Nested Hoare Triples and Frame Rules for Higher-order Store

clear that (p ◦ q) ◦ r = 0 p ◦ (q ◦ r) holds for all p, q, r ∈ W . For the inductive stepn > 0, by definition of the distance function on Pred it suffices to show that forall w ∈ W , ι −1 ((p ◦ q) ◦ r)(w) n−1= ι −1 (p ◦ (q ◦ r))(w). Suppose w ∈ W , thenι −1 ((p ◦ q) ◦ r)(w) = ι −1 (p ◦ q)(r ◦ w) ∗ ι −1 (r)(w)= ι −1 (p)(q ◦ (r ◦ w)) ∗ ι −1 (q)(r ◦ w) ∗ ι −1 (r)(w)= ι −1 (p)(q ◦ (r ◦ w)) ∗ ι −1 (q ◦ r)(w)n−1= ι −1 (p)((q ◦ r) ◦ w) ∗ ι −1 (q ◦ r)(w)= ι −1 (p ◦ (q ◦ r))(w)using the induction hypothesis in the fourth equation.That ⊗ forms an action of W on Pred follows from these properties of ◦:first, p ⊗ emp = λw.p(emp ◦ w) = p since emp is a unit for ◦, and(p ⊗ q) ⊗ r = λw.p(q ◦ (r ◦ w)) = λw.p((q ◦ r) ◦ w) = p ⊗ (q ◦ r)by the associativity of ◦.⊓⊔Since there is a closure applied to the post-condition of semantic triples, butno similar closure used in the pre-condition, it is not immediately clear how tocompose commands. The following characterisation permits the proof for therule of sequential composition.Lemma 15 (Closure). If f:D ⊸ D ′ is a strict continuous function, q ⊆ D ′ isan admissible and downwards closed subset of D ′ , and p ⊆ D is an arbitrarysubset of D, then f(p) ⊆ q implies f(Ad(p)) ⊆ q.Proof. Since f is continuous, the pre-image f −1 (q) of q is admissible and downwardclosed. From the assumption that f(p) ⊆ q it follows that p ⊆ f −1 (q), andthus Ad(p) ⊆ f −1 (q) as the former is by definition the least admissible and downwardclosed subset of D containing p. Thus, if h ∈ Ad(p) then f(h) ∈ q. ⊓⊔Lemma 16 (Admissibility and downward closure of semantic triples).Assume w ∈ W and p, q ∈ Pred. Then the set {c ∈ Com | w |= {p}c{q}} is anadmissible and downward closed subset of Com.Proof. Both properties follow from the definition of w |={p}c{q}, specificallyfrom the respective properties of the closure applied in the post-condition. ⊓⊔Lemma 17 (Non-expansiveness of semantic triples). Assume w, w ′ ∈ Wand let n>0 s.t. w n =w ′ . If w |={p}c{q}, then w ′ |={p}c ′ {q} for c ′ def= π n−1 ◦ c ◦ π n−1 .Proof. Assume w = n w ′ , and let p, q ∈ Pred and c : Heap ⊸ T err (Heap) suchthat w |={p}c{q}. To show that w ′ |={p}c ′ {q} for c ′ (h) = defπ n−1 (c(π n−1 (h))), letr ∈ UAdm and h ∈ Heap such that h ∈ p(w ′ ) ∗ ι −1 (w ′ )(emp) ∗ r. We must provethat c ′ (h) ∈ Ad(q(w ′ ) ∗ ι −1 (w ′ )(emp) ∗ r).