Hoare triples Sample Clauses

Hoare triples. 9 2.2.2 Characterization of reachability 10 2.2.3 Invariant proof rules 10 2.3 Refinement 11 2.3.1 Relational Hoare tuples 11

Hoare triples. ‌ definition × ⇒

Hoare triples. Our Hoare rules are syntax-directed, omitting structural rules. Separation logic’s frame rule is admissible. Separation logic’s auxiliary variable rule is subsumed by our syntax for existential unpacking. We omit the rules of conjunction and disjunction, and did not need them in the examples we considered. We could soundly add the rule of disjunction. To add the rule of conjunction, we would need to assume that preconditions of run() are supported [14].9 8 The subtyping rule for run is restricted to avoid dependencies between pre- and postcondition. 9 Supported formulas are formulas that have the property that, for any resource, the set of sub- resources that satisfy it is either empty or has a least element. They play a similar role for intuitionistic predicates, as precise formulas for non-intuitionistic predicates [24]. In our vari-‌ ant of separation logic, all predicates are intuitionistic, as we admit weakening. € { } { } € { } { } Hoare triples have the forms (Γ ; v F c : T G ) and (Γ ; v F hc G ), where v is the receiver parameter. We present a few selected rules and refer to [16] for the com- plete rule system. The rules for reading and writing fields are standard: Γ ; v; F € PointsTo(w. f , π, u) Γ € w : U T f ∈ fld(U ) T [w/this] <: Γ (A) A ƒ∈ F Γ ; v € {F}A = w. f {F * A == u} Γ € v, F : Object, ¤ Γ € u : U T f ∈ fld(U ) Γ € w : T [u/this] Γ ; v € {F * PointsTo(u. f , 1, T )}u. f = w{F * PointsTo(u. f , 1, w)} The rule for forking a thread consumes run’s precondition. The postcondition of fork() is empty.10 The rule makes use of the function mtype(m, T ), which looks up m’s type in the smallest supertype of T that declares m: mtype(run, T ) = req G; xxx Xx; void run(T ı0;) A ƒ∈ F Γ (A) = void Γ € u : T <: Thread Γ ; v; F € u != null Γ ; v € {F * G[u/ı0]}A = u.fork(){F} The most interesting rule is the one for joining threads. It allows the caller to ex- change a fraction fr of the join-permission Perm(u.join, 1) for a fraction fr of x.xxx’s postcondition:11 mtype(run, T ) = req G; xxx Xx; void run(T ı0;) fr = all or Gj is supported A ƒ∈ F Γ (A) = void Γ € u : T <: Thread Γ ; v; F € u != null Γ ; v € {F * fr · Perm(u.join, 1)}A = u.join(){F * fr · Gj[u/ı0]} ∑ 2i Here, fr ranges over linear combinations. These represent numbers of the forms 1 or n i=1 biti · 1 : bit ∈ {0, 1} bits ::= 1 | bit, bits fr ∈ BinFrac ::= all | fr() | fr(bits) · To define the scalar multiplication fr F, we first extend the split-operation from per- missions to formulas: ...

Hoare triples. ‌ definition × ⇒ PO-hoare :: [ js set, ( js js) set, js set ] bool { } { } ((3 - - > - ) [0 , 0 , 0 ] 90 ) where {pre} R {> post} ≡ R‘‘pre ⊆ post lemmas PO-hoare-defs = PO-hoare-def Image-def lemma {P} R {> Q} = (∀ s t . s ∈ P −→ (s, t ) ∈ R −→ t ∈ Q) (proof ) Some essential facts about Hoare triples. lemma hoare-conseq-left [intro]: [ {P j} R {> Q}; P ⊆ P j ] =⇒ {P} R {> Q} (proof ) xxxxx xxxxx-conseq-right : [ {P} R {> Q j}; Q j ⊆ Q ] =⇒ {P} R {> Q} (proof ) xxxxx xxxxx-false-left [simp]: {{}} R {> Q} (proof ) lemma hoare-true-right [simp]: {P} R {> UNIV } (proof ) xxxxx xxxxx-conj-right [intro!]: [ {P} R {> Q1 }; {P} R {> Q2 } ] =⇒ {P} R {> Q1 ∩ Q2 }

Hoare triples. ‌ definition × ⇒ PO-hoare :: [ js set, ( js js) set, js set ] bool { } { } ((3 - - > - ) [0 , 0 , 0 ] 90 ) where {pre} R {> post} ≡ R‘‘pre ⊆ post lemmas PO-hoare-defs = PO-hoare-def Image-def { } { } ∀ ∈ −→ ∈ −→ ∈ lemma P R > Q = ( s t . s P (s, t ) R t Q) by (auto simp add : PO-hoare-defs) Some essential facts about Hoare triples. { } { } ⊆ lemma hoare-conseq-left [intro]: [ P j R > Q ; P P j ] ⇒ { } { } = P R > Q by (auto simp add : PO-hoare-defs) xxxxx xxxxx-conseq-right : { } { } ⊆ [ P R > Q j ; Q j Q ] ⇒ { } { } = P R > Q by (auto simp add : PO-hoare-defs) xxxxx xxxxx-false-left [simp]: {{}} { } by (auto simp add : PO-hoare-defs) lemma hoare-true-right [simp]: { } { } P R > UNIV by (auto simp add : PO-hoare-defs) xxxxx xxxxx-conj-right [intro!]: { } { } { } { } [ P R > Q1 ; P R > Q2 ] ⇒ { } { ∩ } = P R > Q1 Q2 by (auto simp add : PO-hoare-defs) Special transition relations. lemma hoare-stop [simp, intro!]: { } {} { } P > Q by (auto simp add : PO-hoare-defs) lemma hoare-skip [simp, intro!]: ⊆ ⇒ { } { } P Q = P Id > Q by (auto simp add : PO-hoare-defs) lemma hoare-trans-Un [iff ]: { } ∪ { } { } { } ∧ { } { } P R1 R2 > Q = ( P R1 > Q P R2 > Q ) by (auto simp add : PO-hoare-defs) S{ } { } ∀ { } { } lemma hoare-trans-UN [iff ]: P x. R x > Q = ( x. P R x > Q ) by (auto simp add : PO-hoare-defs) lemma hoare-apply : { } { } ⇒ ∈ ⇒ ∈ ⇒ ∈ P R >Q = x P = (x, y) R = y Q by (auto simp add : PO-hoare-defs)