm{numer-count}}\,({\it{x\/}})\index{numer-count} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{empty}}\,({\it{x\/}})\index{empty}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{len}}\,({\it{x\/}})\index{len} $-\;1$$\;${\bf  endif}\-\-
\end{tabbing}   \begin{verbatim};a cheap way: (len (p x))

; this is the standard extension from last-char-fun to MLP-string-fun, 
; see theta.bm .
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{spec-count} \\  
\=\+{\rm{spec-count}}\,({\it{x\/}})\index{spec-count} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{empty}}\,({\it{x\/}})\index{empty}$\;\;${\bf then }{\sc{e}}\index{e} \\ 
{\bf else }{\rm{a}}\,({\rm{spec-count}}\,({\rm{p}}\,({\it{x\/}})\index{p})\index{spec-count}, {\rm{numer-count}}\,({\it{x\/}})\index{numer-count})\index{a}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; Paillet's spec do not define an additional function, just a relation
; that must be verified by the circuit output. See below.

;;; Circuit CORRECTNESS:
; THIS is where it matters which line we take as output!

; Count-correct-ax is a "predicative correctness statement", i.e. what we would
; do if we didn't have functional equality as a specification method, but 
; instead used a purely axiomatic approach.

\end{verbatim}\begin{tabbing}{\sc Theorem}:  count-correct-ax \\ \index{count-correct-ax}
($\neg$ {\rm{empty}}\,({\it{x\/}})\index{empty}) $\rightarrow$ ({\rm{l}}\,({\rm{sy-count}}\,({\tt{'}}{\tt{yreg}}, {\it{x\/}})\index{sy-count})\index{l} $=$ {\rm{numer-count}}\,({\it{x\/}})\index{numer-count})
\end{tabbing}

\begin{verbatim}; to go to a functional equality once we have the "last" (ax) statement is
; a trivial induction, if we start out with an P-L split which is unnatural
; for BM, so we force it w/ a USE hint of A-p-l-split

\end{verbatim}\begin{tabbing}{\sc Theorem}:  a-p-l-split \\ \index{a-p-l-split}
\=\+($\neg$ {\rm{empty}}\,({\it{x\/}})\index{empty}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{sy-count}}\,({\tt{'}}{\tt{yreg}}, {\it{x\/}})\index{sy-count} \\ 
$=$$\;\;\;\;${\rm{a}}\,({\rm{p}}\,({\rm{sy-count}}\,({\tt{'}}{\tt{yreg}}, {\it{x\/}})\index{sy-count})\index{p}, {\rm{l}}\,({\rm{sy-count}}\,({\tt{'}}{\tt{yreg}}, {\it{x\/}})\index{sy-count})\index{l})\index{a})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  count-correct \\ \index{count-correct}
{\rm{sy-count}}\,({\tt{'}}{\tt{yreg}}, {\it{x\/}})\index{sy-count} $=$ {\rm{spec-count}}\,({\it{x\/}})\index{spec-count}
\end{tabbing}

\begin{verbatim}; PAILLET CORRECTNESS:
\end{verbatim}
\noindent{\sc Event}:   Disable count-correct.

\addvspace{18pt}

\noindent{\sc Event}:   Disable count-correct-ax.

\addvspace{18pt}

\begin{verbatim}; count-paillet-correct obtained trivially (without recursion) as expected.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  count-paillet-correct \\ \index{count-paillet-correct}
\=\+($\neg$ {\rm{empty}}\,({\it{x\/}})\index{empty}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{sy-count}}\,({\tt{'}}{\tt{yreg}}, {\it{x\/}})\index{sy-count} $=$ {\rm{i}}\,({\tt{0}}, {\rm{s-inc}}\,({\rm{p}}\,({\rm{sy-count}}\,({\tt{'}}{\tt{yreg}}, {\it{x\/}})\index{sy-count})\index{p})\index{s-inc})\index{i})\-
\end{tabbing}

\begin{verbatim}; my (more intuitive) version of "simple" (no recursion req'd) correctness:
\end{verbatim}\begin{tabbing}{\sc Theorem}:  count-correct-simple \\ \index{count-correct-simple}
\=\+(($\neg$ {\rm{empty}}\,({\it{x\/}})\index{empty}) $\wedge$ ($\neg$ {\rm{empty}}\,({\rm{p}}\,({\it{x\/}})\index{p})\index{empty})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{l}}\,({\rm{sy-count}}\,({\tt{'}}{\tt{yreg}}, {\it{x\/}})\index{sy-count})\index{l} $=$ {\rm{inc}}\,({\rm{l}}\,({\rm{p}}\,({\rm{sy-count}}\,({\tt{'}}{\tt{yreg}}, {\it{x\/}})\index{sy-count})\index{p})\index{l})\index{inc})\-
\end{tabbing}

\begin{verbatim}; eof: counter.bm
;))
\end{verbatim}
%\end{list}
\printindex
\end{document}
