A \emph{language}$\Lang$ consists of a set \textdom{Expr} of \emph{expressions} (metavariable $\expr$), a set \textdom{Val} of \emph{values} (metavariable $\val$), and a set \textdom{State} of \emph{states} (metvariable $\state$) such that
\begin{itemize}
\item There exist functions $\ofval : \textdom{Val}\to\textdom{Expr}$ and $\toval : \textdom{Expr}\pfn\textdom{val}$ (notice the latter is partial), such that
\item There exists a \emph{primitive reduction relation}\[(-,-\step-,-,-)\subseteq\textdom{Expr}\times\textdom{State}\times\textdom{Expr}\times\textdom{State}\times(\textdom{Expr}\uplus\set{\bot})\]
We will write $\expr_1, \state_1\step\expr_2, \state_2$ for $\expr_1, \state_1\step\expr_2, \state_2, \bot$. \\
A reduction $\expr_1, \state_1\step\expr_2, \state_2, \expr_\f$ indicates that, when $\expr_1$ reduces to $\expr_2$, a \emph{new thread}$\expr_\f$ is forked off.
\item All values are stuck:
\[\expr, \_\step\_, \_, \_\Ra\toval(\expr)=\bot\]
\end{itemize}
\begin{defn}
An expression $\expr$ and state $\state$ are \emph{reducible} (written $\red(\expr, \state)$) if
To instantiate Iris, you need to define the following parameters:
\begin{itemize}
\item A language $\Lang$, and
\item a locally contractive bifunctor $\iFunc : \COFEs\to\CMRAs$ defining the ghost state, such that for all COFEs $A$, the CMRA $\iFunc(A)$ has a unit. (By \lemref{lem:cmra-unit-total-core}, this means that the core of $\iFunc(A)$ is a total function.)
\end{itemize}
\noindent
As usual for higher-order logics, you can furthermore pick a \emph{signature}$\Sig=(\SigType, \SigFn, \SigAx)$ to add more types, symbols and axioms to the language.
You have to make sure that $\SigType$ includes the base types:
Elements of $\SigType$ are ranged over by $\sigtype$.
...
...
@@ -88,7 +25,8 @@ Elements of $\SigAx$ are ranged over by $\sigax$.
\subsection{Grammar}\label{sec:grammar}
\paragraph{Syntax.}
Iris syntax is built up from a signature $\Sig$ and a countably infinite set $\textdom{Var}$ of variables (ranged over by metavariables $x$, $y$, $z$):
Iris syntax is built up from a signature $\Sig$ and a countably infinite set $\textdom{Var}$ of variables (ranged over by metavariables $x$, $y$, $z$).
Below, $\melt$ ranges over $\monoid$ and $i$ ranges over $\set{1,2}$.
\begin{align*}
\type\bnfdef{}&
...
...
@@ -105,7 +43,7 @@ Iris syntax is built up from a signature $\Sig$ and a countably infinite set $\t
\pi_i\;\term\mid
\Lam\var:\type.\term\mid
\term(\term) \mid
\munit\mid
\melt\mid
\mcore\term\mid
\term\mtimes\term\mid
\\&
...
...
@@ -122,47 +60,15 @@ Iris syntax is built up from a signature $\Sig$ and a countably infinite set $\t
\Exists\var:\type. \prop\mid
\All\var:\type. \prop\mid
\\&
\knowInv{\term}{\prop}\mid
\ownGGhost{\term}\mid\mval(\term) \mid
\ownPhys{\term}\mid
\always\prop\mid
{\later\prop}\mid
\pvs[\term][\term]\prop\mid
\wpre{\term}[\term]{\Ret\var.\term}
\upd\prop\mid
\end{align*}
Recursive predicates must be \emph{guarded}: in $\MU\var. \term$, the variable $\var$ can only appear under the later $\later$ modality.
Note that $\always$ and $\later$ bind more tightly than $*$, $\wand$, $\land$, $\lor$, and $\Ra$.
We will write $\pvs[\term]\prop$ for $\pvs[\term][\term]\prop$.
If we omit the mask, then it is $\top$ for weakest precondition $\wpre\expr{\Ret\var.\prop}$ and $\emptyset$ for primitive view shifts $\pvs\prop$.
%FIXME $\top$ is not a term in the logic. Neither is any of the operations on masks that we use in the rules for weakestpre.
Some propositions are \emph{timeless}, which intuitively means that step-indexing does not affect them.
This is a \emph{meta-level} assertion about propositions, defined as follows:
Note that the modalities $\upd$, $\always$ and $\later$ bind more tightly than $*$, $\wand$, $\land$, $\lor$, and $\Ra$.
Notice that primitive view shifts cover everything to their right, \ie$\pvs\prop*\propB\eqdef\pvs(\prop*\propB)$.
Here we define $\wpre{\expr_\f}[\mask]{\Ret\var.\prop}\eqdef\TRUE$ if $\expr_\f=\bot$ (remember that our stepping relation can, but does not have to, define a forked-off expression).
\subsection{Adequacy}
The adequacy statement concerning functional correctness reads as follows:
where $\pred$ is a \emph{meta-level} predicate over values, \ie it can mention neither resources nor invariants.
Furthermore, the following adequacy statement shows that our weakest preconditions imply that the execution never gets \emph{stuck}: Every expression in the thread pool either is a value, or can reduce further.
A \emph{language}$\Lang$ consists of a set \textdom{Expr} of \emph{expressions} (metavariable $\expr$), a set \textdom{Val} of \emph{values} (metavariable $\val$), and a set \textdom{State} of \emph{states} (metvariable $\state$) such that
\begin{itemize}
\item There exist functions $\ofval : \textdom{Val}\to\textdom{Expr}$ and $\toval : \textdom{Expr}\pfn\textdom{val}$ (notice the latter is partial), such that
\item There exists a \emph{primitive reduction relation}\[(-,-\step-,-,-)\subseteq\textdom{Expr}\times\textdom{State}\times\textdom{Expr}\times\textdom{State}\times(\textdom{Expr}\uplus\set{\bot})\]
We will write $\expr_1, \state_1\step\expr_2, \state_2$ for $\expr_1, \state_1\step\expr_2, \state_2, \bot$. \\
A reduction $\expr_1, \state_1\step\expr_2, \state_2, \expr_\f$ indicates that, when $\expr_1$ reduces to $\expr_2$, a \emph{new thread}$\expr_\f$ is forked off.
\item All values are stuck:
\[\expr, \_\step\_, \_, \_\Ra\toval(\expr)=\bot\]
\end{itemize}
\begin{defn}
An expression $\expr$ and state $\state$ are \emph{reducible} (written $\red(\expr, \state)$) if
\ralf{TODO: Right now, this is a dump of all the things that moved out of the base...}
To instantiate Iris, you need to define the following parameters:
\begin{itemize}
\item A language $\Lang$, and
\item a locally contractive bifunctor $\iFunc : \COFEs\to\CMRAs$ defining the ghost state, such that for all COFEs $\cofe$, the CMRA $\iFunc(A)$ has a unit. (By \lemref{lem:cmra-unit-total-core}, this means that the core of $\iFunc(\cofe)$ is a total function.)
\end{itemize}
We will write $\pvs[\term]\prop$ for $\pvs[\term][\term]\prop$.
If we omit the mask, then it is $\top$ for weakest precondition $\wpre\expr{\Ret\var.\prop}$ and $\emptyset$ for primitive view shifts $\pvs\prop$.
%FIXME $\top$ is not a term in the logic. Neither is any of the operations on masks that we use in the rules for weakestpre.
Some propositions are \emph{timeless}, which intuitively means that step-indexing does not affect them.
This is a \emph{meta-level} assertion about propositions, defined as follows:
Notice that primitive view shifts cover everything to their right, \ie$\pvs\prop*\propB\eqdef\pvs(\prop*\propB)$.
Here we define $\wpre{\expr_\f}[\mask]{\Ret\var.\prop}\eqdef\TRUE$ if $\expr_\f=\bot$ (remember that our stepping relation can, but does not have to, define a forked-off expression).
The adequacy statement concerning functional correctness reads as follows:
where $\pred$ is a \emph{meta-level} predicate over values, \ie it can mention neither resources nor invariants.
Furthermore, the following adequacy statement shows that our weakest preconditions imply that the execution never gets \emph{stuck}: Every expression in the thread pool either is a value, or can reduce further.
