A \emph{language}$\Lang$ consists of a set \Expr{} of \emph{expressions} (metavariable $\expr$), a set \Val{} of \emph{values} (metavariable $\val$), and a nonempty set $\State$ of \emph{states} (metavariable $\state$) such that
A \emph{language}$\Lang$ consists of a set \Expr{} of \emph{expressions} (metavariable $\expr$), a set \Val{} of \emph{values} (metavariable $\val$), a set $\Obs$ of \emph{observations} and a set $\State$ of \emph{states} (metavariable $\state$) such that
\begin{itemize}[itemsep=0pt]
\item There exist functions $\ofval : \Val\to\Expr$ and $\toval : \Expr\pfn\Val$ (notice the latter is partial), such that
\item There exists a \emph{primitive reduction relation}\[(-,-\step-,-,-)\subseteq\Expr\times\State\times\Expr\times\State\times\List(\Expr)\]
A reduction $\expr_1, \state_1\step\expr_2, \state_2, \overline\expr$ indicates that, when $\expr_1$reduces to $\expr_2$, the new threads in the list $\overline\expr$ is forked off.
We will write $\expr_1, \state_1\step\expr_2, \state_2$ for $\expr_1, \state_1\step\expr_2, \state_2, ()$, \ie when no threads are forked off. \\
\item There exists a \emph{primitive reduction relation}\[(-,-\;\step[-]\;-,-,-)\subseteq(\Expr\times\State)\times\List(\Obs)\times(\Expr\times\State\times\List(\Expr))\]
A reduction $\expr_1, \state_1\step[\vec\obs]\expr_2, \state_2, \vec\expr$ indicates that, when $\expr_1$in state $\state_1$ reduces to $\expr_2$ with new state $\state_2$, the new threads in the list $\vec\expr$ is forked off and the observations $\vec\obs$ are made.
We will write $\expr_1, \state_1\step\expr_2, \state_2$ for $\expr_1, \state_1\step[()]\expr_2, \state_2, ()$, \ie when no threads are forked off and no observations are made. \\
\item All values are stuck:
\[\expr, \_\step\_, \_, \_\Ra\toval(\expr)=\bot\]
\end{itemize}
\begin{defn}
An expression $\expr$ and state $\state$ are \emph{reducible} (written $\red(\expr, \state)$) if
@@ -156,17 +156,17 @@ Finally, we can define the core piece of the program logic, the proposition that
\paragraph{Defining weakest precondition.}
We assume that everything making up the definition of the language, \ie values, expressions, states, the conversion functions, reduction relation and all their properties, are suitably reflected into the logic (\ie they are part of the signature $\Sig$).
We further assume (as a parameter) a predicate $\stateinterp : \State\times\mathbb N \to\iProp$ that interprets the machine state as an Iris proposition, and a predicate $\pred_F: \Val\to\iProp$ that serves as postcondition for forked-of threads.
The state interpretation can depend on the current physical state as well as the total number of \emph{forked} threads (that is one less that the total number of threads).
We further assume (as a parameter) a predicate $\stateinterp : \State\times\List(\Obs)\times\mathbb N \to\iProp$ that interprets the machine state as an Iris proposition, and a predicate $\pred_F: \Val\to\iProp$ that serves as postcondition for forked-of threads.
The state interpretation can depend on the current physical state, the list of \emph{future} observations as well as the total number of \emph{forked} threads (that is one less that the total number of threads).
This can be instantiated, for example, with ownership of an authoritative RA to tie the physical state to fragments that are used for user-level proofs.
Finally, weakest precondition takes a parameter $\stuckness\in\set{\NotStuck, \MaybeStuck}$ indicating whether program execution is allowed to get stuck.
The $\stateinterp$ and $\pred_F$ will always be set by the context; typically, when instantiating Iris with a language, we also pick the corresponding state interpretation $\stateinterp$ and fork-postcondition $\pred_F$.
...
...
@@ -209,13 +209,15 @@ The following rules can all be derived:
\end{mathpar}
We will also want a rule that connect weakest preconditions to the operational semantics of the language.
This basically just copies the second branch (the non-value case) of the definition of weakest preconditions.
\begin{mathpar}
\infer[wp-lift-step]
{\toval(\expr_1) = \bot}
{{\begin{inbox}% for some crazy reason, LaTeX is actually sensitive to the space between the "{ {" here and the "} }" below...
@@ -253,7 +255,7 @@ There are two properties we are looking for: First of all, the postcondition sho
Second, a proof of a weakest precondition with any postcondition should imply that the program is \emph{safe}, \ie that it does not get stuck.
\begin{defn}[Adequacy]
A program $\expr$ in some initial state $\state$ is \emph{adequate} for stuckness $\stuckness$ and a set $V \subseteq\Val\times\State$ of legal return-value-final-state combinations (written $\expr, \state\vDash_\stuckness V$) if for all $\tpool', \state'$ such that $([\expr], \state)\tpstep^\ast(\tpool', \state')$ we have
A program $\expr$ in some initial state $\state$ is \emph{adequate} for stuckness $\stuckness$ and a set $V \subseteq\Val\times\State$ of legal return-value-final-state combinations (written $\expr, \state\vDash_\stuckness V$) if for all $\tpool', \state'$ such that $([\expr], \state)\tpsteps[\vec\obs](\tpool', \state')$ we have
\begin{enumerate}
\item Safety: If $\stuckness=\NotStuck$, then for any $\expr' \in\tpool'$ we have that either $\expr'$ is a
value, or \(\red(\expr'_i,\state')\):
...
...
@@ -274,19 +276,20 @@ Furthermore, we assume that the \emph{interpretation} $\Sem\pred$ of $\pred$ ref
The signature can of course state arbitrary additional properties of $\pred$, as long as they are proven sound.
The adequacy statement now reads as follows:
\begin{align*}
&\All\mask, \expr, \val, \state.
\\&( \TRUE\proves\pvs[\mask]\Exists\stateinterp, \pred_F. \stateinterp(\state,0) * \wpre[\stateinterp;\pred_F]{\expr}[\stuckness;\mask]{x.\;\All\state, m. \stateinterp(\state', m) \vsW[\top][\emptyset]\pred(x,\state')}) \Ra
&\All\mask, \expr, \state.
\\&( \TRUE\proves\All\vec\obs. \pvs[\mask]\Exists\stateinterp, \pred_F. \stateinterp(\state,\vec\obs,0) * \wpre[\stateinterp;\pred_F]{\expr}[\stuckness;\mask]{x.\;\All\state, m. \stateinterp(\state', (), m) \vsW[\top][\emptyset]\pred(x,\state')}) \Ra
\\&\expr, \state\vDash_\stuckness V
\end{align*}
Notice that the state invariant $S$ used by the weakest precondition is chosen \emph{after} doing a fancy update, which allows it to depend on the names of ghost variables that are picked in that initial fancy update.
Also, notice that the proof of $\expr$ must be performed with a universally quantified list of observations $\vec\obs$, but the \emph{entire} list is known to the proof from the beginning.
The following variant of adequacy also allows exploiting the second parameter of $\stateinterp$, the number of threads, but only applies when \emph{all} threads have reduced to a value:
