Skip to content
GitLab
Projects
Groups
Snippets
Help
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
I
Iris
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
111
Issues
111
List
Boards
Labels
Service Desk
Milestones
Merge Requests
19
Merge Requests
19
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Operations
Operations
Incidents
Environments
Analytics
Analytics
CI / CD
Repository
Value Stream
Wiki
Wiki
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Iris
Iris
Commits
0c801b09
Commit
0c801b09
authored
Feb 09, 2016
by
Ralf Jung
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
some comments
parent
f8efeaaf
Changes
2
Hide whitespace changes
Inline
Sidebyside
Showing
2 changed files
with
12 additions
and
6 deletions
+12
6
program_logic/invariants.v
program_logic/invariants.v
+7
6
program_logic/pviewshifts.v
program_logic/pviewshifts.v
+5
0
No files found.
program_logic/invariants.v
View file @
0c801b09
...
...
@@ 64,12 +64,13 @@ Global Instance inv_always_stable N P : AlwaysStable (inv N P) := _.
Lemma
always_inv
N
P
:
(
□
inv
N
P
)%
I
≡
inv
N
P
.
Proof
.
by
rewrite
always_always
.
Qed
.
(* We actually pretty much lose the abolity to deal with maskchanging view
shifts when using `inv`. This is because we cannot exactly name the invariants
any more. But that's okay; all this means is that sugar like the atomic
triples will have to prove its own version of the open_close rule
by unfolding `inv`. *)
(* TODO Can we prove something that helps for both open_close lemmas? *)
(* There is not really a way to provide versions of pvs_openI and pvs_closeI
that work with inv. The issue is that these rules track the exact current
mask too precisely. However, we *can* provide abstract rules by
performing both the opening and the closing of the invariant in the rule,
and then implicitly framing all the unused invariants around the
"inner" view shift provided by the client. *)
Lemma
pvs_open_close
E
N
P
Q
:
nclose
N
⊆
E
→
(
inv
N
P
∧
(
▷
P

★
pvs
(
E
∖
nclose
N
)
(
E
∖
nclose
N
)
(
▷
P
★
Q
)))
⊑
pvs
E
E
Q
.
...
...
program_logic/pviewshifts.v
View file @
0c801b09
...
...
@@ 158,6 +158,11 @@ Lemma pvs_mask_frame_mono E1 E1' E2 E2' P Q :
P
⊑
Q
→
pvs
E1'
E2'
P
⊑
pvs
E1
E2
Q
.
Proof
.
intros
HE1
HE2
HEE
>.
by
apply
pvs_mask_frame'
.
Qed
.
(* It should be possible to give a stronger version of this rule
that does not force the conclusion view shift to have twice the
same mask. However, even expressing the sideconditions on the
mask becomes really ugly then, and we have now found an instance
where that would be useful. *)
Lemma
pvs_trans3
E1
E2
Q
:
E2
⊆
E1
→
pvs
E1
E2
(
pvs
E2
E2
(
pvs
E2
E1
Q
))
⊑
pvs
E1
E1
Q
.
Proof
.
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment