Skip to content

Weakest preconditions for total program correctness

Robbert Krebbers requested to merge total_weakestpre into master

This MR implements weakest preconditions for total program correctness using a least fixpoint (as suggested by @abizjak). These weakest preconditions are defined without the later modality, so one can only open invariants whose contents is timeless.

Note that for the case of concurrency, these total weakest preconditions are probably not so useful: one typically wants to prove something like totality assuming fair scheduling. To do that, we probably need something TotalTaDa-ish, but that is beyond the scope of this MR. The weakest preconditions in this MR are intended mainly to be used for sequential code.

TODO

  • Prove generic weakest precondition lemmas
  • Prove adequacy
  • Prove the lifting lemmas
  • Implement proofmode support, this depends on !64 (merged)
  • Wait for !71 (merged) to be merged.
Edited by Robbert Krebbers

Merge request reports