Nested Hoare Triples and Frame Rules for Higher-order Store

⊗-FrameΓ ⊢ PΓ ⊢ P ⊗ R∗-FrameΓ ⊢{P }e{Q} ⇒{P ∗ R}e{Q ∗ R}EvalΓ, k ⊢ R[k] ⇒{P ∗ e ↦→ R[ ]}k{Q}Γ ⊢{P ∗ e ↦→ R[ ]}‘eval [e]’{Q}Fig. 5. Proof rules specific to higher-order storefollows (we can omit the P 0 now, as this is only needed for mutually recursivelydefined triples):e ↦→{e ↦→ k ∗ P }k{e ↦→ k ∗ Q}.The question however remains how the assertion can be proved for some concrete‘C’ in [e]. In loc.cit. this is done by an induction on some appropriate argument,as total correctness is considered only. Note that our old OldEval can be viewedas a fixpoint induction rule for proving such specifications, if one quantifiesaway the concrete appearances of ‘C’. In any case, our new Eval is obviouslyelegant to use, and it does not only allow for recursion through the store butalso disentangles the reasoning from the concrete code stored in the heap.Before finishing this section, we summarize a particular choice of a proofruleset from the current and previous subsections in Fig. 5. They will be provedsound in Section 4.4 Semantics of Nested TriplesThis section develops a model for the programming language and logic we havepresented. The semantics of programs, given in the next subsection using anuntyped domain-theoretic model, is standard. The following semantics of thelogic is, however, unusual; it is a possible world semantics where the worldslive in a recursively defined metric space. Finally, we discuss the existence ofrecursively defined assertions, which have been used in the previous sections.Semantics of expressions and commands The interpretation of the programminglanguage is given in the category Cppo ⊥ of pointed cpos and strictcontinuous functions, and is the same as in our previous work [2]. That is, commandsdenote strict continuous functions C η∈ Heap ⊸ T err (Heap) whereHeap = Rec(Val) Val = Integers ⊥ ⊕ Com ⊥ Com = Heap ⊸ T err (Heap) (1)In these equations, T err (D) = D⊕{error} ⊥ denotes the error monad, and Rec(D)denotes records with entries from D and labelled by positive natural numbers. 4We use some evident record notations, such as {|l 1 =d 1 , . . . , l n =d n |} for the recordmapping label l i to d i , and dom(r) for the set of labels of a record r. Thedisjointness predicate r#r ′ on records holds if r and r ′ are not ⊥ and havedisjoint domains, and a continuous partial combining operation r·r ′ is defined byr · r ′ def= if r#r ′ then r ∪ r ′ else (if r=⊥ ∨ r ′ =⊥ then ⊥ else undefined).4 Formally, Rec(D) = `P N⊆ fin Nats(N→D + ↓ )´where (N→D ⊥↓) is the cpo of mapsfrom the finite address set N to the cpo D ↓ = D−{⊥} of non-bottom elements of D.