Open Scope pred.
Program Definition haltsn (n : nat) (stk : stack) : pred world :=
fun pr => let (p,r) := pr in
(level p >= n -> eventually_halts_n n p r stk).
Next Obligation.
unfold hereditary; intros.
destruct a as [p r'].
destruct a' as [p' r''].
intros.
unfold prog in *.
spec H0.
apply age_level in H; simpl in H; omega.
hnf in H.
simpl in H.
unfold prog_lookup, prog in *.
remember (age1 p).
icase o.
rewrite K.knot_age1 in Heqo.
remember (K.unsquash p).
destruct p0.
icase n0.
inv H.
inv Heqo.
destruct H0 as [px [rx [? ?]]].
repeat rewrite K.knot_level in *.
rewrite <- Heqp0 in H.
rewrite K.unsquash_squash in H1.
remember (K.unsquash px).
destruct p0.
simpl in *.
destruct n1.
omegac.
exists (K.squash (n1, f0)).
exists rx.
split.
repeat rewrite K.knot_level in *.
repeat rewrite K.unsquash_squash.
trivial.
generalize (stepstar_approxprog 1 _ _ (K.squash (n0,f)) (K.squash (n1, f0)) _ _ stk _ _ H0); intro.
spec H2.
exists (K.squash (n0,f)). split; try reflexivity.
hnf. rewrite K.knot_age1.
rewrite <- Heqp0. trivial.
spec H2.
exists (K.squash (n1,f0)). split; try reflexivity.
hnf. rewrite K.knot_age1.
rewrite <- Heqp1. trivial.
spec H2. apply stack_approx_rel_refl.
destruct H2 as [s2' [? ?]].
inversion H3. subst s2'.
trivial.
Qed.
Definition guardsn (n : nat) (P : pred world) (stk : stack) : pred world :=
P --> haltsn n stk.
Definition termMeas :=
{ R : store -> nat -> Prop |
forall x y y', R x y -> R x y' -> y = y' }.
Program Definition code (l : label) (c : instruction) : pred prog :=
fun p =>
exists i, prog_lookup p l = Some i /\ instr_approx_rel (level p) c i.
Next Obligation.
unfold hereditary; intros.
hnf in H.
unfold prog_lookup, prog in *.
destruct H0 as [i [? ?]].
exists (fmap_instr (K.approx (level a')) c).
split.
2: red; symmetry; apply collapse_instr_approx_same.
rewrite K.knot_age1 in H.
remember (K.unsquash a).
destruct p.
icase n.
inv H.
rewrite K.knot_level in *.
rewrite <- Heqp in H1.
rewrite K.unsquash_squash.
simpl in *.
unfold KnotInput.fmap.
erewrite fmap_eqn.
2: apply H0.
red in H1.
replace n with (min n (S n)) by (apply min_l; auto with arith).
do 2 rewrite <- collapse_instr_approx.
rewrite H1.
trivial.
Qed.
Program Definition evalTM (t : termMeas) (n : nat) : pred world :=
fun w => let (_, r) := w in
proj1_sig t r n.
Next Obligation.
unfold hereditary; intros.
destruct a. destruct a'.
hnf in H. simpl in H. unfold prog in *.
icase (age1 p).
inv H. trivial.
Qed.
Program Definition embedWP (P : pred world) : pred prog :=
fun p => forall r, P (p,r).
Next Obligation.
unfold hereditary; intros.
spec H0 r.
apply pred_hereditary with (a,r); auto.
unfold age,age1; simpl. change K.knot with prog.
rewrite H; auto.
Qed.
Definition funptr (l:label) (A:Type) (t:termMeas) (P Q: A -> pred world) : pred prog :=
EX c : instruction, code l c &&
ALL stk : stack, ALL n : nat, ALL x : A,
|> ((embedWP (guardsn n (Q x) stk)) -->
(ALL n' : nat, embedWP (evalTM t n'   -->
guardsn (n+n') (P x) ((c;;instr_assert FF)::stk) ))).
(* Definition of the hoare relation and rules *)
Definition hoare (n':nat) (G:pred prog) (R P:pred world) (c:instruction) (Q:pred world) :=
forall p n k stk,
G p ->
(forall r', guardsn n R stk       (p,r')) ->
(forall r', guardsn n Q (k::stk)  (p,r')) ->
(forall r,  guardsn (n'+n) P ((c ;; k)::stk) (p,r)).
(* Verifying function bodies and entire programs *)
Definition verify_prog (psi:program assert) (G:pred prog) :=
forall n, agedfrom (K.squash (n,psi)) && |>G |-- G.
Record funspec (B:Type) :=
{ fs_A  : B -> Type
; fs_t  : B -> termMeas
; fs_P  : forall b, fs_A b -> pred world
; fs_Q  : forall b, fs_A b -> pred world
}.
Definition funspec_assumptions B b n (fss:list (label*funspec B) ) : pred prog :=
ALL l:_, ALL fs:_, !!(In (l,fs) fss) -->
let P' a := fs_P B fs b a &&
store_op (fun r => exists n', proj1_sig (fs_t B fs b) r n' /\ n' < n)
in funptr l (fs_A B fs b) (fs_t B fs b) P' (fs_Q B fs b).
(* Fundamental liveness theorem.  A verified function, when started in a state satisfying its precondition, will halt in a state satisfying its postcondition. *)

(* Weaker corollary: a program with a safe entry point will eventually halt. *)
Corollary verify_halts : forall t G psi l,
verify_prog psi G ->
G |-- funptr l unit t (fun _ => TT) (fun _ => TT) ->
forall r n c,
proj1_sig t r n ->
psi#l = Some c ->
eventually_halts (K.squash (n,psi)) r
((c ;; instr_assert FF)::nil).