%Patch files loaded: patch2 version 2.417 $$$PVSHOME/pvs-strategies (defstep lazy-grind (&optional (if-match t) (defs !) rewrites theories exclude (updates? t)) (then (grind$ :if-match nil :defs defs :rewrites rewrites :theories theories :exclude exclude :updates? updates?) (reduce$ :if-match if-match :updates? updates?)) "Equiv. to (grind) with the instantiations postponed until after simplification." "By skolemization, if-lifting, simplification and instantiation") (defstep stew (&optional lazy-match (if-match t) (defs !) rewrites theories exclude (updates? t) &rest lemmas) (then (if lemmas (let ((lemmata (if (listp lemmas) lemmas (list lemmas))) (x `(then ,@(loop for lemma in lemmata append `((skosimp*)(use ,lemma)))))) x) (skip)) (if lazy-match (then (grind$ :if-match nil :defs defs :rewrites rewrites :theories theories :exclude exclude :updates? updates?) (reduce$ :if-match if-match :updates? updates?)) (grind$ :if-match if-match :defs defs :rewrites rewrites :theories theories :exclude exclude :updates? updates?))) "Does a combination of (lemma) and (grind)." "~%Grinding away with the supplied lemmas,") (defstep store-state (var) (let ((x (set var *ps*))) '(skip)) "" "") (defstep store-context (var) (let ((x (set var *current-context*))) '(skip)) "" "") $$$top.pvs % Authors : Todd Fine, Duane Olawsky % % Protection Notice : % % THIS IS AN UNPUBLISHED WORK CONTAINING SECURE COMPUTING % CORPORATION CONFIDENTIAL AND PROPRIETARY INFORMATION. % IF PUBLICATION OCCURS, THE FOLLOWING NOTICE APPLIES: % % (c) Copyright, 1995-1998, Secure Computing Corporation, All Rights Reserved. % % Revision Id : $Id: ac_translators.pvs.ref,v 1.2 1997/02/06 21:49:19 sundquis Exp $ % % Update Locker : $Locker: $ % % Contents : % % This file is part of the PVS version of the DTOS Composability Study. % It is the top theory. Its primary purpose is to pull everything % together to produce a PVS dump file. % % % Change History : % top : THEORY BEGIN IMPORTING system_props IMPORTING beh_equiv IMPORTING cmp_thm2 IMPORTING compose_associative IMPORTING compose_right END top $$$compose_right.pvs compose_right[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING cmp_thm[ST,AG] IMPORTING compose_idempotent[ST,AG] cset: VAR (composable[ST,AG]) b: VAR trace_t[ST,AG] cmp: VAR (comp_t) n: VAR nat cr_init: THEOREM (forall cmp: member(cmp,cset) implies member(b,prop_for(cmp))) implies initial_okay(compose(cset),b) cr_rely: THEOREM (forall cmp: member(cmp,cset) implies member(b,prop_for(cmp)) and member((sts(b)(n),sts(b)(n+1),ags(b)(n)),rely(cmp))) implies member((sts(b)(n),sts(b)(n+1),ags(b)(n)),steps(compose(cset))) cr_guar: THEOREM (forall cmp: member(cmp,cset) implies member(b,prop_for(cmp))) and (exists cmp: member(cmp,cset) and not member((sts(b)(n),sts(b)(n+1),ags(b)(n)),rely(cmp))) implies member((sts(b)(n),sts(b)(n+1),ags(b)(n)),steps(compose(cset))) cr_steps: THEOREM (forall cmp: member(cmp,cset) implies member(b,prop_for(cmp))) implies steps_okay(compose(cset),b) cr_wfar: THEOREM (forall cmp: member(cmp,cset) implies member(b,prop_for(cmp))) implies is_wfar(compose(cset),b) cr_sfar: THEOREM (forall cmp: member(cmp,cset) implies member(b,prop_for(cmp))) implies is_sfar(compose(cset),b) cr_aux: THEOREM (forall cmp: member(cmp,cset) implies member(b,prop_for(cmp))) implies member(b,prop_for(compose(cset))) compose_right: THEOREM (forall cmp: member(cmp,cset) implies tolerates(singleton(cmp),cset)) implies ( (forall cmp: member(cmp,cset) implies member(b,prop_for(cmp))) iff member(b,prop_for(compose(cset)))) END compose_right $$$compose_right.prf (|compose_right| (|cr_init| "" (SKOSIMP*) (("" (EXPAND "initial_okay") (("" (EXPAND "compose") (("" (EXPAND "member" +) (("" (EXPAND "compose_init") (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (EXPAND "member" -2) (("" (EXPAND "inits_for") (("" (SKOSIMP*) (("" (REPLACE -3 :HIDE? -3) (("" (INST?) (("" (GROUND) (("" (EXPAND "member" -1) (("" (EXPAND "prop_for") (("" (FLATTEN) (("" (EXPAND "initial_okay") (("" (PROPAX) NIL))))))))))))))))))))))))))))))))))) (|cr_rely| "" (SKOSIMP*) (("" (CASE "not member((sts(b!1)(n!1), sts(b!1)(n!1 + 1), ags(b!1)(n!1)),rely(compose(cset!1)))") (("1" (DELETE 2) (("1" (EXPAND "member" +) (("1" (EXPAND "compose") (("1" (EXPAND "compose_rely") (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member" -1) (("1" (EXPAND "relys_for") (("1" (SKOSIMP*) (("1" (REPLACE -2 :HIDE? -2) (("1" (INST?) (("1" (GROUND) NIL))))))))))))))))))))))) ("2" (DELETE -2) (("2" (EXPAND "member") (("2" (EXPAND "steps") (("2" (GROUND) NIL))))))))))) (|cr_guar| "" (SKOSIMP*) (("" (CASE "not member((sts(b!1)(n!1), sts(b!1)(n!1 + 1), ags(b!1)(n!1)),guar(compose(cset!1)))") (("1" (DELETE 3) (("1" (EXPAND "member" 1) (("1" (EXPAND "compose") (("1" (EXPAND "compose_guar") (("1" (EXPAND "intersection") (("1" (SPLIT) (("1" (EXPAND "member" 1) (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member" -1) (("1" (EXPAND "guar_or_hidds_for") (("1" (SKOSIMP*) (("1" (REPLACE -2 :HIDE? -2) (("1" (EXPAND "member" 1) (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (INST?) (("1" (GROUND) (("1" (EXPAND "prop_for") (("1" (EXPAND "steps_okay") (("1" (FLATTEN) (("1" (INST?) (("1" (EXPAND "member") (("1" (EXPAND "steps") (("1" (USE "component_rely_hidd") (("1" (EXPAND "rely_hidd_restriction") (("1" (EXPAND "subset?") (("1" (EXPAND "member") (("1" (INST?) (("1" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))) ("2" (INST?) (("2" (GROUND) (("2" (EXPAND "member" 1) (("2" (EXPAND "gen_union") (("2" (INSTANTIATE 1 "guar(cmp!1)") (("2" (GROUND) (("1" (EXPAND "member") (("1" (EXPAND "guars_for") (("1" (INST?) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))) ("2" (EXPAND "member") (("2" (EXPAND "prop_for") (("2" (EXPAND "steps_okay") (("2" (FLATTEN) (("2" (EXPAND "member") (("2" (EXPAND "steps") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))) ("2" (EXPAND "member") (("2" (EXPAND "steps") (("2" (GROUND) NIL))))))))) (|cr_steps| "" (SKOSIMP*) (("" (EXPAND "steps_okay") (("" (SKOSIMP*) (("" (REWRITE "cr_guar") (("" (REWRITE "cr_rely") (("" (SKOSIMP*) (("" (INST?) (("" (INST?) (("" (GROUND) NIL))))))))))))))))) (|cr_wfar| "" (SKOSIMP*) (("" (EXPAND "is_wfar") (("" (SKOSIMP*) (("" (EXPAND "member" -2) (("" (EXPAND "compose") (("" (EXPAND "compose_wfar") (("" (EXPAND "gen_union") (("" (SKOSIMP*) (("" (EXPAND "member" -2) (("" (EXPAND "wfars_for") (("" (SKOSIMP*) (("" (INST?) (("" (REPLACE -3 :HIDE? -3) (("" (GROUND) (("" (EXPAND "member" -1) (("" (EXPAND "prop_for") (("" (EXPAND "is_wfar") (("" (FLATTEN) (("" (INST?) (("" (GROUND) (("" (INST?) NIL))))))))))))))))))))))))))))))))))))))))) (|cr_sfar| "" (SKOSIMP*) (("" (EXPAND "is_sfar") (("" (SKOSIMP*) (("" (EXPAND "member" -2) (("" (EXPAND "compose") (("" (EXPAND "compose_sfar") (("" (EXPAND "gen_union") (("" (SKOSIMP*) (("" (EXPAND "member" -2) (("" (EXPAND "sfars_for") (("" (SKOSIMP*) (("" (INST?) (("" (REPLACE -3 :HIDE? -3) (("" (GROUND) (("" (EXPAND "member" -1) (("" (EXPAND "prop_for") (("" (EXPAND "is_sfar") (("" (FLATTEN) (("" (INST?) (("" (GROUND) (("" (INST?) NIL))))))))))))))))))))))))))))))))))))))))) (|cr_aux| "" (SKOSIMP*) (("" (EXPAND "member" +) (("" (EXPAND "prop_for" +) (("" (REWRITE "cr_init") (("" (REWRITE "cr_steps") (("" (REWRITE "cr_wfar") (("" (REWRITE "cr_sfar") (("" (GROUND) NIL))))))))))))))) (|compose_right| "" (SKOSIMP*) (("" (GROUND) (("1" (REWRITE "cr_aux") NIL) ("2" (SKOSIMP*) (("2" (LEMMA "cmp_thm") (("2" (INSTANTIATE -1 ("singleton(cmp!1)" "cset!1" "prop_for(cmp!1)")) (("2" (CASE "compose(singleton(cmp!1)) = cmp!1") (("1" (REPLACE -1 :HIDE? -1) (("1" (INST?) (("1" (TYPEPRED "cset!1") (("1" (GROUND) (("1" (EXPAND "satisfies") (("1" (INST?) (("1" (EXPAND "member") (("1" (GROUND) NIL))))))) ("2" (EXPAND "subset?") (("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (EXPAND "singleton") (("2" (GROUND) NIL))))))))) ("3" (LEMMA "nonempty_th[(comp_t)]") (("3" (INSTANTIATE -1 "singleton(cmp!1)") (("3" (GROUND) (("3" (INST?) (("3" (EXPAND "member") (("3" (EXPAND "singleton") (("3" (PROPAX) NIL))))))))))))) ("4" (EXPAND "satisfies") (("4" (SKOSIMP*) NIL))))))))))) ("2" (REWRITE "ci_component") NIL) ("3" (REWRITE "ci_composable") NIL)))))))))))))) $$$compose_associative.pvs compose_associative[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING compose[ST, AG] cset: VAR (composable) csets: VAR setof[(composable)] cmp: VAR (comp_t) ca_composable: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) IFF composable({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))}) ca_init: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) IMPLIES init(compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) = init(compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))})) ca_cags: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) IMPLIES cags(compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) = cags(compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))})) tran: VAR [ST, ST, AG] ca_guar1: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) AND guar(compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) (tran) IMPLIES gen_union(guars_for({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))}))(tran) ca_guar2: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) AND guar(compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) (tran) IMPLIES gen_intersection(guar_or_hidds_for({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))})) (tran) ca_guar3: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) AND guar(compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) (tran) IMPLIES guar(compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))}))(tran) ca_guar4: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) AND guar(compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))}))(tran) IMPLIES gen_union(guars_for(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) (tran) ca_guar5: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) AND guar(compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))}))(tran) IMPLIES gen_intersection (guar_or_hidds_for(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) (tran) ca_guar6: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) AND guar(compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))}))(tran) IMPLIES guar(compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) (tran) ca_guar: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) IMPLIES guar(compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) = guar(compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))})) ca_rely: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) IMPLIES rely(compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) = rely(compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))})) ca_hidd: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) IMPLIES hidd(compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) = hidd(compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))})) ca_view: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) IMPLIES view(compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) = view(compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))})) ca_sfar: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) IMPLIES sfar(compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) = sfar(compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))})) ca_wfar: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) IMPLIES wfar(compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets)))) = wfar(compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))})) ca_component: THEOREM composable(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) IMPLIES compose(gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets))) = compose({cmp | (EXISTS cset: member(cset, csets) AND cmp = compose(cset))}) END compose_associative $$$compose_associative.prf (|compose_associative| (|ca_composable| "" (SKOLEM!) (("" (CASE "not (csets!1 /= emptyset)") (("1" (FLATTEN) (("1" (REPLACE -1) (("1" (EXPAND "composable") (("1" (EXPAND "gen_union") (("1" (EXPAND "member") (("1" (EXPAND "extend") (("1" (EXPAND "emptyset") (("1" (PROPAX) NIL))))))))))))))) ("2" (REWRITE "nonempty_th") (("2" (SKOLEM!) (("2" (CASE "not (x!1 /= emptyset)") (("1" (DELETE -1 2) (("1" (TYPEPRED "x!1") (("1" (EXPAND "composable") (("1" (GROUND) NIL))))))) ("2" (REWRITE "nonempty_th") (("2" (SKOLEM!) (("2" (CASE "not (gen_union(extend[setof[((comp_t[ST, AG]))], ((composable)), bool, FALSE](csets!1)) /= emptyset)") (("1" (DELETE 2) (("1" (REWRITE "nonempty_th") (("1" (INST?) (("1" (EXPAND "member" +) (("1" (EXPAND "gen_union") (("1" (INST?) (("1" (GROUND) (("1" (EXPAND "extend") (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))))))))))) ("2" (CASE "not ({cmp: (comp_t) | (EXISTS (cset: (composable)): member(cset, csets!1) AND cmp = compose(cset))} /= emptyset)") (("1" (DELETE -1 2) (("1" (REWRITE "nonempty_th") (("1" (INSTANTIATE 1 "compose(x!1)") (("1" (EXPAND "member") (("1" (INST?) (("1" (GROUND) NIL))))))))))) ("2" (EXPAND "composable") (("2" (GROUND) (("1" (DELETE -2 -3 2 3 4) (("1" (EXPAND "agreeable_start") (("1" (SKOSIMP*) (("1" (INST?) (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (SKOSIMP*) (("1" (REPLACE -2 :HIDE? -2) (("1" (EXPAND "compose") (("1" (EXPAND "compose_init") (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "inits_for") (("1" (SKOSIMP*) (("1" (REPLACE -3 :HIDE? -3) (("1" (INST?) (("1" (EXPAND "gen_union") (("1" (GROUND) (("1" (INST?) (("1" (EXPAND "member") (("1" (EXPAND "extend") (("1" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))) ("2" (DELETE -2 -3 2 3 4) (("2" (EXPAND "agreeable_start") (("2" (SKOSIMP*) (("2" (INST?) (("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (EXPAND "gen_union") (("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (EXPAND "extend") (("2" (GROUND) (("2" (INSTANTIATE -4 "compose(s!1)") (("2" (GROUND) (("1" (EXPAND "compose") (("1" (EXPAND "compose_init") (("1" (EXPAND "gen_intersection") (("1" (INST?) (("1" (EXPAND "member") (("1" (EXPAND "inits_for") (("1" (INST?) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))))))))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))) (|ca_init_TCC1| "" (SKOSIMP*) (("" (REWRITE "ca_composable") NIL))) (|ca_init| "" (SKOSIMP*) (("" (EXTENSIONALITY "setof[ST]") (("" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose_init") (("1" (EXPAND "gen_intersection") (("1" (EXPAND "member") (("1" (EXPAND "inits_for") (("1" (EXPAND "member") (("1" (EXPAND "gen_union") (("1" (EXPAND "member") (("1" (EXPAND "extend") (("1" (GROUND) (("1" (SKOSIMP*) (("1" (REPLACE -4 :HIDE? -4) (("1" (REPLACE -3 :HIDE? -3) (("1" (EXPAND "compose" +) (("1" (EXPAND "compose_init") (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "inits_for") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (REPLACE -4 :HIDE? -4) (("1" (INST?) (("1" (GROUND) (("1" (INST?) (("1" (GROUND) (("1" (INSTANTIATE 1 "cset!1") (("1" (GROUND) NIL))))))))))))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (GROUND) (("2" (REPLACE -5 :HIDE? -5) (("2" (INSTANTIATE -3 "init(compose(s!2))") (("2" (GROUND) (("1" (EXPAND "compose") (("1" (EXPAND "compose_init") (("1" (EXPAND "gen_intersection") (("1" (INST?) (("1" (EXPAND "member") (("1" (GROUND) (("1" (EXPAND "inits_for") (("1" (INST?) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))))))))))) ("2" (INSTANTIATE 1 "compose(s!2)") (("2" (GROUND) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))) ("2" (REWRITE "ca_composable") NIL))))))) (|ca_cags| "" (SKOSIMP*) (("" (EXTENSIONALITY "setof[AG]") (("" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose_cags") (("1" (EXPAND "gen_union" +) (("1" (EXPAND "cagss_for") (("1" (EXPAND "member") (("1" (EXPAND "extend" +) (("1" (GROUND) (("1" (SKOSIMP*) (("1" (GROUND) (("1" (REPLACE -4 :HIDE? -4) (("1" (INSTANTIATE 1 "cags(compose(s!2))") (("1" (GROUND) (("1" (INSTANTIATE 1 "compose(s!2)") (("1" (GROUND) (("1" (INSTANTIATE 1 "s!2") (("1" (GROUND) NIL))))))) ("2" (EXPAND "compose") (("2" (EXPAND "compose_cags") (("2" (EXPAND "gen_union") (("2" (INST?) (("2" (EXPAND "member") (("2" (EXPAND "cagss_for") (("2" (INST?) (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (REPLACE -2 :HIDE? -2) (("2" (REPLACE -2 :HIDE? -2) (("2" (EXPAND "compose") (("2" (EXPAND "compose_cags") (("2" (EXPAND "gen_union") (("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (EXPAND "cagss_for") (("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (REPLACE -3 :HIDE? -3) (("2" (INST?) (("2" (GROUND) (("2" (INST?) (("2" (GROUND) (("2" (INSTANTIATE 1 "cset!1") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) ("2" (REWRITE "ca_composable") NIL))))))) (|ca_guar1| "" (SKOSIMP*) (("" (EXPAND "compose" -) (("" (EXPAND "compose_guar") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "gen_intersection") (("" (FLATTEN) (("" (EXPAND "gen_union" -3 1) (("" (EXPAND "gen_union" +) (("" (EXPAND "member") (("" (SKOSIMP*) (("" (EXPAND "guars_for") (("" (EXPAND "guar_or_hidds_for") (("" (EXPAND "member") (("" (EXPAND "gen_union" -2) (("" (EXPAND "gen_union" -3) (("" (EXPAND "member") (("" (EXPAND "extend" -2) (("" (EXPAND "extend" -3) (("" (SKOSIMP*) (("" (REPLACE -5 :HIDE? -5) (("" (GROUND) (("" (INSTANTIATE 1 "guar(compose(s!2))") (("" (GROUND) (("1" (INSTANTIATE 1 "compose(s!2)") (("1" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))))))) ("2" (EXPAND "compose") (("2" (EXPAND "compose_guar") (("2" (EXPAND "intersection") (("2" (EXPAND "member") (("2" (SPLIT) (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "guar_or_hidds_for") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (INSTANTIATE -6 "s!3") (("1" (GROUND) (("1" (INSTANTIATE 1 "cmp!2") (("1" (GROUND) (("1" (INSTANTIATE 1 "s!2") (("1" (GROUND) NIL))))))))))))))))))))))) ("2" (EXPAND "gen_union" +) (("2" (INSTANTIATE 1 "guar(cmp!1)") (("2" (EXPAND "member") (("2" (EXPAND "guars_for") (("2" (EXPAND "member") (("2" (INSTANTIATE 1 "cmp!1") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|ca_guar2| "" (SKOSIMP*) (("" (EXPAND "compose" -2) (("" (EXPAND "compose_guar") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (FLATTEN) (("" (DELETE -3) (("" (EXPAND "gen_intersection") (("" (EXPAND "member") (("" (SKOSIMP*) (("" (EXPAND "guar_or_hidds_for") (("" (SKOSIMP*) (("" (REPLACE -4 :HIDE? -4) (("" (EXPAND "member") (("" (SKOSIMP*) (("" (REPLACE -4 :HIDE? -4) (("" (EXPAND "union" +) (("" (EXPAND "member") (("" (EXPAND "compose") (("" (EXPAND "compose_guar") (("" (EXPAND "compose_hidd") (("" (FLATTEN) (("" (CASE "not (exists cmp: cset!1(cmp) and guar(cmp)(tran!1))") (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "hidds_for") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (REPLACE -5 :HIDE? -5) (("1" (INSTANTIATE -2 "union(guar(cmp!2),hidd(cmp!2))") (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (EXPAND "gen_union" +) (("2" (EXPAND "member") (("2" (EXPAND "extend") (("2" (INSTANTIATE 1 "cset!1") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))) ("2" (DELETE 2) (("2" (SKOSIMP*) (("2" (EXPAND "intersection") (("2" (EXPAND "member") (("2" (SPLIT) (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "guar_or_hidds_for") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (REPLACE -2 :HIDE? -2) (("1" (INSTANTIATE -5 "union(guar(cmp!3),hidd(cmp!3))") (("1" (GROUND) (("1" (INSTANTIATE 1 "cmp!3") (("1" (GROUND) (("1" (EXPAND "gen_union" +) (("1" (INSTANTIATE 1 "cset!1") (("1" (EXPAND "member") (("1" (EXPAND "extend") (("1" (PROPAX) NIL))))))))))))))))))))))))))))))) ("2" (EXPAND "gen_union") (("2" (INSTANTIATE 1 "guar(cmp!2)") (("2" (EXPAND "member") (("2" (EXPAND "guars_for") (("2" (GROUND) (("2" (INSTANTIATE 1 "cmp!2") (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|ca_guar3_TCC1| "" (SKOSIMP*) (("" (REWRITE "ca_composable") NIL))) (|ca_guar3| "" (SKOSIMP*) (("" (EXPAND "compose" 1 1) (("" (EXPAND "compose_guar") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (LEMMA "ca_guar1") (("" (INST?) (("" (GROUND) (("1" (LEMMA "ca_guar2") (("1" (INST?) (("1" (GROUND) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))) ("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))) (|ca_guar4| "" (SKOSIMP*) (("" (EXPAND "gen_union" +) (("" (EXPAND "member") (("" (EXPAND "guars_for") (("" (EXPAND "member") (("" (EXPAND "extend" +) (("" (EXPAND "compose" -2 1) (("" (EXPAND "compose_guar") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (FLATTEN) (("" (DELETE -2) (("" (EXPAND "gen_union" -2) (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "guars_for") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (SKOSIMP*) (("" (REPLACE -3 :HIDE? -3) (("" (REPLACE -3 :HIDE? -3) (("" (EXPAND "compose") (("" (EXPAND "compose_guar") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (FLATTEN) (("" (DELETE -3) (("" (EXPAND "gen_union") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "guars_for") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (REPLACE -4 :HIDE? -4) (("" (INST?) (("" (GROUND) (("" (INST?) (("" (GROUND) (("" (INSTANTIATE 1 "cset!1") (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|ca_guar5| "" (SKOSIMP*) (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "guar_or_hidds_for") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "gen_union" -3) (("" (REPLACE -4 :HIDE? -4) (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "extend" -3) (("" (GROUND) (("" (EXPAND "compose" -4 1) (("" (EXPAND "compose_guar") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "gen_intersection") (("" (EXPAND "member") (("" (EXPAND "guar_or_hidds_for") (("" (EXPAND "member") (("" (FLATTEN) (("" (INSTANTIATE -4 "union(guar(compose(s!2)),hidd(compose(s!2)))") (("" (GROUND) (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (EXPAND "compose" -1) (("1" (EXPAND "compose_guar") (("1" (FLATTEN) (("1" (SPLIT) (("1" (EXPAND "intersection") (("1" (EXPAND "member") (("1" (EXPAND "gen_intersection") (("1" (EXPAND "member") (("1" (EXPAND "guar_or_hidds_for") (("1" (EXPAND "member") (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (FLATTEN) (("1" (INSTANTIATE -1 "{x: transition[ST,AG] | (guar(cmp!1)(x) or hidd(cmp!1)(x))}") (("1" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))))))))))))))))))))))))) ("2" (EXPAND "compose_hidd") (("2" (EXPAND "gen_intersection") (("2" (INSTANTIATE -1 "hidd(cmp!1)") (("2" (EXPAND "member") (("2" (GROUND) (("2" (EXPAND "hidds_for") (("2" (EXPAND "member") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))) ("2" (INSTANTIATE 1 "compose(s!2)") (("2" (GROUND) (("2" (INSTANTIATE 1 "s!2") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|ca_guar6_TCC1| "" (SKOSIMP*) NIL) (|ca_guar6| "" (SKOSIMP*) (("" (LEMMA "ca_guar4") (("" (INST?) (("" (EXPAND "member") (("" (GROUND) (("" (LEMMA "ca_guar5") (("" (INST?) (("" (EXPAND "member") (("" (INST?) (("" (GROUND) (("" (EXPAND "compose" +) (("" (EXPAND "compose_guar") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (PROPAX) NIL))))))))))))))))))))))))))))) (|ca_guar| "" (SKOSIMP*) (("" (EXTENSIONALITY "setof[transition]") (("" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (GROUND) (("1" (REWRITE "ca_guar3") NIL) ("2" (REWRITE "ca_guar6") NIL))))))))))) ("2" (REWRITE "ca_composable") NIL))))))) (|ca_rely| "" (SKOSIMP*) (("" (EXTENSIONALITY "setof[[ST,ST,AG]]") (("" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose_rely") (("1" (EXPAND "gen_intersection") (("1" (EXPAND "member") (("1" (EXPAND "relys_for") (("1" (EXPAND "member") (("1" (EXPAND "gen_union") (("1" (EXPAND "member") (("1" (EXPAND "extend") (("1" (GROUND) (("1" (SKOSIMP*) (("1" (REPLACE -4 :HIDE? -4) (("1" (REPLACE -3 :HIDE? -3) (("1" (EXPAND "compose" +) (("1" (EXPAND "compose_rely") (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "relys_for") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (REPLACE -4 :HIDE? -4) (("1" (INST?) (("1" (GROUND) (("1" (INST?) (("1" (GROUND) (("1" (INSTANTIATE 1 "cset!1") (("1" (GROUND) NIL))))))))))))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (GROUND) (("2" (REPLACE -5 :HIDE? -5) (("2" (INSTANTIATE -3 "rely(compose(s!2))") (("2" (GROUND) (("1" (EXPAND "compose") (("1" (EXPAND "compose_rely") (("1" (EXPAND "gen_intersection") (("1" (INST?) (("1" (EXPAND "member") (("1" (GROUND) (("1" (EXPAND "relys_for") (("1" (INST?) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))))))))))) ("2" (INSTANTIATE 1 "compose(s!2)") (("2" (GROUND) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))) ("2" (REWRITE "ca_composable") NIL))))))) (|ca_hidd| "" (SKOSIMP*) (("" (EXTENSIONALITY "setof[[ST,ST,AG]]") (("" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose_hidd") (("1" (EXPAND "gen_intersection") (("1" (EXPAND "member") (("1" (EXPAND "hidds_for") (("1" (EXPAND "member") (("1" (EXPAND "gen_union") (("1" (EXPAND "member") (("1" (EXPAND "extend") (("1" (GROUND) (("1" (SKOSIMP*) (("1" (REPLACE -4 :HIDE? -4) (("1" (REPLACE -3 :HIDE? -3) (("1" (EXPAND "compose" +) (("1" (EXPAND "compose_hidd") (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "hidds_for") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (REPLACE -4 :HIDE? -4) (("1" (INST?) (("1" (GROUND) (("1" (INST?) (("1" (GROUND) (("1" (INSTANTIATE 1 "cset!1") (("1" (GROUND) NIL))))))))))))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (GROUND) (("2" (REPLACE -5 :HIDE? -5) (("2" (INSTANTIATE -3 "hidd(compose(s!2))") (("2" (GROUND) (("1" (EXPAND "compose") (("1" (EXPAND "compose_hidd") (("1" (EXPAND "gen_intersection") (("1" (INST?) (("1" (EXPAND "member") (("1" (GROUND) (("1" (EXPAND "hidds_for") (("1" (INST?) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))))))))))) ("2" (INSTANTIATE 1 "compose(s!2)") (("2" (GROUND) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))) ("2" (REWRITE "ca_composable") NIL))))))) (|ca_view| "" (SKOSIMP*) (("" (EXTENSIONALITY "setof[[ST,ST]] ") (("" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose_view") (("1" (EXPAND "gen_intersection") (("1" (EXPAND "member") (("1" (EXPAND "extend" +) (("1" (EXPAND "views_for") (("1" (EXPAND "member") (("1" (EXPAND "gen_union" +) (("1" (EXPAND "member") (("1" (GROUND) (("1" (SKOSIMP*) (("1" (GROUND) (("1" (SKOSIMP*) (("1" (REPLACE -4 :HIDE? -4) (("1" (REPLACE -3 :HIDE? -3) (("1" (EXPAND "compose" +) (("1" (EXPAND "compose_view") (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "extend" -4) (("1" (GROUND) (("1" (EXPAND "views_for") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (REPLACE -3 :HIDE? -3) (("1" (INST?) (("1" (GROUND) (("1" (INST?) (("1" (GROUND) (("1" (INSTANTIATE 1 "cset!1") (("1" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (GROUND) (("2" (SKOSIMP*) (("2" (REPLACE -4 :HIDE? -4) (("2" (INSTANTIATE -4 "view(compose(s!2))") (("1" (GROUND) (("1" (EXPAND "compose") (("1" (EXPAND "compose_view") (("1" (EXPAND "gen_intersection") (("1" (INST?) (("1" (EXPAND "member") (("1" (EXPAND "extend") (("1" (EXPAND "views_for") (("1" (INST?) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))))))))))) ("2" (INSTANTIATE 1 "compose(s!2)") (("2" (GROUND) (("2" (INSTANTIATE 1 "s!2") (("2" (GROUND) NIL))))))))) ("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))) ("2" (REWRITE "ca_composable") NIL))))))) (|ca_sfar| "" (SKOSIMP*) (("" (EXTENSIONALITY "setof[TRANSITION_CLASS]") (("" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose_sfar") (("1" (EXPAND "gen_union" +) (("1" (EXPAND "sfars_for") (("1" (EXPAND "member") (("1" (EXPAND "extend" +) (("1" (GROUND) (("1" (SKOSIMP*) (("1" (GROUND) (("1" (REPLACE -4 :HIDE? -4) (("1" (INSTANTIATE 1 "sfar(compose(s!2))") (("1" (GROUND) (("1" (INSTANTIATE 1 "compose(s!2)") (("1" (GROUND) (("1" (INSTANTIATE 1 "s!2") (("1" (GROUND) NIL))))))) ("2" (EXPAND "compose") (("2" (EXPAND "compose_sfar") (("2" (EXPAND "gen_union") (("2" (INST?) (("2" (EXPAND "member") (("2" (EXPAND "sfars_for") (("2" (INST?) (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (REPLACE -2 :HIDE? -2) (("2" (REPLACE -2 :HIDE? -2) (("2" (EXPAND "compose") (("2" (EXPAND "compose_sfar") (("2" (EXPAND "gen_union") (("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (EXPAND "sfars_for") (("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (REPLACE -3 :HIDE? -3) (("2" (INST?) (("2" (GROUND) (("2" (INST?) (("2" (GROUND) (("2" (INSTANTIATE 1 "cset!1") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) ("2" (REWRITE "ca_composable") NIL))))))) (|ca_wfar| "" (SKOSIMP*) (("" (EXTENSIONALITY "setof[TRANSITION_CLASS]") (("" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose" 1 1) (("1" (EXPAND "compose_wfar") (("1" (EXPAND "gen_union" +) (("1" (EXPAND "wfars_for") (("1" (EXPAND "member") (("1" (EXPAND "extend" +) (("1" (GROUND) (("1" (SKOSIMP*) (("1" (GROUND) (("1" (REPLACE -4 :HIDE? -4) (("1" (INSTANTIATE 1 "wfar(compose(s!2))") (("1" (GROUND) (("1" (INSTANTIATE 1 "compose(s!2)") (("1" (GROUND) (("1" (INSTANTIATE 1 "s!2") (("1" (GROUND) NIL))))))) ("2" (EXPAND "compose") (("2" (EXPAND "compose_wfar") (("2" (EXPAND "gen_union") (("2" (INST?) (("2" (EXPAND "member") (("2" (EXPAND "wfars_for") (("2" (INST?) (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (REPLACE -2 :HIDE? -2) (("2" (REPLACE -2 :HIDE? -2) (("2" (EXPAND "compose") (("2" (EXPAND "compose_wfar") (("2" (EXPAND "gen_union") (("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (EXPAND "wfars_for") (("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (REPLACE -3 :HIDE? -3) (("2" (INST?) (("2" (GROUND) (("2" (INST?) (("2" (GROUND) (("2" (INSTANTIATE 1 "cset!1") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) ("2" (REWRITE "ca_composable") NIL))))))) (|ca_component| "" (SKOSIMP*) (("" (EXTENSIONALITY "(comp_t)") (("" (INST?) (("1" (GROUND) (("1" (REWRITE "ca_cags") NIL) ("2" (REWRITE "ca_guar") NIL) ("3" (REWRITE "ca_hidd") NIL) ("4" (REWRITE "ca_init") NIL) ("5" (REWRITE "ca_rely") NIL) ("6" (REWRITE "ca_sfar") NIL) ("7" (REWRITE "ca_view") NIL) ("8" (REWRITE "ca_wfar") NIL))) ("2" (REWRITE "ca_composable") NIL)))))))) $$$compose2.pvs compose2[ST: NONEMPTY_TYPE, ST1: NONEMPTY_TYPE, ST2: NONEMPTY_TYPE, AG: NONEMPTY_TYPE, AG1: NONEMPTY_TYPE, AG2: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING cmp_translators[ST1,AG1,ST,AG] IMPORTING cmp_translators[ST2,AG2,ST,AG] IMPORTING compose[ST,AG] cset: VAR setof[(comp_t[ST,AG])] cmp, cmpa, cmpb: VAR (comp_t[ST,AG]) cmp1 : VAR (comp_t[ST1,AG1]) cmp2 : VAR (comp_t[ST2,AG2]) sttran1 : VAR (translator_t[ST1,ST]) agtran1 : VAR (weak_translator_t[AG1,AG]) sttran2 : VAR (translator_t[ST2,ST]) agtran2 : VAR (weak_translator_t[AG2,AG]) make_two_set(cmpa,cmpb) : setof[(comp_t[ST,AG])] = (LAMBDA cmp: cmp = cmpa or cmp = cmpb) make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) : setof[(comp_t[ST,AG])] = make_two_set(tran_cmp(cmp1,sttran1,agtran1),tran_cmp(cmp2,sttran2,agtran2)) compose_init2(cmp1, cmp2, sttran1, sttran2, agtran1, agtran2): setof[ST] = intersection(tmap(sttran1, init(cmp1)), tmap(sttran2, init(cmp2))) compose_init2_def: THEOREM compose_init(make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2)) = compose_init2(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) compose_guar2(cmp1, cmp2, sttran1, sttran2, agtran1, agtran2): setof[[ST, ST, AG]] = union(intersection(tr_ac(guar(cmp1),sttran1,agtran1), union(tr_ac(hidd(cmp2),sttran2, agtran2), env_stutter(cmp2,sttran2,agtran2))), union(intersection(tr_ac(guar(cmp2),sttran2,agtran2), union(tr_ac(hidd(cmp1),sttran1,agtran1), env_stutter(cmp1,sttran1,agtran1))), intersection(tr_ac(guar(cmp1),sttran1,agtran1), tr_ac(guar(cmp2),sttran2,agtran2)))) compose_guar2_def: THEOREM compose_guar(make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2)) = compose_guar2(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) compose_rely2(cmp1, cmp2, sttran1, sttran2, agtran1, agtran2): setof[[ST, ST, AG]] = intersection(union(tr_ac(rely(cmp1),sttran1,agtran1), env_stutter(cmp1,sttran1,agtran1)), union(tr_ac(rely(cmp2), sttran2, agtran2), env_stutter(cmp2,sttran2,agtran2))) compose_rely2_def: THEOREM compose_rely(make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2)) = compose_rely2(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) compose_cags2(cmp1, cmp2, sttran1, sttran2, agtran1, agtran2): setof[AG] = union(tmap(agtran1, cags(cmp1)), tmap(agtran2, cags(cmp2))) compose_cags2_def: THEOREM compose_cags(make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2)) = compose_cags2(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) compose_view2(cmp1, cmp2, sttran1, sttran2, agtran1, agtran2): setof[[ST, ST]] = intersection(vmap(sttran1, view(cmp1)), vmap(sttran2, view(cmp2))) compose_view2_def: THEOREM compose_view(make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2)) = compose_view2(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) compose_hidd2(cmp1, cmp2, sttran1, sttran2, agtran1, agtran2): setof[[ST, ST,AG]] = intersection(union(tr_ac(hidd(cmp1),sttran1,agtran1), env_stutter(cmp1,sttran1,agtran1)), union(tr_ac(hidd(cmp2), sttran2, agtran2), env_stutter(cmp2,sttran2,agtran2))) compose_hidd2_def: THEOREM compose_hidd(make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2)) = compose_hidd2(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) compose_wfar2(cmp1, cmp2,sttran1,sttran2,agtran1,agtran2): setof[TRANSITION_CLASS[ST,AG]] = union(tr_tcs(wfar(cmp1), sttran1,agtran1), tr_tcs(wfar(cmp2), sttran2,agtran2)) compose_wfar2_def: THEOREM compose_wfar(make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2)) = compose_wfar2(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) compose_sfar2(cmp1, cmp2,sttran1,sttran2,agtran1,agtran2): setof[TRANSITION_CLASS[ST,AG]] = union(tr_tcs(sfar(cmp1), sttran1,agtran1), tr_tcs(sfar(cmp2), sttran2,agtran2)) compose_sfar2_def: THEOREM compose_sfar(make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2)) = compose_sfar2(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) composable_init2(cmp1, cmp2, sttran1, sttran2, agtran1, agtran2): bool = compose_init2(cmp1, cmp2, sttran1, sttran2, agtran1, agtran2) /= emptyset composable_init2_def: THEOREM agreeable_start(make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2)) = composable_init2(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) composable2(cmp1, cmp2, sttran1, sttran2, agtran1, agtran2): bool = composable_init2(cmp1, cmp2, sttran1, sttran2, agtran1, agtran2) composable2_def: THEOREM composable(make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2)) = composable2(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) c: VAR (composable2) compose_base2(c): base_comp_t[ST, AG] = (# init := compose_init2(c), guar := compose_guar2(c), rely := compose_rely2(c), cags := compose_cags2(c), view := compose_view2(c), wfar := compose_wfar2(c), sfar := compose_sfar2(c), hidd := compose_hidd2(c) #) compose_base2_def: THEOREM compose_base2(c) = compose_base(make_two_set_tr(c)) compose2(c): (comp_t[ST, AG]) = compose_base2(c) compose2_def: THEOREM compose2(c) = compose(make_two_set_tr(c)) END compose2 $$$compose2.prf (|compose2| (|compose_init2_def| "" (SKOLEM!) (("" (EXTENSIONALITY "setof[ST]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "compose_init") (("" (EXPAND "compose_init2") (("" (EXPAND "gen_intersection") (("" (EXPAND "member") (("" (EXPAND "inits_for") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "make_two_set_tr") (("" (EXPAND "make_two_set") (("" (GROUND) (("1" (INST?) (("1" (GROUND) (("1" (INST?) (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))))))))) ("2" (INST?) (("2" (GROUND) (("2" (INSTANTIATE 1 "tran_cmp(cmp2!1, sttran2!1, agtran2!1)") (("2" (GROUND) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (PROPAX) NIL))))))))))))) ("3" (SKOSIMP*) (("3" (SPLIT) (("1" (REPLACE -1 :HIDE? -1) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (GROUND) NIL))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))) (|compose_guar2_def| "" (SKOLEM!) (("" (EXTENSIONALITY "setof[[ST,ST,AG]]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (GROUND) (("1" (EXPAND "compose_guar") (("1" (EXPAND "intersection") (("1" (FLATTEN) (("1" (EXPAND "member") (("1" (EXPAND "gen_union") (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "guars_for") (("1" (EXPAND "guar_or_hidds_for") (("1" (EXPAND "member") (("1" (EXPAND "make_two_set_tr") (("1" (EXPAND "make_two_set") (("1" (SKOSIMP*) (("1" (REPLACE -3 :HIDE? -3) (("1" (EXPAND "compose_guar2") (("1" (EXPAND "union" +) (("1" (EXPAND "intersection" +) (("1" (EXPAND "member") (("1" (SPLIT -2) (("1" (REPLACE -1 :HIDE? -1) (("1" (INSTANTIATE -1 "union(guar(tran_cmp(cmp2!1,sttran2!1,agtran2!1)),hidd(tran_cmp(cmp2!1,sttran2!1,agtran2!1)))") (("1" (SPLIT -1) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (FLATTEN) (("1" (DELETE 2) (("1" (GROUND) NIL))))))))))))) ("2" (INSTANTIATE 1 "tran_cmp(cmp2!1,sttran2!1,agtran2!1)") (("2" (GROUND) NIL))))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (INSTANTIATE -1 "union(guar(tran_cmp(cmp1!1,sttran1!1,agtran1!1)),hidd(tran_cmp(cmp1!1,sttran1!1,agtran1!1)))") (("2" (SPLIT -1) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (GROUND) NIL))))))))) ("2" (INSTANTIATE 1 "tran_cmp(cmp1!1,sttran1!1,agtran1!1)") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))) ("2" (EXPAND "compose_guar") (("2" (EXPAND "intersection") (("2" (EXPAND "compose_guar2") (("2" (EXPAND "union") (("2" (EXPAND "intersection") (("2" (EXPAND "member") (("2" (EXPAND "gen_intersection") (("2" (EXPAND "gen_union") (("2" (EXPAND "member") (("2" (EXPAND "guar_or_hidds_for") (("2" (EXPAND "guars_for") (("2" (EXPAND "member") (("2" (EXPAND "make_two_set_tr") (("2" (EXPAND "make_two_set") (("2" (SPLIT -1) (("1" (FLATTEN) (("1" (SPLIT 1) (("1" (SKOSIMP*) (("1" (REPLACE -2 :HIDE? -2) (("1" (SPLIT -1) (("1" (REPLACE -1 :HIDE? -1) (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (GROUND) NIL))))))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (EXPAND "union") (("2" (EXPAND "member") (("2" (GROUND) NIL))))))))))))))))) ("2" (INST?) (("2" (GROUND) (("1" (INST?) (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))))) ("2" (INST?) (("2" (GROUND) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (PROPAX) NIL))))))))))))))))) ("2" (FLATTEN) (("2" (SPLIT 1) (("1" (SKOSIMP*) (("1" (REPLACE -2 :HIDE? -2) (("1" (SPLIT -1) (("1" (REPLACE -1 :HIDE? -1) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (GROUND) NIL))))))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (EXPAND "union") (("2" (EXPAND "member") (("2" (GROUND) NIL))))))))))))))))) ("2" (INST?) (("2" (GROUND) (("1" (INSTANTIATE 1 "tran_cmp(cmp2!1,sttran2!1,agtran2!1)") (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))))) ("2" (INSTANTIATE 1 "tran_cmp(cmp2!1,sttran2!1,agtran2!1)") (("2" (GROUND) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (PROPAX) NIL))))))))))))))))) ("3" (FLATTEN) (("3" (SPLIT) (("1" (SKOSIMP*) (("1" (REPLACE -2 :HIDE? -2) (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (SPLIT) (("1" (REPLACE -1 :HIDE? -1) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (GROUND) NIL))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (GROUND) NIL))))))))))))))))) ("2" (INST?) (("2" (GROUND) (("2" (INST?) (("2" (GROUND) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|compose_rely2_def| "" (SKOLEM!) (("" (EXTENSIONALITY "setof[[ST,ST,AG]]") (("" (INST?) (("" (GROUND) (("" (EXPAND "compose_rely") (("" (EXPAND "compose_rely2") (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "gen_intersection") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "relys_for") (("" (EXPAND "union") (("" (EXPAND "member") (("" (EXPAND "make_two_set_tr") (("" (EXPAND "make_two_set") (("" (SPLIT) (("1" (FLATTEN) (("1" (INSTANTIATE -1 "rely(tran_cmp(cmp1!1,sttran1!1,agtran1!1))" T) (("1" (INSTANTIATE -1 "rely(tran_cmp(cmp2!1,sttran2!1,agtran2!1))") (("1" (SPLIT -1) (("1" (SPLIT -2) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (GROUND) NIL))))))))) ("2" (INSTANTIATE 1 "tran_cmp(cmp1!1,sttran1!1,agtran1!1)") (("2" (GROUND) NIL))))) ("2" (INSTANTIATE 1 "tran_cmp(cmp2!1,sttran2!1,agtran2!1)") (("2" (GROUND) NIL))))))))))) ("2" (SKOSIMP*) (("2" (REPLACE -4 :HIDE? -4) (("2" (SPLIT -3) (("1" (REPLACE -1 :HIDE? -1) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (EXPAND "union") (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))) (|compose_cags2_def| "" (SKOLEM!) (("" (EXTENSIONALITY "setof[AG]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "compose_cags") (("" (EXPAND "compose_cags2") (("" (EXPAND "gen_union") (("" (EXPAND "union") (("" (EXPAND "member") (("" (EXPAND "cagss_for") (("" (EXPAND "member") (("" (EXPAND "make_two_set_tr") (("" (EXPAND "make_two_set") (("" (GROUND) (("1" (SKOSIMP*) (("1" (REPLACE -2 :HIDE? -2) (("1" (SPLIT) (("1" (REPLACE -1 :HIDE? -1) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (PROPAX) NIL))))))))))))) ("2" (INST?) (("2" (GROUND) (("2" (INST?) (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REWRITE "tr_cmp_type") NIL))))))) ("3" (INST?) (("3" (GROUND) (("3" (INSTANTIATE 1 "tran_cmp(cmp2!1,sttran2!1,agtran2!1)") (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REWRITE "tr_cmp_type") NIL))))))))))))))))))))))))))))))))))))))))) (|compose_view2_def| "" (SKOLEM!) (("" (EXTENSIONALITY "setof[[ST,ST]]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "compose_view") (("" (EXPAND "compose_view2") (("" (EXPAND "gen_intersection") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "extend") (("" (EXPAND "views_for") (("" (EXPAND "member") (("" (EXPAND "make_two_set_tr") (("" (EXPAND "make_two_set") (("" (GROUND) (("1" (INST?) (("1" (ASSERT) (("1" (INST?) (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REWRITE "tr_cmp_type") NIL))))))) ("2" (INST?) (("2" (ASSERT) (("2" (INSTANTIATE 2 "tran_cmp(cmp2!1,sttran2!1,agtran2!1)") (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REWRITE "tr_cmp_type") NIL))))))) ("3" (SKOSIMP*) (("3" (SPLIT) (("1" (SKOSIMP*) (("1" (REPLACE -3 :HIDE? -3) (("1" (SPLIT) (("1" (REPLACE -1 :HIDE? -1) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (PROPAX) NIL))))))))))))) ("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))) (|compose_hidd2_def| "" (SKOLEM!) (("" (EXTENSIONALITY "setof[[ST,ST,AG]]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "compose_hidd") (("" (EXPAND "compose_hidd2") (("" (EXPAND "gen_intersection") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "hidds_for") (("" (EXPAND "member") (("" (EXPAND "make_two_set_tr") (("" (EXPAND "make_two_set") (("" (GROUND) (("1" (INST?) (("1" (GROUND) (("1" (INST?) (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REWRITE "tr_cmp_type") NIL))))))) ("2" (INST?) (("2" (GROUND) (("2" (INSTANTIATE 1 "tran_cmp(cmp2!1,sttran2!1,agtran2!1)") (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REWRITE "tr_cmp_type") NIL))))))) ("3" (SKOSIMP*) (("3" (REPLACE -4 :HIDE? -4) (("3" (SPLIT) (("1" (REPLACE -1 :HIDE? -1) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))))) (|compose_wfar2_def| "" (SKOLEM!) (("" (EXTENSIONALITY "setof[setof[[ST,ST,AG]]]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "compose_wfar") (("" (EXPAND "compose_wfar2") (("" (EXPAND "gen_union") (("" (EXPAND "union") (("" (EXPAND "member") (("" (EXPAND "wfars_for") (("" (EXPAND "member") (("" (EXPAND "make_two_set_tr") (("" (EXPAND "make_two_set") (("" (GROUND) (("1" (SKOSIMP*) (("1" (REPLACE -2 :HIDE? -2) (("1" (SPLIT) (("1" (REPLACE -1 :HIDE? -1) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (PROPAX) NIL))))))))))))) ("2" (INST?) (("2" (GROUND) (("2" (INST?) (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REWRITE "tr_cmp_type") NIL))))))) ("3" (INST?) (("3" (GROUND) (("3" (INSTANTIATE 1 "tran_cmp(cmp2!1,sttran2!1,agtran2!1)") (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REWRITE "tr_cmp_type") NIL))))))))))))))))))))))))))))))))))))))))) (|compose_sfar2_def| "" (SKOLEM!) (("" (EXTENSIONALITY "setof[setof[[ST,ST,AG]]]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "compose_sfar") (("" (EXPAND "compose_sfar2") (("" (EXPAND "gen_union") (("" (EXPAND "union") (("" (EXPAND "member") (("" (EXPAND "sfars_for") (("" (EXPAND "member") (("" (EXPAND "make_two_set_tr") (("" (EXPAND "make_two_set") (("" (GROUND) (("1" (SKOSIMP*) (("1" (REPLACE -2 :HIDE? -2) (("1" (SPLIT) (("1" (REPLACE -1 :HIDE? -1) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (PROPAX) NIL))))))))))))) ("2" (INST?) (("2" (GROUND) (("2" (INST?) (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REWRITE "tr_cmp_type") NIL))))))) ("3" (INST?) (("3" (GROUND) (("3" (INSTANTIATE 1 "tran_cmp(cmp2!1,sttran2!1,agtran2!1)") (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REWRITE "tr_cmp_type") NIL))))))))))))))))))))))))))))))))))))))))) (|composable_init2_def| "" (SKOLEM!) (("" (IFF) (("" (EXPAND "agreeable_start") (("" (EXPAND "make_two_set_tr") (("" (EXPAND "composable_init2") (("" (EXPAND "member") (("" (EXPAND "make_two_set") (("" (EXPAND "compose_init2") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (REWRITE "nonempty_th[ST]") (("" (EXPAND "member") (("" (GROUND) (("1" (SKOSIMP*) (("1" (INSTANTIATE -1 "tran_cmp(cmp1!1,sttran1!1,agtran1!1)" T) (("1" (INSTANTIATE -1 "tran_cmp(cmp2!1,sttran2!1,agtran2!1)") (("1" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (INST?) (("1" (GROUND) NIL))))))))) ("2" (REWRITE "tr_cmp_type") NIL))) ("2" (REWRITE "tr_cmp_type") NIL))))) ("2" (SKOSIMP*) (("2" (INST?) (("2" (SKOSIMP*) (("2" (SPLIT) (("1" (REPLACE -1 :HIDE? -1) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (PROPAX) NIL))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))) (|composable2_def| "" (SKOLEM!) (("" (IFF) (("" (EXPAND "composable") (("" (EXPAND "composable2") (("" (REWRITE "composable_init2_def") (("" (REWRITE "nonempty_th[(comp_t[ST,AG])]") (("" (GROUND) (("" (EXPAND "member") (("" (EXPAND "make_two_set_tr") (("" (INST?) (("" (EXPAND "make_two_set") (("" (PROPAX) NIL))))))))))))))))))))))) (|compose_base2_TCC1| "" (SKOLEM!) (("" (EXPAND "compose_view2") (("" (REWRITE "view_and_prop") NIL))))) (|compose_base2_def| "" (SKOLEM!) (("" (EXPAND "compose_base2") (("" (EXPAND "compose_base") (("" (CASE "c!1 /= (PROJ_1(c!1),PROJ_2(c!1),PROJ_3(c!1),PROJ_4(c!1),PROJ_5(c!1),PROJ_6(c!1))") (("1" (DELETE 1) (("1" (FLATTEN) (("1" (EXTENSIONALITY "(composable2)") (("1" (INST?) (("1" (GROUND) NIL))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (GROUND) (("1" (USE "compose_init2_def") (("1" (GROUND) NIL))) ("2" (USE "compose_guar2_def") (("2" (GROUND) NIL))) ("3" (USE "compose_rely2_def") (("3" (GROUND) NIL))) ("4" (USE "compose_cags2_def") (("4" (GROUND) NIL))) ("5" (USE "compose_view2_def") (("5" (GROUND) NIL))) ("6" (USE "compose_wfar2_def") (("6" (GROUND) NIL))) ("7" (USE "compose_sfar2_def") (("7" (GROUND) NIL))) ("8" (USE "compose_hidd2_def") (("8" (GROUND) NIL))))))))))))))))) (|compose2_TCC1| "" (SKOLEM!) (("" (REWRITE "compose_base2_def") (("" (REWRITE "compose_base_tc") (("" (LEMMA "composable2_def") (("" (INSTANTIATE -1 ("PROJ_5(c!1)" "PROJ_6(c!1)" "PROJ_1(c!1)" "PROJ_2(c!1)" "PROJ_3(c!1)" "PROJ_4(c!1)")) (("" (TYPEPRED "c!1") (("" (GROUND) (("" (CASE "c!1 /= (PROJ_1(c!1),PROJ_2(c!1),PROJ_3(c!1),PROJ_4(c!1),PROJ_5(c!1),PROJ_6(c!1))") (("1" (DELETE -2 -3 1 2) (("1" (EXTENSIONALITY "(composable2)") (("1" (INSTANTIATE -1 ("c!1" "(PROJ_1(c!1), PROJ_2(c!1), PROJ_3(c!1), PROJ_4(c!1), PROJ_5(c!1), PROJ_6(c!1))")) (("1" (GROUND) NIL))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (GROUND) NIL))))))))))))))))))))) (|compose2_def_TCC1| "" (SKOSIMP*) (("" (TYPEPRED "c!1") (("" (LEMMA "composable2_def") (("" (INSTANTIATE -1 ("PROJ_5(c!1)" "PROJ_6(c!1)" "PROJ_1(c!1)" "PROJ_2(c!1)" "PROJ_3(c!1)" "PROJ_4(c!1)")) (("" (CASE "c!1 /= (PROJ_1(c!1),PROJ_2(c!1),PROJ_3(c!1),PROJ_4(c!1),PROJ_5(c!1),PROJ_6(c!1))") (("1" (EXTENSIONALITY "(composable2)") (("1" (INSTANTIATE -1 ("c!1" "(PROJ_1(c!1), PROJ_2(c!1), PROJ_3(c!1), PROJ_4(c!1), PROJ_5(c!1), PROJ_6(c!1))")) (("1" (GROUND) NIL))))) ("2" (FLATTEN) (("2" (REPLACE -1 -2 RL :HIDE? -1) (("2" (GROUND) NIL))))))))))))))) (|compose2_def| "" (SKOLEM!) (("" (EXPAND "compose2") (("" (EXPAND "compose") (("" (REWRITE "compose_base2_def") (("" (EXPAND "compose_base") (("" (PROPAX) NIL)))))))))))) $$$cmp_thm2.pvs cmp_thm2[ST: NONEMPTY_TYPE, ST1: NONEMPTY_TYPE, ST2 : NONEMPTY_TYPE, AG: NONEMPTY_TYPE, AG1: NONEMPTY_TYPE, AG2: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING compose2[ST, ST1,ST2,AG,AG1,AG2] IMPORTING compose_idempotent[ST,AG] IMPORTING cmp_thm[ST, AG] p: VAR prop_t[ST, AG] cmp1: VAR (comp_t[ST1, AG1]) cmp2: VAR (comp_t[ST2, AG2]) st, st1, st2: VAR ST ag: VAR AG sttran1 : VAR (translator_t[ST1,ST]) agtran1 : VAR (translator_t[AG1,AG]) sttran2 : VAR (translator_t[ST2,ST]) agtran2 : VAR (translator_t[AG2,AG]) respects_restrictions1(cmp1, cmp2, sttran1, sttran2, agtran1, agtran2): bool = (FORALL st1, st2, ag: member((st1,st2,ag),tr_ac(guar(cmp1), sttran1, agtran1)) AND not member((st1, st2, ag),tr_ac(guar(cmp2), sttran2, agtran2)) and member((st1, st2, ag),tr_ac(hidd(cmp2), sttran2, agtran2)) implies member((st1, st2, ag), tr_ac(rely(cmp2), sttran2, agtran2))) respects_restrictions2(cmp1, cmp2, sttran1, sttran2, agtran1, agtran2): bool = (FORALL st1, st2, ag: member((st1,st2,ag),tr_ac(guar(cmp2), sttran2, agtran2)) AND not member((st1, st2, ag),tr_ac(guar(cmp1), sttran1, agtran1)) and member((st1, st2, ag),tr_ac(hidd(cmp1), sttran1, agtran1)) implies member((st1, st2, ag), tr_ac(rely(cmp1), sttran1, agtran1))) respects_and_tolerates_same2: THEOREM respects_restrictions2(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) implies tolerates(singleton(tran_cmp(cmp1,sttran1,agtran1)), make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1, agtran2)) respects_and_tolerates_same1: THEOREM respects_restrictions1(cmp1,cmp2,sttran1,sttran2,agtran1,agtran2) implies tolerates(singleton(tran_cmp(cmp2,sttran2,agtran2)), make_two_set_tr(cmp1,cmp2,sttran1,sttran2,agtran1, agtran2)) compose_thm1: THEOREM composable2(cmp1, cmp2,sttran1,sttran2,agtran1,agtran2) AND respects_restrictions2(cmp1, cmp2,sttran1,sttran2,agtran1,agtran2) IMPLIES (satisfies(tran_cmp(cmp1,sttran1,agtran1), p) IMPLIES satisfies(compose2(cmp1, cmp2,sttran1,sttran2,agtran1,agtran2), p)) compose_thm2: THEOREM composable2(cmp1, cmp2,sttran1,sttran2,agtran1,agtran2) AND respects_restrictions1(cmp1, cmp2,sttran1,sttran2,agtran1,agtran2) IMPLIES (satisfies(tran_cmp(cmp2,sttran2,agtran2), p) IMPLIES satisfies(compose2(cmp1, cmp2,sttran1,sttran2,agtran1,agtran2), p)) compose_thm: THEOREM composable2(cmp1, cmp2,sttran1,sttran2,agtran1,agtran2) AND respects_restrictions1(cmp1, cmp2,sttran1,sttran2,agtran1,agtran2) and respects_restrictions2(cmp1, cmp2,sttran1,sttran2,agtran1,agtran2) IMPLIES ((satisfies(tran_cmp(cmp1,sttran1,agtran1), p) OR satisfies(tran_cmp(cmp2,sttran2,agtran2), p)) IMPLIES satisfies(compose2(cmp1, cmp2,sttran1,sttran2,agtran1,agtran2), p)) END cmp_thm2 $$$cmp_thm2.prf (|cmp_thm2| (|respects_and_tolerates_same2| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "tolerates") (("" (SKOSIMP*) (("" (EXPAND "tolerates_cmp") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "make_two_set_tr") (("" (EXPAND "make_two_set") (("" (EXPAND "respects_restrictions2") (("" (EXPAND "member") (("" (SPLIT -2) (("1" (REPLACE -1 :HIDE? -1) (("1" (DELETE -1) (("1" (INST?) (("1" (EXPAND "singleton") (("1" (GROUND) NIL))))))))) ("2" (REPLACE -1 :HIDE? -1) (("2" (INSTANTIATE -1 ("PROJ_1(tran!1)" "PROJ_2(tran!1)" "PROJ_3(tran!1)")) (("2" (EXPAND "singleton") (("2" (REPLACE -3 :HIDE? -3) (("2" (INSTANTIATE 1 "tran_cmp(cmp1!1,sttran1!1,agtran1!1)") (("2" (EXPAND "tran_cmp") (("2" (GROUND) (("1" (EXPAND "tr_cmp") (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))) ("2" (EXPAND "tr_cmp") (("2" (GROUND) NIL))) ("3" (EXPAND "tr_cmp") (("3" (GROUND) NIL))) ("4" (EXPAND "tr_cmp") (("4" (EXPAND "union") (("4" (EXPAND "member") (("4" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))) (|respects_and_tolerates_same1| "" (SKOSIMP*) (("" (EXPAND "tolerates") (("" (SKOSIMP*) (("" (EXPAND "tolerates_cmp") (("" (SKOSIMP*) (("" (EXPAND "respects_restrictions1") (("" (EXPAND "member") (("" (EXPAND "make_two_set_tr") (("" (EXPAND "make_two_set") (("" (EXPAND "singleton") (("" (REPLACE -4 :HIDE? -4) (("" (INSTANTIATE 1 "tran_cmp(cmp2!1,sttran2!1,agtran2!1)") (("" (GROUND) (("" (EXPAND "tran_cmp" +) (("" (REPLACE -1 :HIDE? -1) (("" (EXPAND "tr_cmp") (("" (EXPAND "union") (("" (EXPAND "member") (("" (INSTANTIATE -1 ("PROJ_1(tran!1)" "PROJ_2(tran!1)" "PROJ_3(tran!1)")) (("" (GROUND) (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (CASE "(PROJ_1(tran!1),PROJ_2(tran!1),PROJ_3(tran!1)) /= tran!1") (("1" (FLATTEN) (("1" (GROUND) NIL))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (PROPAX) NIL))))))))))))))) ("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (EXPAND "union") (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))))))) (|compose_thm1_TCC1| "" (SUBTYPE-TCC) NIL) (|compose_thm1| "" (SKOSIMP*) (("" (LEMMA "cmp_thm") (("" (REWRITE "compose2_def") (("" (LEMMA "ci_component") (("" (INSTANTIATE -1 "tran_cmp(cmp1!1,sttran1!1,agtran1!1)") (("" (REPLACE -1 -5 RL :HIDE? -1) (("" (INSTANTIATE -1 ("singleton(tran_cmp(cmp1!1,sttran1!1,agtran1!1))" "make_two_set_tr(cmp1!1,cmp2!1,sttran1!1,sttran2!1,agtran1!1,agtran2!1)" "p!1")) (("" (SPLIT -1) (("1" (PROPAX) NIL) ("2" (EXPAND "subset?") (("2" (EXPAND "member") (("2" (EXPAND "singleton" 1) (("2" (EXPAND "make_two_set_tr" 1) (("2" (EXPAND "make_two_set") (("2" (SKOSIMP*) NIL))))))))))) ("3" (REWRITE "respects_and_tolerates_same2") NIL) ("4" (REWRITE "composable2_def") NIL) ("5" (REWRITE "nonempty_th") (("5" (EXPAND "member") (("5" (EXPAND "singleton" +) (("5" (INST?) NIL))))))) ("6" (PROPAX) NIL))))))))))))))))) (|compose_thm2_TCC1| "" (SUBTYPE-TCC) NIL) (|compose_thm2| "" (SKOSIMP*) (("" (REWRITE "compose2_def") (("" (LEMMA "composable2_def") (("" (INST?) (("" (REPLACE -1 -2 RL :HIDE? -1) (("" (LEMMA "respects_and_tolerates_same1") (("" (INST?) (("" (GROUND) (("" (DELETE -3) (("" (LEMMA "cmp_thm") (("" (INSTANTIATE -1 ("singleton(tran_cmp(cmp2!1,sttran2!1,agtran2!1))" "make_two_set_tr(cmp1!1,cmp2!1,sttran1!1,sttran2!1,agtran1!1,agtran2!1)" "p!1")) (("" (GROUND) (("1" (EXPAND "subset?") (("1" (EXPAND "member") (("1" (EXPAND "singleton") (("1" (EXPAND "make_two_set_tr") (("1" (EXPAND "make_two_set") (("1" (SKOSIMP*) NIL))))))))))) ("2" (LEMMA "nonempty_th[(comp_t[ST,AG])]") (("2" (INSTANTIATE -1 "singleton(tran_cmp(cmp2!1,sttran2!1,agtran2!1))") (("2" (GROUND) (("2" (INSTANTIATE 1 "tran_cmp(cmp2!1,sttran2!1,agtran2!1)") (("2" (EXPAND "member") (("2" (EXPAND "singleton" +) (("2" (PROPAX) NIL))))))))))))) ("3" (REWRITE "ci_component") NIL))))))))))))))))))))))))) (|compose_thm_TCC1| "" (SUBTYPE-TCC) NIL) (|compose_thm| "" (SKOSIMP*) (("" (REWRITE "compose_thm1") (("" (REWRITE "compose_thm2") NIL)))))) $$$beh_equiv.pvs beh_equiv[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING cprops[ST, AG] IMPORTING views[trace_t[ST, AG]] b, b1, b2, b3: VAR trace_t p: VAR prop_t v: VAR (VIEWS[ST]) i: VAR nat cmp: VAR (comp_t) tranc: VAR setof[transition] beh_equiv(v)(b1, b2): bool = (FORALL i: v(sts(b1)(i), sts(b2)(i)) AND ags(b1)(i) = ags(b2)(i)) beh_equiv_is_refl: THEOREM beh_equiv(v)(b, b) beh_equiv_is_sym: THEOREM beh_equiv(v)(b1, b2) IMPLIES beh_equiv(v)(b2, b1) beh_equiv_is_trans: THEOREM beh_equiv(v)(b1, b2) AND beh_equiv(v)(b2, b3) IMPLIES beh_equiv(v)(b1, b3) beh_equiv_is_equiv: THEOREM VIEWS(beh_equiv(v)) beh_equiv_init: THEOREM beh_equiv(view(cmp))(b1, b2) AND initial_okay(cmp, b1) IMPLIES initial_okay(cmp, b2) beh_equiv_gen_steps: THEOREM beh_equiv(v)(b1, b2) AND gen_view_restriction(tranc, v) AND member((sts(b1)(i), sts(b1)(i + 1), ags(b1)(i)), tranc) IMPLIES member((sts(b2)(i), sts(b2)(i + 1), ags(b2)(i)), tranc) beh_equiv_steps: THEOREM beh_equiv(view(cmp))(b1, b2) AND steps_okay(cmp, b1) IMPLIES steps_okay(cmp, b2) beh_equiv_enabled: THEOREM beh_equiv(v)(b1, b2) AND gen_view_restriction(tranc, v) AND enabled(tranc, sts(b1)(i)) IMPLIES enabled(tranc, sts(b2)(i)) beh_equiv_wfar: THEOREM beh_equiv(view(cmp))(b1, b2) AND is_wfar(cmp, b1) IMPLIES is_wfar(cmp, b2) beh_equiv_sfar: THEOREM beh_equiv(view(cmp))(b1, b2) AND is_sfar(cmp, b1) IMPLIES is_sfar(cmp, b2) beh_equiv_prop_help: THEOREM beh_equiv(view(cmp))(b1, b2) AND member(b1, prop_for(cmp)) IMPLIES member(b2, prop_for(cmp)) beh_equiv_prop: THEOREM beh_equiv(view(cmp))(b1, b2) IMPLIES (member(b1, prop_for(cmp)) IFF member(b2, prop_for(cmp))) property(p, v): bool = (FORALL b1, b2: beh_equiv(v)(b1, b2) IMPLIES (member(b1, p) IFF member(b2, p))) cmp_property(p, cmp): bool = property(p, view(cmp)) END beh_equiv $$$beh_equiv.prf (|beh_equiv| (|beh_equiv_is_refl| "" (SKOLEM!) (("" (EXPAND "beh_equiv") (("" (SKOLEM!) (("" (REWRITE "refl_view") NIL))))))) (|beh_equiv_is_sym| "" (SKOSIMP*) (("" (EXPAND "beh_equiv") (("" (SKOSIMP*) (("" (INST?) (("" (GROUND) (("" (REWRITE "sym_view") NIL))))))))))) (|beh_equiv_is_trans| "" (SKOSIMP*) (("" (EXPAND "beh_equiv") (("" (SKOSIMP*) (("" (INST?) (("" (INST?) (("" (GROUND) (("" (LEMMA "trans_view[ST]") (("" (INSTANTIATE -1 ("v!1" "sts(b1!1)(i!1)" "sts(b2!1)(i!1)" "sts(b3!1)(i!1)")) (("" (GROUND) NIL))))))))))))))))) (|beh_equiv_is_equiv| "" (SKOLEM!) (("" (EXPAND "VIEWS") (("" (GROUND) (("1" (SKOLEM!) (("1" (REWRITE "beh_equiv_is_refl") NIL))) ("2" (SKOSIMP*) (("2" (LEMMA "beh_equiv_is_sym") (("2" (INSTANTIATE -1 ("x1!1" "x2!1" "v!1")) (("2" (GROUND) NIL))))))) ("3" (LEMMA "beh_equiv_is_trans") (("3" (SKOSIMP*) (("3" (INSTANTIATE -1 ("x1!1" "x2!1" "x3!1" "v!1")) (("3" (GROUND) NIL))))))))))))) (|beh_equiv_init| "" (SKOSIMP*) (("" (EXPAND "initial_okay") (("" (USE "component_view_init") (("" (EXPAND "view_init_restriction") (("" (EXPAND "beh_equiv") (("" (INSTANTIATE -2 "0") (("" (INST?) (("" (GROUND) NIL))))))))))))))) (|beh_equiv_gen_steps| "" (SKOSIMP*) (("" (EXPAND "beh_equiv") (("" (INSTANTIATE -1 "i!1" T) (("" (INSTANTIATE -1 "i!1+1") (("" (EXPAND "gen_view_restriction") (("" (INSTANTIATE -3 ("ags(b1!1)(i!1)" "sts(b1!1)(i!1)" "sts(b1!1)(i!1+1)" "sts(b2!1)(i!1)" "sts(b2!1)(i!1+1)")) (("" (GROUND) NIL))))))))))))) (|beh_equiv_steps| "" (SKOSIMP*) (("" (EXPAND "steps_okay") (("" (EXPAND "member") (("" (EXPAND "steps") (("" (SKOLEM!) (("" (INSTANTIATE -2 "n!1") (("" (LEMMA "beh_equiv_gen_steps") (("" (INSTANTIATE -1 ("b1!1" "b2!1" "n!1" _ "view(cmp!1)")) (("" (GROUND) (("1" (INST?) (("1" (EXPAND "member") (("1" (USE "component_view_guar") (("1" (EXPAND "view_guar_restriction") (("1" (PROPAX) NIL))))))))) ("2" (INST?) (("2" (EXPAND "member") (("2" (USE "component_view_rely") (("2" (EXPAND "view_rely_restriction") (("2" (PROPAX) NIL))))))))) ("3" (DELETE -2) (("3" (LEMMA "square_view[ST]") (("3" (INSTANTIATE -1 ("view(cmp!1)" "sts(b1!1)(n!1)" "sts(b1!1)(n!1+1)" "sts(b2!1)(n!1)" "sts(b2!1)(n!1+1)")) (("3" (EXPAND "beh_equiv") (("3" (INSTANTIATE -3 "n!1" T) (("3" (INSTANTIATE -3 "n!1+1" T) (("3" (GROUND) NIL))))))))))))))))))))))))))))))) (|beh_equiv_enabled| "" (SKOSIMP*) (("" (EXPAND "enabled") (("" (SKOSIMP*) (("" (INSTANTIATE 1 ("st2!1" "ag!1")) (("" (EXPAND "gen_view_restriction") (("" (INSTANTIATE -2 ("ag!1" "sts(b1!1)(i!1)" "st2!1" "sts(b2!1)(i!1)" "st2!1")) (("" (GROUND) (("1" (EXPAND "beh_equiv") (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (REWRITE "refl_view") NIL))))))))))))))) (|beh_equiv_wfar| "" (SKOSIMP*) (("" (EXPAND "is_wfar") (("" (SKOSIMP*) (("" (INST?) (("" (GROUND) (("" (INST?) (("" (SKOSIMP*) (("" (INST?) (("" (SPLIT -2) (("1" (LEMMA "beh_equiv_enabled") (("1" (INSTANTIATE -1 ("b2!1" "b1!1" "j!1" "tranc!1" "view(cmp!1)")) (("1" (LEMMA "beh_equiv_is_sym") (("1" (INSTANTIATE -1 ("b1!1" "b2!1" "view(cmp!1)")) (("1" (LEMMA "component_view_wfar") (("1" (INST?) (("1" (EXPAND "view_wfar_restriction") (("1" (INST?) (("1" (GROUND) NIL))))))))))))))))) ("2" (LEMMA "beh_equiv_gen_steps") (("2" (INSTANTIATE -1 ("b1!1" "b2!1" "j!1" "tranc!1" "view(cmp!1)")) (("2" (USE "component_view_wfar") (("2" (EXPAND "view_wfar_restriction") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))) (|beh_equiv_sfar| "" (SKOSIMP*) (("" (EXPAND "is_sfar") (("" (SKOSIMP*) (("" (INST?) (("" (GROUND) (("" (INST?) (("" (SKOSIMP*) (("" (INST?) (("" (USE "component_view_sfar") (("" (EXPAND "view_sfar_restriction") (("" (INST?) (("" (GROUND) (("1" (SKOSIMP*) (("1" (DELETE 1) (("1" (INST?) (("1" (GROUND) (("1" (LEMMA "beh_equiv_enabled") (("1" (INSTANTIATE -1 ("b2!1" "b1!1" "k!1" "tranc!1" "view(cmp!1)")) (("1" (GROUND) (("1" (REWRITE "beh_equiv_is_sym") NIL))))))))))))))) ("2" (DELETE 1) (("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) (("2" (LEMMA "beh_equiv_gen_steps") (("2" (INSTANTIATE -1 ("b1!1" "b2!1" "l!1" "tranc!1" "view(cmp!1)")) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))) (|beh_equiv_prop_help| "" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "prop_for") (("" (GROUND) (("1" (USE "beh_equiv_init") (("1" (GROUND) NIL))) ("2" (USE "beh_equiv_steps") (("2" (GROUND) NIL))) ("3" (USE "beh_equiv_wfar") (("3" (GROUND) NIL))) ("4" (USE "beh_equiv_sfar") (("4" (GROUND) NIL))))))))))) (|beh_equiv_prop| "" (SKOSIMP*) (("" (GROUND) (("1" (USE "beh_equiv_prop_help") (("1" (GROUND) NIL))) ("2" (LEMMA "beh_equiv_prop_help") (("2" (INSTANTIATE -1 ("b2!1" "b1!1" "cmp!1")) (("2" (GROUND) (("2" (REWRITE "beh_equiv_is_sym") NIL))))))))))) (|cmp_property_fact| "" (SKOSIMP*) (("" (EXPAND "cmp_property") (("" (EXPAND "property") (("" (EXPAND "satisfies") (("" (SKOSIMP*) (("" (INSTANTIATE -1 "b1!1" T) (("" (INSTANTIATE -1 "b2!1") (("" (LEMMA "beh_equiv_prop") (("" (INST?) (("" (EXPAND "member") (("" (SPLIT -1) (("1" (CASE "prop_for(cmp!1)(b1!1)") (("1" (GROUND) NIL) ("2" (CASE "prop_for(cmp!1)(b2!1)") (("1" (GROUND) NIL) ("2" (DELETE -1 -2 -3) (("2" (POSTPONE) NIL))))))) ("2" (POSTPONE) NIL)))))))))))))))))))))))) $$$tpreds.pvs tpreds[ST: NONEMPTY_TYPE, ST1: NONEMPTY_TYPE, AG: NONEMPTY_TYPE, AG1: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING tprops[ST, ST1, AG, AG1] IMPORTING ac_translators[ST1, AG1, ST, AG] IMPORTING preds[ST, AG] IMPORTING preds[ST1, AG1] IMPORTING unity xsp: VAR STATE_PRED[ST1, AG1] ysp: VAR STATE_PRED[ST, AG] xap: VAR ACTION_PRED[ST1, AG1] yap: VAR ACTION_PRED[ST, AG] xp1, xp2: VAR prop_t[ST1, AG1] yp1, yp2: VAR prop_t[ST, AG] xst, xst1, xst2: VAR ST1 yst, yst1, yst2: VAR ST xag: VAR AG1 yag: VAR AG sttran1: VAR (translator_t[ST1, ST]) agtran1: VAR (translator_t[AG1, AG]) sp_tran: THEOREM (FORALL yst: tmap(sttran1, xsp)(yst) IFF ysp(yst)) IMPLIES pmap(stbp(xsp), sttran1, agtran1) = (stbp(ysp)) always_sp_tran: THEOREM (FORALL yst: tmap(sttran1, xsp)(yst) IFF ysp(yst)) IMPLIES pmap(alwayss(xsp), sttran1, agtran1) = (alwayss(ysp)) always_tmap: THEOREM pmap(alwayss(xsp), sttran1, agtran1) = alwayss(tmap(sttran1, xsp)) pimplies_pmap: THEOREM pmap(pimplies(xp1, xp2), sttran1, agtran1) = pimplies(pmap(xp1, sttran1, agtran1), pmap(xp2, sttran1, agtran1)) ap_tran: THEOREM (FORALL yst1, yst2, yag: tr_ac[ST1, AG1, ST, AG](xap, sttran1, agtran1)(yst1, yst2, yag) IFF yap(yst1, yst2, yag)) IMPLIES pmap(atbp(xap), sttran1, agtran1) = (atbp(yap)) always_ap_tran: THEOREM (FORALL yst1, yst2, yag: tr_ac[ST1, AG1, ST, AG](xap, sttran1, agtran1)(yst1, yst2, yag) IFF yap(yst1, yst2, yag)) IMPLIES pmap(alwaysa(xap), sttran1, agtran1) = (alwaysa(yap)) END tpreds $$$tpreds.prf (|tpreds| (|sp_tran| "" (SKOSIMP*) (("" (EXTENSIONALITY "prop_t[ST,AG]") (("" (INST?) (("" (GROUND) (("" (HIDE 2) (("" (SKOSIMP) (("" (EXPAND "pmap") (("" (EXPAND "pmap1") (("" (EXPAND "stbp") (("" (EXPAND "bmap") (("" (EXPAND "bmap1") (("" (EXPAND "bmap1_base") (("" (IFF) (("" (GROUND) (("1" (SKOSIMP) (("1" (EXPAND "tmap") (("1" (EXPAND "member") (("1" (INST - "0") (("1" (INST? -) (("1" (GROUND) (("1" (INST? +) (("1" (GROUND) NIL))))))))))))))) ("2" (INSTANTIATE 1 "(# sts := (LAMBDA (n : nat): trinv(sttran1!1,sts(x!1)(n))), ags := (LAMBDA (n : nat): trinv(agtran1!1,ags(x!1)(n))) #)") (("2" (SIMPLIFY) (("2" (GROUND) (("1" (SKOSIMP) (("1" (REWRITE "trinv_def[ST1,ST]") (("1" (REWRITE "trinv_def[AG1,AG]") (("1" (GROUND) NIL))))))) ("2" (EXPAND "tmap") (("2" (EXPAND "member") (("2" (LEMMA "help3[ST1,ST]") (("2" (INST? -3) (("2" (GROUND) (("2" (SKOSIMP) (("2" (CASE "x!2=trinv(sttran1!1, sts(x!1)(0))") (("1" (REPLACE -1) (("1" (PROPAX) NIL))) ("2" (INST? -) (("2" (INST?) (("2" (GROUND) (("2" (REWRITE "trinv_def[ST1,ST]") NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|always_sp_tran| "" (SKOSIMP*) (("" (EXTENSIONALITY "prop_t[ST,AG]") (("" (INST?) (("" (GROUND) (("" (HIDE 2) (("" (SKOSIMP) (("" (EXPAND "pmap") (("" (EXPAND "pmap1") (("" (EXPAND "bmap") (("" (EXPAND "bmap1") (("" (EXPAND "bmap1_base") (("" (EXPAND "tmap") (("" (IFF) (("" (EXPAND "member") (("" (EXPAND "alwayss") (("" (EXPAND "always") (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (GROUND) (("1" (SKOSIMP*) (("1" (INST? -3) (("1" (GROUND) (("1" (INST - "i!1") (("1" (INST - "i!1") (("1" (INST? +) (("1" (GROUND) NIL))))))))))))) ("2" (INST + "(# sts := (LAMBDA (n : nat): trinv(sttran1!1,sts(x!1)(n))), ags := (LAMBDA (n : nat): trinv(agtran1!1,ags(x!1)(n))) #)") (("2" (SIMPLIFY) (("2" (GROUND) (("1" (SKOSIMP) (("1" (REWRITE "trinv_def[ST1,ST]") (("1" (REWRITE "trinv_def[AG1,AG]") (("1" (GROUND) NIL))))))) ("2" (SKOLEM!) (("2" (INSTANTIATE -1 "i!1") (("2" (INST?) (("2" (GROUND) (("2" (DELETE -2 -3) (("2" (SKOSIMP) (("2" (CASE "x!2=trinv(sttran1!1, sts(x!1)(i!1))") (("1" (REPLACE -1) (("1" (PROPAX) NIL))) ("2" (USE "help3[ST1,ST]") (("2" (GROUND) (("2" (REWRITE "trinv_def[ST1,ST]") NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|always_tmap| "" (SKOSIMP) (("" (REWRITE "always_sp_tran") NIL))) (|pimplies_pmap| "" (SKOSIMP) (("" (REWRITE "extensionality") (("" (HIDE 2) (("" (SKOSIMP) (("" (IFF) (("" (EXPAND "pmap") (("" (EXPAND "pmap1") (("" (EXPAND "bmap") (("" (EXPAND "bmap1") (("" (EXPAND "bmap1_base") (("" (EXPAND "pimplies") (("" (EXPAND "member") (("" (GROUND) (("1" (SKOSIMP*) (("1" (INST + "t1!1") (("1" (GROUND) (("1" (CASE-REPLACE "t1!1=t1!2") (("1" (EXTENSIONALITY "trace_t[ST1,AG1]") (("1" (INST?) (("1" (GROUND) (("1" (REWRITE "extensionality") (("1" (SKOSIMP) (("1" (INST?) (("1" (INST?) (("1" (USE "help3[AG1,AG]") (("1" (GROUND) NIL))))))))))) ("2" (REWRITE "extensionality") (("2" (SKOSIMP) (("2" (INST?) (("2" (INST?) (("2" (USE "help3[ST1,ST]") (("2" (GROUND) NIL))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (INST? +) (("2" (GROUND) NIL))))) ("3" (CASE "(EXISTS (t1: trace_t[ST1, AG1]): ((FORALL (n: nat): sttran1!1(sts(t1)(n))(sts(x!1)(n)) AND agtran1!1(ags(t1)(n))(ags(x!1)(n)))))") (("1" (SKOSIMP) (("1" (INST? +) (("1" (INST? +) (("1" (GROUND) NIL))))))) ("2" (HIDE 2 3) (("2" (INST + "(# sts:= (LAMBDA (n: nat): epsilon! (st: ST1): sttran1!1(st)(sts(x!1)(n))), ags:= (LAMBDA (n: nat): epsilon! (ag: AG1): agtran1!1(ag)(ags(x!1)(n))) #)") (("2" (GROUND) (("2" (SKOSIMP) (("2" (GROUND) (("1" (USE "epsilon_ax[ST1]") (("1" (GROUND) (("1" (USE "help5[ST1,ST]") NIL))))) ("2" (USE "epsilon_ax[AG1]") (("2" (GROUND) (("2" (USE "help5[AG1,AG]") NIL))))))))))))))))))))))))))))))))))))))))))) (|ap_tran| "" (SKOSIMP*) (("" (EXTENSIONALITY "prop_t[ST,AG]") (("" (INST?) (("" (GROUND) (("" (HIDE 2) (("" (SKOSIMP) (("" (EXPAND "pmap") (("" (EXPAND "pmap1") (("" (EXPAND "bmap") (("" (EXPAND "bmap1") (("" (EXPAND "bmap1_base") (("" (EXPAND "atbp") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (IFF) (("" (GROUND) (("1" (SKOSIMP*) (("1" (INST? -3) (("1" (GROUND) (("1" (INST? +) (("1" (GROUND) (("1" (INST? -) (("1" (GROUND) NIL))) ("2" (INST? -) (("2" (GROUND) NIL))) ("3" (INST? -) (("3" (GROUND) NIL))))))))))))) ("2" (INST + "(# sts := (LAMBDA (n : nat): trinv(sttran1!1,sts(x!1)(n))), ags := (LAMBDA (n : nat): trinv(agtran1!1,ags(x!1)(n))) #)") (("2" (GROUND) (("1" (SKOSIMP) (("1" (REWRITE "trinv_def[ST1,ST]") (("1" (REWRITE "trinv_def[AG1,AG]") (("1" (GROUND) NIL))))))) ("2" (INST? -) (("2" (GROUND) (("2" (SKOSIMP*) (("2" (LEMMA "trinv_def[ST1,ST]") (("2" (CASE "a1!1=trinv(sttran1!1, sts(x!1)(0))" "a2!1=trinv(sttran1!1, sts(x!1)(1))" "b!1=trinv(agtran1!1, ags(x!1)(0))") (("1" (GROUND) NIL) ("2" (USE "help3[AG1,AG]") (("2" (GROUND) (("2" (USE "trinv_def[AG1,AG]") NIL))))) ("3" (LEMMA "help3[ST1,ST]") (("3" (INST? - :WHERE +) (("3" (INST?) (("3" (GROUND) (("3" (REWRITE "trinv_def[ST1,ST]") NIL))))))))) ("4" (USE "help3[ST1,ST]") (("4" (GROUND) (("4" (REWRITE "trinv_def[ST1,ST]") NIL))))))))))))))))))))))))))))))))))))))))))))))))))) (|always_ap_tran| "" (SKOSIMP*) (("" (EXTENSIONALITY "prop_t[ST,AG]") (("" (INST?) (("" (GROUND) (("" (HIDE 2) (("" (SKOSIMP) (("" (EXPAND "pmap") (("" (EXPAND "pmap1") (("" (EXPAND "bmap") (("" (EXPAND "bmap1") (("" (EXPAND "bmap1_base") (("" (EXPAND "alwaysa") (("" (EXPAND "always") (("" (EXPAND "atbp") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (EXPAND "shift") (("" (IFF) (("" (GROUND) (("1" (SKOSIMP*) (("1" (INST? -3) (("1" (GROUND) (("1" (INST - "i!1") (("1" (INST - "i!1") (("1" (INST? +) (("1" (GROUND) (("1" (REVEAL -2) (("1" (INST? -) (("1" (GROUND) NIL))))))))))))))))))) ("2" (INST + "(# sts := (LAMBDA (n : nat): trinv(sttran1!1,sts(x!1)(n))), ags := (LAMBDA (n : nat): trinv(agtran1!1,ags(x!1)(n))) #)") (("2" (GROUND) (("1" (SKOSIMP) (("1" (REWRITE "trinv_def[ST1,ST]") (("1" (REWRITE "trinv_def[AG1,AG]") (("1" (GROUND) NIL))))))) ("2" (SKOSIMP) (("2" (INST - "i!1") (("2" (INST? -) (("2" (GROUND) (("2" (SKOSIMP) (("2" (CASE "a1!1=trinv(sttran1!1, sts(x!1)(i!1))" "a2!1=trinv(sttran1!1, sts(x!1)(i!1+1))" "b!1=trinv(agtran1!1, ags(x!1)(i!1))") (("1" (GROUND) NIL) ("2" (USE "help3[AG1,AG]") (("2" (GROUND) (("2" (USE "trinv_def[AG1,AG]") NIL))))) ("3" (LEMMA "help3[ST1,ST]") (("3" (INST? - :WHERE +) (("3" (INST?) (("3" (GROUND) (("3" (REWRITE "trinv_def[ST1,ST]") NIL))))))))) ("4" (USE "help3[ST1,ST]") (("4" (GROUND) (("4" (REWRITE "trinv_def[ST1,ST]") NIL)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) $$$ks_props.pvs ks_props : THEORY BEGIN IMPORTING ks_spec IMPORTING preds[(KS_STATE), THREAD ] st, st1, st2 : VAR (KS_STATE) thread: VAR THREAD to, handle, reply_port : VAR NAME key: VAR KEY kernel_req : VAR KERNEL_REQ seed : VAR SEED ks_valid_key_pred : STATE_PRED = (LAMBDA st : (FORALL thread, handle : (ks_threads(thread) AND key_handles(thst(st)(thread))(handle)) IMPLIES (EXISTS seed : handle_to_key(thst(st)(thread))(handle) = generate_key(server_mech(thst(st)(thread)),seed)))) ks_valid_key_prop1: THEOREM init_satisfies(ks_comp, ks_valid_key_pred) ks_valid_key_prop2: THEOREM steps_satisfy(ks_comp, stable(ks_valid_key_pred)) ks_valid_key_prop: THEOREM satisfies(ks_comp, alwayss(ks_valid_key_pred)) ks_provide_key_pred : STATE_PRED = (LAMBDA st: (FORALL kernel_req, thread, to, reply_port, key: (ks_threads(thread) AND pending_requests(kst(st))(kernel_req) AND kernel_req = send_message_req(thread, to, provide_key_op, reply_port, provide_key_msg(key)) IMPLIES (EXISTS handle : key_handles(thst(st)(thread))(handle) AND key = handle_to_key(thst(st)(thread))(handle))))) ks_provide_key_prop1: THEOREM init_satisfies(ks_comp, ks_provide_key_pred) ks_provide_key_prop2: CONJECTURE steps_satisfy(ks_comp, stable(ks_provide_key_pred)) ks_provide_key_prop: CONJECTURE satisfies(ks_comp, alwayss(ks_provide_key_pred)) ks_provide_valid_key_pred : STATE_PRED = (LAMBDA st: (FORALL kernel_req, thread, to, reply_port, key: (ks_threads(thread) AND pending_requests(kst(st))(kernel_req) AND kernel_req = send_message_req(thread, to, provide_key_op, reply_port, provide_key_msg(key)) IMPLIES (EXISTS seed : key = generate_key(server_mech(thst(st)(thread)),seed))))) ks_provide_valid_key_prop: CONJECTURE satisfies(ks_comp, alwayss(ks_provide_valid_key_pred)) END ks_props $$$ks_props.prf (|ks_props| (IMPORTING2_TCC1 "" (INST 1 "ks_state_witness") NIL) (|ks_valid_key_pred_TCC1| "" (SKOSIMP) NIL) (|ks_valid_key_pred_TCC2| "" (SKOSIMP) NIL) (|ks_valid_key_prop1| "" (EXPAND "init_satisfies") (("" (SKOSIMP) (("" (REWRITE "ks_comp") (("" (REWRITE "base_ks_comp") (("" (BETA) (("" (REWRITE "ks_valid_key_pred") (("" (SKOSIMP) (("" (HIDE 1) (("" (EXPAND "initial_ks_states") (("" (INST?) (("" (FLATTEN) (("" (REPLACE -1) (("" (EXPAND "emptyset") (("" (PROPAX) NIL))))))))))))))))))))))))))) (|ks_valid_key_prop2| "" (EXPAND "steps_satisfy") (("" (SKOSIMP) (("" (EXPAND "stable") (("" (FLATTEN) (("" (EXPAND "ks_valid_key_pred") (("" (SKOSIMP*) (("" (INST -2 "thread!1" "handle!1") (("" (EXPAND "ks_comp") (("" (EXPAND "base_ks_comp") (("" (SPLIT -1) (("1" (EXPAND "ks_guar") (("1" (FLATTEN) (("1" (SPLIT -2) (("1" (EXPAND "ks_view") (("1" (REPLACE -1) (("1" (SPLIT -3) (("1" (PROPAX) NIL) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL))))))) ("2" (FLATTEN) (("2" (CASE "key_handle_inv(st1!1,st2!1)") (("1" (EXPAND "key_handle_inv") (("1" (EXPAND "ks_step") (("1" (FLATTEN) (("1" (EXPAND "ks_static") (("1" (SKOSIMP*) (("1" (INST -1 "thread!1") (("1" (INST -5 "thread!1") (("1" (FLATTEN) (("1" (REPLACE -2) (("1" (INST -3 "thread!1") (("1" (FLATTEN) (("1" (REPLACE -1) (("1" (REPLACE -4) (("1" (SPLIT -10) (("1" (PROPAX) NIL) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL))))))))))))))))))))))))))))) ("2" (EXPAND "ks_op") (("2" (SPLIT -2) (("1" (EXPAND "ks_receive_request") (("1" (FLATTEN) (("1" (REPLACE -1) (("1" (GROUND) NIL))))))) ("2" (EXPAND "ks_init_key_retrieval") (("2" (SKOSIMP) (("2" (EXPAND "assign_key") (("2" (EXPAND "new_handle") (("2" (FLATTEN) (("2" (EXPAND "ks_step") (("2" (EXPAND "ks_static") (("2" (FLATTEN) (("2" (INST -12 "thread!1") (("2" (FLATTEN) (("2" (REPLACE -13) (("2" (INST -16 "thread!1") (("2" (HIDE -1 -2 -3 -4 -12 -14 -15 1) (("2" (SPLIT -9) (("1" (REPLACE -1) (("1" (SPLIT -11) (("1" (PROPAX) NIL) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL))))) ("2" (REPLACE -1) (("2" (REPLACE -7) (("2" (REPLACE -5) (("2" (EXPAND "add") (("2" (SPLIT -13) (("1" (REPLACE -1) (("1" (BETA) (("1" (INST?) NIL))))) ("2" (EXPAND "member") (("2" (SPLIT -12) (("1" (CASE "handle!1 = handle!2") (("1" (REPLACE -1) (("1" (BETA) (("1" (SKOLEM!) (("1" (INST?) NIL))))))) ("2" (SKOLEM!) (("2" (INST?) (("2" (REPLACE -1 :DIR RL) (("2" (GROUND) NIL))))))))) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))) ("3" (EXPAND "ks_retrieve_key") (("3" (SKOSIMP) NIL))))))))))))))))) ("2" (EXPAND "ks_rely") (("2" (FLATTEN) (("2" (EXPAND "ks_environment") (("2" (FLATTEN) (("2" (REPLACE -2 :DIR RL) (("2" (BETA) (("2" (SPLIT -3) (("1" (PROPAX) NIL) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL))))))))))))))))))))))))))))))))))) (|ks_valid_key_prop| "" (REWRITE "inv1") (("1" (REWRITE "ks_valid_key_prop1") NIL) ("2" (REWRITE "ks_valid_key_prop2") NIL))) (|ks_provide_key_pred_TCC1| "" (SKOSIMP) NIL) (|ks_provide_key_pred_TCC2| "" (SUBTYPE-TCC) NIL) (|ks_provide_key_prop1| "" (EXPAND "ks_comp") (("" (EXPAND "base_ks_comp") (("" (EXPAND "init_satisfies") (("" (SKOSIMP) (("" (EXPAND "initial_ks_states") (("" (EXPAND "ks_provide_key_pred") (("" (SKOSIMP) (("" (INST -1 "thread!1") (("" (FLATTEN) (("" (REPLACE -3) (("" (EXPAND "emptyset") (("" (PROPAX) NIL))))))))))))))))))))))) (|ks_provide_key_prop2| "" (EXPAND "ks_comp") (("" (EXPAND "base_ks_comp") (("" (EXPAND "steps_satisfy") (("" (SKOSIMP) (("" (EXPAND "stable") (("" (FLATTEN) (("" (SPLIT) (("1" (EXPAND "ks_state_step") (("1" (FLATTEN) (("1" (EXPAND "ks_provide_key_pred") (("1" (SKOSIMP) (("1" (EXPAND "ks_op") (("1" (CASE "(FORALL (kreq : KERNEL_REQ): (send_message_req?(kreq) AND smop(kreq) = provide_key_op AND pending_requests(kst(st2!1))(kreq)) IMPLIES pending_requests(kst(st1!1))(kreq))" "key_handle_inv(st1!1, st2!1)") (("1" (EXPAND "key_handle_inv") (("1" (INST -1 "thread!1") (("1" (INST? -2) (("1" (FLATTEN) (("1" (REPLACE -1) (("1" (REPLACE -2) (("1" (REPLACE -10 -3) (("1" (BETA) (("1" (SIMPLIFY) (("1" (REPLACE -10 -3 :DIR RL) (("1" (SPLIT -3) (("1" (INST? -7) (("1" (GROUND) NIL))) ("2" (PROPAX) NIL))))))))))))))))))))))) ("2" (EXPAND "ks_receive_request") (("2" (SPLIT -4) (("1" (FLATTEN) (("1" (PROPAX) NIL))) ("2" (INST -2 "kernel_req!1") (("2" (REPLACE -8 -2) (("2" (SIMPLIFY) (("2" (REPLACE -8 -2 :DIR RL) (("2" (GROUND) (("2" (INST? -5) (("2" (GROUND) (("2" (EXPAND "ks_init_key_retrieval") (("2" (SKOLEM! -1) (("2" (FLATTEN) (("2" (SKOLEM! -4) (("2" (FLATTEN) (("2" (INST 2 "handle!1") (("2" (SPLIT) (("1" (EXPAND "new_handle") (("1" (FLATTEN) (("1" (EXPAND "ks_step") (("1" (FLATTEN) (("1" (INST -16 "thread!1") (("1" (SPLIT -16) (("1" (REPLACE -1) (("1" (PROPAX) NIL))) ("2" (REPLACE -1) (("2" (REPLACE -12) (("2" (EXPAND "add") (("2" (FLATTEN) (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))) ("2" (EXPAND "assign_key") (("2" (FLATTEN) (("2" (EXPAND "ks_step") (("2" (FLATTEN) (("2" (INST -16 "thread!1") (("2" (SPLIT -16) (("1" (REPLACE -1) (("1" (PROPAX) NIL))) ("2" (REPLACE -1) (("2" (REPLACE -13) (("2" (TYPEPRED "thst(st1!1)(ag!1)") (("2" (LIFT-IF) (("2" (SPLIT) (("1" (FLATTEN) (("1" (REPLACE -1) (("1" (EXPAND "KS_THREAD_STATE") (("1" (FLATTEN) (("1" (EXPAND "disjoint?") (("1" (EXPAND "empty?") (("1" (EXPAND "intersection") (("1" (EXPAND "member") (("1" (INST -2 "handle!1") (("1" (SPLIT 2) (("1" (PROPAX) NIL) ("2" (PROPAX) NIL))))))))))))))))))))) ("2" (FLATTEN) (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))) ("3" (EXPAND "ks_retrieve_key") (("3" (SKOLEM!) (("3" (FLATTEN) (("3" (PROPAX) NIL))))))))))) ("3" (SPLIT -3) (("1" (EXPAND "ks_receive_request") (("1" (FLATTEN) (("1" (EXPAND "ks_receive_request_submit") (("1" (SKOSIMP) (("1" (EXPAND "receive_msg") (("1" (FLATTEN) (("1" (SKOSIMP) (("1" (REPLACE -10 -13) (("1" (EXPAND "add") (("1" (SPLIT -13) (("1" (REPLACE -1 :DIR RL) (("1" (BETA) (("1" (PROPAX) NIL))))) ("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))) ("2" (EXPAND "ks_init_key_retrieval") (("2" (SKOSIMP) (("2" (EXPAND "send_msg") (("2" (FLATTEN) (("2" (SKOSIMP) (("2" (REPLACE -14 -17) (("2" (EXPAND "add" -17) (("2" (SPLIT -17) (("1" (REPLACE -1 -17 :DIR RL) (("1" (BETA) (("1" (LEMMA "ks_provide_ops_distinct") (("1" (GROUND) NIL))))))) ("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))) ("3" (EXPAND "ks_retrieve_key") (("3" (SKOSIMP) (("3" (EXPAND "key_handle_inv") (("3" (INST -6 "ag!1") (("3" (EXPAND "send_msg") (("3" (FLATTEN) (("3" (EXPAND "add") (("3" (HIDE 1) (("3" (REPLACE -14) (("3" (HIDE -14) (("3" (EXPAND "member") (("3" (SPLIT -18) (("1" (REPLACE -19 -1) (("1" (LEMMA "KERNEL_REQ_smth_send_message_req") (("1" (INST-CP -1 "ag!1" "reply_port!2" "provide_key_op" "null_name" "provide_key_msg(key!2)") (("1" (REPLACE -3 -2) (("1" (BETA) (("1" (HIDE -1) (("1" (REPLACE -1) (("1" (REPLACE -8) (("1" (REPLACE -9) (("1" (INST 1 "service_port(ri!1)") (("1" (LEMMA "KERNEL_REQ_smusr_msg_send_message_req") (("1" (INST -1 "ag!1" "reply_port!2" "provide_key_op" "null_name" "provide_key_msg(key!2)") (("1" (REPLACE -3 -1) (("1" (BETA) (("1" (EXPAND "provide_key_msg") (("1" (EXPAND "null_user_msg") (("1" (GROUND) (("1" (CASE "user_data((# user_data := null_data, user_rights := null_seq:FSEQ[USER_RIGHT] #) WITH [(user_data) := key_to_data(key!1)]) = key_to_data(key!1)") (("1" (REPLACE -2) (("1" (BETA) (("1" (REWRITE "key_to_data_inj") NIL))))) ("2" (BETA) (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))) ("2" (INST -17 "kernel_req!1" "thread!1" "to!1" "reply_port!1" "key!1") (("2" (GROUND) (("2" (EXPAND "ks_step") (("2" (FLATTEN) (("2" (INST -18 "thread!1") (("2" (GROUND) (("1" (REPLACE -1) (("1" (PROPAX) NIL))) ("2" (REPLACE -1) (("2" (REPLACE -9) (("2" (REPLACE -10) (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))) ("2" (EXPAND "ks_env_step") (("2" (FLATTEN) (("2" (EXPAND "ks_environment") (("2" (FLATTEN) (("2" (EXPAND "environment_base") (("2" (FLATTEN) (("2" (EXPAND "pending_requests_rely") (("2" (EXPAND "ks_provide_key_pred") (("2" (SKOSIMP) (("2" (INST?) (("2" (INST?) (("2" (FLATTEN) (("2" (SPLIT -4) (("1" (SPLIT -6) (("1" (REPLACE -6 :DIR RL) (("1" (BETA) (("1" (PROPAX) NIL))))) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL) ("4" (PROPAX) NIL))) ("2" (PROPAX) NIL))))))))))))))))))))))))))) ("3" (EXPAND "ks_view") (("3" (REPLACE -1) (("3" (PROPAX) NIL))))))))))))))))))) (|ks_provide_key_prop| "" (REWRITE "inv1") (("1" (REWRITE "ks_provide_key_prop1") NIL) ("2" (REWRITE "ks_provide_key_prop2") NIL))) (|ks_provide_valid_key_prop| "" (LEMMA "ks_provide_key_prop") (("" (LEMMA "ks_valid_key_prop") (("" (LEMMA "always_and") (("" (INST?) (("" (INST -1 "alwayss(ks_provide_key_pred)") (("" (IFF) (("" (FLATTEN) (("" (HIDE -2) (("" (SPLIT) (("1" (HIDE -2 -3) (("1" (REWRITE "inv6") (("1" (LEMMA "always_simplies") (("1" (INST -1 "ks_comp" "sand(ks_valid_key_pred, ks_provide_key_pred)" "ks_provide_valid_key_pred") (("1" (GROUND) (("1" (SKOLEM!) (("1" (EXPAND "simplies") (("1" (EXPAND "sand") (("1" (HIDE -1 2) (("1" (FLATTEN) (("1" (EXPAND "ks_valid_key_pred") (("1" (EXPAND "ks_provide_valid_key_pred") (("1" (EXPAND "ks_provide_key_pred") (("1" (SKOSIMP) (("1" (INST?) (("1" (INST? -2) (("1" (GROUND) (("1" (SKOSIMP) (("1" (INST?) (("1" (GROUND) NIL))))))))))))))))))))))))))))))))))))))) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL)))))))))))))))))))) $$$preds.pvs preds[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING cprops[ST, AG] STATE_PRED: TYPE = setof[ST] sp, sp1, sp2: VAR STATE_PRED cmp: VAR (comp_t[ST, AG]) st, st1, st2: VAR ST ag: VAR AG init_satisfies(cmp, sp): bool = (FORALL st: init(cmp)(st) IMPLIES sp(st)) ACTION_PRED: TYPE = setof[[ST, ST, AG]] ap, ap1, ap2: VAR ACTION_PRED steps_satisfy(cmp, ap): bool = (FORALL st1, st2, ag: (guar(cmp)(st1, st2, ag) OR rely(cmp)(st1, st2, ag)) IMPLIES ap(st1, st2, ag)) stable(sp): ACTION_PRED = (LAMBDA st1, st2, ag: sp(st1) IMPLIES sp(st2)) t: VAR trace_t p: VAR prop_t i, j: VAR nat shift(i, t): trace_t = (# sts := (LAMBDA j: sts(t)(i + j)), ags := (LAMBDA j: ags(t)(i + j)) #) always(p): prop_t = (LAMBDA t: (FORALL i: p(shift(i, t)))) eventually(p): prop_t = (LAMBDA t: (EXISTS i: p(shift(i, t)))) stbp(sp): prop_t = (LAMBDA t: sp(sts(t)(0))) atbp(ap): prop_t = (LAMBDA t: ap(sts(t)(0), sts(t)(1), ags(t)(0))) alwayss(sp): prop_t = always(stbp(sp)) eventuallys(sp): prop_t = eventually(stbp(sp)) alwayss_prop: THEOREM alwayss(sp) = (LAMBDA t: (FORALL i: sp(sts(t)(i)))) eventuallys_prop: THEOREM eventuallys(sp) = (LAMBDA t: (EXISTS i: sp(sts(t)(i)))) alwaysa(ap): prop_t = always(atbp(ap)) eventuallya(ap): prop_t = eventually(atbp(ap)) alwaysa_prop: THEOREM alwaysa(ap) = (LAMBDA t: (FORALL i: ap(sts(t)(i), sts(t)(i + 1), ags(t)(i)))) eventuallya_prop: THEOREM eventuallya(ap) = (LAMBDA t: (EXISTS i: ap(sts(t)(i), sts(t)(i + 1), ags(t)(i)))) inv1: THEOREM init_satisfies(cmp, sp) AND steps_satisfy(cmp, stable(sp)) IMPLIES satisfies(cmp, alwayss(sp)) inv2: THEOREM steps_satisfy(cmp, ap) IMPLIES satisfies(cmp, alwaysa(ap)) aandas(ap, sp): ACTION_PRED = (LAMBDA st1, st2, ag: ap(st1, st2, ag) AND sp(st1)) inv3: THEOREM intersection(alwaysa(ap), alwayss(sp)) = alwaysa(aandas(ap, sp)) inv4: THEOREM intersection(alwayss(sp), alwaysa(ap)) = alwaysa(aandas(ap, sp)) aand(ap1, ap2): ACTION_PRED = (LAMBDA st1, st2, ag: ap1(st1, st2, ag) AND ap2(st1, st2, ag)) aimplies(ap1, ap2): ACTION_PRED = (LAMBDA st1, st2, ag: ap1(st1, st2, ag) IMPLIES ap2(st1, st2, ag)) inv5: THEOREM intersection(alwaysa(ap1), alwaysa(ap2)) = alwaysa(aand(ap1, ap2)) sand(sp1, sp2): STATE_PRED = (LAMBDA st: sp1(st) AND sp2(st)) sor(sp1, sp2): STATE_PRED = (LAMBDA st: sp1(st) OR sp2(st)) simplies(sp1, sp2): STATE_PRED = (LAMBDA st: sp1(st) IMPLIES sp2(st)) inv6: THEOREM intersection(alwayss(sp1), alwayss(sp2)) = alwayss(sand(sp1, sp2)) p1, p2: VAR prop_t always_and: THEOREM (satisfies(cmp, p1) AND satisfies(cmp, p2)) = satisfies(cmp, intersection(p1, p2)) always_aimplies: THEOREM satisfies(cmp, alwaysa(ap1)) AND (FORALL st1, st2, ag: aimplies(ap1, ap2)(st1, st2, ag)) IMPLIES satisfies(cmp, alwaysa(ap2)) END preds $$$preds.prf (|preds| (|alwayss_prop| "" (SKOLEM!) (("" (EXTENSIONALITY "prop_t") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (EXPAND "alwayss") (("" (EXPAND "always") (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (PROPAX) NIL))))))))))))))))))))) (|eventuallys_prop| "" (SKOSIMP*) (("" (EXTENSIONALITY "prop_t") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (EXPAND "eventuallys") (("" (EXPAND "eventually") (("" (EXPAND "shift") (("" (EXPAND "stbp") (("" (PROPAX) NIL))))))))))))))))))))) (|alwaysa_prop| "" (SKOLEM!) (("" (EXPAND "alwaysa") (("" (EXPAND "always") (("" (EXPAND "atbp") (("" (EXPAND "shift") (("" (PROPAX) NIL))))))))))) (|eventuallya_prop| "" (SKOSIMP*) (("" (EXTENSIONALITY "prop_t") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (EXPAND "eventuallya") (("" (EXPAND "eventually") (("" (EXPAND "atbp") (("" (EXPAND "shift") (("" (PROPAX) NIL))))))))))))))))))))) (|inv1| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "alwayss") (("" (EXPAND "always") (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (INDUCT "i") (("1" (EXPAND "init_satisfies") (("1" (INST?) (("1" (GROUND) (("1" (EXPAND "prop_for") (("1" (EXPAND "initial_okay") (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))))) ("2" (SKOLEM!) (("2" (FLATTEN) (("2" (EXPAND "steps_satisfy") (("2" (EXPAND "stable") (("2" (INSTANTIATE -3 ("sts(t!1)(j!1)" "sts(t!1)(j!1+1)" "ags(t!1)(j!1)")) (("2" (EXPAND "prop_for") (("2" (FLATTEN) (("2" (EXPAND "steps_okay") (("2" (INSTANTIATE -5 "j!1") (("2" (EXPAND "steps") (("2" (EXPAND "union") (("2" (EXPAND "member") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))) (|inv2| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "alwaysa") (("" (EXPAND "always") (("" (EXPAND "atbp") (("" (EXPAND "shift") (("" (SKOLEM!) (("" (EXPAND "prop_for") (("" (EXPAND "steps_okay") (("" (FLATTEN) (("" (EXPAND "member") (("" (INST?) (("" (EXPAND "steps") (("" (EXPAND "steps_satisfy") (("" (EXPAND "union") (("" (EXPAND "member") (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))) (|inv3| "" (SKOLEM!) (("" (EXTENSIONALITY "prop_t") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "alwaysa") (("" (EXPAND "alwayss") (("" (EXPAND "always") (("" (EXPAND "atbp") (("" (EXPAND "shift") (("" (EXPAND "stbp") (("" (EXPAND "aandas") (("" (GROUND) (("1" (SKOLEM!) (("1" (INST?) (("1" (INST?) (("1" (GROUND) NIL))))))) ("2" (SKOLEM!) (("2" (INST?) (("2" (GROUND) NIL))))) ("3" (SKOLEM!) (("3" (INST?) (("3" (GROUND) NIL))))))))))))))))))))))))))))))))))))))) (|inv4| "" (SKOLEM!) (("" (EXTENSIONALITY "prop_t") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "alwaysa") (("" (EXPAND "alwayss") (("" (EXPAND "stbp") (("" (EXPAND "atbp") (("" (EXPAND "always") (("" (EXPAND "shift") (("" (EXPAND "aandas") (("" (SPLIT) (("1" (FLATTEN) (("1" (SKOLEM!) (("1" (INST?) (("1" (INST?) (("1" (GROUND) NIL))))))))) ("2" (FLATTEN) (("2" (SPLIT) (("1" (SKOLEM!) (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (SKOLEM!) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))) (|inv5| "" (SKOLEM!) (("" (EXTENSIONALITY "prop_t") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "intersection") (("" (EXPAND "alwaysa") (("" (EXPAND "member") (("" (EXPAND "always") (("" (EXPAND "atbp") (("" (EXPAND "shift") (("" (EXPAND "aand") (("" (GROUND) (("1" (SKOLEM!) (("1" (INST?) (("1" (INST?) (("1" (GROUND) NIL))))))) ("2" (SKOLEM!) (("2" (INST?) (("2" (GROUND) NIL))))) ("3" (SKOLEM!) (("3" (INST?) (("3" (GROUND) NIL))))))))))))))))))))))))))))))))))) (|inv6| "" (SKOLEM!) (("" (EXTENSIONALITY "prop_t") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "alwayss") (("" (EXPAND "always") (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (EXPAND "sand") (("" (GROUND) (("1" (SKOLEM!) (("1" (INST?) (("1" (INST?) (("1" (GROUND) NIL))))))) ("2" (SKOLEM!) (("2" (INST?) (("2" (GROUND) NIL))))) ("3" (SKOLEM!) (("3" (INST?) (("3" (GROUND) NIL))))))))))))))))))))))))))))))))))) (|always_and| "" (SKOLEM!) (("" (EXPAND "satisfies") (("" (IFF) (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (GROUND) (("1" (SKOLEM!) (("1" (INST?) (("1" (INST?) (("1" (GROUND) NIL))))))) ("2" (SKOLEM!) (("2" (INST?) (("2" (GROUND) NIL))))) ("3" (SKOLEM!) (("3" (INST?) (("3" (GROUND) NIL))))))))))))))))) (|always_aimplies| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (INST?) (("" (GROUND) (("" (EXPAND "alwaysa") (("" (EXPAND "always") (("" (EXPAND "atbp") (("" (SKOLEM!) (("" (INST?) (("" (EXPAND "aimplies") (("" (INST?) (("" (GROUND) NIL)))))))))))))))))))))))))))) $$$unity.pvs unity[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING preds[ST, AG] sp, sp1, sp2, sp3: VAR STATE_PRED cmp: VAR (comp_t) st, st1, st2: VAR ST ag: VAR AG tranc: VAR TRANSITION_CLASS t: VAR trace_t p1, p2: VAR prop_t pimplies(p1, p2): prop_t = (LAMBDA t: member(t, p1) IMPLIES member(t, p2)) por(p1, p2): prop_t = (LAMBDA t: member(t, p1) OR member(t, p2)) negate_sp(sp): STATE_PRED = (LAMBDA st: NOT sp(st)) unless_pred(sp1, sp2): ACTION_PRED = (LAMBDA st1, st2, ag: sand(sp1, negate_sp(sp2))(st1) IMPLIES sor(sp1, sp2)(st2)) unless(cmp, sp1, sp2): bool = satisfies(cmp, alwaysa(unless_pred(sp1, sp2))) unless_help: THEOREM steps_satisfy(cmp, unless_pred(sp1, sp2)) IMPLIES unless(cmp, sp1, sp2) i, j, k, l, m: VAR nat ip: VAR [nat -> bool] ip_help: THEOREM ip(m) AND (FORALL i: (FORALL j: m <= j AND j < i IMPLIES ip(j)) IMPLIES ip(i)) IMPLIES (FORALL k: (FORALL l: m <= l AND l <= k IMPLIES ip(l))) ip_help1: THEOREM ip(m) AND (FORALL i: (FORALL j: m <= j AND j < i IMPLIES ip(j)) IMPLIES ip(i)) IMPLIES (FORALL k: m <= k IMPLIES ip(k)) unless_prop1: THEOREM unless(cmp, sp1, sp2) IMPLIES satisfies(cmp, always(pimplies(stbp(sp1), por(alwayss(sp1), eventuallys(sp2))))) unless_prop2: THEOREM unless(cmp, sp1, sp2) AND prop_for(cmp)(t) AND sp1(sts(t)(i)) IMPLIES ((FORALL j: sp1(sts(t)(i + j))) OR (EXISTS k: sp2(sts(t)(i + k)) AND (FORALL l: l < k IMPLIES sp1(sts(t)(i + l))))) ensuresb(cmp, sp1, sp2, tranc): bool = unless(cmp, sp1, sp2) AND member(tranc, sfar(cmp)) AND (FORALL st1, st2, ag: (member((st1, st2, ag), tranc) AND sp1(st1) AND NOT sp2(st1)) IMPLIES sp2(st2)) ensures(cmp, sp1, sp2): bool = unless(cmp, sp1, sp2) AND (EXISTS tranc: ensuresb(cmp, sp1, sp2, tranc)) wensuresb(cmp, sp1, sp2, tranc): bool = unless(cmp, sp1, sp2) AND member(tranc, wfar(cmp)) AND (FORALL st1, st2, ag: (member((st1, st2, ag), tranc) AND sp1(st1) AND NOT sp2(st1)) IMPLIES sp2(st2)) wensures(cmp, sp1, sp2): bool = unless(cmp, sp1, sp2) AND (EXISTS tranc: wensuresb(cmp, sp1, sp2, tranc)) enabled_sp(tranc): STATE_PRED = (LAMBDA st: enabled(tranc, st)) leads_to(cmp, sp1, sp2): bool = satisfies(cmp, always(pimplies(stbp(sp1), eventuallys(sp2)))) leads_to1: THEOREM ensuresb(cmp, sp1, sp2, tranc) AND leads_to(cmp, sp1, enabled_sp(tranc)) IMPLIES leads_to(cmp, sp1, sp2) leads_to1w: THEOREM wensuresb(cmp, sand(enabled_sp(tranc), sp1), sp2, tranc) IMPLIES leads_to(cmp, sand(enabled_sp(tranc), sp1), sp2) leads_to_2: THEOREM (FORALL st: simplies(sp1, sp2)(st)) AND leads_to(cmp, sp2, sp) IMPLIES leads_to(cmp, sp1, sp) leads_to_3: THEOREM (FORALL st: simplies(sp1, sp2)(st)) AND leads_to(cmp, sp, sp1) IMPLIES leads_to(cmp, sp, sp2) leads_to_or: THEOREM leads_to(cmp, sp1, sp) AND leads_to(cmp, sp2, sp) IMPLIES leads_to(cmp, sor(sp1, sp2), sp) leads_to_tran: THEOREM leads_to(cmp, sp, sp1) AND leads_to(cmp, sp1, sp2) IMPLIES leads_to(cmp, sp, sp2) true_sp(st): bool = TRUE leads_to_true: THEOREM leads_to(cmp, true_sp, sp) IMPLIES satisfies(cmp, always(eventuallys(sp))) leads_to_stable: THEOREM leads_to(cmp, true_sp, sp) AND steps_satisfy(cmp, stable(sp)) IMPLIES satisfies(cmp, eventually(alwayss(sp))) leads_to_invariant: THEOREM leads_to(cmp, sp1, sp) AND satisfies(cmp, alwayss(sp2)) IMPLIES leads_to(cmp, sand(sp1, sp2), sp) AND leads_to(cmp, sp1, sand(sp, sp2)) AND leads_to(cmp, sand(sp1, sp2), sand(sp, sp2)) leads_to_invariant1: THEOREM leads_to(cmp, sp1, sp) AND satisfies(cmp, alwayss(sp2)) IMPLIES ((FORALL st: simplies(sand(sp3, sp2), sp1)(st)) IMPLIES leads_to(cmp, sp3, sp)) END unity $$$unity.prf (|unity| (|unless_help| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "unless") (("" (REWRITE "inv2") NIL))))))) (|ip_help| "" (SKOLEM!) (("" (FLATTEN) (("" (INDUCT "k") (("1" (SKOLEM!) (("1" (GROUND) NIL))) ("2" (SKOLEM!) (("2" (FLATTEN) (("2" (SKOLEM!) (("2" (FLATTEN) (("2" (CASE "l!1 = j!1+1") (("1" (INSTANTIATE -6 "l!1") (("1" (GROUND) (("1" (SKOLEM!) (("1" (INSTANTIATE -2 "j!2") (("1" (GROUND) NIL))))))))) ("2" (INSTANTIATE -5 "l!1") (("2" (GROUND) (("2" (SKOLEM!) (("2" (INSTANTIATE -1 "j!2") (("2" (GROUND) NIL))))))))))))))))))))))))) (|ip_help1| "" (SKOLEM!) (("" (LEMMA "ip_help") (("" (INST?) (("" (GROUND) (("" (SKOLEM!) (("" (INSTANTIATE -1 "k!1") (("" (INSTANTIATE -1 "k!1") (("" (GROUND) NIL))))))))))))))) (|unless_prop1| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (EXPAND "unless") (("" (EXPAND "satisfies") (("" (INST?) (("" (GROUND) (("" (EXPAND "always") (("" (SKOLEM!) (("" (EXPAND "pimplies") (("" (FLATTEN) (("" (EXPAND "member") (("" (EXPAND "por") (("" (EXPAND "member") (("" (EXPAND "alwayss") (("" (EXPAND "eventuallys") (("" (EXPAND "always") (("" (EXPAND "eventually") (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (LEMMA "ip_help1") (("" (INSTANTIATE -1 ("(LAMBDA l: sp1!1(sts(t!1)(l+i!1)))" "0")) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (FLATTEN) (("" (CASE "i!2 = 0") (("1" (GROUND) NIL) ("2" (CASE "not i!2 > 0") (("1" (GROUND) NIL) ("2" (CASE "not i!2-1 >= 0") (("1" (GROUND) NIL) ("2" (INSTANTIATE 3 "i!2-1" T) (("1" (INSTANTIATE 3 "i!2") (("1" (INSTANTIATE -3 "i!2-1") (("1" (GROUND) (("1" (EXPAND "alwaysa") (("1" (EXPAND "always") (("1" (EXPAND "atbp") (("1" (EXPAND "unless_pred") (("1" (EXPAND "sand") (("1" (EXPAND "negate_sp") (("1" (EXPAND "sor") (("1" (EXPAND "shift") (("1" (INSTANTIATE -4 "i!1+i!2-1") (("1" (GROUND) NIL))))))))))))))))))))) ("2" (PROPAX) NIL))))) ("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|unless_prop2| "" (SKOLEM!) (("" (FLATTEN) (("" (LEMMA "ip_help1") (("" (SKOLEM!) (("" (INSTANTIATE -1 ("(LAMBDA i: sp1!1(sts(t!1)(i+i!1)))" "0")) (("" (GROUND) (("1" (INSTANTIATE -1 "j!1") (("1" (GROUND) NIL))) ("2" (SKOLEM!) (("2" (FLATTEN) (("2" (CASE "i!2 = 0") (("1" (GROUND) NIL) ("2" (CASE "not i!2-1 >= 0") (("1" (GROUND) NIL) ("2" (INSTANTIATE 4 "i!2-1" T) (("1" (INSTANTIATE 4 "i!2") (("1" (INSTANTIATE -2 "i!2-1" T) (("1" (EXPAND "unless") (("1" (EXPAND "satisfies") (("1" (INSTANTIATE -4 "t!1") (("1" (EXPAND "alwaysa") (("1" (EXPAND "always") (("1" (EXPAND "atbp") (("1" (EXPAND "unless_pred") (("1" (EXPAND "sand") (("1" (EXPAND "negate_sp") (("1" (EXPAND "sor") (("1" (EXPAND "shift") (("1" (INSTANTIATE -4 "i!2+i!1-1") (("1" (GROUND) (("1" (SKOLEM!) (("1" (INSTANTIATE -4 "l!1") (("1" (GROUND) NIL))))))) ("2" (GROUND) NIL))))))))))))))))))))))))) ("2" (PROPAX) NIL))))) ("2" (PROPAX) NIL))))))))))))))))))))))) (|leads_to1| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "ensuresb") (("" (FLATTEN) (("" (LEMMA "unless_prop2") (("" (INST?) (("" (GROUND) (("" (EXPAND "leads_to") (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (INST?) (("" (INST?) (("" (GROUND) (("" (EXPAND "always") (("" (SKOLEM!) (("" (EXPAND "pimplies") (("" (EXPAND "member") (("" (FLATTEN) (("" (EXPAND "eventuallys") (("" (EXPAND "eventually") (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (INSTANTIATE -2 "i!1") (("" (GROUND) (("1" (CASE "not (exists k : k >= i!1 and member((sts(t!1)(k),sts(t!1)(k+1),ags(t!1)(k)),tranc!1))") (("1" (EXPAND "prop_for") (("1" (FLATTEN) (("1" (EXPAND "is_sfar") (("1" (INSTANTIATE -9 "tranc!1") (("1" (GROUND) (("1" (INSTANTIATE -1 "i!1") (("1" (SKOLEM!) (("1" (FLATTEN) (("1" (SPLIT) (("1" (INSTANTIATE -4 "j!1") (("1" (INSTANTIATE -3 "j!1-i!1") (("1" (GROUND) (("1" (SKOLEM!) (("1" (INSTANTIATE -2 "i!2+j!1") (("1" (GROUND) (("1" (EXPAND "enabled_sp") (("1" (PROPAX) NIL))))))))))) ("2" (GROUND) NIL))))) ("2" (SKOLEM!) (("2" (INSTANTIATE 1 "l!1") (("2" (GROUND) NIL))))))))))))))))))))))) ("2" (SKOLEM!) (("2" (FLATTEN) (("2" (INSTANTIATE -7 ("sts(t!1)(k!1)" "sts(t!1)(k!1+1)" "ags(t!1)(k!1)")) (("2" (EXPAND "member") (("2" (INSTANTIATE -3 "k!1-i!1") (("1" (INSTANTIATE 1 "k!1-i!1" T) (("1" (INSTANTIATE 1 "k!1-i!1+1") (("1" (GROUND) NIL) ("2" (GROUND) NIL))) ("2" (GROUND) NIL))) ("2" (GROUND) NIL))))))))))))) ("2" (SKOLEM!) (("2" (INSTANTIATE 1 "k!1") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))) (|leads_to1w| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "wensuresb") (("" (FLATTEN) (("" (EXPAND "leads_to") (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (FLATTEN) (("" (LEMMA "unless_prop2") (("" (INST?) (("" (INST?) (("" (EXPAND "always") (("" (SKOLEM!) (("" (INSTANTIATE -1 "i!1") (("" (EXPAND "pimplies") (("" (EXPAND "member") (("" (FLATTEN) (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (EXPAND "eventuallys") (("" (EXPAND "eventually") (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (GROUND) (("1" (CASE "not (exists k: k >= i!1 and member((sts(t!1)(k),sts(t!1)(k+1),ags(t!1)(k)),tranc!1))") (("1" (EXPAND "prop_for") (("1" (FLATTEN) (("1" (EXPAND "is_wfar") (("1" (INSTANTIATE -7 "tranc!1") (("1" (EXPAND "member") (("1" (GROUND) (("1" (INSTANTIATE -7 "i!1") (("1" (SKOLEM!) (("1" (INSTANTIATE 1 "j!1") (("1" (INSTANTIATE -1 "j!1-i!1") (("1" (GROUND) (("1" (EXPAND "sand") (("1" (EXPAND "enabled_sp") (("1" (PROPAX) NIL))))))) ("2" (GROUND) NIL))))))))))))))))))))) ("2" (SKOLEM!) (("2" (INSTANTIATE -5 ("sts(t!1)(k!1)" "sts(t!1)(k!1+1)" "ags(t!1)(k!1)")) (("2" (EXPAND "member") (("2" (INSTANTIATE -2 "k!1-i!1") (("1" (INSTANTIATE 1 "k!1-i!1" T) (("1" (INSTANTIATE 1 "k!1-i!1+1") (("1" (GROUND) NIL) ("2" (GROUND) NIL))) ("2" (GROUND) NIL))) ("2" (GROUND) NIL))))))))))) ("2" (SKOLEM!) (("2" (INSTANTIATE 1 "k!1") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))) (|leads_to_2| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "leads_to") (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (INST?) (("" (GROUND) (("" (EXPAND "always") (("" (SKOLEM!) (("" (INST?) (("" (EXPAND "pimplies") (("" (EXPAND "stbp") (("" (EXPAND "member") (("" (EXPAND "eventuallys") (("" (EXPAND "eventually") (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (FLATTEN) (("" (INST?) (("" (EXPAND "simplies") (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))) (|leads_to_3| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "leads_to") (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (INST?) (("" (GROUND) (("" (EXPAND "always") (("" (SKOLEM!) (("" (INST?) (("" (EXPAND "pimplies") (("" (GROUND) (("" (EXPAND "member") (("" (EXPAND "eventuallys") (("" (EXPAND "eventually") (("" (SKOLEM!) (("" (INST?) (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (INST?) (("" (EXPAND "simplies") (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))) (|leads_to_or| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "leads_to") (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (INST?) (("" (INST?) (("" (GROUND) (("" (EXPAND "always") (("" (SKOLEM!) (("" (INST?) (("" (INST?) (("" (EXPAND "pimplies") (("" (EXPAND "member") (("" (EXPAND "stbp") (("" (EXPAND "sor") (("" (FLATTEN) (("" (EXPAND "eventuallys") (("" (EXPAND "eventually") (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (SPLIT -4) (("1" (DELETE -2) (("1" (GROUND) NIL))) ("2" (DELETE -3) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))) (|leads_to_tran| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "leads_to") (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (INST?) (("" (INST?) (("" (GROUND) (("" (EXPAND "always") (("" (SKOLEM!) (("" (INSTANTIATE -2 "i!1") (("" (EXPAND "pimplies") (("" (GROUND) (("" (EXPAND "member") (("" (EXPAND "eventuallys") (("" (EXPAND "eventually") (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (SKOLEM!) (("" (INSTANTIATE -2 "i!2+i!1") (("" (GROUND) (("" (SKOLEM!) (("" (INSTANTIATE 1 "i!2+i!3") (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))) (|leads_to_true| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "leads_to") (("" (CASE "not always(eventuallys(sp!1)) = always(pimplies(stbp(true_sp), eventuallys(sp!1)))") (("1" (DELETE -1 2) (("1" (EXTENSIONALITY "prop_t") (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "always") (("1" (EXPAND "pimplies") (("1" (EXPAND "member") (("1" (EXPAND "stbp") (("1" (EXPAND "true_sp") (("1" (PROPAX) NIL))))))))))))))))))))))))) ("2" (REPLACE -1) (("2" (PROPAX) NIL))))))))))) (|leads_to_stable| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "eventually") (("" (LEMMA "leads_to_true") (("" (INST?) (("" (GROUND) (("" (EXPAND "satisfies") (("" (INST?) (("" (GROUND) (("" (EXPAND "always") (("" (INSTANTIATE -1 "0") (("" (EXPAND "eventuallys") (("" (EXPAND "eventually") (("" (SKOLEM!) (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (INSTANTIATE 1 "i!1") (("" (EXPAND "alwayss") (("" (EXPAND "always") (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (INDUCT "i") (("1" (GROUND) NIL) ("2" (SKOLEM!) (("2" (EXPAND "steps_satisfy") (("2" (FLATTEN) (("2" (INSTANTIATE -4 ("sts(t!1)(j!1+i!1)" "sts(t!1)(j!1+i!1+1)" "ags(t!1)(j!1+i!1)")) (("2" (EXPAND "stable") (("2" (GROUND) (("2" (DELETE -1 -2 -3 3) (("2" (EXPAND "prop_for") (("2" (FLATTEN) (("2" (DELETE -1 -3 -4) (("2" (EXPAND "steps_okay") (("2" (INST?) (("2" (GROUND) (("2" (EXPAND "member") (("2" (EXPAND "steps") (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|leads_to_invariant| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "leads_to") (("" (EXPAND "satisfies") (("" (EXPAND "always") (("" (EXPAND "pimplies") (("" (EXPAND "member") (("" (EXPAND "eventuallys") (("" (EXPAND "alwayss") (("" (EXPAND "always") (("" (EXPAND "eventually") (("" (EXPAND "stbp") (("" (EXPAND "sand") (("" (EXPAND "shift") (("" (GROUND) (("1" (SKOLEM!) (("1" (INST?) (("1" (INST?) (("1" (GROUND) (("1" (SKOLEM!) (("1" (FLATTEN) (("1" (INSTANTIATE -2 "i!1") (("1" (GROUND) NIL))))))))))))))) ("2" (SKOLEM!) (("2" (INST?) (("2" (INST?) (("2" (GROUND) (("2" (SKOLEM!) (("2" (INSTANTIATE -2 "i!1") (("2" (GROUND) (("2" (SKOLEM!) (("2" (INSTANTIATE -2 "i!1+i!2") (("2" (INSTANTIATE 1 "i!2") (("2" (GROUND) NIL))))))))))))))))))))) ("3" (SKOLEM!) (("3" (INST?) (("3" (INST?) (("3" (GROUND) (("3" (SKOLEM!) (("3" (INSTANTIATE -2 "i!1") (("3" (GROUND) (("3" (SKOLEM!) (("3" (INSTANTIATE -2 "i!1+i!2") (("3" (INSTANTIATE 1 "i!2") (("3" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))) (|leads_to_invariant1| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "leads_to") (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (INST?) (("" (INST?) (("" (GROUND) (("" (EXPAND "alwayss") (("" (EXPAND "always") (("" (EXPAND "pimplies") (("" (EXPAND "eventuallys") (("" (EXPAND "member") (("" (EXPAND "eventually") (("" (EXPAND "stbp") (("" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "shift") (("" (EXPAND "simplies") (("" (EXPAND "sand") (("" (INSTANTIATE -3 "sts(t!1)(i!1)") (("" (INSTANTIATE -1 "i!1") (("" (GROUND) (("" (INSTANTIATE -3 "i!1") (("" (GROUND) NIL)))))))))))))))))))))))))))))))))))))))))))))))))) $$$more_preds.pvs more_preds[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING unity[ST,AG] sp, sp1, sp2: VAR STATE_PRED cmp: VAR (comp_t[ST, AG]) st, st1, st2: VAR ST p, p1, p2: VAR prop_t[ST,AG] ag: VAR AG stable_assuming(sp1, sp2): ACTION_PRED = (LAMBDA st1, st2, ag: sp1(st1) and sp1(st2) and sp2(st1) IMPLIES sp2(st2)) pimplies_always: THEOREM init_satisfies(cmp, simplies(sp1, sp2)) AND steps_satisfy(cmp, stable_assuming(sp1, sp2)) => satisfies(cmp, pimplies(alwayss(sp1),alwayss(sp2))) init_simplies: THEOREM init_satisfies(cmp, sp2) => init_satisfies(cmp, simplies(sp1, sp2)) satisfies_modus_ponens: THEOREM satisfies(cmp, p1) AND satisfies(cmp, pimplies(p1, p2)) => satisfies(cmp, p2) END more_preds $$$more_preds.prf (|more_preds| (|pimplies_always| "" (SKOSIMP) (("" (EXPAND "satisfies") (("" (SKOSIMP) (("" (EXPAND "pimplies") (("" (EXPAND "member") (("" (GROUND) (("" (EXPAND "alwayss") (("" (EXPAND "always") (("" (EXPAND "stbp") (("" (EXPAND "shift") (("" (INDUCT "i") (("1" (EXPAND "init_satisfies") (("1" (INST?) (("1" (EXPAND "prop_for") (("1" (EXPAND "initial_okay") (("1" (EXPAND "member") (("1" (GROUND) (("1" (EXPAND "simplies") (("1" (INST?) NIL))))))))))))))) ("2" (SKOSIMP) (("2" (EXPAND "steps_satisfy") (("2" (EXPAND "stable_assuming") (("2" (INST - "sts(t!1)(j!1)" "sts(t!1)(j!1+1)" "ags(t!1)(j!1)") (("2" (EXPAND "prop_for") (("2" (EXPAND "steps_okay") (("2" (EXPAND "member") (("2" (EXPAND "steps") (("2" (FLATTEN) (("2" (INST?) (("2" (INST-CP - "j!1") (("2" (INST - "j!1+1") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))) (|init_simplies| "" (SKOSIMP) (("" (EXPAND "init_satisfies") (("" (SKOSIMP) (("" (EXPAND "simplies") (("" (GROUND) (("" (INST?) (("" (GROUND) NIL))))))))))))) (|satisfies_modus_ponens| "" (SKOSIMP) (("" (EXPAND "satisfies") (("" (SKOSIMP) (("" (INST?) (("" (EXPAND "pimplies") (("" (EXPAND "member") (("" (INST?) (("" (GROUND) NIL)))))))))))))))) $$$client_props.pvs client_props: THEORY BEGIN IMPORTING client_spec IMPORTING more_preds[(CLIENT_STATE), THREAD ] IMPORTING unity st, st1, st2 : VAR (CLIENT_STATE) pf: VAR PROT_FAMILY clear, cypher: VAR TEXT p : VAR FSEQ[[ENCRYPT_MECH, KEY]] seed : VAR SEED key_mech : VAR KEY_MECH th: VAR (client_threads) t: VAR TEXT ri: VAR RECEIVED_INFO %% Next two functions probably belong in crypto_shared_state.pvs map_protect(p, t): RECURSIVE TEXT = IF nonemptyfseq(p) THEN map_protect(pop(p),protect_text(PROJ_1(elem(p)(1)), PROJ_2(elem(p)(1)), t)) ELSE t ENDIF MEASURE size(p); encrypted_with_pf(pf, clear, cypher): bool = (EXISTS p: cypher = map_protect(p,clear) AND size(p) = size(pf) AND (FORALL (i: {i: nat | i>0 AND i <= size(pf)}): PROJ_1(elem(p)(i)) = encrypt_mech(elem(pf)(i)) AND (EXISTS seed, key_mech: PROJ_2(elem(p)(i)) = generate_key(key_mech, seed) AND key_mech = key_mech(elem(pf)(i))))) have_encrypted_text(st, pf, clear, cypher): bool = EXISTS th: requested_prot_family(thst(st)(th)) = pf AND pf_handle_provided(thst(st)(th)) AND handle(thst(st)(th)) /= null_name AND clear_text_sent(thst(st)(th)) = clear AND clear /= null_text AND cypher_text_received(thst(st)(th)) = cypher AND reply_received(thst(st)(th)) %%vvv DESIRED PROPERTY vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv %% %% This is the top-level desired property. We could try %% to prove it by decomposing it into other properties %% which eventually reduce to things you would prove about %% a single component (using the composition theorems to %% lift each result). correct_encryption_pred : STATE_PRED = (LAMBDA st: (FORALL pf, clear, cypher: have_encrypted_text(st, pf, clear, cypher) => encrypted_with_pf(pf, clear, cypher))) %% We can prove that it is satisfied in the initial state without %% considering any component other than the client. correct_encryption_prop1: THEOREM init_satisfies(client_comp, correct_encryption_pred) %% However, we cannot prove that the system steps satisfy %% correct_encryption_pred without considering properties of the %% entire system. %% %%^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ %% To demonstrate property lifting, we prove a lemma that says if %% the ri of the client always has things that are correct %% encryptions then encrypted_with_pf is satisfied correct_ppd_def(st): bool = (FORALL th, ri, cypher, pf, clear: (NOT reply_received(thst(st)(th)) AND existing_threads(kst(st))(th) AND received_info(kst(st))(th) = ri AND op(ri) = provide_protected_data_op AND provide_protected_data_msg(cypher) = user_msg(ri) AND ri_status(ri) = ri_unprocessed AND pf = requested_prot_family(thst(st)(th)) AND clear = clear_text_sent(thst(st)(th))) => encrypted_with_pf(pf, clear, cypher)) correct_ppd_pred: STATE_PRED = (LAMBDA st: correct_ppd_def(st)) correct_encryption_prop_steps: THEOREM steps_satisfy(client_comp, stable_assuming(correct_ppd_pred, correct_encryption_pred)) correct_encryption_prop: THEOREM satisfies(client_comp, pimplies(alwayss(correct_ppd_pred), alwayss(correct_encryption_pred))) END client_props $$$client_props.prf (|client_props| (IMPORTING2_TCC1 "" (INST + "client_state_witness") NIL) (|map_protect_TCC1| "" (EXPAND "nonemptyfseq") (("" (SKOSIMP) (("" (GROUND) NIL))))) (|map_protect_TCC2| "" (EXPAND "pop") (("" (PROPAX) NIL))) (|encrypted_with_pf_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL))) (|encrypted_with_pf_TCC2| "" (SKOSIMP*) (("" (GROUND) NIL))) (|correct_encryption_prop1| "" (EXPAND "init_satisfies") (("" (SKOSIMP) (("" (EXPAND "client_comp") (("" (EXPAND "base_client_comp") (("" (EXPAND "initial_client_states") (("" (EXPAND "correct_encryption_pred") (("" (SKOSIMP) (("" (EXPAND "have_encrypted_text") (("" (SKOSIMP) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))) (|correct_encryption_prop_steps| "" (EXPAND "steps_satisfy") (("" (EXPAND "stable_assuming") (("" (SKOSIMP) (("" (EXPAND "client_comp") (("" (EXPAND "base_client_comp") (("" (HIDE -3) (("" (GROUND) (("1" (EXPAND "client_guar") (("1" (GROUND) (("1" (EXPAND "client_view") (("1" (REPLACE -1) (("1" (PROPAX) NIL))))) ("2" (EXPAND "correct_encryption_pred") (("2" (EXPAND "client_step") (("2" (SKOSIMP) (("2" (EXPAND "have_encrypted_text") (("2" (SKOSIMP) (("2" (INST? -7) (("2" (GROUND) (("2" (INST + "th!1") (("2" (CASE "NOT th!1=ag!1") (("1" (INST?) (("1" (GROUND) NIL))) ("2" (REPLACE -1 :HIDE? T) (("2" (CASE "thst(st1!1)(ag!1) = thst(st2!1)(ag!1) OR clear!1 = null_text OR client_provide_protected_data(st1!1,st2!1,ag!1)") (("1" (HIDE -4) (("1" (SPLIT -) (("1" (REPLACE -1) (("1" (GROUND) NIL))) ("2" (PROPAX) NIL) ("3" (HIDE 1) (("3" (EXPAND "client_provide_protected_data") (("3" (SKOSIMP) (("3" (REPLACE -3) (("3" (BETA) (("3" (HIDE -3) (("3" (EXPAND "correct_ppd_pred") (("3" (EXPAND "correct_ppd_def") (("3" (INST?) (("3" (INST?) (("3" (INST?) (("3" (EXPAND "client_receive_request_util") (("3" (EXPAND "receive_request") (("3" (GROUND) NIL))))))))))))))))))))))))))))))) ("2" (HIDE 2) (("2" (EXPAND "client_op") (("2" (GROUND) (("1" (EXPAND "client_receive_request") (("1" (PROPAX) NIL))) ("2" (EXPAND "client_select_prot_family") (("2" (PROPAX) NIL))) ("3" (EXPAND "client_provide_pf_handle") (("3" (SKOSIMP) (("3" (REPLACE -13 :DIR RL) (("3" (REPLACE -4) (("3" (BETA) (("3" (PROPAX) NIL))))))))))) ("4" (EXPAND "client_provide_crypto_context") (("4" (SKOSIMP) (("4" (REPLACE -13 :DIR RL) (("4" (REPLACE -5) (("4" (BETA) (("4" (PROPAX) NIL))))))))))) ("5" (EXPAND "client_protect") (("5" (PROPAX) NIL))))))))))))))))))))))))))))))))))) ("2" (EXPAND "client_rely") (("2" (EXPAND "client_environment") (("2" (GROUND) (("2" (EXPAND "correct_encryption_pred") (("2" (SKOSIMP) (("2" (INST?) (("2" (GROUND) (("2" (EXPAND "have_encrypted_text") (("2" (SKOSIMP) (("2" (INST + "th!1") (("2" (REPLACE -2 :DIR RL) (("2" (BETA) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))) (|correct_encryption_prop| "" (REWRITE "pimplies_always") (("1" (HIDE 2) (("1" (REWRITE "init_simplies") (("1" (REWRITE "correct_encryption_prop1") NIL))))) ("2" (HIDE 2) (("2" (REWRITE "correct_encryption_prop_steps") NIL)))))) $$$tolerates.pvs tolerates[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING component[ST, AG] cset, cset1, cset2, cset3: VAR setof[(comp_t)] cmp, cmp1, cmp2: VAR (comp_t) st, st1, st2: VAR ST ag: VAR AG ags: VAR setof[AG] tran: VAR transition tolerates_cmp(cset1, cmp2): bool = (FORALL tran: member(tran, guar(cmp2)) IMPLIES ((EXISTS cmp1: member(cmp1, cset1) AND member(tran, guar(cmp1))) OR (FORALL cmp1: member(cmp1, cset1) AND member(tran, hidd(cmp1)) IMPLIES member(tran, rely(cmp1))))) tolerates_cmp_disj(cset1, cmp2): bool = (FORALL tran: member(tran, guar(cmp2)) IMPLIES ((FORALL cmp1: member(cmp1, cset1) AND member(tran, hidd(cmp1)) IMPLIES member(tran, rely(cmp1))))) tolerates_cmp_stutter(cset1, cmp2): bool = (FORALL st1, st2, ag, cmp1: member(cmp1, cset1) AND member((st1, st2, ag), guar(cmp2)) AND member((st1, st2, ag), hidd(cmp1)) IMPLIES member((st1, st2), view(cmp1))) tolerates_cmp_cags(cset1, cmp2): bool = (FORALL st1, st2, ag, cmp1: member(cmp1, cset1) AND member(ag, cags(cmp2)) AND member((st1, st2, ag), hidd(cmp1)) IMPLIES member((st1, st2), view(cmp1))) tolerates_cmp_disj_stronger: THEOREM tolerates_cmp_disj(cset1, cmp2) IMPLIES tolerates_cmp(cset1, cmp2) tolerates_cmp_stutter_stronger: THEOREM tolerates_cmp_stutter(cset1, cmp2) IMPLIES tolerates_cmp_disj(cset1, cmp2) tolerates_cmp_cags_stronger: THEOREM tolerates_cmp_cags(cset1, cmp2) IMPLIES tolerates_cmp_stutter(cset1, cmp2) tolerates_cmp_cags_stronger2: THEOREM tolerates_cmp_cags(cset1, cmp2) IMPLIES tolerates_cmp_disj(cset1, cmp2) tolerates(cset1, cset2): bool = (FORALL cmp2: member(cmp2, cset2) IMPLIES tolerates_cmp(cset1, cmp2)) tolerates_prop: THEOREM tolerates(cset1, cset2) AND subset?(cset, cset2) IMPLIES tolerates(cset1, cset) tolerates_union: THEOREM tolerates(cset1, cset2) AND tolerates(cset1, cset3) AND cset = union(cset2, cset3) => tolerates(cset1, cset) tolerates_disj(cset1, cset2): bool = (FORALL cmp2: member(cmp2, cset2) IMPLIES tolerates_cmp_disj(cset1, cmp2)) tolerates_stutter(cset1, cset2): bool = (FORALL cmp2: member(cmp2, cset2) IMPLIES tolerates_cmp_stutter(cset1, cmp2)) tolerates_cags(cset1, cset2): bool = (FORALL cmp2: member(cmp2, cset2) IMPLIES tolerates_cmp_cags(cset1, cmp2)) tolerates_cags_help: THEOREM (FORALL cmp1, cmp2, st1, st2, ag : (cset1(cmp1) AND hidd(cmp1)(st1, st2, ag) => ags(ag) OR view(cmp1)(st1, st2)) AND (cset2(cmp2) AND cags(cmp2)(ag) => NOT ags(ag))) IMPLIES tolerates_cags(cset1, cset2) tolerates_disj_stronger: THEOREM tolerates_disj(cset1, cset2) IMPLIES tolerates(cset1, cset2) tolerates_stutter_stronger: THEOREM tolerates_stutter(cset1, cset2) IMPLIES tolerates(cset1, cset2) tolerates_cags_stronger: THEOREM tolerates_cags(cset1, cset2) IMPLIES tolerates(cset1, cset2) tolerates_disj_prop2: THEOREM tolerates_disj(cset1, cset2) AND subset?(cset, cset2) IMPLIES tolerates_disj(cset1, cset) END tolerates $$$tolerates.prf (|tolerates| (|tolerates_cmp_disj_stronger| "" (SKOSIMP*) (("" (EXPAND "tolerates_cmp") (("" (EXPAND "tolerates_cmp_disj") (("" (SKOSIMP*) (("" (INST?) (("" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))) (|tolerates_cmp_stutter_stronger| "" (SKOSIMP) (("" (EXPAND "tolerates_cmp_disj") (("" (EXPAND "tolerates_cmp_stutter") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (CASE "tran!1 = (PROJ_1(tran!1), PROJ_2(tran!1), PROJ_3(tran!1))") (("1" (REPLACE -1 :HIDE? T) (("1" (INST?) (("1" (GROUND) (("1" (TYPEPRED "cmp1!1") (("1" (USE "component_rely_stuttering") (("1" (EXPAND "rely_stuttering_restriction") (("1" (EXPAND "gen_stuttering_restriction") (("1" (EXPAND "member") (("1" (INST?) (("1" (GROUND) (("1" (EXPAND "complement") (("1" (EXPAND "member") (("1" (USE "component_hidd") (("1" (EXPAND "hidd_restriction") (("1" (EXPAND "member") (("1" (INST?) (("1" (GROUND) NIL))))))))))))))))))))))))))))))))) ("2" (EXTENSIONALITY "transition") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))) (|tolerates_cmp_cags_stronger| "" (SKOSIMP) (("" (EXPAND "tolerates_cmp_cags") (("" (EXPAND "tolerates_cmp_stutter") (("" (SKOSIMP) (("" (EXPAND "member") (("" (INST?) (("" (GROUND) (("" (TYPEPRED "cmp2!1") (("" (USE "component_guar") (("" (REWRITE "guar_restriction") (("" (EXPAND "member") (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))) (|tolerates_cmp_cags_stronger2| "" (SKOSIMP) (("" (REWRITE "tolerates_cmp_stutter_stronger") (("" (REWRITE "tolerates_cmp_cags_stronger") NIL))))) (|tolerates_prop| "" (SKOSIMP*) (("" (EXPAND "tolerates") (("" (SKOSIMP*) (("" (INST?) (("" (EXPAND "subset?") (("" (INST?) (("" (GROUND) NIL))))))))))))) (|tolerates_union| "" (SKOSIMP) (("" (EXPAND "tolerates") (("" (SKOSIMP) (("" (EXPAND "tolerates_cmp") (("" (EXPAND "member") (("" (SKOSIMP*) (("" (REPLACE -3 :HIDE? T) (("" (EXPAND "union") (("" (EXPAND "member") (("" (GROUND) (("1" (HIDE -3) (("1" (INST?) (("1" (GROUND) (("1" (INST?) (("1" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))))))))))))) ("2" (HIDE -2) (("2" (INST?) (("2" (GROUND) (("2" (INST?) (("2" (GROUND) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))) (|tolerates_cags_help| "" (SKOSIMP*) (("" (EXPAND "tolerates_cags") (("" (SKOSIMP) (("" (EXPAND "tolerates_cmp_cags") (("" (SKOSIMP) (("" (EXPAND "member") (("" (INST?) (("" (INST?) (("" (GROUND) NIL))))))))))))))))) (|tolerates_disj_stronger| "" (SKOSIMP*) (("" (EXPAND "tolerates") (("" (SKOSIMP*) (("" (EXPAND "tolerates_disj") (("" (INST?) (("" (GROUND) (("" (REWRITE "tolerates_cmp_disj_stronger") NIL))))))))))))) (|tolerates_stutter_stronger| "" (SKOSIMP) (("" (EXPAND "tolerates_stutter") (("" (EXPAND "tolerates") (("" (EXPAND "member") (("" (SKOSIMP) (("" (INST?) (("" (GROUND) (("" (REWRITE "tolerates_cmp_disj_stronger") (("" (REWRITE "tolerates_cmp_stutter_stronger") NIL))))))))))))))))) (|tolerates_cags_stronger| "" (SKOSIMP) (("" (EXPAND "tolerates_cags") (("" (EXPAND "tolerates") (("" (EXPAND "member") (("" (SKOSIMP) (("" (INST?) (("" (GROUND) (("" (REWRITE "tolerates_cmp_disj_stronger") (("" (REWRITE "tolerates_cmp_cags_stronger2") NIL))))))))))))))))) (|tolerates_disj_prop2| "" (SKOSIMP*) (("" (EXPAND "tolerates_disj") (("" (SKOSIMP*) (("" (INST?) (("" (GROUND) (("" (EXPAND "subset?") (("" (INST?) (("" (GROUND) NIL)))))))))))))))) $$$contains.pvs contains[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING cmp_contains[ST, AG] cmp, cmp1, cmp2: VAR (comp_t) cset1, cset2: VAR setof[(comp_t)] contains(cset1, cset2): bool = (FORALL cmp1: member(cmp1, cset1) IMPLIES (EXISTS cmp2: member(cmp2, cset2) AND cmp_contains(cmp2, cmp1))) END contains $$$contains.prf (|contains| (|contains_one_def| "" (SKOLEM!) (("" (IFF) (("" (EXPAND "contains_one") (("" (EXPAND "contains") (("" (EXPAND "member") (("" (EXPAND "singleton") (("" (GROUND) (("1" (SKOSIMP*) (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))) (|contains_one_prop| "" (SKOSIMP*) (("" (EXPAND "contains_one") (("" (INST?) (("" (GROUND) (("" (EXPAND "cmp_contains") (("" (REWRITE "subset_reflexive") (("" (REWRITE "subset_reflexive") (("" (REWRITE "subset_reflexive") (("" (GROUND) (("1" (EXPAND "subset?") (("1" (EXPAND "steps") (("1" (EXPAND "member") (("1" (SKOSIMP*) (("1" (GROUND) NIL))))))))) ("2" (REWRITE "subset_reflexive") NIL) ("3" (REWRITE "subset_reflexive") NIL) ("4" (REWRITE "subset_reflexive") NIL)))))))))))))))))))) $$$cmp_thm_aux.pvs cmp_thm_aux[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING compose[ST, AG] IMPORTING cprops[ST, AG] IMPORTING contains[ST, AG] IMPORTING tolerates[ST, AG] cset, cset1, cset2: VAR setof[(comp_t)] cmp1, cmp2: VAR (comp_t) tran: VAR [ST, ST, AG] st, st1, st2: VAR ST ag: VAR AG key_composable: THEOREM subset?(cset1, cset2) AND cset1 /= emptyset AND composable(cset2) IMPLIES composable(cset1) key_init: THEOREM contains(cset1, cset2) AND composable(cset2) AND member(st, init(compose(cset2))) IMPLIES (composable(cset1) IMPLIES member(st, init(compose(cset1)))) key_guar1: THEOREM contains(cset1, cset2) AND composable(cset2) AND member(tran, guar(compose(cset2))) IMPLIES member(tran, gen_intersection(guar_or_hidds_for(cset1))) key_guar2: THEOREM composable(cset2) AND member(tran, guar(compose(cset2))) AND tolerates(cset1, cset2) IMPLIES (member(tran, gen_union(guars_for(cset1))) OR (FORALL cmp1: member(cmp1, cset1) AND member(tran, hidd(cmp1)) IMPLIES member(tran, rely(cmp1)))) key_guar3: THEOREM NOT member(tran, gen_union(guars_for(cset1))) AND member(tran, gen_intersection(guar_or_hidds_for(cset1))) IMPLIES member(tran, gen_intersection(hidds_for(cset1))) key_guar4: THEOREM member(tran, gen_intersection(hidds_for(cset1))) AND (FORALL cmp1: member(cmp1, cset1) AND member(tran, hidd(cmp1)) IMPLIES member(tran, rely(cmp1))) IMPLIES member(tran, gen_intersection(relys_for(cset1))) key_guar: THEOREM contains(cset1, cset2) AND tolerates(cset1, cset2) AND composable(cset2) AND member(tran, guar(compose(cset2))) IMPLIES (composable(cset1) IMPLIES member(tran, steps(compose(cset1)))) key_rely: THEOREM contains(cset1, cset2) AND composable(cset2) AND member(tran, rely(compose(cset2))) IMPLIES (composable(cset1) IMPLIES member(tran, rely(compose(cset1)))) key_hidd: THEOREM contains(cset1, cset2) AND composable(cset2) AND member(tran, hidd(compose(cset2))) IMPLIES (composable(cset1) IMPLIES member(tran, hidd(compose(cset1)))) key_view: THEOREM contains(cset1, cset2) AND composable(cset2) AND member((st1, st2), view(compose(cset2))) IMPLIES (composable(cset1) IMPLIES member((st1, st2), view(compose(cset1)))) tranc: VAR TRANSITION_CLASS key_wfar: THEOREM contains(cset1, cset2) AND composable(cset1) AND member(tranc, wfar(compose(cset1))) IMPLIES (composable(cset2) IMPLIES member(tranc, wfar(compose(cset2)))) key_sfar: THEOREM contains(cset1, cset2) AND composable(cset1) AND member(tranc, sfar(compose(cset1))) IMPLIES (composable(cset2) IMPLIES member(tranc, sfar(compose(cset2)))) key_cags: THEOREM contains(cset1, cset2) AND composable(cset1) AND member(ag, cags(compose(cset1))) IMPLIES (composable(cset2) IMPLIES member(ag, cags(compose(cset2)))) key: THEOREM contains(cset1, cset2) AND tolerates(cset1, cset2) AND composable(cset2) AND cmp2 = compose(cset2) AND composable(cset1) AND cmp1 = compose(cset1) IMPLIES cmp_contains(cmp2, cmp1) END cmp_thm_aux $$$cmp_thm_aux.prf (|cmp_thm_aux| (|key_composable| "" (SKOSIMP*) (("" (EXPAND "composable") (("" (GROUND) (("" (EXPAND "agreeable_start") (("" (SKOLEM!) (("" (INST?) (("" (SKOSIMP*) (("" (INST?) (("" (GROUND) (("" (EXPAND "subset?") (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))) (|key_init| "" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "compose") (("" (EXPAND "compose_init") (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (EXPAND "inits_for") (("" (EXPAND "member") (("" (SKOSIMP*) (("" (REPLACE -6 :HIDE? -6) (("" (EXPAND "contains") (("" (INST?) (("" (EXPAND "member") (("" (GROUND) (("" (SKOSIMP*) (("" (INSTANTIATE -4 "init(cmp2!1)") (("" (SPLIT) (("1" (CASE "not subset?(init(cmp2!1),init(cmp!1))") (("1" (EXPAND "cmp_contains") (("1" (GROUND) NIL))) ("2" (EXPAND "subset?") (("2" (EXPAND "member") (("2" (INST?) (("2" (GROUND) NIL))))))))) ("2" (INSTANTIATE 1 "cmp2!1") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))) (|key_guar1| "" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "compose") (("" (EXPAND "compose_guar") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "guar_or_hidds_for") (("" (SKOSIMP*) (("" (REPLACE -6 :HIDE? -6) (("" (EXPAND "contains") (("" (INST?) (("" (GROUND) (("" (SKOSIMP*) (("" (INSTANTIATE -4 "union(guar(cmp2!1),hidd(cmp2!1))") (("" (GROUND) (("1" (EXPAND "union") (("1" (EXPAND "cmp_contains") (("1" (FLATTEN) (("1" (EXPAND "subset?" -9) (("1" (INST?) (("1" (GROUND) (("1" (EXPAND "subset?" -5) (("1" (INST?) (("1" (GROUND) (("1" (EXPAND "steps") (("1" (EXPAND "member") (("1" (GROUND) (("1" (LEMMA "component_rely_hidd") (("1" (INSTANTIATE -1 "cmp!1") (("1" (EXPAND "rely_hidd_restriction") (("1" (EXPAND "subset?" -1) (("1" (INST?) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))))))))))))))))))))))))))))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))) (|key_guar2| "" (SKOSIMP*) (("" (EXPAND "tolerates") (("" (EXPAND "member") (("" (EXPAND "compose") (("" (EXPAND "compose_guar") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "gen_intersection") (("" (EXPAND "gen_union") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "guars_for") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (INSTANTIATE -6 "cmp!1") (("" (GROUND) (("" (EXPAND "tolerates_cmp") (("" (EXPAND "member") (("" (INST?) (("" (SPLIT) (("1" (SKOSIMP*) (("1" (INSTANTIATE 1 "guar(cmp1!2)") (("1" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))))))))) ("2" (DELETE 1) (("2" (INST?) (("2" (GROUND) NIL))))) ("3" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))) (|key_guar3| "" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "gen_intersection") (("" (EXPAND "gen_union") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "hidds_for") (("" (EXPAND "guars_for") (("" (EXPAND "guar_or_hidds_for") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (INSTANTIATE -1 "union(guar(cmp!1),hidd(cmp!1))") (("" (INSTANTIATE 1 "guar(cmp!1)") (("" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))) ("3" (EXPAND "union") (("3" (EXPAND "member") (("3" (PROPAX) NIL))))) ("4" (INST?) (("4" (GROUND) NIL))))))))))))))))))))))))))))))) (|key_guar4| "" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "relys_for") (("" (SKOSIMP*) (("" (EXPAND "hidds_for") (("" (INSTANTIATE -1 "hidd(cmp!1)") (("" (INSTANTIATE -2 "cmp!1") (("" (EXPAND "member") (("" (GROUND) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))) (|key_guar| "" (SKOSIMP*) (("" (LEMMA "key_guar1") (("" (INSTANTIATE -1 ("cset1!1" "cset2!1" "tran!1")) (("" (GROUND) (("" (LEMMA "key_guar2") (("" (INSTANTIATE -1 ("cset1!1" "cset2!1" "tran!1")) (("" (LEMMA "key_guar3") (("" (INSTANTIATE -1 ("cset1!1" "tran!1")) (("" (LEMMA "key_guar4") (("" (INSTANTIATE -1 ("cset1!1" "tran!1")) (("" (EXPAND "member") (("" (EXPAND "compose" +) (("" (EXPAND "steps") (("" (EXPAND "compose_guar") (("" (EXPAND "intersection") (("" (EXPAND "compose_rely") (("" (EXPAND "member") (("" (GROUND) NIL))))))))))))))))))))))))))))))))))) (|key_rely| "" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "compose") (("" (EXPAND "compose_rely") (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "relys_for") (("" (SKOSIMP*) (("" (EXPAND "contains") (("" (INSTANTIATE -1 "cmp!1") (("" (GROUND) (("" (SKOSIMP*) (("" (INSTANTIATE -4 "rely(cmp2!1)") (("" (CASE "not subset?(rely(cmp2!1),rely(cmp!1))") (("1" (EXPAND "cmp_contains") (("1" (GROUND) NIL))) ("2" (EXPAND "subset?") (("2" (INST?) (("2" (EXPAND "member") (("2" (GROUND) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))) (|key_hidd| "" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "compose") (("" (EXPAND "compose_hidd") (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "hidds_for") (("" (SKOSIMP*) (("" (EXPAND "contains") (("" (INSTANTIATE -1 "cmp!1") (("" (GROUND) (("" (SKOSIMP*) (("" (INSTANTIATE -4 "hidd(cmp2!1)") (("" (CASE "not subset?(hidd(cmp2!1),hidd(cmp!1))") (("1" (EXPAND "cmp_contains") (("1" (GROUND) NIL))) ("2" (EXPAND "subset?") (("2" (INST?) (("2" (EXPAND "member") (("2" (GROUND) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))) (|key_view| "" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "compose") (("" (EXPAND "compose_view") (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "extend") (("" (SPLIT) (("1" (EXPAND "views_for" -1) (("1" (FLATTEN) (("1" (SKOLEM!) (("1" (FLATTEN) (("1" (REPLACE -3 :HIDE? -3) (("1" (EXPAND "contains") (("1" (INST?) (("1" (GROUND) (("1" (SKOLEM!) (("1" (CASE "not subset?(view(cmp2!1),view(cmp!1))") (("1" (EXPAND "cmp_contains") (("1" (GROUND) NIL))) ("2" (EXPAND "subset?") (("2" (EXPAND "member") (("2" (INST?) (("2" (GROUND) (("2" (INST?) (("2" (GROUND) (("2" (EXPAND "views_for") (("2" (EXPAND "member") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))) ("2" (GROUND) NIL))))))))))))))))))) (|key_wfar| "" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "compose") (("" (EXPAND "compose_wfar") (("" (EXPAND "gen_union") (("" (SKOLEM!) (("" (EXPAND "member") (("" (EXPAND "wfars_for") (("" (FLATTEN) (("" (SKOLEM!) (("" (EXPAND "contains") (("" (INST?) (("" (GROUND) (("" (SKOLEM!) (("" (REPLACE -4 :HIDE? -4) (("" (INSTANTIATE 1 "wfar(cmp2!1)") (("" (SPLIT) (("1" (INSTANTIATE 1 "cmp2!1") (("1" (GROUND) NIL))) ("2" (CASE "not subset?(wfar(cmp!1),wfar(cmp2!1))") (("1" (EXPAND "cmp_contains") (("1" (GROUND) NIL))) ("2" (EXPAND "subset?") (("2" (INST?) (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))) (|key_sfar| "" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "compose") (("" (EXPAND "compose_sfar") (("" (EXPAND "gen_union") (("" (SKOLEM!) (("" (EXPAND "member") (("" (EXPAND "sfars_for") (("" (FLATTEN) (("" (SKOLEM!) (("" (FLATTEN) (("" (REPLACE -4 :HIDE? -4) (("" (EXPAND "contains") (("" (INST?) (("" (GROUND) (("" (SKOSIMP*) (("" (INSTANTIATE 1 "sfar(cmp2!1)") (("" (SPLIT) (("1" (INSTANTIATE 1 "cmp2!1") (("1" (GROUND) NIL))) ("2" (CASE "not subset?(sfar(cmp!1),sfar(cmp2!1))") (("1" (EXPAND "cmp_contains") (("1" (GROUND) NIL))) ("2" (EXPAND "subset?") (("2" (EXPAND "member") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))) (|key_cags| "" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "compose") (("" (EXPAND "compose_cags") (("" (EXPAND "gen_union") (("" (SKOSIMP*) (("" (EXPAND* "member" "cagss_for") (("" (SKOSIMP*) (("" (EXPAND "contains") (("" (INST?) (("" (GROUND) (("" (SKOSIMP*) (("" (INSTANTIATE 1 "cags(cmp2!1)") (("" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (CASE "not subset?(cags(cmp!1),cags(cmp2!1))") (("1" (EXPAND "cmp_contains") (("1" (GROUND) NIL))) ("2" (EXPAND "subset?") (("2" (INST?) (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))) (|key| "" (SKOSIMP*) (("" (EXPAND "cmp_contains") (("" (REPLACE -4 :HIDE? -4) (("" (REPLACE -5 :HIDE? -5) (("" (EXPAND "subset?") (("" (GROUND) (("1" (SKOSIMP*) (("1" (LEMMA "key_init") (("1" (INSTANTIATE -1 ("cset1!1" "cset2!1" "x!1")) (("1" (GROUND) NIL))))))) ("2" (SKOSIMP*) (("2" (LEMMA "key_cags") (("2" (INSTANTIATE -1 ("x!1" "cset1!1" "cset2!1")) (("2" (GROUND) NIL))))))) ("3" (SKOSIMP*) (("3" (LEMMA "key_guar") (("3" (INSTANTIATE -1 ("cset1!1" "cset2!1" "x!1")) (("3" (GROUND) NIL))))))) ("4" (SKOSIMP*) (("4" (LEMMA "key_wfar") (("4" (INSTANTIATE -1 ("cset1!1" "cset2!1" "x!1")) (("4" (GROUND) NIL))))))) ("5" (SKOSIMP*) (("5" (LEMMA "key_sfar") (("5" (INSTANTIATE -1 ("cset1!1" "cset2!1" "x!1")) (("5" (GROUND) NIL))))))) ("6" (LEMMA "key_rely") (("6" (SKOSIMP*) (("6" (INSTANTIATE -1 ("cset1!1" "cset2!1" "x!1")) (("6" (GROUND) NIL))))))) ("7" (LEMMA "key_hidd") (("7" (SKOSIMP*) (("7" (INSTANTIATE -1 ("cset1!1" "cset2!1" "x!1")) (("7" (GROUND) NIL))))))) ("8" (SKOSIMP*) (("8" (LEMMA "key_view") (("8" (INSTANTIATE -1 ("cset1!1" "cset2!1" "PROJ_1(x!1)" "PROJ_2(x!1)")) (("8" (GROUND) (("1" (EXPAND "member") (("1" (GROUND) NIL))) ("2" (EXPAND "member") (("2" (GROUND) NIL)))))))))))))))))))))))) $$$cmp_thm.pvs cmp_thm[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING cmp_thm_aux[ST, AG] cset1, cset2: VAR setof[(comp_t)] p: VAR prop_t cmp_thm_base: THEOREM contains(cset1, cset2) AND tolerates(cset1, cset2) AND composable(cset1) AND satisfies(compose(cset1), p) IMPLIES (composable(cset2) IMPLIES satisfies(compose(cset2), p)) cmp_thm_base_disj: THEOREM contains(cset1, cset2) AND tolerates_disj(cset1, cset2) AND composable(cset1) AND satisfies(compose(cset1), p) IMPLIES (composable(cset2) IMPLIES satisfies(compose(cset2), p)) cmp_thm: THEOREM subset?(cset1, cset2) AND tolerates(cset1, cset2) AND composable(cset2) AND cset1 /= emptyset AND satisfies(compose(cset1), p) IMPLIES satisfies(compose(cset2), p) cmp_thm_disj: THEOREM subset?(cset1, cset2) AND tolerates_disj(cset1, cset2) AND cset1 /= emptyset AND composable(cset2) AND satisfies(compose(cset1), p) IMPLIES satisfies(compose(cset2), p) END cmp_thm $$$cmp_thm.prf (|cmp_thm| (|cmp_thm_base| "" (SKOSIMP*) (("" (LEMMA "satisfies_contains_prop") (("" (INSTANTIATE -1 ("compose(cset2!1)" "compose(cset1!1)" "p!1")) (("1" (GROUND) (("1" (LEMMA "key") (("1" (INSTANTIATE -1 ("compose(cset1!1)" "compose(cset2!1)" "cset1!1" "cset2!1")) (("1" (GROUND) NIL))))))) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL))))))) (|cmp_thm_base_disj| "" (SKOSIMP*) (("" (LEMMA "cmp_thm_base") (("" (INSTANTIATE -1 ("cset1!1" "cset2!1" "p!1")) (("" (GROUND) (("" (REWRITE "tolerates_disj_stronger") NIL))))))))) (|cmp_thm_TCC1| "" (SKOSIMP*) (("" (LEMMA "key_composable") (("" (INSTANTIATE -1 ("cset1!1" "cset2!1")) (("" (GROUND) NIL))))))) (|cmp_thm_TCC2| "" (SKOSIMP*) NIL) (|cmp_thm| "" (SKOSIMP*) (("" (LEMMA "cmp_thm_base") (("" (INSTANTIATE -1 ("cset1!1" "cset2!1" "p!1")) (("" (GROUND) (("1" (EXPAND "contains") (("1" (SKOSIMP*) (("1" (INST?) (("1" (EXPAND "subset?") (("1" (INST?) (("1" (GROUND) (("1" (REWRITE "cmp_contains_reflexive") NIL))))))))))))) ("2" (LEMMA "key_composable") (("2" (INSTANTIATE -1 ("cset1!1" "cset2!1")) (("2" (GROUND) NIL))))))))))))) (|cmp_thm_disj_TCC1| "" (SKOSIMP*) (("" (LEMMA "key_composable") (("" (INSTANTIATE -1 ("cset1!1" "cset2!1")) (("" (GROUND) NIL))))))) (|cmp_thm_disj_TCC2| "" (SKOSIMP*) NIL) (|cmp_thm_disj| "" (SKOSIMP*) (("" (LEMMA "cmp_thm") (("" (INSTANTIATE -1 ("cset1!1" "cset2!1" "p!1")) (("" (GROUND) (("" (REWRITE "tolerates_disj_stronger") NIL)))))))))) $$$gen_set.pvs gen_set[X: TYPE]: THEORY BEGIN s, s1, s2: VAR setof[X] ss, ss1, ss2: VAR setof[setof[X]] x, x1: VAR X nonempty_th: THEOREM s /= emptyset IFF (EXISTS x: member(x, s)) gen_union(ss): setof[X] = (LAMBDA x: (EXISTS s: member(s, ss) AND member(x, s))) gen_intersection(ss): setof[X] = (LAMBDA x: (FORALL s: member(s, ss) IMPLIES member(x, s))) gen_union_zero: THEOREM gen_union(emptyset[setof[X]]) = emptyset gen_intersection_zero: THEOREM gen_intersection(emptyset[setof[X]]) = fullset gen_union_two: THEOREM gen_union({s | s = s1 OR s = s2}) = union(s1, s2) gen_intersection_two: THEOREM gen_intersection({s | s = s1 OR s = s2}) = intersection(s1, s2) gen_union_one: THEOREM gen_union(singleton(s)) = s gen_intersection_one: THEOREM gen_intersection(singleton(s)) = s gen_intersection_bigger: THEOREM subset?(ss1, ss2) IMPLIES subset?(gen_intersection(ss2), gen_intersection(ss1)) gen_union_smaller: THEOREM subset?(ss1, ss2) IMPLIES subset?(gen_union(ss1), gen_union(ss2)) contains_at_most_one(s): bool = (FORALL x, x1: member(x, s) AND member(x1, s) IMPLIES x = x1) contains_one(s): bool = s /= emptyset AND contains_at_most_one(s) contains_one_def: THEOREM contains_one(s) IFF (EXISTS x: s = singleton(x)) END gen_set $$$gen_set.prf (|gen_set| (|nonempty_th| "" (GROUND) (("" (SKOSIMP*) (("" (GROUND) (("1" (EXTENSIONALITY "setof[X]") (("1" (INST?) (("1" (GROUND) (("1" (SKOLEM!) (("1" (EXPAND "emptyset" 1) (("1" (INST?) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))))))) ("2" (REPLACE -2 :HIDE? -2) (("2" (EXPAND "member") (("2" (EXPAND "emptyset") (("2" (PROPAX) NIL))))))))))))) (|gen_union_zero| "" (EXTENSIONALITY "setof[X]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (EXPAND "gen_union") (("" (EXPAND "member") (("" (EXPAND "emptyset") (("" (PROPAX) NIL))))))))))))))))) (|gen_intersection_zero| "" (EXTENSIONALITY "setof[X]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (EXPAND "gen_intersection") (("" (EXPAND "emptyset") (("" (EXPAND "member") (("" (EXPAND "fullset") (("" (PROPAX) NIL))))))))))))))))))) (|gen_union_two| "" (SKOLEM!) (("" (EXTENSIONALITY "setof[X]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "gen_union") (("" (EXPAND "union") (("" (EXPAND "member") (("" (GROUND) (("1" (SKOLEM!) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))) ("3" (INST?) (("3" (GROUND) NIL))))))))))))))))))))))))) (|gen_intersection_two| "" (SKOLEM!) (("" (EXTENSIONALITY "setof[X]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "gen_intersection") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))) ("3" (SKOSIMP*) (("3" (GROUND) NIL))))))))))))))))))))))))) (|gen_union_one| "" (SKOLEM!) (("" (CASE "singleton(s!1) /= {s | s = s!1 or s = s!1}") (("1" (DELETE 1) (("1" (FLATTEN) (("1" (EXTENSIONALITY "setof[setof[X]]") (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "singleton") (("1" (GROUND) NIL))))))))))))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (REWRITE "gen_union_two") (("2" (REWRITE "union_idempotent") NIL))))))))))) (|gen_intersection_one| "" (SKOLEM!) (("" (CASE "singleton(s!1) /= {s | s = s!1 or s = s!1}") (("1" (DELETE 1) (("1" (FLATTEN) (("1" (EXTENSIONALITY "setof[setof[X]]") (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "singleton") (("1" (GROUND) NIL))))))))))))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (REWRITE "gen_intersection_two") (("2" (REWRITE "intersection_idempotent") NIL))))))))))) (|gen_intersection_bigger| "" (SKOSIMP*) (("" (EXPAND "subset?") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (INST?) (("" (INST?) (("" (EXPAND "member") (("" (GROUND) NIL))))))))))))))))))) (|gen_union_smaller| "" (SKOSIMP*) (("" (EXPAND "subset?") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "gen_union") (("" (SKOSIMP*) (("" (INST?) (("" (INST?) (("" (EXPAND "member") (("" (GROUND) NIL))))))))))))))))))) (|contains_one_def| "" (SKOLEM!) (("" (EXPAND "contains_one") (("" (REWRITE "nonempty_th") (("" (EXPAND "contains_at_most_one") (("" (EXPAND "member") (("" (GROUND) (("1" (SKOSIMP*) (("1" (INSTANTIATE 1 "x!1") (("1" (EXTENSIONALITY "setof[X]") (("1" (INST?) (("1" (GROUND) (("1" (SKOLEM!) (("1" (DELETE 2) (("1" (EXPAND "singleton") (("1" (IFF) (("1" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))))))))))))))))))))))) ("2" (SKOLEM!) (("2" (INST?) (("2" (REPLACE -1 :HIDE? -1) (("2" (EXPAND "singleton") (("2" (PROPAX) NIL))))))))) ("3" (SKOSIMP*) (("3" (REPLACE -3 :HIDE? -3) (("3" (EXPAND "singleton") (("3" (GROUND) NIL)))))))))))))))))))) $$$compose.pvs compose[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING gen_set IMPORTING component[ST, AG] cset: VAR setof[(comp_t)] cmp, cmp1, cmp2: VAR (comp_t) st, st1, st2, st3, st4: VAR ST ag: VAR AG agreeable_start(cset): bool = (EXISTS st: (FORALL cmp: member(cmp, cset) IMPLIES member(st, init(cmp)))) composable(cset): bool = cset /= emptyset AND agreeable_start(cset) st_set: VAR setof[ST] inits_for(cset): setof[setof[ST]] = (LAMBDA st_set: (EXISTS cmp: member(cmp, cset) AND st_set = init(cmp))) compose_init(cset): setof[ST] = gen_intersection(inits_for(cset)) tranc: VAR TRANSITION_CLASS guars_for(cset): setof[TRANSITION_CLASS] = (LAMBDA tranc: (EXISTS cmp: member(cmp, cset) AND tranc = guar(cmp))) guar_or_hidds_for(cset): setof[TRANSITION_CLASS] = (LAMBDA tranc: (EXISTS cmp: member(cmp, cset) AND tranc = union(guar(cmp), hidd(cmp)))) relys_for(cset): setof[TRANSITION_CLASS] = (LAMBDA tranc: (EXISTS cmp: member(cmp, cset) AND tranc = rely(cmp))) hidds_for(cset): setof[TRANSITION_CLASS] = (LAMBDA tranc: (EXISTS cmp: member(cmp, cset) AND tranc = hidd(cmp))) v: VAR (VIEWS) views_for(cset): setof[(VIEWS)] = (LAMBDA v: (EXISTS cmp: member(cmp, cset) AND v = view(cmp))) ag_set: VAR setof[AG] cagss_for(cset): setof[setof[AG]] = (LAMBDA ag_set: (EXISTS cmp: member(cmp, cset) AND ag_set = cags(cmp))) tc_set: VAR setof[TRANSITION_CLASS] sfars_for(cset): setof[setof[TRANSITION_CLASS]] = (LAMBDA tc_set: (EXISTS cmp: member(cmp, cset) AND tc_set = sfar(cmp))) wfars_for(cset): setof[setof[TRANSITION_CLASS]] = (LAMBDA tc_set: (EXISTS cmp: member(cmp, cset) AND tc_set = wfar(cmp))) compose_guar(cset): setof[transition] = intersection(gen_intersection(guar_or_hidds_for(cset)), gen_union(guars_for(cset))) compose_rely(cset): setof[transition] = gen_intersection(relys_for(cset)) compose_hidd(cset): setof[transition] = gen_intersection(hidds_for(cset)) compose_cags(cset): setof[AG] = gen_union(cagss_for(cset)) compose_view_base(cset): setof[[ST, ST]] = gen_intersection(extend[setof[[ST, ST]], ((VIEWS)), bool, FALSE](views_for(cset))) compose_view_tc: THEOREM VIEWS(compose_view_base(cset)) compose_view(cset): (VIEWS[ST]) = gen_intersection(extend[setof[[ST, ST]], ((VIEWS)), bool, FALSE](views_for(cset))) compose_wfar(cset): setof[TRANSITION_CLASS] = gen_union(wfars_for(cset)) compose_sfar(cset): setof[TRANSITION_CLASS] = gen_union(sfars_for(cset)) compose_base(cset): base_comp_t[ST, AG] = (# init := compose_init(cset), guar := compose_guar(cset), rely := compose_rely(cset), hidd := compose_hidd(cset), cags := compose_cags(cset), view := compose_view(cset), wfar := compose_wfar(cset), sfar := compose_sfar(cset) #) compose_base_init: THEOREM cset /= emptyset AND agreeable_start(cset) IMPLIES init_restriction(compose_base(cset)) compose_base_guar: THEOREM guar_restriction(compose_base(cset)) compose_base_rely_hidd: THEOREM rely_hidd_restriction(compose_base(cset)) compose_base_hidd: THEOREM hidd_restriction(compose_base(cset)) compose_base_cags: THEOREM cset /= emptyset IMPLIES cags_restriction(compose_base(cset)) compose_base_view_rely: THEOREM view_rely_restriction(compose_base(cset)) compose_base_view_hidd: THEOREM view_hidd_restriction(compose_base(cset)) compose_base_view_guar: THEOREM view_guar_restriction(compose_base(cset)) compose_base_view_init: THEOREM view_init_restriction(compose_base(cset)) compose_base_view_sfar: THEOREM view_sfar_restriction(compose_base(cset)) compose_base_view_wfar: THEOREM view_wfar_restriction(compose_base(cset)) compose_base_guar_stuttering: THEOREM guar_stuttering_restriction(compose_base(cset)) compose_base_rely_stuttering: THEOREM rely_stuttering_restriction(compose_base(cset)) cmset: VAR (composable) compose_base_tc: THEOREM comp_t(compose_base(cmset)) compose(cmset): (comp_t) = (# init := compose_init(cmset), guar := compose_guar(cmset), rely := compose_rely(cmset), hidd := compose_hidd(cmset), cags := compose_cags(cmset), view := compose_view(cmset), wfar := compose_wfar(cmset), sfar := compose_sfar(cmset) #) END compose $$$compose.prf (|compose| (|compose_view_tc| "" (SKOLEM!) (("" (EXPAND "VIEWS") (("" (SPLIT) (("1" (EXPAND "compose_view_base") (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "views_for") (("1" (EXPAND "extend") (("1" (SPLIT) (("1" (EXPAND "VIEWS") (("1" (FLATTEN) (("1" (INST?) NIL))))) ("2" (GROUND) NIL))))))))))))))) ("2" (SKOSIMP*) (("2" (EXPAND "compose_view_base") (("2" (EXPAND "extend") (("2" (EXPAND "gen_intersection") (("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (INST?) (("2" (SPLIT) (("1" (SPLIT) (("1" (EXPAND "VIEWS") (("1" (FLATTEN) (("1" (INSTANTIATE -2 ("x1!1" "x2!1")) (("1" (GROUND) NIL))))))) ("2" (GROUND) NIL))) ("2" (FLATTEN) (("2" (ASSERT) NIL))) ("3" (FLATTEN) (("3" (GROUND) NIL))))))))))))))))))) ("3" (SKOSIMP*) (("3" (EXPAND "compose_view_base") (("3" (EXPAND "gen_intersection") (("3" (SKOSIMP*) (("3" (INST?) (("3" (INST?) (("3" (EXPAND "member") (("3" (EXPAND "extend") (("3" (CASE "VIEWS(s!1)") (("1" (ASSERT) (("1" (GROUND) (("1" (EXPAND "VIEWS") (("1" (FLATTEN) (("1" (INSTANTIATE -5 ("x1!1" "x2!1" "x3!1")) (("1" (GROUND) NIL))))))))))) ("2" (ASSERT) NIL))))))))))))))))))))))))) (|compose_view_TCC1| "" (SKOLEM!) (("" (LEMMA "compose_view_tc") (("" (INST?) (("" (EXPAND "compose_view_base") (("" (PROPAX) NIL))))))))) (|compose_base_init| "" (SKOLEM!) (("" (REWRITE "nonempty_th") (("" (EXPAND "init_restriction") (("" (REWRITE "nonempty_th") (("" (SKOSIMP*) (("" (EXPAND "agreeable_start") (("" (SKOLEM!) (("" (INSTANTIATE 1 "st!1") (("" (EXPAND "member" +) (("" (EXPAND "compose_base") (("" (EXPAND "compose_init") (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "inits_for") (("" (SKOLEM!) (("" (INSTANTIATE -2 "cmp!1") (("" (EXPAND "member") (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))) (|compose_base_guar| "" (SKOLEM!) (("" (EXPAND "guar_restriction") (("" (SKOSIMP*) (("" (EXPAND "compose_base") (("" (EXPAND "compose_cags") (("" (EXPAND "compose_guar") (("" (EXPAND "member") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "gen_union") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "guars_for") (("" (SKOSIMP*) (("" (INSTANTIATE 1 "cags(cmp!1)") (("" (EXPAND "cagss_for") (("" (SPLIT) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (LEMMA "component_guar") (("2" (INST?) (("2" (EXPAND "guar_restriction") (("2" (EXPAND "member") (("2" (INSTANTIATE -1 ("st1!1" "st2!1" "ag!1")) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))) (|compose_base_rely_hidd| "" (SKOLEM!) (("" (EXPAND "rely_hidd_restriction") (("" (EXPAND "subset?") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "compose_base") (("" (EXPAND "compose_hidd") (("" (EXPAND "compose_rely") (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "relys_for") (("" (EXPAND "hidds_for") (("" (SKOSIMP*) (("" (INSTANTIATE -1 "rely(cmp!1)") (("" (CASE "not rely(cmp!1)(x!1)") (("1" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (DELETE -2) (("2" (LEMMA "component_rely_hidd") (("2" (INST?) (("2" (EXPAND "rely_hidd_restriction") (("2" (EXPAND "subset?") (("2" (INST?) (("2" (EXPAND "member") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))) (|compose_base_hidd| "" (SKOLEM!) (("" (EXPAND "hidd_restriction") (("" (SKOSIMP*) (("" (EXPAND "compose_base") (("" (EXPAND "member") (("" (EXPAND "compose_hidd") (("" (EXPAND "compose_cags") (("" (EXPAND "gen_intersection") (("" (EXPAND "gen_union") (("" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "member") (("" (EXPAND "cagss_for") (("" (SKOLEM!) (("" (INSTANTIATE -1 "hidd(cmp!1)") (("" (CASE "not hidds_for(cset!1)(hidd(cmp!1))") (("1" (EXPAND "hidds_for" +) (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (GROUND) (("2" (REPLACE -4 :HIDE? -4) (("2" (TYPEPRED "cmp!1") (("2" (EXPAND "comp_t") (("2" (EXPAND "hidd_restriction") (("2" (FLATTEN) (("2" (EXPAND "member") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))) (|compose_base_cags| "" (SKOLEM!) (("" (REWRITE "nonempty_th") (("" (FLATTEN) (("" (SKOLEM!) (("" (EXPAND "cags_restriction") (("" (REWRITE "nonempty_th") (("" (LEMMA "component_cags") (("" (INST?) (("" (EXPAND "cags_restriction") (("" (REWRITE "nonempty_th") (("" (SKOSIMP*) (("" (INST?) (("" (EXPAND "member" +) (("" (EXPAND "compose_base") (("" (EXPAND "compose_cags") (("" (EXPAND "gen_union") (("" (INST?) (("" (GROUND) (("" (EXPAND "member" +) (("" (EXPAND "cagss_for") (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))) (|compose_base_view_rely| "" (SKOLEM!) (("" (EXPAND "view_rely_restriction") (("" (EXPAND "gen_view_restriction") (("" (SKOSIMP*) (("" (EXPAND "compose_base") (("" (EXPAND "compose_view") (("" (EXPAND "compose_rely") (("" (EXPAND "gen_intersection") (("" (EXPAND "member") (("" (SKOSIMP*) (("" (INST?) (("" (GROUND) (("" (EXPAND "relys_for") (("" (SKOLEM!) (("" (FLATTEN) (("" (REPLACE -5 :HIDE? -5) (("" (TYPEPRED "cmp!1") (("" (EXPAND "comp_t") (("" (EXPAND "view_rely_restriction") (("" (FLATTEN) (("" (EXPAND "gen_view_restriction") (("" (EXPAND "member") (("" (EXPAND "extend") (("" (CASE "not views_for(cset!1)(view(cmp!1))") (("1" (EXPAND "views_for" +) (("1" (INST?) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))) ("2" (GROUND) (("2" (INSTANTIATE -7 ("ag!1" "st1!1" "st2!1" "st3!1" "st4!1")) (("2" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|compose_base_view_hidd| "" (SKOLEM!) (("" (EXPAND "view_hidd_restriction") (("" (EXPAND "gen_view_restriction") (("" (SKOSIMP*) (("" (EXPAND "compose_base") (("" (EXPAND "compose_view") (("" (EXPAND "compose_hidd") (("" (EXPAND "gen_intersection") (("" (EXPAND "member") (("" (SKOSIMP*) (("" (INST?) (("" (GROUND) (("" (EXPAND "hidds_for") (("" (SKOLEM!) (("" (FLATTEN) (("" (REPLACE -5 :HIDE? -5) (("" (TYPEPRED "cmp!1") (("" (EXPAND "comp_t") (("" (EXPAND "view_hidd_restriction") (("" (FLATTEN) (("" (EXPAND "gen_view_restriction") (("" (EXPAND "member") (("" (EXPAND "extend") (("" (CASE "not views_for(cset!1)(view(cmp!1))") (("1" (EXPAND "views_for" +) (("1" (INST?) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))) ("2" (GROUND) (("2" (INSTANTIATE -8 ("ag!1" "st1!1" "st2!1" "st3!1" "st4!1")) (("2" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|compose_base_view_guar| "" (SKOSIMP*) (("" (EXPAND "view_guar_restriction") (("" (EXPAND "gen_view_restriction") (("" (SKOSIMP*) (("" (EXPAND "compose_base") (("" (EXPAND "compose_view") (("" (EXPAND "member") (("" (EXPAND "compose_guar") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (EXPAND "gen_intersection") (("" (EXPAND "gen_union") (("" (GROUND) (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "guar_or_hidds_for") (("1" (SKOSIMP*) (("1" (INSTANTIATE -3 "view(cmp!1)") (("1" (INSTANTIATE -4 "view(cmp!1)") (("1" (INSTANTIATE -5 "union(guar(cmp!1),hidd(cmp!1))") (("1" (EXPAND "extend") (("1" (CASE "not views_for(cset!1)(view(cmp!1))") (("1" (EXPAND "views_for") (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (GROUND) (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (REPLACE -6 :HIDE? -6) (("1" (SIMPLIFY) (("1" (GROUND) (("1" (LEMMA "component_view_guar") (("1" (INST?) (("1" (EXPAND "view_guar_restriction") (("1" (EXPAND "gen_view_restriction") (("1" (EXPAND "member") (("1" (INSTANTIATE -1 ("ag!1" "st1!1" "st2!1" "st3!1" "st4!1")) (("1" (GROUND) NIL))))))))))))) ("2" (LEMMA "component_view_hidd") (("2" (INST?) (("2" (EXPAND "view_hidd_restriction") (("2" (EXPAND "gen_view_restriction") (("2" (EXPAND "member") (("2" (INSTANTIATE -1 ("ag!1" "st1!1" "st2!1" "st3!1" "st4!1")) (("2" (GROUND) NIL))))))))))))))))))))))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (EXPAND "guars_for") (("2" (SKOSIMP*) (("2" (INSTANTIATE -1 "view(cmp!1)") (("2" (INSTANTIATE -2 "view(cmp!1)") (("2" (INSTANTIATE 1 "guar(cmp!1)") (("2" (EXPAND "extend") (("2" (CASE "not views_for(cset!1)(view(cmp!1))") (("1" (EXPAND "views_for") (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (LEMMA "component_view_guar") (("2" (INST?) (("2" (EXPAND "view_guar_restriction") (("2" (EXPAND "gen_view_restriction") (("2" (EXPAND "member") (("2" (INSTANTIATE -1 ("ag!1" "st1!1" "st2!1" "st3!1" "st4!1")) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|compose_base_view_init| "" (SKOLEM!) (("" (EXPAND "view_init_restriction") (("" (SKOSIMP*) (("" (EXPAND "compose_base") (("" (EXPAND "compose_init") (("" (EXPAND "compose_view") (("" (EXPAND "member") (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "inits_for") (("" (SKOSIMP*) (("" (INSTANTIATE -2 "init(cmp!1)") (("" (INSTANTIATE -1 "view(cmp!1)") (("" (EXPAND "extend") (("" (GROUND) (("1" (LEMMA "component_view_init") (("1" (INST?) (("1" (EXPAND "view_init_restriction") (("1" (INST?) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))) ("2" (INST?) (("2" (GROUND) NIL))) ("3" (EXPAND "views_for") (("3" (INST?) (("3" (GROUND) NIL))))) ("4" (INST?) (("4" (GROUND) NIL))))))))))))))))))))))))))))))))))) (|compose_base_view_sfar| "" (SKOLEM!) (("" (EXPAND "view_sfar_restriction") (("" (SKOSIMP*) (("" (EXPAND "gen_view_restriction") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "compose_base") (("" (EXPAND "compose_sfar") (("" (EXPAND "gen_union") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "sfars_for") (("" (SKOSIMP*) (("" (EXPAND "compose_view") (("" (EXPAND "gen_intersection") (("" (INSTANTIATE -4 "view(cmp!1)") (("" (INSTANTIATE -5 "view(cmp!1)") (("" (EXPAND "member") (("" (EXPAND "extend") (("" (CASE "not views_for(cset!1)(view(cmp!1))") (("1" (EXPAND "views_for" +) (("1" (EXPAND "member") (("1" (INST?) (("1" (GROUND) NIL))))))) ("2" (GROUND) (("2" (LEMMA "component_view_sfar") (("2" (INST?) (("2" (EXPAND "view_sfar_restriction") (("2" (EXPAND "member") (("2" (INST?) (("2" (GROUND) (("2" (EXPAND "gen_view_restriction") (("2" (INSTANTIATE -1 ("ag!1" "st1!1" "st2!1" "st3!1" "st4!1")) (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|compose_base_view_wfar| "" (SKOLEM!) (("" (EXPAND "view_wfar_restriction") (("" (SKOSIMP*) (("" (EXPAND "gen_view_restriction") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "compose_base") (("" (EXPAND "compose_wfar") (("" (EXPAND "gen_union") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "wfars_for") (("" (SKOSIMP*) (("" (EXPAND "compose_view") (("" (EXPAND "gen_intersection") (("" (INSTANTIATE -4 "view(cmp!1)") (("" (INSTANTIATE -5 "view(cmp!1)") (("" (EXPAND "member") (("" (EXPAND "extend") (("" (CASE "not views_for(cset!1)(view(cmp!1))") (("1" (EXPAND "views_for" +) (("1" (EXPAND "member") (("1" (INST?) (("1" (GROUND) NIL))))))) ("2" (GROUND) (("2" (LEMMA "component_view_wfar") (("2" (INST?) (("2" (EXPAND "view_wfar_restriction") (("2" (EXPAND "member") (("2" (INST?) (("2" (GROUND) (("2" (EXPAND "gen_view_restriction") (("2" (INSTANTIATE -1 ("ag!1" "st1!1" "st2!1" "st3!1" "st4!1")) (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|compose_base_guar_stuttering| "" (SKOLEM!) (("" (EXPAND "guar_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "compose_base") (("" (EXPAND "compose_guar") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (SPLIT) (("1" (EXPAND "compose_view") (("1" (EXPAND "gen_intersection") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "guar_or_hidds_for") (("1" (SKOSIMP*) (("1" (INSTANTIATE -4 "view(cmp!1)") (("1" (EXPAND "extend") (("1" (SPLIT -4) (("1" (REPLACE -3 :HIDE? -3) (("1" (EXPAND "union") (("1" (CASE "member(ag!1,cags(cmp!1))") (("1" (LEMMA "component_guar_stuttering") (("1" (INST?) (("1" (EXPAND "guar_stuttering_restriction") (("1" (EXPAND "gen_stuttering_restriction") (("1" (INST?) (("1" (GROUND) NIL))))))))))) ("2" (CASE "not member(ag!1,complement(cags(cmp!1)))") (("1" (EXPAND "member") (("1" (EXPAND "complement") (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))) ("2" (LEMMA "component_hidd_stuttering") (("2" (INST?) (("2" (GROUND) (("2" (EXPAND "hidd_stuttering_restriction") (("2" (EXPAND "gen_stuttering_restriction") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))) ("2" (EXPAND "views_for") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))) ("2" (EXPAND "compose_cags") (("2" (EXPAND "gen_union") (("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (EXPAND "cagss_for") (("2" (SKOSIMP*) (("2" (INSTANTIATE 1 "guar(cmp!1)") (("2" (GROUND) (("1" (EXPAND "guars_for") (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (EXPAND "compose_view") (("2" (EXPAND "gen_intersection") (("2" (INSTANTIATE -4 "view(cmp!1)") (("2" (EXPAND "member") (("2" (EXPAND "extend") (("2" (GROUND) (("1" (LEMMA "component_guar_stuttering") (("1" (INST?) (("1" (EXPAND "guar_stuttering_restriction") (("1" (EXPAND "gen_stuttering_restriction") (("1" (EXPAND "member") (("1" (INST?) (("1" (GROUND) NIL))))))))))))) ("2" (EXPAND "views_for") (("2" (INST?) (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|compose_base_rely_stuttering| "" (SKOSIMP*) (("" (EXPAND "rely_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP*) (("" (EXPAND "compose_base") (("" (EXPAND "compose_rely") (("" (EXPAND "compose_view") (("" (EXPAND "compose_cags") (("" (EXPAND "member") (("" (EXPAND "complement") (("" (EXPAND "member") (("" (EXPAND "gen_intersection") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "relys_for") (("" (SKOSIMP*) (("" (INSTANTIATE -1 "view(cmp!1)") (("" (EXPAND "extend") (("" (GROUND) (("1" (EXPAND "gen_union") (("1" (INSTANTIATE 1 "cags(cmp!1)") (("1" (GROUND) (("1" (EXPAND "member") (("1" (EXPAND "cagss_for") (("1" (INST?) (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))) ("2" (LEMMA "component_rely_stuttering") (("2" (INST?) (("2" (EXPAND "rely_stuttering_restriction") (("2" (EXPAND "gen_stuttering_restriction") (("2" (EXPAND "member") (("2" (INST?) (("2" (INST?) (("2" (EXPAND "complement") (("2" (PROPAX) NIL))))))))))))))))))))))) ("2" (EXPAND "views_for") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))) (|compose_base_tc| "" (SKOLEM!) (("" (TYPEPRED "cmset!1") (("" (GROUND) (("" (EXPAND "composable") (("" (EXPAND "comp_t") (("" (REWRITE "compose_base_init") (("" (REWRITE "compose_base_guar") (("" (REWRITE "compose_base_rely_hidd") (("" (REWRITE "compose_base_hidd") (("" (REWRITE "compose_base_cags") (("" (REWRITE "compose_base_view_rely") (("" (REWRITE "compose_base_view_hidd") (("" (REWRITE "compose_base_view_guar") (("" (REWRITE "compose_base_view_init") (("" (REWRITE "compose_base_view_wfar") (("" (REWRITE "compose_base_view_sfar") (("" (REWRITE "compose_base_guar_stuttering") (("" (REWRITE "compose_base_rely_stuttering") (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))) (|compose_TCC1| "" (SKOLEM!) (("" (LEMMA "compose_base_tc") (("" (INST?) (("" (EXPAND "compose_base") (("" (PROPAX) NIL)))))))))) $$$compose_idempotent.pvs compose_idempotent[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING compose[ST, AG] cmp: VAR (comp_t) ci_init: THEOREM compose_init(singleton(cmp)) = init(cmp) ci_cags: THEOREM compose_cags(singleton(cmp)) = cags(cmp) ci_guar: THEOREM compose_guar(singleton(cmp)) = guar(cmp) ci_rely: THEOREM compose_rely(singleton(cmp)) = rely(cmp) ci_hidd: THEOREM compose_hidd(singleton(cmp)) = hidd(cmp) ci_view: THEOREM compose_view(singleton(cmp)) = view(cmp) ci_sfar: THEOREM compose_sfar(singleton(cmp)) = sfar(cmp) ci_wfar: THEOREM compose_wfar(singleton(cmp)) = wfar(cmp) ci_composable: THEOREM composable(singleton(cmp)) ci_component: THEOREM compose(singleton(cmp)) = cmp END compose_idempotent $$$compose_idempotent.prf (|compose_idempotent| (|ci_init| "" (SKOLEM!) (("" (EXPAND "compose_init") (("" (CASE "inits_for(singleton(cmp!1)) /= singleton(init(cmp!1))") (("1" (DELETE 1) (("1" (FLATTEN) (("1" (EXTENSIONALITY "setof[setof[ST]]") (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "inits_for") (("1" (EXPAND "member") (("1" (EXPAND "singleton") (("1" (GROUND) (("1" (SKOSIMP*) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (REWRITE "gen_intersection_one") NIL))))))))))) (|ci_cags| "" (SKOLEM!) (("" (CASE "cagss_for(singleton(cmp!1)) /= singleton(cags(cmp!1))") (("1" (DELETE 1) (("1" (EXTENSIONALITY "setof[setof[AG]]") (("1" (FLATTEN) (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (EXPAND "cagss_for") (("1" (EXPAND "member") (("1" (EXPAND "singleton") (("1" (IFF) (("1" (GROUND) (("1" (SKOLEM!) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))) ("2" (FLATTEN) (("2" (EXPAND "compose_cags") (("2" (REPLACE -1 :HIDE? -1) (("2" (REWRITE "gen_union_one") NIL))))))))))) (|ci_guar| "" (SKOLEM!) (("" (EXPAND "compose_guar") (("" (CASE "guar_or_hidds_for(singleton(cmp!1)) /= singleton(union(guar(cmp!1),hidd(cmp!1)))") (("1" (DELETE 1) (("1" (FLATTEN) (("1" (EXTENSIONALITY "setof[setof[[ST,ST,AG]]]") (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "guar_or_hidds_for") (("1" (EXPAND "union") (("1" (EXPAND "singleton") (("1" (EXPAND "member") (("1" (GROUND) (("1" (SKOSIMP*) (("1" (GROUND) (("1" (REPLACE -2) (("1" (REPLACE -1) (("1" (PROPAX) NIL))))))))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (CASE "guars_for(singleton(cmp!1)) /= singleton(guar(cmp!1))") (("1" (DELETE 1) (("1" (EXTENSIONALITY "setof[setof[[ST,ST,AG]]]") (("1" (FLATTEN) (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "guars_for") (("1" (EXPAND "member") (("1" (EXPAND "singleton") (("1" (GROUND) (("1" (SKOLEM!) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (REWRITE "gen_intersection_one") (("2" (REWRITE "gen_union_one") (("2" (REWRITE "intersection_commutative") (("2" (REWRITE "intersection_subset2") (("2" (REWRITE "union_subset1") NIL))))))))))))))))))))))))) (|ci_rely| "" (SKOLEM!) (("" (EXPAND "compose_rely") (("" (CASE "relys_for(singleton(cmp!1)) /= singleton(rely(cmp!1))") (("1" (DELETE 1) (("1" (FLATTEN) (("1" (EXTENSIONALITY "setof[setof[[ST,ST,AG]]]") (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "relys_for") (("1" (EXPAND "member") (("1" (EXPAND "singleton") (("1" (GROUND) (("1" (SKOSIMP*) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (REWRITE "gen_intersection_one") NIL))))))))))) (|ci_hidd| "" (SKOLEM!) (("" (EXPAND "compose_hidd") (("" (CASE "hidds_for(singleton(cmp!1)) /= singleton(hidd(cmp!1))") (("1" (DELETE 1) (("1" (FLATTEN) (("1" (EXTENSIONALITY "setof[setof[[ST,ST,AG]]]") (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "hidds_for") (("1" (EXPAND "member") (("1" (EXPAND "singleton") (("1" (GROUND) (("1" (SKOSIMP*) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (REWRITE "gen_intersection_one") NIL))))))))))) (|ci_view| "" (SKOLEM!) (("" (EXPAND "compose_view") (("" (EXPAND "extend") (("" (CASE "(LAMBDA (t:setof[[ST,ST]]): IF VIEWS[ST](t) THEN views_for(singleton(cmp!1))(t) ELSE FALSE ENDIF) /= singleton(view(cmp!1))") (("1" (DELETE 1) (("1" (FLATTEN) (("1" (EXTENSIONALITY "setof[setof[[ST,ST]]]") (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "extend") (("1" (EXPAND "views_for") (("1" (EXPAND "member") (("1" (EXPAND "singleton") (("1" (GROUND) (("1" (SKOLEM!) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (LEMMA "gen_intersection_one[[ST,ST]]") (("2" (INST?) (("2" (GROUND) (("2" (REPLACE -1 1 RL :HIDE? -1) (("2" (EXPAND "extend") (("2" (EXPAND "gen_intersection") (("2" (EXPAND "member") (("2" (EXPAND "singleton") (("2" (EXTENSIONALITY "setof[[ST,ST]]") (("2" (INST?) (("2" (GROUND) (("2" (DELETE 2) (("2" (SKOLEM!) (("2" (GROUND) (("2" (IFF) (("2" (GROUND) (("1" (SKOSIMP*) (("1" (INST?) (("1" (REPLACE -2 :HIDE? -2) (("1" (ASSERT) (("1" (EXTENSIONALITY "setof[[ST,ST]]") (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2 3) (("1" (SKOLEM!) (("1" (IFF) (("1" (GROUND) (("1" (SKOSIMP*) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) (("2" (REPLACE -2 :HIDE? -2) (("2" (DELETE -1 2) (("2" (EXTENSIONALITY "setof[[ST,ST]]") (("2" (INST?) (("2" (GROUND) (("2" (DELETE 2) (("2" (SKOSIMP*) (("2" (IFF) (("2" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (SKOSIMP*) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|ci_sfar| "" (SKOLEM!) (("" (EXPAND "compose_sfar") (("" (CASE "sfars_for(singleton(cmp!1)) /= singleton(sfar(cmp!1))") (("1" (DELETE 1) (("1" (FLATTEN) (("1" (EXTENSIONALITY "setof[setof[setof[[ST,ST,AG]]]]") (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "sfars_for") (("1" (EXPAND "member") (("1" (EXPAND "singleton") (("1" (GROUND) (("1" (SKOLEM!) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (REWRITE "gen_union_one") NIL))))))))))) (|ci_wfar| "" (SKOLEM!) (("" (EXPAND "compose_wfar") (("" (CASE "wfars_for(singleton(cmp!1)) /= singleton(wfar(cmp!1))") (("1" (DELETE 1) (("1" (FLATTEN) (("1" (EXTENSIONALITY "setof[setof[setof[[ST,ST,AG]]]]") (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (IFF) (("1" (EXPAND "wfars_for") (("1" (EXPAND "member") (("1" (EXPAND "singleton") (("1" (GROUND) (("1" (SKOLEM!) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (REWRITE "gen_union_one") NIL))))))))))) (|ci_composable| "" (SKOLEM!) (("" (EXPAND "composable") (("" (REWRITE "nonempty_th") (("" (GROUND) (("1" (INST?) (("1" (EXPAND "member") (("1" (EXPAND "singleton") (("1" (PROPAX) NIL))))))) ("2" (EXPAND "agreeable_start") (("2" (LEMMA "component_init") (("2" (INST?) (("2" (EXPAND "init_restriction") (("2" (REWRITE "nonempty_th") (("2" (SKOLEM!) (("2" (INST?) (("2" (SKOLEM!) (("2" (EXPAND "member") (("2" (EXPAND "singleton") (("2" (GROUND) NIL))))))))))))))))))))))))))))) (|ci_component_TCC1| "" (SKOLEM!) (("" (REWRITE "ci_composable") NIL))) (|ci_component| "" (SKOLEM!) (("" (EXTENSIONALITY "(comp_t)") (("" (INST?) (("1" (EXPAND "compose") (("1" (REWRITE "ci_cags") (("1" (REWRITE "ci_guar") (("1" (REWRITE "ci_init") (("1" (REWRITE "ci_rely") (("1" (REWRITE "ci_sfar") (("1" (REWRITE "ci_wfar") (("1" (REWRITE "ci_view") (("1" (REWRITE "ci_hidd") (("1" (GROUND) NIL))))))))))))))))))) ("2" (REWRITE "ci_composable") NIL)))))))) $$$ac_translators.pvs ac_translators[X1: NONEMPTY_TYPE, Y1: NONEMPTY_TYPE, X: NONEMPTY_TYPE, Y: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING translators[X1, X] IMPORTING translators[Y1, Y] ap, ap1, ap2: VAR setof[[X1, X1, Y1]] xt: VAR (translator_t[X1, X]) yt: VAR (weak_translator_t[Y1, Y]) x1, x2: VAR X y: VAR Y a1, a2: VAR X1 b: VAR Y1 tr_ac(ap, xt, yt): setof[[X, X, Y]] = (LAMBDA x1, x2, y: (EXISTS a1, a2, b: member((a1, a2, b), ap) AND member(x1, xt(a1)) AND member(x2, xt(a2)) AND member(y, yt(b)))) tr_ac_intersection: THEOREM tr_ac(intersection(ap1, ap2), xt, yt) = intersection(tr_ac(ap1, xt, yt), tr_ac(ap2, xt, yt)) tr_ac_union: THEOREM tr_ac(union(ap1, ap2), xt, yt) = union(tr_ac(ap1, xt, yt), tr_ac(ap2, xt, yt)) END ac_translators $$$ac_translators.prf (|ac_translators| (|tr_ac_intersection| "" (SKOLEM!) (("" (EXPAND "tr_ac") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (REWRITE "extensionality") (("" (HIDE 2) (("" (SKOLEM!) (("" (IFF) (("" (SPLIT) (("1" (FLATTEN) (("1" (SKOSIMP*) (("1" (SPLIT) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))) ("2" (FLATTEN) (("2" (SKOLEM!) (("2" (SKOLEM!) (("2" (FLATTEN) (("2" (INST?) (("2" (GROUND) (("2" (LEMMA "help3[X1,X]") (("2" (INST -1 "xt!1" "a1!1" "a1!2" "PROJ_1(x!1)") (("2" (LEMMA "help3[X1,X]") (("2" (INST -1 "xt!1" "a2!1" "a2!2" "PROJ_2(x!1)") (("2" (GROUND) (("2" (REPLACE -1) (("2" (REPLACE -2) (("2" (LEMMA "help3[Y1,Y]") (("2" (INST -1 "yt!1" "b!1" "b!2" "PROJ_3(x!1)") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))) (|tr_ac_union| "" (SKOLEM!) (("" (REWRITE "extensionality") (("" (HIDE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "tr_ac") (("" (EXPAND "union") (("" (EXPAND "member") (("" (SPLIT) (("1" (FLATTEN) (("1" (SKOSIMP*) (("1" (SPLIT) (("1" (HIDE 2) (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (HIDE 1) (("2" (INST?) (("2" (GROUND) NIL))))))))))) ("2" (SKOSIMP*) (("2" (SPLIT) (("1" (SKOSIMP*) (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) NIL)))))))))))))))))))))))))))) $$$tcs_translators.pvs tcs_translators[X1: NONEMPTY_TYPE, Y1: NONEMPTY_TYPE, X: NONEMPTY_TYPE, Y: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING ac_translators[X1, Y1, X, Y] tca : VAR setof[[X1,X1,Y1]] tcb : VAR setof[[X,X,Y]] tcsa, tcsa1, tcsa2 : VAR setof[setof[[X1,X1,Y1]]] xt: VAR (translator_t[X1, X]) yt: VAR (weak_translator_t[Y1, Y]) tr_tcs(tcsa, xt, yt): setof[setof[[X,X,Y]]] = (LAMBDA tcb: (exists tca: member(tca,tcsa) and tr_ac(tca,xt,yt) = tcb)) tr_tcs_union: THEOREM tr_tcs(union(tcsa1, tcsa2), xt, yt) = union(tr_tcs(tcsa1, xt, yt), tr_tcs(tcsa2, xt, yt)) END tcs_translators $$$tcs_translators.prf (|tcs_translators| (|tr_tcs_union| "" (SKOLEM!) (("" (EXTENSIONALITY "setof[setof[[X,X,Y]]]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (SKOLEM!) (("" (IFF) (("" (EXPAND "tr_tcs") (("" (EXPAND "union") (("" (EXPAND "member") (("" (GROUND) (("1" (SKOSIMP*) (("1" (SPLIT) (("1" (DELETE 2) (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (DELETE 1) (("2" (INST?) (("2" (GROUND) NIL))))))))) ("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) NIL))))) ("3" (SKOSIMP*) (("3" (INST?) (("3" (GROUND) NIL)))))))))))))))))))))))))))) $$$translator_views.pvs translator_views[X: NONEMPTY_TYPE, Y: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING translators[X, Y] IMPORTING views[X] IMPORTING views[Y] t: VAR (translator_t) v, v1, v2: VAR (VIEWS[X]) vy: VAR (VIEWS[Y]) br, br1, br2: VAR BASE_RELATIONS[X] x, x1, x2: VAR X y, y1, y2: VAR Y vmap(t, v): (VIEWS[Y]) = (LAMBDA y1, y2: (EXISTS x1, x2: member((x1, x2), v) AND member(y1, t(x1)) AND member(y2, t(x2)))) brmap(t, br): BASE_RELATIONS[Y] = (LAMBDA y1, y2: (EXISTS x1, x2: member((x1, x2), br) AND member(y1, t(x1)) AND member(y2, t(x2)))) brmap_intersection: THEOREM brmap(t, intersection(br1, br2)) = intersection(brmap(t, br1), brmap(t, br2)) brmap_union: THEOREM brmap(t, union(br1, br2)) = union(brmap(t, br1), brmap(t, br2)) vmap_brmap: THEOREM vmap(t, v) = brmap(t, v) vmap_intersection: THEOREM vmap(t, intersection(v1, v2)) = intersection(vmap(t, v1), vmap(t, v2)) END translator_views $$$translator_views.prf (|translator_views| (|vmap_TCC1| "" (SKOLEM!) (("" (EXPAND "member") (("" (TYPEPRED "v!1") (("" (EXPAND "VIEWS") (("" (GROUND) (("1" (SKOLEM!) (("1" (LEMMA "help5[X,Y]") (("1" (INSTANTIATE -1 ("t!1" "x!1")) (("1" (SKOLEM!) (("1" (INST? -2) (("1" (INST? 1) (("1" (GROUND) NIL))))))))))))) ("2" (SKOLEM!) (("2" (FLATTEN) (("2" (SKOLEM!) (("2" (FLATTEN) (("2" (INSTANTIATE 1 ("x2!2" "x1!2")) (("2" (GROUND) (("2" (INST? -5) (("2" (GROUND) NIL))))))))))))))) ("3" (SKOLEM!) (("3" (FLATTEN) (("3" (SKOLEM!) (("3" (SKOLEM!) (("3" (FLATTEN) (("3" (INSTANTIATE 1 ("x1!2" "x2!3")) (("3" (GROUND) (("3" (INSTANTIATE -9 ("x1!2" _ "x2!3")) (("3" (GROUND) (("3" (INSTANTIATE -9 "x2!2") (("3" (DELETE 1) (("3" (GROUND) (("3" (LEMMA "help3[X,Y]") (("3" (INSTANTIATE -1 ("t!1" "x2!2" "x1!3" "x2!1")) (("3" (GROUND) NIL))))))))))))))))))))))))))))))))))))))) (|brmap_intersection| "" (SKOLEM!) (("" (EXPAND "intersection") (("" (EXPAND "brmap") (("" (EXPAND "member") (("" (REWRITE "extensionality") (("" (HIDE 2) (("" (SKOLEM!) (("" (IFF) (("" (SPLIT) (("1" (FLATTEN) (("1" (SKOSIMP*) (("1" (SPLIT) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))) ("2" (FLATTEN) (("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) (("2" (LEMMA "help3[X,Y]") (("2" (INST?) (("2" (INST -1 "x1!2") (("2" (LEMMA "help3[X,Y]") (("2" (INST -1 "t!1" "x2!2" "x2!1" "PROJ_2(x!1)") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))) (|brmap_union| "" (SKOLEM!) (("" (EXPAND "union") (("" (EXPAND "brmap") (("" (EXPAND "member") (("" (REWRITE "extensionality") (("" (HIDE 2) (("" (SKOLEM!) (("" (IFF) (("" (SPLIT) (("1" (FLATTEN) (("1" (SKOLEM!) (("1" (FLATTEN) (("1" (SPLIT) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST? 2) (("2" (GROUND) NIL))))))))))) ("2" (FLATTEN) (("2" (SPLIT) (("1" (SKOSIMP*) (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))) (|vmap_brmap| "" (EXPAND "vmap") (("" (EXPAND "brmap") (("" (PROPAX) NIL))))) (|vmap_intersection_TCC1| "" (LEMMA "view_and_prop[X]") (("" (PROPAX) NIL))) (|vmap_intersection| "" (SKOLEM!) (("" (REWRITE "vmap_brmap") (("1" (REWRITE "vmap_brmap") (("1" (REWRITE "vmap_brmap") (("1" (REWRITE "brmap_intersection") NIL))))) ("2" (HIDE 2) (("2" (REWRITE "view_and_prop") NIL)))))))) $$$cmp_translators.pvs cmp_translators[X1: NONEMPTY_TYPE, Y1: NONEMPTY_TYPE, X: NONEMPTY_TYPE, Y: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING translator_views[X1, X] IMPORTING tcs_translators[X1, Y1, X, Y] IMPORTING component[X1, Y1] IMPORTING component[X, Y] cmp1: VAR (comp_t[X1, Y1]) xt: VAR (translator_t[X1, X]) yt: VAR (weak_translator_t[Y1, Y]) x1, x2: VAR X y: VAR Y env_stutter(cmp1,xt,yt): setof[[X,X,Y]] = (LAMBDA x1,x2,y: not member(y,tmap(yt,cags(cmp1))) and vmap(xt,view(cmp1))(x1,x2)) tr_cmp(cmp1, xt, yt): base_comp_t[X, Y] = (# init := tmap(xt, init(cmp1)), cags := tmap(yt, cags(cmp1)), view := vmap(xt, view(cmp1)), hidd := union(tr_ac(hidd(cmp1),xt, yt),env_stutter(cmp1,xt,yt)), rely := union(tr_ac(rely(cmp1), xt, yt),env_stutter(cmp1,xt,yt)), guar := tr_ac(guar(cmp1), xt, yt), sfar := tr_tcs(sfar(cmp1), xt, yt), wfar := tr_tcs(wfar(cmp1), xt, yt) #) tranc : VAR setof[[X1,X1,Y1]] ag_set : VAR setof[Y1] v : VAR (VIEWS[X1]) tr_gen_view_restriction: THEOREM gen_view_restriction(tranc,v) implies gen_view_restriction(tr_ac(tranc,xt,yt),vmap(xt,v)) tr_gen_stuttering_restriction: THEOREM gen_stuttering_restriction(ag_set,tranc,v) implies gen_stuttering_restriction(tmap(yt,ag_set),tr_ac(tranc,xt,yt),vmap(xt,v)) tr_cmp_init: THEOREM init_restriction(tr_cmp(cmp1, xt, yt)) tr_cmp_guar: THEOREM guar_restriction(tr_cmp(cmp1, xt, yt)) tr_cmp_rely_hidd: THEOREM rely_hidd_restriction(tr_cmp(cmp1, xt, yt)) tr_cmp_hidd: THEOREM hidd_restriction(tr_cmp(cmp1, xt, yt)) tr_cmp_cags: THEOREM cags_restriction(tr_cmp(cmp1, xt, yt)) tr_cmp_view_rely: THEOREM view_rely_restriction(tr_cmp(cmp1, xt, yt)) tr_cmp_view_hidd: THEOREM view_hidd_restriction(tr_cmp(cmp1, xt, yt)) tr_cmp_view_guar: THEOREM view_guar_restriction(tr_cmp(cmp1, xt, yt)) tr_cmp_view_init: THEOREM view_init_restriction(tr_cmp(cmp1, xt, yt)) tr_cmp_view_wfar: THEOREM view_wfar_restriction(tr_cmp(cmp1, xt, yt)) tr_cmp_view_sfar: THEOREM view_sfar_restriction(tr_cmp(cmp1, xt, yt)) tr_cmp_guar_stuttering: THEOREM guar_stuttering_restriction(tr_cmp(cmp1, xt,yt)) tr_cmp_rely_stuttering: THEOREM rely_stuttering_restriction(tr_cmp(cmp1, xt,yt)) tr_cmp_type: THEOREM comp_t(tr_cmp(cmp1, xt, yt)) tran_cmp(cmp1, xt, yt): (comp_t[X, Y]) = tr_cmp(cmp1, xt, yt) END cmp_translators $$$cmp_translators.prf (|cmp_translators| (|tr_gen_view_restriction| "" (SKOSIMP*) (("" (EXPAND "gen_view_restriction") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "tr_ac") (("" (EXPAND "vmap") (("" (EXPAND "member") (("" (SKOSIMP*) (("" (INSTANTIATE -1 ("b!1" "x1!1" "x1!2" "x2!1" "x2!2")) (("" (LEMMA "help3[X1,X]") (("" (INSTANTIATE -1 ("xt!1" "x1!1" "a1!1" "st1!1") T) (("" (INSTANTIATE -1 ("xt!1" "x1!2" "a2!1" "st2!1")) (("" (GROUND) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))) (|tr_gen_stuttering_restriction| "" (SKOSIMP*) (("" (EXPAND "gen_stuttering_restriction") (("" (EXPAND "member" +) (("" (SKOSIMP*) (("" (EXPAND "tmap") (("" (EXPAND "vmap") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (SKOSIMP*) (("" (INST?) (("" (INST?) (("" (GROUND) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))) (|tr_cmp_init| "" (SKOLEM!) (("" (EXPAND "init_restriction") (("" (REWRITE "help1[X1,X]") (("" (LEMMA "component_init[X1,Y1]") (("" (INST?) (("" (EXPAND "init_restriction") (("" (REWRITE "help1[X1,X1]") (("" (SKOLEM!) (("" (LEMMA "help4[X1,X]") (("" (INSTANTIATE -1 ("xt!1" "y!1")) (("" (SKOLEM!) (("" (INST?) (("" (EXPAND "tr_cmp") (("" (EXPAND "tmap") (("" (EXPAND "member") (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))) (|tr_cmp_guar| "" (SKOLEM!) (("" (EXPAND "guar_restriction") (("" (SKOLEM!) (("" (EXPAND "tr_cmp") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (FLATTEN) (("" (SKOLEM!) (("" (FLATTEN) (("" (LEMMA "component_guar[X1,Y1]") (("" (INST?) (("" (EXPAND "guar_restriction") (("" (EXPAND "member") (("" (INST?) (("" (GROUND) (("" (EXPAND "tmap") (("" (INST?) (("" (EXPAND "member") (("" (PROPAX) NIL))))))))))))))))))))))))))))))))))))) (|tr_cmp_rely_hidd| "" (SKOLEM!) (("" (EXPAND "rely_hidd_restriction") (("" (EXPAND "subset?") (("" (EXPAND "member") (("" (SKOSIMP*) (("" (EXPAND "tr_cmp") (("" (EXPAND "tr_ac") (("" (GROUND) (("" (LEMMA "component_rely_hidd[X1,Y1]") (("" (INST?) (("" (EXPAND "rely_hidd_restriction") (("" (EXPAND "subset?") (("" (GROUND) (("" (EXPAND "union") (("" (EXPAND "member") (("" (SKOSIMP*) (("" (GROUND) (("" (SKOSIMP*) (("" (INST?) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))) (|tr_cmp_hidd| "" (SKOLEM!) (("" (EXPAND "hidd_restriction") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "tr_cmp") (("" (EXPAND "tr_ac") (("" (EXPAND "tmap") (("" (SKOSIMP*) (("" (LEMMA "component_hidd[X1,Y1]") (("" (INST?) (("" (EXPAND "hidd_restriction") (("" (INST?) (("" (GROUND) (("" (LEMMA "help3[Y1,Y]") (("" (EXPAND "member") (("" (EXPAND "union") (("" (EXPAND "member") (("" (SPLIT) (("1" (SKOSIMP*) (("1" (INSTANTIATE -5 ("yt!1" "x!1" "b!1" "ag!1")) (("1" (GROUND) (("1" (INSTANTIATE -6 ("a1!1" "a2!1")) (("1" (GROUND) NIL))))))))) ("2" (EXPAND "env_stutter") (("2" (EXPAND "member") (("2" (EXPAND "tmap") (("2" (FLATTEN) (("2" (EXPAND "member") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))) (|tr_cmp_cags| "" (SKOLEM!) (("" (EXPAND "cags_restriction") (("" (REWRITE "help1[Y1,Y]") (("" (EXPAND "tr_cmp") (("" (LEMMA "component_cags[X1,Y1]") (("" (INST?) (("" (EXPAND "cags_restriction") (("" (REWRITE "help1[Y1,Y1]") (("" (SKOLEM!) (("" (LEMMA "help4[Y1,Y]") (("" (INSTANTIATE -1 ("yt!1" "y!1")) (("" (SKOLEM!) (("" (INST?) (("" (EXPAND "tmap") (("" (EXPAND "member") (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))) (|tr_cmp_view_rely| "" (SKOSIMP*) (("" (USE "component_view_rely[X1,Y1]") (("" (LEMMA "tr_gen_view_restriction") (("" (INSTANTIATE -1 ("rely(cmp1!1)" "view(cmp1!1)" "xt!1" "yt!1")) (("" (EXPAND "view_rely_restriction") (("" (GROUND) (("" (EXPAND "tr_cmp") (("" (DELETE -2) (("" (EXPAND "gen_view_restriction") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "union") (("" (EXPAND "member") (("" (SPLIT) (("1" (INSTANTIATE -2 ("ag!1" "st1!1" "st2!1" "st3!1" "st4!1")) (("1" (GROUND) NIL))) ("2" (FLATTEN) (("2" (DELETE -2 1) (("2" (EXPAND "env_stutter") (("2" (GROUND) (("2" (LEMMA "square_view[X]") (("2" (INSTANTIATE -1 ("vmap(xt!1,view(cmp1!1))" "st1!1" "st2!1" "st3!1" "st4!1")) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))) (|tr_cmp_view_hidd| "" (SKOSIMP*) (("" (USE "component_view_hidd[X1,Y1]") (("" (LEMMA "tr_gen_view_restriction") (("" (INSTANTIATE -1 ("hidd(cmp1!1)" "view(cmp1!1)" "xt!1" "yt!1")) (("" (EXPAND "view_hidd_restriction") (("" (GROUND) (("" (EXPAND "tr_cmp") (("" (DELETE -2) (("" (EXPAND "gen_view_restriction") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "union") (("" (EXPAND "member") (("" (SPLIT) (("1" (INSTANTIATE -2 ("ag!1" "st1!1" "st2!1" "st3!1" "st4!1")) (("1" (GROUND) NIL))) ("2" (FLATTEN) (("2" (DELETE -2 1) (("2" (EXPAND "env_stutter") (("2" (GROUND) (("2" (LEMMA "square_view[X]") (("2" (INSTANTIATE -1 ("vmap(xt!1,view(cmp1!1))" "st1!1" "st2!1" "st3!1" "st4!1")) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))) (|tr_cmp_view_guar| "" (SKOLEM!) (("" (LEMMA "component_view_guar[X1,Y1]") (("" (INST?) (("" (EXPAND "view_guar_restriction") (("" (EXPAND "tr_cmp") (("" (REWRITE "tr_gen_view_restriction") NIL))))))))))) (|tr_cmp_view_init| "" (SKOSIMP*) (("" (LEMMA "component_view_init[X1,Y1]") (("" (INST?) (("" (EXPAND "view_init_restriction") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "tr_cmp") (("" (EXPAND "vmap") (("" (EXPAND "tmap") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (LEMMA "help3[X1,X]") (("" (INSTANTIATE -1 ("xt!1" "x1!1" "x!1" "st1!1")) (("" (INST?) (("" (GROUND) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))) (|tr_cmp_view_wfar| "" (SKOLEM!) (("" (USE "component_view_wfar[X1,Y1]") (("" (EXPAND "view_wfar_restriction") (("" (SKOSIMP*) (("" (EXPAND "member" -2) (("" (EXPAND "tr_cmp") (("" (EXPAND "tr_tcs") (("" (SKOSIMP*) (("" (INST?) (("" (REPLACE -3 1 RL :HIDE? -3) (("" (GROUND) (("" (REWRITE "tr_gen_view_restriction") NIL))))))))))))))))))))))) (|tr_cmp_view_sfar| "" (SKOLEM!) (("" (USE "component_view_sfar[X1,Y1]") (("" (EXPAND "view_sfar_restriction") (("" (SKOSIMP*) (("" (EXPAND "member" -2) (("" (EXPAND "tr_cmp") (("" (EXPAND "tr_tcs") (("" (SKOSIMP*) (("" (INST?) (("" (REPLACE -3 1 RL :HIDE? -3) (("" (GROUND) (("" (REWRITE "tr_gen_view_restriction") NIL))))))))))))))))))))))) (|tr_cmp_guar_stuttering| "" (SKOLEM!) (("" (USE "component_guar_stuttering[X1,Y1]") (("" (EXPAND "guar_stuttering_restriction") (("" (EXPAND "tr_cmp") (("" (REWRITE "tr_gen_stuttering_restriction") NIL))))))))) (|tr_cmp_rely_stuttering| "" (SKOLEM!) (("" (USE "component_rely_stuttering[X1,Y1]") (("" (EXPAND "rely_stuttering_restriction") (("" (LEMMA "tr_gen_stuttering_restriction") (("" (INSTANTIATE -1 ("complement(cags(cmp1!1))" "rely(cmp1!1)" "view(cmp1!1)" "xt!1" "yt!1")) (("" (EXPAND "tr_cmp") (("" (GROUND) (("" (DELETE -2) (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "union") (("" (EXPAND "member") (("" (FLATTEN) (("" (INST?) (("" (GROUND) (("" (EXPAND "env_stutter") (("" (EXPAND "member") (("" (EXPAND "complement" -) (("" (EXPAND "member") (("" (PROPAX) NIL))))))))))))))))))))))))))))))))))))))))) (|tr_cmp_type| "" (SKOLEM!) (("" (EXPAND "comp_t") (("" (REWRITE "tr_cmp_init") (("" (REWRITE "tr_cmp_guar") (("" (REWRITE "tr_cmp_rely_hidd") (("" (REWRITE "tr_cmp_hidd") (("" (REWRITE "tr_cmp_cags") (("" (REWRITE "tr_cmp_view_rely") (("" (REWRITE "tr_cmp_view_hidd") (("" (REWRITE "tr_cmp_view_guar") (("" (REWRITE "tr_cmp_view_init") (("" (REWRITE "tr_cmp_view_wfar") (("" (REWRITE "tr_cmp_view_sfar") (("" (REWRITE "tr_cmp_guar_stuttering") (("" (REWRITE "tr_cmp_rely_stuttering") (("" (GROUND) NIL))))))))))))))))))))))))))))))) (|tran_cmp_TCC1| "" (SKOLEM!) (("" (REWRITE "tr_cmp_type") NIL)))) $$$cmp_contains.pvs cmp_contains[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING component[ST, AG] cmp1, cmp2, cmp3: VAR (comp_t) cmp_contains(cmp1, cmp2): bool = subset?(init(cmp1), init(cmp2)) AND subset?(cags(cmp2), cags(cmp1)) AND subset?(guar(cmp1), steps(cmp2)) AND subset?(wfar(cmp2), wfar(cmp1)) AND subset?(sfar(cmp2), sfar(cmp1)) AND subset?(rely(cmp1), rely(cmp2)) AND subset?(hidd(cmp1), hidd(cmp2)) AND subset?(view(cmp1), view(cmp2)) cmp_contains_reflexive: THEOREM cmp_contains(cmp1, cmp1) cmp_contains_as_guar: THEOREM cmp_contains(cmp1, cmp2) AND cmp_contains(cmp2, cmp1) IMPLIES subset?(guar(cmp1), guar(cmp2)) cmp_contains_antisymmetric: THEOREM cmp_contains(cmp1, cmp2) AND cmp_contains(cmp2, cmp1) IMPLIES cmp1 = cmp2 cmp_contains_tr_guar: THEOREM cmp_contains(cmp1, cmp2) AND cmp_contains(cmp2, cmp3) IMPLIES subset?(guar(cmp1), steps(cmp3)) cmp_contains_transitive: THEOREM cmp_contains(cmp1, cmp2) AND cmp_contains(cmp2, cmp3) IMPLIES cmp_contains(cmp1, cmp3) cmp_contains_po: THEOREM partial_order?(cmp_contains) END cmp_contains $$$cmp_contains.prf (|cmp_contains| (|cmp_contains_reflexive| "" (SKOLEM!) (("" (EXPAND "cmp_contains") (("" (REWRITE "subset_reflexive") (("" (REWRITE "subset_reflexive") (("" (REWRITE "subset_reflexive") (("" (REWRITE "subset_reflexive") (("" (REWRITE "subset_reflexive[[ST,ST]]") (("" (REWRITE "subset_reflexive[TRANSITION_CLASS]") (("" (REWRITE "subset_reflexive[TRANSITION_CLASS]") (("" (EXPAND "subset?") (("" (EXPAND "steps") (("" (EXPAND "member") (("" (SKOSIMP*) (("" (GROUND) NIL))))))))))))))))))))))))))) (|cmp_contains_as_guar| "" (SKOSIMP*) (("" (CASE "not subset?(guar(cmp1!1),steps(cmp2!1))") (("1" (EXPAND "cmp_contains") (("1" (GROUND) NIL))) ("2" (CASE "steps(cmp2!1) /= union(guar(cmp2!1),rely(cmp2!1))") (("1" (FLATTEN) (("1" (EXTENSIONALITY "setof[[ST,ST,AG]]") (("1" (INST?) (("1" (GROUND) (("1" (SKOSIMP*) (("1" (EXPAND "steps") (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (CASE "rely(cmp2!1) /= rely(cmp1!1)") (("1" (FLATTEN) (("1" (EXPAND "cmp_contains") (("1" (REWRITE "subset_antisymmetric") NIL))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (CASE "forall (x:[ST,ST,AG]): member(x,guar(cmp1!1)) implies not member(x,rely(cmp1!1))") (("1" (EXPAND "subset?") (("1" (SKOSIMP*) (("1" (INST?) (("1" (INST?) (("1" (GROUND) (("1" (EXPAND "member" -1) (("1" (EXPAND "union") (("1" (PROPAX) NIL))))))))))))))) ("2" (DELETE -1 -2 -3 2) (("2" (SKOSIMP*) (("2" (LEMMA "component_guar") (("2" (INST?) (("2" (EXPAND "guar_restriction") (("2" (INSTANTIATE -1 ("PROJ_1(x!1)" "PROJ_2(x!1)" "PROJ_3(x!1)")) (("2" (GROUND) (("1" (LEMMA "component_rely") (("1" (INST?) (("1" (EXPAND "rely_restriction") (("1" (INSTANTIATE -1 ("PROJ_1(x!1)" "PROJ_2(x!1)" "PROJ_3(x!1)")) (("1" (GROUND) (("1" (EXPAND "member") (("1" (GROUND) NIL))))))))))))) ("2" (EXPAND "member") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))) (|cmp_contains_antisymmetric| "" (SKOSIMP*) (("" (LEMMA "cmp_contains_as_guar") (("" (INSTANTIATE -1 ("cmp1!1" "cmp2!1") T) (("" (INSTANTIATE -1 ("cmp2!1" "cmp1!1")) (("" (GROUND) (("" (EXTENSIONALITY "base_comp_t") (("" (INST?) (("" (EXPAND "cmp_contains") (("" (GROUND) (("1" (REWRITE "subset_antisymmetric") NIL) ("2" (REWRITE "subset_antisymmetric") NIL) ("3" (REWRITE "subset_antisymmetric") NIL) ("4" (REWRITE "subset_antisymmetric") NIL) ("5" (REWRITE "subset_antisymmetric") NIL) ("6" (REWRITE "subset_antisymmetric") NIL) ("7" (REWRITE "subset_antisymmetric") NIL) ("8" (REWRITE "subset_antisymmetric") NIL))))))))))))))))))) (|cmp_contains_tr_guar| "" (SKOSIMP*) (("" (CASE "not subset?(guar(cmp1!1),steps(cmp2!1))") (("1" (EXPAND "cmp_contains") (("1" (GROUND) NIL))) ("2" (CASE "not (forall (c: base_comp_t): steps(c) = union(guar(c),rely(c)))") (("1" (SKOSIMP*) (("1" (EXTENSIONALITY "setof[[ST,ST,AG]]") (("1" (INST?) (("1" (GROUND) (("1" (SKOSIMP*) (("1" (EXPAND "steps") (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))))))))) ("2" (INSTANTIATE -1 "cmp2!1" T) (("2" (REPLACE -2 :HIDE? -2) (("2" (INSTANTIATE -1 "cmp3!1") (("2" (CASE "not subset?(guar(cmp2!1),steps(cmp3!1)) or not subset?(rely(cmp2!1),rely(cmp3!1))") (("1" (EXPAND "cmp_contains") (("1" (GROUND) NIL))) ("2" (REPLACE -1 :HIDE? -1) (("2" (FLATTEN) (("2" (CASE "not subset?(union(guar(cmp2!1),rely(cmp2!1)),union(guar(cmp3!1),rely(cmp3!1)))") (("1" (DELETE -3 -4 -5 2) (("1" (EXPAND "subset?") (("1" (SKOSIMP*) (("1" (INST?) (("1" (INST?) (("1" (EXPAND "union") (("1" (EXPAND "member") (("1" (GROUND) NIL))))))))))))))) ("2" (DELETE -2 -3 -5 -6) (("2" (LEMMA "subset_transitive[[ST,ST,AG]]") (("2" (INSTANTIATE -1 ("guar(cmp1!1)" "union(guar(cmp2!1),rely(cmp2!1))" "union(guar(cmp3!1),rely(cmp3!1))")) (("2" (GROUND) NIL))))))))))))))))))))))))))) (|cmp_contains_transitive| "" (SKOSIMP*) (("" (LEMMA "cmp_contains_tr_guar") (("" (INSTANTIATE -1 ("cmp1!1" "cmp2!1" "cmp3!1")) (("" (GROUND) (("" (EXPAND "cmp_contains") (("" (GROUND) (("1" (LEMMA "subset_transitive[ST]") (("1" (INSTANTIATE -1 ("init(cmp1!1)" "init(cmp2!1)" "init(cmp3!1)")) (("1" (GROUND) NIL))))) ("2" (LEMMA "subset_transitive[AG]") (("2" (INSTANTIATE -1 ("cags(cmp3!1)" "cags(cmp2!1)" "cags(cmp1!1)")) (("2" (GROUND) NIL))))) ("3" (LEMMA "subset_transitive[TRANSITION_CLASS]") (("3" (INSTANTIATE -1 ("wfar(cmp3!1)" "wfar(cmp2!1)" "wfar(cmp1!1)")) (("3" (GROUND) NIL))))) ("4" (LEMMA "subset_transitive[TRANSITION_CLASS]") (("4" (INSTANTIATE -1 ("sfar(cmp3!1)" "sfar(cmp2!1)" "sfar(cmp1!1)")) (("4" (GROUND) NIL))))) ("5" (LEMMA "subset_transitive[[ST,ST,AG]]") (("5" (INSTANTIATE -1 ("rely(cmp1!1)" "rely(cmp2!1)" "rely(cmp3!1)")) (("5" (GROUND) NIL))))) ("6" (LEMMA "subset_transitive[[ST,ST,AG]]") (("6" (INSTANTIATE -1 ("hidd(cmp1!1)" "hidd(cmp2!1)" "hidd(cmp3!1)")) (("6" (GROUND) NIL))))) ("7" (LEMMA "subset_transitive[[ST,ST]]") (("7" (INSTANTIATE -1 ("view(cmp1!1)" "view(cmp2!1)" "view(cmp3!1)")) (("7" (GROUND) NIL))))))))))))))))) (|cmp_contains_po| "" (EXPAND "partial_order?") (("" (GROUND) (("1" (EXPAND "preorder?") (("1" (GROUND) (("1" (EXPAND "reflexive?") (("1" (SKOLEM!) (("1" (REWRITE "cmp_contains_reflexive") NIL))))) ("2" (EXPAND "transitive?") (("2" (SKOSIMP*) (("2" (LEMMA "cmp_contains_transitive") (("2" (INSTANTIATE -1 ("x!1" "y!1" "z!1")) (("2" (GROUND) NIL))))))))))))) ("2" (EXPAND "antisymmetric?") (("2" (SKOSIMP*) (("2" (REWRITE "cmp_contains_antisymmetric") NIL)))))))))) $$$cprops.pvs cprops[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING cmp_contains[ST, AG] IMPORTING props[ST, AG] cmp, cmp1, cmp2: VAR (comp_t) t: VAR trace_t n, i, j, k, l: VAR nat p: VAR prop_t st, st1, st2: VAR ST ag: VAR AG tranc, tranc1: VAR TRANSITION_CLASS initial_okay(cmp, t): bool = member((sts(t)(0)), init(cmp)) steps_okay(cmp, t): bool = (FORALL n: member((sts(t)(n), sts(t)(n + 1), ags(t)(n)), steps(cmp))) enabled(tranc, st1): bool = (EXISTS st2, ag: member((st1, st2, ag), tranc)) is_wfar(cmp, t): bool = (FORALL tranc: member(tranc, wfar(cmp)) IMPLIES (FORALL i: (EXISTS j: j > i AND (NOT enabled(tranc, sts(t)(j)) OR member((sts(t)(j), sts(t)(j + 1), ags(t)(j)), tranc))))) is_sfar(cmp, t): bool = (FORALL tranc: member(tranc, sfar(cmp)) IMPLIES (FORALL i: (EXISTS j: j > i AND ((FORALL k: k >= j IMPLIES NOT enabled(tranc, sts(t)(k))) OR (EXISTS l: l >= j AND member((sts(t)(l), sts(t)(l + 1), ags(t)(l)), tranc)))))) prop_for(cmp): prop_t = (LAMBDA t: initial_okay(cmp, t) AND steps_okay(cmp, t) AND is_wfar(cmp, t) AND is_sfar(cmp, t)) satisfies(cmp, p): bool = (FORALL t: prop_for(cmp)(t) IMPLIES p(t)) initial_okay_prop: THEOREM (FORALL st: member(st, init(cmp1)) IMPLIES member(st, init(cmp2))) AND initial_okay(cmp1, t) IMPLIES initial_okay(cmp2, t) steps_okay_prop: THEOREM (FORALL st1, st2, ag: member((st1, st2, ag), steps(cmp1)) IMPLIES member((st1, st2, ag), steps(cmp2))) AND steps_okay(cmp1, t) IMPLIES steps_okay(cmp2, t) is_wfar_prop: THEOREM (FORALL tranc: member(tranc, wfar(cmp2)) IMPLIES member(tranc, wfar(cmp1))) AND is_wfar(cmp1, t) IMPLIES is_wfar(cmp2, t) is_sfar_prop: THEOREM (FORALL tranc: member(tranc, sfar(cmp2)) IMPLIES member(tranc, sfar(cmp1))) AND is_sfar(cmp1, t) IMPLIES is_sfar(cmp2, t) satisfies_prop: THEOREM (FORALL st1, st2, ag: member((st1, st2, ag), steps(cmp1)) IMPLIES member((st1, st2, ag), steps(cmp2))) AND (FORALL st: member(st, init(cmp1)) IMPLIES member(st, init(cmp2))) AND (FORALL tranc: member(tranc, wfar(cmp2)) IMPLIES member(tranc, wfar(cmp1))) AND (FORALL tranc: member(tranc, sfar(cmp2)) IMPLIES member(tranc, sfar(cmp1))) AND satisfies(cmp2, p) IMPLIES satisfies(cmp1, p) satisfies_contains_prop: THEOREM satisfies(cmp2, p) AND cmp_contains(cmp1, cmp2) IMPLIES satisfies(cmp1, p) END cprops $$$cprops.prf (|cprops| (|initial_okay_prop| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "initial_okay") (("" (INST?) (("" (GROUND) NIL))))))))) (|steps_okay_prop| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "steps_okay") (("" (SKOLEM!) (("" (INST?) (("" (INST?) (("" (GROUND) NIL))))))))))))) (|is_wfar_prop| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "is_wfar") (("" (SKOSIMP*) (("" (INST?) (("" (GROUND) (("" (INST?) (("" (GROUND) (("" (INST?) NIL))))))))))))))))) (|is_sfar_prop| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "is_sfar") (("" (SKOLEM!) (("" (INST?) (("" (GROUND) (("" (INST?) (("" (GROUND) NIL))))))))))))))) (|satisfies_prop| "" (SKOLEM!) (("" (FLATTEN) (("" (EXPAND "satisfies") (("" (SKOLEM!) (("" (INSTANTIATE -5 "t!1") (("" (GROUND) (("" (DELETE 2) (("" (EXPAND "prop_for") (("" (GROUND) (("1" (LEMMA "initial_okay_prop") (("1" (INST?) (("1" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))))))))) ("2" (LEMMA "steps_okay_prop") (("2" (INST?) (("2" (INST?) (("2" (GROUND) NIL))))))) ("3" (LEMMA "is_wfar_prop") (("3" (INST?) (("3" (INST?) (("3" (GROUND) NIL))))))) ("4" (LEMMA "is_sfar_prop") (("4" (INST?) (("4" (INST?) (("4" (GROUND) NIL))))))))))))))))))))))))) (|satisfies_contains_prop| "" (SKOSIMP*) (("" (LEMMA "satisfies_prop") (("" (INSTANTIATE -1 ("cmp1!1" "cmp2!1" "p!1")) (("" (EXPAND "cmp_contains") (("" (GROUND) (("1" (EXPAND "subset?") (("1" (SKOSIMP*) (("1" (EXPAND "member") (("1" (EXPAND "steps") (("1" (SPLIT) (("1" (INSTANTIATE -5 "(st1!1,st2!1,ag!1)") (("1" (GROUND) NIL))) ("2" (INSTANTIATE -8 "(st1!1,st2!1,ag!1)") (("2" (GROUND) (("1" (EXPAND "intersection") (("1" (EXPAND "member") (("1" (GROUND) (("1" (INSTANTIATE -10 "(st1!1, st2!1, ag!1)") (("1" (GROUND) NIL))))))))) ("2" (EXPAND "intersection") (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))) ("3" (INSTANTIATE -10 "(st1!1,st2!1)") (("3" (GROUND) NIL))))))))))))) ("2" (EXPAND "subset?") (("2" (PROPAX) NIL))) ("3" (EXPAND "subset?") (("3" (PROPAX) NIL))) ("4" (EXPAND "subset?") (("4" (PROPAX) NIL)))))))))))))) $$$props.pvs props[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN trace_t: TYPE = [# sts: [nat -> ST], ags: [nat -> AG] #] prop_t: TYPE = setof[trace_t] END props $$$tprops.pvs tprops[ST: NONEMPTY_TYPE, ST1: NONEMPTY_TYPE, AG: NONEMPTY_TYPE, AG1: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING props[ST, AG] IMPORTING props[ST1, AG1] IMPORTING translators[ST1, ST] IMPORTING translators[AG1, AG] t1: VAR trace_t[ST1, AG1] t: VAR trace_t[ST, AG] p1: VAR prop_t[ST1, AG1] p2: VAR prop_t[ST1,AG1] p: VAR prop_t[ST, AG] sttran1: VAR (translator_t[ST1, ST]) agtran1: VAR (weak_translator_t[AG1, AG]) n: VAR nat bmap1_base(sttran1, agtran1): [trace_t[ST1, AG1] -> [trace_t[ST, AG] -> bool]] = (LAMBDA t1: (LAMBDA t: (FORALL n: sttran1(sts(t1)(n))(sts(t)(n)) AND agtran1(ags(t1)(n))(ags(t)(n))))) bmap1(sttran1, agtran1): (weak_translator_t[(trace_t[ST1, AG1]), (trace_t[ST, AG])]) = bmap1_base(sttran1, agtran1) bmap1_strong: THEOREM translator_t(agtran1) => translator_t[(trace_t[ST1, AG1]), (trace_t[ST, AG])](bmap1(sttran1,agtran1)) bmap(t1, sttran1, agtran1): setof[trace_t[ST, AG]] = bmap1(sttran1, agtran1)(t1) pmap1(sttran1, agtran1): [prop_t[ST1, AG1] -> prop_t[ST, AG]] = (LAMBDA p1: (LAMBDA t: (EXISTS t1: bmap(t1, sttran1, agtran1)(t) AND p1(t1)))) pmap(p1, sttran1, agtran1): prop_t[ST, AG] = pmap1(sttran1, agtran1)(p1) END tprops $$$tprops.prf (|tprops| (|bmap1_TCC1| "" (SKOLEM!) (("" (EXPAND "weak_translator_t") (("" (SPLIT) (("1" (SKOLEM!) (("1" (REWRITE "help1[trace_t[ST,AG],trace_t[ST,AG]]") (("1" (EXPAND "bmap1_base") (("1" (INST? 1 :SUBST ("y" "(#sts := (LAMBDA (i : nat): trone(sttran1!1,sts(x!1)(i))), ags := (LAMBDA (i : nat): trone(agtran1!1,ags(x!1)(i)))#)")) (("1" (SKOLEM!) (("1" (LEMMA "trone_def[ST1,ST]") (("1" (SPLIT) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (DELETE -1) (("2" (LEMMA "trone_def[AG1,AG]") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))) ("2" (SKOLEM!) (("2" (FLATTEN) (("2" (LEMMA "help1[trace_t[ST,AG],trace_t[ST,AG]]") (("2" (INST? -1 :SUBST ("s1" "intersection(bmap1_base(sttran1!1, agtran1!1)(x1!1), bmap1_base(sttran1!1, agtran1!1)(x2!1))")) (("2" (GROUND) (("2" (DELETE 1 3) (("2" (SKOLEM!) (("2" (EXPAND "intersection") (("2" (EXPAND "member") (("2" (EXPAND "bmap1_base") (("2" (FLATTEN) (("2" (EXTENSIONALITY "trace_t[ST1,AG1]") (("2" (INST? -1) (("2" (GROUND) (("1" (DELETE 2) (("1" (EXTENSIONALITY "[nat->AG1]") (("1" (INST? -1) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (INST?) (("1" (INST?) (("1" (FLATTEN) (("1" (DELETE -1 -3) (("1" (LEMMA "help3[AG1,AG]") (("1" (INST?) (("1" (INST? -1 :SUBST ("x2" "ags(x2!1)(x!1)")) (("1" (GROUND) NIL))))))))))))))))))))))))))) ("2" (DELETE 2) (("2" (EXTENSIONALITY "[nat->ST1]") (("2" (INST? -1) (("2" (GROUND) (("2" (DELETE 2) (("2" (SKOLEM!) (("2" (INST?) (("2" (INST?) (("2" (FLATTEN) (("2" (DELETE -2 -4) (("2" (LEMMA "help3[ST1,ST]") (("2" (INST?) (("2" (INST? -1 ("x2" "sts(x2!1)(x!1)")) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|bmap1_strong| "" (SKOSIMP) (("" (EXPAND "translator_t") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "bmap1") (("" (EXPAND "bmap1_base") (("" (INST + "(# sts := (LAMBDA (n: nat) : (epsilon! (st: ST1): sttran1!1(st)(sts(y!1)(n)))), ags := (LAMBDA (n: nat) : (epsilon! (ag: AG1): agtran1!1(ag)(ags(y!1)(n)))) #)") (("" (SKOSIMP) (("" (SIMPLIFY) (("" (GROUND) (("1" (USE "epsilon_ax[ST1]") (("1" (GROUND) (("1" (USE "help5[ST1,ST]") NIL))))) ("2" (USE "epsilon_ax[AG1]") (("2" (GROUND) (("2" (INST? -) NIL)))))))))))))))))))))))))) $$$tcprops.pvs tcprops[ST: NONEMPTY_TYPE, ST1: NONEMPTY_TYPE, AG: NONEMPTY_TYPE, AG1: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING tprops IMPORTING cprops IMPORTING cmp_translators IMPORTING compose_idempotent tcmp: VAR (comp_t[ST,AG]) cmp: VAR (comp_t[ST1,AG1]) p1: VAR prop_t[ST1, AG1] p: VAR prop_t[ST, AG] t: VAR trace_t[ST, AG] t1: VAR trace_t[ST1, AG1] st1,st2: VAR ST1 st3,st4: VAR ST ag1: VAR AG1 ag2: VAR AG ags: VAR setof[AG1] sttran1: VAR (translator_t[ST1, ST]) agtran1: VAR (translator_t[AG1, AG]) preimage_initial_okay : THEOREM (bmap(t1, sttran1, agtran1)(t) AND initial_okay(tran_cmp(cmp, sttran1, agtran1), t)) IMPLIES initial_okay(cmp, t1) preimage_steps_okay : THEOREM (bmap(t1, sttran1, agtran1)(t) AND steps_okay(tran_cmp(cmp, sttran1, agtran1), t)) IMPLIES steps_okay(cmp, t1) preimage_is_wfar : THEOREM (bmap(t1, sttran1, agtran1)(t) AND is_wfar(tran_cmp(cmp, sttran1, agtran1), t)) IMPLIES is_wfar(cmp, t1) preimage_is_sfar : THEOREM (bmap(t1, sttran1, agtran1)(t) AND is_sfar(tran_cmp(cmp, sttran1, agtran1), t)) IMPLIES is_sfar(cmp, t1) prop_for_preimage: LEMMA prop_for(tran_cmp(cmp, sttran1, agtran1))(t) => (EXISTS (t1: trace_t[ST1, AG1]): bmap(t1, sttran1, agtran1)(t) AND prop_for(cmp)(t1)) tcprop1: LEMMA satisfies(cmp, p1) AND pmap(p1, sttran1, agtran1) = p AND tcmp = tran_cmp(cmp, sttran1, agtran1) => satisfies(compose(singleton(tcmp)), p) tolerates_cags_trans_prop: LEMMA ((FORALL st1, st2, ag1: hidd(cmp)(st1, st2, ag1) => ags(ag1) OR view(cmp)(st1, st2))) IMPLIES (hidd(tran_cmp(cmp,sttran1,agtran1))(st3, st4, ag2) => tmap(agtran1,ags)(ag2) OR view(tran_cmp(cmp,sttran1,agtran1))(st3, st4)) disjoint_cags: LEMMA (cags(tran_cmp(cmp, sttran1, agtran1))(ag2) AND tmap(agtran1, ags)(ag2)) => (EXISTS ag1: (cags(cmp)(ag1) AND ags(ag1))) END tcprops $$$tcprops.prf (|tcprops| (|preimage_initial_okay| "" (SKOSIMP) (("" (EXPAND "bmap") (("" (EXPAND "bmap1") (("" (EXPAND "bmap1_base") (("" (EXPAND "tran_cmp") (("" (GROUND) (("" (EXPAND "initial_okay") (("" (EXPAND "member") (("" (EXPAND "tr_cmp") (("" (EXPAND "tmap") (("" (SKOSIMP) (("" (EXPAND "member") (("" (INST - "0") (("" (LEMMA "help3[ST1,ST]") (("" (GROUND) (("" (CASE "x!1 = sts(t1!1)(0)") (("1" (GROUND) NIL) ("2" (INST?) (("2" (INST - "x!1") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))) (|preimage_steps_okay| "" (SKOSIMP) (("" (EXPAND "bmap") (("" (EXPAND "bmap1") (("" (EXPAND "bmap1_base") (("" (EXPAND "tran_cmp") (("" (GROUND) (("" (EXPAND "steps_okay") (("" (EXPAND "member") (("" (EXPAND "steps") (("" (EXPAND "tr_cmp") (("" (EXPAND "tr_ac") (("" (EXPAND "union") (("" (EXPAND "env_stutter") (("" (EXPAND "tmap") (("" (EXPAND "vmap") (("" (EXPAND "member") (("" (SKOSIMP) (("" (INST-CP - "n!1") (("" (INST - "1 + n!1") (("" (INST - "n!1") (("" (GROUND) (("1" (SKOSIMP) (("1" (LEMMA "help3[ST1,ST]") (("1" (LEMMA "help3[AG1,AG]") (("1" (CASE "a1!1 = sts(t1!1)(n!1)" "a2!1 = sts(t1!1)(1 + n!1)" "b!1 = ags(t1!1)(n!1)") (("1" (GROUND) NIL) ("2" (INST?) (("2" (INST?) (("2" (GROUND) NIL))))) ("3" (INST -3 "sttran1!1" "a2!1" "sts(t1!1)(1 + n!1)" "sts(t!1)(1 + n!1)") (("3" (GROUND) NIL))) ("4" (HIDE -1) (("4" (INST?) (("4" (INST?) (("4" (GROUND) NIL))))))))))))))) ("2" (SKOSIMP) (("2" (LEMMA "help3[AG1,AG]") (("2" (LEMMA "help3[ST1,ST]") (("2" (CASE "a1!1 = sts(t1!1)(n!1)" "a2!1 = sts(t1!1)(1 + n!1)" "b!1 = ags(t1!1)(n!1)") (("1" (GROUND) NIL) ("2" (INST? -4) (("2" (INST? -4) (("2" (GROUND) NIL))))) ("3" (INST? -2 :WHERE +) (("3" (INST? -) (("3" (GROUND) NIL))))) ("4" (INST? -) (("4" (INST? -) (("4" (GROUND) NIL))))))))))))) ("3" (SKOSIMP) (("3" (INST? +) (("3" (GROUND) (("3" (LEMMA "component_rely_stuttering[ST1,AG1]") (("3" (INST - "cmp!1") (("3" (EXPAND "rely_stuttering_restriction") (("3" (EXPAND "gen_stuttering_restriction") (("3" (EXPAND "member") (("3" (INST?) (("3" (EXPAND "complement") (("3" (EXPAND "member") (("3" (LEMMA "help3[ST1,ST]") (("3" (CASE "x1!1=sts(t1!1)(n!1)" "x2!1=sts(t1!1)(1 + n!1)") (("1" (GROUND) NIL) ("2" (INST? :WHERE +) (("2" (INST?) (("2" (GROUND) NIL))))) ("3" (INST?) (("3" (INST?) (("3" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|preimage_is_wfar| "" (SKOSIMP) (("" (EXPAND "bmap") (("" (EXPAND "bmap1") (("" (EXPAND "bmap1_base") (("" (EXPAND "tran_cmp") (("" (GROUND) (("" (EXPAND "is_wfar") (("" (EXPAND "member") (("" (EXPAND "tr_cmp") (("" (SKOSIMP*) (("" (EXPAND "tr_tcs") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (INST -2 "(LAMBDA (x1: ST, x2: ST), (y: AG): (EXISTS (a1: ST1), (a2: ST1), (b: AG1): (tranc!1(a1, a2, b) AND (sttran1!1(a1)(x1) AND (sttran1!1(a2)(x2) AND agtran1!1(b)(y))))))") (("" (GROUND) (("1" (INST? -) (("1" (SKOSIMP*) (("1" (GROUND) (("1" (INST? +) (("1" (GROUND) (("1" (EXPAND "enabled") (("1" (EXPAND "member") (("1" (SKOSIMP*) (("1" (INST 2 "epsilon! (s: ST): sttran1!1(st2!1)(s)" "epsilon! (a: AG): agtran1!1(ag!1)(a)") (("1" (INST? +) (("1" (GROUND) (("1" (INST? -) (("1" (GROUND) NIL))) ("2" (USE "epsilon_ax[ST]") (("2" (GROUND) (("2" (USE "help4[ST1,ST]") NIL))))) ("3" (USE "epsilon_ax[AG]") (("3" (GROUND) (("3" (USE "help4[AG1,AG]") NIL))))))))))))))))))))) ("2" (SKOSIMP) (("2" (INST? +) (("2" (GROUND) (("2" (CASE "a1!1=sts(t1!1)(j!1)" "a2!1=sts(t1!1)(1 + j!1)" "b!1=ags(t1!1)(j!1)") (("1" (GROUND) NIL) ("2" (INST - "j!1") (("2" (USE "help3[AG1,AG]") (("2" (GROUND) NIL))))) ("3" (INST - "1+j!1") (("3" (LEMMA "help3[ST1,ST]") (("3" (INST? - :WHERE +) (("3" (INST?) (("3" (GROUND) NIL))))))))) ("4" (INST - "j!1") (("4" (LEMMA "help3[ST1,ST]") (("4" (INST? - :WHERE +) (("4" (INST?) (("4" (GROUND) NIL))))))))))))))))))))))) ("2" (INST? +) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))) (|preimage_is_sfar| "" (SKOSIMP) (("" (EXPAND "bmap") (("" (EXPAND "bmap1") (("" (EXPAND "bmap1_base") (("" (EXPAND "tran_cmp") (("" (GROUND) (("" (EXPAND "is_sfar") (("" (EXPAND "member") (("" (EXPAND "tr_cmp") (("" (SKOSIMP*) (("" (EXPAND "tr_tcs") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (INST -2 "(LAMBDA (x1: ST, x2: ST), (y: AG): (EXISTS (a1: ST1), (a2: ST1), (b: AG1): (tranc!1(a1, a2, b) AND (sttran1!1(a1)(x1) AND (sttran1!1(a2)(x2) AND agtran1!1(b)(y))))))") (("" (GROUND) (("1" (INST? -) (("1" (SKOSIMP*) (("1" (GROUND) (("1" (INST? +) (("1" (GROUND) (("1" (SKOSIMP) (("1" (INST? -) (("1" (GROUND) (("1" (EXPAND "enabled") (("1" (EXPAND "member") (("1" (SKOSIMP) (("1" (INST + "epsilon! (s: ST): sttran1!1(st2!1)(s)" "epsilon! (a: AG): agtran1!1(ag!1)(a)") (("1" (INST? +) (("1" (GROUND) (("1" (INST? -) (("1" (GROUND) NIL))) ("2" (USE "epsilon_ax[ST]") (("2" (GROUND) (("2" (USE "help4[ST1,ST]") NIL))))) ("3" (USE "epsilon_ax[AG]") (("3" (GROUND) (("3" (USE "help4[AG1,AG]") NIL))))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (INST? +) (("2" (GROUND) (("2" (SKOSIMP) (("2" (INST + "l!1") (("2" (CASE "a1!1=sts(t1!1)(l!1)" "a2!1=sts(t1!1)(1 + l!1)" "b!1=ags(t1!1)(l!1)") (("1" (GROUND) NIL) ("2" (INST - "l!1") (("2" (USE "help3[AG1,AG]") (("2" (GROUND) NIL))))) ("3" (INST - "1+l!1") (("3" (LEMMA "help3[ST1,ST]") (("3" (INST? - :WHERE +) (("3" (INST?) (("3" (GROUND) NIL))))))))) ("4" (INST - "l!1") (("4" (LEMMA "help3[ST1,ST]") (("4" (INST? - :WHERE +) (("4" (INST?) (("4" (GROUND) NIL))))))))))))))))))))))))))) ("2" (INST? +) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))) (|prop_for_preimage| "" (SKOSIMP) (("" (EXPAND "prop_for") (("" (CASE "EXISTS (t1: trace_t[ST1, AG1]): (bmap(t1, sttran1!1, agtran1!1)(t!1))") (("1" (SKOSIMP) (("1" (INST?) (("1" (GROUND) (("1" (USE "preimage_initial_okay") (("1" (GROUND) NIL))) ("2" (USE "preimage_steps_okay") (("2" (GROUND) NIL))) ("3" (USE "preimage_is_wfar") (("3" (GROUND) NIL))) ("4" (USE "preimage_is_sfar") (("4" (GROUND) NIL))))))))) ("2" (HIDE -1 2) (("2" (EXPAND "bmap") (("2" (TYPEPRED "agtran1!1") (("2" (LEMMA "bmap1_strong[ST,ST1,AG,AG1]") (("2" (INST?) (("2" (GROUND) (("2" (HIDE -2 -3) (("2" (EXPAND "translator_t") (("2" (EXPAND "member") (("2" (INST? -) NIL))))))))))))))))))))))))) (|tcprop1_TCC1| "" (SKOSIMP) (("" (REWRITE "ci_composable") NIL))) (|tcprop1| "" (SKOSIMP) (("" (REWRITE "ci_component") (("" (REPLACE -3 :HIDE? T) (("" (EXPAND "satisfies") (("" (SKOSIMP) (("" (EXPAND "pmap") (("" (EXPAND "pmap1") (("" (GROUND) (("" (FORWARD-CHAIN "prop_for_preimage") (("" (REPLACE -3 :DIR RL :HIDE? T) (("" (SKOSIMP) (("" (GROUND) (("" (INST?) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))) (|tolerates_cags_trans_prop| "" (SKOSIMP) (("" (EXPAND "tran_cmp") (("" (EXPAND "tr_cmp") (("" (EXPAND "union") (("" (EXPAND "env_stutter") (("" (EXPAND "member") (("" (GROUND) (("" (EXPAND "tr_ac") (("" (SKOSIMP) (("" (EXPAND "member") (("" (INST?) (("" (GROUND) (("1" (EXPAND "tmap") (("1" (EXPAND "member") (("1" (INST?) (("1" (GROUND) NIL))))))) ("2" (EXPAND "vmap") (("2" (EXPAND "member") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))) (|disjoint_cags| "" (SKOSIMP) (("" (EXPAND "tran_cmp") (("" (EXPAND "tr_cmp") (("" (EXPAND "tmap") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (INST?) (("" (GROUND) (("" (CASE-REPLACE "x!1 = x!2") (("" (USE "help3[AG1, AG]") (("" (GROUND) NIL)))))))))))))))))))))) $$$translators.pvs translators[X: NONEMPTY_TYPE, Y: NONEMPTY_TYPE]: THEORY BEGIN base_translator_t: TYPE = [X -> setof[Y]] inv_translator_t: TYPE = [Y -> X] bt: VAR base_translator_t it: VAR inv_translator_t x, x1, x2: VAR X y, y1, y2: VAR Y weak_translator_t(bt): bool = (FORALL x: bt(x) /= emptyset) AND (FORALL x1, x2: x1 /= x2 IMPLIES intersection(bt(x1), bt(x2)) = emptyset) t: VAR (weak_translator_t) translator_t(t): bool = (FORALL y: (EXISTS x: member(y, t(x)))) t1: VAR (translator_t) r, s: VAR setof[X] tmap(bt, s): setof[Y] = (LAMBDA y: (EXISTS x: member(x, s) AND member(y, bt(x)))) s1: VAR setof[Y] help1: THEOREM s1 /= emptyset IFF (EXISTS y: s1(y)) help2: THEOREM s /= emptyset IMPLIES (EXISTS x: s(x)) help3: THEOREM t(x1)(y) AND t(x2)(y) IMPLIES x1 = x2 help4: THEOREM (EXISTS y: t(x)(y)) help5: THEOREM (EXISTS x: t1(x)(y)) tmap_union: THEOREM tmap(t, union(r, s)) = union(tmap(t, r), tmap(t, s)) tmap_intersection: THEOREM tmap(t, intersection(r, s)) = intersection(tmap(t, r), tmap(t, s)) trone(t, x): Y = choose(t(x)) trone_def: THEOREM t(x)(trone(t, x)) trinv(t1, y): X = choose(LAMBDA x: member(y,t1(x))) trinv_def: THEOREM t1(trinv(t1, y))(y) inv_trans_prop: THEOREM (FORALL x: bt(x) = {y | it(y) = x} AND (EXISTS y: it(y) = x)) => weak_translator_t(bt) AND translator_t(bt) END translators $$$translators.prf (|translators| (|help1| "" (SKOLEM!) (("" (LEMMA "emptyset_is_empty?[Y]") (("" (INST -1 "s1!1") (("" (EXPAND "empty?") (("" (EXPAND "member") (("" (GROUND) (("1" (SKOLEM!) (("1" (INST?) NIL))) ("2" (SKOLEM!) (("2" (INST?) NIL))))))))))))))) (|help2| "" (SKOLEM!) (("" (FLATTEN) (("" (REWRITE "emptyset_is_empty?" :DIR RL) (("" (EXPAND "empty?") (("" (EXPAND "member") (("" (SKOLEM!) (("" (INST?) NIL))))))))))))) (|help3| "" (SKOLEM!) (("" (FLATTEN) (("" (TYPEPRED "t!1") (("" (EXPAND "weak_translator_t") (("" (FLATTEN) (("" (DELETE -1) (("" (INST?) (("" (INST? -1 :SUBST ("x2" "x2!1")) (("" (GROUND) (("" (CASE "intersection(t!1(x1!1), t!1(x2!1))(y!1) = emptyset(y!1)") (("1" (DELETE -2) (("1" (EXPAND "intersection") (("1" (EXPAND "member") (("1" (EXPAND "emptyset") (("1" (PROPAX) NIL))))))))) ("2" (REPLACE -1) (("2" (PROPAX) NIL))))))))))))))))))))))) (|help4| "" (SKOLEM!) (("" (TYPEPRED "t!1") (("" (EXPAND "weak_translator_t") (("" (FLATTEN) (("" (DELETE -2 -3) (("" (INST?) (("" (REWRITE "help1") NIL))))))))))))) (|help5| "" (SKOLEM!) (("" (TYPEPRED "t1!1") (("" (EXPAND "translator_t") (("" (INST?) (("" (EXPAND "member") (("" (PROPAX) NIL))))))))))) (|tmap_union| "" (SKOLEM!) (("" (REWRITE "extensionality") (("" (HIDE 2) (("" (SKOLEM!) (("" (EXPAND "tmap") (("" (EXPAND "union") (("" (EXPAND "member") (("" (IFF) (("" (SPLIT) (("1" (FLATTEN) (("1" (SKOLEM!) (("1" (FLATTEN) (("1" (INST?) (("1" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))))))))))))) ("2" (FLATTEN) (("2" (SPLIT) (("1" (SKOLEM!) (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (SKOLEM!) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))) (|tmap_intersection| "" (SKOLEM!) (("" (REWRITE "extensionality") (("" (HIDE 2) (("" (SKOLEM!) (("" (EXPAND "tmap") (("" (EXPAND "intersection") (("" (IFF) (("" (EXPAND "member") (("" (SPLIT) (("1" (FLATTEN) (("1" (SKOLEM!) (("1" (FLATTEN) (("1" (SPLIT) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST?) (("2" (GROUND) NIL))))))))))) ("2" (FLATTEN) (("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) (("2" (LEMMA "help3") (("2" (INST?) (("2" (INST? :WHERE -5) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))) (|trone_TCC1| "" (SKOSIMP*) (("" (EXPAND "nonempty?") (("" (EXPAND "empty?") (("" (USE "help4") (("" (SKOLEM!) (("" (INST?) (("" (EXPAND "member") (("" (PROPAX) NIL))))))))))))))) (|trone_def| "" (SKOLEM!) (("" (EXPAND "trone") (("" (EXPAND "choose") (("" (LEMMA "epsilon_ax[Y]") (("" (INST?) (("" (GROUND) (("" (DELETE 2) (("" (LEMMA "help4") (("" (INST?) NIL))))))))))))))))) (|trinv_TCC1| "" (SKOLEM!) (("" (EXPAND "nonempty?") (("" (EXPAND "empty?") (("" (EXPAND "member") (("" (USE "help5") (("" (INSTANTIATE -1 ("t1!1" "y!1")) (("" (SKOLEM!) (("" (INST?) NIL))))))))))))))) (|trinv_def| "" (SKOLEM!) (("" (EXPAND "trinv") (("" (EXPAND "choose") (("" (EXPAND "member") (("" (LEMMA "epsilon_ax[X]") (("" (INST?) (("" (GROUND) (("" (LEMMA "help5") (("" (INST?) NIL))))))))))))))))) (|inv_trans_prop| "" (SKOSIMP*) (("" (GROUND) (("1" (EXPAND "weak_translator_t") (("1" (GROUND) (("1" (SKOSIMP) (("1" (INST? -) (("1" (GROUND) (("1" (SKOSIMP) (("1" (REWRITE "emptyset_is_empty?" :DIR RL) (("1" (EXPAND "empty?") (("1" (EXPAND "member") (("1" (INST?) (("1" (REPLACE -1) (("1" (GROUND) NIL))))))))))))))))))) ("2" (SKOSIMP) (("2" (REWRITE "emptyset_is_empty?" :DIR RL) (("2" (EXPAND "intersection") (("2" (EXPAND "empty?") (("2" (EXPAND "member") (("2" (SKOSIMP) (("2" (COPY -3) (("2" (INST?) (("2" (INST - "x2!1") (("2" (GROUND) (("2" (REPLACE -1 :HIDE? T) (("2" (REPLACE -4 :HIDE? T) (("2" (GROUND) NIL))))))))))))))))))))))))))))) ("2" (EXPAND "translator_t") (("2" (SKOSIMP*) (("2" (EXPAND "member") (("2" (INST * "it!1(y!1)") (("2" (INST * "it!1(y!1)") (("2" (GROUND) (("2" (REPLACE -1) (("2" (GROUND) NIL)))))))))))))))))))) $$$idtran.pvs idtran[X: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING translators[X,X] x, y : VAR X idt: (translator_t) = (LAMBDA x: {y | y = x}) END idtran $$$idtran.prf (|idtran| (|idt_TCC1| "" (EXPAND "translator_t") (("" (EXPAND "weak_translator_t") (("" (EXPAND "intersection") (("" (EXPAND "member") (("" (GROUND) (("1" (SKOSIMP) (("1" (REWRITE "emptyset_is_empty?" :DIR RL) (("1" (EXPAND "empty?") (("1" (INST - "x!1") (("1" (EXPAND "member") (("1" (PROPAX) NIL))))))))))) ("2" (SKOSIMP) (("2" (REWRITE "emptyset_is_empty?" :DIR RL) (("2" (EXPAND "empty?") (("2" (SKOSIMP) (("2" (EXPAND "member") (("2" (GROUND) NIL))))))))))) ("3" (SKOSIMP) (("3" (INST?) NIL)))))))))))))) $$$disjoint_sets.pvs disjoint_sets [X: TYPE, IDX: TYPE+] : THEORY BEGIN a,b,s,t : VAR setof[X] x: VAR X n : VAR nat i,j : VAR IDX f: VAR [IDX -> setof[X]] subsets_disjoint : LEMMA subset?(a,s) and subset?(b,t) and disjoint?(s,t) IMPLIES disjoint?(a,b) disjoint?_commutative : LEMMA disjoint?(a,b) IMPLIES disjoint?(b,a) pairwise_disjoint: setof[[IDX -> setof[X]]] = {seq: [IDX -> setof[X]] | (FORALL i, j, x: seq(i)(x) AND seq(j)(x) => i = j)} pairwise_disjoint_prop: LEMMA pairwise_disjoint(f) AND f(i)(x) AND f(j)(x) => i = j END disjoint_sets $$$disjoint_sets.prf (|disjoint_sets| (|subsets_disjoint| "" (SKOSIMP) (("" (EXPAND "disjoint?") (("" (EXPAND "intersection") (("" (EXPAND "subset?") (("" (EXPAND "empty?") (("" (EXPAND "member") (("" (SKOSIMP) (("" (INST?) (("" (INST?) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))) (|disjoint?_commutative| "" (SKOSIMP) (("" (EXPAND "disjoint?") (("" (REWRITE "intersection_commutative") NIL))))) (|pairwise_disjoint_prop| "" (SKOSIMP) (("" (EXPAND "pairwise_disjoint") (("" (INST?) (("" (INST?) (("" (GROUND) NIL)))))))))) $$$security_server_state_witness.pvs security_server_state_witness: THEORY BEGIN IMPORTING security_server_state ss_state_witness: (SS_STATE) = (# valid_sids := emptyset[SID], valid_object_sids := emptyset[SID], valid_subject_sids := emptyset[SID], sid_class := (LAMBDA (x: (emptyset[SID])): subject_class), sid_to_ssc := (LAMBDA (x: (emptyset[SID])): ssc_witness), sid_to_osc := (LAMBDA (x: (emptyset[SID])): osc_witness), sid_to_aid := (LAMBDA (x: (emptyset[SID])): aid_witness), ddt := (LAMBDA (x: [DOMAIN, LEVEL, TYP, LEVEL]): emptyset[PERMISSION]), cached_aids := emptyset[AID], aid_to_user := (LAMBDA (x: (emptyset[AID])): user_witness), known_users := emptyset[USER], allowed_levels := (LAMBDA (x: (emptyset[USER])): emptyset[LEVEL]), allowed_domains := (LAMBDA (x: (emptyset[USER])): emptyset[DOMAIN]), ccu_privileged := emptyset[DOMAIN], ss_service_ports := emptyset[NAME], ss_host_name := null_name, ss_reply_port := null_name, kst := empty_kst #) ss_state_witness_prop: THEOREM (EXISTS (ssstb: (SS_STATE)): TRUE) END security_server_state_witness $$$security_server_state_witness.prf (|security_server_state_witness| (|ss_state_witness_TCC1| "" (EXPAND "SS_STATE") (("" (EXPAND "empty_kst") (("" (GROUND) (("1" (REWRITE "union_empty") NIL) ("2" (EXPAND "emptyset") (("2" (PROPAX) NIL))) ("3" (EXPAND "emptyset") (("3" (PROPAX) NIL))) ("4" (REWRITE "subset_emptyset") NIL))))))) (|ss_state_witness_prop| "" (INST 1 "ss_state_witness") NIL)) $$$security_server_rely.pvs security_server_rely : THEORY BEGIN IMPORTING dtos_kernel_shared_rely IMPORTING security_server_state st1, st2 : VAR (SS_STATE) ag : VAR THREAD ss_environment(st1,st2,ag) : bool = environment_base(ag,kst(st1),kst(st2)) and st1 with [kst := kst(st2)] = st2 ss_environment_refl: THEOREM ss_environment(st1,st1,ag) ss_hidd(st1,st2,ag) : bool = NOT ss_threads(ag) AND hidd_base(ag, kst(st1), kst(st2)) AND st2 = st1 WITH [ kst := kst(st2) ] ss_hidd_prop: THEOREM ss_hidd(st1,st2,ag) => k_threads(ag) OR ss_view(st1,st2) ss_rely(st1,st2,ag) : bool = not ss_threads(ag) AND ss_environment(st1,st2,ag) END security_server_rely $$$security_server_state.pvs security_server_state: THEORY BEGIN IMPORTING dtos_kernel_shared_ops CLASS: NONEMPTY_TYPE subject_class: CLASS DOMAIN: NONEMPTY_TYPE domain_witness: DOMAIN TYP: NONEMPTY_TYPE typ_witness: TYP LEVEL: NONEMPTY_TYPE level_witness: LEVEL SSC: TYPE = [# dmn: DOMAIN, lvl: LEVEL #] ssc_witness: SSC = (# dmn := domain_witness, lvl := level_witness #) OSC: TYPE = [# typ: TYP, lvl: LEVEL #] osc_witness: OSC = (# typ := typ_witness, lvl := level_witness #) AID: NONEMPTY_TYPE aid_witness: AID USER: NONEMPTY_TYPE user_witness: USER ss_threads: setof[THREAD] ss_threads_nonempty: AXIOM ss_threads /= emptyset ss_threads_witness: (ss_threads) SS_STATE_BASE: TYPE = [# valid_sids: setof[SID], valid_object_sids: setof[SID], valid_subject_sids: setof[SID], sid_class: [(valid_sids) -> CLASS], sid_to_ssc: [(valid_subject_sids) -> SSC], sid_to_osc: [(valid_object_sids) -> OSC], sid_to_aid: [(valid_sids) -> AID], ddt: [[DOMAIN, LEVEL, TYP, LEVEL] -> ACCESS_VECTOR], cached_aids: setof[AID], aid_to_user: [(cached_aids) -> USER], known_users: setof[USER], allowed_levels: [(known_users) -> setof[LEVEL]], allowed_domains: [(known_users) -> setof[DOMAIN]], ccu_privileged: setof[DOMAIN], ss_service_ports: setof[NAME], ss_host_name: NAME, ss_reply_port: NAME, kst: KERNEL_SHARED_STATE #] ssstb: VAR SS_STATE_BASE sid: VAR SID SS_STATE(ssstb): bool = (valid_sids(ssstb) = union(valid_object_sids(ssstb), valid_subject_sids(ssstb)) AND valid_object_sids(ssstb) = (LAMBDA sid: valid_sids(ssstb)(sid) AND sid_class(ssstb)(sid) /= subject_class) AND valid_subject_sids(ssstb) = (LAMBDA sid: valid_sids(ssstb)(sid) AND sid_class(ssstb)(sid) = subject_class) AND subset?(existing_threads(kst(ssstb)), ss_threads)) sst1, sst2: VAR (SS_STATE) ss_threads_prop: THEOREM subset?(existing_threads(kst(sst1)), ss_threads) ss_view(sst1,sst2) : bool = sst1 = sst2 sss: VAR (SS_STATE) valid_subject_sid_def: LEMMA valid_subject_sids(sss)(sid) = (valid_sids(sss)(sid) AND sid_class(sss)(sid) = subject_class) valid_object_sid_def: LEMMA valid_object_sids(sss)(sid) = (valid_sids(sss)(sid) AND sid_class(sss)(sid) /= subject_class) END security_server_state $$$security_server_state.prf (|security_server_state| (|ss_threads_witness_TCC1| "" (LEMMA "ss_threads_nonempty") (("" (LEMMA "emptyset_is_empty?[THREAD]") (("" (LEMMA "nonempty_exists[THREAD]") (("" (INST?) (("" (INST?) (("" (FLATTEN) (("" (EXPAND "nonempty?") (("" (GROUND) NIL))))))))))))))) (|ss_threads_prop| "" (SKOSIMP) (("" (TYPEPRED "sst1!1") (("" (EXPAND "SS_STATE") (("" (GROUND) NIL))))))) (|valid_subject_sid_def| "" (SKOLEM!) (("" (TYPEPRED "sss!1") (("" (EXPAND "SS_STATE") (("" (FLATTEN) (("" (REPLACE -3) (("" (BETA) (("" (PROPAX) NIL))))))))))))) (|valid_object_sid_def| "" (SKOLEM!) (("" (TYPEPRED "sss!1") (("" (EXPAND "SS_STATE") (("" (FLATTEN) (("" (REPLACE -2) (("" (BETA) (("" (PROPAX) NIL)))))))))))))) $$$security_server_ops.pvs security_server_ops: THEORY BEGIN IMPORTING security_server_state st, st1, st2: VAR (SS_STATE) ag: VAR THREAD ss_static(st1, st2): bool = valid_sids(st1) = valid_sids(st2) AND sid_class(st1) = sid_class(st2) AND valid_subject_sids(st1) = valid_subject_sids(st2) AND sid_to_ssc(st1) = sid_to_ssc(st2) AND valid_object_sids(st1) = valid_object_sids(st2) AND sid_to_osc(st1) = sid_to_osc(st2) AND known_users(st1) = known_users(st2) AND allowed_levels(st1) = allowed_levels(st2) AND sid_to_aid(st1) = sid_to_aid(st2) AND ddt(st1) = ddt(st2) AND allowed_domains(st1) = allowed_domains(st2) AND ccu_privileged(st1) = ccu_privileged(st2) AND ss_service_ports(st1) = ss_service_ports(st2) AND ss_host_name(st1) = ss_host_name(st2) AND ss_reply_port(st1) = ss_reply_port(st2) ss_step(st1, st2): bool = ss_static(st1, st2) AND effects_on_kernel_state(kst(st1), kst(st2), ss_threads) thread: VAR THREAD name: VAR NAME ss_receive_request(st1, st2): bool = ss_step(st1, st2) AND cached_aids(st1) = cached_aids(st2) AND aid_to_user(st1) = aid_to_user(st2) AND existing_threads(kst(st1)) = existing_threads(kst(st2)) AND received_info(kst(st1)) = received_info(kst(st2)) AND (EXISTS thread, name: ss_threads(thread) AND ss_service_ports(st1)(name) AND existing_threads(kst(st1))(thread) AND thread_status(kst(st1))(thread) = thread_running AND existing_threads(kst(st2))(thread) AND thread_status(kst(st2)) = thread_status(kst(st1)) WITH [thread := thread_waiting] AND pending_requests(kst(st2)) = add(receive_message_req(thread, name), pending_requests(kst(st1)))) ssi, osi: VAR SID base_allowed(ssi, osi, st): ACCESS_VECTOR = IF (valid_subject_sids(st)(ssi) AND valid_object_sids(st)(osi)) THEN LET ssc: SSC = sid_to_ssc(st)(ssi), osc: OSC = sid_to_osc(st)(osi) IN ddt(st)(dmn(ssc), lvl(ssc), typ(osc), lvl(osc)) ELSE emptyset[PERMISSION] ENDIF perm: VAR PERMISSION allowed(ssi, osi, st): ACCESS_VECTOR = IF NOT valid_object_sids(st)(osi) OR (valid_sids(st)(osi) AND sid_class(st)(osi) /= subject_class) OR NOT valid_subject_sids(st)(ssi) THEN base_allowed(ssi, osi, st) ELSIF (valid_sids(st)(ssi) AND NOT cached_aids(st)(sid_to_aid(st)(ssi))) OR (valid_sids(st)(osi) AND NOT cached_aids(st)(sid_to_aid(st)(osi))) THEN emptyset[PERMISSION] ELSIF aid_to_user(st)(sid_to_aid(st)(ssi)) /= aid_to_user(st)(sid_to_aid(st)(osi)) AND NOT ccu_privileged(st)(dmn(sid_to_ssc(st)(ssi))) THEN (LAMBDA perm: base_allowed(ssi, osi, st)(perm) AND perm /= create_task_perm AND perm /= create_task_secure_perm) ELSE base_allowed(ssi, osi, st) ENDIF compute_access_op: OP compute_access_perm: PERMISSION sid_sid_to_data: [[SID, SID] -> DATA] sid_sid_av_to_data: [[SID, SID, ACCESS_VECTOR] -> DATA] av: VAR ACCESS_VECTOR compute_access_msg(ssi, osi): USER_MSG = null_user_msg WITH [user_data := sid_sid_to_data(ssi, osi), user_rights := null_seq] provide_access_msg(ssi, osi, av): USER_MSG = null_user_msg WITH [user_data := sid_sid_av_to_data(ssi, osi, av), user_rights := null_seq] ss_compute_access(st1, st2): bool = ss_step(st1, st2) AND (EXISTS ssi, osi: (NOT valid_sids(st1)(ssi) OR cached_aids(st1)(sid_to_aid(st1)(ssi))) AND (NOT valid_sids(st1)(osi) OR cached_aids(st1)(sid_to_aid(st1)(osi))) AND make_service_request(ss_threads, ss_service_ports(st1), ss_reply_port(st1), compute_access_op, compute_access_perm, compute_access_msg(ssi, osi), provide_access_msg(ssi, osi, allowed(ssi, osi, st1)), kst(st1), kst(st2))) AND cached_aids(st1) = cached_aids(st2) AND aid_to_user(st1) = aid_to_user(st2) load_user_op: OP load_user_perm: PERMISSION aid_user_to_data: [[AID, USER] -> DATA] aid, aid1: VAR AID user: VAR USER load_user_msg(aid, user): USER_MSG = null_user_msg WITH [user_data := aid_user_to_data(aid, user), user_rights := null_seq] ri: VAR RECEIVED_INFO ss_load_user(st1, st2): bool = (EXISTS thread, ri, aid, user: ss_threads(thread) AND process_request(thread, kst_to_ti(kst(st1)), kst_to_ti(kst(st2))) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) AND thread_status(kst(st2)) = thread_status(kst(st1)) AND existing_threads(kst(st1))(thread) AND thread_status(kst(st1))(thread) = thread_running AND ri = received_info(kst(st1))(thread) AND ss_service_ports(st1)(service_port(ri)) AND ri_status(ri) = ri_unprocessed AND sending_av(ri)(load_user_perm) AND op(ri) = load_user_op AND load_user_msg(aid, user) = user_msg(ri) AND cached_aids(st2) = union(cached_aids(st1), {x: AID | x = aid}) AND cached_aids(st2)(aid) AND aid_to_user(st2) = aid_to_user(st1) WITH [aid := user] AND pending_requests(kst(st2)) = pending_requests(kst(st1))) ss_op(st1, st2) : bool = ss_receive_request(st1,st2) or ss_compute_access(st1,st2) or ss_load_user(st1,st2) ss_guar(st1,st2,ag) : bool = ss_threads(ag) AND (ss_view(st1, st2) OR (ss_step(st1, st2) AND ss_op(st1, st2))) END security_server_ops $$$security_server_ops.prf (|security_server_ops| (|ss_static_TCC1| "" (SKOSIMP*) (("" (TYPEPRED "y1!1") (("" (TYPEPRED "x1!1") (("" (GROUND) NIL))))))) (|ss_static_TCC2| "" (SKOSIMP*) (("" (HIDE -1 -2) (("" (TYPEPRED "y1!1") (("" (TYPEPRED "x1!1") (("" (GROUND) NIL))))))))) (|ss_static_TCC3| "" (SUBTYPE-TCC) NIL) (|ss_static_TCC4| "" (SKOSIMP*) (("" (TYPEPRED "y1!1") (("" (TYPEPRED "x1!1") (("" (GROUND) NIL))))))) (|ss_receive_request_TCC1| "" (SKOSIMP*) (("" (TYPEPRED "y1!1") (("" (TYPEPRED "x1!1") (("" (GROUND) NIL))))))) (|ss_receive_request_TCC2| "" (SKOSIMP*) (("" (TYPEPRED "y1!1") (("" (TYPEPRED "x1!1") (("" (GROUND) NIL))))))) (|base_allowed_TCC1| "" (SKOSIMP*) NIL) (|base_allowed_TCC2| "" (SKOSIMP*) NIL) (|allowed_TCC1| "" (SKOSIMP*) (("" (HIDE -1 1 2 3) (("" (REWRITE "valid_subject_sid_def") (("" (GROUND) NIL))))))) (|allowed_TCC2| "" (SKOSIMP*) (("" (HIDE -2 2 3 4) (("" (REWRITE "valid_object_sid_def") NIL))))) (|allowed_TCC3| "" (SUBTYPE-TCC) NIL) (|allowed_TCC4| "" (SUBTYPE-TCC) NIL) (|ss_compute_access_TCC1| "" (SKOSIMP*) NIL) (|ss_compute_access_TCC2| "" (SKOSIMP*) NIL) (|ss_load_user_TCC1| "" (SKOSIMP*) (("" (TYPEPRED "y1!1") (("" (TYPEPRED "x1!1") (("" (GROUND) NIL)))))))) $$$security_server_spec.pvs security_server_spec : THEORY BEGIN IMPORTING dtos_kernel_shared_state IMPORTING security_server_ops IMPORTING security_server_rely IMPORTING security_server_state_witness IMPORTING component_aux[(SS_STATE),THREAD] sst, sst1, sst2 : VAR (SS_STATE) ag : VAR THREAD %% This is only a partial definition. In particular we need to place %% requirements on ddt to ensure that the system components can work %% together. initial_ss_states(sst) : bool = cached_aids(sst) = emptyset[AID] AND pending_requests(kst(sst)) = emptyset[KERNEL_REQ] AND (FORALL ag : existing_threads(kst(sst))(ag) => ri_status(received_info(kst(sst))(ag)) = ri_processed) ss_state_witness_initial: THEOREM initial_ss_states(ss_state_witness) base_ss_comp : base_comp_t = (# init := initial_ss_states, guar := ss_guar, rely := ss_rely, hidd := ss_hidd, cags := ss_threads, view := ss_view, wfar := emptyset[TRANSITION_CLASS[(SS_STATE), THREAD]], sfar := emptyset[TRANSITION_CLASS[(SS_STATE), THREAD]] #) ss_view_eq: THEOREM view_eq(base_ss_comp) ss_comp_init: THEOREM init_restriction(base_ss_comp) ss_comp_guar: THEOREM guar_restriction(base_ss_comp) ss_comp_rely_hidd: THEOREM rely_hidd_restriction(base_ss_comp) ss_comp_hidd: THEOREM hidd_restriction(base_ss_comp) ss_comp_rely: THEOREM rely_restriction(base_ss_comp) ss_comp_cags: THEOREM cags_restriction(base_ss_comp) ss_comp_guar_stuttering: THEOREM guar_stuttering_restriction(base_ss_comp) ss_comp_rely_stuttering: THEOREM rely_stuttering_restriction(base_ss_comp) ss_comp : (comp_t) = base_ss_comp ss_comp_hidd_prop: THEOREM hidd(ss_comp)(sst1, sst2, ag) => k_threads(ag) OR view(ss_comp)(sst1, sst2) END security_server_spec $$$security_server_spec.prf (|security_server_spec| (IMPORTING5_TCC1 "" (INST + "ss_state_witness") NIL) (|ss_state_witness_initial| "" (EXPAND "initial_ss_states") (("" (EXPAND "ss_state_witness") (("" (EXPAND "empty_kst") (("" (EXPAND "emptyset") (("" (PROPAX) NIL))))))))) (|base_ss_comp_TCC1| "" (REWRITE "eq_view2") (("" (EXPAND "ss_view") (("" (PROPAX) NIL))))) (|ss_view_eq| "" (EXPAND "view_eq") (("" (EXPAND "base_ss_comp") (("" (SKOSIMP) (("" (EXPAND "ss_view") (("" (PROPAX) NIL))))))))) (|ss_comp_init| "" (EXPAND "init_restriction") (("" (EXPAND "base_ss_comp") (("" (GROUND) (("" (USE "emptyset_is_empty?[(SS_STATE)]") (("" (GROUND) (("" (EXPAND "empty?") (("" (EXPAND "member") (("" (INST - "ss_state_witness") (("" (REWRITE "ss_state_witness_initial") NIL))))))))))))))))) (|ss_comp_guar| "" (EXPAND "guar_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_ss_comp") (("" (GROUND) (("" (EXPAND "ss_guar") (("" (PROPAX) NIL))))))))))))) (|ss_comp_rely_hidd| "" (EXPAND "rely_hidd_restriction") (("" (EXPAND "subset?") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_ss_comp") (("" (EXPAND "ss_rely") (("" (GROUND) (("" (EXPAND "ss_hidd") (("" (EXPAND "ss_environment") (("" (REWRITE "hidd_base_prop") (("" (GROUND) NIL))))))))))))))))))))) (|ss_comp_hidd| "" (EXPAND "hidd_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_ss_comp") (("" (GROUND) (("" (EXPAND "ss_hidd") (("" (PROPAX) NIL))))))))))))) (|ss_comp_rely| "" (EXPAND "rely_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_ss_comp") (("" (EXPAND "ss_rely") (("" (GROUND) NIL))))))))))) (|ss_comp_cags| "" (EXPAND "cags_restriction") (("" (EXPAND "base_ss_comp") (("" (REWRITE "ss_threads_nonempty") NIL))))) (|ss_comp_guar_stuttering| "" (EXPAND "guar_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_ss_comp") (("" (EXPAND "ss_guar") (("" (GROUND) NIL))))))))))))) (|ss_comp_rely_stuttering| "" (EXPAND "rely_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_ss_comp") (("" (EXPAND "ss_rely") (("" (EXPAND "complement") (("" (EXPAND "member") (("" (EXPAND "ss_view") (("" (GROUND) (("" (REPLACE -1) (("" (REWRITE "ss_environment_refl") NIL))))))))))))))))))))))) (|ss_comp_TCC1| "" (USE "ss_view_eq") (("" (USE "ss_comp_init") (("" (USE "ss_comp_guar") (("" (USE "ss_comp_rely_hidd") (("" (USE "ss_comp_hidd") (("" (USE "ss_comp_cags") (("" (USE "ss_comp_guar_stuttering") (("" (USE "ss_comp_rely_stuttering") (("" (REWRITE "component_view_eq_thm") NIL))))))))))))))))) (|ss_comp_hidd_prop| "" (EXPAND "ss_comp") (("" (EXPAND "base_ss_comp") (("" (USE "ss_hidd_prop") NIL)))))) $$$client_state_witness.pvs client_state_witness: THEORY BEGIN IMPORTING client_state th: VAR (client_threads) client_thread_state_witness: (CLIENT_THREAD_STATE) = (# reply_port := epsilon(fullset[NAME]), situation := epsilon(fullset[SITUATION]), requested_prot_family := epsilon(fullset[PROT_FAMILY]), ssups := epsilon(fullset[NAME]), cc := epsilon(fullset[NAME]), pf_handle_provided := false, handle := null_name, clear_text_sent := null_text, reply_received := true, cypher_text_received := null_text #) client_state_witness: (CLIENT_STATE) = (# thst := (LAMBDA th : client_thread_state_witness), kst := empty_kst #) client_state_witness_prop : THEOREM (EXISTS (base : (CLIENT_STATE)) : TRUE) END client_state_witness $$$client_state_witness.prf (|client_state_witness| (|client_thread_state_witness_TCC1| "" (EXPAND "CLIENT_THREAD_STATE") (("" (PROPAX) NIL))) (|client_state_witness_TCC1| "" (EXPAND "CLIENT_STATE") (("" (EXPAND "empty_kst") (("" (REWRITE "subset_emptyset") NIL))))) (|client_state_witness_prop| "" (INST + "client_state_witness") NIL)) $$$client_rely.pvs client_rely : THEORY BEGIN IMPORTING dtos_kernel_shared_rely IMPORTING client_state st1, st2 : VAR (CLIENT_STATE) ag : VAR THREAD client_environment(st1,st2,ag) : bool = environment_base(ag,kst(st1),kst(st2)) and st1 with [kst := kst(st2)] = st2 client_environment_refl: THEOREM client_environment(st1,st1,ag) client_hidd(st1,st2,ag) : bool = NOT client_threads(ag) AND hidd_base(ag, kst(st1), kst(st2)) AND st2 = st1 with [ kst := kst(st2) ] client_hidd_prop: THEOREM client_hidd(st1,st2,ag) => k_threads(ag) OR client_view(st1,st2) client_rely(st1,st2,ag) : bool = not client_threads(ag) AND client_environment(st1,st2,ag) END client_rely $$$client_rely.prf (|client_rely| (|client_environment_refl| "" (SKOSIMP) (("" (EXPAND "client_environment") (("" (REWRITE "environment_base_refl") NIL))))) (|client_hidd_prop| "" (SKOSIMP) (("" (EXPAND "client_view") (("" (EXPAND "client_hidd") (("" (EXPAND "hidd_base") (("" (GROUND) (("" (REPLACE -2 +) (("" (REPLACE -1 :DIR RL) (("" (HIDE -1 -2 1 2) (("" (APPLY-EXTENSIONALITY) NIL)))))))))))))))))) $$$client_provide_protected_data.pvs client_provide_protected_data: THEORY BEGIN IMPORTING client_ops_base % VARIABLES st1, st2: VAR (CLIENT_STATE) thread: VAR (client_threads) ri : VAR RECEIVED_INFO text : VAR TEXT client_provide_protected_data(st1, st2, thread): bool = (EXISTS ri, text : client_receive_request_util(thread, ri, provide_protected_data_op, provide_protected_data_perm, st1, st2) AND NOT reply_received(thst(st1)(thread)) AND provide_protected_data_msg(text) = user_msg(ri) AND thst(st2)(thread) = thst(st1)(thread) WITH [reply_received := true, cypher_text_received := text] ) END client_provide_protected_data $$$client_protect.pvs client_protect: THEORY BEGIN IMPORTING client_ops_base % VARIABLES st1, st2: VAR (CLIENT_STATE) thread: VAR (client_threads) text : VAR TEXT client_protect(st1, st2, thread): bool = (EXISTS text : handle(thst(st1)(thread)) /= null_name AND reply_received(thst(st1)(thread)) AND thst(st2)(thread) = thst(st1)(thread) WITH [clear_text_sent := text, reply_received := false] AND send_msg(kst(st1), kst(st2), thread, handle(thst(st1)(thread)), protect_op, reply_port(thst(st1)(thread)), protect_msg(text, reply_port(thst(st1)(thread)))) ) END client_protect $$$client_provide_crypto_context.pvs client_provide_crypto_context: THEORY BEGIN IMPORTING client_ops_base % VARIABLES st1, st2: VAR (CLIENT_STATE) thread: VAR (client_threads) ri : VAR RECEIVED_INFO crypto_handle : VAR NAME client_provide_crypto_context(st1, st2, thread): bool = (EXISTS ri, crypto_handle : client_receive_request_util(thread, ri, provide_crypto_context_op, provide_crypto_context_perm, st1, st2) AND handle(thst(st1)(thread)) = null_name AND clear_text_sent(thst(st1)(thread)) = null_text AND provide_crypto_context_msg(crypto_handle) = user_msg(ri) AND thst(st2)(thread) = thst(st1)(thread) WITH [handle := crypto_handle] ) END client_provide_crypto_context $$$client_provide_pf_handle.pvs client_provide_pf_handle: THEORY BEGIN IMPORTING client_ops_base % VARIABLES st1, st2: VAR (CLIENT_STATE) thread: VAR (client_threads) ri : VAR RECEIVED_INFO pf_handle : VAR NAME client_provide_pf_handle(st1, st2, thread): bool = (EXISTS ri, pf_handle : client_receive_request_util(thread, ri, provide_pf_handle_op, provide_pf_handle_perm, st1, st2) AND pf_handle_provided(thst(st1)(thread)) = false AND clear_text_sent(thst(st1)(thread)) = null_text AND provide_pf_handle_msg(pf_handle) = user_msg(ri) AND thst(st2)(thread) = thst(st1)(thread) WITH [pf_handle_provided := true] AND send_msg(kst(st1), kst(st2), thread, cc(thst(st1)(thread)), create_crypto_context_op, reply_port(thst(st1)(thread)), create_crypto_context_msg(situation(thst(st1)(thread)), pf_handle, requested_prot_family(thst(st1)(thread)))) ) END client_provide_pf_handle $$$client_select_prot_family.pvs client_select_prot_family: THEORY BEGIN IMPORTING client_ops_base % VARIABLES st1, st2: VAR (CLIENT_STATE) thread: VAR (client_threads) client_select_prot_family(st1, st2, thread): bool = thst(st2)(thread) = thst(st1)(thread) AND send_msg(kst(st1), kst(st2), thread, ssups(thst(st1)(thread)), select_prot_family_op, reply_port(thst(st1)(thread)), select_prot_family_msg(situation(thst(st1)(thread)), requested_prot_family(thst(st1)(thread)))) END client_select_prot_family $$$client_state.pvs client_state : THEORY BEGIN IMPORTING crypto_shared_state client_threads: (nonempty?[THREAD]) client_threads_witness: (client_threads) client_threads_nonempty: THEOREM client_threads /= emptyset % Each client thread can have a situation, selected protection family, crypto % handle and active protection request. CLIENT_THREAD_STATE_BASE : TYPE = [# reply_port: NAME, % where I wait for replies situation : SITUATION, % my situation requested_prot_family : PROT_FAMILY, % pf I requested ssups : NAME, % my name for an SSUPS service port cc : NAME, % my name for a crypto controller service port pf_handle_provided: bool, % have I received (and forwarded) % a pf port? handle: NAME, % crypto handle for my pf clear_text_sent : TEXT, % most recent text that I asked to have encrypted % Should be null_text until first protection request % is sent. reply_received : bool, % have I received back the cypher text for my % most recent protection request? Should be % true if no protection requests have been sent % yet. cypher_text_received: TEXT % most recently received cypher text % Should be null_text until reply % to first protection request is received. #] thstate : VAR CLIENT_THREAD_STATE_BASE CLIENT_THREAD_STATE(thstate) : bool = true CLIENT_STATE_BASE : TYPE = [# thst : [(client_threads) -> (CLIENT_THREAD_STATE)], kst: KERNEL_SHARED_STATE #] base : VAR CLIENT_STATE_BASE CLIENT_STATE(base): bool = subset?(existing_threads(kst(base)), client_threads) st1, st2: VAR (CLIENT_STATE) client_view(st1,st2) : bool = st1 = st2 END client_state $$$client_state.prf (|client_state| (|client_threads_TCC1| "" (INST 1 "fullset[THREAD]") (("" (GRIND) (("" (INST -1 "epsilon! (x: THREAD): true") NIL))))) (|client_threads_witness_TCC1| "" (TYPEPRED "client_threads") (("" (GRIND) (("" (INST 1 "x!1") NIL))))) (|client_threads_nonempty| "" (FLATTEN) (("" (EXPAND "emptyset") (("" (TYPEPRED "client_threads") (("" (REPLACE -2) (("" (GRIND) NIL))))))))) (|client_thread_state_witness_TCC1| "" (GRIND) NIL) (|client_state_witness_TCC1| "" (GRIND) NIL) (|client_state_witness_prop| "" (INST 1 "client_state_witness") NIL)) $$$client_ops_base.pvs client_ops_base: THEORY BEGIN IMPORTING client_state IMPORTING dtos_kernel_shared_ops IMPORTING messaging st1, st2: VAR (CLIENT_STATE) th, th1, th2 : VAR (client_threads) thread: VAR THREAD %%local state invariants client_static(st1, st2): bool = (FORALL th: reply_port(thst(st2)(th)) = reply_port(thst(st1)(th)) AND situation(thst(st2)(th)) = situation(thst(st1)(th)) AND requested_prot_family(thst(st2)(th)) = requested_prot_family(thst(st1)(th)) AND ssups(thst(st2)(th)) = ssups(thst(st1)(th)) AND cc(thst(st2)(th)) = cc(thst(st1)(th))) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) %a step must obey local invariants and only make allowed % mods to kernel state or its own thst. client_step(st1, st2, thread): bool = client_static(st1, st2) AND effects_on_kernel_state(kst(st1), kst(st2), client_threads) AND (FORALL th: (NOT (th = thread) IMPLIES thst(st1)(th) = thst(st2)(th))) ri: VAR RECEIVED_INFO op_id: VAR OP perm: VAR PERMISSION % UTILITY FUNCTIONS % processing a newly received request client_receive_request_util(thread, ri, op_id, perm, st1, st2): bool = receive_request(thread, ri, op_id, perm, kst(st1), kst(st2)) END client_ops_base $$$client_receive_request.pvs client_receive_request: THEORY BEGIN IMPORTING client_ops_base st1, st2: VAR (CLIENT_STATE) thread: VAR (client_threads) name: VAR NAME client_receive_request_submit(st1, st2, thread): bool = EXISTS name: receive_msg(kst(st1), kst(st2), thread, name) client_receive_request(st1, st2, thread): bool = thst(st2) = thst(st1) AND client_receive_request_submit(st1, st2, thread) END client_receive_request $$$client_ops.pvs client_ops: THEORY BEGIN IMPORTING client_receive_request IMPORTING client_select_prot_family IMPORTING client_provide_pf_handle IMPORTING client_provide_crypto_context IMPORTING client_protect IMPORTING client_provide_protected_data st1, st2 : VAR (CLIENT_STATE) thread : VAR THREAD th: VAR (client_threads) client_op(st1, st2, th) : bool = client_receive_request(st1, st2, th) OR client_select_prot_family(st1, st2, th) OR client_provide_pf_handle(st1, st2, th) OR client_provide_crypto_context(st1, st2, th) OR client_protect(st1, st2, th) OR client_provide_protected_data(st1, st2, th) client_guar(st1,st2,thread) : bool = client_threads(thread) AND (client_view(st1,st2) OR (client_step(st1, st2, thread) AND client_op(st1, st2, thread))) END client_ops $$$client_spec.pvs client_spec : THEORY BEGIN IMPORTING dtos_kernel_shared_state IMPORTING client_ops IMPORTING client_rely IMPORTING client_state_witness IMPORTING component_aux[(CLIENT_STATE),THREAD] st, st1, st2 : VAR (CLIENT_STATE) ag : VAR THREAD thread : VAR (client_threads) initial_client_states(st) : bool = (FORALL thread: pf_handle_provided(thst(st)(thread)) = false AND handle(thst(st)(thread)) = null_name AND clear_text_sent(thst(st)(thread)) = null_text AND reply_received(thst(st)(thread)) = true AND pending_requests(kst(st)) = emptyset[KERNEL_REQ] AND (FORALL ag : existing_threads(kst(st))(ag) => ri_status(received_info(kst(st))(ag)) = ri_processed)) client_state_witness_initial: THEOREM initial_client_states(client_state_witness) base_client_comp : base_comp_t = (# init := initial_client_states, guar := client_guar, rely := client_rely, hidd := client_hidd, cags := client_threads, view := client_view, wfar := emptyset[TRANSITION_CLASS[(CLIENT_STATE), THREAD]], sfar := emptyset[TRANSITION_CLASS[(CLIENT_STATE), THREAD]] #) client_view_eq: THEOREM view_eq(base_client_comp) client_comp_init: THEOREM init_restriction(base_client_comp) client_comp_guar: THEOREM guar_restriction(base_client_comp) client_comp_rely_hidd: THEOREM rely_hidd_restriction(base_client_comp) client_comp_hidd: THEOREM hidd_restriction(base_client_comp) client_comp_rely: THEOREM rely_restriction(base_client_comp) client_comp_cags: THEOREM cags_restriction(base_client_comp) client_comp_guar_stuttering: THEOREM guar_stuttering_restriction(base_client_comp) client_comp_rely_stuttering: THEOREM rely_stuttering_restriction(base_client_comp) client_comp : (comp_t) = base_client_comp client_comp_hidd_prop: THEOREM hidd(client_comp)(st1, st2, ag) => k_threads(ag) OR view(client_comp)(st1, st2) END client_spec $$$client_spec.prf (|client_spec| (IMPORTING5_TCC1 "" (INST + "client_state_witness") NIL) (|client_state_witness_initial| "" (EXPAND "initial_client_states") (("" (EXPAND "client_state_witness") (("" (SKOSIMP) (("" (EXPAND "client_thread_state_witness") (("" (EXPAND "empty_kst") (("" (EXPAND "emptyset") (("" (PROPAX) NIL))))))))))))) (|base_client_comp_TCC1| "" (EXPAND "client_view") (("" (REWRITE "eq_view1") NIL))) (|client_view_eq| "" (EXPAND "view_eq") (("" (EXPAND "base_client_comp") (("" (SKOSIMP) (("" (EXPAND "client_view") (("" (PROPAX) NIL))))))))) (|client_comp_init| "" (EXPAND "init_restriction") (("" (EXPAND "base_client_comp") (("" (FLATTEN) (("" (LEMMA "emptyset_is_empty?[(CLIENT_STATE)]") (("" (INST -1 "initial_client_states") (("" (FLATTEN) (("" (HIDE -1) (("" (SPLIT -1) (("1" (EXPAND "empty?") (("1" (HIDE -2) (("1" (INST -1 "client_state_witness") (("1" (EXPAND "member") (("1" (REWRITE "client_state_witness_initial") NIL))))))))) ("2" (PROPAX) NIL))))))))))))))))) (|client_comp_guar| "" (EXPAND "guar_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_client_comp") (("" (GROUND) (("" (EXPAND "client_guar") (("" (PROPAX) NIL))))))))))))) (|client_comp_rely_hidd| "" (EXPAND "rely_hidd_restriction") (("" (EXPAND "subset?") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_client_comp") (("" (EXPAND "client_rely") (("" (GROUND) (("" (EXPAND "client_hidd") (("" (EXPAND "client_environment") (("" (REWRITE "hidd_base_prop") (("" (GROUND) NIL))))))))))))))))))))) (|client_comp_hidd| "" (EXPAND "hidd_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_client_comp") (("" (GROUND) (("" (EXPAND "client_hidd") (("" (PROPAX) NIL))))))))))))) (|client_comp_rely| "" (EXPAND "rely_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_client_comp") (("" (EXPAND "client_rely") (("" (GROUND) NIL))))))))))) (|client_comp_cags| "" (EXPAND "cags_restriction") (("" (GROUND) (("" (EXPAND "base_client_comp") (("" (LEMMA "client_threads_nonempty") (("" (GROUND) NIL))))))))) (|client_comp_guar_stuttering| "" (EXPAND "guar_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_client_comp") (("" (EXPAND "client_guar") (("" (GROUND) NIL))))))))))))) (|client_comp_rely_stuttering| "" (EXPAND "rely_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_client_comp") (("" (EXPAND "client_rely") (("" (EXPAND "complement") (("" (EXPAND "member") (("" (EXPAND "client_view") (("" (GROUND) (("" (REPLACE -1) (("" (REWRITE "client_environment_refl") NIL))))))))))))))))))))))) (|client_comp_TCC1| "" (USE "client_view_eq") (("" (USE "client_comp_init") (("" (USE "client_comp_guar") (("" (USE "client_comp_rely_hidd") (("" (USE "client_comp_hidd") (("" (USE "client_comp_cags") (("" (USE "client_comp_guar_stuttering") (("" (USE "client_comp_rely_stuttering") (("" (REWRITE "component_view_eq_thm") NIL))))))))))))))))) (|client_comp_hidd_prop| "" (EXPAND "client_comp") (("" (EXPAND "base_client_comp") (("" (USE "client_hidd_prop") NIL)))))) $$$ssups_state_witness.pvs ssups_state_witness: THEORY BEGIN IMPORTING ssups_state ssups_state_witness: (SSUPS_STATE) = (# avail_port := emptyset[NAME], service_port := emptyset[NAME], sit_pfs := (LAMBDA (s : SITUATION): emptyset[PROT_FAMILY]), handles := emptyset[NAME], handle_pf := (LAMBDA (h: (emptyset[NAME])): null_prot_family), kst := empty_kst #) ssups_state_witness_prop : THEOREM (EXISTS (s : (SSUPS_STATE)) : TRUE) END ssups_state_witness $$$ssups_state_witness.prf (|ssups_state_witness| (|ssups_state_witness_TCC1| "" (EXPAND "SSUPS_STATE") (("" (EXPAND "empty_kst") (("" (EXPAND "disjoint?") (("" (REWRITE "intersection_empty") (("" (EXPAND "empty?") (("" (REWRITE "subset_emptyset") (("" (EXPAND "member") (("" (EXPAND "emptyset") (("" (PROPAX) NIL))))))))))))))))) (|ssups_state_witness_prop| "" (INST 1 "ssups_state_witness") NIL)) $$$ssups_rely.pvs ssups_rely : THEORY BEGIN IMPORTING dtos_kernel_shared_rely IMPORTING ssups_state st1, st2 : VAR (SSUPS_STATE) ag : VAR THREAD ssups_environment(st1,st2,ag) : bool = environment_base(ag,kst(st1),kst(st2)) and st1 with [kst := kst(st2)] = st2 ssups_environment_refl: THEOREM ssups_environment(st1,st1,ag) ssups_hidd(st1,st2,ag) : bool = NOT ssups_threads(ag) AND hidd_base(ag, kst(st1), kst(st2)) AND st2 = st1 WITH [ kst := kst(st2) ] ssups_hidd_prop: THEOREM ssups_hidd(st1,st2,ag) => k_threads(ag) OR ssups_view(st1,st2) ssups_rely(st1,st2,ag) : bool = not ssups_threads(ag) AND ssups_environment(st1,st2,ag) END ssups_rely $$$ssups_rely.prf (|ssups_rely| (|ssups_environment_refl| "" (SKOSIMP) (("" (EXPAND "ssups_environment") (("" (REWRITE "environment_base_refl") NIL))))) (|ssups_hidd_prop| "" (SKOSIMP) (("" (EXPAND "ssups_view") (("" (EXPAND "ssups_hidd") (("" (EXPAND "hidd_base") (("" (GROUND) (("" (REPLACE -2 +) (("" (REPLACE -1 :DIR RL) (("" (HIDE -1 -2 1 2) (("" (APPLY-EXTENSIONALITY) NIL)))))))))))))))))) $$$ssups_retrieve_prot_family.pvs ssups_retrieve_prot_family: THEORY BEGIN IMPORTING ssups_ops_base % VARIABLES st1, st2: VAR (SSUPS_STATE) thread: VAR THREAD prot_family : VAR PROT_FAMILY ri: VAR RECEIVED_INFO handle : VAR NAME ssups_retrieve_prot_family(st1, st2, thread): bool = (EXISTS ri, prot_family, handle: ssups_receive_request_util(thread, ri, retrieve_prot_family_op, retrieve_prot_family_perm, st1, st2) AND handle = service_port(ri) AND handles(st1)(handle) AND prot_family = handle_pf(st1)(handle) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) AND avail_port(st2) = avail_port(st1) AND handles(st2) = handles(st1) AND handle_pf(st2) = handle_pf(st1) AND send_msg(kst(st1), kst(st2), thread, reply_name(ri), provide_prot_family_op, null_name, provide_prot_family_msg(prot_family)) ) END ssups_retrieve_prot_family $$$ssups_retrieve_prot_family.prf (|ssups_retrieve_prot_family| (|ssups_retrieve_prot_family_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL)))) $$$ssups_select_prot_family.pvs ssups_select_prot_family: THEORY BEGIN IMPORTING ssups_ops_base % VARIABLES st1, st2: VAR (SSUPS_STATE) thread: VAR THREAD prot_family : VAR PROT_FAMILY sit: VAR SITUATION ri: VAR RECEIVED_INFO handle : VAR NAME ssups_select_prot_family(st1, st2, thread): bool = (EXISTS ri, sit, prot_family, handle: ssups_receive_request_util(thread, ri, select_prot_family_op, select_prot_family_perm, st1, st2) AND select_prot_family_msg(sit, prot_family) = user_msg(ri) AND service_port(st1)(service_port(ri)) AND sit_pfs(st1)(sit)(prot_family) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) AND avail_port(st1)(handle) AND avail_port(st2) = remove(handle, avail_port(st1)) AND handles(st2) = add(handle, handles(st1)) AND handle_pf(st2) = handle_pf(st1) WITH [ handle := prot_family ] AND send_msg(kst(st1), kst(st2), thread, reply_name(ri), provide_pf_handle_op, null_name, provide_pf_handle_msg(handle)) ) END ssups_select_prot_family $$$ssups_select_prot_family.prf (|ssups_select_prot_family| (|ssups_select_prot_family_TCC1| "" (GRIND :DEFS NIL :REWRITES "add") NIL)) $$$ssups_state.pvs ssups_state : THEORY BEGIN IMPORTING crypto_shared_state ssups_threads: (nonempty?[THREAD]) ssups_threads_witness: (ssups_threads) ssups_threads_nonempty: THEOREM ssups_threads /= emptyset SSUPS_STATE_BASE: TYPE = [# avail_port: setof[NAME], % my supply of ports service_port : setof[NAME], sit_pfs : [SITUATION -> setof[PROT_FAMILY]], handles : setof[NAME], handle_pf : [(handles) -> PROT_FAMILY], kst: KERNEL_SHARED_STATE #] base : VAR SSUPS_STATE_BASE SSUPS_STATE(base): bool = disjoint?(avail_port(base), handles(base)) AND disjoint?(avail_port(base), service_port(base)) AND subset?(existing_threads(kst(base)), ssups_threads) st1, st2: VAR (SSUPS_STATE) ssups_view(st1,st2) : bool = st1 = st2 END ssups_state $$$ssups_state.prf (|ssups_state| (|ssups_threads_TCC1| "" (INST 1 "fullset[THREAD]") (("" (GRIND) (("" (INST -1 "epsilon! (t : THREAD): true") NIL))))) (|ssups_threads_witness_TCC1| "" (TYPEPRED "ssups_threads") (("" (GRIND) (("" (INST 1 "x!1") NIL))))) (|ssups_threads_nonempty| "" (FLATTEN) (("" (REWRITE "emptyset_no_members") (("" (INST -1 "ssups_threads_witness") (("" (EXPAND "member") (("" (GROUND) NIL))))))))) (|ssups_state_witness_TCC1| "" (EXPAND "SSUPS_STATE") (("" (GRIND) NIL))) (|ssups_state_witness_prop| "" (INST 1 "ssups_state_witness") NIL)) $$$ssups_ops_base.pvs ssups_ops_base: THEORY BEGIN IMPORTING ssups_state IMPORTING dtos_kernel_shared_ops %%This should probably be in dtos_kernel_shared_ops IMPORTING messaging st, st1, st2: VAR (SSUPS_STATE) %%local state invariants ssups_static(st1, st2): bool = sit_pfs(st2) = sit_pfs(st1) AND service_port(st2) = service_port(st1) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) %a step must obey local invariants and only make allowed % mods to kernel state. ssups_step(st1, st2): bool = ssups_static(st1, st2) AND effects_on_kernel_state(kst(st1), kst(st2), ssups_threads) thread: VAR THREAD prot_family: VAR PROT_FAMILY ri: VAR RECEIVED_INFO op_id: VAR OP perm: VAR PERMISSION name, reply_port, to: VAR NAME kernel_req: VAR KERNEL_REQ msg: VAR USER_MSG % UTILITY FUNCTIONS % processing a newly received request ssups_receive_request_util(thread, ri, op_id, perm, st1, st2): bool = receive_request(thread, ri, op_id, perm, kst(st1), kst(st2)) END ssups_ops_base $$$ssups_receive_request.pvs ssups_receive_request: THEORY BEGIN IMPORTING ssups_ops_base st1, st2: VAR (SSUPS_STATE) thread: VAR (ssups_threads) name: VAR NAME ssups_receive_request_submit(st1, st2, thread): bool = EXISTS name: receive_msg(kst(st1), kst(st2), thread, name) ssups_receive_request(st1, st2, thread): bool = avail_port(st2) = avail_port(st1) AND handles(st2) = handles(st1) AND handle_pf(st2) = handle_pf(st1) AND ssups_receive_request_submit(st1, st2, thread) END ssups_receive_request $$$ssups_receive_request.prf (|ssups_receive_request| (|ssups_receive_request_TCC1| "" (SUBTYPE-TCC) NIL)) $$$ssups_ops.pvs ssups_ops: THEORY BEGIN IMPORTING ssups_receive_request IMPORTING ssups_select_prot_family IMPORTING ssups_retrieve_prot_family st1, st2 : VAR (SSUPS_STATE) thread : VAR (ssups_threads) ag: VAR THREAD ssups_op(st1, st2, thread) : bool = ssups_receive_request(st1, st2, thread) OR ssups_select_prot_family(st1, st2, thread) OR ssups_retrieve_prot_family(st1, st2, thread) ssups_guar(st1,st2,ag) : bool = ssups_threads(ag) AND (ssups_view(st1, st2) OR (ssups_step(st1, st2) AND ssups_op(st1, st2, ag))) END ssups_ops $$$ssups_spec.pvs ssups_spec : THEORY BEGIN IMPORTING dtos_kernel_shared_state IMPORTING ssups_ops IMPORTING ssups_rely IMPORTING ssups_state_witness IMPORTING component_aux[(SSUPS_STATE),THREAD] st, st1, st2 : VAR (SSUPS_STATE) ag : VAR THREAD thread : VAR (ssups_threads) initial_ssups_states(st) : bool = handles(st) = emptyset[NAME] AND pending_requests(kst(st)) = emptyset[KERNEL_REQ] AND (FORALL ag : existing_threads(kst(st))(ag) => ri_status(received_info(kst(st))(ag)) = ri_processed) ssups_state_witness_initial: THEOREM initial_ssups_states(ssups_state_witness) base_ssups_comp : base_comp_t = (# init := initial_ssups_states, guar := ssups_guar, rely := ssups_rely, hidd := ssups_hidd, cags := ssups_threads, view := ssups_view, wfar := emptyset[TRANSITION_CLASS[(SSUPS_STATE), THREAD]], sfar := emptyset[TRANSITION_CLASS[(SSUPS_STATE), THREAD]] #) ssups_view_eq: THEOREM view_eq(base_ssups_comp) ssups_comp_init: THEOREM init_restriction(base_ssups_comp) ssups_comp_guar: THEOREM guar_restriction(base_ssups_comp) ssups_comp_rely_hidd: THEOREM rely_hidd_restriction(base_ssups_comp) ssups_comp_hidd: THEOREM hidd_restriction(base_ssups_comp) ssups_comp_rely: THEOREM rely_restriction(base_ssups_comp) ssups_comp_cags: THEOREM cags_restriction(base_ssups_comp) ssups_comp_guar_stuttering: THEOREM guar_stuttering_restriction(base_ssups_comp) ssups_comp_rely_stuttering: THEOREM rely_stuttering_restriction(base_ssups_comp) ssups_comp : (comp_t) = base_ssups_comp ssups_comp_hidd_prop: THEOREM hidd(ssups_comp)(st1, st2, ag) => k_threads(ag) OR view(ssups_comp)(st1, st2) END ssups_spec $$$ssups_spec.prf (|ssups_spec| (IMPORTING5_TCC1 "" (INST + "ssups_state_witness") NIL) (|ssups_state_witness_initial| "" (EXPAND "initial_ssups_states") (("" (EXPAND "ssups_state_witness") (("" (EXPAND "empty_kst") (("" (EXPAND "emptyset") (("" (PROPAX) NIL))))))))) (|base_ssups_comp_TCC1| "" (REWRITE "eq_view2") (("" (EXPAND "ssups_view") (("" (PROPAX) NIL))))) (|ssups_view_eq| "" (EXPAND "view_eq") (("" (EXPAND "base_ssups_comp") (("" (SKOSIMP) (("" (EXPAND "ssups_view") (("" (PROPAX) NIL))))))))) (|ssups_comp_init| "" (EXPAND "init_restriction") (("" (EXPAND "base_ssups_comp") (("" (GROUND) (("" (USE "emptyset_is_empty?[(SSUPS_STATE)]") (("" (GROUND) (("" (EXPAND "empty?") (("" (EXPAND "member") (("" (INST - "ssups_state_witness") (("" (REWRITE "ssups_state_witness_initial") NIL))))))))))))))))) (|ssups_comp_guar| "" (EXPAND "guar_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_ssups_comp") (("" (GROUND) (("" (EXPAND "ssups_guar") (("" (PROPAX) NIL))))))))))))) (|ssups_comp_rely_hidd| "" (EXPAND "rely_hidd_restriction") (("" (EXPAND "subset?") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_ssups_comp") (("" (EXPAND "ssups_rely") (("" (GROUND) (("" (EXPAND "ssups_hidd") (("" (EXPAND "ssups_environment") (("" (REWRITE "hidd_base_prop") (("" (GROUND) NIL))))))))))))))))))))) (|ssups_comp_hidd| "" (EXPAND "hidd_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_ssups_comp") (("" (GROUND) (("" (EXPAND "ssups_hidd") (("" (PROPAX) NIL))))))))))))) (|ssups_comp_rely| "" (EXPAND "rely_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_ssups_comp") (("" (EXPAND "ssups_rely") (("" (GROUND) NIL))))))))))) (|ssups_comp_cags| "" (EXPAND "cags_restriction") (("" (EXPAND "base_ssups_comp") (("" (REWRITE "ssups_threads_nonempty") NIL))))) (|ssups_comp_guar_stuttering| "" (EXPAND "guar_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_ssups_comp") (("" (EXPAND "ssups_guar") (("" (GROUND) NIL))))))))))))) (|ssups_comp_rely_stuttering| "" (EXPAND "rely_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_ssups_comp") (("" (EXPAND "ssups_rely") (("" (EXPAND "complement") (("" (EXPAND "member") (("" (EXPAND "ssups_view") (("" (GROUND) (("" (REPLACE -1) (("" (REWRITE "ssups_environment_refl") NIL))))))))))))))))))))))) (|ssups_comp_TCC1| "" (USE "ssups_view_eq") (("" (USE "ssups_comp_init") (("" (USE "ssups_comp_guar") (("" (USE "ssups_comp_rely_hidd") (("" (USE "ssups_comp_hidd") (("" (USE "ssups_comp_cags") (("" (USE "ssups_comp_guar_stuttering") (("" (USE "ssups_comp_rely_stuttering") (("" (REWRITE "component_view_eq_thm") NIL))))))))))))))))) (|ssups_comp_hidd_prop| "" (EXPAND "ssups_comp") (("" (EXPAND "base_ssups_comp") (("" (USE "ssups_hidd_prop") NIL)))))) $$$ks_state_witness.pvs ks_state_witness: THEORY BEGIN IMPORTING ks_state th,th1,th2 : VAR (ks_threads) ks_thread_state_witness: (KS_THREAD_STATE) = (# service_port := null_name, server_mech := key_mech_witness, avail_port := emptyset[NAME], key_handles := emptyset[NAME], handle_to_key := (LAMBDA (x: (emptyset[NAME])): key_witness) #) ks_state_witness: (KS_STATE) = (# thst := (LAMBDA th : ks_thread_state_witness), kst := empty_kst #) ks_state_witness_prop : THEOREM (EXISTS (ksstb : (KS_STATE)) : TRUE) END ks_state_witness $$$ks_state_witness.prf (|ks_state_witness| (|ks_thread_state_witness_TCC1| "" (EXPAND "KS_THREAD_STATE") (("" (GRIND) NIL))) (|ks_state_witness_TCC1| "" (EXPAND "KS_STATE") (("" (EXPAND "empty_kst") (("" (REWRITE "subset_emptyset") NIL))))) (|ks_state_witness_prop| "" (INST 1 "ks_state_witness") NIL)) $$$ks_rely.pvs ks_rely : THEORY BEGIN IMPORTING dtos_kernel_shared_rely IMPORTING ks_state st1, st2 : VAR (KS_STATE) ag : VAR THREAD ks_environment(st1,st2,ag) : bool = environment_base(ag,kst(st1),kst(st2)) and st1 with [kst := kst(st2)] = st2 ks_environment_refl: THEOREM ks_environment(st1,st1,ag) ks_hidd(st1,st2,ag) : bool = NOT ks_threads(ag) AND hidd_base(ag, kst(st1), kst(st2)) AND st2 = st1 with [ kst := kst(st2) ] ks_hidd_prop: THEOREM ks_hidd(st1,st2,ag) => k_threads(ag) OR ks_view(st1,st2) ks_rely(st1,st2,ag) : bool = not ks_threads(ag) AND ks_environment(st1,st2,ag) END ks_rely $$$ks_rely.prf (|ks_rely| (|ks_environment_refl| "" (SKOSIMP) (("" (EXPAND "ks_environment") (("" (REWRITE "environment_base_refl") NIL))))) (|ks_hidd_prop| "" (SKOSIMP) (("" (EXPAND "ks_view") (("" (EXPAND "ks_hidd") (("" (EXPAND "hidd_base") (("" (GROUND) (("" (REPLACE -2 +) (("" (REPLACE -1 :DIR RL) (("" (HIDE -1 -2 1 2) (("" (APPLY-EXTENSIONALITY) NIL)))))))))))))))))) $$$ks_retrieve_key.pvs ks_retrieve_key: THEORY BEGIN %% The real crypto subsystem allows key servers to immediately retrieve a key to %% be associated with the handle, wait until a key is actually requested %% or fork a thread to retrieve a key to be associated with the handle. %% For simplicity, we assume that the first option is always followed. IMPORTING ks_ops_base % VARIABLES st1, st2: VAR (KS_STATE) thread: VAR (ks_threads) ri: VAR RECEIVED_INFO handle, reply_port : VAR NAME key: VAR KEY ks_retrieve_key(st1, st2, thread): bool = (EXISTS ri, reply_port, handle, key: ks_receive_request_util(thread, ri, retrieve_key_op, retrieve_key_perm, st1, st2) AND null_user_msg = user_msg(ri) AND key_handles(thst(st1)(thread))(service_port(ri)) AND reply_port = reply_name(ri) AND key = handle_to_key(thst(st1)(thread))(service_port(ri)) AND key_handle_inv(st1,st2) AND avail_port(thst(st2)(thread)) = avail_port(thst(st1)(thread)) AND send_msg(kst(st1), kst(st2), thread, reply_port, provide_key_op, null_name, provide_key_msg(key)) ) END ks_retrieve_key $$$ks_init_key_retrieval.pvs ks_init_key_retrieval: THEORY BEGIN %% The real crypto subsystem allows key servers to immediately retrieve a key to %% be associated with the handle, wait until a key is actually requested %% or fork a thread to retrieve a key to be associated with the handle. %% For simplicity, we assume that the first option is always followed. IMPORTING ks_ops_base % VARIABLES st1, st2: VAR (KS_STATE) thread: VAR (ks_threads) ri: VAR RECEIVED_INFO handle, reply_port : VAR NAME key: VAR KEY seed : VAR SEED new_handle(st1, st2, handle, thread) : bool = avail_port(thst(st2)(thread)) = remove(handle, avail_port(thst(st1)(thread))) AND key_handles(thst(st2)(thread)) = add(handle, key_handles(thst(st1)(thread))) assign_key(st1, st2, handle, key, thread) : bool = key_handles(thst(st2)(thread))(handle) AND handle_to_key(thst(st2)(thread)) = handle_to_key(thst(st1)(thread)) WITH [(handle) := key] ks_init_key_retrieval(st1, st2, thread): bool = (EXISTS ri, reply_port, handle, key, seed: ks_receive_request_util(thread, ri, init_key_retrieval_op, init_key_retrieval_perm, st1, st2) AND null_user_msg = user_msg(ri) AND service_port(thst(st1)(thread)) = service_port(ri) AND reply_port = reply_name(ri) AND avail_port(thst(st1)(thread))(handle) AND key = generate_key(server_mech(thst(st1)(thread)), seed) AND new_handle(st1, st2, handle, thread) AND assign_key(st1, st2, handle, key, thread) AND send_msg(kst(st1), kst(st2), thread, reply_port, provide_key_port_op, null_name, provide_key_port_msg(handle)) ) END ks_init_key_retrieval $$$ks_state.pvs ks_state : THEORY BEGIN IMPORTING crypto_shared_state ks_threads: setof[THREAD] ks_threads_nonempty: AXIOM ks_threads /= emptyset ks_threads_witness: (ks_threads) % Each thread is a separate key server with the following state information KS_THREAD_STATE_BASE : TYPE = [# service_port: NAME, % where I receive my requests server_mech: KEY_MECH, % mechanism I provide to clients avail_port: setof[NAME], % my supply of unused handles key_handles : setof[NAME], % handles I've given out. handle_to_key : [(key_handles) -> KEY] % the key associated with each handle #] ksths : VAR KS_THREAD_STATE_BASE KS_THREAD_STATE(ksths) : bool = disjoint?(avail_port(ksths), key_handles(ksths)) AND NOT avail_port(ksths)(service_port(ksths)) KS_STATE_BASE : TYPE = [# thst : [(ks_threads) -> (KS_THREAD_STATE)], kst: KERNEL_SHARED_STATE #] ksstb : VAR KS_STATE_BASE KS_STATE(ksstb): bool = subset?(existing_threads(kst(ksstb)), ks_threads) st1, st2: VAR (KS_STATE) ks_view(st1,st2) : bool = st1 = st2 END ks_state $$$ks_state.prf (|ks_state| (|ks_threads_witness_TCC1| "" (LEMMA "ks_threads_nonempty") (("" (LEMMA "nonempty_exists[THREAD]") (("" (INST -1 "ks_threads") (("" (EXPAND "nonempty?") (("" (FLATTEN) (("" (LEMMA "emptyset_is_empty?[THREAD]") (("" (INST -1 "ks_threads") (("" (FLATTEN) (("" (GROUND) NIL))))))))))))))))) (|ks_thread_state_witness_TCC1| "" (EXPAND "KS_THREAD_STATE") (("" (SPLIT) (("1" (EXPAND "disjoint?") (("1" (REWRITE "intersection_idempotent") (("1" (REWRITE "emptyset_is_empty?") NIL))))) ("2" (EXPAND "emptyset") (("2" (PROPAX) NIL))))))) (|ks_state_witness_TCC1| "" (EXPAND "KS_STATE") (("" (EXPAND "disjoint?") (("" (REWRITE "intersection_empty") (("" (REWRITE "emptyset_is_empty?") (("" (GROUND) (("" (EXPAND "subset?") (("" (SKOSIMP) (("" (EXPAND "member") (("" (REPLACE -1) (("" (TYPEPRED "ks_threads_witness") (("" (PROPAX) NIL))))))))))))))))))))) (|ks_state_witness_prop| "" (INST 1 "ks_state_witness") NIL)) $$$ks_ops_base.pvs ks_ops_base: THEORY BEGIN IMPORTING ks_state IMPORTING dtos_kernel_shared_ops IMPORTING messaging st1, st2: VAR (KS_STATE) th, th1, th2 : VAR (ks_threads) thread: VAR THREAD %%local state invariants ks_static(st1, st2): bool = (FORALL th: service_port(thst(st2)(th)) = service_port(thst(st1)(th)) AND server_mech(thst(st2)(th)) = server_mech(thst(st1)(th))) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) %a step must obey local invariants and only make allowed % mods to kernel state or its own thst. ks_step(st1, st2, thread): bool = ks_static(st1, st2) AND effects_on_kernel_state(kst(st1), kst(st2), ks_threads) AND (FORALL th: (NOT (th = thread) IMPLIES thst(st1)(th) = thst(st2)(th))) key_handle_inv(st1, st2): bool = (FORALL th: key_handles(thst(st2)(th)) = key_handles(thst(st1)(th)) AND handle_to_key(thst(st2)(th)) = handle_to_key(thst(st1)(th))) ri: VAR RECEIVED_INFO op_id: VAR OP perm: VAR PERMISSION % UTILITY FUNCTIONS % processing a newly received request ks_receive_request_util(thread, ri, op_id, perm, st1, st2): bool = receive_request(thread, ri, op_id, perm, kst(st1), kst(st2)) END ks_ops_base $$$ks_ops_base.prf (|ks_ops_base| (|key_handle_inv_TCC1| "" (SKOSIMP*) (("" (TYPEPRED "y1!1") (("" (TYPEPRED "x1!1") (("" (SPLIT) (("1" (REPLACE -3) (("1" (PROPAX) NIL))) ("2" (REPLACE -3) (("2" (PROPAX) NIL)))))))))))) $$$ks_receive_request.pvs ks_receive_request: THEORY BEGIN IMPORTING ks_ops_base st1, st2: VAR (KS_STATE) thread: VAR (ks_threads) name: VAR NAME ks_receive_request_submit(st1, st2, thread): bool = EXISTS name: receive_msg(kst(st1), kst(st2), thread, name) ks_receive_request(st1, st2, thread): bool = thst(st2) = thst(st1) AND ks_receive_request_submit(st1, st2, thread) END ks_receive_request $$$ks_ops.pvs ks_ops: THEORY BEGIN IMPORTING ks_receive_request IMPORTING ks_init_key_retrieval IMPORTING ks_retrieve_key st1, st2 : VAR (KS_STATE) th : VAR (ks_threads) thread: VAR THREAD ks_op(st1, st2, th) : bool = ks_receive_request(st1, st2, th) OR ks_init_key_retrieval(st1, st2, th) OR ks_retrieve_key(st1, st2, th) ks_guar(st1,st2,thread) : bool = ks_threads(thread) AND (ks_view(st1,st2) OR (ks_step(st1, st2, thread) AND ks_op(st1, st2, thread))) END ks_ops $$$ks_spec.pvs ks_spec : THEORY BEGIN IMPORTING dtos_kernel_shared_state IMPORTING ks_ops IMPORTING ks_rely IMPORTING ks_state_witness IMPORTING component_aux[(KS_STATE),THREAD] st, st1, st2 : VAR (KS_STATE) ag : VAR THREAD thread : VAR (ks_threads) initial_ks_states(st) : bool = (FORALL thread: key_handles(thst(st)(thread)) = emptyset[NAME] AND handle_to_key(thst(st)(thread)) = (LAMBDA (x : (emptyset[NAME])) : key_witness) AND pending_requests(kst(st)) = emptyset[KERNEL_REQ] AND (FORALL ag : existing_threads(kst(st))(ag) => ri_status(received_info(kst(st))(ag)) = ri_processed)) ks_state_witness_initial: THEOREM initial_ks_states(ks_state_witness) base_ks_comp : base_comp_t = (# init := initial_ks_states, guar := ks_guar, rely := ks_rely, hidd := ks_hidd, cags := ks_threads, view := ks_view, wfar := emptyset[TRANSITION_CLASS[(KS_STATE), THREAD]], sfar := emptyset[TRANSITION_CLASS[(KS_STATE), THREAD]] #) ks_view_eq: THEOREM view_eq(base_ks_comp) ks_comp_init: THEOREM init_restriction(base_ks_comp) ks_comp_guar: THEOREM guar_restriction(base_ks_comp) ks_comp_rely_hidd: THEOREM rely_hidd_restriction(base_ks_comp) ks_comp_hidd: THEOREM hidd_restriction(base_ks_comp) ks_comp_rely: THEOREM rely_restriction(base_ks_comp) ks_comp_cags: THEOREM cags_restriction(base_ks_comp) ks_comp_guar_stuttering: THEOREM guar_stuttering_restriction(base_ks_comp) ks_comp_rely_stuttering: THEOREM rely_stuttering_restriction(base_ks_comp) ks_comp : (comp_t) = base_ks_comp ks_comp_hidd_prop: THEOREM hidd(ks_comp)(st1, st2, ag) => k_threads(ag) OR view(ks_comp)(st1, st2) END ks_spec $$$ks_spec.prf (|ks_spec| (IMPORTING5_TCC1 "" (INST + "ks_state_witness") NIL) (|initial_ks_states_TCC1| "" (SUBTYPE-TCC) NIL) (|initial_ks_states_TCC2| "" (SUBTYPE-TCC) NIL) (|ks_state_witness_initial| "" (EXPAND "initial_ks_states") (("" (EXPAND "ks_state_witness") (("" (EXPAND "ks_thread_state_witness") (("" (EXPAND "empty_kst") (("" (EXPAND "emptyset") (("" (PROPAX) NIL))))))))))) (|base_ks_comp_TCC1| "" (EXPAND "ks_view") (("" (REWRITE "eq_view1") NIL))) (|ks_view_eq| "" (EXPAND "view_eq") (("" (EXPAND "base_ks_comp") (("" (SKOSIMP) (("" (EXPAND "ks_view") (("" (PROPAX) NIL))))))))) (|ks_comp_init| "" (EXPAND "init_restriction") (("" (EXPAND "base_ks_comp") (("" (FLATTEN) (("" (LEMMA "emptyset_is_empty?[(KS_STATE)]") (("" (INST -1 "initial_ks_states") (("" (FLATTEN) (("" (HIDE -1) (("" (SPLIT -1) (("1" (EXPAND "empty?") (("1" (HIDE -2) (("1" (INST -1 "ks_state_witness") (("1" (EXPAND "member") (("1" (REWRITE "ks_state_witness_initial") NIL))))))))) ("2" (PROPAX) NIL))))))))))))))))) (|ks_comp_guar| "" (EXPAND "guar_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_ks_comp") (("" (GROUND) (("" (EXPAND "ks_guar") (("" (PROPAX) NIL))))))))))))) (|ks_comp_rely_hidd| "" (EXPAND "rely_hidd_restriction") (("" (EXPAND "subset?") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_ks_comp") (("" (EXPAND "ks_rely") (("" (GROUND) (("" (EXPAND "ks_hidd") (("" (EXPAND "ks_environment") (("" (REWRITE "hidd_base_prop") (("" (GROUND) NIL))))))))))))))))))))) (|ks_comp_hidd| "" (EXPAND "hidd_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_ks_comp") (("" (GROUND) (("" (EXPAND "ks_hidd") (("" (PROPAX) NIL))))))))))))) (|ks_comp_rely| "" (EXPAND "rely_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_ks_comp") (("" (EXPAND "ks_rely") (("" (GROUND) NIL))))))))))) (|ks_comp_cags| "" (EXPAND "cags_restriction") (("" (GROUND) (("" (EXPAND "base_ks_comp") (("" (LEMMA "ks_threads_nonempty") (("" (GROUND) NIL))))))))) (|ks_comp_guar_stuttering| "" (EXPAND "guar_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_ks_comp") (("" (EXPAND "ks_guar") (("" (GROUND) NIL))))))))))))) (|ks_comp_rely_stuttering| "" (EXPAND "rely_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_ks_comp") (("" (EXPAND "ks_rely") (("" (EXPAND "complement") (("" (EXPAND "member") (("" (EXPAND "ks_view") (("" (GROUND) (("" (REPLACE -1) (("" (REWRITE "ks_environment_refl") NIL))))))))))))))))))))))) (|ks_comp_TCC1| "" (USE "ks_view_eq") (("" (USE "ks_comp_init") (("" (USE "ks_comp_guar") (("" (USE "ks_comp_rely_hidd") (("" (USE "ks_comp_hidd") (("" (USE "ks_comp_cags") (("" (USE "ks_comp_guar_stuttering") (("" (USE "ks_comp_rely_stuttering") (("" (REWRITE "component_view_eq_thm") NIL))))))))))))))))) (|ks_comp_hidd_prop| "" (EXPAND "ks_comp") (("" (EXPAND "base_ks_comp") (("" (USE "ks_hidd_prop") NIL)))))) $$$pt_state_witness.pvs pt_state_witness: THEORY BEGIN IMPORTING pt_state th,th1,th2 : VAR (pt_threads) pt_thread_state_witness: (PT_THREAD_STATE) = (# service_port := null_name, encrypt_mech := encrypt_mech_witness, avail_port := emptyset[NAME], pt_handles := emptyset[NAME], pt_reply_to := (LAMBDA (x: (emptyset[NAME])): null_name), pt_args := (LAMBDA (x: (emptyset[NAME])): null_name_seq(1)), pt_key_server_reply_port := (LAMBDA (x: (emptyset[NAME])): null_name), pt_keyed := emptyset[NAME], pt_key := (LAMBDA (x: (emptyset[NAME])): key_witness), pt_next_pt_reply_port := (LAMBDA (x: (emptyset[NAME])): null_name), pt_pipeline_initialized := emptyset[NAME], pt_next_pt := (LAMBDA (x: (emptyset[NAME])): null_name) #) pt_state_witness: (PT_STATE) = (# thst := (LAMBDA th : pt_thread_state_witness), kst := empty_kst #) pt_state_witness_prop : THEOREM (EXISTS (ptstb : (PT_STATE)) : TRUE) END pt_state_witness $$$pt_state_witness.prf (|pt_state_witness| (|pt_thread_state_witness_TCC1| "" (EXPAND "PT_THREAD_STATE") (("" (GRIND) NIL))) (|pt_state_witness_TCC1| "" (EXPAND "PT_STATE") (("" (EXPAND "empty_kst") (("" (REWRITE "subset_emptyset") NIL))))) (|pt_state_witness_prop| "" (INST 1 "pt_state_witness") NIL)) $$$pt_rely.pvs pt_rely : THEORY BEGIN IMPORTING dtos_kernel_shared_rely IMPORTING pt_state st1, st2 : VAR (PT_STATE) ag : VAR THREAD pt_environment(st1,st2,ag) : bool = environment_base(ag,kst(st1),kst(st2)) and st1 with [kst := kst(st2)] = st2 pt_environment_refl: THEOREM pt_environment(st1,st1,ag) pt_hidd(st1,st2,ag) : bool = NOT pt_threads(ag) AND hidd_base(ag, kst(st1), kst(st2)) AND st2 = st1 with [ kst := kst(st2) ] pt_hidd_prop: THEOREM pt_hidd(st1,st2,ag) => k_threads(ag) OR pt_view(st1,st2) pt_rely(st1,st2,ag) : bool = not pt_threads(ag) AND pt_environment(st1,st2,ag) END pt_rely $$$pt_rely.prf (|pt_rely| (|pt_environment_refl| "" (SKOSIMP) (("" (EXPAND "pt_environment") (("" (REWRITE "environment_base_refl") NIL))))) (|pt_hidd_prop| "" (SKOSIMP) (("" (EXPAND "pt_view") (("" (EXPAND "pt_hidd") (("" (EXPAND "hidd_base") (("" (GROUND) (("" (REPLACE -2 +) (("" (REPLACE -1 :DIR RL) (("" (HIDE -1 -2 1 2) (("" (APPLY-EXTENSIONALITY) NIL)))))))))))))))))) $$$pt_protect.pvs pt_protect: THEORY BEGIN IMPORTING pt_ops_base % VARIABLES st1, st2: VAR (PT_STATE) thread: VAR (pt_threads) ri: VAR RECEIVED_INFO handle, dest, next_pt : VAR NAME protected_text, text : VAR TEXT pt_more_protecters(st1, st2, thread, handle, protected_text, dest): bool = pt_pipeline_initialized(thst(st1)(thread))(handle) AND pt_next_pt(thst(st1)(thread))(handle) /= null_name AND send_msg(kst(st1), kst(st2), thread, pt_next_pt(thst(st1)(thread))(handle), protect_op, null_name, protect_msg(protected_text, dest)) pt_last_protecter(st1, st2, thread, handle, protected_text, dest): bool = pt_pipeline_initialized(thst(st1)(thread))(handle) AND pt_next_pt(thst(st1)(thread))(handle) = null_name AND send_msg(kst(st1), kst(st2), thread, dest, provide_protected_data_op, null_name, provide_protected_data_msg(protected_text)) pt_protect(st1, st2, thread): bool = (EXISTS ri, handle, protected_text, text, dest: pt_receive_request_util(thread, ri, protect_op, protect_perm, st1, st2) AND protect_msg(text, dest) = user_msg(ri) AND handle = service_port(ri) AND pt_handles(thst(st1)(thread))(handle) AND pt_keyed(thst(st1)(thread))(handle) AND pt_pipeline_initialized(thst(st1)(thread))(handle) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) AND pt_handles_inv(st1, st2) AND pt_keyed_inv(st1, st2) AND pt_pipeline_initialized_inv(st1, st2) AND protected_text = protect_text(encrypt_mech(thst(st1)(thread)), pt_key(thst(st1)(thread))(handle), text) AND (pt_more_protecters(st1, st2, thread, handle, protected_text, dest) OR pt_last_protecter(st1, st2, thread, handle, protected_text, dest)) ) END pt_protect $$$pt_provide_crypto_handle.pvs pt_provide_crypto_handle: THEORY BEGIN IMPORTING pt_ops_base % VARIABLES st1, st2: VAR (PT_STATE) thread: VAR (pt_threads) ri: VAR RECEIVED_INFO handle, next_pt : VAR NAME pt_provide_crypto_handle(st1, st2, thread): bool = (EXISTS ri, handle, next_pt: pt_receive_request_util(thread, ri, provide_crypto_handle_op, provide_crypto_handle_perm, st1, st2) AND provide_crypto_handle_msg(next_pt) = user_msg(ri) AND pt_keyed(thst(st1)(thread))(handle) AND pt_next_pt_reply_port(thst(st1)(thread))(handle) = service_port(ri) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) AND pt_handles_inv(st1, st2) AND pt_keyed_inv(st1, st2) AND pt_initialize_pipeline(st1, st2, thread, handle, next_pt) ) END pt_provide_crypto_handle $$$pt_provide_key.pvs pt_provide_key: THEORY BEGIN IMPORTING pt_ops_base % VARIABLES st1, st2: VAR (PT_STATE) thread: VAR (pt_threads) args: VAR NAME_SEQ ri: VAR RECEIVED_INFO key: VAR KEY handle, reply_port, next_pt_reply_port : VAR NAME pt_store_key(st1, st2, thread, handle, key, next_pt_reply_port) : bool = pt_keyed(thst(st2)(thread)) = add(handle, pt_keyed(thst(st1)(thread))) AND pt_key(thst(st2)(thread)) = pt_key(thst(st1)(thread)) WITH [handle := key] AND pt_next_pt_reply_port(thst(st2)(thread)) = pt_next_pt_reply_port(thst(st1)(thread)) WITH [handle := next_pt_reply_port] pt_more_pts(st1, st2, thread, handle, key): bool = (EXISTS reply_port, args: pt_handles(thst(st1)(thread))(handle) AND args = pt_args(thst(st1)(thread))(handle) AND 2 <= size(args) AND pt_store_key(st1, st2, thread, handle, key, reply_port) AND pt_pipeline_initialized_inv(st1, st2) AND avail_port(thst(st1)(thread))(reply_port) AND avail_port(thst(st2)(thread)) = remove(reply_port, avail_port(thst(st1)(thread))) AND send_msg(kst(st1), kst(st2), thread, elem(args)(2), init_crypto_context_op, reply_port, init_crypto_context_msg(pop(pop(args)))) ) pt_last_pt(st1, st2, thread, handle, key): bool = (EXISTS args: pt_handles(thst(st1)(thread))(handle) AND args = pt_args(thst(st1)(thread))(handle) AND size(args) = 1 AND pt_store_key(st1, st2, thread, handle, key, null_name) AND pt_initialize_pipeline(st1, st2, thread, handle, null_name) ) pt_provide_key(st1, st2, thread): bool = (EXISTS ri, handle, key: pt_receive_request_util(thread, ri, provide_key_op, provide_key_perm, st1, st2) AND provide_key_msg(key) = user_msg(ri) AND pt_handles(thst(st1)(thread))(handle) AND pt_key_server_reply_port(thst(st1)(thread))(handle) = service_port(ri) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) AND pt_handles_inv(st1, st2) AND (pt_more_pts(st1, st2, thread, handle, key) OR pt_last_pt(st1, st2, thread, handle, key)) ) END pt_provide_key $$$pt_provide_key.prf (|pt_provide_key| (|pt_store_key_TCC1| "" (GRIND :DEFS NIL :REWRITES "add") NIL) (|pt_more_pts_TCC1| "" (SKOSIMP) (("" (GROUND) NIL))) (|pt_more_pts_TCC2| "" (GRIND :DEFS NIL :REWRITES "nonemptyfseq") NIL) (|pt_more_pts_TCC3| "" (GRIND :DEFS NIL :REWRITES ("nonemptyfseq" "pop")) (("" (EXPAND "nonemptyfseq") (("" (GROUND) NIL)))))) $$$pt_init_crypto_context.pvs pt_init_crypto_context: THEORY BEGIN IMPORTING pt_ops_base % VARIABLES st1, st2: VAR (PT_STATE) thread: VAR (pt_threads) name_seq: VAR NAME_SEQ ri: VAR RECEIVED_INFO key_server, new_handle, reply_port : VAR NAME initialize_handle(st1, st2, thread, new_handle, ri, name_seq, reply_port) : bool = avail_port(thst(st1)(thread))(new_handle) AND avail_port(thst(st2)(thread)) = remove(new_handle, avail_port(thst(st1)(thread))) AND pt_handles(thst(st2)(thread)) = add(new_handle, pt_handles(thst(st1)(thread))) AND pt_handles(thst(st2)(thread))(new_handle) AND pt_reply_to(thst(st2)(thread)) = pt_reply_to(thst(st1)(thread)) WITH [(new_handle) := reply_name(ri)] AND pt_args(thst(st2)(thread)) = pt_args(thst(st1)(thread)) WITH [(new_handle) := name_seq] AND avail_port(thst(st1)(thread))(reply_port) AND avail_port(thst(st2)(thread)) = remove(reply_port, avail_port(thst(st1)(thread))) AND pt_key_server_reply_port(thst(st2)(thread)) = pt_key_server_reply_port(thst(st1)(thread)) WITH [(new_handle) := reply_port] pt_init_crypto_context(st1, st2, thread): bool = (EXISTS ri, reply_port, key_server, new_handle, name_seq: pt_receive_request_util(thread, ri, init_crypto_context_op, init_crypto_context_perm, st1, st2) AND init_crypto_context_msg(name_seq) = user_msg(ri) AND service_port(thst(st1)(thread)) = service_port(ri) AND 1 <= size(name_seq) AND key_server = elem(name_seq)(1) AND initialize_handle(st1, st2, thread, new_handle, ri, name_seq, reply_port) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) AND pt_keyed_inv(st1, st2) AND pt_pipeline_initialized_inv(st1, st2) AND send_msg(kst(st1), kst(st2), thread, key_server, retrieve_key_op, reply_port, null_user_msg) ) END pt_init_crypto_context $$$pt_init_crypto_context.prf (|pt_init_crypto_context| (|pt_init_crypto_context_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL)))) $$$pt_state.pvs pt_state : THEORY BEGIN IMPORTING crypto_shared_state pt_threads: (nonempty?[THREAD]) pt_threads_witness: (pt_threads) pt_threads_nonempty: AXIOM pt_threads /= emptyset % Each thread is a separate protection task with the following state information PT_THREAD_STATE_BASE : TYPE = [# service_port: NAME, % where I receive my init_cc requests encrypt_mech : ENCRYPT_MECH, % mechanism I provide to clients avail_port: setof[NAME], % my supply of unused handles pt_handles : setof[NAME], % handles I've given out. pt_reply_to : [(pt_handles) -> NAME], % where to send the handle pt_args : [(pt_handles) -> NAME_SEQ], % names passed in as arguments pt_key_server_reply_port : [(pt_handles) -> NAME], % where to receive the key. pt_keyed : setof[NAME], % handles for which I have a key pt_key : [(pt_keyed) -> KEY], % the key for each handle pt_next_pt_reply_port : [(pt_keyed) -> NAME], % where to receive handle % from next pt. pt_pipeline_initialized : setof[NAME], % the handles for which the pipeline % has been initialized. pt_next_pt : [(pt_pipeline_initialized) -> NAME] % handle for next prot task #] ptths : VAR PT_THREAD_STATE_BASE PT_THREAD_STATE(ptths) : bool = disjoint?(avail_port(ptths), pt_handles(ptths)) AND NOT avail_port(ptths)(service_port(ptths)) AND subset?(pt_keyed(ptths), pt_handles(ptths)) AND subset?(pt_pipeline_initialized(ptths), pt_handles(ptths)) PT_STATE_BASE : TYPE = [# thst : [(pt_threads) -> (PT_THREAD_STATE)], kst: KERNEL_SHARED_STATE #] ptstb : VAR PT_STATE_BASE PT_STATE(ptstb): bool = subset?(existing_threads(kst(ptstb)), pt_threads) st1, st2: VAR (PT_STATE) pt_view(st1,st2) : bool = st1 = st2 END pt_state $$$pt_state.prf (|pt_state| (|pt_threads_TCC1| "" (INST 1 "fullset[THREAD]") (("" (GRIND) (("" (INST -1 "epsilon! (t : THREAD): true") NIL))))) (|pt_threads_witness_TCC1| "" (TYPEPRED "pt_threads") (("" (GRIND) (("" (INST 1 "x!1") NIL))))) (|pt_thread_state_witness_TCC1| "" (EXPAND "PT_THREAD_STATE") (("" (GRIND) NIL))) (|pt_state_witness_TCC1| "" (EXPAND "PT_STATE") (("" (GROUND) (("" (EXPAND "subset?") (("" (SKOSIMP) (("" (EXPAND "member") (("" (REPLACE -1) (("" (TYPEPRED "pt_threads_witness") (("" (PROPAX) NIL))))))))))))))) (|pt_state_witness_prop| "" (INST 1 "pt_state_witness") NIL)) $$$pt_ops_base.pvs pt_ops_base: THEORY BEGIN IMPORTING pt_state IMPORTING dtos_kernel_shared_ops IMPORTING messaging st1, st2: VAR (PT_STATE) thread, th, th1, th2 : VAR (pt_threads) %%local state invariants pt_static(st1, st2): bool = (FORALL th: service_port(thst(st2)(th)) = service_port(thst(st1)(th)) AND encrypt_mech(thst(st2)(th)) = encrypt_mech(thst(st1)(th))) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) %a step must obey local invariants and only make allowed % mods to kernel state or its own thst. pt_step(st1, st2, thread): bool = pt_static(st1, st2) AND effects_on_kernel_state(kst(st1), kst(st2), pt_threads) AND (FORALL th: (NOT (th = thread) IMPLIES thst(st1)(th) = thst(st2)(th))) ri: VAR RECEIVED_INFO op_id: VAR OP perm: VAR PERMISSION next_pt, handle: VAR NAME % UTILITY FUNCTIONS pt_handles_inv(st1, st2): bool = (FORALL th: pt_handles(thst(st2)(th)) = pt_handles(thst(st1)(th)) AND pt_reply_to(thst(st2)(th)) = pt_reply_to(thst(st1)(th)) AND pt_args(thst(st2)(th)) = pt_args(thst(st1)(th)) AND pt_key_server_reply_port(thst(st2)(th)) = pt_key_server_reply_port(thst(st1)(th)) ) pt_keyed_inv(st1, st2): bool = (FORALL th: pt_keyed(thst(st2)(th)) = pt_keyed(thst(st1)(th)) AND pt_key(thst(st2)(th)) = pt_key(thst(st1)(th)) AND pt_next_pt_reply_port(thst(st2)(th)) = pt_next_pt_reply_port(thst(st1)(th))) pt_pipeline_initialized_inv(st1, st2): bool = (FORALL th: pt_pipeline_initialized(thst(st2)(th)) = pt_pipeline_initialized(thst(st1)(th)) AND pt_next_pt(thst(st2)(th)) = pt_next_pt(thst(st1)(th))) pt_initialize_pipeline(st1, st2, thread, handle, next_pt): bool = pt_pipeline_initialized(thst(st2)(thread)) = add(handle, pt_pipeline_initialized(thst(st1)(thread))) AND pt_next_pt(thst(st2)(thread)) = pt_next_pt(thst(st2)(thread)) WITH [handle := next_pt] AND pt_handles(thst(st1)(thread))(handle) AND send_msg(kst(st1), kst(st2), thread, pt_reply_to(thst(st1)(thread))(handle), provide_crypto_handle_op, null_name, provide_crypto_handle_msg(handle)) % processing a newly received request pt_receive_request_util(thread, ri, op_id, perm, st1, st2): bool = receive_request(thread, ri, op_id, perm, kst(st1), kst(st2)) END pt_ops_base $$$pt_ops_base.prf (|pt_ops_base| (|pt_handles_inv_TCC1| "" (GRIND) NIL) (|pt_keyed_inv_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL))) (|pt_pipeline_initialized_inv_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL))) (|pt_initialize_pipeline_TCC1| "" (GRIND :DEFS NIL :REWRITES "add") NIL)) $$$pt_receive_request.pvs pt_receive_request: THEORY BEGIN IMPORTING pt_ops_base st1, st2: VAR (PT_STATE) thread: VAR (pt_threads) name: VAR NAME pt_receive_request_submit(st1, st2, thread): bool = EXISTS name: receive_msg(kst(st1), kst(st2), thread, name) pt_receive_request(st1, st2, thread): bool = thst(st2) = thst(st1) AND pt_receive_request_submit(st1, st2, thread) END pt_receive_request $$$pt_ops.pvs pt_ops: THEORY BEGIN IMPORTING pt_receive_request IMPORTING pt_init_crypto_context IMPORTING pt_provide_key IMPORTING pt_provide_crypto_handle IMPORTING pt_protect st1, st2 : VAR (PT_STATE) thread : VAR THREAD th: VAR (pt_threads) pt_op(st1, st2, th) : bool = pt_receive_request(st1, st2, th) OR pt_init_crypto_context(st1, st2, th) OR pt_provide_key(st1, st2, th) OR pt_provide_crypto_handle(st1, st2, th) OR pt_protect(st1, st2, th) pt_guar(st1,st2,thread) : bool = pt_threads(thread) AND (pt_view(st1,st2) OR (pt_step(st1, st2, thread) AND pt_op(st1, st2, thread))) END pt_ops $$$pt_ops.prf (|pt_ops| (|pt_guar_TCC1| "" (SKOSIMP) (("" (POSTPONE) NIL)))) $$$pt_spec.pvs pt_spec : THEORY BEGIN IMPORTING dtos_kernel_shared_state IMPORTING pt_ops IMPORTING pt_rely IMPORTING pt_state_witness IMPORTING component_aux[(PT_STATE), THREAD] st, st1, st2 : VAR (PT_STATE) ag : VAR THREAD thread : VAR (pt_threads) initial_pt_states(st) : bool = (FORALL thread: pt_handles(thst(st)(thread)) = emptyset[NAME] AND pending_requests(kst(st)) = emptyset[KERNEL_REQ] AND (FORALL ag : existing_threads(kst(st))(ag) => ri_status(received_info(kst(st))(ag)) = ri_processed)) pt_state_witness_initial: THEOREM initial_pt_states(pt_state_witness) base_pt_comp : base_comp_t = (# init := initial_pt_states, guar := pt_guar, rely := pt_rely, hidd := pt_hidd, cags := pt_threads, view := pt_view, wfar := emptyset[TRANSITION_CLASS[(PT_STATE), THREAD]], sfar := emptyset[TRANSITION_CLASS[(PT_STATE), THREAD]] #) pt_view_eq: THEOREM view_eq(base_pt_comp) pt_comp_init: THEOREM init_restriction(base_pt_comp) pt_comp_guar: THEOREM guar_restriction(base_pt_comp) pt_comp_rely_hidd: THEOREM rely_hidd_restriction(base_pt_comp) pt_comp_hidd: THEOREM hidd_restriction(base_pt_comp) pt_comp_rely: THEOREM rely_restriction(base_pt_comp) pt_comp_cags: THEOREM cags_restriction(base_pt_comp) pt_comp_guar_stuttering: THEOREM guar_stuttering_restriction(base_pt_comp) pt_comp_rely_stuttering: THEOREM rely_stuttering_restriction(base_pt_comp) pt_comp : (comp_t) = base_pt_comp pt_comp_hidd_prop: THEOREM hidd(pt_comp)(st1, st2, ag) => k_threads(ag) OR view(pt_comp)(st1, st2) END pt_spec $$$pt_spec.prf (|pt_spec| (IMPORTING5_TCC1 "" (INST + "pt_state_witness") NIL) (|pt_state_witness_initial| "" (EXPAND "initial_pt_states") (("" (EXPAND "pt_state_witness") (("" (EXPAND "pt_thread_state_witness") (("" (EXPAND "empty_kst") (("" (EXPAND "emptyset") (("" (PROPAX) NIL))))))))))) (|base_pt_comp_TCC1| "" (EXPAND "pt_view") (("" (REWRITE "eq_view1") NIL))) (|pt_view_eq| "" (EXPAND "view_eq") (("" (EXPAND "base_pt_comp") (("" (SKOSIMP) (("" (EXPAND "pt_view") (("" (PROPAX) NIL))))))))) (|pt_comp_init| "" (EXPAND "init_restriction") (("" (EXPAND "base_pt_comp") (("" (FLATTEN) (("" (LEMMA "emptyset_is_empty?[(PT_STATE)]") (("" (INST -1 "initial_pt_states") (("" (FLATTEN) (("" (HIDE -1) (("" (SPLIT -1) (("1" (EXPAND "empty?") (("1" (HIDE -2) (("1" (INST -1 "pt_state_witness") (("1" (EXPAND "member") (("1" (REWRITE "pt_state_witness_initial") NIL))))))))) ("2" (PROPAX) NIL))))))))))))))))) (|pt_comp_guar| "" (EXPAND "guar_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_pt_comp") (("" (GROUND) (("" (EXPAND "pt_guar") (("" (PROPAX) NIL))))))))))))) (|pt_comp_rely_hidd| "" (EXPAND "rely_hidd_restriction") (("" (EXPAND "subset?") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_pt_comp") (("" (EXPAND "pt_rely") (("" (GROUND) (("" (EXPAND "pt_hidd") (("" (EXPAND "pt_environment") (("" (REWRITE "hidd_base_prop") (("" (GROUND) NIL))))))))))))))))))))) (|pt_comp_hidd| "" (EXPAND "hidd_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_pt_comp") (("" (GROUND) (("" (EXPAND "pt_hidd") (("" (PROPAX) NIL))))))))))))) (|pt_comp_rely| "" (EXPAND "rely_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_pt_comp") (("" (EXPAND "pt_rely") (("" (GROUND) NIL))))))))))) (|pt_comp_cags| "" (EXPAND "cags_restriction") (("" (GROUND) (("" (EXPAND "base_pt_comp") (("" (LEMMA "pt_threads_nonempty") (("" (GROUND) NIL))))))))) (|pt_comp_guar_stuttering| "" (EXPAND "guar_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_pt_comp") (("" (EXPAND "pt_guar") (("" (GROUND) NIL))))))))))))) (|pt_comp_rely_stuttering| "" (EXPAND "rely_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_pt_comp") (("" (EXPAND "pt_rely") (("" (EXPAND "complement") (("" (EXPAND "member") (("" (EXPAND "pt_view") (("" (GROUND) (("" (REPLACE -1) (("" (REWRITE "pt_environment_refl") NIL))))))))))))))))))))))) (|pt_comp_TCC1| "" (USE "pt_view_eq") (("" (USE "pt_comp_init") (("" (USE "pt_comp_guar") (("" (USE "pt_comp_rely_hidd") (("" (USE "pt_comp_hidd") (("" (USE "pt_comp_cags") (("" (USE "pt_comp_guar_stuttering") (("" (USE "pt_comp_rely_stuttering") (("" (REWRITE "component_view_eq_thm") NIL))))))))))))))))) (|pt_comp_hidd_prop| "" (EXPAND "pt_comp") (("" (EXPAND "base_pt_comp") (("" (USE "pt_hidd_prop") NIL)))))) $$$cc_state_witness.pvs cc_state_witness: THEORY BEGIN IMPORTING cc_state cc_state_witness: (CC_STATE) = (# active_ccc := emptyset[RECEIVED_INFO], ssups := null_name, service_ports := emptyset[NAME], avail_port := emptyset[NAME], retrieve_pf_port := emptyset, pending_retrieve_pf := (LAMBDA (x: (emptyset[NAME])): ri_witness), ccc_prot_family := (LAMBDA (x: RECEIVED_INFO): null_prot_family), ccc_handle := (LAMBDA (x: RECEIVED_INFO): null_name), key_init_port := emptyset, pending_key_init := (LAMBDA (x: (emptyset[NAME])): (ri_witness, 1)), ccc_init_cc_args := (LAMBDA (x: RECEIVED_INFO): null_name_seq(1)), context_port := emptyset, pending_context_port := (LAMBDA (x: (emptyset[NAME])): ri_witness), key_mech_server := (LAMBDA (km: KEY_MECH): null_name), encrypt_mech_server := (LAMBDA (em: ENCRYPT_MECH): null_name), kst := empty_kst #) cc_state_witness_prop : THEOREM (EXISTS (ccstb : (CC_STATE)) : TRUE) END cc_state_witness $$$cc_state_witness.prf (|cc_state_witness| (|cc_state_witness_TCC1| "" (EXPAND "CC_STATE") (("" (EXPAND "disjoint?") (("" (REWRITE "intersection_empty") (("" (REWRITE "emptyset_is_empty?") (("" (GROUND) (("1" (EXPAND "emptyset") (("1" (PROPAX) NIL))) ("2" (EXPAND "empty_kst") (("2" (REWRITE "subset_emptyset") NIL))))))))))))) (|cc_state_witness_prop| "" (INST 1 "cc_state_witness") NIL)) $$$kst_merge.pvs kst_merge : THEORY BEGIN IMPORTING dtos_kernel_shared_state IMPORTING more_set_lemmas th : VAR THREAD kst : VAR KERNEL_SHARED_STATE i,j : VAR nat S,T : VAR setof[THREAD] kst1, kst2 : VAR KERNEL_SHARED_STATE kstset, kstset1, kstset2 : VAR setof[KERNEL_SHARED_STATE] kst_mergable(kstset): bool = (FORALL th, kst1, kst2: (kstset(kst1) AND kstset(kst2) AND existing_threads(kst1)(th) AND existing_threads(kst2)(th)) => (received_info(kst2)(th) = received_info(kst1)(th) AND thread_status(kst2)(th) = thread_status(kst1)(th))) km, km1, km2 : VAR (kst_mergable) ri: VAR RECEIVED_INFO thst: VAR THREAD_STATUS %%% Note that if a thread is shared, it must have the same status %%% and received info in all ksts for the merge to be successful. kst_merge(km1) : KERNEL_SHARED_STATE = LET all_threads : setof[THREAD] = { th : THREAD | EXISTS (kst : (km1)) : existing_threads(kst)(th)} IN (# pending_requests := { kr : KERNEL_REQ | EXISTS (kst : (km1)) : pending_requests(kst)(kr)}, existing_threads := all_threads, received_info := (LAMBDA (th : (all_threads)) : epsilon({ri | FORALL (kst: (km1)) : existing_threads(kst)(th) IMPLIES ri = received_info(kst)(th)})), thread_status := (LAMBDA (th : (all_threads)) : epsilon({thst | FORALL (kst: (km1)) : existing_threads(kst)(th) IMPLIES thst = thread_status(kst)(th)})) #) kst_substate(kst1, kst2) : bool = subset?(existing_threads(kst1), existing_threads(kst2)) AND subset?(pending_requests(kst1), pending_requests(kst2)) AND FORALL (th : (existing_threads(kst1))) : (received_info(kst1)(th) = received_info(kst2)(th) AND thread_status(kst1)(th) = thread_status(kst2)(th)) empty_kst_substate: THEOREM kst_substate(empty_kst, kst2) kst_substate_refl: THEOREM kst_substate(kst1,kst1) kst_merge_contains: THEOREM km(kst) => kst_substate(kst, kst_merge(km)) kst_mergable_disjoint_threads : THEOREM (FORALL (kst1, kst2 : (kstset), th) : existing_threads(kst1)(th) AND existing_threads(kst2)(th) IMPLIES kst1 = kst2) IMPLIES kst_mergable(kstset) kst_mergable_add : THEOREM (FORALL (kst2 : (km2)) : kst_mergable({kst | kst = kst1 or kst = kst2})) IMPLIES kst_mergable(add(kst1, km2)) kst_mergable_union : THEOREM (FORALL (kst : (km1)) : kst_mergable(add(kst, km2))) IMPLIES kst_mergable(union(km1, km2)) kst_mergable_subset: THEOREM subset?(kstset, km1) IMPLIES kst_mergable(kstset) kst_mergable_substates : THEOREM (FORALL (kst1 : (kstset)) : kst_substate(kst1, kst2)) IMPLIES kst_mergable(add(kst2, kstset)) kst_merge_substates_existing_threads : THEOREM (FORALL (kst1 : (kstset)) : kst_substate(kst1, kst2)) IMPLIES existing_threads(kst2) = existing_threads(kst_merge(add(kst2, kstset))) kst_merge_substates_pending_requests : THEOREM (FORALL (kst1 : (kstset)) : kst_substate(kst1, kst2)) IMPLIES pending_requests(kst2) = pending_requests(kst_merge(add(kst2, kstset))) kst_merge_substates_received_info : THEOREM (FORALL (kst1 : (kstset)) : kst_substate(kst1, kst2)) IMPLIES received_info(kst2) = received_info(kst_merge(add(kst2, kstset))) kst_merge_substates_thread_status : THEOREM (FORALL (kst1 : (kstset)) : kst_substate(kst1, kst2)) IMPLIES thread_status(kst2) = thread_status(kst_merge(add(kst2, kstset))) kst_merge_substates : THEOREM (FORALL (kst1 : (kstset)) : kst_substate(kst1, kst2)) IMPLIES kst2 = kst_merge(add(kst2, kstset)) END kst_merge $$$kst_merge.prf (|kst_merge| (|kst_mergable_TCC1| "" (SKOSIMP) NIL) (|kst_mergable_TCC2| "" (SKOSIMP) NIL) (|kst_substate_TCC1| "" (GRIND) NIL) (|kst_substate_TCC2| "" (GRIND) NIL) (|empty_kst_substate| "" (SKOSIMP) (("" (EXPAND "empty_kst") (("" (EXPAND "kst_substate") (("" (GROUND) (("1" (REWRITE "subset_emptyset") NIL) ("2" (REWRITE "subset_emptyset") NIL) ("3" (SKOSIMP) (("3" (TYPEPRED "th!1") (("3" (EXPAND "emptyset") (("3" (PROPAX) NIL))))))))))))))) (|kst_substate_refl| "" (SKOSIMP) (("" (EXPAND "kst_substate") (("" (EXPAND "subset?") (("" (EXPAND "member") (("" (GROUND) (("1" (SKOSIMP*) NIL) ("2" (SKOSIMP*) NIL))))))))))) (|kst_merge_contains| "" (SKOSIMP) (("" (EXPAND "kst_substate") (("" (EXPAND "kst_merge") (("" (EXPAND "subset?") (("" (EXPAND "member") (("" (GROUND) (("1" (SKOSIMP) (("1" (INST?) NIL))) ("2" (SKOSIMP) (("2" (INST?) NIL))) ("3" (SKOSIMP) (("3" (GROUND) (("1" (USE "epsilon_ax[RECEIVED_INFO]") (("1" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST + "received_info(kst!1)(th!1)") (("2" (SKOSIMP) (("2" (TYPEPRED "km!1") (("2" (HIDE 2) (("2" (EXPAND "kst_mergable") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))) ("2" (USE "epsilon_ax[THREAD_STATUS]") (("2" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (HIDE 2) (("2" (INST + "thread_status(kst!1)(th!1)") (("2" (SKOSIMP) (("2" (TYPEPRED "km!1") (("2" (EXPAND "kst_mergable") (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))))) (|kst_mergable_disjoint_threads| "" (SKOSIMP*) (("" (EXPAND "kst_mergable") (("" (SKOSIMP) (("" (CASE "kst1!1 = kst2!1") (("1" (GROUND) NIL) ("2" (INST?) (("2" (INST?) (("2" (GROUND) NIL))))))))))))) (|kst_mergable_add| "" (SKOSIMP*) (("" (TYPEPRED "km2!1") (("" (EXPAND "kst_mergable") (("" (SKOSIMP) (("" (EXPAND "add") (("" (EXPAND "member") (("" (SPLIT -) (("1" (SPLIT -) (("1" (GROUND) NIL) ("2" (INST -4 "kst2!1") (("2" (INST? -4) (("2" (GROUND) NIL))))))) ("2" (SPLIT -) (("1" (INST -4 "kst1!2") (("1" (INST? -4) (("1" (GROUND) NIL))))) ("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))) (|kst_mergable_union| "" (SKOSIMP*) (("" (CASE "empty?(km1!1)") (("1" (TYPEPRED "km2!1") (("1" (REWRITE "emptyset_is_empty?") (("1" (REPLACE -2) (("1" (REWRITE "union_commutative") (("1" (REWRITE "union_empty") NIL))))))))) ("2" (TYPEPRED "km1!1") (("2" (EXPAND "kst_mergable") (("2" (SKOSIMP*) (("2" (EXPAND "union") (("2" (EXPAND "add") (("2" (EXPAND "member") (("2" (SPLIT -) (("1" (SPLIT -) (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST -4 "kst1!1") (("2" (INST? -4) (("2" (GROUND) NIL))))))) ("2" (SPLIT -) (("1" (INST -4 "kst2!1") (("1" (INST? -4) (("1" (GROUND) NIL))))) ("2" (EXPAND "empty?") (("2" (EXPAND "member") (("2" (SKOSIMP) (("2" (INST -5 "x!1") (("2" (INST? -5) (("2" (GROUND) NIL))))))))))))))))))))))))))))))) (|kst_mergable_subset| "" (SKOSIMP) (("" (TYPEPRED "km1!1") (("" (EXPAND "kst_mergable") (("" (SKOSIMP) (("" (EXPAND "subset?") (("" (EXPAND "member") (("" (CASE "km1!1(kst1!1) and km1!1(kst2!1)") (("1" (FLATTEN) (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (HIDE 2 -5) (("2" (SPLIT) (("1" (GRIND :DEFS NIL) NIL) ("2" (HIDE -1) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))) (|kst_mergable_substates| "" (SKOSIMP*) (("" (EXPAND "kst_mergable") (("" (SKOSIMP) (("" (EXPAND "kst_substate") (("" (EXPAND "add") (("" (EXPAND "member") (("" (SPLIT -) (("1" (SPLIT -) (("1" (GROUND) NIL) ("2" (INST - "kst2!2") (("2" (GRIND :DEFS NIL) NIL))))) ("2" (SPLIT -) (("1" (INST - "kst1!1") (("1" (GRIND :DEFS NIL) NIL))) ("2" (INST-CP - "kst2!2") (("2" (INST - "kst1!1") (("2" (GRIND :DEFS NIL) NIL))))))))))))))))))))) (|kst_merge_substates_existing_threads_TCC1| "" (SKOSIMP) (("" (REWRITE "kst_mergable_substates") NIL))) (|kst_merge_substates_existing_threads| "" (SKOSIMP) (("" (EXTENSIONALITY "setof[THREAD]") (("" (INST?) (("1" (GROUND) (("1" (SKOSIMP) (("1" (HIDE 2) (("1" (IFF) (("1" (EXPAND "add") (("1" (EXPAND "kst_merge") (("1" (SPLIT) (("1" (GROUND) (("1" (INST? +) NIL))) ("2" (FLATTEN) (("2" (SKOSIMP) (("2" (INST - "kst!1") (("1" (EXPAND "kst_substate") (("1" (FLATTEN) (("1" (HIDE -3 -4) (("1" (GRIND) NIL))))))) ("2" (TYPEPRED "kst!1") (("2" (EXPAND "member") (("2" (GROUND) NIL))))))))))))))))))))))))) ("2" (REWRITE "kst_mergable_substates") NIL))))))) (|kst_merge_substates_pending_requests| "" (SKOSIMP) (("" (EXTENSIONALITY "setof[KERNEL_REQ]") (("" (INST?) (("1" (GROUND) (("1" (SKOSIMP) (("1" (HIDE 2) (("1" (IFF) (("1" (EXPAND "add") (("1" (EXPAND "kst_merge") (("1" (SPLIT) (("1" (GROUND) (("1" (INST? +) NIL))) ("2" (FLATTEN) (("2" (SKOSIMP) (("2" (INST - "kst!1") (("1" (EXPAND "kst_substate") (("1" (FLATTEN) (("1" (GRIND) NIL))))) ("2" (TYPEPRED "kst!1") (("2" (EXPAND "member") (("2" (GROUND) NIL))))))))))))))))))))))))) ("2" (REWRITE "kst_mergable_substates") NIL))))))) (|kst_merge_substates_received_info_TCC1| "" (SKOSIMP) (("" (SKOSIMP) (("" (LEMMA "kst_merge_substates_existing_threads") (("" (INST?) (("" (SPLIT) (("1" (GROUND) NIL) ("2" (PROPAX) NIL))))))))))) (|kst_merge_substates_received_info| "" (SKOSIMP) (("" (EXTENSIONALITY "[(existing_threads(kst2!1)) -> RECEIVED_INFO]") (("" (INST - "received_info(kst2!1)" "received_info(kst_merge(add(kst2!1, kstset!1)))") (("1" (GROUND) (("1" (SKOSIMP) (("1" (HIDE 2) (("1" (EXPAND "add") (("1" (EXPAND "kst_merge") (("1" (EXPAND "kst_substate") (("1" (CASE "singleton(received_info(kst2!1)(x!1)) = {ri: RECEIVED_INFO | FORALL (kst: ({y: KERNEL_SHARED_STATE | kst2!1 = y OR member(y, kstset!1)})): existing_threads(kst)(x!1) IMPLIES ri = received_info(kst)(x!1)}") (("1" (REPLACE -1 :DIR RL) (("1" (HIDE -1) (("1" (LEMMA "singleton_epsilon[RECEIVED_INFO]") (("1" (INST?) (("1" (SPLIT) (("1" (GROUND) NIL) ("2" (INST + "ri_witness") NIL))))))))))) ("2" (HIDE 2) (("2" (EXTENSIONALITY "setof[RECEIVED_INFO]") (("2" (INST?) (("2" (GROUND) (("2" (SKOSIMP) (("2" (HIDE 2) (("2" (IFF) (("2" (EXPAND "singleton") (("2" (SPLIT) (("1" (GROUND) (("1" (SKOSIMP) (("1" (INST - "kst!1") (("1" (FLATTEN) (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (TYPEPRED "kst!1") (("2" (EXPAND "member") (("2" (GROUND) NIL))))))))))) ("2" (SKOSIMP) (("2" (INST?) (("2" (TYPEPRED "x!1") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))) ("2" (LEMMA "kst_merge_substates_existing_threads") (("2" (INST? -) (("2" (SKOSIMP) (("2" (GROUND) NIL))))))) ("3" (REWRITE "kst_mergable_substates") NIL))))))) (|kst_merge_substates_thread_status| "" (SKOSIMP) (("" (EXTENSIONALITY "[(existing_threads(kst2!1)) -> THREAD_STATUS]") (("" (INST - "thread_status(kst2!1)" "thread_status(kst_merge(add(kst2!1, kstset!1)))") (("1" (GROUND) (("1" (SKOSIMP) (("1" (HIDE 2) (("1" (EXPAND "add") (("1" (EXPAND "kst_merge") (("1" (EXPAND "kst_substate") (("1" (CASE "singleton(thread_status(kst2!1)(x!1)) = {ri: THREAD_STATUS | FORALL (kst: ({y: KERNEL_SHARED_STATE | kst2!1 = y OR member(y, kstset!1)})): existing_threads(kst)(x!1) IMPLIES ri = thread_status(kst)(x!1)}") (("1" (REPLACE -1 :DIR RL) (("1" (HIDE -1) (("1" (LEMMA "singleton_epsilon[THREAD_STATUS]") (("1" (INST?) (("1" (SPLIT) (("1" (GROUND) NIL) ("2" (INST + "thread_waiting") NIL))))))))))) ("2" (HIDE 2) (("2" (EXTENSIONALITY "setof[THREAD_STATUS]") (("2" (INST?) (("2" (GROUND) (("2" (SKOSIMP) (("2" (HIDE 2) (("2" (IFF) (("2" (EXPAND "singleton") (("2" (SPLIT) (("1" (GROUND) (("1" (SKOSIMP) (("1" (INST - "kst!1") (("1" (FLATTEN) (("1" (INST?) (("1" (GROUND) NIL))))) ("2" (TYPEPRED "kst!1") (("2" (EXPAND "member") (("2" (GROUND) NIL))))))))))) ("2" (SKOSIMP) (("2" (INST?) (("2" (TYPEPRED "x!1") (("2" (GROUND) NIL))))))))))))))))))))))))))))))))))))))) ("2" (LEMMA "kst_merge_substates_existing_threads") (("2" (INST? -) (("2" (SKOSIMP) (("2" (GROUND) NIL))))))) ("3" (REWRITE "kst_mergable_substates") NIL))))))) (|kst_merge_substates| "" (SKOSIMP) (("" (EXTENSIONALITY "KERNEL_SHARED_STATE") (("" (INST?) (("1" (GROUND) (("1" (REWRITE "kst_merge_substates_existing_threads") NIL) ("2" (REWRITE "kst_merge_substates_pending_requests") NIL) ("3" (REWRITE "kst_merge_substates_received_info") NIL) ("4" (REWRITE "kst_merge_substates_thread_status") NIL))) ("2" (REWRITE "kst_mergable_substates") NIL)))))))) $$$dtos_kernel_shared_rely.pvs dtos_kernel_shared_rely: THEORY BEGIN IMPORTING dtos_kernel_shared_state IMPORTING kst_merge c_ags: VAR setof[THREAD] thread, ag: VAR THREAD kst, kst1, kst2: VAR KERNEL_SHARED_STATE ri: VAR RECEIVED_INFO kernel_req: VAR KERNEL_REQ %% The following assume a context where the kst's are local %% to a single component. Thus, although other components may %% alter their own kst's there is nothing they can do (with the %% exception of the kernel) to the kst of the component being %% defined. existing_threads_rely(ag, kst1, kst2): bool = existing_threads(kst1) = existing_threads(kst2) OR k_threads(ag) thread_status_rely(ag, kst1, kst2): bool = (FORALL thread: (existing_threads(kst1)(thread) AND existing_threads(kst2)(thread)) IMPLIES (thread_status(kst1)(thread) = thread_running IMPLIES thread_status(kst2)(thread) = thread_running) AND (thread_status(kst1)(thread) = thread_waiting AND thread_status(kst2)(thread) = thread_running IMPLIES k_threads(ag))) received_info_rely(ag, kst1, kst2): bool = (FORALL thread, ri: existing_threads(kst1)(thread) AND received_info(kst1)(thread) = ri AND existing_threads(kst2)(thread) IMPLIES (received_info(kst2)(thread) = ri OR (ri_status(ri) = ri_processed AND k_threads(ag)))) pending_requests_rely(ag, kst1, kst2): bool = (FORALL kernel_req: (pending_requests(kst1)(kernel_req) AND NOT pending_requests(kst2)(kernel_req) IMPLIES k_threads(ag)) AND (pending_requests(kst2)(kernel_req) => pending_requests(kst1)(kernel_req)) ) environment_base(ag, kst1, kst2): bool = existing_threads_rely(ag, kst1, kst2) AND thread_status_rely(ag, kst1, kst2) AND received_info_rely(ag, kst1, kst2) AND pending_requests_rely(ag, kst1, kst2) environment_base_refl: THEOREM environment_base(ag, kst1, kst1) hidd_base(ag, kst1, kst2): bool = (kst1 = kst2 OR k_threads(ag)) AND (FORALL kernel_req: (pending_requests(kst2)(kernel_req) => pending_requests(kst1)(kernel_req)) ) hidd_base_prop: THEOREM environment_base(ag, kst1, kst2) => hidd_base(ag, kst1, kst2) hidd_env_prop: THEOREM hidd_base(ag, kst1, kst2) AND (FORALL thread: (existing_threads(kst1)(thread) AND existing_threads(kst2)(thread)) IMPLIES (thread_status(kst1)(thread) = thread_running IMPLIES thread_status(kst2)(thread) = thread_running)) AND (FORALL thread, ri: existing_threads(kst1)(thread) AND received_info(kst1)(thread) = ri AND existing_threads(kst2)(thread) IMPLIES (received_info(kst2)(thread) = ri OR ri_status(ri) = ri_processed)) => environment_base(ag, kst1, kst2) END dtos_kernel_shared_rely $$$dtos_kernel_shared_rely.prf (|dtos_kernel_shared_rely| (|thread_status_rely_TCC1| "" (SUBTYPE-TCC) NIL) (|thread_status_rely_TCC2| "" (SUBTYPE-TCC) NIL) (|thread_status_rely_TCC3| "" (SUBTYPE-TCC) NIL) (|received_info_rely_TCC1| "" (SUBTYPE-TCC) NIL) (|hidd_env_prop_TCC1| "" (SUBTYPE-TCC) NIL) (|hidd_env_prop_TCC2| "" (SUBTYPE-TCC) NIL) (|hidd_env_prop_TCC3| "" (SUBTYPE-TCC) NIL)) $$$cc_rely.pvs cc_rely : THEORY BEGIN IMPORTING dtos_kernel_shared_rely IMPORTING cc_state st1, st2 : VAR (CC_STATE) ag : VAR THREAD cc_environment(st1,st2,ag) : bool = environment_base(ag,kst(st1),kst(st2)) and st1 with [kst := kst(st2)] = st2 cc_environment_refl: THEOREM cc_environment(st1,st1,ag) cc_hidd(st1,st2,ag) : bool = NOT cc_threads(ag) AND hidd_base(ag, kst(st1), kst(st2)) AND st2 = st1 WITH [ kst := kst(st2) ] cc_hidd_prop: THEOREM cc_hidd(st1,st2,ag) => k_threads(ag) OR cc_view(st1,st2) cc_rely(st1,st2,ag) : bool = not cc_threads(ag) AND cc_environment(st1,st2,ag) END cc_rely $$$cc_provide_crypto_handle.pvs cc_provide_crypto_handle: THEORY BEGIN IMPORTING cc_ops_base % VARIABLES st1, st2: VAR (CC_STATE) thread: VAR THREAD port, name: VAR NAME ccc, ri: VAR RECEIVED_INFO svc_port : VAR NAME unmark_context_port(st1, st2, svc_port) : bool = avail_port(st2) = add(svc_port, avail_port(st1)) AND context_port(st2) = remove(svc_port, context_port(st1)) AND pending_context_port(st2) = (LAMBDA (port : (context_port(st2))) : pending_context_port(st1)(port)) cc_provide_crypto_handle(st1, st2): bool = (EXISTS thread, ri, name, svc_port, ccc: receive_request(thread, ri, provide_crypto_handle_op, provide_crypto_handle_perm, st1, st2) AND provide_crypto_handle_msg(name) = user_msg(ri) AND name /= null_name AND svc_port = service_port(ri) AND context_port(st1)(svc_port) AND ccc = pending_context_port(st1)(svc_port) AND active_ccc(st1)(ccc) AND ccc_handle(st1)(ccc) = null_name AND active_ccc(st2)(ccc) AND ccc_handle(st2) = ccc_handle(st1) WITH [(ccc) := name] AND active_ccc(st2) = active_ccc(st1) AND ccc_prot_family(st2) = ccc_prot_family(st1) AND ccc_init_cc_args(st2) = ccc_init_cc_args(st1) AND retrieve_pf_inv(st1, st2) AND key_init_inv(st1, st2) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) AND send_msg(st1, st2, thread, reply_name(ccc), provide_crypto_context_op, null_name, provide_crypto_context_msg(name)) AND unmark_context_port(st1, st2, svc_port) ) END cc_provide_crypto_handle $$$cc_provide_crypto_handle.prf (|cc_provide_crypto_handle| (|unmark_context_port_TCC1| "" (SKOSIMP*) (("" (TYPEPRED "port!1") (("" (REPLACE -3) (("" (HIDE -2 -3) (("" (EXPAND "remove") (("" (EXPAND "member") (("" (FLATTEN) (("" (PROPAX) NIL)))))))))))))))) $$$cc_provide_key_port.pvs cc_provide_key_port: THEORY BEGIN IMPORTING crypto_shared_state IMPORTING cc_ops_base % VARIABLES st1, st2: VAR (CC_STATE) thread: VAR THREAD svc_port : VAR NAME key_port,port : VAR NAME ri: VAR RECEIVED_INFO ccc: VAR RECEIVED_INFO cc_args : VAR NAME_SEQ n : VAR posnat unmark_key_init_port(st1, st2, svc_port) : bool = avail_port(st2) = add(svc_port, avail_port(st1)) AND key_init_port(st2) = remove(svc_port, key_init_port(st1)) AND pending_key_init(st2) = (LAMBDA (port : (key_init_port(st2))) : pending_key_init(st1)(port)) %% record a key_port from a provide_key_port message. cc_provide_key_port(st1, st2): bool = (EXISTS thread, ri, svc_port, ccc, cc_args, key_port, n: receive_request(thread, ri, provide_key_port_op, provide_key_port_perm, st1, st2) %%preconditions AND provide_key_port_msg(key_port) = user_msg(ri) AND svc_port = service_port(ri) AND key_init_port(st1)(svc_port) AND (ccc, n) = pending_key_init(st1)(svc_port) AND active_ccc(st1)(ccc) AND cc_args = ccc_init_cc_args(st1)(ccc) AND (n > 0 AND n <= size(cc_args)) AND elem(cc_args)(n) = null_name AND existing_threads(kst(st1))(thread) %% invariants AND active_ccc(st2) = active_ccc(st1) AND avail_port(st2) = avail_port(st1) AND ccc_prot_family(st2) = ccc_prot_family(st1) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) AND ccc_handle(st2) = ccc_handle(st1) AND retrieve_pf_inv(st1, st2) AND context_port_inv(st1,st2) AND pending_requests(kst(st2)) = pending_requests(kst(st1)) AND (n > 0 AND n <= size(cc_args)) AND ccc_init_cc_args(st2) = ccc_init_cc_args(st1) WITH [ ccc := (# size := size(cc_args), elem := elem(cc_args) WITH [(n) := key_port] #) ] AND unmark_key_init_port(st1, st2, svc_port) ) END cc_provide_key_port $$$cc_provide_key_port.prf (|cc_provide_key_port| (|unmark_key_init_port_TCC1| "" (SKOSIMP*) (("" (HIDE -1) (("" (TYPEPRED "port!1") (("" (REPLACE -2) (("" (HIDE -2) (("" (EXPAND "remove") (("" (EXPAND "member") (("" (FLATTEN) (("" (PROPAX) NIL)))))))))))))))))) $$$cc_provide_prot_family.pvs cc_provide_prot_family: THEORY BEGIN IMPORTING cc_ops_base % VARIABLES st1, st2: VAR (CC_STATE) thread: VAR THREAD svc_port : VAR NAME prot_family : VAR PROT_FAMILY ri: VAR RECEIVED_INFO kernel_req : VAR KERNEL_REQ ccc: VAR RECEIVED_INFO unmark_retrieve_pf_port(st1, st2, svc_port) : bool = avail_port(st2) = add(svc_port, avail_port(st1)) AND retrieve_pf_port(st2) = remove(svc_port, retrieve_pf_port(st1)) AND pending_retrieve_pf(st2) = (LAMBDA (port : (retrieve_pf_port(st2))) : pending_retrieve_pf(st1)(port)) % start processing the protection family by storing it and % initializing ccc_init_cc_args. start_process_prot_family(thread, ccc, prot_family, st1, st2): bool = active_ccc(st1)(ccc) AND active_ccc(st2) = active_ccc(st1) AND ccc_prot_family(st2) = ccc_prot_family(st1) WITH [ccc := prot_family] AND size(prot_family) > 0 AND ccc_init_cc_args(st2) = ccc_init_cc_args(st1) WITH [ccc := null_name_seq(size(prot_family))] % ccc_handle is still null_name from initial state. AND ccc_handle(st2) = ccc_handle(st1) AND existing_threads(kst(st1))(thread) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) cc_provide_prot_family(st1, st2): bool = (EXISTS thread, ri, prot_family, svc_port, kernel_req, ccc: receive_request(thread, ri, provide_prot_family_op, provide_prot_family_perm, st1, st2) AND provide_prot_family_msg(prot_family) = user_msg(ri) AND svc_port = service_port(ri) AND retrieve_pf_port(st1)(svc_port) AND ccc = pending_retrieve_pf(st1)(svc_port) AND key_init_inv(st1, st2) AND context_port_inv(st1,st2) AND pending_requests(kst(st2)) = pending_requests(kst(st1)) AND start_process_prot_family(thread, ccc, prot_family, st1, st2) AND unmark_retrieve_pf_port(st1, st2, svc_port) ) END cc_provide_prot_family $$$cc_provide_prot_family.prf (|cc_provide_prot_family| (|unmark_retrieve_pf_port_TCC1| "" (SKOSIMP*) (("" (TYPEPRED "port!1") (("" (HIDE -2) (("" (REPLACE -2) (("" (HIDE -2) (("" (EXPAND "remove") (("" (FLATTEN) (("" (EXPAND "member") (("" (PROPAX) NIL)))))))))))))))))) $$$cc_init_key_retrieval.pvs cc_init_key_retrieval : THEORY BEGIN IMPORTING cc_ops_base st1, st2 : VAR (CC_STATE) thread: VAR THREAD to, reply_port, key_svr, port: VAR NAME n : VAR posnat ccc : VAR RECEIVED_INFO prot : VAR PROT prot_family : VAR PROT_FAMILY kernel_req : VAR KERNEL_REQ op : VAR OP msg : VAR USER_MSG %% Some utility functions. mark_key_init_port(st1, st2, reply_port, ccc, n) : bool = avail_port(st1)(reply_port) AND avail_port(st2) = remove(reply_port, avail_port(st1)) AND key_init_port(st2) = add(reply_port, key_init_port(st1)) AND key_init_port(st2)(reply_port) AND pending_key_init(st2) = pending_key_init(st1) WITH [(reply_port) := (ccc, n)] need_key_init_port(st1, st2, ccc, n, prot) : bool = (EXISTS prot_family: active_ccc(st1)(ccc) AND prot_family = ccc_prot_family(st1)(ccc) AND (n > 0 AND n <= size(prot_family)) AND prot = (elem(prot_family))(n) AND (n > 0 AND n <= size(ccc_init_cc_args(st1)(ccc))) AND (elem(ccc_init_cc_args(st1)(ccc)))(n) = null_name AND NOT (EXISTS port : key_init_port(st1)(port) AND pending_key_init(st1)(port) = (ccc, n))) %% send an init_key_retrieval request to a key server %% if we haven't already done so for this ccc. cc_init_key_retrieval(st1, st2) : bool = (EXISTS thread, key_svr, reply_port, ccc, n, prot : cc_step(st1, st2) AND need_key_init_port(st1, st2, ccc, n, prot) AND active_ccc(st2) = active_ccc(st1) AND ccc_prot_family(st2) = ccc_prot_family(st1) AND ccc_init_cc_args(st2) = ccc_init_cc_args(st1) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) AND ccc_handle(st2) = ccc_handle(st1) AND retrieve_pf_inv(st1, st2) AND context_port_inv(st1,st2) %% send init_key_retrival to key server AND key_svr = key_mech_server(st1)(key_mech(prot)) AND send_msg(st1, st2, thread, key_svr, init_key_retrieval_op, reply_port, null_user_msg) %% mark reply_port as being used for (ccc, n) AND mark_key_init_port(st1, st2, reply_port, ccc, n) ) END cc_init_key_retrieval $$$cc_init_crypto_context.pvs cc_init_crypto_context : THEORY BEGIN IMPORTING cc_ops_base st, st1, st2 : VAR (CC_STATE) thread: VAR THREAD first_prot_task, reply_port : VAR NAME n, i : VAR posnat ccc : VAR RECEIVED_INFO prot, first_prot : VAR PROT prot_family : VAR PROT_FAMILY kernel_req : VAR KERNEL_REQ key_port_seq, name_seq : VAR NAME_SEQ %% Some utility functions. prot_to_prot_task(st, prot) : NAME = encrypt_mech_server(st)(encrypt_mech(prot)) mark_context_port(st1, st2, reply_port, ccc) : bool = avail_port(st1)(reply_port) AND avail_port(st2) = remove(reply_port, avail_port(st1)) AND context_port(st2) = add(reply_port, context_port(st1)) AND context_port(st2)(reply_port) AND pending_context_port(st2) = pending_context_port(st1) WITH [(reply_port) := ccc] %% Assemble list of alternating prot_task ports and key ports %% omitting first prot_task and starting with a key port. merged_seq(st, prot_family, key_port_seq, name_seq) : bool = (EXISTS (f : [{i | i>0 and i <= 2 * size(prot_family) - 1} -> NAME]) : (size(name_seq) > 0 AND size(name_seq) = 2 * size(prot_family) - 1) AND elem(name_seq) = f AND (FORALL n : (n > 1 and n <= size(prot_family)) IMPLIES f(2*n-2) = prot_to_prot_task(st,elem(prot_family)(n))) AND (size(name_seq) > 0 AND size(name_seq) = 2 * size(key_port_seq) - 1) AND (FORALL n : (n > 0 and n <= size(key_port_seq)) IMPLIES f(2*n-1) = elem(key_port_seq)(n))) assemble_crypto_context_info(st1, st2, ccc, first_prot_task, name_seq) : bool = (EXISTS prot_family, first_prot : active_ccc(st1)(ccc) AND prot_family = ccc_prot_family(st1)(ccc) AND (FORALL n : (n > 0 AND n <= size(ccc_init_cc_args(st1)(ccc))) IMPLIES (elem(ccc_init_cc_args(st1)(ccc)))(n) /= null_name) AND (1 > 0 and 1 <= size(prot_family)) AND first_prot = (elem(prot_family))(1) AND first_prot_task = prot_to_prot_task(st1, first_prot) AND merged_seq(st1, prot_family, ccc_init_cc_args(st1)(ccc), name_seq)) %% send an init_crypto_context request to the first prot task %% in the selected prot family for a ccc. All key ports %% must already be obtained. cc_init_crypto_context(st1, st2) : bool = (EXISTS thread, reply_port, ccc, first_prot_task, name_seq : cc_step(st1, st2) AND assemble_crypto_context_info(st1, st2, ccc, first_prot_task, name_seq) AND active_ccc(st2) = active_ccc(st1) AND ccc_prot_family(st2) = ccc_prot_family(st1) AND ccc_init_cc_args(st2) = ccc_init_cc_args(st1) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) AND ccc_handle(st2) = ccc_handle(st1) AND retrieve_pf_inv(st1, st2) AND key_init_inv(st1, st2) %% send init_crypto_context to prot task AND send_msg(st1, st2, thread, first_prot_task, init_crypto_context_op, reply_port, init_crypto_context_msg(name_seq)) %% mark reply_port as being used for this context initialization AND mark_context_port(st1, st2, reply_port, ccc) ) END cc_init_crypto_context $$$cc_init_crypto_context.prf (|cc_init_crypto_context| (|merged_seq_TCC1| "" (SKOSIMP*) (("" (TYPEPRED "x1!1") (("" (TYPEPRED "y1!1") (("" (REPLACE -6) (("" (GROUND) NIL))))))))) (|merged_seq_TCC2| "" (SKOSIMP*) (("" (REPLACE -2) (("" (GROUND) NIL))))) (|merged_seq_TCC3| "" (SKOSIMP*) (("" (GROUND) NIL))) (|merged_seq_TCC4| "" (SKOSIMP*) (("" (REPLACE -2) (("" (INST? :WHERE -7) (("" (GROUND) NIL)))))))) $$$cc_create_context_from_port.pvs cc_create_context_from_port: THEORY BEGIN IMPORTING cc_ops_base % VARIABLES st1, st2: VAR (CC_STATE) thread: VAR THREAD name: VAR NAME prot_family : VAR PROT_FAMILY sit: VAR SITUATION ri: VAR RECEIVED_INFO reply_port : VAR NAME kernel_req : VAR KERNEL_REQ mark_retrieve_pf_port(st1, st2, reply_port, ri) : bool = avail_port(st2) = remove(reply_port, avail_port(st1)) AND retrieve_pf_port(st2) = add(reply_port, retrieve_pf_port(st1)) AND retrieve_pf_port(st2)(reply_port) AND pending_retrieve_pf(st2) = pending_retrieve_pf(st1) WITH [(reply_port) := ri] cc_create_context_from_port(st1, st2): bool = (EXISTS thread, ri, sit, name, prot_family, reply_port, kernel_req: cc_step(st1, st2) AND receive_request(thread, ri, create_crypto_context_op, create_crypto_context_perm, st1, st2) AND create_crypto_context_msg(sit, name, prot_family) = user_msg(ri) AND service_ports(st1)(service_port(ri)) AND name /= null_name AND prot_family = null_prot_family AND avail_port(st1)(reply_port) % This says we should not currently be processing an identical ri. % Is this correct? AND NOT active_ccc(st1)(ri) AND active_ccc(st2) = add(ri, active_ccc(st1)) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) AND ccc_prot_family(st2) = ccc_prot_family(st1) AND ccc_handle(st2) = ccc_handle(st1) AND ccc_init_cc_args(st2) = ccc_init_cc_args(st1) AND key_init_inv(st1, st2) AND context_port_inv(st1,st2) AND send_msg(st1, st2, thread, name, retrieve_prot_family_op, reply_port, null_user_msg) AND mark_retrieve_pf_port(st1, st2, reply_port, ri) ) END cc_create_context_from_port $$$messaging.pvs messaging: THEORY BEGIN IMPORTING dtos_kernel_shared_ops kst1, kst2: VAR KERNEL_SHARED_STATE thread: VAR THREAD ri: VAR RECEIVED_INFO op_id: VAR OP perm: VAR PERMISSION name, reply_port, to: VAR NAME kernel_req: VAR KERNEL_REQ msg: VAR USER_MSG %% "Thread" requests to receive a message on a port named "name" %% in transition from kst1 to kst2. receive_msg(kst1, kst2, thread, name): bool = existing_threads(kst1)(thread) AND existing_threads(kst1) = existing_threads(kst2) AND received_info(kst1) = received_info(kst2) AND thread_status(kst1)(thread) = thread_running AND existing_threads(kst2)(thread) AND thread_status(kst2) = thread_status(kst1) WITH [thread := thread_waiting] AND pending_requests(kst2) = add(receive_message_req(thread, name), pending_requests(kst1)) % process a newly received request message receive_request(thread, ri, op_id, perm, kst1, kst2): bool = existing_threads(kst1)(thread) AND thread_status(kst1)(thread) = thread_running AND ri = received_info(kst1)(thread) AND ri_status(ri) = ri_unprocessed AND sending_av(ri)(perm) AND op(ri) = op_id AND process_request(thread, kst_to_ti(kst1), kst_to_ti(kst2)) %% "Thread" sends message to port "to" with %% reply port "reply_port" in transition from kst1 to kst2. send_msg(kst1, kst2, thread, to, op_id, reply_port, msg): bool = existing_threads(kst1) = existing_threads(kst2) AND existing_threads(kst1)(thread) AND thread_status(kst1)(thread) = thread_running AND existing_threads(kst2)(thread) AND thread_status(kst2) = thread_status(kst1) WITH [thread := thread_waiting] AND (LET kernel_req = send_message_req(thread, to, op_id, reply_port, msg) IN pending_requests(kst2) = add(kernel_req, pending_requests(kst1))) send_msg_ops_neq : LEMMA (send_msg(kst1, kst2, thread, to, op_id, reply_port, msg) AND send_message_req?(kernel_req) AND smop(kernel_req) /= op_id AND pending_requests(kst2)(kernel_req)) IMPLIES pending_requests(kst1)(kernel_req) receive_msg_not_send : LEMMA (receive_msg(kst1, kst2, thread, name) AND send_message_req?(kernel_req) AND pending_requests(kst2)(kernel_req)) IMPLIES pending_requests(kst1)(kernel_req) END messaging $$$messaging.prf (|messaging| (|receive_msg_TCC1| "" (SKOSIMP*) (("" (SPLIT) (("1" (TYPEPRED "y1!1") (("1" (HIDE -2) (("1" (GROUND) NIL))))) ("2" (TYPEPRED "x1!1") (("2" (HIDE -2) (("2" (GROUND) NIL))))))))) (|send_msg_ops_neq| "" (SKOSIMP) (("" (EXPAND "send_msg") (("" (FLATTEN) (("" (REPLACE -6) (("" (HIDE -6) (("" (EXPAND "add") (("" (SPLIT -7) (("1" (REPLACE -1 :DIR RL) (("1" (BETA) (("1" (PROPAX) NIL))))) ("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))))) (|receive_msg_not_send| "" (SKOSIMP) (("" (EXPAND "receive_msg") (("" (FLATTEN) (("" (REPLACE -7) (("" (EXPAND "add") (("" (HIDE -7) (("" (SPLIT) (("1" (REPLACE -1 :DIR RL) (("1" (BETA) (("1" (PROPAX) NIL))))) ("2" (EXPAND "member") (("2" (PROPAX) NIL)))))))))))))))))) $$$dtos_kernel_shared_ops.pvs dtos_kernel_shared_ops: THEORY BEGIN %% Note that the restrictions on transition described here apply %% only within a component's part of the kernel shared state. The %% in the common state for the components we assume the kst of each %% non-kernel component to be a substate of the kernel's shared %% state. The hidd relations are used to ensure that components %% being composed do not mess with another component's kst. IMPORTING dtos_kernel_shared_state THREAD_INFO: TYPE = [# existing_threads: setof[THREAD], received_info: [(existing_threads) -> RECEIVED_INFO], thread_status: [(existing_threads) -> THREAD_STATUS] #] thread_info1, thread_info2: VAR THREAD_INFO thread: VAR THREAD ri, ri1, ri2: VAR RECEIVED_INFO process_request(thread, thread_info1, thread_info2): bool = existing_threads(thread_info1)(thread) AND existing_threads(thread_info2) = existing_threads(thread_info1) AND (EXISTS ri1, ri2: ri_status(ri1) = ri_unprocessed AND (received_info(thread_info1))(thread) = ri1 AND ri_status(ri2) = ri_processed AND received_info(thread_info2) = received_info(thread_info1) WITH [thread := ri2]) kst, kst1, kst2: VAR KERNEL_SHARED_STATE c_ags: VAR setof[THREAD] kernel_req: VAR KERNEL_REQ requested_op, op: VAR OP name, reply_port: VAR NAME user_msg, user_msg1, user_msg2: VAR USER_MSG null_thread_info: THREAD_INFO kst_to_ti(kst): THREAD_INFO = null_thread_info WITH [existing_threads := existing_threads(kst), received_info := received_info(kst), thread_status := thread_status(kst)] effects_on_kernel_state(kst1, kst2, c_ags): bool = ((pending_requests(kst2) /= pending_requests(kst1) OR existing_threads(kst2) /= existing_threads(kst1) OR thread_status(kst2) /= thread_status(kst1)) IMPLIES (EXISTS kernel_req, thread: pending_requests(kst2) = union(pending_requests(kst1), {x: KERNEL_REQ | kernel_req = x}) AND ((send_message_req?(kernel_req) AND smth(kernel_req) = thread) OR (receive_message_req?(kernel_req) AND rmth(kernel_req) = thread)) AND c_ags(thread) AND existing_threads(kst1)(thread) AND existing_threads(kst2)(thread) AND thread_status(kst1)(thread) = thread_running AND thread_status(kst2) = thread_status(kst1) WITH [thread := thread_waiting])) AND ((existing_threads(kst2) /= existing_threads(kst1) OR received_info(kst2) /= received_info(kst1)) IMPLIES (EXISTS thread: c_ags(thread) AND process_request(thread, kst_to_ti(kst1), kst_to_ti(kst2)))) service_ports: VAR setof[NAME] needed_perm: VAR PERMISSION ssi, osi: VAR SID reply_op(requested_op): OP make_service_request(c_ags, service_ports, reply_port, requested_op, needed_perm, user_msg1, user_msg2, kst1, kst2): bool = (EXISTS thread, ri, ssi, osi, kernel_req: c_ags(thread) AND existing_threads(kst1)(thread) AND process_request(thread, kst_to_ti(kst1), kst_to_ti(kst2)) AND thread_status(kst1)(thread) = thread_running AND ri = received_info(kst1)(thread) AND service_ports(service_port(ri)) AND ri_status(ri) = ri_unprocessed AND sending_av(ri)(needed_perm) AND op(ri) = requested_op AND user_msg1 = user_msg(ri) AND kernel_req = send_message_req(thread, reply_name(ri), reply_op(op(ri)), reply_port, user_msg2) AND pending_requests(kst2) = union(pending_requests(kst1), {x: KERNEL_REQ | x = kernel_req}) AND existing_threads(kst2) = existing_threads(kst1) AND existing_threads(kst2)(thread) AND thread_status(kst2) = thread_status(kst1) WITH [thread := thread_waiting]) END dtos_kernel_shared_ops $$$dtos_kernel_shared_ops.prf (|dtos_kernel_shared_ops| (|process_request_TCC1| "" (SKOSIMP*) (("" (REPLACE -2) (("" (PROPAX) NIL))))) (|effects_on_kernel_state_TCC1| "" (SKOSIMP*) (("" (HIDE -1) (("" (SPLIT) (("1" (TYPEPRED "y1!1") (("1" (REPLACE -2) (("1" (PROPAX) NIL))))) ("2" (TYPEPRED "x1!1") (("2" (REPLACE -2) (("2" (PROPAX) NIL))))))))))) (|effects_on_kernel_state_TCC2| "" (SKOSIMP*) (("" (HIDE -1) (("" (TYPEPRED "y1!1") (("" (TYPEPRED "x1!1") (("" (REPLACE -3) (("" (GROUND) NIL))))))))))) (|make_service_request_TCC1| "" (SKOSIMP*) (("" (POSTPONE) NIL)))) $$$more_set_lemmas.pvs more_set_lemmas [X: TYPE] : THEORY BEGIN a,b,s,t : VAR setof[X] x : VAR X nonempty_union : LEMMA nonempty?(a) AND nonempty?(b) IMPLIES nonempty?(union(a,b)) %% This is useful when you are working with the "choose" function %% so that you can set the domain restriction up to be automatically matched. emptyset_not_nonempty? : LEMMA a = emptyset IFF NOT nonempty?(a) emptyset_no_members : LEMMA a = emptyset IFF (FORALL (x: X): NOT member(x, a)) singleton_epsilon: LEMMA (EXISTS (x: X): TRUE) => epsilon(singleton(x)) = x singleton_not_emptyset: LEMMA singleton(x) /= emptyset subset_singleton: LEMMA a(x) => subset?(singleton(x), a) END more_set_lemmas $$$more_set_lemmas.prf (|more_set_lemmas| (|nonempty_union| "" (SKOSIMP) (("" (EXPAND "nonempty?") (("" (EXPAND "empty?") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "union") (("" (EXPAND "member") (("" (INST?) (("" (FLATTEN) (("" (PROPAX) NIL))))))))))))))))))) (|emptyset_not_nonempty?| "" (SKOSIMP) (("" (EXPAND "nonempty?") (("" (REWRITE "emptyset_is_empty?") (("" (SPLIT) (("1" (FLATTEN) (("1" (PROPAX) NIL))) ("2" (FLATTEN) (("2" (PROPAX) NIL))))))))))) (|emptyset_no_members| "" (SKOSIMP) (("" (REWRITE "emptyset_not_nonempty?") (("" (REWRITE "nonempty_member") (("" (SPLIT) (("1" (FLATTEN) (("1" (SKOSIMP) (("1" (INST?) NIL))))) ("2" (FLATTEN) (("2" (SKOLEM!) (("2" (INST?) NIL))))))))))))) (|singleton_epsilon_TCC1| "" (GROUND) NIL) (|singleton_epsilon| "" (SKOSIMP) (("" (EXPAND "singleton") (("" (LEMMA "epsilon_ax[X]") (("" (INST - "{y: X | y = x!1}") (("" (SPLIT) (("1" (GROUND) NIL) ("2" (INST? +) (("2" (GROUND) NIL))))))))))))) (|singleton_not_emptyset| "" (SKOSIMP) (("" (REWRITE "emptyset_is_empty?" :DIR RL) (("" (EXPAND "singleton") (("" (EXPAND "empty?") (("" (EXPAND "member") (("" (INST?) NIL))))))))))) (|subset_singleton| "" (SKOSIMP) (("" (EXPAND "subset?") (("" (EXPAND "singleton") (("" (EXPAND "member") (("" (SKOSIMP) (("" (GROUND) NIL)))))))))))) $$$fseq_functions.pvs fseq_functions[t1,t2: NONEMPTY_TYPE] : THEORY BEGIN IMPORTING finite_sequence[t1] IMPORTING finite_sequence[t2] n : VAR nat map(f: [t1 -> t2], s: FSEQ[t1]) : FSEQ[t2] = (# size := size(s), elem := (LAMBDA (n: posnat | n <= size(s)) : f(elem(s)(n))) #) END fseq_functions $$$fseq_functions.prf (|fseq_functions| (|map_TCC1| "" (SKOLEM!) (("" (TYPEPRED "n!1") (("" (GROUND) NIL))))) (|map_TCC2| "" (SKOSIMP*) (("" (TYPEPRED "x1!1") (("" (TYPEPRED "y1!1") (("" (GROUND) NIL)))))))) $$$crypto_shared_state.pvs crypto_shared_state: THEORY BEGIN IMPORTING dtos_kernel_shared_state IMPORTING fseq_functions IMPORTING more_set_lemmas SITUATION : NONEMPTY_TYPE SEC_PROTOCOL: NONEMPTY_TYPE KEY_MECH: NONEMPTY_TYPE ENCRYPT_MECH: NONEMPTY_TYPE KEY : NONEMPTY_TYPE TEXT : NONEMPTY_TYPE SEED : NONEMPTY_TYPE null_text : TEXT key_witness: KEY key_mech_witness : KEY_MECH encrypt_mech_witness : ENCRYPT_MECH generate_key : [KEY_MECH, SEED -> KEY] protect_text : [ENCRYPT_MECH, KEY, TEXT -> TEXT] % Don't use security protocol at this time PROT : TYPE = [# key_mech : KEY_MECH, encrypt_mech : ENCRYPT_MECH, sec_protocol : SEC_PROTOCOL #] IMPORTING finite_sequence[PROT] PROT_FAMILY : TYPE = FSEQ[PROT] null_prot_family : PROT_FAMILY = finite_sequence[PROT].null_seq IMPORTING finite_sequence[PROT_FAMILY] PROT_FAMILY_SEQ: TYPE = FSEQ[PROT_FAMILY] null_prot_family_seq : PROT_FAMILY_SEQ = finite_sequence[PROT_FAMILY].null_seq sit_pf_to_data: [[SITUATION, PROT_FAMILY] -> DATA] pf_to_data: [PROT_FAMILY -> DATA] key_to_data: [KEY -> DATA] text_to_data: [TEXT -> DATA] k1, k2 : VAR KEY key_to_data_inj: AXIOM key_to_data(k1) = key_to_data(k2) IMPLIES k1 = k2 x,n : VAR posnat null_name_seq(x) : NAME_SEQ null_name_seq_ax : AXIOM size(null_name_seq(x)) = x AND (FORALL n : (n > 0 and n <= size(null_name_seq(x))) => elem(null_name_seq(x))(n) = null_name) prot_family: VAR PROT_FAMILY sit: VAR SITUATION name: VAR NAME name_seq : VAR NAME_SEQ data: VAR DATA text: VAR TEXT dest: VAR NAME key : VAR KEY %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % SSUPS ops % Request port indicating permission to a given prot_family select_prot_family_op : OP select_prot_family_perm : PERMISSION select_prot_family_msg(sit, prot_family): USER_MSG = null_user_msg WITH [ (user_data) := sit_pf_to_data(sit, prot_family) ] provide_pf_handle_op : OP provide_pf_handle_perm : PERMISSION provide_pf_handle_msg(name): USER_MSG = null_user_msg WITH [ (user_rights) := name_to_send_right_seq(name) ] % Retrieve a previously negotiated prot_family %% a retrieve_prot_family_msg = null_msg, so we do not need to declare it. retrieve_prot_family_op : OP retrieve_prot_family_perm : PERMISSION % Reply with the previously negotiated prot_family provide_prot_family_msg(prot_family): USER_MSG = null_user_msg WITH [ (user_data) := pf_to_data(prot_family) ] provide_prot_family_op : OP provide_prot_family_perm : PERMISSION %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % CC ops %% A client requests a crypto context create_crypto_context_msg(sit, name, prot_family): USER_MSG = (# user_data := sit_pf_to_data(sit, prot_family), user_rights := name_to_send_right_seq(name) #) create_crypto_context_op : OP create_crypto_context_perm : PERMISSION %% Reply from create_crypto_context with a handle for a protection task. provide_crypto_context_msg(name): USER_MSG = null_user_msg WITH [ (user_rights) := name_to_send_right_seq(name) ] provide_crypto_context_op : OP provide_crypto_context_perm : PERMISSION %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %% PROTECTION TASK OPS init_crypto_context_msg(name_seq): USER_MSG = null_user_msg WITH [ (user_rights) := map(name_to_send_right, name_seq) ] init_crypto_context_op : OP init_crypto_context_perm : PERMISSION provide_crypto_handle_msg(name): USER_MSG = null_user_msg WITH [ (user_rights) := name_to_send_right_seq(name) ] provide_crypto_handle_op : OP provide_crypto_handle_perm : PERMISSION protect_msg(text, dest): USER_MSG = (# user_data := text_to_data(text), user_rights := name_to_send_right_seq(dest) #) protect_op : OP protect_perm : PERMISSION provide_protected_data_msg(text): USER_MSG = null_user_msg WITH [ (user_data) := text_to_data(text) ] provide_protected_data_op : OP provide_protected_data_perm : PERMISSION %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % KEY SERVER OPS %% init_key_retrieval_msg = null_msg init_key_retrieval_op : OP init_key_retrieval_perm : PERMISSION provide_key_port_msg(name): USER_MSG = null_user_msg WITH [ (user_rights) := name_to_send_right_seq(name) ] provide_key_port_op : OP provide_key_port_perm : PERMISSION retrieve_key_op : OP retrieve_key_perm : PERMISSION provide_key_op : OP provide_key_perm : PERMISSION provide_key_msg(key): USER_MSG = null_user_msg WITH [ (user_data) := key_to_data(key) ] %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %% Specify which OPs must be distinct. In general these constraints %% are NOT necessary in all implementations of the model since any %% two distinct operations frequently go to distinct servers. %% However, these assumptions simplify the proofs. ks_provide_ops_distinct: AXIOM provide_key_port_op /= provide_key_op op1, op2: VAR OP f : VAR [OP -> int] %% Make distinctness proofs easier self_congruence : LEMMA op1 = op2 IMPLIES f(op1) = f(op2) %% Define a function from some ops to distinct integers. %% Distinctness follows from the fact that it is a function. %% See 'congruence' in the prelude. cc_op_num : [OP -> int] cc_op_ax : AXIOM cc_op_num(retrieve_prot_family_op) = 1 AND cc_op_num(init_crypto_context_op) = 2 AND cc_op_num(init_key_retrieval_op) = 3 AND cc_op_num(provide_crypto_context_op) = 4 cc_ops_distinct: LEMMA retrieve_prot_family_op /= init_crypto_context_op AND retrieve_prot_family_op /= init_key_retrieval_op AND retrieve_prot_family_op /= provide_crypto_context_op AND init_crypto_context_op /= init_key_retrieval_op AND init_crypto_context_op /= provide_crypto_context_op AND init_key_retrieval_op /= provide_crypto_context_op END crypto_shared_state $$$cc_state.pvs cc_state : THEORY BEGIN IMPORTING crypto_shared_state cc_threads: setof[THREAD] cc_threads_nonempty: AXIOM cc_threads /= emptyset cc_threads_witness: (cc_threads) CC_STATE_BASE: TYPE = [# % requests I am processing. Index by this rather than situation % because two clients with the same situation could request % different preferred prot families. active_ccc: setof[RECEIVED_INFO], ssups: NAME, % where I send ssups requests service_ports: setof[NAME], % where I receive my requests avail_port: setof[NAME], % my supply of reply ports % ports on which I'm expecting a selected protection family % from ssups retrieve_pf_port: setof[NAME], pending_retrieve_pf: [(retrieve_pf_port) -> RECEIVED_INFO], %the selected family; only used for active_ccc's ccc_prot_family: [RECEIVED_INFO -> PROT_FAMILY], %the obtained crypto context handle ccc_handle: [RECEIVED_INFO -> NAME], % ports on which I'm expecting a key port from a key server key_init_port: setof[NAME], pending_key_init: [(key_init_port) -> [RECEIVED_INFO, posnat]], % Key ports received so far; only used for active_ccc's ccc_init_cc_args: [RECEIVED_INFO -> NAME_SEQ], % ports on which I'm expecting a crypto_context port from a % protection task context_port: setof[NAME], pending_context_port: [(context_port) -> RECEIVED_INFO], % mapping mechanisms to port names key_mech_server: [KEY_MECH -> NAME], encrypt_mech_server: [ENCRYPT_MECH -> NAME], kst: KERNEL_SHARED_STATE #] ccstb : VAR CC_STATE_BASE ccc : VAR RECEIVED_INFO CC_STATE(ccstb): bool = disjoint?(avail_port(ccstb), retrieve_pf_port(ccstb)) AND disjoint?(avail_port(ccstb), key_init_port(ccstb)) AND disjoint?(avail_port(ccstb), context_port(ccstb)) AND disjoint?(avail_port(ccstb), service_ports(ccstb)) AND (FORALL ccc: (active_ccc(ccstb)(ccc)) IMPLIES size(ccc_prot_family(ccstb)(ccc)) = size(ccc_init_cc_args(ccstb)(ccc))) AND subset?(existing_threads(kst(ccstb)), cc_threads) st1, st2: VAR (CC_STATE) cc_threads_prop: THEOREM subset?(existing_threads(kst(st1)), cc_threads) cc_view(st1,st2) : bool = st1 = st2 END cc_state $$$cc_state.prf (|cc_state| (|cc_threads_witness_TCC1| "" (LEMMA "cc_threads_nonempty") (("" (LEMMA "nonempty_exists[THREAD]") (("" (INST -1 "cc_threads") (("" (EXPAND "nonempty?") (("" (FLATTEN) (("" (LEMMA "emptyset_is_empty?[THREAD]") (("" (INST -1 "cc_threads") (("" (FLATTEN) (("" (GROUND) NIL))))))))))))))))) (|cc_threads_prop| "" (SKOSIMP) (("" (TYPEPRED "st1!1") (("" (EXPAND "CC_STATE") (("" (GROUND) NIL)))))))) $$$cc_ops_base.pvs cc_ops_base: THEORY BEGIN IMPORTING cc_state IMPORTING dtos_kernel_shared_ops %%This should probably be in dtos_kernel_shared_ops IMPORTING messaging st, st1, st2: VAR (CC_STATE) %%local state invariants cc_static(st1, st2): bool = key_mech_server(st2) = key_mech_server(st1) AND encrypt_mech_server(st2) = encrypt_mech_server(st1) AND ssups(st2) = ssups(st1) AND service_ports(st2) = service_ports(st1) AND existing_threads(kst(st2)) = existing_threads(kst(st1)) %a step must obey local invariants and only make allowed % mods to kernel state. cc_step(st1, st2): bool = cc_static(st1, st2) AND effects_on_kernel_state(kst(st1), kst(st2), cc_threads) retrieve_pf_inv(st1, st2): bool = retrieve_pf_port(st2) = retrieve_pf_port(st1) AND pending_retrieve_pf(st2) = pending_retrieve_pf(st1) key_init_inv(st1, st2): bool = key_init_port(st2) = key_init_port(st1) AND pending_key_init(st2) = pending_key_init(st1) context_port_inv(st1, st2): bool = context_port(st2) = context_port(st1) AND pending_context_port(st2) = pending_context_port(st1) thread: VAR THREAD prot_family: VAR PROT_FAMILY ri: VAR RECEIVED_INFO op_id: VAR OP perm: VAR PERMISSION name, reply_port, to: VAR NAME kernel_req: VAR KERNEL_REQ ccc: VAR RECEIVED_INFO msg: VAR USER_MSG % UTILITY FUNCTIONS % processing a newly received CC request receive_request(thread, ri, op_id, perm, st1, st2): bool = cc_step(st1, st2) AND cc_threads(thread) AND existing_threads(kst(st1))(thread) AND thread_status(kst(st1))(thread) = thread_running AND ri = received_info(kst(st1))(thread) AND ri_status(ri) = ri_unprocessed AND sending_av(ri)(perm) AND op(ri) = op_id AND process_request(thread, kst_to_ti(kst(st1)), kst_to_ti(kst(st2))) %% "Thread" sends message to port "to" with %% reply port "reply_port" in transition from st1 to st2. send_msg(st1, st2, thread, to, op_id, reply_port, msg): bool = send_msg(kst(st1), kst(st2), thread, to, op_id, reply_port, msg) END cc_ops_base $$$cc_ops_base.prf (|cc_ops_base| (|retrieve_pf_inv_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL))) (|key_init_inv_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL))) (|context_port_inv_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL)))) $$$cc_receive_request.pvs cc_receive_request: THEORY BEGIN IMPORTING cc_ops_base st1, st2: VAR (CC_STATE) thread: VAR THREAD name: VAR NAME cc_receive_request_aux1(st1, st2): bool = ccc_handle(st2) = ccc_handle(st1) AND ccc_init_cc_args(st2) = ccc_init_cc_args(st1) AND avail_port(st2) = avail_port(st1) cc_receive_request_aux2(st1, st2): bool = retrieve_pf_inv(st1, st2) AND key_init_inv(st1, st2) AND context_port_inv(st1, st2) cc_receive_request_submit(st1, st2): bool = EXISTS thread, name: cc_threads(thread) AND existing_threads(kst(st1))(thread) AND thread_status(kst(st1))(thread) = thread_running AND existing_threads(kst(st2))(thread) AND thread_status(kst(st2)) = thread_status(kst(st1)) WITH [thread := thread_waiting] AND pending_requests(kst(st2)) = add(receive_message_req(thread, name), pending_requests(kst(st1))) cc_receive_request(st1, st2): bool = cc_step(st1, st2) AND active_ccc(st1) = active_ccc(st2) AND ccc_prot_family(st1) = ccc_prot_family(st2) AND existing_threads(kst(st1)) = existing_threads(kst(st2)) AND received_info(kst(st1)) = received_info(kst(st2)) AND cc_receive_request_aux1(st1, st2) AND cc_receive_request_aux2(st1, st2) AND cc_receive_request_submit(st1, st2) END cc_receive_request $$$cc_receive_request.prf (|cc_receive_request| (|cc_receive_request_TCC1| "" (SKOSIMP*) (("" (HIDE -1 -2 -3) (("" (SPLIT) (("1" (TYPEPRED "y1!1") (("1" (REPLACE -2) (("1" (PROPAX) NIL))))) ("2" (TYPEPRED "x1!1") (("2" (REPLACE -2) (("2" (PROPAX) NIL)))))))))))) $$$cc_ops.pvs cc_ops: THEORY BEGIN IMPORTING cc_receive_request IMPORTING cc_create_context_from_port IMPORTING cc_init_crypto_context IMPORTING cc_init_key_retrieval IMPORTING cc_provide_prot_family IMPORTING cc_provide_key_port IMPORTING cc_provide_crypto_handle st1, st2 : VAR (CC_STATE) ag: VAR THREAD cc_op(st1, st2) : bool = cc_receive_request(st1, st2) OR cc_create_context_from_port(st1, st2) OR cc_provide_prot_family(st1, st2) OR cc_init_key_retrieval(st1, st2) OR cc_provide_key_port(st1, st2) OR cc_init_crypto_context(st1, st2) OR cc_provide_crypto_handle(st1, st2) cc_guar(st1,st2,ag) : bool = cc_threads(ag) AND (cc_view(st1, st2) OR (cc_step(st1, st2) AND cc_op(st1, st2))) END cc_ops $$$cc_spec.pvs cc_spec : THEORY BEGIN IMPORTING dtos_kernel_shared_state IMPORTING cc_ops IMPORTING cc_rely IMPORTING cc_state_witness IMPORTING component_aux[(CC_STATE),THREAD] st, st1, st2 : VAR (CC_STATE) ag : VAR THREAD initial_cc_states(st) : bool = active_ccc(st) = emptyset[RECEIVED_INFO] AND retrieve_pf_port(st) = emptyset AND ccc_prot_family(st) = (LAMBDA (x : RECEIVED_INFO) : null_prot_family) AND ccc_handle(st) = (LAMBDA (x : RECEIVED_INFO) : null_name) AND key_init_port(st) = emptyset AND ccc_init_cc_args(st) = (LAMBDA (x : RECEIVED_INFO) : null_name_seq(1)) AND context_port(st) = emptyset AND pending_requests(kst(st)) = emptyset[KERNEL_REQ] AND (FORALL ag : existing_threads(kst(st))(ag) => ri_status(received_info(kst(st))(ag)) = ri_processed) cc_state_witness_initial: THEOREM initial_cc_states(cc_state_witness) base_cc_comp : base_comp_t = (# init := initial_cc_states, guar := cc_guar, rely := cc_rely, hidd := cc_hidd, cags := cc_threads, view := cc_view, wfar := emptyset[TRANSITION_CLASS[(CC_STATE), THREAD]], sfar := emptyset[TRANSITION_CLASS[(CC_STATE), THREAD]] #) cc_view_eq: THEOREM view_eq(base_cc_comp) cc_comp_init: THEOREM init_restriction(base_cc_comp) cc_comp_guar: THEOREM guar_restriction(base_cc_comp) cc_comp_rely_hidd: THEOREM rely_hidd_restriction(base_cc_comp) cc_comp_hidd: THEOREM hidd_restriction(base_cc_comp) cc_comp_rely: THEOREM rely_restriction(base_cc_comp) cc_comp_cags: THEOREM cags_restriction(base_cc_comp) cc_comp_guar_stuttering: THEOREM guar_stuttering_restriction(base_cc_comp) cc_comp_rely_stuttering: THEOREM rely_stuttering_restriction(base_cc_comp) cc_comp : (comp_t) = base_cc_comp cc_comp_hidd_prop: THEOREM hidd(cc_comp)(st1, st2, ag) => k_threads(ag) OR view(cc_comp)(st1, st2) END cc_spec $$$cc_spec.prf (|cc_spec| (IMPORTING5_TCC1 "" (INST + "cc_state_witness") NIL) (|cc_state_witness_initial| "" (EXPAND "initial_cc_states") (("" (EXPAND "cc_state_witness") (("" (EXPAND "empty_kst") (("" (EXPAND "emptyset") (("" (PROPAX) NIL))))))))) (|base_cc_comp_TCC1| "" (REWRITE "eq_view2") (("" (EXPAND "cc_view") (("" (PROPAX) NIL))))) (|cc_view_eq| "" (EXPAND "view_eq") (("" (EXPAND "base_cc_comp") (("" (SKOSIMP) (("" (EXPAND "cc_view") (("" (PROPAX) NIL))))))))) (|cc_comp_init| "" (EXPAND "init_restriction") (("" (EXPAND "base_cc_comp") (("" (GROUND) (("" (USE "emptyset_is_empty?[(CC_STATE)]") (("" (GROUND) (("" (EXPAND "empty?") (("" (EXPAND "member") (("" (INST - "cc_state_witness") (("" (REWRITE "cc_state_witness_initial") NIL))))))))))))))))) (|cc_comp_guar| "" (EXPAND "guar_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_cc_comp") (("" (GROUND) (("" (EXPAND "cc_guar") (("" (PROPAX) NIL))))))))))))) (|cc_comp_rely_hidd| "" (EXPAND "rely_hidd_restriction") (("" (EXPAND "subset?") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_cc_comp") (("" (EXPAND "cc_rely") (("" (GROUND) (("" (EXPAND "cc_hidd") (("" (EXPAND "cc_environment") (("" (REWRITE "hidd_base_prop") (("" (GROUND) NIL))))))))))))))))))))) (|cc_comp_hidd| "" (EXPAND "hidd_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_cc_comp") (("" (GROUND) (("" (EXPAND "cc_hidd") (("" (PROPAX) NIL))))))))))))) (|cc_comp_rely| "" (EXPAND "rely_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_cc_comp") (("" (EXPAND "cc_rely") (("" (GROUND) NIL))))))))))) (|cc_comp_cags| "" (EXPAND "cags_restriction") (("" (EXPAND "base_cc_comp") (("" (REWRITE "cc_threads_nonempty") NIL))))) (|cc_comp_guar_stuttering| "" (EXPAND "guar_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_cc_comp") (("" (EXPAND "cc_guar") (("" (GROUND) NIL))))))))))))) (|cc_comp_rely_stuttering| "" (EXPAND "rely_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_cc_comp") (("" (EXPAND "cc_rely") (("" (EXPAND "complement") (("" (EXPAND "member") (("" (EXPAND "cc_view") (("" (GROUND) (("" (REPLACE -1) (("" (REWRITE "cc_environment_refl") NIL))))))))))))))))))))))) (|cc_comp_TCC1| "" (USE "cc_view_eq") (("" (USE "cc_comp_init") (("" (USE "cc_comp_guar") (("" (USE "cc_comp_rely_hidd") (("" (USE "cc_comp_hidd") (("" (USE "cc_comp_cags") (("" (USE "cc_comp_guar_stuttering") (("" (USE "cc_comp_rely_stuttering") (("" (REWRITE "component_view_eq_thm") NIL))))))))))))))))) (|cc_comp_hidd_prop| "" (EXPAND "cc_comp") (("" (EXPAND "base_cc_comp") (("" (USE "cc_hidd_prop") NIL)))))) $$$views.pvs views[X: NONEMPTY_TYPE]: THEORY BEGIN BASE_RELATIONS: TYPE = [X, X -> bool] x, x1, x2, x3, x4: VAR X br: VAR BASE_RELATIONS VIEWS(br): bool = ((FORALL x: br(x, x)) AND (FORALL x1, x2: br(x1, x2) IMPLIES br(x2, x1)) AND (FORALL x1, x2, x3: br(x1, x2) AND br(x2, x3) IMPLIES br(x1, x3))) v1, v2: VAR (VIEWS) view_and_prop: THEOREM VIEWS(intersection(v1, v2)) refl_view: LEMMA v1(x, x) sym_view: LEMMA v1(x1, x2) => v1(x2, x1) trans_view: LEMMA v1(x1, x2) AND v1(x2, x3) => v1(x1, x3) trans_sym_view: LEMMA v1(x1, x2) AND v1(x1, x3) => v1(x2, x3) square_view: LEMMA v1(x1, x2) AND v1(x1, x3) AND v1(x2, x4) => v1(x3, x4) eq_view1: LEMMA VIEWS(LAMBDA x1, x2: x1 = x2) eq_view2: LEMMA (FORALL x1, x2: br(x1, x2) IFF x1 = x2) IMPLIES VIEWS(br) END views $$$views.prf (|views| (|view_and_prop| "" (SKOLEM!) (("" (EXPAND "intersection") (("" (TYPEPRED "v1!1") (("" (TYPEPRED "v2!1") (("" (EXPAND "VIEWS") (("" (EXPAND "member") (("" (SKOSIMP*) (("" (SPLIT 1) (("1" (HIDE -2 -3 -5 -6) (("1" (GROUND) (("1" (GRIND) NIL))))) ("2" (HIDE -1 -3 -4 -6) (("2" (SKOLEM!) (("2" (FLATTEN) (("2" (INST -3 "x1!1" "x2!1") (("2" (INST -4 "x1!1" "x2!1") (("2" (GROUND) NIL))))))))))) ("3" (SKOLEM!) (("3" (FLATTEN) (("3" (HIDE -5 -6 -8 -9) (("3" (INST -5 "x1!1" "x2!1" "x3!1") (("3" (INST -6 "x1!1" "x2!1" "x3!1") (("3" (GRIND) NIL))))))))))))))))))))))))))) (|refl_view| "" (SKOLEM!) (("" (TYPEPRED "v1!1") (("" (EXPAND "VIEWS") (("" (SKOSIMP*) (("" (INST -1 "x!1") NIL))))))))) (|sym_view| "" (SKOLEM!) (("" (TYPEPRED "v1!1") (("" (EXPAND "VIEWS") (("" (FLATTEN) (("" (INST -2 "x1!1" "x2!1") (("" (GROUND) NIL))))))))))) (|trans_view| "" (SKOLEM!) (("" (TYPEPRED "v1!1") (("" (EXPAND "VIEWS") (("" (FLATTEN) (("" (INST -3 "x1!1" "x2!1" "x3!1") (("" (GROUND) NIL))))))))))) (|trans_sym_view| "" (SKOSIMP*) (("" (LEMMA "trans_view") (("" (INSTANTIATE -1 ("v1!1" "x2!1" "x1!1" "x3!1")) (("" (GROUND) (("" (REWRITE "sym_view") NIL))))))))) (|square_view| "" (SKOSIMP*) (("" (LEMMA "sym_view") (("" (LEMMA "trans_view") (("" (INST -1 "v1!1" "x1!1" "x2!1" "x4!1") (("" (GROUND) (("" (HIDE -4 -5) (("" (INST -2 "v1!1" "x1!1" "x3!1") (("" (GROUND) (("" (REWRITE-LEMMA "trans_view" ("v1" "v1!1" "x1" "x3!1" "x2" "x1!1" "x3" "x4!1")) NIL))))))))))))))))) (|eq_view1| "" (EXPAND "VIEWS") (("" (SPLIT) (("1" (SKOSIMP*) (("1" (GROUND) NIL))) ("2" (SKOSIMP*) (("2" (GROUND) NIL))))))) (|eq_view2| "" (SKOSIMP*) (("" (CASE "br!1 /= (LAMBDA x1, x2: x1 = x2)") (("1" (DELETE 1) (("1" (FLATTEN) (("1" (EXTENSIONALITY "setof[[X,X]]") (("1" (INST?) (("1" (GROUND) (("1" (SKOLEM!) (("1" (INST?) (("1" (GROUND) NIL))))))))))))))) ("2" (FLATTEN) (("2" (REPLACE -1 :HIDE? -1) (("2" (REWRITE "eq_view1") NIL)))))))))) $$$component.pvs component[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING views[ST] transition: TYPE = [ST, ST, AG] TRANSITION_CLASS: TYPE = setof[transition] st, st1, st2, st3, st4: VAR ST base_comp_t: TYPE = [# init: setof[ST], guar: setof[transition], rely: setof[transition], hidd: setof[transition], cags: setof[AG], view: (VIEWS), wfar: setof[TRANSITION_CLASS], sfar: setof[TRANSITION_CLASS] #] bc: VAR base_comp_t ag: VAR AG init_restriction(bc): bool = (init(bc) /= emptyset) guar_restriction(bc): bool = (FORALL st1, st2, ag: member((st1, st2, ag), guar(bc)) IMPLIES member(ag, cags(bc))) cags_restriction(bc): bool = (cags(bc) /= emptyset) rely_restriction(bc): bool = (FORALL st1, st2, ag: member((st1, st2, ag), rely(bc)) IMPLIES NOT member(ag, cags(bc))) hidd_restriction(bc): bool = (FORALL st1, st2, ag: member((st1, st2, ag), hidd(bc)) IMPLIES NOT member(ag, cags(bc))) tranc: VAR TRANSITION_CLASS v: VAR (VIEWS) gen_view_restriction(tranc, v): bool = (FORALL ag, st1, st2, st3, st4: v(st1, st3) AND v(st2, st4) AND member((st1, st2, ag), tranc) IMPLIES member((st3, st4, ag), tranc)) view_rely_restriction(bc): bool = gen_view_restriction(rely(bc), view(bc)) view_hidd_restriction(bc): bool = gen_view_restriction(hidd(bc), view(bc)) view_guar_restriction(bc): bool = gen_view_restriction(guar(bc), view(bc)) view_init_restriction(bc): bool = (FORALL st1, st2: view(bc)(st1, st2) AND member(st1, init(bc)) IMPLIES member(st2, init(bc))) view_wfar_restriction(bc): bool = (FORALL tranc: member(tranc, wfar(bc)) IMPLIES gen_view_restriction(tranc, view(bc))) view_sfar_restriction(bc): bool = (FORALL tranc: member(tranc, sfar(bc)) IMPLIES gen_view_restriction(tranc, view(bc))) ag_set: VAR setof[AG] gen_stuttering_restriction(ag_set, tranc, v): bool = (FORALL ag, st1, st2: member(ag, ag_set) AND v(st1, st2) IMPLIES member((st1, st2, ag), tranc)) guar_stuttering_restriction(bc): bool = gen_stuttering_restriction(cags(bc), guar(bc), view(bc)) rely_stuttering_restriction(bc): bool = gen_stuttering_restriction(complement(cags(bc)), rely(bc), view(bc)) hidd_stuttering_restriction(bc): bool = gen_stuttering_restriction(complement(cags(bc)), hidd(bc), view(bc)) rely_hidd_restriction(bc): bool = subset?(rely(bc), hidd(bc)) comp_t(bc): bool = init_restriction(bc) AND guar_restriction(bc) AND rely_hidd_restriction(bc) AND hidd_restriction(bc) AND cags_restriction(bc) AND view_rely_restriction(bc) AND view_hidd_restriction(bc) AND view_guar_restriction(bc) AND view_init_restriction(bc) AND view_wfar_restriction(bc) AND view_sfar_restriction(bc) AND guar_stuttering_restriction(bc) AND rely_stuttering_restriction(bc) steps(bc): setof[[ST, ST, AG]] = (LAMBDA st1, st2, ag: guar(bc)(st1, st2, ag) OR rely(bc)(st1, st2, ag)) c: VAR (comp_t) component_init: THEOREM init_restriction(c) component_guar: THEOREM guar_restriction(c) component_rely_hidd: THEOREM rely_hidd_restriction(c) component_hidd: THEOREM hidd_restriction(c) component_rely: THEOREM rely_restriction(c) component_cags: THEOREM cags_restriction(c) component_view_rely: THEOREM view_rely_restriction(c) component_view_hidd: THEOREM view_hidd_restriction(c) component_view_guar: THEOREM view_guar_restriction(c) component_view_init: THEOREM view_init_restriction(c) component_view_wfar: THEOREM view_wfar_restriction(c) component_view_sfar: THEOREM view_sfar_restriction(c) component_guar_stuttering: THEOREM guar_stuttering_restriction(c) component_rely_stuttering: THEOREM rely_stuttering_restriction(c) component_hidd_stuttering: THEOREM hidd_stuttering_restriction(c) END component $$$component.prf (|component| (|component_init| "" (SKOLEM!) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_guar| "" (SKOLEM!) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_rely_hidd| "" (SKOLEM!) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_hidd| "" (SKOSIMP*) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_rely| "" (SKOLEM!) (("" (EXPAND "rely_restriction") (("" (SKOSIMP*) (("" (LEMMA "component_rely_hidd") (("" (INST?) (("" (EXPAND "rely_hidd_restriction") (("" (EXPAND "subset?") (("" (INST?) (("" (GROUND) (("" (LEMMA "component_hidd") (("" (INST?) (("" (EXPAND "hidd_restriction") (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))) (|component_cags| "" (SKOLEM!) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_view_rely| "" (SKOLEM!) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_view_hidd| "" (SKOLEM!) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_view_guar| "" (SKOLEM!) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_view_init| "" (SKOSIMP*) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_view_wfar| "" (SKOLEM!) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_view_sfar| "" (SKOLEM!) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_guar_stuttering| "" (SKOLEM!) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_rely_stuttering| "" (SKOLEM!) (("" (TYPEPRED "c!1") (("" (EXPAND "comp_t") (("" (GROUND) NIL))))))) (|component_hidd_stuttering| "" (SKOLEM!) (("" (LEMMA "component_rely_stuttering") (("" (INST?) (("" (GROUND) (("" (LEMMA "component_rely_hidd") (("" (INST?) (("" (GROUND) (("" (EXPAND "hidd_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP*) (("" (EXPAND "rely_hidd_restriction") (("" (EXPAND "subset?") (("" (INST?) (("" (GROUND) (("" (EXPAND "rely_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (INST?) (("" (GROUND) NIL)))))))))))))))))))))))))))))))))))) $$$component_aux.pvs component_aux[ST: NONEMPTY_TYPE, AG: NONEMPTY_TYPE]: THEORY BEGIN IMPORTING component[ST, AG] bc: VAR base_comp_t st1, st2, st3, st4: VAR ST ag: VAR AG ag_set: VAR setof[AG] tranc: VAR setof[transition] v: VAR (VIEWS) gen_class(tranc, v): setof[transition] = (LAMBDA st1, st2, ag: (EXISTS st3, st4: member((st3, st4, ag), tranc) AND v(st1, st3) AND v(st2, st4))) gen_class_view: THEOREM gen_view_restriction(gen_class(tranc, v), v) add_stuttering(ag_set, tranc, v): setof[transition] = (LAMBDA st1, st2, ag: member((st1, st2, ag), tranc) OR (member(ag, ag_set) AND v(st1, st2))) add_stuttering_guar: THEOREM guar(bc) = add_stuttering(cags(bc), tranc, view(bc)) IMPLIES guar_stuttering_restriction(bc) add_stuttering_rely: THEOREM rely(bc) = add_stuttering(complement(cags(bc)), tranc, view(bc)) IMPLIES rely_stuttering_restriction(bc) gen_class_preserves_stuttering: THEOREM gen_stuttering_restriction(ag_set, tranc, v) IMPLIES gen_stuttering_restriction(ag_set, gen_class(tranc, v), v) add_stuttering_and_gen(ag_set, tranc, v): setof[transition] = gen_class(add_stuttering(ag_set, tranc, v), v) asag_stuttering: THEOREM gen_stuttering_restriction(ag_set, add_stuttering_and_gen(ag_set, tranc, v), v) asag_view: THEOREM gen_view_restriction(add_stuttering_and_gen(ag_set, tranc, v), v) view_eq(bc) : bool = (FORALL st1, st2: view(bc)(st1, st2) IFF st1 = st2) component_view_eq_red: THEOREM view_eq(bc) IMPLIES view_rely_restriction(bc) AND view_hidd_restriction(bc) AND view_guar_restriction(bc) AND view_init_restriction(bc) AND view_wfar_restriction(bc) AND view_sfar_restriction(bc) component_view_eq_thm: THEOREM view_eq(bc) AND init_restriction(bc) AND guar_restriction(bc) AND rely_hidd_restriction(bc) AND hidd_restriction(bc) AND cags_restriction(bc) AND guar_stuttering_restriction(bc) AND rely_stuttering_restriction(bc) => comp_t(bc) guar_reqs_hold(st1, st2, ag, bc): bool = (member(ag, cags(bc)) AND (FORALL st3, st4: view(bc)(st1, st3) AND view(bc)(st2, st4) IMPLIES member((st3, st4, ag), guar(bc)))) guar_reqs_hold_thm: THEOREM (FORALL st1, st2, ag: member((st1, st2, ag), tranc) IMPLIES guar_reqs_hold(st1, st2, ag, bc)) IFF (FORALL st1, st2, ag: member((st1, st2, ag), gen_class(tranc, view(bc))) IMPLIES guar_reqs_hold(st1, st2, ag, bc)) guar_reqs_sufficient: THEOREM (FORALL st1, st2, ag: member((st1, st2, ag), guar(bc)) IMPLIES guar_reqs_hold(st1, st2, ag, bc)) IFF (view_guar_restriction(bc) AND guar_restriction(bc)) rely_reqs_hold(st1, st2, ag, bc): bool = (member((st1, st2, ag), hidd(bc)) AND (FORALL st3, st4: view(bc)(st1, st3) AND view(bc)(st2, st4) IMPLIES member((st3, st4, ag), rely(bc)))) rely_reqs_sufficient: THEOREM (FORALL st1, st2, ag: member((st1, st2, ag), rely(bc)) IMPLIES rely_reqs_hold(st1, st2, ag, bc)) IFF (view_rely_restriction(bc) AND rely_hidd_restriction(bc)) hidd_reqs_hold(st1, st2, ag, bc): bool = (NOT member(ag, cags(bc)) AND (FORALL st3, st4: view(bc)(st1, st3) AND view(bc)(st2, st4) IMPLIES member((st3, st4, ag), hidd(bc)))) hidd_reqs_hold_thm: THEOREM (FORALL st1, st2, ag: member((st1, st2, ag), tranc) IMPLIES hidd_reqs_hold(st1, st2, ag, bc)) IFF (FORALL st1, st2, ag: member((st1, st2, ag), gen_class(tranc, view(bc))) IMPLIES hidd_reqs_hold(st1, st2, ag, bc)) rely_reqs_hold_thm: THEOREM view_hidd_restriction(bc) IMPLIES ((FORALL st1, st2, ag: member((st1, st2, ag), tranc) IMPLIES rely_reqs_hold(st1, st2, ag, bc)) IFF (FORALL st1, st2, ag: member((st1, st2, ag), gen_class(tranc, view(bc))) IMPLIES rely_reqs_hold(st1, st2, ag, bc))) hidd_reqs_sufficient: THEOREM (FORALL st1, st2, ag: member((st1, st2, ag), hidd(bc)) IMPLIES hidd_reqs_hold(st1, st2, ag, bc)) IFF (view_hidd_restriction(bc) AND hidd_restriction(bc)) END component_aux $$$component_aux.prf (|component_aux| (|gen_class_view| "" (SKOLEM!) (("" (EXPAND "gen_view_restriction") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "gen_class") (("" (SKOSIMP*) (("" (INSTANTIATE 1 ("st3!2" "st4!2")) (("" (CASE "not (forall st1, st2, st3: v!1(st1,st2) and v!1(st1,st3) implies v!1(st2,st3))") (("1" (DELETE -1 -2 -3 -4 -5 2) (("1" (SKOSIMP*) (("1" (TYPEPRED "v!1") (("1" (EXPAND "VIEWS") (("1" (FLATTEN) (("1" (INSTANTIATE -3 ("st2!2" "st1!2" "st3!3")) (("1" (GROUND) (("1" (INSTANTIATE -2 ("st1!2" "st2!2")) (("1" (GROUND) NIL))))))))))))))))) ("2" (GROUND) (("1" (INSTANTIATE -1 ("st1!1" "st3!1" "st3!2")) (("1" (GROUND) NIL))) ("2" (INSTANTIATE -1 ("st2!1" "st4!1" "st4!2")) (("2" (GROUND) NIL))))))))))))))))))))) (|add_stuttering_guar| "" (SKOSIMP*) (("" (EXPAND "guar_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (REPLACE -1 :HIDE? -1) (("" (SKOSIMP*) (("" (EXPAND "member") (("" (EXPAND "add_stuttering") (("" (EXPAND "member") (("" (GROUND) NIL))))))))))))))))) (|add_stuttering_rely| "" (SKOSIMP*) (("" (EXPAND "rely_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (REPLACE -1 :HIDE? -1) (("" (SKOSIMP*) (("" (EXPAND "member" +) (("" (EXPAND "add_stuttering") (("" (GROUND) NIL))))))))))))))) (|gen_class_preserves_stuttering| "" (SKOSIMP*) (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP*) (("" (INST?) (("" (GROUND) (("" (EXPAND "member" +) (("" (EXPAND "gen_class") (("" (INST?) (("" (REWRITE "refl_view") (("" (REWRITE "refl_view") (("" (GROUND) NIL))))))))))))))))))))) (|asag_stuttering| "" (SKOSIMP*) (("" (EXPAND "add_stuttering_and_gen") (("" (REWRITE "gen_class_preserves_stuttering") (("" (DELETE 2) (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP*) (("" (EXPAND "member" +) (("" (EXPAND "add_stuttering") (("" (GROUND) NIL))))))))))))))))) (|asag_view| "" (SKOSIMP*) (("" (EXPAND "add_stuttering_and_gen") (("" (REWRITE "gen_class_view") NIL))))) (|component_view_eq_red| "" (SKOSIMP) (("" (EXPAND "view_eq") (("" (CASE "view(bc!1) /= (LAMBDA st1, st2: st1 = st2)") (("1" (DELETE 1) (("1" (FLATTEN) (("1" (EXTENSIONALITY "setof[[ST,ST]]") (("1" (INST?) (("1" (GROUND) (("1" (DELETE 2) (("1" (SKOLEM!) (("1" (INST?) (("1" (GROUND) NIL))))))))))))))))) ("2" (DELETE -1) (("2" (FLATTEN) (("2" (EXPAND "view_rely_restriction") (("2" (EXPAND "view_hidd_restriction") (("2" (EXPAND "view_guar_restriction") (("2" (EXPAND "view_init_restriction") (("2" (EXPAND "view_wfar_restriction") (("2" (EXPAND "view_sfar_restriction") (("2" (EXPAND "gen_view_restriction") (("2" (REPLACE -1 :HIDE? -1) (("2" (GROUND) (("1" (SKOSIMP) (("1" (GROUND) NIL))) ("2" (SKOSIMP) (("2" (GROUND) NIL))) ("3" (SKOSIMP) (("3" (GROUND) NIL))) ("4" (SKOSIMP) (("4" (GROUND) NIL))) ("5" (SKOSIMP) (("5" (GROUND) (("5" (SKOSIMP) (("5" (GROUND) NIL))))))) ("6" (SKOSIMP) (("6" (GROUND) (("6" (SKOSIMP) (("6" (GROUND) NIL))))))))))))))))))))))))))))))))))) (|component_view_eq_thm| "" (SKOSIMP) (("" (EXPAND "comp_t") (("" (USE "component_view_eq_red") (("" (GROUND) NIL))))))) (|guar_reqs_hold_thm| "" (SKOLEM!) (("" (SPLIT) (("1" (SKOSIMP*) (("1" (EXPAND "member" -2) (("1" (EXPAND "gen_class") (("1" (SKOSIMP*) (("1" (INSTANTIATE -1 ("st3!1" "st4!1" "ag!1")) (("1" (GROUND) (("1" (EXPAND "guar_reqs_hold") (("1" (GROUND) (("1" (SKOSIMP*) (("1" (INSTANTIATE -4 ("st3!2" "st4!2")) (("1" (LEMMA "trans_sym_view") (("1" (GROUND) (("1" (INSTANTIATE -1 ("view(bc!1)" "st1!1" "st3!1" "st3!2")) (("1" (GROUND) NIL))) ("2" (INSTANTIATE -1 ("view(bc!1)" "st2!1" "st4!1" "st4!2")) (("2" (GROUND) NIL))))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) (("2" (EXPAND "member" +) (("2" (EXPAND "gen_class") (("2" (INST?) (("2" (REWRITE "refl_view") (("2" (REWRITE "refl_view") (("2" (GROUND) NIL))))))))))))))))))))) (|guar_reqs_sufficient| "" (SKOLEM!) (("" (EXPAND "guar_reqs_hold") (("" (EXPAND "view_guar_restriction") (("" (EXPAND "gen_view_restriction") (("" (EXPAND "guar_restriction") (("" (GROUND) (("1" (SKOSIMP*) (("1" (INSTANTIATE -4 ("st1!1" "st2!1" "ag!1")) (("1" (GROUND) (("1" (INSTANTIATE -2 ("st3!1" "st4!1")) (("1" (GROUND) NIL))))))))) ("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) NIL))))) ("3" (SKOSIMP*) (("3" (INSTANTIATE -2 ("st1!1" "st2!1" "ag!1")) (("3" (GROUND) (("3" (SKOSIMP*) (("3" (INSTANTIATE -4 ("ag!1" "st1!1" "st2!1" "st3!1" "st4!1")) (("3" (GROUND) NIL))))))))))))))))))))))) (|rely_reqs_sufficient| "" (SKOLEM!) (("" (EXPAND "rely_reqs_hold") (("" (EXPAND "view_rely_restriction") (("" (EXPAND "gen_view_restriction") (("" (EXPAND "rely_hidd_restriction") (("" (GROUND) (("1" (SKOSIMP*) (("1" (INST?) (("1" (GROUND) (("1" (INSTANTIATE -2 ("st3!1" "st4!1")) (("1" (GROUND) NIL))))))))) ("2" (EXPAND "subset?") (("2" (SKOSIMP*) (("2" (INSTANTIATE -2 ("PROJ_1(x!1)" "PROJ_2(x!1)" "PROJ_3(x!1)")) (("2" (EXPAND "member") (("2" (GROUND) NIL))))))))) ("3" (SKOSIMP*) (("3" (EXPAND "subset?") (("3" (INSTANTIATE -2 "(st1!1,st2!1,ag!1)") (("3" (GROUND) (("3" (SKOSIMP*) (("3" (INSTANTIATE -4 ("ag!1" "st1!1" "st2!1" "st3!1" "st4!1")) (("3" (GROUND) NIL))))))))))))))))))))))))) (|hidd_reqs_hold_thm| "" (SKOLEM!) (("" (GROUND) (("1" (SKOSIMP*) (("1" (EXPAND "member" -2) (("1" (EXPAND "gen_class") (("1" (SKOSIMP*) (("1" (INSTANTIATE -1 ("st3!1" "st4!1" "ag!1")) (("1" (GROUND) (("1" (EXPAND "hidd_reqs_hold") (("1" (GROUND) (("1" (SKOSIMP*) (("1" (INSTANTIATE -3 ("st3!2" "st4!2")) (("1" (LEMMA "trans_sym_view") (("1" (GROUND) (("1" (INSTANTIATE -1 ("view(bc!1)" "st1!1" "st3!1" "st3!2")) (("1" (GROUND) NIL))) ("2" (INSTANTIATE -1 ("view(bc!1)" "st2!1" "st4!1" "st4!2")) (("2" (GROUND) NIL))))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) (("2" (EXPAND "member" +) (("2" (EXPAND "gen_class") (("2" (INST?) (("2" (GROUND) (("1" (REWRITE "refl_view") NIL) ("2" (REWRITE "refl_view") NIL))))))))))))))))))) (|rely_reqs_hold_thm| "" (SKOLEM!) (("" (GROUND) (("1" (SKOSIMP*) (("1" (EXPAND "member" -2) (("1" (EXPAND "gen_class") (("1" (SKOSIMP*) (("1" (INSTANTIATE -1 ("st3!1" "st4!1" "ag!1")) (("1" (GROUND) (("1" (EXPAND "rely_reqs_hold") (("1" (GROUND) (("1" (EXPAND "view_hidd_restriction") (("1" (EXPAND "gen_view_restriction") (("1" (INSTANTIATE -6 ("ag!1" "st3!1" "st4!1" "st1!1" "st2!1")) (("1" (GROUND) (("1" (REWRITE "sym_view") NIL) ("2" (REWRITE "sym_view") NIL))))))))) ("2" (SKOSIMP*) (("2" (INSTANTIATE -4 ("st3!2" "st4!2")) (("2" (LEMMA "trans_sym_view") (("2" (GROUND) (("1" (INSTANTIATE -1 ("view(bc!1)" "st1!1" "st3!1" "st3!2")) (("1" (GROUND) NIL))) ("2" (INSTANTIATE -1 ("view(bc!1)" "st2!1" "st4!1" "st4!2")) (("2" (GROUND) NIL))))))))))))))))))))))))))) ("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) (("2" (EXPAND "member" +) (("2" (EXPAND "gen_class") (("2" (INST?) (("2" (GROUND) (("1" (REWRITE "refl_view") NIL) ("2" (REWRITE "refl_view") NIL))))))))))))))))))) (|hidd_reqs_sufficient| "" (SKOSIMP*) (("" (EXPAND "hidd_reqs_hold") (("" (EXPAND "view_hidd_restriction") (("" (EXPAND "gen_view_restriction") (("" (EXPAND "hidd_restriction") (("" (GROUND) (("1" (SKOSIMP*) (("1" (INST?) (("1" (GROUND) (("1" (INSTANTIATE -1 ("st3!1" "st4!1")) (("1" (GROUND) NIL))))))))) ("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) NIL))))) ("3" (SKOSIMP*) (("3" (INSTANTIATE -2 ("st1!1" "st2!1" "ag!1")) (("3" (GROUND) (("3" (SKOSIMP*) (("3" (INSTANTIATE -3 ("ag!1" "st1!1" "st2!1" "st3!1" "st4!1")) (("3" (GROUND) NIL)))))))))))))))))))))))) $$$k_state_witness.pvs k_state_witness: THEORY BEGIN IMPORTING k_state k_external_state_witness : K_EXTERNAL_STATE = (# pending_requests := emptyset[K_REQ], existing_threads := k_threads, received_info := (LAMBDA (th : (k_threads)) : ri_witness), thread_status := (LAMBDA (th : (k_threads)) : thread_running) #) k_internal_state_witness : (K_INTERNAL_STATE) = (# existing_tasks := {tk : TASK | tk = k_task}, existing_threads := k_threads, existing_ports := {p : PORT | p = k_port }, existing_messages := emptyset[MESSAGE], task_threads := (LAMBDA (tk : TASK | tk = k_task) : k_threads), task_names := (LAMBDA (tk : TASK | tk = k_task) : {nm : NAME | nm = host_name OR nm = ss_name}), dead_names := (LAMBDA (tk : TASK | tk = k_task) : emptyset[NAME]), named_port := (LAMBDA (tk : TASK | tk = k_task) : (LAMBDA (nm : NAME | nm = host_name OR nm = ss_name) : k_port) ), held_rights := (LAMBDA (tk : TASK | tk = k_task) : (LAMBDA (nm : NAME | nm = host_name OR nm = ss_name) : {r : RIGHT | r=send OR r=receive}) ), task_sid := (LAMBDA (tk : TASK | tk = k_task) : sid_witness), port_sid := (LAMBDA (p : PORT | p = k_port) : sid_witness), cached_access := (LAMBDA (ssi : SID, osi : SID) : emptyset[PERMISSION]), queue := (LAMBDA (p : PORT | p = k_port) : null_seq[MESSAGE]), sending_sid := (LAMBDA (msg : (emptyset[MESSAGE])) : sid_witness), av := (LAMBDA (msg : (emptyset[MESSAGE])) : emptyset[PERMISSION]), op := (LAMBDA (msg : (emptyset[MESSAGE])) : op_witness), sent_data := (LAMBDA (msg : (emptyset[MESSAGE])) : null_data), sent_rights := (LAMBDA (msg : (emptyset[MESSAGE])) : null_rights), reply_port := (LAMBDA (msg : (emptyset[MESSAGE])) : null_port) #) k_internal_state_witness_prop : THEOREM EXISTS (st : (K_INTERNAL_STATE)) : TRUE k_state_witness : (K_STATE) = (# int_st := k_internal_state_witness, ext_st := k_external_state_witness #) k_state_witness_prop : THEOREM EXISTS (s : (K_STATE)) : TRUE END k_state_witness $$$k_state_witness.prf (|k_state_witness| (|k_internal_state_witness_TCC1| "" (LEMMA "names_distinct_axiom") (("" (LEMMA "k_port_non_null_axiom") (("" (EXPAND "K_INTERNAL_STATE") (("" (GRIND) (("1" (INST 5 "k_task") (("1" (GRIND) NIL))) ("2" (APPLY-EXTENSIONALITY 5) (("2" (GRIND) NIL))))))))))) (|k_internal_state_witness_TCC2| "" (SKOSIMP) (("" (GROUND) NIL))) (|k_internal_state_witness_TCC3| "" (EXPAND "K_INTERNAL_STATE") (("" (LEMMA "names_distinct_axiom") (("" (LEMMA "k_port_non_null_axiom") (("" (EXPAND "extend") (("" (GROUND) (("1" (APPLY-EXTENSIONALITY) (("1" (LIFT-IF) (("1" (GROUND) (("1" (EXPAND "restrict") (("1" (PROPAX) NIL))))))))) ("2" (SKOSIMP*) (("2" (INST + "k_task") (("2" (EXPAND "restrict") (("2" (PROPAX) NIL))))))) ("3" (SKOSIMP*) (("3" (GROUND) NIL))) ("4" (SKOSIMP*) (("4" (EXPAND "disjoint?") (("4" (REWRITE "intersection_empty") (("4" (REWRITE "emptyset_is_empty?") NIL))))))) ("5" (SKOSIMP*) (("5" (REWRITE "nonempty_exists") (("5" (INST + "send") NIL))))) ("6" (SKOSIMP*) (("6" (HIDE 1) (("6" (TYPEPRED "msg!1") (("6" (EXPAND "emptyset") (("6" (PROPAX) NIL))))))))))))))))))) (|k_internal_state_witness_prop| "" (INST 1 "k_internal_state_witness") NIL) (|k_state_witness_TCC1| "" (EXPAND "K_STATE") (("" (EXPAND "k_internal_state_witness") (("" (EXPAND "k_external_state_witness") (("" (PROPAX) NIL))))))) (|k_state_witness_prop| "" (INST 1 "k_state_witness") NIL) (|choose_k_state_TCC1| "" (SKOSIMP) (("" (REWRITE "nonempty_member") (("" (EXPAND "member") (("" (INST + "k_internal_state_witness WITH [existing_threads := existing_threads(est!1), task_threads := (LAMBDA (tk: TASK | tk = k_task): existing_threads(est!1))]") (("1" (BETA) (("1" (PROPAX) NIL))) ("2" (USE "k_internal_state_witness_TCC1") (("2" (EXPAND "k_internal_state_witness") (("2" (EXPAND "K_INTERNAL_STATE") (("2" (GROUND) (("1" (EXPAND "extend") (("1" (POSTPONE) NIL))) ("2" (POSTPONE) NIL))))))))) ("3" (SKOSIMP) (("3" (TYPEPRED "y1!1") (("3" (TYPEPRED "x1!1") (("3" (EXPAND "k_internal_state_witness") (("3" (PROPAX) NIL))))))))) ("4" (SKOSIMP) (("4" (EXPAND "k_internal_state_witness") (("4" (PROPAX) NIL))))))))))))) (|choose_k_state_TCC2| "" (SKOSIMP) (("" (EXPAND "K_STATE") (("" (LEMMA "epsilon_ax[(K_INTERNAL_STATE)]") (("1" (INST?) (("1" (GROUND) NIL))) ("2" (INST + "k_internal_state_witness") NIL)))))))) $$$k_rely.pvs k_rely : THEORY BEGIN % ===== % IMPORTS % ======= IMPORTING k_state % VARIABLES % ========= st1, st2 : VAR (K_STATE) ist1, ist2 : VAR (K_INTERNAL_STATE) est1, est2 : VAR K_EXTERNAL_STATE ag, thread : VAR THREAD kern_req : VAR KERNEL_REQ % ENVIRONMENTAL ASSUMPTIONS % ============= =========== % 1. Nobody else changes my internal state: k_rely_internal(ist1, ist2) : bool = ist1 = ist2 % 2. Nobody changes the set of existing threads: k_rely_existing_threads(est1, est2) : bool = existing_threads(est1) = existing_threads(est2) % 3. The only change allowed to pending_requests is the addition % of a send or receive message request by the active agent: k_rely_pending_requests(est1, est2, ag) : bool = FORALL kern_req : ( TRUE AND pending_requests(est1)(kern_req) => pending_requests(est2)(kern_req) AND (NOT pending_requests(est1)(kern_req) AND pending_requests(est2)(kern_req) => ( FALSE OR (send_message_req?(kern_req) AND smth(kern_req) = ag) OR (receive_message_req?(kern_req) AND rmth(kern_req) = ag) ))) % 4. The only change allowed to thread_status is the changing of the active agent's % status from thread_running to thread_waiting: k_rely_thread_status(est1, est2, ag) : bool = FORALL (thread : THREAD) : ( FALSE OR NOT existing_threads(est1)(thread) OR NOT existing_threads(est2)(thread) OR thread_status(est1)(thread) = thread_status(est2)(thread) OR (TRUE AND thread_status(est1)(thread) = thread_running AND thread_status(est2)(thread) = thread_waiting AND thread = ag ) ) % 5. The only change allowed to received_info is the changing of the active agent's % ri_status from ri_unprocessed to ri_processed. k_rely_received_info(est1, est2, ag) : bool = FORALL (thread : THREAD) : ( FALSE OR NOT existing_threads(est1)(thread) OR NOT existing_threads(est2)(thread) OR received_info(est1)(thread) = received_info(est2)(thread) OR ( TRUE AND ri_status(received_info(est1)(thread)) = ri_unprocessed AND ri_status(received_info(est2)(thread)) = ri_processed AND thread = ag ) ) % THE ENVIRONMENTAL ASSUMPTIONS % === ============= =========== k_rely(st1, st2, ag) : bool = TRUE AND NOT k_threads(ag) AND k_rely_internal(int_st(st1), int_st(st2)) AND k_rely_existing_threads(ext_st(st1), ext_st(st2)) AND k_rely_pending_requests(ext_st(st1), ext_st(st2), ag) AND k_rely_thread_status(ext_st(st1), ext_st(st2), ag) AND k_rely_received_info(ext_st(st1), ext_st(st2), ag) k_rely_refl: THEOREM k_threads(ag) OR k_rely(st1,st1,ag) %% HIDD %% ==== %% We assume that clients of the kernel are unable to violate the %% environment assumptions made above by the kernel. k_hidd(st1,st2,ag) : bool = k_rely(st1, st2, ag) END k_rely % === ====== $$$k_rely.prf (|k_rely| (|k_rely_thread_status_TCC1| "" (SKOSIMP*) NIL) (|k_rely_thread_status_TCC2| "" (SKOSIMP) NIL) (|k_rely_refl| "" (SKOSIMP) (("" (EXPAND "k_rely") (("" (GROUND) (("1" (EXPAND "k_rely_internal") (("1" (PROPAX) NIL))) ("2" (EXPAND "k_rely_existing_threads") (("2" (PROPAX) NIL))) ("3" (EXPAND "k_rely_pending_requests") (("3" (SKOSIMP) (("3" (GROUND) NIL))))) ("4" (EXPAND "k_rely_thread_status") (("4" (PROPAX) NIL))) ("5" (EXPAND "k_rely_received_info") (("5" (PROPAX) NIL)))))))))) $$$k_get_ss_port.pvs k_get_ss_port : THEORY BEGIN % ===== % IMPORTS % ======= IMPORTING k_state IMPORTING k_utilities % THE k_get_ss_port REQUEST % === ============= ======= % % k_get_ss_port describes a transition where a client has requested % to get the kernels security server port. k_get_ss_port ( st1 : (K_STATE), % The initial state of the transition st2 : (K_STATE), % The final state of the transition ag : (k_threads) % The mediating agent ) : bool = EXISTS ( ist1, ist2 : (K_INTERNAL_STATE), % The internal state components est1, est2 : K_EXTERNAL_STATE, % The externally visible components kreq : K_REQ, % The kernel request being processed client : THREAD, % The client thread op : OP, % The operation; redundant (= get_ss_op) client_av : ACCESS_VECTOR, % The av associated with (client, svc_port) svc_port : PORT, % The port on which the request was received reply_port : PORT, % The port where reply message is enqueued msg : MESSAGE % The reply message enqueued at reply_port ) : ( TRUE % Establish some variables. AND ist1 = int_st(st1) AND ist2 = int_st(st2) AND est1 = ext_st(st1) AND est2 = ext_st(st2) %% Avoid excess TCCs AND (FORALL (x1: (existing_tasks(ist1)), y1: (existing_tasks(ist2))): existing_tasks(ist1)(y1) AND existing_tasks(ist2)(x1)) AND (FORALL (x1: (existing_ports(ist1)), y1: (existing_ports(ist2))): existing_ports(ist1)(y1) AND existing_ports(ist2)(x1)) AND (FORALL (x1: (existing_threads(est1)), y1: (existing_threads(est2))): existing_threads(est1)(y1) AND existing_threads(est2)(x1)) % Many components are invariant: AND existing_threads(est2) = existing_threads(est1) AND existing_tasks(ist2) = existing_tasks(ist1) AND task_threads(ist2) = task_threads(ist1) AND existing_ports(ist2) = existing_ports(ist1) AND task_sid(ist2) = task_sid(ist1) AND port_sid(ist2) = port_sid(ist1) AND received_info(est2) = received_info(est1) AND cached_access(ist2) = cached_access(ist1) AND task_names(ist2) = task_names(ist1) AND named_port(ist2) = named_port(ist1) AND held_rights(ist2) = held_rights(ist1) AND dead_names(ist2) = dead_names(ist1) % In this transformation we process a kernel request... AND NOT pending_requests(est2)(kreq) AND pending_requests(est1) = add(kreq, pending_requests(est2)) % and its a request to get the kernel's security server port AND get_ssp_req?(kreq) % with these particular parameters: AND client = gsct(kreq) AND op = gsop(kreq) AND client_av = gsav(kreq) AND svc_port = gssp(kreq) AND reply_port = gsrp(kreq) % The client is an existing thread... AND existing_threads(ist1)(client) AND existing_threads(est1)(client) AND existing_threads(est2)(client) % and reply_port is an existing port... AND existing_ports(ist1)(reply_port) % and client_av contains permission to get the ss port... AND client_av(get_ss_perm) % and the client had been waiting but now is running... AND thread_status(est1)(client) = thread_waiting AND thread_status(est2) = thread_status(est1) WITH [ (client) := thread_running ] % and the request was received on the correct port... AND existing_tasks(ist1)(k_task) AND task_names(ist1)(k_task)(host_name) AND task_names(ist1)(k_task)(ss_name) AND svc_port = named_port(ist1)(k_task)(host_name) % The kernel enqueues the reply message at reply_port: % The set of existing messages grows... AND NOT existing_messages(ist1)(msg) AND existing_messages(ist2) = add(msg, existing_messages(ist1)) % the msg gets added to reply_port's queue... AND queue(ist2) = (LAMBDA (pt : (existing_ports(ist1))) : IF (pt = reply_port) THEN tack_on(msg, queue(ist1)(reply_port)) ELSE queue(ist1)(pt) ENDIF ) % the sending sid gets recorded... AND sending_sid(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN sending_sid(ist1)(x) ELSE sid_witness ENDIF ) % no access vector is sent... AND av(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN av(ist1)(x) ELSE emptyset[PERMISSION] ENDIF ) % the operation gets recorded... AND op(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN op(ist1)(x) ELSE op_to_reply_op(op) ENDIF ) % the data (indicating success) gets recorded... AND sent_data(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN sent_data(ist1)(x) ELSE success_data ENDIF ) % the reply port is the same as the port where the message is enqueued... AND reply_port(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN reply_port(ist1)(x) ELSE reply_port ENDIF ) % ss port is sent back AND sent_rights(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN sent_rights(ist1)(x) ELSE (# size := 1, elem := (LAMBDA (x : nat | x > 0 AND x <= 1) : (named_port(ist1)(k_task)(ss_name), send) ) #) ENDIF ) ) END k_get_ss_port % === ============= $$$k_get_ss_port.prf (|k_get_ss_port| (|k_get_ss_port_TCC1| "" (SKOSIMP*) (("" (GROUND) (("" (TYPEPRED "st1!1") (("" (TYPEPRED "st2!1") (("" (EXPAND "K_STATE") (("" (REPLACE -3 :HIDE? T) (("" (REPLACE -3 :HIDE? T) (("" (REPLACE -3 :HIDE? T) (("" (REPLACE -3 :HIDE? T) (("" (SKOSIMP) (("" (GROUND) NIL))))))))))))))))))))) (|k_get_ss_port_TCC2| "" (SKOSIMP*) (("" (GROUND) (("" (SKOSIMP) (("" (TYPEPRED "y1!2") (("" (TYPEPRED "x2!1") (("" (GROUND) NIL))))))))))) (|k_get_ss_port_TCC3| "" (SKOSIMP*) (("" (GROUND) NIL)))) $$$k_set_ss_port.pvs k_set_ss_port : THEORY BEGIN % ===== % IMPORTS % ======= IMPORTING k_state IMPORTING k_utilities % THE k_set_ss_port REQUEST % === ============= ======= % % k_set_ss_port describes a transition where a client has requested % to set the kernels security server port. k_set_ss_port ( st1 : (K_STATE), % The initial state of the transition st2 : (K_STATE), % The final state of the transition ag : (k_threads) % The mediating agent ) : bool = EXISTS ( ist1, ist2 : (K_INTERNAL_STATE), % The internal state components est1, est2 : K_EXTERNAL_STATE, % The externally visible components kreq : K_REQ, % The kernel request being processed client : THREAD, % The client thread op : OP, % The operation; redundant (= set_ss_op) client_av : ACCESS_VECTOR, % The av associated with (client, svc_port) svc_port : PORT, % The port on which the request was received new_port : PORT, % The new security server port reply_port : PORT, % The port where reply message is enqueued msg : MESSAGE % The reply message enqueued at reply_port ) : ( TRUE % Establish some variables. AND ist1 = int_st(st1) AND ist2 = int_st(st2) AND est1 = ext_st(st1) AND est2 = ext_st(st2) %% Avoid excess TCCs AND (FORALL (x1: (existing_tasks(ist1)), y1: (existing_tasks(ist2))): existing_tasks(ist1)(y1) AND existing_tasks(ist2)(x1)) AND (FORALL (x1: (existing_ports(ist1)), y1: (existing_ports(ist2))): existing_ports(ist1)(y1) AND existing_ports(ist2)(x1)) AND (FORALL (x1: (existing_threads(est1)), y1: (existing_threads(est2))): existing_threads(est1)(y1) AND existing_threads(est2)(x1)) % Many components are invariant: AND existing_threads(est2) = existing_threads(est1) AND existing_tasks(ist2) = existing_tasks(ist1) AND task_threads(ist2) = task_threads(ist1) AND existing_ports(ist2) = existing_ports(ist1) AND task_sid(ist2) = task_sid(ist1) AND port_sid(ist2) = port_sid(ist1) AND received_info(est2) = received_info(est1) AND cached_access(ist2) = cached_access(ist1) % In this transformation we process a kernel request... AND NOT pending_requests(est2)(kreq) AND pending_requests(est1) = add(kreq, pending_requests(est2)) % and it's a request to set the kernel's security server port AND set_ssp_req?(kreq) % with these particular parameters: AND client = ssct(kreq) AND op = ssop(kreq) AND client_av = ssav(kreq) AND svc_port = sssp(kreq) AND new_port = ssnp(kreq) AND reply_port = ssrp(kreq) % The client is an existing thread... AND existing_threads(ist1)(client) AND existing_threads(est1)(client) AND existing_threads(est2)(client) % and reply_port is an existing port... AND existing_ports(ist1)(reply_port) % and new_port is an existing port... AND existing_ports(ist1)(new_port) % and client_av contains permission to set the ss port... AND client_av(set_ss_perm) % and the client had been waiting but now is running... AND thread_status(est1)(client) = thread_waiting AND thread_status(est2) = thread_status(est1) WITH [ (client) := thread_running ] % and the request was received on the correct port... AND existing_tasks(ist1)(k_task) AND task_names(ist1)(k_task)(host_name) AND svc_port = named_port(ist1)(k_task)(host_name) % and the kernel's name space gets updated. AND existing_tasks(ist2) = existing_tasks(ist1) AND FORALL (x : (existing_tasks(ist2))) : ( TRUE AND existing_tasks(ist1)(x) AND task_names(ist2)(x) = task_names(ist1)(x) AND ( FALSE OR ( TRUE AND x = k_task AND task_names(ist2)(k_task)(ss_name) AND named_port(ist2)(k_task) = named_port(ist1)(k_task) WITH [ (ss_name) := new_port ] ) OR named_port(ist2)(x) = named_port(ist1)(x) ) AND held_rights(ist2)(x) = held_rights(ist1)(x) AND dead_names(ist2)(x) = dead_names(ist1)(x) ) % The kernel enqueues the reply message at reply_port: % The set of existing messages grows... AND NOT existing_messages(ist1)(msg) AND existing_messages(ist2) = add(msg, existing_messages(ist1)) % the msg gets added to reply_port's queue... AND queue(ist2) = (LAMBDA (pt : (existing_ports(ist1))) : IF (pt = reply_port) THEN tack_on(msg, queue(ist1)(reply_port)) ELSE queue(ist1)(pt) ENDIF ) % the sending sid gets recorded... AND sending_sid(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN sending_sid(ist1)(x) ELSE sid_witness ENDIF ) % no access vector is sent... AND av(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN av(ist1)(x) ELSE emptyset[PERMISSION] ENDIF ) % the operation gets recorded... AND op(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN op(ist1)(x) ELSE op_to_reply_op(op) ENDIF ) % the data (indicating success) gets recorded... AND sent_data(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN sent_data(ist1)(x) ELSE success_data ENDIF ) % the reply port is the same as the port where the message is enqueued... AND reply_port(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN reply_port(ist1)(x) ELSE reply_port ENDIF ) % no rights are sent. AND sent_rights(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN sent_rights(ist1)(x) ELSE null_seq ENDIF ) ) END k_set_ss_port % === ============= $$$k_set_ss_port.prf (|k_set_ss_port| (|k_set_ss_port_TCC1| "" (SKOSIMP*) (("" (GROUND) (("" (TYPEPRED "st1!1") (("" (TYPEPRED "st2!1") (("" (EXPAND "K_STATE") (("" (REPLACE -3 :HIDE? T) (("" (REPLACE -3 :HIDE? T) (("" (REPLACE -3 :HIDE? T) (("" (REPLACE -3 :HIDE? T) (("" (SKOSIMP) (("" (GROUND) NIL))))))))))))))))))))) (|k_set_ss_port_TCC2| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_set_ss_port_TCC3| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_set_ss_port_TCC4| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_set_ss_port_TCC5| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_set_ss_port_TCC6| "" (SKOSIMP*) (("" (GROUND) NIL)))) $$$k_request_access.pvs k_request_access : THEORY BEGIN % ===== % IMPORTS % ======= IMPORTING k_state IMPORTING k_utilities % THE k_request_access REQUEST % === ================ ======= % % k_request_access describes a transition where the kernel sends a message % to the security server requesting an access vector computation on a pair % of sid's. k_request_access ( st1 : (K_STATE), % The initial state of the transition st2 : (K_STATE), % The final state of the transition ag : (k_threads) % The mediating agent ) : bool = EXISTS ( ist1, ist2 : (K_INTERNAL_STATE), % The internal state components est1, est2 : K_EXTERNAL_STATE, % The externally visible components new_req : K_REQ, % The new kernel request produced sid1 : SID, % The sids for which the kernel is requesting sid2 : SID % an access vector ) : ( TRUE % Establish some variables. AND ist1 = int_st(st1) AND ist2 = int_st(st2) AND est1 = ext_st(st1) AND est2 = ext_st(st2) % Almost all components are invariant: AND existing_tasks(ist2) = existing_tasks(ist1) AND existing_threads(est2) = existing_threads(est1) AND received_info(est2) = received_info(est1) AND thread_status(est2) = thread_status(est1) AND existing_ports(ist2) = existing_ports(ist1) AND existing_messages(ist2) = existing_messages(ist1) AND task_threads(ist2) = task_threads(ist1) AND task_names(ist2) = task_names(ist1) AND dead_names(ist2) = dead_names(ist1) AND named_port(ist2) = named_port(ist1) AND held_rights(ist2) = held_rights(ist1) AND task_sid(ist2) = task_sid(ist1) AND port_sid(ist2) = port_sid(ist1) AND cached_access(ist2) = cached_access(ist1) AND queue(ist2) = queue(ist1) AND sending_sid(ist2) = sending_sid(ist1) AND av(ist2) = av(ist1) AND op(ist2) = op(ist1) AND sent_data(ist2) = sent_data(ist1) AND reply_port(ist2) = reply_port(ist1) AND sent_rights(ist2) = sent_rights(ist1) % In this transformation we produce a new request... AND NOT pending_requests(est1)(new_req) AND pending_requests(est2) = add(new_req, pending_requests(est1)) % and its a send_message request to the security server. AND new_req = send_message_req( ag, % The active agent, a kernel thread, is making the request ss_name, % The message is going to the security server request_access_op,% The operation is a request for an access vector ss_name, % The reply name is the same null_user_msg WITH [ (user_data) := sid_sid_to_data(sid1, sid2) ] % The user message being sent ) ) END k_request_access % === ================ $$$k_request_access.prf (|k_request_access| (|k_request_access_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_request_access_TCC2| "" (SKOSIMP*) (("" (GROUND) (("" (TYPEPRED "st1!1") (("" (TYPEPRED "st2!1") (("" (EXPAND "K_STATE") (("" (REPLACE -3 :HIDE? T) (("" (REPLACE -3 :HIDE? T) (("" (REPLACE -3 :HIDE? T) (("" (REPLACE -3 :HIDE? T) (("" (SKOSIMP) (("" (GROUND) NIL))))))))))))))))))))) (|k_request_access_TCC3| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_request_access_TCC4| "" (SKOSIMP*) (("" (GROUND) (("" (SKOSIMP) (("" (TYPEPRED "y1!2") (("" (TYPEPRED "x2!1") (("" (GROUND) NIL))))))))))) (|k_request_access_TCC5| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_request_access_TCC6| "" (SKOSIMP*) (("" (GROUND) NIL)))) $$$k_provide_access.pvs k_provide_access : THEORY BEGIN % ===== % IMPORTS % ======= IMPORTING k_state IMPORTING k_utilities % THE k_provide_access REQUEST % === ================ ======= % % k_provide_access describes a transition where a client has requested % to add an access vector to the kernel's cache. k_provide_access ( st1 : (K_STATE), % The initial state of the transition st2 : (K_STATE), % The final state of the transition ag : (k_threads) % The mediating agent ) : bool = EXISTS ( ist1, ist2 : (K_INTERNAL_STATE), % The internal state components est1, est2 : K_EXTERNAL_STATE, % The externally visible components kreq : K_REQ, % The kernel request being processed client : THREAD, % The client thread op : OP, % The operation; redundant (= provide_access_op) client_av : ACCESS_VECTOR, % The av associated with (client, svc_port) svc_port : PORT, % The port on which the request was received ssid : SID, % The input subject sid osid : SID, % The input object sid new_av : ACCESS_VECTOR, % The input access vector reply_port : PORT, % The port where reply message is enqueued msg : MESSAGE % The reply message enqueued at reply_port ) : ( TRUE % Establish some variables. AND ist1 = int_st(st1) AND ist2 = int_st(st2) AND est1 = ext_st(st1) AND est2 = ext_st(st2) %% Avoid generation of too many type check conditions in PVS AND (FORALL (x1: (existing_tasks(ist1)), y1: (existing_tasks(ist2))): existing_tasks(ist1)(y1) AND existing_tasks(ist2)(x1)) AND (FORALL (x1: (existing_ports(ist1)), y1: (existing_ports(ist2))): existing_ports(ist1)(y1) AND existing_ports(ist2)(x1)) AND (FORALL (x1: (existing_threads(est1)), y1: (existing_threads(est2))): existing_threads(est1)(y1) AND existing_threads(est2)(x1)) % Many components are invariant: AND existing_threads(est2) = existing_threads(est1) AND existing_tasks(ist2) = existing_tasks(ist1) AND task_threads(ist2) = task_threads(ist1) AND existing_ports(ist2) = existing_ports(ist1) AND task_sid(ist2) = task_sid(ist1) AND port_sid(ist2) = port_sid(ist1) AND received_info(est2) = received_info(est1) AND (FORALL (x : (existing_tasks(ist2))) : TRUE AND existing_tasks(ist1)(x) AND task_names(ist2)(x) = task_names(ist1)(x) AND named_port(ist2)(x) = named_port(ist1)(x) AND held_rights(ist2)(x) = held_rights(ist1)(x) AND dead_names(ist2)(x) = dead_names(ist1)(x) ) % In this transformation we process a kernel request... AND NOT pending_requests(est2)(kreq) AND pending_requests(est1) = add(kreq, pending_requests(est2)) % and its a request to provide access vector information... AND provide_access_req?(kreq) % with these particular parameters: AND client = pact(kreq) AND op = paop(kreq) AND client_av = pacav(kreq) AND svc_port = passport(kreq) AND ssid = passi(kreq) AND osid = paosi(kreq) AND new_av = parav(kreq) AND reply_port = parp(kreq) % The client is an existing thread... AND existing_threads(ist1)(client) AND existing_threads(ist2)(client) AND existing_threads(est1)(client) AND existing_threads(est2)(client) % and reply_port is an existing port... AND existing_ports(ist1)(reply_port) % and client_av contains permission to provide access... AND client_av(provide_access_perm) % and the client had been waiting but now is running... AND thread_status(est1)(client) = thread_waiting AND thread_status(est2) = thread_status(est1) WITH [ (client) := thread_running ] % and the request was received on the correct port... AND existing_tasks(ist1)(k_task) AND task_names(ist1)(k_task)(host_name) AND svc_port = named_port(ist1)(k_task)(host_name) % and the cache gets updated. AND cached_access(ist2) = cached_access(ist1) WITH [ ((ssid, osid)) := new_av ] % The kernel enqueues the reply message at reply_port: % The set of existing messages grows... AND NOT existing_messages(ist1)(msg) AND existing_messages(ist2) = add(msg, existing_messages(ist1)) % the msg gets added to reply_port's queue... AND queue(ist2) = (LAMBDA (pt : (existing_ports(ist1))) : IF (pt = reply_port) THEN tack_on(msg, queue(ist1)(reply_port)) ELSE queue(ist1)(pt) ENDIF ) % the sending sid gets recorded... AND sending_sid(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN sending_sid(ist1)(x) ELSE sid_witness ENDIF ) % no access vector is sent... AND av(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN av(ist1)(x) ELSE emptyset[PERMISSION] ENDIF ) % the operation gets recorded... AND op(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN op(ist1)(x) ELSE op_to_reply_op(op) ENDIF ) % the data (indicating success) gets recorded... AND sent_data(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN sent_data(ist1)(x) ELSE success_data ENDIF ) % the reply port is the same as the port where the message is enqueued... AND reply_port(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN reply_port(ist1)(x) ELSE reply_port ENDIF ) % no rights are sent. AND sent_rights(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN sent_rights(ist1)(x) ELSE null_seq ENDIF ) ) END k_provide_access % === ================ $$$k_provide_access.prf (|k_provide_access| (|k_provide_access_TCC1| "" (SKOSIMP*) (("" (GROUND) (("" (TYPEPRED "st1!1") (("" (TYPEPRED "st2!1") (("" (EXPAND "K_STATE") (("" (REPLACE -3 :HIDE? T) (("" (REPLACE -3 :HIDE? T) (("" (REPLACE -3 :HIDE? T) (("" (REPLACE -3 :HIDE? T) (("" (SKOSIMP) (("" (GROUND) NIL))))))))))))))))))))) (|k_provide_access_TCC2| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_provide_access_TCC3| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_provide_access_TCC4| "" (SKOSIMP*) (("" (GROUND) NIL)))) $$$k_kernel_request.pvs k_kernel_request : THEORY BEGIN % ===== % IMPORTS % ======= IMPORTING k_state IMPORTING k_utilities % THE k_kernel_request REQUEST % === ================ ======= % % k_kernel_request describes a transition in which a client sends a message % to a kernel port and generates a new pending request. k_kernel_request( st1 : (K_STATE), % The initial state of the transition st2 : (K_STATE), % The final state of the transition ag : (k_threads) % The mediating agent ) : bool = EXISTS ( ist1, ist2 : (K_INTERNAL_STATE), % The internal state components est1, est2 : K_EXTERNAL_STATE, % The externally visible components kreq : K_REQ, % The kernel request being processed new_req : K_REQ, % The request derived from the message thread : THREAD, % The client thread name : NAME, % Where thread is sending the message op : OP, % The operation being requested by the client reply_name : NAME, % Clients name for reply_port reply_port : PORT, % Where to enqueue the reply message usr_msg : USER_MSG, % The rights and data being sent task : TASK, % Thread's owning task port : PORT, % The port refered to by name sending_av : ACCESS_VECTOR, % The av associated with (task, port) u_rights : USER_RIGHTS, % The sequence of rights being sent k_rights : K_RIGHTS % The kernel version of u_rights ) : ( TRUE % Establish some variables. AND ist1 = int_st(st1) AND ist2 = int_st(st2) AND est1 = ext_st(st1) AND est2 = ext_st(st2) %% Avoid excess TCCs AND (FORALL (x1: (existing_tasks(ist1)), y1: (existing_tasks(ist2))): existing_tasks(ist1)(y1) AND existing_tasks(ist2)(x1)) AND (FORALL (x1: (existing_threads(ist1)), y1: (existing_threads(ist2))): existing_threads(ist1)(y1) AND existing_threads(ist2)(x1)) AND (FORALL (x1: (existing_threads(est1)), y1: (existing_threads(est2))): existing_threads(est1)(y1) AND existing_threads(est2)(x1)) AND (FORALL (x1: (existing_ports(ist1)), y1: (existing_ports(ist2))): existing_ports(ist1)(y1) AND existing_ports(ist2)(x1)) % In this transition we process an old request... AND difference(pending_requests(est1), pending_requests(est2)) = { x : K_REQ | x = kreq } % and its a request to send a message... AND send_message_req?(kreq) % with these particular parameters: AND thread = smth(kreq) AND name = smna(kreq) AND op = smop(kreq) AND reply_name = smrna(kreq) AND usr_msg = smusr_msg(kreq) % The thread exists... AND existing_threads(est1)(thread) AND existing_threads(est2)(thread) AND existing_threads(ist1)(thread) AND existing_threads(est2) = existing_threads(est1) % and had been waiting... AND thread_status(est1)(thread) = thread_waiting % and continues to wait until processing of the request % produces a reply message... AND thread_status(est2) = thread_status(est1) % and thread belongs to an existing task... AND existing_tasks(ist1)(task) AND existing_tasks(ist2)(task) AND task_threads(ist1)(task)(thread) AND existing_tasks(ist2) = existing_tasks(ist1) AND task_threads(ist2) = task_threads(ist1) % and name is in tasks name space... AND task_names(ist1)(task)(name) % and refers to an existing port... AND port = named_port(ist1)(task)(name) AND existing_ports(ist1)(port) AND existing_ports(ist2)(port) AND existing_ports(ist2) = existing_ports(ist1) % and the receiver for port is the kernel. AND existing_tasks(ist1)(k_task) AND (EXISTS (nm : (task_names(ist1)(k_task))) : ( TRUE AND named_port(ist1)(k_task)(nm) = port AND held_rights(ist1)(k_task)(nm)(receive) )) % Nobody changes the SID assignments... AND task_sid(ist2) = task_sid(ist1) AND port_sid(ist2) = port_sid(ist1) % so the sending access vector is AND sending_av = cached_access(ist1)(task_sid(ist1)(task), port_sid(ist1)(port)) AND cached_access(ist2) = cached_access(ist1) % and it contains permission to send. AND sending_av(send_perm) % Moreover, task is using names from his name space and the cache contains % av's for any live rights being sent in the message: % NOTE: The user_rights is only needed in the case of a set_host_special_port % request, but I think the kernel checks the validity of any rights that are % present prior to construction of the actual request, so the following % check is needed in the general case. AND u_rights = user_rights(usr_msg) AND (FORALL (n : nat | n>0 AND n <= size(u_rights)) : TRUE AND task_names(ist1)(task)(proj_1(elem(u_rights)(n))) AND existing_ports(ist1)(named_port(ist1)(task)(proj_1(elem(u_rights)(n)))) IMPLIES LET xname : NAME = proj_1(elem(u_rights)(n)), xport : PORT = named_port(ist1)(task)(xname), psid : SID = port_sid(ist1)(xport), tsid : SID = task_sid(ist1)(task) IN nonempty?(cached_access(ist1)(tsid, psid)) ) % the user rights are converted to kernel rights. AND k_rights = user_to_kernel(ist1, u_rights, task) % Name spaces do not change. AND (FORALL (tk : (existing_tasks(ist2))) : TRUE AND existing_tasks(ist1)(tk) AND task_names(ist2)(tk) = task_names(ist1)(tk) AND named_port(ist2)(tk) = named_port(ist1)(tk) AND held_rights(ist2)(tk) = held_rights(ist1)(tk) AND dead_names(ist2)(tk) = dead_names(ist1)(tk) ) % The parameters for the new kernel request are obtained from the user message % and the other send_message_req parameters: % The operation must be one of the three we are specifying... AND ( FALSE OR op = provide_access_op OR op = set_host_special_port_op OR op = get_host_special_port_op ) % the reply_port is determined from the reply_name AND reply_port = IF task_names(ist1)(task)(reply_name) THEN named_port(ist1)(task)(reply_name) ELSE null_port ENDIF % The other parameters are request specific: % provide_access_req AND ( op = provide_access_op IMPLIES new_req = LET (sid1, sid2, pav) = data_to_sid_sid_av(user_data(usr_msg)) IN provide_access_req(thread, op, sending_av, port, sid1, sid2, pav, reply_port) ) % set_ssp_req AND ( op = set_host_special_port_op IMPLIES ( TRUE AND size(k_rights) = 1 AND proj_2(elem(k_rights)(1)) = send AND new_req = LET npt : PORT = proj_1(elem(k_rights)(1)) IN set_ssp_req(thread, op, sending_av, port, npt, reply_port) ) ) % get_ssp_req AND ( op = get_host_special_port_op IMPLIES new_req = get_ssp_req(thread, op, sending_av, port, reply_port) ) % The new pending_requests set contains new_req as a unique % element not in the old set: AND difference(pending_requests(est2), pending_requests(est1)) = {kr : K_REQ | kr = new_req} % The components of state not mentioned above remain unchanged: AND received_info(est2) = received_info(est1) ) END k_kernel_request % === ================ $$$k_kernel_request.prf (|k_kernel_request| (|k_kernel_request_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_kernel_request_TCC2| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_kernel_request_TCC3| "" (SKOSIMP*) (("" (REPLACE -44) (("" (REPLACE -43) (("" (PROPAX) NIL))))))) (|k_kernel_request_TCC4| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_kernel_request_TCC5| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_kernel_request_TCC6| "" (SKOSIMP*) (("" (GROUND) NIL)))) $$$k_receive_message.pvs k_receive_message : THEORY BEGIN % ===== % IMPORTS % ======= IMPORTING k_state IMPORTING k_utilities % THE k_receive_message REQUEST % === ================= ======= % % k_receive_message describes a transition where a client requests to receive % a message on a non-kernel port. % utility krm_names_and_rights( task : TASK, ist1, ist2 : (K_INTERNAL_STATE), % The internal state components u_rights : USER_RIGHTS, % The sequence of rights being sent k_rights : K_RIGHTS % The kernel version of u_rights ) : bool = (TRUE AND existing_tasks(ist1)(task) AND existing_tasks(ist2)(task) AND size(k_rights) = size(u_rights) % Other name spaces do not change... AND (FORALL (x : (existing_tasks(ist1))) : x = task OR (TRUE AND existing_tasks(ist2)(x) AND task_names(ist2)(x) = task_names(ist1)(x) AND named_port(ist2)(x) = named_port(ist1)(x) AND held_rights(ist2)(x) = held_rights(ist1)(x) AND dead_names(ist2)(x) = dead_names(ist1)(x)) ) % But task's name space does change if rights were sent. % In particular, task_names gains a name for each live port right sent... AND (FORALL (nm : NAME) : task_names(ist2)(task)(nm) IFF ( FALSE OR task_names(ist1)(task)(nm) OR EXISTS (i : nat | i > 0 AND i <= size(k_rights)) : (TRUE AND proj_1(elem(u_rights)(i)) = nm AND existing_ports(ist2)(proj_1(elem(k_rights)(i)))) )) % and dead_names gains a name for each dead port right sent... AND (FORALL (nm : NAME) : dead_names(ist2)(task)(nm) IFF ( FALSE OR dead_names(ist1)(task)(nm) OR EXISTS (i : nat | i > 0 AND i <= size (k_rights)) : (TRUE AND proj_1(elem(u_rights)(i)) = nm AND NOT existing_ports(ist2)(proj_1(elem(k_rights)(i)))) )) % and the name/port correspondence grows... AND (FORALL (nm : (task_names(ist2)(task)), pt : PORT) : named_port(ist2)(task)(nm) = pt IFF ( FALSE OR (task_names(ist1)(task)(nm) AND named_port(ist1)(task)(nm) = pt) OR EXISTS (i : nat | i > 0 AND i <= size(k_rights)) : (TRUE AND proj_1(elem(u_rights)(i)) = nm AND proj_1(elem(k_rights)(i)) = pt) )) % and the held_rights for task grows. AND (FORALL (nm : (task_names(ist2)(task)), rt : RIGHT) : held_rights(ist2)(task)(nm)(rt) IFF ( FALSE OR (task_names(ist1)(task)(nm) AND held_rights(ist1)(task)(nm)(rt)) OR EXISTS (i : nat | i > 0 AND i <= size(u_rights)) : (TRUE AND proj_1(elem(u_rights)(i)) = nm AND proj_2(elem(u_rights)(i)) = rt) )) ) k_receive_message( st1 : (K_STATE), % The initial state of the transition st2 : (K_STATE), % The final state of the transition ag : (k_threads) % The mediating agent ) : bool = EXISTS ( ist1, ist2 : (K_INTERNAL_STATE), % The internal state components est1, est2 : K_EXTERNAL_STATE, % The externally visible components kreq : K_REQ, % The kernel request being processed thread : THREAD, % The client thread name : NAME, % Where thread is receiving the message task : TASK, % Thread's owning task port : PORT, % The port refered to by name receiving_av: ACCESS_VECTOR, % The av associated with (task, port) u_rights : USER_RIGHTS, % The sequence of rights being sent k_rights : K_RIGHTS, % The kernel version of u_rights new_info : RECEIVED_INFO, % The message content being received msg : MESSAGE % The internal representation of the message ) : ( TRUE % Establish some variables. AND ist1 = int_st(st1) AND ist2 = int_st(st2) AND est1 = ext_st(st1) AND est2 = ext_st(st2) %% Avoid generation of too many type check conditions in PVS AND (FORALL (x1: (existing_tasks(ist1)), y1: (existing_tasks(ist2))): existing_tasks(ist1)(y1) AND existing_tasks(ist2)(x1)) AND (FORALL (x1: (existing_threads(ist1)), y1: (existing_threads(ist2))): existing_threads(ist1)(y1) AND existing_threads(ist2)(x1)) AND (FORALL (x1: (existing_ports(ist1)), y1: (existing_ports(ist2))): existing_ports(ist1)(y1) AND existing_ports(ist2)(x1)) % In this transformation we process an old kernel request without % generating a new request... AND NOT pending_requests(est2)(kreq) AND pending_requests(est1) = add(kreq, pending_requests(est2)) % and its a request to receive a message... AND receive_message_req?(kreq) % with these particular parameters: AND thread = rmth(kreq) AND name = rmna(kreq) % The thread exists... AND existing_threads(est1)(thread) AND existing_threads(est2)(thread) AND existing_threads(ist1)(thread) AND existing_threads(est2) = existing_threads(est1) % and had been waiting but now is running... AND thread_status(est1)(thread) = thread_waiting AND thread_status(est2) = thread_status(est1) WITH [ (thread) := thread_running ] % and thread belongs to an existing task... AND existing_tasks(ist1)(task) AND existing_tasks(ist2)(task) AND task_threads(ist1)(task)(thread) AND existing_tasks(ist2) = existing_tasks(ist1) AND task_threads(ist2) = task_threads(ist1) % and name is in task's name space... AND task_names(ist1)(task)(name) % and refers to an existing port... AND port = named_port(ist1)(task)(name) AND existing_ports(ist1)(port) AND existing_ports(ist2)(port) AND existing_ports(ist2) = existing_ports(ist1) % and the kernel is not the receiver for port. AND existing_tasks(ist1)(k_task) AND NOT (EXISTS (nm : (task_names(ist1)(k_task))) : ( TRUE AND named_port(ist1)(k_task)(nm) = port AND held_rights(ist1)(k_task)(nm)(receive) )) % Nobody changes the SID assignments... AND task_sid(ist2) = task_sid(ist1) AND port_sid(ist2) = port_sid(ist1) % so the receiving access vector is AND receiving_av = cached_access(ist1)(task_sid(ist1)(task), port_sid(ist1)(port)) AND cached_access(ist2) = cached_access(ist1) % and it contains permission to receive. AND receiving_av(receive_perm) % Thread has an ri_status of ri_processed AND ri_status(received_info(est1)(thread)) = ri_processed % There is a message on port's queue... AND 1 <= size(queue(ist1)(port)) % which the kernel records... AND msg = elem(queue(ist1)(port))(1) % it exists... AND existing_messages(ist1)(msg) % so the kernel uses it to construct task's new received_info... AND k_rights = sent_rights(ist1)(msg) AND u_rights = kernel_to_user(ist1, task, k_rights) AND size(k_rights) = size(u_rights) AND new_info = (# service_port := name, sending_sid := sending_sid(ist1)(msg), sending_av := av(ist1)(msg), user_msg := (# user_data := sent_data(ist1)(msg), user_rights := u_rights #), op := op(ist1)(msg), reply_name := LET reply_set : setof[nat] = {i : nat | (i > 0 AND i <= size(k_rights)) AND proj_1(elem(k_rights)(i)) = reply_port(ist1)(msg)} IN IF nonempty?(reply_set) THEN proj_1(elem(u_rights)(choose(reply_set))) ELSE null_name ENDIF, ri_status := ri_unprocessed #) AND received_info(est2) = received_info(est1) WITH [ (thread) := new_info ] % and then deletes it from port's queue... AND nonemptyfseq(queue(ist1)(port)) AND queue(ist2)(port) = pop(queue(ist1)(port)) % leaving all other queues unchanged. AND (FORALL (x : (existing_ports(ist1))) : port = x OR (existing_ports(ist2)(x) AND queue(ist2)(x) = queue(ist1)(x))) % The msg dies... AND existing_messages(ist2) = remove(msg, existing_messages(ist1)) % so the kernel updates the message functions: AND (FORALL (x : (existing_messages(ist2))) : TRUE AND existing_messages(ist1)(x) AND sending_sid(ist2)(x) = sending_sid(ist1)(x) AND av(ist2)(x) = av(ist1)(x) AND op(ist2)(x) = op(ist1)(x) AND sent_data(ist2)(x) = sent_data(ist1)(x) AND sent_rights(ist2)(x) = sent_rights(ist1)(x) AND reply_port(ist2)(x) = reply_port(ist1)(x) ) AND krm_names_and_rights(task,ist1,ist2,u_rights,k_rights) ) END k_receive_message % === ================= $$$k_receive_message.prf (|k_receive_message| (|krm_names_and_rights_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL))) (|krm_names_and_rights_TCC2| "" (SKOSIMP*) (("" (GROUND) NIL))) (|krm_names_and_rights_TCC3| "" (SKOSIMP*) (("" (GROUND) NIL))) (|krm_names_and_rights_TCC4| "" (SKOSIMP*) (("" (GROUND) NIL))) (|krm_names_and_rights_TCC5| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_receive_message_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_receive_message_TCC2| "" (SKOSIMP*) (("" (GROUND) NIL))) (|k_receive_message_TCC3| "" (SKOSIMP*) (("" (CASE "FORALL (n: (reply_set!1)): n >0 AND n <= size(u_rights!1)") (("1" (HIDE 1 2) (("1" (EXPAND "choose") (("1" (GROUND) (("1" (USE "epsilon_ax[nat]") (("1" (GROUND) (("1" (INST? -) (("1" (GROUND) NIL))) ("2" (REWRITE "nonempty_member") (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))) ("2" (USE "epsilon_ax[nat]") (("2" (GROUND) (("1" (INST? -) (("1" (GROUND) NIL))) ("2" (REWRITE "nonempty_member") (("2" (EXPAND "member") (("2" (PROPAX) NIL))))))))))))))) ("2" (SKOSIMP) (("2" (TYPEPRED "n!1") (("2" (REPLACE -42) (("2" (HIDE 2 3 4 -42) (("2" (GROUND) (("2" (REPLACE -41) (("2" (GROUND) NIL)))))))))))))))))) $$$k_utilities.pvs k_utilities : THEORY BEGIN % ===== % IMPORTS % ======= IMPORTING k_state % UTILITIES % ========= % name_to_port converts task's name into a port reference. If the reference is not % given by a valid name in task's name space or if the port does not exist the % return is null_port. name_to_port( st : (K_INTERNAL_STATE), name : NAME, right : RIGHT, task : (existing_tasks(st)) ) : PORT = IF (task_names(st)(task)(name) AND existing_ports(st)(named_port(st)(task)(name))) THEN LET port : PORT = named_port(st)(task)(name), av : ACCESS_VECTOR = cached_access(st)(task_sid(st)(task), port_sid(st)(port)), hr : setof[RIGHT] = held_rights(st)(task)(name) IN IF FALSE OR (right = receive AND hr(right) AND av(xfer_receive_perm)) OR (right = send AND av(xfer_send_perm)) THEN port ELSE null_port ENDIF ELSE null_port ENDIF % user_to_kernel models the kernel processing which converts a user right % sequence into a kernel right sequence. At the point where this is called % we have already checked that the sender holds at least one right for % each name in the sequence. user_to_kernel( st : (K_INTERNAL_STATE), % The initial internal state u_rt_seq : USER_RIGHTS, % The user right sequence to be converted task : (existing_tasks(st)) % The owning task of the sending thread ) : K_RIGHTS = (# size := size(u_rt_seq), elem := (LAMBDA (x : nat | x > 0 AND x <= size(u_rt_seq)) : ( name_to_port(st, proj_1(elem(u_rt_seq)(x)), proj_2(elem(u_rt_seq)(x)), task), proj_2(elem(u_rt_seq)(x)) ) ) #) % kernel_to_user is an unspecified function that models the kernel's % conversion of kernel rights (internal port references) to user % rights (local name references). The conditions imposed on this % conversion (i.e., uniqueness of names in a namespace) are given % as an axiom following the declaration. kernel_to_user( ist : (K_INTERNAL_STATE), task : (existing_tasks(ist)), k_rights : K_RIGHTS ) : USER_RIGHTS kernel_to_user_axiom : AXIOM FORALL ( ist : (K_INTERNAL_STATE), task : (existing_tasks(ist)), u_rts : USER_RIGHTS, k_rts : K_RIGHTS | u_rts = kernel_to_user(ist, task, k_rts)) : ( TRUE AND size(k_rts) = size(u_rts) AND (FORALL (i1 : posnat, i2 : posnat | i1 <= size(k_rts) AND i2 <= size(k_rts)) : proj_1(elem(k_rts)(i1)) = proj_1(elem(k_rts)(i2)) IFF proj_1(elem(u_rts)(i1)) = proj_1(elem(u_rts)(i2)) ) AND (FORALL (i : posnat | i <= size(k_rts)) : LET pt : PORT = proj_1(elem(k_rts)(i)), nm : NAME = proj_1(elem(u_rts)(i)), ps : setof[PORT] = {p : PORT | EXISTS (x : (task_names(ist)(task))) : p = named_port(ist)(task)(x) } IN TRUE AND NOT dead_names(ist)(task)(nm) AND ps(pt) IMPLIES (task_names(ist)(task)(nm) AND pt = named_port(ist)(task)(nm)) AND task_names(ist)(task)(nm) IMPLIES (ps(pt) AND existing_ports(ist)(pt)) ) ) % This unspecified function models the (black box) conversion of user % specified data into certain request parameters. data_to_sid_sid_av : [DATA -> [SID, SID, ACCESS_VECTOR]] % This models the conversion of a sid pair to message data (used when the kernel sends % a message to the security server requesting an access vector.) sid_sid_to_data : [SID, SID -> DATA] % This unspecified function models the conversion of an op id into the corresponding % id for the reply message. op_to_reply_op : [OP -> OP] END k_utilities % === =========== $$$k_utilities.prf (|k_utilities| (|name_to_port_TCC1| "" (SKOSIMP*) NIL) (|name_to_port_TCC2| "" (SKOSIMP*) (("" (GROUND) NIL))) (|kernel_to_user_axiom_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL))) (|kernel_to_user_axiom_TCC2| "" (SKOSIMP*) (("" (GROUND) NIL))) (|kernel_to_user_axiom_TCC3| "" (SKOSIMP*) (("" (GROUND) NIL))) (|kernel_to_user_axiom_TCC4| "" (SKOSIMP*) (("" (GROUND) NIL))) (|kernel_to_user_axiom_TCC5| "" (SKOSIMP*) (("" (GROUND) NIL))) (|kernel_to_user_axiom_TCC6| "" (SKOSIMP*) (("" (GROUND) NIL)))) $$$k_send_message.pvs k_send_message : THEORY BEGIN % ===== % IMPORTS % ======= IMPORTING k_state IMPORTING k_utilities ksm_interp_request( est1, est2 : K_EXTERNAL_STATE, % The externally visible components kreq : K_REQ, % The kernel request being processed thread : THREAD, % The client thread name : NAME, % Where thread is sending the message reply_name : NAME, % Where to send reply message op : OP, % NA (applies to k_kernel_request) usr_msg : USER_MSG % The rights and data being sent ): bool = % In this transition we process an old request without generating % a new request... NOT pending_requests(est2)(kreq) AND pending_requests(est1) = add(kreq, pending_requests(est2)) % and its a request to send a message... AND send_message_req?(kreq) % with these particular parameters: AND thread = smth(kreq) AND name = smna(kreq) AND op = smop(kreq) AND reply_name = smrna(kreq) AND usr_msg = smusr_msg(kreq) ksm_task_thread( ist1, ist2 : (K_INTERNAL_STATE), % The internal state components est1, est2 : K_EXTERNAL_STATE, % The externally visible components thread : THREAD, % The client thread task : TASK, % Thread's owning task name : NAME, % Where thread is sending the message port : PORT % The port refered to by name ): bool = TRUE %% Avoid generation of too many type check conditions in PVS AND (FORALL (x1: (existing_tasks(ist1)), y1: (existing_tasks(ist2))): existing_tasks(ist1)(y1) AND existing_tasks(ist2)(x1)) AND (FORALL (x1: (existing_threads(ist1)), y1: (existing_threads(ist2))): existing_threads(ist1)(y1) AND existing_threads(ist2)(x1)) AND (FORALL (x1: (existing_threads(est1)), y1: (existing_threads(est2))): existing_threads(est1)(y1) AND existing_threads(est2)(x1)) AND existing_tasks(ist1)(k_task) AND existing_tasks(ist1)(task) AND existing_tasks(ist2)(task) % The thread exists... AND existing_threads(est1)(thread) AND existing_threads(est2)(thread) AND existing_threads(ist1)(thread) AND existing_threads(ist2)(thread) AND existing_threads(est2) = existing_threads(est1) % and had been waiting but now is running... AND thread_status(est1)(thread) = thread_waiting AND thread_status(est2) = thread_status(est1) WITH [ (thread) := thread_running ] % and thread belongs to an existing task... AND task_threads(ist1)(task)(thread) AND task_threads(ist2)(task)(thread) AND existing_tasks(ist2) = existing_tasks(ist1) AND task_threads(ist2) = task_threads(ist1) % and name is in tasks name space... AND task_names(ist1)(task)(name) % and refers to an existing port... AND port = named_port(ist1)(task)(name) AND existing_ports(ist1)(port) AND existing_ports(ist2)(port) AND existing_ports(ist2) = existing_ports(ist1) % and the receiver for port is not the kernel. AND NOT (EXISTS (nm : (task_names(ist1)(k_task))) : TRUE AND named_port(ist1)(k_task)(nm) = port AND held_rights(ist1)(k_task)(nm)(receive) ) ksm_sids( ist1, ist2 : (K_INTERNAL_STATE), % The internal state components task : TASK, % Thread's owning task port : PORT, % The port refered to by name sending_av : ACCESS_VECTOR % The av associated with (task, port) ): bool = TRUE %% Avoid generation of too many type check conditions in PVS AND (FORALL (x1: (existing_tasks(ist1)), y1: (existing_tasks(ist2))): existing_tasks(ist1)(y1) AND existing_tasks(ist2)(x1)) AND (FORALL (x1: (existing_ports(ist1)), y1: (existing_ports(ist2))): existing_ports(ist1)(y1) AND existing_ports(ist2)(x1)) AND existing_tasks(ist1)(task) AND existing_ports(ist1)(port) % Nobody changes the SID assignments... AND task_sid(ist2) = task_sid(ist1) AND port_sid(ist2) = port_sid(ist1) % so the sending access vector is AND sending_av = cached_access(ist1)(task_sid(ist1)(task), port_sid(ist1)(port)) AND cached_access(ist2) = cached_access(ist1) % and it contains permission to send. AND sending_av(send_perm) ksm_name_spaces( ist1, ist2 : (K_INTERNAL_STATE), % The internal state components usr_msg : USER_MSG, % The rights and data being sent task : TASK, % Thread's owning task rt_seq : USER_RIGHTS, % The sequence of rights being sent xfer_receive_names : setof[NAME], % Receive rights being sent no_send_names : setof[NAME] % Rights that task looses ): bool = TRUE %% Avoid generation of too many type check conditions in PVS AND (FORALL (x1: (existing_tasks(ist1)), y1: (existing_tasks(ist2))): existing_tasks(ist1)(y1) AND existing_tasks(ist2)(x1)) AND existing_tasks(ist1)(task) AND existing_tasks(ist2)(task) AND (FORALL (nm: (task_names(ist2)(task))): task_names(ist1)(task)(nm)) % Task is using names from his name space and the cache contains % av's for any live rights being sent in the message: AND rt_seq = user_rights(usr_msg) AND (FORALL (n : nat | n > 0 AND n <= size(rt_seq)) : TRUE AND task_names(ist1)(task)(proj_1(elem(rt_seq)(n))) AND existing_ports(ist1)(named_port(ist1)(task)(proj_1(elem(rt_seq)(n)))) IMPLIES LET xname : NAME = proj_1(elem(rt_seq)(n)), xport : PORT = named_port(ist1)(task)(xname), psid : SID = port_sid(ist1)(xport), tsid : SID = task_sid(ist1)(task) IN nonempty?(cached_access(ist1)(tsid, psid)) ) % Name spaces have been updated. % In particular, name spaces other than task's are unchanged... AND (FORALL (x : (existing_tasks(ist2))) : (x = task OR (TRUE AND existing_tasks(ist1)(x) AND (FORALL (x1: (task_names(ist1)(x)), y1: (task_names(ist2)(x))): task_names(ist1)(x)(y1) AND task_names(ist2)(x)(x1)) AND named_port(ist2)(x) = named_port(ist1)(x) AND held_rights(ist2)(x) = held_rights(ist1)(x)) )) % nobody's dead name set changes... AND dead_names(ist2) = dead_names(ist1) % some of task's names have their receive rights removed... AND xfer_receive_names = { nm : (task_names(ist1)(task)) | EXISTS (i : nat | i > 0 AND i <= size(rt_seq)) : elem(rt_seq)(i) = ( nm, receive ) } % some names are removed from task's name space... AND no_send_names = { nm : NAME | xfer_receive_names(nm) AND NOT held_rights(ist1)(task)(nm)(send) } AND task_names(ist2)(task) = difference(task_names(ist1)(task), no_send_names) % (remove the receive rights)... AND (FORALL (nm : (task_names(ist2)(task))) : task_names(ist1)(task)(nm) AND held_rights(ist2)(task)(nm) = remove(receive, held_rights(ist1)(task)(nm))) AND named_port(ist2)(task) = (LAMBDA (nm : (task_names(ist2)(task))) : named_port(ist1)(task)(nm)) AND held_rights(ist2)(task) = (LAMBDA (nm : (task_names(ist2)(task))) : held_rights(ist1)(task)(nm)) ksm_message( ist1, ist2 : (K_INTERNAL_STATE), % The internal state components reply_name : NAME, % Where to send reply message op : OP, % NA (applies to k_kernel_request) usr_msg : USER_MSG, % The rights and data being sent task : TASK, % Thread's owning task port : PORT, % The port refered to by name sending_av : ACCESS_VECTOR, % The av associated with (task, port) rt_seq : USER_RIGHTS, % The sequence of rights being sent msg : MESSAGE % The internal representation of the message ): bool = TRUE %% Avoid generation of too many type check conditions in PVS AND existing_tasks(ist1)(task) AND existing_messages(ist2)(msg) AND existing_ports(ist1)(port) AND existing_ports(ist2)(port) % The kernel enqueues a new message. % The set of existing messages grows... AND NOT existing_messages(ist1)(msg) AND existing_messages(ist2) = add(msg, existing_messages(ist1)) % the msg gets added to port's queue... AND queue(ist2) = queue(ist1) WITH [port := tack_on(msg, queue(ist1)(port))] % the sending sid gets recorded... AND sending_sid(ist2) = sending_sid(ist1) WITH [msg := task_sid(ist1)(task)] % the access vector gets recorded... AND av(ist2) = av(ist1) WITH [msg := sending_av] % the operation gets recorded... AND op(ist2) = op(ist1) WITH [msg := op] % the data gets recorded... AND sent_data(ist2) = sent_data(ist1) WITH [msg := user_data(usr_msg)] % the reply port is determined from the reply name specified... AND reply_port(ist2) = (LAMBDA (x : (existing_messages(ist2))) : IF existing_messages(ist1)(x) THEN reply_port(ist1)(x) ELSIF task_names(ist1)(task)(reply_name) THEN named_port(ist1)(task)(reply_name) ELSE null_port ENDIF ) % the user rights are converted to kernel rights and recorded. AND sent_rights(ist2) = sent_rights(ist1) WITH [msg := user_to_kernel(ist1, rt_seq, task)] % THE k_send_message REQUEST % === ============== ======= % % k_send_message describes a transition in which a client has requested % to send a message to a port for which the kernel is not the receiver. k_send_message( st1 : (K_STATE), % The initial state of the transition st2 : (K_STATE), % The final state of the transition ag : (k_threads) % The mediating agent ) : bool = EXISTS ( ist1, ist2 : (K_INTERNAL_STATE), % The internal state components est1, est2 : K_EXTERNAL_STATE, % The externally visible components kreq : K_REQ, % The kernel request being processed thread : THREAD, % The client thread name : NAME, % Where thread is sending the message reply_name : NAME, % Where to send reply message op : OP, % NA (applies to k_kernel_request) usr_msg : USER_MSG, % The rights and data being sent task : TASK, % Thread's owning task port : PORT, % The port refered to by name sending_av : ACCESS_VECTOR, % The av associated with (task, port) rt_seq : USER_RIGHTS, % The sequence of rights being sent xfer_receive_names : setof[NAME], % Receive rights being sent no_send_names : setof[NAME], % Rights that task looses msg : MESSAGE % The internal representation of the message ) : ( TRUE % Establish the state variables. AND ist1 = int_st(st1) AND ist2 = int_st(st2) AND est1 = ext_st(st1) AND est2 = ext_st(st2) %% Avoid generation of too many type check conditions in PVS AND (FORALL (x1: (existing_threads(est1)), y1: (existing_threads(est2))): existing_threads(est1)(y1) AND existing_threads(est2)(x1)) AND ksm_interp_request(est1, est2, kreq, thread, name, reply_name, op, usr_msg) AND ksm_task_thread(ist1, ist2, est1, est2, thread, task, name, port) AND ksm_sids(ist1, ist2, task, port, sending_av) AND ksm_name_spaces(ist1, ist2, usr_msg, task, rt_seq, xfer_receive_names, no_send_names) AND ksm_message(ist1, ist2, reply_name, op, usr_msg, task, port, sending_av, rt_seq, msg) % The components of state not mentioned above remain unchanged: AND received_info(est2) = received_info(est1) ) END k_send_message % === ============== $$$k_send_message.prf (|k_send_message| (|ksm_task_thread_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL))) (|ksm_name_spaces_TCC1| "" (SKOSIMP*) (("" (GROUND) NIL))) (|ksm_name_spaces_TCC2| "" (SKOSIMP*) (("" (GROUND) NIL))) (|ksm_name_spaces_TCC3| "" (SKOSIMP*) (("" (GROUND) (("" (EXPAND "extend") (("" (REPLACE -9) (("" (HIDE -9) (("" (GROUND) NIL))))))))))) (|ksm_name_spaces_TCC4| "" (SKOSIMP*) NIL)) $$$k_ops.pvs k_ops : THEORY BEGIN % ===== % IMPORTS % ======= IMPORTING k_send_message IMPORTING k_receive_message IMPORTING k_kernel_request IMPORTING k_provide_access IMPORTING k_request_access IMPORTING k_set_ss_port IMPORTING k_get_ss_port % VARIABLES % ========= st1, st2 : VAR (K_STATE) thread : VAR THREAD th: VAR (k_threads) % THE OPERATIONS % === ========== k_op(st1, st2, th) : bool = FALSE OR k_send_message(st1, st2, th) OR k_receive_message(st1, st2, th) OR k_kernel_request(st1, st2, th) OR k_provide_access(st1, st2, th) OR k_request_access(st1, st2, th) OR k_set_ss_port(st1, st2, th) OR k_get_ss_port(st1, st2, th) k_guar(st1,st2,thread) : bool = k_threads(thread) AND (k_view(st1, st2) OR k_op(st1, st2,thread)) END k_ops % === ===== $$$finite_sequence.pvs finite_sequence[X : NONEMPTY_TYPE] : THEORY BEGIN n : VAR nat FSEQ : TYPE = [# size : nat, elem : [(LAMBDA n: n > 0 and n <= size)->X] #] null_seq : FSEQ null_seq_def : AXIOM size(null_seq) = 0 nonemptyfseq(seq : FSEQ) : bool = (size(seq) > 0) nseq : VAR (nonemptyfseq) x: VAR nat pop(nseq) : FSEQ = (# size := size(nseq) - 1, elem := (LAMBDA (x: posnat | x <= size(nseq) - 1) : (elem(nseq))(x+1)) #) tack_on(e : X, s: FSEQ) : FSEQ = (# size := size(s) + 1, elem := (LAMBDA (n: posnat | n <= size(s) + 1) : IF n <= size(s) THEN elem(s)(n) ELSE e ENDIF) #) END finite_sequence $$$finite_sequence.prf (|finite_sequence| (|pop_TCC1| "" (SUBTYPE-TCC) NIL) (|pop_TCC2| "" (SUBTYPE-TCC) NIL) (|pop_TCC3| "" (SUBTYPE-TCC) NIL) (|pop_TCC4| "" (SUBTYPE-TCC) NIL) (|tack_on_TCC1| "" (SUBTYPE-TCC) NIL) (|tack_on_TCC2| "" (SUBTYPE-TCC) NIL) (|tack_on_TCC3| "" (SUBTYPE-TCC) NIL)) $$$dtos_kernel_shared_state.pvs dtos_kernel_shared_state: THEORY BEGIN SID: NONEMPTY_TYPE sid_witness : SID PERMISSION: NONEMPTY_TYPE create_task_perm, create_task_secure_perm: PERMISSION xfer_send_perm, xfer_receive_perm, send_perm, receive_perm : PERMISSION provide_access_perm, set_ss_perm, get_ss_perm : PERMISSION ACCESS_VECTOR: TYPE = setof[PERMISSION] DATA: NONEMPTY_TYPE success_data : DATA null_data : DATA TIME: NONEMPTY_TYPE NAME: NONEMPTY_TYPE null_name : NAME IMPORTING finite_sequence[NAME] NAME_SEQ : TYPE = FSEQ[NAME] RIGHT : TYPE = {send, receive} USER_RIGHT : TYPE = [NAME, RIGHT] IMPORTING finite_sequence[USER_RIGHT] USER_RIGHTS: TYPE = FSEQ[USER_RIGHT] name_to_send_right : [NAME -> USER_RIGHT] name_to_send_right_seq: [NAME -> USER_RIGHTS] USER_MSG: TYPE = [# user_data: DATA, user_rights: USER_RIGHTS #] null_user_msg: USER_MSG = (# user_data := null_data, user_rights := null_seq #) OP: NONEMPTY_TYPE op_witness : OP provide_access_op, set_host_special_port_op, get_host_special_port_op : OP request_access_op : OP RI_STATUS: TYPE = {ri_unprocessed, ri_processed} RECEIVED_INFO: TYPE = [# service_port: NAME, sending_sid: SID, sending_av: ACCESS_VECTOR, user_msg: USER_MSG, op: OP, reply_name: NAME, ri_status: RI_STATUS #] ri_witness : RECEIVED_INFO = (# service_port := null_name, sending_sid := sid_witness, sending_av := emptyset[PERMISSION], user_msg := null_user_msg, op := op_witness, reply_name := null_name, ri_status := ri_processed #) THREAD_STATUS: TYPE = {thread_waiting, thread_running} THREAD: NONEMPTY_TYPE th: VAR THREAD rna, na: VAR NAME op: VAR OP usr_msg: VAR USER_MSG PORT: NONEMPTY_TYPE HOST_SPECIAL_PORT: TYPE KERNEL_REQ: DATATYPE BEGIN send_message_req(smth : THREAD, smna : NAME, smop : OP, smrna : NAME, smusr_msg : USER_MSG) : send_message_req? receive_message_req(rmth : THREAD, rmna : NAME) : receive_message_req? provide_access_req(pact: THREAD, paop : OP, pacav : ACCESS_VECTOR, passport : PORT, passi : SID, paosi : SID, parav : ACCESS_VECTOR, parp : PORT) : provide_access_req? set_ssp_req(ssct : THREAD, ssop : OP, ssav : ACCESS_VECTOR, sssp : PORT, ssnp : PORT, ssrp : PORT) : set_ssp_req? get_ssp_req(gsct : THREAD, gsop : OP, gsav : ACCESS_VECTOR, gssp : PORT, gsrp : PORT) : get_ssp_req? END KERNEL_REQ KERNEL_SHARED_STATE: TYPE = [# pending_requests: setof[KERNEL_REQ], existing_threads: setof[THREAD], received_info: [(existing_threads) -> RECEIVED_INFO], thread_status: [(existing_threads) -> THREAD_STATUS] #] empty_kst: KERNEL_SHARED_STATE = (# existing_threads := emptyset[THREAD], pending_requests := emptyset[KERNEL_REQ], received_info := (LAMBDA (x: (emptyset[THREAD])): ri_witness), thread_status := (LAMBDA (x: (emptyset[THREAD])): thread_running) #) k_threads: (nonempty?[THREAD]) END dtos_kernel_shared_state $$$dtos_kernel_shared_state.prf (|dtos_kernel_shared_state| (|KERNEL_REQ_induction_TCC1| "" (SKOSIMP*) (("" (REPLACE -1 :HIDE? T) (("" (REPLACE -1 :HIDE? T) (("" (GROUND) (("1" (TYPEPRED "y1!1") (("1" (TYPEPRED "size(user_rights(send_message_req5_var!1))") (("1" (TYPEPRED "size!1") (("1" (POSTPONE) NIL))))))) ("2" (POSTPONE) NIL))))))))) (|k_threads_TCC1| "" (INST + "fullset[THREAD]") (("" (REWRITE "nonempty_exists") (("" (INST + "epsilon! (x : THREAD): TRUE") (("" (EXPAND "fullset") (("" (PROPAX) NIL)))))))))) $$$k_state.pvs k_state : THEORY BEGIN % ===== IMPORTING dtos_kernel_shared_state % PRIMITIVE ENTITIES % ========= ======== TASK : TYPE+ k_task : TASK k_port : PORT null_port : PORT k_port_non_null_axiom : AXIOM NOT k_port = null_port MESSAGE : TYPE+ % OTHER ENTITIES % ===== ======== host_name : NAME ss_name : NAME names_distinct_axiom : AXIOM ( TRUE AND NOT host_name = ss_name AND NOT host_name = null_name AND NOT null_name = ss_name ) K_RIGHT : TYPE = [PORT, RIGHT] IMPORTING finite_sequence[K_RIGHT] K_RIGHTS : TYPE = FSEQ[K_RIGHT] null_rights : K_RIGHTS = null_seq IMPORTING finite_sequence[MESSAGE] MESSAGES : TYPE = FSEQ[MESSAGE] % COMPOSITE ENTITIES % ========= ======== K_REQ : TYPE = KERNEL_REQ % THE EXTERNAL (SHARED) STATE % === ======== ======== ===== % % Can be seen by other components. K_EXTERNAL_STATE : TYPE = KERNEL_SHARED_STATE % THE INTERNAL STATE % === ======== ===== % % Cannot be changed by other components (note: this overlaps the shared % state in existing_threads. The overlapping elements are constrained to % be the same in K_STATE below). K_INTERNAL_STATE_BASE : TYPE = [# existing_tasks : setof[TASK], existing_threads : setof[THREAD], existing_ports : setof[PORT], existing_messages : setof[MESSAGE], task_threads : [(existing_tasks) -> setof[(existing_threads)]], task_names : [(existing_tasks) -> setof[NAME]], dead_names : [(existing_tasks) -> setof[NAME]], named_port : [tk : (existing_tasks) -> [(task_names(tk)) -> PORT]], held_rights : [tk : (existing_tasks) -> [(task_names(tk)) -> setof[RIGHT]]], task_sid : [(existing_tasks) -> SID], port_sid : [(existing_ports) -> SID], cached_access : [SID, SID -> ACCESS_VECTOR], queue : [(existing_ports) -> MESSAGES], sending_sid : [(existing_messages) -> SID], av : [(existing_messages) -> ACCESS_VECTOR], op : [(existing_messages) -> OP], sent_data : [(existing_messages) -> DATA], sent_rights : [(existing_messages) -> K_RIGHTS], reply_port : [(existing_messages) -> PORT] #] K_INTERNAL_STATE(base : K_INTERNAL_STATE_BASE) : bool = ( TRUE AND existing_tasks(base)(k_task) AND task_names(base)(k_task)(host_name) AND existing_ports(base)(named_port(base)(k_task)(host_name)) AND held_rights(base)(k_task)(host_name)(receive) AND task_names(base)(k_task)(ss_name) AND existing_ports(base)(named_port(base)(k_task)(ss_name)) AND held_rights(base)(k_task)(ss_name)(send) AND k_threads = task_threads(base)(k_task) AND (FORALL (th : (existing_threads(base))) : EXISTS (tk : (existing_tasks(base))) : task_threads(base)(tk)(th)) AND NOT existing_ports(base)(null_port) AND (FORALL (tk : (existing_tasks(base))) : NOT task_names(base)(tk)(null_name)) AND (FORALL (tk : (existing_tasks(base))) : disjoint?(task_names(base)(tk), dead_names(base)(tk))) AND (FORALL (tk : (existing_tasks(base)), nm : (task_names(base)(tk))) : existing_ports(base)(named_port(base)(tk)(nm)) AND nonempty?(held_rights(base)(tk)(nm))) AND (FORALL (msg : (existing_messages(base))) : EXISTS (p : (existing_ports(base))), (n : nat | n > 0 AND n <= size(queue(base)(p))) : elem(queue(base)(p))(n) = msg) ) % THE KERNEL STATE % === ====== ===== K_STATE_BASE : TYPE = [# int_st : (K_INTERNAL_STATE), ext_st : K_EXTERNAL_STATE #] K_STATE(base : K_STATE_BASE) : bool = existing_threads(int_st(base)) = existing_threads(ext_st(base)) st1, st2: VAR (K_STATE) k_view(st1, st2) : bool = st1 = st2 END k_state % === ======= $$$k_spec.pvs k_spec : THEORY BEGIN % ===== % IMPORTS % ======= IMPORTING k_state IMPORTING k_ops IMPORTING k_rely IMPORTING k_state_witness IMPORTING component_aux[(K_STATE), THREAD] % VARIABLES % ========= st, st1, st2 : VAR (K_STATE) ag : VAR THREAD % COMPONENT DEFINITIONS % ========= =========== % 1. init---Initial conditions (must be non-empty, so we need a witness): initial_k_states(st) : bool = FORALL (p : PORT | existing_ports(int_st(st))(p)) : queue(int_st(st))(p)=null_seq[MESSAGE] AND empty?(pending_requests(ext_st(st))) % NOTE: Ought to be more conditions here. E.g., AVC should contain % permissions for the kernel to the security server and vice versa, % and no other permissions; need to specify that tasks for the other % components exist. Then need to update the initial state witness. k_state_witness_initial : THEOREM initial_k_states(k_state_witness) % THE KERNEL COMPONENT % === ====== ========= base_k_comp : base_comp_t = (# init := initial_k_states, guar := k_guar, rely := k_rely, hidd := k_hidd, cags := k_threads, view := k_view, wfar := emptyset[TRANSITION_CLASS[(K_STATE), THREAD]], sfar := emptyset[TRANSITION_CLASS[(K_STATE), THREAD]] #) k_view_eq: THEOREM view_eq(base_k_comp) k_comp_init: THEOREM init_restriction(base_k_comp) k_comp_guar: THEOREM guar_restriction(base_k_comp) k_comp_rely_hidd: THEOREM rely_hidd_restriction(base_k_comp) k_comp_hidd: THEOREM hidd_restriction(base_k_comp) k_comp_rely: THEOREM rely_restriction(base_k_comp) k_comp_cags: THEOREM cags_restriction(base_k_comp) k_comp_guar_stuttering: THEOREM guar_stuttering_restriction(base_k_comp) k_comp_rely_stuttering: THEOREM rely_stuttering_restriction(base_k_comp) k_comp : (comp_t) = base_k_comp END k_spec % === ====== $$$k_spec.prf (|k_spec| (IMPORTING5_TCC1 "" (INST + "k_state_witness") NIL) (|initial_k_states_TCC1| "" (SKOSIMP) (("" (TYPEPRED "p!1") (("" (PROPAX) NIL))))) (|k_state_witness_initial| "" (EXPAND "initial_k_states") (("" (EXPAND "k_state_witness") (("" (SKOSIMP) (("" (GROUND) (("1" (EXPAND "k_internal_state_witness") (("1" (PROPAX) NIL))) ("2" (EXPAND "k_external_state_witness") (("2" (REWRITE "emptyset_is_empty?") NIL))))))))))) (|base_k_comp_TCC1| "" (REWRITE "eq_view2") (("" (EXPAND "k_view") (("" (PROPAX) NIL))))) (|k_view_eq| "" (EXPAND "view_eq") (("" (EXPAND "base_k_comp") (("" (SKOSIMP) (("" (EXPAND "k_view") (("" (PROPAX) NIL))))))))) (|k_comp_init| "" (EXPAND "init_restriction") (("" (EXPAND "base_k_comp") (("" (GROUND) (("" (USE "emptyset_is_empty?[(K_STATE)]") (("" (GROUND) (("" (EXPAND "empty?") (("" (EXPAND "member") (("" (INST - "k_state_witness") (("" (REWRITE "k_state_witness_initial") NIL))))))))))))))))) (|k_comp_guar| "" (EXPAND "guar_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_k_comp") (("" (GROUND) (("" (EXPAND "k_guar") (("" (PROPAX) NIL))))))))))))) (|k_comp_rely_hidd| "" (EXPAND "rely_hidd_restriction") (("" (EXPAND "subset?") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_k_comp") (("" (EXPAND "k_hidd") (("" (CASE "x!1 = (PROJ_1(x!1), PROJ_2(x!1), PROJ_3(x!1))") (("1" (REPLACE -1 -) (("1" (PROPAX) NIL))) ("2" (HIDE 2) (("2" (APPLY-EXTENSIONALITY) NIL))))))))))))))))) (|k_comp_hidd| "" (EXPAND "hidd_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_k_comp") (("" (GROUND) (("" (EXPAND "k_hidd") (("" (EXPAND "k_rely") (("" (PROPAX) NIL))))))))))))))) (|k_comp_rely| "" (EXPAND "rely_restriction") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "base_k_comp") (("" (EXPAND "k_rely") (("" (GROUND) NIL))))))))))) (|k_comp_cags| "" (EXPAND "cags_restriction") (("" (EXPAND "base_k_comp") (("" (TYPEPRED "k_threads") (("" (GROUND) (("" (REPLACE -2) (("" (EXPAND "nonempty?") (("" (REWRITE "emptyset_is_empty?") NIL))))))))))))) (|k_comp_guar_stuttering| "" (EXPAND "guar_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_k_comp") (("" (EXPAND "k_guar") (("" (GROUND) NIL))))))))))))) (|k_comp_rely_stuttering| "" (EXPAND "rely_stuttering_restriction") (("" (EXPAND "gen_stuttering_restriction") (("" (SKOSIMP) (("" (EXPAND "member") (("" (EXPAND "base_k_comp") (("" (EXPAND "complement") (("" (EXPAND "member") (("" (EXPAND "k_view") (("" (GROUND) (("" (REPLACE -1) (("" (USE "k_rely_refl") (("" (GROUND) NIL))))))))))))))))))))))) (|k_comp_TCC1| "" (USE "k_view_eq") (("" (USE "k_comp_init") (("" (USE "k_comp_guar") (("" (USE "k_comp_rely_hidd") (("" (USE "k_comp_hidd") (("" (USE "k_comp_cags") (("" (USE "k_comp_guar_stuttering") (("" (USE "k_comp_rely_stuttering") (("" (REWRITE "component_view_eq_thm") NIL)))))))))))))))))) $$$system_state.pvs system_state: THEORY BEGIN IMPORTING k_spec IMPORTING cc_spec IMPORTING pt_spec IMPORTING ks_spec IMPORTING ssups_spec IMPORTING client_spec IMPORTING security_server_spec IMPORTING kst_merge IMPORTING more_set_lemmas IMPORTING disjoint_sets th: VAR THREAD thset, thset1, thset2: VAR setof[THREAD] kst : VAR KERNEL_SHARED_STATE COMP_INDEX : TYPE+ = {k_ind, cc_ind, pt_ind, ks_ind, ssups_ind, client_ind, ss_ind} i: VAR COMP_INDEX thsets_func: [COMP_INDEX -> setof[THREAD]] = (LAMBDA i: CASES i OF k_ind: k_threads, cc_ind: cc_threads, pt_ind: pt_threads, ks_ind: ks_threads, ssups_ind: ssups_threads, client_ind: client_threads, ss_ind: ss_threads ENDCASES) thsets_ax: AXIOM pairwise_disjoint(thsets_func) thsets_prop: LEMMA k_threads = thsets_func(k_ind) AND cc_threads = thsets_func(cc_ind) AND pt_threads = thsets_func(pt_ind) AND ks_threads = thsets_func(ks_ind) AND ssups_threads = thsets_func(ssups_ind) AND client_threads = thsets_func(client_ind) AND ss_threads = thsets_func(ss_ind) %%% Define the composite state SYSTEM_STATE_BASE: TYPE = [# k: (K_STATE), cc: (CC_STATE), pt: (PT_STATE), ks: (KS_STATE), ssups: (SSUPS_STATE), client: (CLIENT_STATE), ss: (SS_STATE) #] stb: VAR SYSTEM_STATE_BASE k_st: VAR (K_STATE) cc_st: VAR (CC_STATE) pt_st: VAR (PT_STATE) ks_st: VAR (KS_STATE) ssups_st: VAR (SSUPS_STATE) client_st: VAR (CLIENT_STATE) ss_st: VAR (SS_STATE) kstset : VAR setof[KERNEL_SHARED_STATE] build_system_state_base(k_st, cc_st, pt_st, ks_st, ssups_st, client_st, ss_st): SYSTEM_STATE_BASE = (# k:= k_st, cc:= cc_st, pt:= pt_st, ks:= ks_st, ssups:= ssups_st, client:= client_st, ss:= ss_st #) all_ksts(stb) : setof[KERNEL_SHARED_STATE] = {kst | kst = ext_st(k(stb)) OR kst = kst(cc(stb)) OR kst = kst(pt(stb)) OR kst = kst(ks(stb)) OR kst = kst(ssups(stb)) OR kst = kst(client(stb)) OR kst = kst(ss(stb))} SYSTEM_STATE(stb): bool = (FORALL kst: all_ksts(stb)(kst) => kst_substate(kst, ext_st(k(stb)))) %% This axiom could be proven from disjointness of threads for the %% components. For simplicity we will just assert that it is true. substates_ax: AXIOM EXISTS (superstate: KERNEL_SHARED_STATE) : (FORALL kst: all_ksts(stb)(kst) => kst_substate(kst, superstate)) ksts_mergable: THEOREM kst_mergable(all_ksts(build_system_state_base(k_st, cc_st, pt_st, ks_st, ssups_st, client_st, ss_st))) %% This could be proven by showing how to select int_st(k_st) so %% that it is consistent with K_STATE requirements and with the kst %% chosen. Again, for simplicity we assert this. k_st_ax: AXIOM (EXISTS k_st: ext_st(k_st) = kst) build_system_state_base_prop: THEOREM SYSTEM_STATE( build_system_state_base( choose({k_st1 : (K_STATE) | ext_st(k_st1) = kst_merge(all_ksts(build_system_state_base( k_st, cc_st, pt_st, ks_st, ssups_st, client_st, ss_st)))}), cc_st, pt_st, ks_st, ssups_st, client_st, ss_st)) build_system_state(k_st, cc_st, pt_st, ks_st, ssups_st, client_st, ss_st): (SYSTEM_STATE) = build_system_state_base( choose({k_st1 : (K_STATE) | ext_st(k_st1) = kst_merge(all_ksts(build_system_state_base( k_st, cc_st, pt_st, ks_st, ssups_st, client_st, ss_st)))}), cc_st, pt_st, ks_st, ssups_st, client_st, ss_st) system_state_witness : (SYSTEM_STATE) = build_system_state_base(k_state_witness, cc_state_witness, pt_state_witness, ks_state_witness, ssups_state_witness, client_state_witness, ss_state_witness) system_state_nonempty: THEOREM (EXISTS (x: ((SYSTEM_STATE))): TRUE) END system_state $$$system_state.prf (|system_state| (|thsets_prop| "" (EXPAND "thsets_func") (("" (PROPAX) NIL))) (|ksts_mergable| "" (SKOSIMP) (("" (USE "substates_ax") (("" (SKOSIMP) (("" (LEMMA "kst_mergable_subset") (("" (INST?) (("" (INST - "add(superstate!1,all_ksts(build_system_state_base(k_st!1, cc_st!1, pt_st!1, ks_st!1, ssups_st!1, client_st!1, ss_st!1)))") (("1" (GROUND) (("1" (HIDE -1 2) (("1" (EXPAND "subset?") (("1" (EXPAND "member") (("1" (SKOSIMP) (("1" (EXPAND "add") (("1" (EXPAND "member") (("1" (GROUND) NIL))))))))))))))) ("2" (HIDE 2) (("2" (REWRITE "kst_mergable_substates") (("2" (SKOSIMP) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))) (|build_system_state_base_prop_TCC1| "" (SKOSIMP) (("" (REWRITE "ksts_mergable") NIL))) (|build_system_state_base_prop_TCC2| "" (SKOSIMP) (("" (USE "k_st_ax") (("1" (REWRITE "nonempty_exists") (("1" (SKOSIMP) (("1" (INST?) NIL))) ("2" (SKOSIMP) (("2" (REWRITE "ksts_mergable") NIL))))) ("2" (REWRITE "ksts_mergable") NIL))))) (|build_system_state_base_prop| "" (SKOSIMP) (("" (EXPAND "SYSTEM_STATE") (("" (SKOSIMP) (("" (EXPAND "build_system_state_base") (("" (EXPAND "all_ksts") (("" (USE "ksts_mergable") (("" (EXPAND "build_system_state_base") (("" (EXPAND "all_ksts") (("" (CASE-REPLACE "ext_st(choose[(K_STATE)]({k_st1: (K_STATE) | (ext_st(k_st1) = kst_merge({kst: KERNEL_SHARED_STATE | kst = ext_st(k_st!1) OR kst = kst(cc_st!1) OR kst = kst(pt_st!1) OR kst = kst(ks_st!1) OR kst = kst(ssups_st!1) OR kst = kst(client_st!1) OR kst = kst(ss_st!1)}))})) = kst_merge({kst: KERNEL_SHARED_STATE | kst = ext_st(k_st!1) OR kst = kst(cc_st!1) OR kst = kst(pt_st!1) OR kst = kst(ks_st!1) OR kst = kst(ssups_st!1) OR kst = kst(client_st!1) OR kst = kst(ss_st!1)})") (("1" (HIDE -1) (("1" (USE "kst_merge_contains") (("1" (GROUND) (("1" (REPLACE -1 :DIR RL) (("1" (REWRITE "kst_substate_refl") NIL))))))))) ("2" (HIDE -2 2) (("2" (EXPAND "choose") (("2" (USE "epsilon_ax[(K_STATE)]") (("1" (GROUND) (("1" (HIDE 2) (("1" (REWRITE "k_st_ax") NIL))))) ("2" (SKOSIMP) NIL) ("3" (INST + "k_state_witness") NIL))))))) ("3" (REWRITE "nonempty_member") (("1" (EXPAND "member") (("1" (REWRITE "k_st_ax") NIL))) ("2" (SKOSIMP) NIL))) ("4" (SKOSIMP) NIL))))))))))))))))))) (|build_system_state_TCC1| "" (SKOSIMP) (("" (REWRITE "build_system_state_base_prop") NIL))) (|system_state_witness_TCC1| "" (EXPAND "SYSTEM_STATE") (("" (SKOSIMP) (("" (EXPAND "build_system_state_base") (("" (EXPAND "all_ksts") (("" (EXPAND "cc_state_witness") (("" (EXPAND "pt_state_witness") (("" (EXPAND "ks_state_witness") (("" (EXPAND "ssups_state_witness") (("" (EXPAND "client_state_witness") (("" (EXPAND "ss_state_witness") (("" (CASE "kst!1 = ext_st(k_state_witness) OR (kst!1 = empty_kst)") (("1" (HIDE -2) (("1" (GROUND) (("1" (REPLACE -1) (("1" (REWRITE "kst_substate_refl") NIL))) ("2" (REPLACE -1) (("2" (REWRITE "empty_kst_substate") NIL))))))) ("2" (GROUND) NIL))))))))))))))))))))))) (|system_state_nonempty| "" (INST + "system_state_witness") NIL)) $$$system_trans.pvs system_trans: THEORY BEGIN IMPORTING system_state IMPORTING idtran IMPORTING tcprops st, st1, st2: VAR (SYSTEM_STATE) k_st : VAR (K_STATE) ccst : VAR (CC_STATE) ptst : VAR (PT_STATE) ksst : VAR (KS_STATE) ssupsst : VAR (SSUPS_STATE) clientst : VAR (CLIENT_STATE) ssst : VAR (SS_STATE) %%% Define the translators k2system_sttran: (translator_t[(K_STATE), (SYSTEM_STATE)]) = (LAMBDA k_st: {st | k(st) = k_st}) cc2system_sttran: (translator_t[(CC_STATE), (SYSTEM_STATE)]) = (LAMBDA ccst: {st | cc(st) = ccst}) pt2system_sttran: (translator_t[(PT_STATE), (SYSTEM_STATE)]) = (LAMBDA ptst: {st | pt(st) = ptst}) ks2system_sttran: (translator_t[(KS_STATE), (SYSTEM_STATE)]) = (LAMBDA ksst: {st | ks(st) = ksst}) ssups2system_sttran: (translator_t[(SSUPS_STATE), (SYSTEM_STATE)]) = (LAMBDA ssupsst: {st | ssups(st) = ssupsst}) client2system_sttran: (translator_t[(CLIENT_STATE), (SYSTEM_STATE)]) = (LAMBDA clientst: {st | client(st) = clientst}) ss2system_sttran: (translator_t[(SS_STATE), (SYSTEM_STATE)]) = (LAMBDA ssst: {st | ss(st) = ssst}) system_agtran: (translator_t[THREAD, THREAD]) = idt[THREAD] %%% Translate the components kt: (comp_t[(SYSTEM_STATE), THREAD]) = tran_cmp(k_comp, k2system_sttran, system_agtran) cct: (comp_t[(SYSTEM_STATE), THREAD]) = tran_cmp(cc_comp, cc2system_sttran, system_agtran) ptt: (comp_t[(SYSTEM_STATE), THREAD]) = tran_cmp(pt_comp, pt2system_sttran, system_agtran) kst: (comp_t[(SYSTEM_STATE), THREAD]) = tran_cmp(ks_comp, ks2system_sttran, system_agtran) ssupst: (comp_t[(SYSTEM_STATE), THREAD]) = tran_cmp(ssups_comp, ssups2system_sttran, system_agtran) clientt: (comp_t[(SYSTEM_STATE), THREAD]) = tran_cmp(client_comp, client2system_sttran, system_agtran) sst: (comp_t[(SYSTEM_STATE), THREAD]) = tran_cmp(ss_comp, ss2system_sttran, system_agtran) END system_trans $$$system_trans.prf (|system_trans| (|k2system_sttran_TCC1| "" (INST + "k_state_witness") NIL) (|k2system_sttran_TCC2| "" (INST + "system_state_witness") NIL) (|k2system_sttran_TCC3| "" (REWRITE "inv_trans_prop" :SUBST ("it" "(LAMBDA (st: (SYSTEM_STATE)): k(st))")) (("" (HIDE 2) (("" (SKOSIMP) (("" (INST + "build_system_state_base(x!1,cc_state_witness,pt_state_witness,ks_state_witness,ssups_state_witness,client_state_witness,ss_state_witness)") (("1" (EXPAND "build_system_state_base") (("1" (PROPAX) NIL))) ("2" (EXPAND "SYSTEM_STATE") (("2" (SKOSIMP) (("2" (EXPAND "build_system_state_base") (("2" (EXPAND "all_ksts") (("2" (EXPAND "cc_state_witness") (("2" (EXPAND "pt_state_witness") (("2" (EXPAND "ks_state_witness") (("2" (EXPAND "ssups_state_witness") (("2" (EXPAND "client_state_witness") (("2" (EXPAND "ss_state_witness") (("2" (CASE "kst!1 = ext_st(x!1) OR kst!1 = empty_kst") (("1" (HIDE -2) (("1" (GROUND) (("1" (REPLACE -1) (("1" (REWRITE "kst_substate_refl") NIL))) ("2" (REPLACE -1) (("2" (REWRITE "empty_kst_substate") NIL))))))) ("2" (GROUND) NIL))))))))))))))))))))))))))))))) (|cc2system_sttran_TCC1| "" (INST + "cc_state_witness") NIL) (|cc2system_sttran_TCC2| "" (REWRITE "inv_trans_prop" :SUBST ("it" "(LAMBDA (st: (SYSTEM_STATE)): cc(st))")) (("" (HIDE 2) (("" (SKOSIMP) (("" (INST + "build_system_state(k_state_witness,x!1,pt_state_witness,ks_state_witness,ssups_state_witness,client_state_witness,ss_state_witness)") (("" (EXPAND "build_system_state") (("" (EXPAND "build_system_state_base") (("" (PROPAX) NIL))))))))))))) (|pt2system_sttran_TCC1| "" (INST + "pt_state_witness") NIL) (|pt2system_sttran_TCC2| "" (REWRITE "inv_trans_prop" :SUBST ("it" "(LAMBDA (st: (SYSTEM_STATE)): pt(st))")) (("" (HIDE 2) (("" (SKOSIMP) (("" (INST + "build_system_state(k_state_witness,cc_state_witness,x!1,ks_state_witness,ssups_state_witness,client_state_witness,ss_state_witness)") (("" (EXPAND "build_system_state") (("" (EXPAND "build_system_state_base") (("" (PROPAX) NIL))))))))))))) (|ks2system_sttran_TCC1| "" (INST + "ks_state_witness") NIL) (|ks2system_sttran_TCC2| "" (REWRITE "inv_trans_prop" :SUBST ("it" "(LAMBDA (st: (SYSTEM_STATE)): ks(st))")) (("" (HIDE 2) (("" (SKOSIMP) (("" (INST + "build_system_state(k_state_witness,cc_state_witness,pt_state_witness,x!1,ssups_state_witness,client_state_witness,ss_state_witness)") (("" (EXPAND "build_system_state") (("" (EXPAND "build_system_state_base") (("" (PROPAX) NIL))))))))))))) (|ssups2system_sttran_TCC1| "" (INST + "ssups_state_witness") NIL) (|ssups2system_sttran_TCC2| "" (REWRITE "inv_trans_prop" :SUBST ("it" "(LAMBDA (st: (SYSTEM_STATE)): ssups(st))")) (("" (HIDE 2) (("" (SKOSIMP) (("" (INST + "build_system_state(k_state_witness,cc_state_witness,pt_state_witness,ks_state_witness,x!1,client_state_witness,ss_state_witness)") (("" (EXPAND "build_system_state") (("" (EXPAND "build_system_state_base") (("" (PROPAX) NIL))))))))))))) (|client2system_sttran_TCC1| "" (INST + "client_state_witness") NIL) (|client2system_sttran_TCC2| "" (REWRITE "inv_trans_prop" :SUBST ("it" "(LAMBDA (st: (SYSTEM_STATE)): client(st))")) (("" (HIDE 2) (("" (SKOSIMP) (("" (INST + "build_system_state(k_state_witness,cc_state_witness,pt_state_witness,ks_state_witness,ssups_state_witness,x!1,ss_state_witness)") (("" (EXPAND "build_system_state") (("" (EXPAND "build_system_state_base") (("" (PROPAX) NIL))))))))))))) (|ss2system_sttran_TCC1| "" (INST + "ss_state_witness") NIL) (|ss2system_sttran_TCC2| "" (REWRITE "inv_trans_prop" :SUBST ("it" "(LAMBDA (st: (SYSTEM_STATE)): ss(st))")) (("" (HIDE 2) (("" (SKOSIMP) (("" (INST + "build_system_state(k_state_witness,cc_state_witness,pt_state_witness,ks_state_witness,ssups_state_witness,client_state_witness,x!1)") (("" (EXPAND "build_system_state") (("" (EXPAND "build_system_state_base") (("" (PROPAX) NIL)))))))))))))) $$$system.pvs system: THEORY BEGIN IMPORTING system_trans IMPORTING cmp_thm cmp: VAR (comp_t[(SYSTEM_STATE), THREAD]) ag: VAR THREAD tran: VAR [(SYSTEM_STATE), (SYSTEM_STATE), THREAD] a1, a2, kst1, kst2: VAR KERNEL_SHARED_STATE b: VAR THREAD system_cmps: setof[(comp_t[(SYSTEM_STATE), THREAD])] = {cmp | cmp = kt OR cmp = cct OR cmp = ptt OR cmp = kst OR cmp = ssupst OR cmp = clientt OR cmp = sst } nonk_cmps: setof[(comp_t[(SYSTEM_STATE), THREAD])] = {cmp | cmp = cct OR cmp = ptt OR cmp = kst OR cmp = ssupst OR cmp = clientt OR cmp = sst } nonk_cmps_ags: THEOREM (nonk_cmps(cmp) AND cags(cmp)(ag) => NOT tmap(system_agtran, k_threads)(ag)) system_union: LEMMA system_cmps = union(singleton(kt), nonk_cmps) system_agreeable_start: THEOREM agreeable_start(system_cmps) system_composable: THEOREM composable(system_cmps) system: (comp_t[(SYSTEM_STATE), THREAD]) = compose(system_cmps) %% TOLERANCE ANALYSIS %% Start with nonk components since we can use tolerates_cags for them system_tolerates_cct1: THEOREM tolerates(singleton(cct), nonk_cmps) system_tolerates_ptt1: THEOREM tolerates(singleton(ptt), nonk_cmps) system_tolerates_kst1: THEOREM tolerates(singleton(kst), nonk_cmps) system_tolerates_ssupst1: THEOREM tolerates(singleton(ssupst), nonk_cmps) system_tolerates_clientt1: THEOREM tolerates(singleton(clientt), nonk_cmps) system_tolerates_sst1: THEOREM tolerates(singleton(sst), nonk_cmps) %% Now consider the kernel %% First show the kernel does the right things for %% its kst_substates. kernel_tolerance_help: THEOREM LET a1 = ext_st(k(PROJ_1(tran))), a2 = ext_st(k(PROJ_2(tran))) IN guar(kt)(tran) AND PROJ_3(tran) = b AND kst_substate(kst1, a1) AND kst_substate(kst2, a2) AND hidd_base(b, kst1, kst2) IMPLIES environment_base(b, kst1, kst2) system_tolerates_cct2: THEOREM tolerates(singleton(cct), singleton(kt)) system_tolerates_ptt2: THEOREM tolerates(singleton(ptt), singleton(kt)) system_tolerates_kst2: THEOREM tolerates(singleton(kst), singleton(kt)) system_tolerates_ssupst2: THEOREM tolerates(singleton(ssupst), singleton(kt)) system_tolerates_clientt2: THEOREM tolerates(singleton(clientt), singleton(kt)) system_tolerates_sst2: THEOREM tolerates(singleton(sst), singleton(kt)) %% Now use tolerates_union to tie everything together. system_tolerates_kt: THEOREM tolerates(singleton(kt), system_cmps) system_tolerates_cct: THEOREM tolerates(singleton(cct), system_cmps) system_tolerates_ptt: THEOREM tolerates(singleton(ptt), system_cmps) system_tolerates_kst: THEOREM tolerates(singleton(kst), system_cmps) system_tolerates_ssupst: THEOREM tolerates(singleton(ssupst), system_cmps) system_tolerates_clientt: THEOREM tolerates(singleton(clientt), system_cmps) system_tolerates_sst: THEOREM tolerates(singleton(sst), system_cmps) END system $$$system.prf (|system| (|nonk_cmps_ags| "" (SKOSIMP) (("" (EXPAND "nonk_cmps") (("" (GROUND) (("1" (REPLACE -1 :HIDE? T) (("1" (EXPAND "cct") (("1" (FORWARD-CHAIN "disjoint_cags") (("1" (SKOSIMP) (("1" (HIDE -3 -4) (("1" (EXPAND "cc_comp") (("1" (EXPAND "base_cc_comp") (("1" (USE "thsets_prop") (("1" (FLATTEN) (("1" (REPLACE*) (("1" (USE "thsets_ax") (("1" (EXPAND "pairwise_disjoint") (("1" (INST? - ("j" "k_ind")) (("1" (GROUND) NIL))))))))))))))))))))) ("2" (LEMMA "cc_state_witness_prop") (("2" (PROPAX) NIL))) ("3" (INST + "system_state_witness") NIL))))))) ("2" (REPLACE -1 :HIDE? T) (("2" (EXPAND "ptt") (("2" (FORWARD-CHAIN "disjoint_cags") (("1" (SKOSIMP) (("1" (HIDE -3 -4) (("1" (EXPAND "pt_comp") (("1" (EXPAND "base_pt_comp") (("1" (USE "thsets_prop") (("1" (FLATTEN) (("1" (REPLACE*) (("1" (USE "thsets_ax") (("1" (EXPAND "pairwise_disjoint") (("1" (INST? - ("j" "k_ind")) (("1" (GROUND) NIL))))))))))))))))))))) ("2" (INST + "pt_state_witness") NIL) ("3" (INST + "system_state_witness") NIL))))))) ("3" (REPLACE -1 :HIDE? T) (("3" (EXPAND "kst") (("3" (FORWARD-CHAIN "disjoint_cags") (("1" (SKOSIMP) (("1" (HIDE -3 -4) (("1" (EXPAND "ks_comp") (("1" (EXPAND "base_ks_comp") (("1" (USE "thsets_prop") (("1" (FLATTEN) (("1" (REPLACE*) (("1" (USE "thsets_ax") (("1" (EXPAND "pairwise_disjoint") (("1" (INST? - ("j" "k_ind")) (("1" (GROUND) NIL))))))))))))))))))))) ("2" (INST + "ks_state_witness") NIL) ("3" (INST + "system_state_witness") NIL))))))) ("4" (REPLACE -1 :HIDE? T) (("4" (EXPAND "ssupst") (("4" (FORWARD-CHAIN "disjoint_cags") (("1" (SKOSIMP) (("1" (HIDE -3 -4) (("1" (EXPAND "ssups_comp") (("1" (EXPAND "base_ssups_comp") (("1" (USE "thsets_prop") (("1" (FLATTEN) (("1" (REPLACE*) (("1" (USE "thsets_ax") (("1" (EXPAND "pairwise_disjoint") (("1" (INST? - ("j" "k_ind")) (("1" (GROUND) NIL))))))))))))))))))))) ("2" (INST + "ssups_state_witness") NIL) ("3" (INST + "system_state_witness") NIL))))))) ("5" (REPLACE -1 :HIDE? T) (("5" (EXPAND "clientt") (("5" (FORWARD-CHAIN "disjoint_cags") (("1" (SKOSIMP) (("1" (HIDE -3 -4) (("1" (EXPAND "client_comp") (("1" (EXPAND "base_client_comp") (("1" (USE "thsets_prop") (("1" (FLATTEN) (("1" (REPLACE*) (("1" (USE "thsets_ax") (("1" (EXPAND "pairwise_disjoint") (("1" (INST? - ("j" "k_ind")) (("1" (GROUND) NIL))))))))))))))))))))) ("2" (INST + "client_state_witness") NIL) ("3" (INST + "system_state_witness") NIL))))))) ("6" (REPLACE -1 :HIDE? T) (("6" (EXPAND "sst") (("6" (FORWARD-CHAIN "disjoint_cags") (("1" (SKOSIMP) (("1" (HIDE -3 -4) (("1" (EXPAND "ss_comp") (("1" (EXPAND "base_ss_comp") (("1" (USE "thsets_prop") (("1" (FLATTEN) (("1" (REPLACE*) (("1" (USE "thsets_ax") (("1" (EXPAND "pairwise_disjoint") (("1" (INST? - ("j" "k_ind")) (("1" (GROUND) NIL))))))))))))))))))))) ("2" (INST + "ss_state_witness") NIL) ("3" (INST + "system_state_witness") NIL))))))))))))) (|system_union| "" (EXTENSIONALITY "setof[(comp_t[(SYSTEM_STATE), THREAD])]") (("" (INST?) (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (HIDE 2) (("2" (SKOSIMP) (("2" (EXPAND "union") (("2" (EXPAND "singleton") (("2" (EXPAND "member") (("2" (EXPAND "nonk_cmps") (("2" (EXPAND "system_cmps") (("2" (PROPAX) NIL))))))))))))))))))))) (|system_agreeable_start_TCC1| "" (INST + "system_state_witness") NIL) (|system_agreeable_start| "" (EXPAND "agreeable_start") (("" (INST + "system_state_witness") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "system_cmps") (("" (EXPAND "system_state_witness") (("" (EXPAND "build_system_state_base") (("" (SPLIT) (("1" (REPLACE -1 :HIDE? T) (("1" (EXPAND "kt") (("1" (EXPAND "tran_cmp") (("1" (EXPAND "tr_cmp") (("1" (EXPAND "k_comp") (("1" (EXPAND "base_k_comp") (("1" (EXPAND "tmap") (("1" (EXPAND "k2system_sttran") (("1" (EXPAND "member") (("1" (INST?) (("1" (REWRITE "k_state_witness_initial") (("1" (GROUND) NIL))))))))))))))))))))))) ("2" (REPLACE -1 :HIDE? T) (("2" (EXPAND "cct") (("2" (EXPAND "tran_cmp") (("2" (EXPAND "tr_cmp") (("2" (EXPAND "cc_comp") (("2" (EXPAND "base_cc_comp") (("2" (EXPAND "tmap") (("2" (EXPAND "cc2system_sttran") (("2" (EXPAND "member") (("2" (INST?) (("2" (REWRITE "cc_state_witness_initial") (("2" (GROUND) NIL))))))))))))))))))))))) ("3" (REPLACE -1 :HIDE? T) (("3" (EXPAND "ptt") (("3" (EXPAND "tran_cmp") (("3" (EXPAND "tr_cmp") (("3" (EXPAND "pt_comp") (("3" (EXPAND "base_pt_comp") (("3" (EXPAND "tmap") (("3" (EXPAND "pt2system_sttran") (("3" (EXPAND "member") (("3" (INST?) (("3" (REWRITE "pt_state_witness_initial") (("3" (GROUND) NIL))))))))))))))))))))))) ("4" (REPLACE -1 :HIDE? T) (("4" (EXPAND "kst") (("4" (EXPAND "tran_cmp") (("4" (EXPAND "tr_cmp") (("4" (EXPAND "ks_comp") (("4" (EXPAND "base_ks_comp") (("4" (EXPAND "tmap") (("4" (EXPAND "ks2system_sttran") (("4" (EXPAND "member") (("4" (INST?) (("4" (REWRITE "ks_state_witness_initial") (("4" (GROUND) NIL))))))))))))))))))))))) ("5" (REPLACE -1 :HIDE? T) (("5" (EXPAND "ssupst") (("5" (EXPAND "tran_cmp") (("5" (EXPAND "tr_cmp") (("5" (EXPAND "ssups_comp") (("5" (EXPAND "base_ssups_comp") (("5" (EXPAND "tmap") (("5" (EXPAND "ssups2system_sttran") (("5" (EXPAND "member") (("5" (INST?) (("5" (REWRITE "ssups_state_witness_initial") (("5" (GROUND) NIL))))))))))))))))))))))) ("6" (REPLACE -1 :HIDE? T) (("6" (EXPAND "clientt") (("6" (EXPAND "tran_cmp") (("6" (EXPAND "tr_cmp") (("6" (EXPAND "client_comp") (("6" (EXPAND "base_client_comp") (("6" (EXPAND "tmap") (("6" (EXPAND "client2system_sttran") (("6" (EXPAND "member") (("6" (INST?) (("6" (REWRITE "client_state_witness_initial") (("6" (GROUND) NIL))))))))))))))))))))))) ("7" (REPLACE -1 :HIDE? T) (("7" (EXPAND "sst") (("7" (EXPAND "tran_cmp") (("7" (EXPAND "tr_cmp") (("7" (EXPAND "ss_comp") (("7" (EXPAND "base_ss_comp") (("7" (EXPAND "tmap") (("7" (EXPAND "ss2system_sttran") (("7" (EXPAND "member") (("7" (INST?) (("7" (REWRITE "ss_state_witness_initial") (("7" (GROUND) NIL))))))))))))))))))))))))))))))))))))))) (|system_composable| "" (EXPAND "composable") (("" (REWRITE "system_agreeable_start") (("" (GROUND) (("" (REWRITE "emptyset_is_empty?" :DIR RL) (("" (EXPAND "empty?") (("" (EXPAND "member") (("" (EXPAND "system_cmps") (("" (INST? -) (("" (GROUND) NIL))))))))))))))))) (|system_TCC1| "" (REWRITE "system_composable") NIL) (|system_tolerates_cct1| "" (REWRITE "tolerates_cags_stronger") (("" (HIDE 2) (("" (LEMMA "tolerates_cags_help[(SYSTEM_STATE),THREAD]") (("" (INST? - ("ags" "tmap(system_agtran, k_threads)")) (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (HIDE 2) (("2" (SKOSIMP) (("2" (SPLIT) (("1" (FLATTEN) (("1" (EXPAND "singleton") (("1" (REPLACE -1 :HIDE? T) (("1" (EXPAND "cct") (("1" (LEMMA "cc_state_witness_prop") (("1" (LEMMA "system_state_nonempty") (("1" (USE "tolerates_cags_trans_prop[(SYSTEM_STATE),(CC_STATE), THREAD, THREAD]") (("1" (GROUND) (("1" (SKOSIMP) (("1" (USE "cc_comp_hidd_prop") (("1" (GROUND) NIL))))))))))))))))))))) ("2" (GROUND) (("2" (USE "nonk_cmps_ags") (("2" (GROUND) NIL))))))))))))))))))))) (|system_tolerates_ptt1| "" (REWRITE "tolerates_cags_stronger") (("" (HIDE 2) (("" (LEMMA "tolerates_cags_help[(SYSTEM_STATE),THREAD]") (("" (INST? - ("ags" "tmap(system_agtran, k_threads)")) (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (HIDE 2) (("2" (SKOSIMP) (("2" (SPLIT) (("1" (FLATTEN) (("1" (EXPAND "singleton") (("1" (REPLACE -1 :HIDE? T) (("1" (EXPAND "ptt") (("1" (LEMMA "pt_state_witness_prop") (("1" (LEMMA "system_state_nonempty") (("1" (USE "tolerates_cags_trans_prop[(SYSTEM_STATE),(PT_STATE), THREAD, THREAD]") (("1" (GROUND) (("1" (SKOSIMP) (("1" (USE "pt_comp_hidd_prop") (("1" (GROUND) NIL))))))))))))))))))))) ("2" (GROUND) (("2" (USE "nonk_cmps_ags") (("2" (GROUND) NIL))))))))))))))))))))) (|system_tolerates_kst1| "" (REWRITE "tolerates_cags_stronger") (("" (HIDE 2) (("" (LEMMA "tolerates_cags_help[(SYSTEM_STATE),THREAD]") (("" (INST? - ("ags" "tmap(system_agtran, k_threads)")) (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (HIDE 2) (("2" (SKOSIMP) (("2" (SPLIT) (("1" (FLATTEN) (("1" (EXPAND "singleton") (("1" (REPLACE -1 :HIDE? T) (("1" (EXPAND "kst") (("1" (LEMMA "ks_state_witness_prop") (("1" (LEMMA "system_state_nonempty") (("1" (USE "tolerates_cags_trans_prop[(SYSTEM_STATE),(KS_STATE), THREAD, THREAD]") (("1" (GROUND) (("1" (SKOSIMP) (("1" (USE "ks_comp_hidd_prop") (("1" (GROUND) NIL))))))))))))))))))))) ("2" (GROUND) (("2" (USE "nonk_cmps_ags") (("2" (GROUND) NIL))))))))))))))))))))) (|system_tolerates_ssupst1| "" (REWRITE "tolerates_cags_stronger") (("" (HIDE 2) (("" (LEMMA "tolerates_cags_help[(SYSTEM_STATE),THREAD]") (("" (INST? - ("ags" "tmap(system_agtran, k_threads)")) (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (HIDE 2) (("2" (SKOSIMP) (("2" (SPLIT) (("1" (FLATTEN) (("1" (EXPAND "singleton") (("1" (REPLACE -1 :HIDE? T) (("1" (EXPAND "ssupst") (("1" (LEMMA "ssups_state_witness_prop") (("1" (LEMMA "system_state_nonempty") (("1" (USE "tolerates_cags_trans_prop[(SYSTEM_STATE),(SSUPS_STATE), THREAD, THREAD]") (("1" (GROUND) (("1" (SKOSIMP) (("1" (USE "ssups_comp_hidd_prop") (("1" (GROUND) NIL))))))))))))))))))))) ("2" (GROUND) (("2" (USE "nonk_cmps_ags") (("2" (GROUND) NIL))))))))))))))))))))) (|system_tolerates_clientt1| "" (REWRITE "tolerates_cags_stronger") (("" (HIDE 2) (("" (LEMMA "tolerates_cags_help[(SYSTEM_STATE),THREAD]") (("" (INST? - ("ags" "tmap(system_agtran, k_threads)")) (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (HIDE 2) (("2" (SKOSIMP) (("2" (SPLIT) (("1" (FLATTEN) (("1" (EXPAND "singleton") (("1" (REPLACE -1 :HIDE? T) (("1" (EXPAND "clientt") (("1" (LEMMA "client_state_witness_prop") (("1" (LEMMA "system_state_nonempty") (("1" (USE "tolerates_cags_trans_prop[(SYSTEM_STATE),(CLIENT_STATE), THREAD, THREAD]") (("1" (GROUND) (("1" (SKOSIMP) (("1" (USE "client_comp_hidd_prop") (("1" (GROUND) NIL))))))))))))))))))))) ("2" (GROUND) (("2" (USE "nonk_cmps_ags") (("2" (GROUND) NIL))))))))))))))))))))) (|system_tolerates_sst1| "" (REWRITE "tolerates_cags_stronger") (("" (HIDE 2) (("" (LEMMA "tolerates_cags_help[(SYSTEM_STATE),THREAD]") (("" (INST? - ("ags" "tmap(system_agtran, k_threads)")) (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (HIDE 2) (("2" (SKOSIMP) (("2" (SPLIT) (("1" (FLATTEN) (("1" (EXPAND "singleton") (("1" (REPLACE -1 :HIDE? T) (("1" (EXPAND "sst") (("1" (LEMMA "ss_state_witness_prop") (("1" (LEMMA "system_state_nonempty") (("1" (USE "tolerates_cags_trans_prop[(SYSTEM_STATE),(SS_STATE), THREAD, THREAD]") (("1" (GROUND) (("1" (SKOSIMP) (("1" (USE "ss_comp_hidd_prop") (("1" (GROUND) NIL))))))))))))))))))))) ("2" (GROUND) (("2" (USE "nonk_cmps_ags") (("2" (GROUND) NIL))))))))))))))))))))) (|kernel_tolerance_help| "" (SKOSIMP) (("" (EXPAND "kst_substate") (("" (GROUND) (("" (EXPAND "kt") (("" (EXPAND "k2system_sttran") (("" (EXPAND "system_agtran") (("" (EXPAND "idt") (("" (EXPAND "tran_cmp") (("" (EXPAND "tr_cmp") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (SKOSIMP) (("" (EXPAND "k_comp") (("" (EXPAND "base_k_comp") (("" (EXPAND "k_guar") (("" (REPLACE -2 :HIDE? T) (("" (REPLACE -2 :HIDE? T) (("" (REPLACE -2 :HIDE? T) (("" (REPLACE -2 :HIDE? T) (("" (FLATTEN) (("" (EXPAND "k_view") (("" (REWRITE "hidd_env_prop") (("1" (SKOSIMP) (("1" (INST? -) (("1" (INST? -) (("1" (FLATTEN) (("1" (REPLACE -13) (("1" (REPLACE -9) (("1" (TYPEPRED "a1!1") (("1" (TYPEPRED "a2!1") (("1" (EXPAND "K_STATE") (("1" (CASE "EXISTS (est1, est2: K_EXTERNAL_STATE): est1 = ext_st(a1!1) AND est2 = ext_st(a2!1) AND existing_threads(est2) = existing_threads(est1) AND ((thread_status(est2) = thread_status(est1)) OR (EXISTS (thread: (existing_threads(int_st(a1!1)))): thread_status(est2) = thread_status(est1) WITH [(thread) := thread_running]))") (("1" (SKOSIMP) (("1" (GROUND) (("1" (SKOSIMP) (("1" (REPLACE -3 :DIR RL) (("1" (REPLACE -15 :DIR RL) (("1" (REPLACE -4 :DIR RL) (("1" (REPLACE -2) (("1" (LIFT-IF) (("1" (GROUND) NIL))))))))))))))))) ("2" (EXPAND "k_op") (("2" (GROUND) (("1" (EXPAND "k_send_message") (("1" (SKOSIMP) (("1" (EXPAND "ksm_task_thread") (("1" (GROUND) (("1" (HIDE 1) (("1" (INST? +) (("1" (GROUND) (("1" (INST? +) NIL))))))))))))))) ("2" (EXPAND "k_receive_message") (("2" (SKOSIMP) (("2" (HIDE 2) (("2" (INST? +) (("2" (GROUND) (("2" (INST? +) NIL))))))))))) ("3" (EXPAND "k_kernel_request") (("3" (SKOSIMP) (("3" (INST? +) (("3" (GROUND) NIL))))))) ("4" (EXPAND "k_provide_access") (("4" (SKOSIMP) (("4" (INST? -) (("1" (INST? +) (("1" (GROUND) (("1" (INST? +) NIL))))) ("2" (TYPEPRED "ist2!1") (("2" (EXPAND "K_INTERNAL_STATE") (("2" (GROUND) NIL))))))))))) ("5" (EXPAND "k_request_access") (("5" (SKOSIMP) (("5" (INST? +) (("5" (GROUND) NIL))))))) ("6" (EXPAND "k_set_ss_port") (("6" (SKOSIMP) (("6" (INST? +) (("6" (GROUND) (("6" (INST? +) NIL))))))))) ("7" (EXPAND "k_get_ss_port") (("7" (SKOSIMP) (("7" (INST? +) (("7" (GROUND) (("7" (INST? +) NIL))))))))))))) ("3" (SKOSIMP) (("3" (SKOSIMP) (("3" (TYPEPRED "thread!2") (("3" (GROUND) NIL))))))) ("4" (SKOSIMP*) (("4" (TYPEPRED "y1!1") (("4" (TYPEPRED "x1!1") (("4" (GROUND) NIL))))))))))))))))))))))))))) ("2" (SKOSIMP) (("2" (REPLACE -2 :DIR RL :HIDE? T) (("2" (INST? -) (("2" (INST? -) (("2" (FLATTEN) (("2" (REPLACE -7) (("2" (REPLACE -11) (("2" (TYPEPRED "a1!1") (("2" (TYPEPRED "a2!1") (("2" (EXPAND "K_STATE") (("2" (CASE "EXISTS (est1, est2: K_EXTERNAL_STATE): est1 = ext_st(a1!1) AND est2 = ext_st(a2!1) AND existing_threads(est2) = existing_threads(est1) AND (EXISTS (thread: (existing_threads(int_st(a1!1)))): ((FORALL (th: (existing_threads(int_st(a1!1)))): (th = thread OR received_info(est2)(th) = received_info(est1)(th))) AND ri_status(received_info(est1)(thread)) = ri_processed))") (("1" (SKOSIMP*) (("1" (INST? - :WHERE +) (("1" (GROUND) NIL) ("2" (REPLACE -6) (("2" (EXPAND "subset?") (("2" (EXPAND "member") (("2" (INST?) (("2" (GROUND) NIL))))))))))))) ("2" (EXPAND "k_op") (("2" (GROUND) (("1" (EXPAND "k_send_message") (("1" (SKOSIMP) (("1" (EXPAND "ksm_task_thread") (("1" (GROUND) NIL))))))) ("2" (EXPAND "k_receive_message") (("2" (SKOSIMP) (("2" (HIDE 2) (("2" (INST? +) (("2" (GROUND) NIL))))))))) ("3" (EXPAND "k_kernel_request") (("3" (SKOSIMP) (("3" (INST? +) (("3" (GROUND) NIL))))))) ("4" (EXPAND "k_provide_access") (("4" (SKOSIMP) (("4" (INST? +) (("4" (GROUND) NIL))))))) ("5" (EXPAND "k_request_access") (("5" (SKOSIMP) (("5" (INST? +) (("5" (GROUND) NIL))))))) ("6" (EXPAND "k_set_ss_port") (("6" (SKOSIMP) (("6" (INST? +) (("6" (GROUND) NIL))))))) ("7" (INST? +) (("7" (EXPAND "k_get_ss_port") (("7" (SKOSIMP) (("7" (INST? +) (("7" (GROUND) NIL))))))))))))) ("3" (SKOSIMP*) (("3" (TYPEPRED "thread!2") (("3" (GROUND) NIL))))) ("4" (SKOSIMP*) (("4" (TYPEPRED "th!1") (("4" (REPLACE -2 :HIDE? T) (("4" (GROUND) NIL))))))) ("5" (SKOSIMP*) (("5" (REPLACE -2) (("5" (TYPEPRED "th!1") (("5" (REPLACE -4) (("5" (REPLACE -2) (("5" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|system_tolerates_cct2| "" (REWRITE "tolerates_disj_stronger") (("" (HIDE 2) (("" (EXPAND "tolerates_disj") (("" (SKOSIMP) (("" (EXPAND "singleton") (("" (EXPAND "member") (("" (REPLACE -1 :HIDE? T) (("" (EXPAND "tolerates_cmp_disj") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (REPLACE -2 :HIDE? T) (("" (EXPAND "cct") (("" (EXPAND "cc2system_sttran") (("" (EXPAND "system_agtran") (("" (EXPAND "tran_cmp") (("" (EXPAND "tr_cmp") (("" (EXPAND "idt") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (EXPAND "union") (("" (EXPAND "member") (("" (GROUND) (("" (SKOSIMP*) (("" (HIDE 2) (("" (INST + "a1!1" "a2!1" "b!1") (("" (GROUND) (("" (EXPAND "cc_comp") (("" (EXPAND "base_cc_comp") (("" (EXPAND "cc_hidd") (("" (GROUND) (("" (EXPAND "cc_rely") (("" (EXPAND "cc_environment") (("" (USE "kernel_tolerance_help") (("" (TYPEPRED "PROJ_1(tran!1)") (("" (TYPEPRED "PROJ_2(tran!1)") (("" (EXPAND "SYSTEM_STATE") (("" (EXPAND "all_ksts") (("" (INST?) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|system_tolerates_ptt2| "" (REWRITE "tolerates_disj_stronger") (("" (HIDE 2) (("" (EXPAND "tolerates_disj") (("" (SKOSIMP) (("" (EXPAND "singleton") (("" (EXPAND "member") (("" (REPLACE -1 :HIDE? T) (("" (EXPAND "tolerates_cmp_disj") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (REPLACE -2 :HIDE? T) (("" (EXPAND "ptt") (("" (EXPAND "pt2system_sttran") (("" (EXPAND "system_agtran") (("" (EXPAND "tran_cmp") (("" (EXPAND "tr_cmp") (("" (EXPAND "idt") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (EXPAND "union") (("" (EXPAND "member") (("" (GROUND) (("" (SKOSIMP*) (("" (HIDE 2) (("" (INST + "a1!1" "a2!1" "b!1") (("" (GROUND) (("" (EXPAND "pt_comp") (("" (EXPAND "base_pt_comp") (("" (EXPAND "pt_hidd") (("" (GROUND) (("" (EXPAND "pt_rely") (("" (EXPAND "pt_environment") (("" (USE "kernel_tolerance_help") (("" (TYPEPRED "PROJ_1(tran!1)") (("" (TYPEPRED "PROJ_2(tran!1)") (("" (EXPAND "SYSTEM_STATE") (("" (EXPAND "all_ksts") (("" (INST?) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|system_tolerates_kst2| "" (REWRITE "tolerates_disj_stronger") (("" (HIDE 2) (("" (EXPAND "tolerates_disj") (("" (SKOSIMP) (("" (EXPAND "singleton") (("" (EXPAND "member") (("" (REPLACE -1 :HIDE? T) (("" (EXPAND "tolerates_cmp_disj") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (REPLACE -2 :HIDE? T) (("" (EXPAND "kst") (("" (EXPAND "ks2system_sttran") (("" (EXPAND "system_agtran") (("" (EXPAND "tran_cmp") (("" (EXPAND "tr_cmp") (("" (EXPAND "idt") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (EXPAND "union") (("" (EXPAND "member") (("" (GROUND) (("" (SKOSIMP*) (("" (HIDE 2) (("" (INST + "a1!1" "a2!1" "b!1") (("" (GROUND) (("" (EXPAND "ks_comp") (("" (EXPAND "base_ks_comp") (("" (EXPAND "ks_hidd") (("" (GROUND) (("" (EXPAND "ks_rely") (("" (EXPAND "ks_environment") (("" (USE "kernel_tolerance_help") (("" (TYPEPRED "PROJ_1(tran!1)") (("" (TYPEPRED "PROJ_2(tran!1)") (("" (EXPAND "SYSTEM_STATE") (("" (EXPAND "all_ksts") (("" (INST?) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|system_tolerates_ssupst2| "" (REWRITE "tolerates_disj_stronger") (("" (HIDE 2) (("" (EXPAND "tolerates_disj") (("" (SKOSIMP) (("" (EXPAND "singleton") (("" (EXPAND "member") (("" (REPLACE -1 :HIDE? T) (("" (EXPAND "tolerates_cmp_disj") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (REPLACE -2 :HIDE? T) (("" (EXPAND "ssupst") (("" (EXPAND "ssups2system_sttran") (("" (EXPAND "system_agtran") (("" (EXPAND "tran_cmp") (("" (EXPAND "tr_cmp") (("" (EXPAND "idt") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (EXPAND "union") (("" (EXPAND "member") (("" (GROUND) (("" (SKOSIMP*) (("" (HIDE 2) (("" (INST + "a1!1" "a2!1" "b!1") (("" (GROUND) (("" (EXPAND "ssups_comp") (("" (EXPAND "base_ssups_comp") (("" (EXPAND "ssups_hidd") (("" (GROUND) (("" (EXPAND "ssups_rely") (("" (EXPAND "ssups_environment") (("" (USE "kernel_tolerance_help") (("" (TYPEPRED "PROJ_1(tran!1)") (("" (TYPEPRED "PROJ_2(tran!1)") (("" (EXPAND "SYSTEM_STATE") (("" (EXPAND "all_ksts") (("" (INST?) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|system_tolerates_clientt2| "" (REWRITE "tolerates_disj_stronger") (("" (HIDE 2) (("" (EXPAND "tolerates_disj") (("" (SKOSIMP) (("" (EXPAND "singleton") (("" (EXPAND "member") (("" (REPLACE -1 :HIDE? T) (("" (EXPAND "tolerates_cmp_disj") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (REPLACE -2 :HIDE? T) (("" (EXPAND "clientt") (("" (EXPAND "client2system_sttran") (("" (EXPAND "system_agtran") (("" (EXPAND "tran_cmp") (("" (EXPAND "tr_cmp") (("" (EXPAND "idt") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (EXPAND "union") (("" (EXPAND "member") (("" (GROUND) (("" (SKOSIMP*) (("" (HIDE 2) (("" (INST + "a1!1" "a2!1" "b!1") (("" (GROUND) (("" (EXPAND "client_comp") (("" (EXPAND "base_client_comp") (("" (EXPAND "client_hidd") (("" (GROUND) (("" (EXPAND "client_rely") (("" (EXPAND "client_environment") (("" (USE "kernel_tolerance_help") (("" (TYPEPRED "PROJ_1(tran!1)") (("" (TYPEPRED "PROJ_2(tran!1)") (("" (EXPAND "SYSTEM_STATE") (("" (EXPAND "all_ksts") (("" (INST?) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|system_tolerates_sst2| "" (REWRITE "tolerates_disj_stronger") (("" (HIDE 2) (("" (EXPAND "tolerates_disj") (("" (SKOSIMP) (("" (EXPAND "singleton") (("" (EXPAND "member") (("" (REPLACE -1 :HIDE? T) (("" (EXPAND "tolerates_cmp_disj") (("" (SKOSIMP*) (("" (EXPAND "member") (("" (REPLACE -2 :HIDE? T) (("" (EXPAND "sst") (("" (EXPAND "ss2system_sttran") (("" (EXPAND "system_agtran") (("" (EXPAND "tran_cmp") (("" (EXPAND "tr_cmp") (("" (EXPAND "idt") (("" (EXPAND "tr_ac") (("" (EXPAND "member") (("" (EXPAND "union") (("" (EXPAND "member") (("" (GROUND) (("" (SKOSIMP*) (("" (HIDE 2) (("" (INST + "a1!1" "a2!1" "b!1") (("" (GROUND) (("" (EXPAND "ss_comp") (("" (EXPAND "base_ss_comp") (("" (EXPAND "ss_hidd") (("" (GROUND) (("" (EXPAND "ss_rely") (("" (EXPAND "ss_environment") (("" (USE "kernel_tolerance_help") (("" (TYPEPRED "PROJ_1(tran!1)") (("" (TYPEPRED "PROJ_2(tran!1)") (("" (EXPAND "SYSTEM_STATE") (("" (EXPAND "all_ksts") (("" (INST?) (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|system_tolerates_kt| "" (EXPAND "tolerates") (("" (SKOSIMP) (("" (HIDE -1) (("" (EXPAND "tolerates_cmp") (("" (EXPAND "singleton") (("" (EXPAND "member") (("" (SKOSIMP*) (("" (INST?) (("" (GROUND) (("" (REPLACE -2 :HIDE? T) (("" (EXPAND "kt") (("" (EXPAND "tran_cmp") (("" (EXPAND "tr_cmp") (("" (EXPAND "k2system_sttran") (("" (EXPAND "system_agtran") (("" (EXPAND "idt") (("" (EXPAND "tr_ac") (("" (EXPAND "union") (("" (EXPAND "member") (("" (GROUND) (("" (SKOSIMP*) (("" (HIDE 1) (("" (EXPAND "k_comp") (("" (EXPAND "base_k_comp") (("" (HIDE 2) (("" (EXPAND "k_hidd") (("" (INST?) (("" (GROUND) NIL))))))))))))))))))))))))))))))))))))))))))))))))))))))) (|system_tolerates_cct| "" (USE "system_tolerates_cct1") (("" (USE "system_tolerates_cct2") (("" (USE "system_union") (("" (USE "tolerates_union[(SYSTEM_STATE), THREAD]") (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL) ("4" (PROPAX) NIL))))))))))) (|system_tolerates_ptt| "" (USE "system_tolerates_ptt1") (("" (USE "system_tolerates_ptt2") (("" (USE "system_union") (("" (USE "tolerates_union[(SYSTEM_STATE), THREAD]") (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL) ("4" (PROPAX) NIL))))))))))) (|system_tolerates_kst| "" (USE "system_tolerates_kst1") (("" (USE "system_tolerates_kst2") (("" (USE "system_union") (("" (USE "tolerates_union[(SYSTEM_STATE), THREAD]") (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL) ("4" (PROPAX) NIL))))))))))) (|system_tolerates_ssupst| "" (USE "system_tolerates_ssupst1") (("" (USE "system_tolerates_ssupst2") (("" (USE "system_union") (("" (USE "tolerates_union[(SYSTEM_STATE), THREAD]") (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL) ("4" (PROPAX) NIL))))))))))) (|system_tolerates_clientt| "" (USE "system_tolerates_clientt1") (("" (USE "system_tolerates_clientt2") (("" (USE "system_union") (("" (USE "tolerates_union[(SYSTEM_STATE), THREAD]") (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL) ("4" (PROPAX) NIL))))))))))) (|system_tolerates_sst| "" (USE "system_tolerates_sst1") (("" (USE "system_tolerates_sst2") (("" (USE "system_union") (("" (USE "tolerates_union[(SYSTEM_STATE), THREAD]") (("" (SPLIT) (("1" (PROPAX) NIL) ("2" (PROPAX) NIL) ("3" (PROPAX) NIL) ("4" (PROPAX) NIL)))))))))))) $$$system_cmp_thm.pvs system_cmp_thm: THEORY BEGIN IMPORTING system kp: VAR prop_t[(K_STATE), THREAD] ccp: VAR prop_t[(CC_STATE), THREAD] ptp: VAR prop_t[(PT_STATE), THREAD] ksp: VAR prop_t[(KS_STATE), THREAD] ssupsp: VAR prop_t[(SSUPS_STATE), THREAD] clientp: VAR prop_t[(CLIENT_STATE), THREAD] ssp: VAR prop_t[(SS_STATE), THREAD] p: VAR prop_t[(SYSTEM_STATE), THREAD] system_cmp_thm_k: THEOREM satisfies(k_comp, kp) AND pmap(kp, k2system_sttran, system_agtran) = p IMPLIES satisfies(system, p) system_cmp_thm_cc: THEOREM satisfies(cc_comp, ccp) AND pmap(ccp, cc2system_sttran, system_agtran) = p IMPLIES satisfies(system, p) system_cmp_thm_pt: THEOREM satisfies(pt_comp, ptp) AND pmap(ptp, pt2system_sttran, system_agtran) = p IMPLIES satisfies(system, p) system_cmp_thm_ks: THEOREM satisfies(ks_comp, ksp) AND pmap(ksp, ks2system_sttran, system_agtran) = p IMPLIES satisfies(system, p) system_cmp_thm_ssups: THEOREM satisfies(ssups_comp, ssupsp) AND pmap(ssupsp, ssups2system_sttran, system_agtran) = p IMPLIES satisfies(system, p) system_cmp_thm_client: THEOREM satisfies(client_comp, clientp) AND pmap(clientp, client2system_sttran, system_agtran) = p IMPLIES satisfies(system, p) system_cmp_thm_ss: THEOREM satisfies(ss_comp, ssp) AND pmap(ssp, ss2system_sttran, system_agtran) = p IMPLIES satisfies(system, p) END system_cmp_thm $$$system_cmp_thm.prf (|system_cmp_thm| (|kp_TCC1| "" (INST + "k_state_witness") NIL) (|ccp_TCC1| "" (INST + "cc_state_witness") NIL) (|ptp_TCC1| "" (INST + "pt_state_witness") NIL) (|ksp_TCC1| "" (INST + "ks_state_witness") NIL) (|ssupsp_TCC1| "" (INST + "ssups_state_witness") NIL) (|clientp_TCC1| "" (INST + "client_state_witness") NIL) (|ssp_TCC1| "" (INST + "ss_state_witness") NIL) (|p_TCC1| "" (INST + "system_state_witness") NIL) (|system_cmp_thm_k| "" (SKOSIMP) (("" (EXPAND "system") (("" (USE "system_composable") (("" (USE "system_tolerates_kt") (("" (USE "cmp_thm[(SYSTEM_STATE),THREAD]") (("1" (REWRITE "singleton_not_emptyset") (("1" (GROUND) (("1" (REWRITE "subset_singleton") (("1" (EXPAND "system_cmps") (("1" (PROPAX) NIL))))) ("2" (USE "kt") (("2" (USE "tcprop1[(SYSTEM_STATE), (K_STATE), THREAD, THREAD]") (("1" (GROUND) NIL) ("2" (INST + "k_state_witness") NIL) ("3" (INST + "system_state_witness") NIL))))))))) ("2" (INST + "system_state_witness") NIL))))))))))) (|system_cmp_thm_cc| "" (SKOSIMP) (("" (EXPAND "system") (("" (USE "system_composable") (("" (USE "system_tolerates_cct") (("" (USE "cmp_thm[(SYSTEM_STATE),THREAD]") (("1" (REWRITE "singleton_not_emptyset") (("1" (GROUND) (("1" (REWRITE "subset_singleton") (("1" (EXPAND "system_cmps") (("1" (PROPAX) NIL))))) ("2" (USE "cct") (("2" (USE "tcprop1[(SYSTEM_STATE), (CC_STATE), THREAD, THREAD]") (("1" (GROUND) NIL) ("2" (INST + "cc_state_witness") NIL) ("3" (INST + "system_state_witness") NIL))))))))) ("2" (INST + "system_state_witness") NIL))))))))))) (|system_cmp_thm_pt| "" (SKOSIMP) (("" (EXPAND "system") (("" (USE "system_composable") (("" (USE "system_tolerates_ptt") (("" (USE "cmp_thm[(SYSTEM_STATE),THREAD]") (("1" (REWRITE "singleton_not_emptyset") (("1" (GROUND) (("1" (REWRITE "subset_singleton") (("1" (EXPAND "system_cmps") (("1" (PROPAX) NIL))))) ("2" (USE "ptt") (("2" (USE "tcprop1[(SYSTEM_STATE), (PT_STATE), THREAD, THREAD]") (("1" (GROUND) NIL) ("2" (INST + "pt_state_witness") NIL) ("3" (INST + "system_state_witness") NIL))))))))) ("2" (INST + "system_state_witness") NIL))))))))))) (|system_cmp_thm_ks| "" (SKOSIMP) (("" (EXPAND "system") (("" (USE "system_composable") (("" (USE "system_tolerates_kst") (("" (USE "cmp_thm[(SYSTEM_STATE),THREAD]") (("1" (REWRITE "singleton_not_emptyset") (("1" (GROUND) (("1" (REWRITE "subset_singleton") (("1" (EXPAND "system_cmps") (("1" (PROPAX) NIL))))) ("2" (USE "kst") (("2" (USE "tcprop1[(SYSTEM_STATE), (KS_STATE), THREAD, THREAD]") (("1" (GROUND) NIL) ("2" (INST + "ks_state_witness") NIL) ("3" (INST + "system_state_witness") NIL))))))))) ("2" (INST + "system_state_witness") NIL))))))))))) (|system_cmp_thm_ssups| "" (SKOSIMP) (("" (EXPAND "system") (("" (USE "system_composable") (("" (USE "system_tolerates_ssupst") (("" (USE "cmp_thm[(SYSTEM_STATE),THREAD]") (("1" (REWRITE "singleton_not_emptyset") (("1" (GROUND) (("1" (REWRITE "subset_singleton") (("1" (EXPAND "system_cmps") (("1" (PROPAX) NIL))))) ("2" (USE "ssupst") (("2" (USE "tcprop1[(SYSTEM_STATE), (SSUPS_STATE), THREAD, THREAD]") (("1" (GROUND) NIL) ("2" (INST + "ssups_state_witness") NIL) ("3" (INST + "system_state_witness") NIL))))))))) ("2" (INST + "system_state_witness") NIL))))))))))) (|system_cmp_thm_client| "" (SKOSIMP) (("" (EXPAND "system") (("" (USE "system_composable") (("" (USE "system_tolerates_clientt") (("" (USE "cmp_thm[(SYSTEM_STATE),THREAD]") (("1" (REWRITE "singleton_not_emptyset") (("1" (GROUND) (("1" (REWRITE "subset_singleton") (("1" (EXPAND "system_cmps") (("1" (PROPAX) NIL))))) ("2" (USE "clientt") (("2" (USE "tcprop1[(SYSTEM_STATE), (CLIENT_STATE), THREAD, THREAD]") (("1" (GROUND) NIL) ("2" (INST + "client_state_witness") NIL) ("3" (INST + "system_state_witness") NIL))))))))) ("2" (INST + "system_state_witness") NIL))))))))))) (|system_cmp_thm_ss| "" (SKOSIMP) (("" (EXPAND "system") (("" (USE "system_composable") (("" (USE "system_tolerates_sst") (("" (USE "cmp_thm[(SYSTEM_STATE),THREAD]") (("1" (REWRITE "singleton_not_emptyset") (("1" (GROUND) (("1" (REWRITE "subset_singleton") (("1" (EXPAND "system_cmps") (("1" (PROPAX) NIL))))) ("2" (USE "sst") (("2" (USE "tcprop1[(SYSTEM_STATE), (SS_STATE), THREAD, THREAD]") (("1" (GROUND) NIL) ("2" (INST + "ss_state_witness") NIL) ("3" (INST + "system_state_witness") NIL))))))))) ("2" (INST + "system_state_witness") NIL)))))))))))) $$$system_props.pvs system_props: THEORY BEGIN IMPORTING system_cmp_thm IMPORTING client_props IMPORTING ks_props IMPORTING more_preds IMPORTING tpreds st, st1, st2 : VAR (SYSTEM_STATE) pf: VAR PROT_FAMILY clear, cypher: VAR TEXT ri: VAR RECEIVED_INFO p : VAR FSEQ[[ENCRYPT_MECH, KEY]] seed : VAR SEED key_mech : VAR KEY_MECH th: VAR (client_threads) t: VAR TEXT %% This is the top-level desired state predicate. We could try %% to prove it by decomposing it into other properties %% which eventually reduce to things you would prove about %% a single component (using the composition theorem to %% lift the result). sys_correct_encryption_pred : STATE_PRED[(SYSTEM_STATE),THREAD] = (LAMBDA st: (FORALL pf, clear, cypher: have_encrypted_text(client(st), pf, clear, cypher) => encrypted_with_pf(pf, clear, cypher))) sys_correct_encryption_thm: THEOREM sys_correct_encryption_pred = tmap(client2system_sttran, correct_encryption_pred) sys_correct_ppd_pred: STATE_PRED[(SYSTEM_STATE),THREAD] = (LAMBDA st: correct_ppd_def(client(st))) sys_correct_ppd_thm: THEOREM sys_correct_ppd_pred = tmap(client2system_sttran, correct_ppd_pred) correct_encryption_prop: THEOREM satisfies(system, pimplies(alwayss(sys_correct_ppd_pred), alwayss(sys_correct_encryption_pred))) sys_correct_ppd_prop: CONJECTURE satisfies(system, alwayss(sys_correct_ppd_pred)) sys_encrypts_correctly_prop: THEOREM satisfies(system, alwayss(sys_correct_encryption_pred)) END system_props $$$system_props.prf (|system_props| (|sys_correct_encryption_pred_TCC1| "" (INST + "system_state_witness") NIL) (|sys_correct_encryption_thm| "" (REWRITE "extensionality") (("" (HIDE 2) (("" (SKOSIMP) (("" (IFF) (("" (EXPAND "sys_correct_encryption_pred") (("" (EXPAND "tmap") (("" (EXPAND "client2system_sttran") (("" (EXPAND "correct_encryption_pred") (("" (EXPAND "member") (("" (GROUND) (("1" (INST + "client(x!1)") (("1" (GROUND) NIL))) ("2" (SKOSIMP*) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))) (|sys_correct_ppd_thm| "" (REWRITE "extensionality") (("" (HIDE 2) (("" (SKOSIMP) (("" (IFF) (("" (EXPAND "sys_correct_ppd_pred") (("" (EXPAND "tmap") (("" (EXPAND "client2system_sttran") (("" (EXPAND "correct_ppd_pred") (("" (EXPAND "correct_ppd_def") (("" (EXPAND "member") (("" (GROUND) (("1" (INST + "client(x!1)") (("1" (GROUND) NIL))) ("2" (SKOSIMP*) (("2" (INST?) (("2" (INST?) (("2" (INST?) (("2" (GROUND) NIL))))))))))))))))))))))))))))))) (|correct_encryption_prop| "" (REWRITE "sys_correct_ppd_thm") (("" (REWRITE "sys_correct_encryption_thm") (("" (CASE "(EXISTS (x: ((SYSTEM_STATE))): TRUE)") (("1" (CASE "(EXISTS (x: ((CLIENT_STATE))): TRUE)") (("1" (REWRITE "always_tmap[(SYSTEM_STATE),(CLIENT_STATE),THREAD, THREAD]" :SUBST ("agtran1" "system_agtran") :DIR RL) (("1" (REWRITE "always_tmap[(SYSTEM_STATE),(CLIENT_STATE),THREAD, THREAD]" :SUBST ("agtran1" "system_agtran") :DIR RL) (("1" (REWRITE "pimplies_pmap" :DIR RL) (("1" (USE "client_props.correct_encryption_prop") (("1" (LEMMA "system_cmp_thm_client") (("1" (INST?) (("1" (GROUND) (("1" (INST?) (("1" (GROUND) NIL))))))))))))))))) ("2" (INST + "client_state_witness") NIL))) ("2" (INST + "system_state_witness") NIL))))))) (|sys_encrypts_correctly_prop| "" (USE "sys_correct_ppd_prop") (("" (USE "correct_encryption_prop") (("" (USE "satisfies_modus_ponens[(SYSTEM_STATE),THREAD]") (("1" (GROUND) NIL) ("2" (INST + "system_state_witness") NIL))))))))