(* Fundamental liveness theorem.  A verified function, when started in a state satisfying its precondition, will halt in a state satisfying its postcondition. *)

(* Specifications: *)
Lemma verify_totally_correct : forall G A P Q psi l t x,
verify_prog psi G ->
G |-- funptr l A t P Q ->
forall r,
(forall n, P x (K.squash (n,psi),r)) ->
forall n c, proj1_sig t r n ->
psi#l = Some c ->
exists p', exists r',
stepstar (K.squash (n,psi)) p'
r ((c ;; instr_assert FF)::nil)
r' nil /\
Q x (p',r').
(* Weaker corollary: a program with a safe entry point will eventually halt. *)
Corollary verify_halts : forall t G psi l,
verify_prog psi G ->
G |-- funptr l unit t (fun _ => TT) (fun _ => TT) ->
forall r n c,
proj1_sig t r n ->
psi#l = Some c ->
eventually_halts (K.squash (n,psi)) r
((c ;; instr_assert FF)::nil).
Lemma verify_totally_correct : forall G A P Q psi l t x,
verify_prog psi G ->
G |-- funptr l A t P Q ->
forall r,
(forall n, P x (K.squash (n,psi),r)) ->
forall n c, proj1_sig t r n ->
psi#l = Some c ->
exists p', exists r',
stepstar (K.squash (n,psi)) p'
r ((c ;; instr_assert FF)::nil)
r' nil /\
Q x (p',r').
(* Weaker corollary: a program with a safe entry point will eventually halt. *)
Corollary verify_halts : forall t G psi l,
verify_prog psi G ->
G |-- funptr l unit t (fun _ => TT) (fun _ => TT) ->
forall r n c,
proj1_sig t r n ->
psi#l = Some c ->
eventually_halts (K.squash (n,psi)) r
((c ;; instr_assert FF)::nil).
Lemma verify_totally_correct : forall t G A P Q psi l x
(HQ:forall x, boxy K.expandM (Q x)),
verify_prog t G psi G ->
G |-- funptr l A P Q ->
forall r,
(forall n, P x (K.squash (n,psi),(r#(L 0) <- (value_label l),t))) ->
exists n, exists p', exists r',
stepstar t (K.squash (n,psi)) p'
r ((instr_getlabel l (L 0) ;; instr_call (L 0) ;; instr_return ;; instr_nil _)::nil)
r' nil /\
Q x (p',(r',t)).
(* Weaker corallary: a program with a safe entry point will eventually halt. *)
Corollary verify_halts : forall t G psi l,
verify_prog t G psi G ->
G |-- funptr l unit (fun _ => TT) (fun _ => TT) ->
forall r, exists n,
eventually_halts t (K.squash (n,psi)) r
((instr_getlabel l (L 0) ;; instr_call (L 0) ;; instr_return ;; instr_nil _)::nil).