Skip to content
GitLab
Projects
Groups
Snippets
Help
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
I
Iron
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Service Desk
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Operations
Operations
Incidents
Environments
Analytics
Analytics
CI / CD
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Iris
Iron
Commits
1a34a493
Commit
1a34a493
authored
Oct 31, 2018
by
Robbert Krebbers
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Tweak README.
parent
66aa3ccf
Changes
1
Hide whitespace changes
Inline
Sidebyside
Showing
1 changed file
with
96 additions
and
97 deletions
+96
97
README.md
README.md
+96
97
No files found.
README.md
View file @
1a34a493
...
...
@@ 14,69 +14,68 @@ Iron has been built and tested with the following dependencies
## Directory Structure

In
`theories/algebra`
two new cameras are defined.

In
[
theories/algebra
](
theories/algebra
)
two new cameras are defined.
1.
Improper fractions as a camera without identity with addition as
the operation are defined in
`theories/algebra/vfrac.v`
.
the operation are defined in
[
theories/algebra/vfrac.v
](
theories/algebra/vfrac.v
)
.
2.
The fractional authoritative camera described in Section 5 built
with improper fractions is defined in
`theories/algebra/vfrac_auth.v`
.
[
theories/algebra/vfrac_auth.v
](
theories/algebra/vfrac_auth.v
)
.

The semantics of the connectives of
the lifted
logic are given in
`theories/bi/fracpred.v`
.

The semantics of the connectives of
fractional predicates
logic are given in
[
theories/bi/fracpred.v
](
theories/bi/fracpred.v
)
.
This file does not contain a description of the lifted program
logic but instead contains the definitions of ∧, ∗, ∀, and other
the other connectives. It also contains all the rules of the
specific to this logic that are used later.

The machinery for connecting the generalized proofmode from
`iriscoq`
to fractional predicates is contained in
`theories/proofmode`
.

The machinery for connecting the generalized proofmode/MoSeL from to
fractional predicates is contained in (theories/proofmode)[theories/proofmode].

In
`theories/iron_logic`
much of the core Iron logic discussed
in Section 2 is defined.
*
Uniformity
with respect to fractions is defined in
`theories/iron_logic/iron.v`
as
`Uniform`
and

In
(theories/iron_logic)[theories/iron_logic] much of the core Iron logic
discussed
in Section 2 is defined.
*
_Uniformity_
with respect to fractions is defined in
[
theories/iron_logic/iron.v
](
theories/iron_logic/iron.v
)
as
`Uniform`
and
several closure properties of it are proved.
*
Trackable invariants
as discussed in Section 2.1 are formalized
in
`theories/iron_logic/fcinv.v`
.
*
_Trackable invariants_
as discussed in Section 2.1 are formalized
in
[
theories/iron_logic/fcinv.v
](
theories/iron_logic/fcinv.v
)
.
*
The definition of weakest preconditions from Section 4 is in
`theories/iron_logic/weakestpre.v`
.
[
theories/iron_logic/weakestpre.v
](
theories/iron_logic/weakestpre.v
)
.

The formalization specific to the λref,conc is in
`theories/heap_lang`
.
*
The definition of the heap in terms of ghost state from Section
5 is in
`theories/heap_lang/heap.v`
as
`heapG`
. So too are
the definitions of ↦ and e
(in the formalization called
`perm`
).
[
theories/heap_lang
](
theories/heap_lang
)
.
*
The definition of the heap in terms of ghost state from Section
5 is in
[
theories/heap_lang/heap.v
](
theories/heap_lang/heap.v
)
as
`heapG`
. So too
are the definitions of ↦ and 𝖊
(in the formalization called
`perm`
).
*
The theorems stated in Section 5 about updates to the heap ghost
state are proven in
`theories/heap_lang/heap.v`
.
state are proven in
(theories/heap_lang/heap.v)[theories/heap_lang/heap.v]
.
*
The state interpretation from Section 5 is defined in
`theories/heap_lang/heap.v`
as
`heap_ctx`
.
[
theories/heap_lang/heap.v
](
theories/heap_lang/heap.v
)
as
`heap_ctx`
.
*
Theorems 2.1, 2.2, 4.1, and 4.2 are proven in
`theories/heap_lang/adequacy.v`
.
[
theories/heap_lang/adequacy.v
](
theories/heap_lang/adequacy.v
)
.
*
The operational semantics from Figure 4 are defined in
`theories/heap_lang/lang.v`
.
[
theories/heap_lang/lang.v
](
theories/heap_lang/lang.v
)
.
*
The rules from Figures 1, 2, 3, and 5 are proven in
`theories/heap_lang/lifting.v`
.
[
theories/heap_lang/lifting.v
](
theories/heap_lang/lifting.v
)
.

All of the examples of the paper are formalized and may be found in
`theories/heap_lang/lib/`
. All of the examples are formalized
purely within the lifted logic. There is no fraction accounting in
[
theories/heap_lang/lib/
](
theories/heap_lang/lib/
)
. All of the examples are
formalized
purely within the lifted logic. There is no fraction accounting in
the proofs and no significant bookkeeping beyond what is found in
vanilla Iris.
As mentioned in the paper, a small portion of
`par`
cannot be
formalized in the lifted logic but in the formalization this is
factored out into
`spawn`
in
`theories/heap_lang/lib/spawn.v`
.
*
The example from 3.1 is in
`theories/heap_lang/lib/resource_transfer_par.v`
.
*
The example from 3.2 is in
`theories/heap_lang/lib/resource_transfer_fork.v`
.
*
The example from 3.3 is in
`theories/heap_lang/lib/message_passing.v`
.
*
The example from 3.4 is in
`theories/heap_lang/lib/message_passing_example.v`
.
*
The example from 3.5 is in
`theories/heap_lang/lib/par.v`
.
As mentioned in the paper, a small portion of
`par`
cannot be
formalized in
the lifted logic but in the formalization this is factored out into
`spawn`
in
[
theories/heap_lang/lib/spawn.v
](
theories/heap_lang/lib/spawn.v
)
*
The example from 3.1 is in
[
theories/heap_lang/lib/resource_transfer_par.v
](
theories/heap_lang/lib/resource_transfer_par.v
)
.
*
The example from 3.2 is in
[
theories/heap_lang/lib/resource_transfer_fork.v
](
theories/heap_lang/lib/resource_transfer_fork.v
)
.
*
The example from 3.3 is in
[
theories/heap_lang/lib/message_passing.v
](
theories/heap_lang/lib/message_passing.v
)
.
*
The example from 3.4 is in
[
theories/heap_lang/lib/message_passing_example.v
](
theories/heap_lang/lib/message_passing_example.v
)
.
*
The example from 3.5 is in
[
theories/heap_lang/lib/par.v
](
theories/heap_lang/lib/resource_transfer_par.v
)
.
Note that
`spawn.v`
,
`resource_transfer_par.v`
, and
`resource_transfer_fork.v`
use the same state transition system (from Figure 3). This is formalized in
`theories/heap_lang/lib/transfer_resource_sts.v`
.
[
theories/heap_lang/lib/transfer_resource_sts.v
](
theories/heap_lang/lib/transfer_resource_sts.v
)
.
## Differences Between the Formalization and The Paper
...
...
@@ 152,9 +151,9 @@ This can be used to derive `LINVALLOC` when used in conjunction with
There is a correspondence between the invariant rules presented in the
paper with Hoare triples and those in the formalization.

`TINVALLOC`
and
`LTINVALLOC`
follow from
`fcinv_alloc_named`
.

`TINVOPEN`
and
`LTINVOPEN`
follow from
`fcinv_open`
.

`TINVDEALLOC`
and
`LTINVDEALLOC`
follow from
`fcinv_cancel`
.

`TINVALLOC`
and
`LTINVALLOC`
follow from
`fcinv_alloc_named`
.

`TINVOPEN`
and
`LTINVOPEN`
follow from
`fcinv_open`
.

`TINVDEALLOC`
and
`LTINVDEALLOC`
follow from
`fcinv_cancel`
.
All of these theorems are proven in
`theories/iron_logic/fcinv.v`
.
...
...
@@ 172,63 +171,63 @@ The format of the table is as follows: Name of
Theorem/Rule/Definition/Proposition, the name in the formalization,
and the file in the formalization.

The language definition in Section 2,
`expr`
,
`theories/heap_lang/lang.v`

`e`
and
`↦`
,
`perm`
and
`↦`
,
`theories/heap_lang/heap.v`

Trackable invariants,
`fcinv`
,
`theories/iron_logic/fcinv.v`

`OPerm(, )`
,
`fcinv_own`
,
`theories/iron_logic/fcinv.v`

`DPerm(, )`
,
`fcinv_cancel_own`
,
`theories/iron_logic/fcinv.v`

`HOAREFRAME`
,
`hoare_frame_r`
,
`iriscoq/theories/program_logic/hoare.v`

`HOAREVAL`
,
`ht_val`
,
`iriscoq/theories/program_logic/hoare.v`

`HOAREλ`
,
`pure_rec`
,
`theories/heap_lang/lifting.v`

`HOAREBIND`
,
`ht_bind`
,
`iriscoq/theories/program_logic/hoare.v`

`EMPSPLIT`
,
`perm_split`
,
`theories/heap_lang/heap.v`

`PTSPLIT`
,
`mapsto_uniform`
,
`theories/heap_lang/heap.v`

`PTDISJ`
,
`mapsto_valid_2`
,
`theories/heap_lang/heap.v`

`HOAREALLOC`
,
`wp_alloc`
,
`theories/heap_lang/lifting.v`

`HOAREFREE`
,
`wp_free`
,
`theories/heap_lang/lifting.v`

`HOARELOAD`
,
`wp_load`
,
`theories/heap_lang/lifting.v`

`HOARESTORE`
,
`wp_store`
,
`theories/heap_lang/lifting.v`

`HOAREFORKEMP`
/
`HOAREFORKTRUE`
,
`wp_fork`
,
`theories/heap_lang/lifting.v`

`INVDUP`
,
`inv_persistent`
,
`theories/heap_lang/lifting.v`

`INVALLOC`
,
`inv_alloc`
,
`iriscoq/theories/base_logic/lib/invariants.v`

`INVOPEN`
,
`inv_open`
,
`iriscoq/theories/base_logic/lib/invariants.v`

`TINVSPLIT`
,
`fcinv_own_fractional`
,
`theories/iron_logic/fcinv.v`

`TINVDUP`
,
`fcinv_persistent`
,
`theories/iron_logic/fcinv.v`

`TINVALLOC`
,
`fcinv_alloc_named`
,
`theories/iron_logic/fcinv.v`

`TINVOPEN`
,
`fcinv_open`
,
`theories/iron_logic/fcinv.v`

`TINVDEALLOC`
,
`fcinv_cancel`
,
`theories/iron_logic/fcinv.v`

Uniform with respect to fractions,
`Uniform`
,
`theories/iron_logic/iron.v`

`HOARECONS`
,
`ht_vs`
,
`iriscoq/theories/program_logic/hoare.v`

The rules from Figure 4,
`head_step`
,
`theories/heap_lang/lang.v`

Theorem 2.1,
`heap_adequacy`
,
`theories/heap_lang/adequacy.v`

Theorem 2.2,
`heap_strong_adequacy`
,
`theories/heap_lang/adequacy.v`

`HOAREPAR`
,
`par_spec`
,
`theories/heap_lang/lib/par.v`

The example from 3.1,
`transfer_works1`
,
`theories/heap_lang/lib/resource_tranfer_par.v`

The example from 3.2,
`transfer_works1`
,
`theories/heap_lang/lib/resource_tranfer_fork.v`

The example from 3.3, Several theorems,
`theories/heap_lang/lib/message_passing.v`

The example from 3.4,
`program_spec`
,
`theories/heap_lang/lib/message_passing_example.v`

The example from 3.5, Several theorems,
`theories/heap_lang/lib/{spawn, par}.v`

Definitions of lifted connectives, Several definitions,
`theories/bi/fracpred.v`

Definition of lifted
`↦`
,
`↦`
,
`theories/heap_lang/heap.v`

`LHOAREFRAME`
,
`iron_wp_frame_r`
,
`iriscoq/theories/program_logic/hoare.v`

`LHOAREVAL`
,
`iron_wp_val`
,
`iriscoq/theories/program_logic/hoare.v`

`LHOAREλ`
,
`pure_rec`
,
`theories/heap_lang/lifting.v`

`LHOAREBIND`
,
`iron_wp_bind`
,
`iriscoq/theories/program_logic/hoare.v`

`LPTDISJ`
,
`mapsto_valid_2`
,
`theories/heap_lang/heap.v`

`LHOAREALLOC`
,
`iron_wp_alloc`
,
`theories/heap_lang/lifting.v`

`LHOAREFREE`
,
`iron_wp_free`
,
`theories/heap_lang/lifting.v`

`LHOARELOAD`
,
`iron_wp_load`
,
`theories/heap_lang/lifting.v`

`LHOARESTORE`
,
`iron_wp_store`
,
`theories/heap_lang/lifting.v`

`LHOAREFORK`
,
`iron_wp_fork`
,
`theories/heap_lang/lifting.v`

`LTINVSPLIT`
,
`fcinv_own_fractional`
,
`theories/iron_logic/fcinv.v`

`LTINVDUP`
,
`fcinv_persistent`
,
`theories/iron_logic/fcinv.v`

`LTINVALLOC`
,
`fcinv_alloc_named`
,
`theories/iron_logic/fcinv.v`

`LTINVOPEN`
,
`fcinv_open`
,
`theories/iron_logic/fcinv.v`

`LTINVDEALLOC`
,
`fcinv_cancel`
,
`theories/iron_logic/fcinv.v`

Definition of Hoare triples,
`iron_wp`
,
`theories/iron_logic/weakestpre.v`

Theorem 4.1,
`heap_adequacy`
,
`theories/heap_lang/adequacy.v`

Theorem 4.2,
`heap_strong_adequacy`
,
`theories/heap_lang/adequacy.v`

Definition of WP in Section 5,
`wp_def`
,
`iriscoq/theories/program_logic/weakestpre.v`

Definition of state interp from Section 5,
`heap_ctx`
,
`theories/heap_lang/heap.v`

Theorem 5.1,
`wp_strong_all_adequacy`
,
`iriscoq/theories/program_logic/adequacy.v`

The language definition in Section 2,
`expr`
,
`theories/heap_lang/lang.v`

`e`
and
`↦`
,
`perm`
and
`↦`
,
`theories/heap_lang/heap.v`

Trackable invariants,
`fcinv`
,
`theories/iron_logic/fcinv.v`

`OPerm(, )`
,
`fcinv_own`
,
`theories/iron_logic/fcinv.v`

`DPerm(, )`
,
`fcinv_cancel_own`
,
`theories/iron_logic/fcinv.v`

`HOAREFRAME`
,
`hoare_frame_r`
,
`iriscoq/theories/program_logic/hoare.v`

`HOAREVAL`
,
`ht_val`
,
`iriscoq/theories/program_logic/hoare.v`

`HOAREλ`
,
`pure_rec`
,
`theories/heap_lang/lifting.v`

`HOAREBIND`
,
`ht_bind`
,
`iriscoq/theories/program_logic/hoare.v`

`EMPSPLIT`
,
`perm_split`
,
`theories/heap_lang/heap.v`

`PTSPLIT`
,
`mapsto_uniform`
,
`theories/heap_lang/heap.v`

`PTDISJ`
,
`mapsto_valid_2`
,
`theories/heap_lang/heap.v`

`HOAREALLOC`
,
`wp_alloc`
,
`theories/heap_lang/lifting.v`

`HOAREFREE`
,
`wp_free`
,
`theories/heap_lang/lifting.v`

`HOARELOAD`
,
`wp_load`
,
`theories/heap_lang/lifting.v`

`HOARESTORE`
,
`wp_store`
,
`theories/heap_lang/lifting.v`

`HOAREFORKEMP`
/
`HOAREFORKTRUE`
,
`wp_fork`
,
`theories/heap_lang/lifting.v`

`INVDUP`
,
`inv_persistent`
,
`theories/heap_lang/lifting.v`

`INVALLOC`
,
`inv_alloc`
,
`iriscoq/theories/base_logic/lib/invariants.v`

`INVOPEN`
,
`inv_open`
,
`iriscoq/theories/base_logic/lib/invariants.v`

`TINVSPLIT`
,
`fcinv_own_fractional`
,
`theories/iron_logic/fcinv.v`

`TINVDUP`
,
`fcinv_persistent`
,
`theories/iron_logic/fcinv.v`

`TINVALLOC`
,
`fcinv_alloc_named`
,
`theories/iron_logic/fcinv.v`

`TINVOPEN`
,
`fcinv_open`
,
`theories/iron_logic/fcinv.v`

`TINVDEALLOC`
,
`fcinv_cancel`
,
`theories/iron_logic/fcinv.v`

Uniform with respect to fractions,
`Uniform`
,
`theories/iron_logic/iron.v`

`HOARECONS`
,
`ht_vs`
,
`iriscoq/theories/program_logic/hoare.v`

The rules from Figure 4,
`head_step`
,
`theories/heap_lang/lang.v`

Theorem 2.1,
`heap_adequacy`
,
`theories/heap_lang/adequacy.v`

Theorem 2.2,
`heap_strong_adequacy`
,
`theories/heap_lang/adequacy.v`

`HOAREPAR`
,
`par_spec`
,
`theories/heap_lang/lib/par.v`

The example from 3.1,
`transfer_works1`
,
`theories/heap_lang/lib/resource_tranfer_par.v`

The example from 3.2,
`transfer_works1`
,
`theories/heap_lang/lib/resource_tranfer_fork.v`

The example from 3.3, Several theorems,
`theories/heap_lang/lib/message_passing.v`

The example from 3.4,
`program_spec`
,
`theories/heap_lang/lib/message_passing_example.v`

The example from 3.5, Several theorems,
`theories/heap_lang/lib/{spawn, par}.v`

Definitions of lifted connectives, Several definitions,
`theories/bi/fracpred.v`

Definition of lifted
`↦`
,
`↦`
,
`theories/heap_lang/heap.v`

`LHOAREFRAME`
,
`iron_wp_frame_r`
,
`iriscoq/theories/program_logic/hoare.v`

`LHOAREVAL`
,
`iron_wp_val`
,
`iriscoq/theories/program_logic/hoare.v`

`LHOAREλ`
,
`pure_rec`
,
`theories/heap_lang/lifting.v`

`LHOAREBIND`
,
`iron_wp_bind`
,
`iriscoq/theories/program_logic/hoare.v`

`LPTDISJ`
,
`mapsto_valid_2`
,
`theories/heap_lang/heap.v`

`LHOAREALLOC`
,
`iron_wp_alloc`
,
`theories/heap_lang/lifting.v`

`LHOAREFREE`
,
`iron_wp_free`
,
`theories/heap_lang/lifting.v`

`LHOARELOAD`
,
`iron_wp_load`
,
`theories/heap_lang/lifting.v`

`LHOARESTORE`
,
`iron_wp_store`
,
`theories/heap_lang/lifting.v`

`LHOAREFORK`
,
`iron_wp_fork`
,
`theories/heap_lang/lifting.v`

`LTINVSPLIT`
,
`fcinv_own_fractional`
,
`theories/iron_logic/fcinv.v`

`LTINVDUP`
,
`fcinv_persistent`
,
`theories/iron_logic/fcinv.v`

`LTINVALLOC`
,
`fcinv_alloc_named`
,
`theories/iron_logic/fcinv.v`

`LTINVOPEN`
,
`fcinv_open`
,
`theories/iron_logic/fcinv.v`

`LTINVDEALLOC`
,
`fcinv_cancel`
,
`theories/iron_logic/fcinv.v`

Definition of Hoare triples,
`iron_wp`
,
`theories/iron_logic/weakestpre.v`

Theorem 4.1,
`heap_adequacy`
,
`theories/heap_lang/adequacy.v`

Theorem 4.2,
`heap_strong_adequacy`
,
`theories/heap_lang/adequacy.v`

Definition of WP in Section 5,
`wp_def`
,
`iriscoq/theories/program_logic/weakestpre.v`

Definition of state interp from Section 5,
`heap_ctx`
,
`theories/heap_lang/heap.v`

Theorem 5.1,
`wp_strong_all_adequacy`
,
`iriscoq/theories/program_logic/adequacy.v`
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment