This definition varies slightly from the original one in~\cite{catlogic}.
\begin{defn}[Chain]
Given some set $\cofe$ and an indexed family $({\nequiv{n}}\subseteq\cofe\times\cofe)_{n \in\mathbb{N}}$ of equivalence relations, a \emph{chain} is a function $c : \mathbb{N}\to\cofe$ such that $\All n, m. n \leq m \Ra c (m)\nequiv{n} c (n)$.
\end{defn}
...
...
@@ -22,6 +23,8 @@
An element $x \in\cofe$ of a COFE is called \emph{discrete} if
\[\All y \in\cofe. x \nequiv{0} y \Ra x = y\]
A COFE $A$ is called \emph{discrete} if all its elements are discrete.
For a set $X$, we write $\Delta X$ for the discrete COFE with $x \nequiv{n} x' \eqdef x = x'$
\end{defn}
\begin{defn}
...
...
@@ -30,6 +33,7 @@
It is \emph{contractive} if
\[\All n, x \in\cofe, y \in\cofe. (\All m < n. x \nequiv{m} y)\Ra f(x)\nequiv{n} f(x)\]
\end{defn}
The reason that contractive functions are interesting is that for every contractive $f : \cofe\to\cofe$ with $\cofe$ inhabited, there exists a fixed-point $\fix(f)$ such that $\fix(f)= f(\fix(f))$.
\begin{defn}
The category $\COFEs$ consists of COFEs as objects, and non-expansive functions as arrows.
...
...
@@ -52,7 +56,31 @@ Note that the composition of non-expansive (bi)functors is non-expansive, and th
\subsection{RA}
\ralf{Copy this from the paper, when that one is more polished.}
@@ -25,7 +25,7 @@ where $\mProp$ is the set of meta-level propositions, \eg Coq's \texttt{Prop}.
$\UPred(-)$ is a locally non-expansive functor from $\CMRAs$ to $\COFEs$.
One way to understand this definition is to re-write it a little.
We start by defining the COFE of \emph{step-indexed propositions}:
We start by defining the COFE of \emph{step-indexed propositions}: For every step-index, we proposition either holds or does not hold.
\begin{align*}
\SProp\eqdef{}&\psetdown{\mathbb{N}}\\
\eqdef{}&\setComp{\prop\in\pset{\mathbb{N}}}{\All n, m. n \geq m \Ra n \in\prop\Ra m \in\prop}\\
...
...
@@ -33,7 +33,7 @@ We start by defining the COFE of \emph{step-indexed propositions}:
\end{align*}
Now we can rewrite $\UPred(\monoid)$ as monotone step-indexed predicates over $\monoid$, where the definition of a ``monotone'' function here is a little funny.
\begin{align*}
\UPred(\monoid) \approx{}&\monoid\monra\SProp\\
\UPred(\monoid) \cong{}&\monoid\monra\SProp\\
\eqdef{}&\setComp{\pred: \monoid\nfn\SProp}{\All n, m, x, y. n \in\pred(x) \land x \mincl y \land m \leq n \land y \in\mval_m \Ra m \in\pred(y)}
\end{align*}
The reason we chose the first definition is that it is easier to work with in Coq.
...
...
@@ -77,35 +77,35 @@ $K \fpfn (-)$ is a locally non-expansive functor from $\CMRAs$ to $\CMRAs$.
\subsection{Agreement}
Given some COFE $\cofe$, we define $\agm(\cofe)$ as follows:
\newcommand{\agc}{\mathrm{c}}% the "c" field of an agreement element
\newcommand{\agV}{\mathrm{V}}% the "V" field of an agreement element
\newcommand{\aginjc}{\mathrm{c}}% the "c" field of an agreement element
\newcommand{\aginjV}{\mathrm{V}}% the "V" field of an agreement element
\melt\equiv\meltB\eqdef{}&\melt.\agV = \meltB.\agV\land\All n. n \in\melt.\agV\Ra\melt.\agc(n) \nequiv{n}\meltB.\agc(n) \\
\melt\nequiv{n}\meltB\eqdef{}& (\All m \leq n. m \in\melt.\agV\Lra m \in\meltB.\agV) \land (\All m \leq n. m \in\melt.\agV\Ra\melt.\agc(m) \nequiv{m}\meltB.\agc(m)) \\
\mval_n \eqdef{}&\setComp{\melt\in\monoid}{ n \in\melt.\agV\land\All m \leq n. \melt.\agc(n) \nequiv{m}\melt.\agc(m) }\\
\melt\equiv\meltB\eqdef{}&\melt.\aginjV = \meltB.\aginjV\land\All n. n \in\melt.\aginjV\Ra\melt.\aginjc(n) \nequiv{n}\meltB.\aginjc(n) \\
\melt\nequiv{n}\meltB\eqdef{}& (\All m \leq n. m \in\melt.\aginjV\Lra m \in\meltB.\aginjV) \land (\All m \leq n. m \in\melt.\aginjV\Ra\melt.\aginjc(m) \nequiv{m}\meltB.\aginjc(m)) \\
\mval_n \eqdef{}&\setComp{\melt\in\monoid}{ n \in\melt.\aginjV\land\All m \leq n. \melt.\aginjc(n) \nequiv{m}\melt.\aginjc(m) }\\
\mcore\melt\eqdef{}&\melt\\
\melt\mtimes\meltB\eqdef{}& (\melt.\agc, \setComp{n}{n \in\melt.\agV\land n \in\meltB.\agV\land\melt\nequiv{n}\meltB})
\melt\mtimes\meltB\eqdef{}& (\melt.\aginjc, \setComp{n}{n \in\melt.\aginjV\land n \in\meltB.\aginjV\land\melt\nequiv{n}\meltB})
\end{align*}
$\agm(-)$ is a locally non-expansive functor from $\COFEs$ to $\CMRAs$.
You can think of the $\agc$ as a \emph{chain} of elements of $\cofe$ that has to converge only for $n \in\agV$ steps.
You can think of the $\aginjc$ as a \emph{chain} of elements of $\cofe$ that has to converge only for $n \in\aginjV$ steps.
The reason we store a chain, rather than a single element, is that $\agm(\cofe)$ needs to be a COFE itself, so we need to be able to give a limit for every chain of $\agm(\cofe)$.
However, given such a chain, we cannot constructively define its limit: Clearly, the $\agV$ of the limit is the limit of the $\agV$ of the chain.
However, given such a chain, we cannot constructively define its limit: Clearly, the $\aginjV$ of the limit is the limit of the $\aginjV$ of the chain.
But what to pick for the actual data, for the element of $\cofe$?
Only if $\agV=\mathbb{N}$ we have a chain of $\cofe$ that we can take a limit of; if the $\agV$ is smaller, the chain ``cancels'', \ie stops converging as we reach indices $n \notin\agV$.
Only if $\aginjV=\mathbb{N}$ we have a chain of $\cofe$ that we can take a limit of; if the $\aginjV$ is smaller, the chain ``cancels'', \ie stops converging as we reach indices $n \notin\aginjV$.
To mitigate this, we apply the usual construction to close a set; we go from elements of $\cofe$ to chains of $\cofe$.
We define an injection $\ag$ into $\agm(\cofe)$ as follows:
\[\ag(x)\eqdef\record{\mathrm c \eqdef\Lam\any. x, \mathrm V \eqdef\mathbb{N}}\]
We define an injection $\aginj$ into $\agm(\cofe)$ as follows:
\[\aginj(x)\eqdef\record{\mathrm c \eqdef\Lam\any. x, \mathrm V \eqdef\mathbb{N}}\]
There are no interesting frame-preserving updates for $\agm(\cofe)$, but we can show the following:
% By disjointness, $x \notin \melt_\f$ and hence $x \in meltB$.
% The other direction works the same way.
% \end{proof}
...
...
@@ -233,20 +238,20 @@ We obtain the following frame-preserving updates:
% \begin{proof}[Proof of \ruleref{FracUpdLocal}]
% Assume some $f \sep (q, a)$. If $f = \munit$, then $f \sep (q, b)$ is trivial for any $b \in B$. Just pick the one we obtain by choosing $\munit_M$ as the frame for $a$.
% In the interesting case, we have $f = (q_f, a_f)$.
% Obtain $b$ such that $b \in B \land b \sep a_f$.
% In the interesting case, we have $f = (q_\f, a_\f)$.
% Obtain $b$ such that $b \in B \land b \sep a_\f$.
% Then $(q, b) \sep f$, and we are done.
% \end{proof}
% $\fracm{M}$ is cancellative if $M$ is cancellative.
% \begin{proof}[Proof of cancellativitiy]
% If $\melt_f = \munit$, we are trivially done.
% So let $\melt_f = (q_f, \melt_f')$.
% If $\melt_\f = \munit$, we are trivially done.
% So let $\melt_\f = (q_\f, \melt_\f')$.
% If $\melt = \munit$, then $\meltB = \munit$ as otherwise the fractions could not match up.
% Again, we are trivially done.
% Similar so for $\meltB = \munit$.
% So let $\melt = (q_a, \melt')$ and $\meltB = (q_b, \meltB')$.
% We have $(q_f + q_a, \melt_f' \mtimes \melt') = (q_f + q_b, \melt_f' \mtimes \meltB')$.
% We have $(q_\f + q_a, \melt_\f' \mtimes \melt') = (q_\f + q_b, \melt_\f' \mtimes \meltB')$.
% We have to show $q_a = q_b$ and $\melt' = \meltB'$.
% The first is trivial, the second follows from cancellativitiy of $M$.
% \end{proof}
...
...
@@ -307,7 +312,7 @@ We obtain the following frame-preserving updates:
% The frame-preserving update involves a rather unwieldy side-condition:
@@ -373,8 +378,6 @@ We obtain the following frame-preserving updates:
% \subsection{STS with tokens monoid}
% \label{sec:stsmon}
% \ralf{This needs syncing with the Coq development.}
% Given a state-transition system~(STS) $(\STSS, \ra)$, a set of tokens $\STSS$, and a labeling $\STSL: \STSS \ra \mathcal{P}(\STST)$ of \emph{protocol-owned} tokens for each state, we construct a monoid modeling an authoritative current state and permitting transitions given a \emph{bound} on the current state and a set of \emph{locally-owned} tokens.
% The construction follows the idea of STSs as described in CaReSL \cite{caresl}.
...
...
@@ -389,11 +392,11 @@ We obtain the following frame-preserving updates:
% We have
% \begin{quote}
% If $(s, T) \ra (s', T')$\\
% and $T_f \sep (T \uplus \STSL(s))$,\\
% then $\textsf{frame}(s, T_f) \ra \textsf{frame}(s', T_f)$.
% and $T_\f \sep (T \uplus \STSL(s))$,\\
% then $\textsf{frame}(s, T_\f) \ra \textsf{frame}(s', T_\f)$.
% \end{quote}
% \begin{proof}
% This follows directly by framing the tokens in $\STST \setminus (T_f \uplus T \uplus \STSL(s))$ around the given transition, which yields $(s, \STST \setminus (T_f \uplus \STSL{T}(s))) \ra (s', T' \uplus (\STST \setminus (T_f \uplus T \uplus \STSL{T}(s))))$.
% This follows directly by framing the tokens in $\STST \setminus (T_\f \uplus T \uplus \STSL(s))$ around the given transition, which yields $(s, \STST \setminus (T_\f \uplus \STSL{T}(s))) \ra (s', T' \uplus (\STST \setminus (T_\f \uplus T \uplus \STSL{T}(s))))$.
% This is exactly what we have to show, since we know $\STSL(s) \uplus T = \STSL(s') \uplus T'$.
% \end{proof}
...
...
@@ -415,8 +418,8 @@ We obtain the following frame-preserving updates:
% Assume some upwards-closed $S_f, T_f$ (the frame cannot be authoritative) s.t.\ $s \in S_f$ and $T_f \sep (T \uplus \STSL(s))$. We have to show that this frame combines with our final monoid element, which is the case if $s' \in S_f$ and $T_f \sep T'$.
% By upward-closedness, it suffices to show $\textsf{frame}(s, T_f) \ststrans \textsf{frame}(s', T_f)$.
% Assume some upwards-closed $S_\f, T_\f$ (the frame cannot be authoritative) s.t.\ $s \in S_\f$ and $T_\f \sep (T \uplus \STSL(s))$. We have to show that this frame combines with our final monoid element, which is the case if $s' \in S_\f$ and $T_\f \sep T'$.
% By upward-closedness, it suffices to show $\textsf{frame}(s, T_\f) \ststrans \textsf{frame}(s', T_\f)$.
% This follows by induction on the path $(s, T) \ststrans (s', T')$, and using the lemma proven above for each step.
@@ -205,9 +205,64 @@ The following rules can be derived for Hoare triples.
\end{mathparpagebreakable}
\paragraph{Lifting of operational semantics.}
We can derive some specialized forms of the lifting axioms for the operational semantics, as well as some forms that involve view shifts and Hoare triples.
We can derive some specialized forms of the lifting axioms for the operational semantics.
% \subsection{STSs with interpretation}\label{sec:stsinterp}
% Building on \Sref{sec:stsmon}, after constructing the monoid $\STSMon{\STSS}$ for a particular STS, we can use an invariant to tie an interpretation, $\pred : \STSS \to \Prop$, to the STS's current state, recovering CaReSL-style reasoning~\cite{caresl}.
...
...
@@ -382,21 +438,21 @@ We can now derive the following rules for this derived form of the invariant ass
@@ -7,7 +7,7 @@ A \emph{language} $\Lang$ consists of a set \textdom{Expr} of \emph{expressions}
\end{mathpar}
\item There exists a \emph{primitive reduction relation}\[(-,-\step-,-,-)\subseteq\textdom{Expr}\times\textdom{State}\times\textdom{Expr}\times\textdom{State}\times(\textdom{Expr}\uplus\set{\bot})\]
We will write $\expr_1, \state_1\step\expr_2, \state_2$ for $\expr_1, \state_1\step\expr_2, \state_2, \bot$. \\
A reduction $\expr_1, \state_1\step\expr_2, \state_2, \expr'$ indicates that, when $\expr_1$ reduces to $\expr$, a \emph{new thread}$\expr'$ is forked off.
A reduction $\expr_1, \state_1\step\expr_2, \state_2, \expr_\f$ indicates that, when $\expr_1$ reduces to $\expr$, a \emph{new thread}$\expr_\f$ is forked off.
\item All values are stuck:
\[\expr, \_\step\_, \_, \_\Ra\toval(\expr)=\bot\]
\item There is a predicate defining \emph{atomic} expressions satisfying
...
...
@@ -16,7 +16,7 @@ A \emph{language} $\Lang$ consists of a set \textdom{Expr} of \emph{expressions}
