🤖 AI Summary
This work addresses the challenge of effectively integrating axiomatic program logics into refinement-based proofs to verify that implementations satisfy safety specifications. We present the first systematic unification of Hoare logic, Incorrectness Logic, Lisbon Logic, and Necessary Precondition Logic, establishing their correspondence with forward and backward simulation relations. Crucially, we reduce the verification of these simulation relations to the validity of standard program logic triples, thereby enabling refinement proofs to directly leverage existing verification tools. As a practical demonstration, we successfully propagate the safety bound of an atomic sequential counter through an intermediate concurrent model to its Left-Right concurrent implementation, confirming both the practicality and effectiveness of our framework.
📝 Abstract
Refinement proofs verify an implementation by showing that its behaviours are subsumed by a simpler specification, on which safety properties are easier to establish. We study how such proofs interact with the axiomatic program logics used to verify the specification. We first give a uniform account of Hoare, Incorrectness, Lisbon, and Necessary-Preconditions logic, classified by the direction in which each constrains a transition and by whether it over- or under-approximates its target set. We then show that simulation relations transfer state-based safety properties: a forward simulation carries a Hoare (inductive) invariant of the specification to one of the implementations, and forward and backward simulations both carry ordinary invariants, via the pre-image of the relation. Finally, we characterize, within these logics, when a relation is a simulation, forward simulations by the validity of Hoare or Lisbon triples, backward simulations by Necessary-Preconditions or Incorrectness triples, so that the simulation obligation reduces to a triple in an off-the-shelf functional logic. We illustrate the development with a concurrent counter, transporting a safety bound from an atomic sequential specification to a Left--Right implementation through an intermediate nondeterministic-concurrent counter, with a forward simulation on one side and a backward simulation on the other.