Section soundness.
Existing Instance unit_kMD.
Context {P: ProgrammingLanguage}
{MD: Model}
{J: Join model}
{SA: SeparationAlgebra model}
{R: Relation model}
{po_R: PreOrder Krelation}
{DCSA: DownwardsClosedSeparationAlgebra model}
{UCSA: UpwardsClosedSeparationAlgebra model}
{Res: Resource}
{Ac: Action}
{Acr: Action_resource Ac Res}
{nAcr: NormalAction_resource Ac Res}
{TS: TraceSemantics P (resources * model) Ac}
{AIr: ActionInterpret_resource model Ac Res ac_sem}
{SAAIr: @SAActionInterpret_resource (resources * model) Ac ac_sem (@prod_Join _ _ (Pred_Join resource) J) (fun a => ~ is_resources_action a)}
{KAIr: @KActionInterpret_resource (resources * model) Ac ac_sem (RelProd (discPred_R resource) R)}.
Instance KSAAIr: @KSAActionInterpret_resource (resources * model) Ac ac_sem (@prod_Join _ _ (Pred_Join resource) J) (RelProd (discPred_R resource) R) (fun a => ~ is_resources_action a) :=
ordered_and_frame_AIr _ _ _.
Context {L: Language} {minL: MinimunLanguage L} {pL: PropositionalLanguage L} {SL: SeparationLanguage L} {SM: Semantics L MD} {kiSM: KripkeIntuitionisticSemantics L MD tt SM} {fsSM: FlatSemantics.SeparatingSemantics L MD tt SM}.
Class LegalInvariants (Inv: resource * (model -> Prop) -> Prop): Prop := {
at_most_one_invariant: forall r I1 I2, Inv (r, I1) -> Inv (r, I2) -> I1 = I2;
invariant_mono: forall r I,  Inv (r, I) -> forall s1 s2, I s1 -> s1 <= s2 -> I s2;
invariant_precise: forall r I, Inv (r, I) -> forall s,
(exists s', (fun s' => exists f, I f /\ join s' f s) s') ->
(exists s', greatest (fun s' => exists f, I f /\ join s' f s) s')
}.
(* Definition ThreadLocal_KSA_AIr: forall (Inv: resource * (model -> Prop) -> Prop) {INV: LegalInvariants Inv}, @KSAActionInterpret_resource (resources * model) Ac (ThreadLocal_ActionInterpret_resource ac_sem Inv) (@prod_Join _ _ (Pred_Join resource) J) (RelProd (discPred_R resource) R). Check @lift_join. *)

(* Specifications: *)
Lemma ThreadLocal_ordered_frame_property (Inv: resource * (model -> Prop) -> Prop) {INV: LegalInvariants Inv}: forall (a: action) (m1 f n1' n1: resources * model) (n2: MetaState (resources * model)) fst_m2
(ASSU: res_enable a (fst m1) fst_m2 (fst f) (*forall r, a = Arelease_res r -> ~ fst f r*)),
@join _ (prod_Join _ _) m1 f n1' ->
(RelProd (discPred_R _) R) n1' n1 ->
thread_local_state_enable Inv a n1 n2  ->
exists m2 n2', @lift_join _ (prod_Join _ _) m2 (Terminating f) n2' /\ @Partial.forward _ (RelProd (discPred_R _) R) n2' n2 /\ match m2 with Terminating m2 => fst m2 = fst_m2 | _ => True end /\ thread_local_state_enable Inv a m1 m2.
Lemma hoare_parallel_partial_sound
{CPP: ConcurrentProgrammingLanguage_Sparallel P}
{AcP: Action_Parallel Ac}
{nAcPr: NormalAction_Parallel_resource Ac Res}
{c2tP: Command2Traces_Sparallel_resource P model Ac Res c2t}
{AIPr: ActionInterpret_Parallel_resource model Ac Res ac_sem}:
forall Inv c1 P1 Q1 c2 P2 Q2 (INV: LegalInvariants Inv),
guarded_triple_partial_valid Inv P1 c1 Q1 ->
guarded_triple_partial_valid Inv P2 c2 Q2 ->
guarded_triple_partial_valid Inv (P1 * P2) (Sparallel c1 c2) (Q1 * Q2).
Lemma SRA_triple_spec
{c2tSRA: StructuralResourceAccess P Ac Res c2t}:
forall (Inv: (resource * (model -> Prop)) -> Prop) (Pre: expr) (c: cmd) (Post: expr),
guarded_triple_partial_valid Inv Pre c Post <->
(forall s_pre A_post ms_post, KRIPKE: s_pre |= Pre -> @traces_access _ _ (ThreadLocal_ActionInterpret_resource _ Inv) (cmd_denote c) (fun _ => False, s_pre) (lift_function (pair A_post) ms_post) -> match ms_post with | Error => False | NonTerminating => True | Terminating s_post => KRIPKE: s_post |= Post end).
Lemma hoare_resource_block_partial_sound
{CPP: ConcurrentProgrammingLanguage_Sresource P Res}
{c2tR: Command2Traces_Sresource P Ac Res c2t}
{c2tSRA: StructuralResourceAccess P Ac Res c2t}:
forall Inv0 Inv1 r P1 P2 c I dI (INV: LegalInvariants Inv1),
@join _ (Pred_Join _) Inv0 (eq (r, dI)) Inv1 ->
(dI = fun m => KRIPKE: m |= I) ->
resource_no_occur r (cmd_denote c) ->
guarded_triple_partial_valid Inv0 (P1 * I) c (P2 * I) ->
guarded_triple_partial_valid Inv1 P1 (Sresource r c) P2.