Newer
Older
In this changelog, we document "large-ish" changes to Iris that affect even the
way the logic is used on paper. We also mention some significant changes in the
Coq development, but not every API-breaking change is listed. Changes marked
`[#]` still need to be ported to the Iris Documentation LaTeX file(s).
* [#] Change in the definition of WP, so that there is a fancy update between
the quantification over the next states and the later modality. This makes it
possible to prove more powerful lifting lemmas: The new versions feature an
* [#] Weaken the semantics of CAS in heap_lang to be efficiently implementable:
CAS may only be used to compare "unboxed" values that can be represented in a
single machine word.
* [#] Add weakest preconditions for total program correctness.
* [#] "(Potentially) stuck" weakest preconditions are no longer considered
experimental.
* [#] The adequacy statement for weakest preconditions now also involves the
final state.
* [#] The Löb rule is now a derived rule; it follows from later-intro, later
being contractive and the fact that we can take fixpoints of contractive
functions.
* [#] Add atomic updates and logically atomic triples, including tactic support.
See `heap_lang/lib/increment.v` for an example.
* [#] heap_lang now uses right-to-left evaluation order. This makes it
significantly easier to write specifications of curried functions.
* An all-new generalized proof mode that abstracts away from Iris! See
<http://iris-project.org/mosel/> for the corresponding paper. Major new
features:
- The proof mode can now be used with logics derived from Iris (like iGPS),
with non-step-indexed logics and even with non-affine (i.e., linear) logics.
- `iModIntro` is more flexible and more powerful, it now also subsumes
`iNext` and `iAlways`.
- General infrastructure for deriving a logic for monotone predicates over
an existing logic (see the paper for more details).
Developments instantiating the proof mode typeclasses may need significant
changes. For developments just using the proof mode tactics, porting should
- All the BI laws moved from the `uPred` module to the `bi` module. For
example, `uPred.later_equivI` became `bi.later_equivI`.
- Big-ops are automatically imported, imports of `iris.base_logic.big_op` have
to be removed.
- The ⊢ notation can sometimes infer different (but convertible) terms when
seraching for the BI to use, which (due to Coq limitations) can lead to
failing rewrites, in particular when rewriting at function types.
* The `iInv` tactic can now be used without the second argument (the name for
the closing update). It will then instead add the obligation to close the
invariant to the goal.
* Added support for defining derived connectives involving n-ary binders using
telescopes.
* The proof mode now more consistently "prettifies" the goal after each tactic.
Prettification also simplifies some BI connectives, like conditional
modalities and telescope quantifiers.
* Improved pretty-printing of Iris connectives (in particular WP and fancy
updates) when Coq has to line-wrap the output. This goes hand-in-hand with an
improved test suite that also tests pretty-printing.
* Added a `gmultiset` RA.
* Rename `timelessP` -> `timeless` (projection of the `Timeless` class)
* The CMRA axiom `cmra_extend` is now stated in `Type`, using `sigT` instead of
in `Prop` using `exists`. This makes it possible to define the function space
* Rename proof mode type classes for laters:
- `IntoLaterN` → `MaybeIntoLaterN` (this one _may_ strip a later)
- `IntoLaterN'` → `IntoLaterN` (this one _should_ strip a later)
- `IntoLaterNEnv` → `MaybeIntoLaterNEnv`
- `IntoLaterNEnvs` → `MaybeIntoLaterNEnvs`
Robbert Krebbers
committed
* Rename:
- `frag_auth_op` → `frac_auth_frag_op`
Robbert Krebbers
committed
- `cmra_opM_assoc` → `cmra_op_opM_assoc`
- `cmra_opM_assoc_L` → `cmra_op_opM_assoc_L`
- `cmra_opM_assoc'` → `cmra_opM_opM_assoc`
* Changed `IntoVal` to be directly usable for rewriting `e` into `of_val v`, and
changed `AsVal` to be usable for rewriting via the `[v <-]` destruct pattern.
* Define `uPred` as a quotient on monotone predicates `M -> SProp`.
* Get rid of some primitive laws; they can be derived:
`True ⊢ □ True` and `□ (P ∧ Q) ⊢ □ (P ∗ Q)`
* Camera morphisms have to be homomorphisms, not just monotone functions.
* Add a proof that `f` has a fixed point if `f^k` is contractive.
* Constructions for least and greatest fixed points over monotone predicates
(defined in the logic of Iris using impredicative quantification).
* [Experimental feature] Support verifying code that might get stuck by
distinguishing "non-stuck" vs. "(potentially) stuck" weakest
preconditions. (See [Swasey et al., OOPSLA '17] for examples.) The non-stuck
`WP e @ E {{ Φ }}` ensures that, as `e` runs, it does not get stuck. The stuck
`WP e @ E ?{{ Φ }}` ensures that, as usual, all invariants are preserved while
`e` runs, but it permits execution to get stuck. The former implies the
latter. The full judgment is `WP e @ s; E {{ Φ }}`, where non-stuck WP uses
*stuckness bit* `s = NotStuck` while stuck WP uses `s = MaybeStuck`.
* Move the `prelude` folder to its own project:
[coq-std++](https://gitlab.mpi-sws.org/robbertkrebbers/coq-stdpp)
* Some extensions/improvements of heap_lang:
- Improve handling of pure (non-state-dependent) reductions.
- Add fetch-and-add (`FAA`) operation.
- Add syntax for all Coq's binary operations on `Z`.
* Generalize `saved_prop` to let the user choose the location of the type-level
later. Rename the general form to `saved_anything`. Provide `saved_prop` and
`saved_pred` as special cases.
* Improved big operators:
+ They are no longer tied to cameras, but work on any monoid
+ The version of big operations over lists was redefined so that it enjoys
more definitional equalities.
- The unit of a camera: `empty` -> `unit`, `∅` -> `ε`
- OFEs with all elements being discrete: `Discrete` -> `OfeDiscrete`
- OFE elements whose equality is discrete: `Timeless` -> `Discrete`
- Timeless propositions: `TimelessP` -> `Timeless`
- Camera elements such that `core x = x`: `Persistent` -> `CoreId`
- Persistent propositions: `PersistentP` -> `Persistent`
- The persistent modality: `always` -> `persistently`
- Adequacy for non-stuck weakestpre: `adequate_safe` -> `adequate_not_stuck`
+ `CMRAMixin` -> `CmraMixin`
+ `CMRAT` -> `CmraT`
+ `CMRATotal` -> `CmraTotal`
+ `CMRAMorphism` -> `CmraMorphism`
+ `CMRADiscrete` -> `CmraDiscrete`
+ `UCMRAMixin` -> `UcmraMixin`
+ `UCMRAT` -> `UcmraT`
+ `DRAMixin` -> `DraMixin`
+ `DRAT` -> `DraT`
+ `STS` -> `Sts`
- Many lemmas also changed their name. `always_*` became `persistently_*`,
and furthermore: (the following list is not complete)
+ `impl_wand` -> `impl_wand_1` (it only involves one direction of the
equivalent)
+ `always_impl_wand` -> `impl_wand`
+ `always_and_sep_l` -> `and_sep_l`
+ `always_and_sep_r` -> `and_sep_r`
+ `always_sep_dup` -> `sep_dup`
+ `wand_impl_always` -> `impl_wand_persistently` (additionally,
the direction of this equivalence got swapped for consistency's sake)
+ `always_wand_impl` -> `persistently_impl_wand` (additionally, the
direction of this equivalence got swapped for consistency's sake)
The following `sed` snippet should get you most of the way:
sed 's/\bPersistentP\b/Persistent/g; s/\bTimelessP\b/Timeless/g; s/\bCMRADiscrete\b/CmraDiscrete/g; s/\bCMRAT\b/CmraT/g; s/\bCMRAMixin\b/CmraMixin/g; s/\bUCMRAT\b/UcmraT/g; s/\bUCMRAMixin\b/UcmraMixin/g; s/\bSTS\b/Sts/g' -i $(find -name "*.v")
* `PersistentL` and `TimelessL` (persistence and timelessness of lists of
propositions) are replaces by `TCForall` from std++.
* Fix a bunch of consistency issues in the proof mode, and make it overall more
usable. In particular:
- All proof mode tactics start the proof mode if necessary; `iStartProof` is
no longer needed and should only be used for building custom proof mode
tactics.
- Change in the grammar of specialization patterns: `>[...]` -> `[> ...]`
- Various new specification patterns for `done` and framing.
- There is common machinery for symbolic execution of pure reductions. This
is provided by the type classes `PureExec` and `IntoVal`.
- There is a new connective `tc_opaque`, which can be used to make definitions
opaque for type classes, and thus opaque for most tactics of the proof
mode.
- Define Many missing type class instances for distributing connectives.
- Implement the tactics `iIntros (?)` and `iIntros "!#"` (i.e. `iAlways`)
using type classes. This makes them more generic, e.g., `iIntros (?)` also
works when the universal quantifier is below a modality, and `iAlways` also
works for the plainness modality. A breaking change, however, is that these
tactics now no longer work when the universal quantifier or modality is
behind a type class opaque definition. Furthermore, this can change the
name of anonymous identifiers introduced with the "%" pattern.
* Make `ofe_fun` dependently typed, subsuming `iprod`. The latter got removed.
* Define the generic `fill` operation of the `ectxi_language` construct in terms
of a left fold instead of a right fold. This gives rise to more definitional
equalities.
* The language hierarchy (`language`, `ectx_language`, `ectxi_language`) is now
fully formalized using canonical structures instead of using a mixture of
type classes and canonical structures. Also, it now uses explicit mixins. The
file `program_logic/ectxi_language` contains some documentation on how to
setup Iris for your language.
* Restore the original, stronger notion of atomicity alongside the weaker
notion. These are `Atomic a e` where the stuckness bit `s` indicates whether
expression `e` is weakly (`a = WeaklyAtomic`) or strongly
(`a = StronglyAtomic`) atomic.
* Various improvements to `solve_ndisj`.
* Use `Hint Mode` to prevent Coq from making arbitrary guesses in the presence
of evars, which often led to divergence. There are a few places where type
annotations are now needed.
* The rules `internal_eq_rewrite` and `internal_eq_rewrite_contractive` are now
* There now is a deprecation process. The modules `*.deprecated` contain
deprecated notations and definitions that are provided for backwards
compatibility and will be removed in a future version of Iris.
* View shifts are radically simplified to just internalize frame-preserving
updates. Weakestpre is defined inside the logic, and invariants and view
shifts with masks are also coded up inside Iris. Adequacy of weakestpre is
proven in the logic. The old ownership of the entire physical state is
replaced by a user-selected predicate over physical state that is maintained
by weakestpre.
* Use OFEs instead of COFEs everywhere. COFEs are only used for solving the
recursive domain equation. As a consequence, CMRAs no longer need a proof of
completeness. (The old `cofeT` is provided by `algebra.deprecated`.)
* Implement a new agreement construction. Unlike the old one, this one
preserves discreteness. dec_agree is thus no longer needed and has been moved
to algebra.deprecated.
* Renaming and moving things around: uPred and the rest of the base logic are in
`base_logic`, while `program_logic` is for everything involving the general
Iris notion of a language.
* Renaming in prelude.list: Rename `prefix_of` -> `prefix` and `suffix_of` ->
`suffix` in lemma names, but keep notation ``l1 `prefix_of` l2`` and ``l1
`suffix_of` l2``. `` l1 `sublist` l2`` becomes ``l1 `sublist_of` l2``. Rename
`contains` -> `submseteq` and change `` l1 `contains` l2`` to ``l1 ⊆+ l2``.
* Slightly weaker notion of atomicity: an expression is atomic if it reduces in
one step to something that does not reduce further.
* Changed notation for embedding Coq assertions into Iris. The new notation is
⌜φ⌝. Also removed `=` and `⊥` from the Iris scope. (The old notations are
* Up-closure of namespaces is now a notation (↑) instead of a coercion.
* With invariants and the physical state being handled in the logic, there is no
longer any reason to demand the CMRA unit to be discrete.
* Local Updates (for the authoritative monoid) are now a 4-way relation with
syntax-directed lemmas proving them.
* [heap_lang] No longer use dependent types for expressions. Instead, values
carry a proof of closedness. Substitution, closedness and value-ness proofs
are performed by computation after reflecting into a term langauge that knows
about values and closed expressions.
* [program_logic/language] The language does not define its own "atomic"
predicate. Instead, atomicity is defined as reducing in one step to a value.
* [program_logic] Due to a lack of maintenance and usefulness, lifting lemmas
for Hoare triples are removed.
## Iris 2.0-rc2
* [algebra] Make the core of an RA or CMRA a partial function.
* [program_logic/lifting] Lifting lemmas no longer round-trip through a
user-chosen predicate to define the configurations we can reduce to; they
directly relate to the operational semantics. This is equivalent and
much simpler to read.
This is the Coq development and Iris Documentation as submitted to ICFP 2016.