Skip to content
GitLab
Projects
Groups
Snippets
Help
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
I
iris-time-proofs
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Service Desk
Milestones
Merge Requests
0
Merge Requests
0
Operations
Operations
Incidents
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
MEVEL Glen
iris-time-proofs
Commits
50f77ef7
Commit
50f77ef7
authored
Jul 08, 2018
by
MEVEL Glen
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
end-to-end proof of the soundness theorem for time receipts
parent
c5b40db9
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
86 additions
and
1 deletion
+86
-1
src/TimeReceipts.v
src/TimeReceipts.v
+86
-1
No files found.
src/TimeReceipts.v
View file @
50f77ef7
...
...
@@ -26,6 +26,7 @@ Implicit Type m n : nat.
* pentagons: ⬟ ⬠
* hexagons: ⬢ ⬡
* shogi pieces: ☗ ☖
* sandglasses: ⧗ ⧖
* other: ⮝ ⮙ ⯊ ⯎
*)
...
...
@@ -260,7 +261,91 @@ Notation "« t »" := (trtranslation <$> t%E) (only printing).
Section
Soundness
.
(* TODO *)
Lemma
adequate_trtranslation__adequate
m
(
φ
:
val
→
Prop
)
e
σ
:
is_closed
[]
e
→
(
∀
`
{
timeReceiptLoc
},
adequate
NotStuck
«
e
»
S
«σ
,
m
»
(
φ
∘
invtranslationV
))
→
adequate_n
NotStuck
m
e
σ
φ
.
Proof
.
intros
.
apply
(
adequate_translation__adequate
(
λ
ℓ
1
,
@
tock
{|
timeReceiptLoc_loc
:
=
ℓ
1
|})).
-
intro
ℓ
1
.
rewrite
(
_
:
ℓ
1
=
@
timeReceiptLoc_loc
{|
timeReceiptLoc_loc
:
=
ℓ
1
|})
;
last
done
.
apply
exec_tick_success
.
-
done
.
-
intro
ℓ
1
.
rewrite
(
_
:
ℓ
1
=
@
timeReceiptLoc_loc
{|
timeReceiptLoc_loc
:
=
ℓ
1
|})
;
last
done
.
done
.
Qed
.
(* derive the adequacy of the translated program from a Hoare triple in Iris. *)
Lemma
auth_mnat_alloc
`
{
inG
Σ
(
authR
mnatUR
)}
(
n
:
mnat
)
:
(|==>
∃
γ
,
own
γ
(
●
mnat
n
)
∗
own
γ
(
◯
mnat
n
))%
I
.
Proof
.
by
iMod
(
own_alloc
(
●
mnat
n
⋅
◯
mnat
n
))
as
(
γ
)
"[? ?]"
;
auto
with
iFrame
.
Qed
.
Global
Arguments
auth_mnat_alloc
{
_
_
}
n
%
nat
.
Lemma
spec_trtranslation__adequate_translation
{
Σ
}
(
nmax
:
nat
)
(
ψ
:
val
→
Prop
)
e
:
(
0
<
nmax
)%
nat
→
(
∀
`
{!
timeReceiptHeapG
Σ
},
TOCKCTXT
nmax
-
∗
{{{
True
}}}
«
e
»
{{{
v
,
RET
v
;
⌜ψ
v
⌝
}}}
)
→
∀
`
{!
timeReceiptHeapPreG
Σ
}
`
{!
timeReceiptLoc
}
σ
,
adequate
NotStuck
«
e
»
S
«σ
,
nmax
-
1
»
ψ
.
Proof
.
intros
Inmax
Hspec
HpreG
Hloc
σ
.
(* apply the adequacy results. *)
apply
(
wp_adequacy
_
_
)
;
simpl
;
intros
HinvG
.
(* … now we have to prove a WP. *)
set
σ
'
:
=
S
«σ»
.
(* allocate the heap, including cell ℓ (on which we need to keep an eye): *)
iMod
(
own_alloc
(
●
to_gen_heap
(<[
ℓ
:
=
#(
nmax
-
1
)%
nat
]>
σ
'
)
⋅
◯
to_gen_heap
{[
ℓ
:
=
#(
nmax
-
1
)%
nat
]}))
as
(
h
)
"[Hh● Hℓ◯]"
.
{
apply
auth_valid_discrete_2
;
split
.
-
rewrite
-
insert_delete
;
set
σ
''
:
=
delete
ℓ
σ
'
.
unfold
to_gen_heap
;
rewrite
2
!
fmap_insert
fmap_empty
insert_empty
.
exists
(
to_gen_heap
σ
''
).
rewrite
(@
gmap
.
insert_singleton_op
_
_
_
_
(
to_gen_heap
σ
''
))
//.
rewrite
lookup_fmap
;
apply
fmap_None
,
lookup_delete
.
-
apply
to_gen_heap_valid
.
}
(* allocate the ghost state associated with ℓ: *)
iMod
(
auth_nat_alloc
0
)
as
(
γ
1
)
"[Hγ1● _]"
.
iMod
(
auth_mnat_alloc
0
)
as
(
γ
2
)
"[Hγ2● _]"
.
(* packing all those bits, build the heap instance necessary to use time credits: *)
pose
(
Build_timeReceiptHeapG
Σ
(
HeapG
Σ
_
(
GenHeapG
_
_
Σ
_
_
_
h
))
_
_
_
γ
1
γ
2
)
as
HtrHeapG
.
(* create the invariant: *)
iAssert
(|={
⊤
}=>
TOCKCTXT
nmax
)%
I
with
"[Hℓ◯ Hγ1● Hγ2●]"
as
"> Hinv"
.
{
iApply
inv_alloc
.
iExists
0
%
nat
.
rewrite
(
_
:
nmax
-
0
-
1
=
Z
.
of_nat
(
nmax
-
1
))
;
last
lia
.
unfold
mapsto
;
destruct
mapsto_aux
as
[
_
->]
;
simpl
.
unfold
to_gen_heap
;
rewrite
fmap_insert
fmap_empty
insert_empty
.
by
iFrame
.
}
iModIntro
.
(* finally, use the user-given specification: *)
iExists
gen_heap_ctx
.
iFrame
"Hh●"
.
iApply
(
Hspec
with
"Hinv"
)
;
auto
.
Qed
.
Lemma
spec_trtranslation__adequate
{
Σ
}
(
nmax
:
nat
)
(
φ
:
val
→
Prop
)
e
:
(
0
<
nmax
)%
nat
→
is_closed
[]
e
→
(
∀
`
{!
timeReceiptHeapG
Σ
},
TOCKCTXT
nmax
-
∗
{{{
True
}}}
«
e
»
{{{
v
,
RET
v
;
⌜φ
(
invtranslationV
v
)
⌝
}}}
)
→
∀
`
{!
timeReceiptHeapPreG
Σ
}
σ
,
adequate_n
NotStuck
(
nmax
-
1
)
e
σ
φ
.
Proof
.
intros
Inmax
Hclosed
Hspec
HpreG
σ
.
eapply
adequate_trtranslation__adequate
;
first
done
.
intros
Hloc
.
by
eapply
spec_trtranslation__adequate_translation
.
Qed
.
End
Soundness
.
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment