Spring 2014 Program Analysis and Verification. Lecture 6: Axiomatic Semantics III. Roman Manevich Ben-Gurion University

Transcription

1 Spring 2014 Program Analysis and Verification Lecture 6: Axiomatic Semantics III Roman Manevich Ben-Gurion University

2 Syllabus Semantics Static Analysis Abstract Interpretation fundamentals Analysis Techniques Crafting your own Natural Semantics Automating Hoare Logic Lattices Numerical Domains Soot Structural semantics Galois Connections CEGAR From proofs to abstractions Axiomatic Verification Fixed-Points Alias analysis Systematically developing transformers Widening/ Narrowing Shape Analysis Domain constructors Interprocedural Analysis 2

3 Previously Hoare logic Inference system Annotated programs Soundness and completeness Weakest precondition calculus 3

4 Axiomatic semantics for While [ass p ] [skip p ] { P[a/x] } x := a { P } { P } skip { P } [comp p ] { P } S 1 { Q }, { Q } S 2 { R } { P } S 1 ; S 2 { R } [if p ] { b P } S 1 { Q }, { b P } S 2 { Q } { P } if b then S 1 else S 2 { Q } [while p ] { b P } S { P } { P } while b do S { b P } [cons p ] { P } S { Q } { P } S { Q } if P P and Q Q 4

5 Weakest precondition calculus 5

6 Weakest liberal precondition A backward-going predicate transformer The weakest liberal precondition for Q is wlp(c, Q) if and only if for all states if C, then Q Propositions: 1. p { wlp(c, Q) } C { Q } 2. If p { P } C { Q } then P wlp(c, Q) 6

7 Weakest liberal precondition A backward-going predicate transformer The weakest liberal precondition for Q is wlp(c, Q) if and only if for all states if C, then Q wlp(c, Q) P Q C(wlp(C, Q)) C C(P) 7

8 Strongest postcondition A forward-going predicate transformer The strongest postcondition for P is sp(p, C) if and only if there exists such that P and C, Propositions: 1. p { P } C { sp(p, C) } 2. If p { P } C { Q } then sp(p, C) Q 8

9 Calculating Weakest preconditions By Vadim Plessky ( [see page for license], via Wikimedia Commons 9

10 Calculating wlp 1. wlp(skip, Q) = Q 2. wlp(x := a, Q) = Q[a/x] 3. wlp(s 1 ; S 2, Q) = wlp(s 1, wlp(s 2, Q)) 4. wlp(if b then S 1 else S 2, Q) = (b wlp(s 1, Q)) ( b wlp(s 2, Q)) 5. wlp(while b do S, Q) =? hard to capture 10

11 Calculating the wlp of a loop Idea: we know the following statements are semantically equivalent while b do S if b do (S; while b do S) else skip Let s try to substitute and calculate on wlp(while b do S, Q) = wlp(if b do (S; while b do S) else skip, Q) = (b wlp(s; while b do S, Q)) ( b wlp(skip, Q)) = (b wlp(s, wlp(while b do S, Q))) ( b Q) LoopInv = (b wlp(s, LoopInv)) ( b Q) 11

12 Another variant for WP of loops Parametric in the loop invariant wlp(while b do { } S, Q) = where {b } S { } and b Q 12

13 Variable swap program specify {? } t := x x := y y := t {? } 13

14 Prove using weakest precondition { y=b x=a } t := x {? } x := y {? } y := t { x=b y=a } 14

15 Prove using weakest precondition { y=b x=a } t := x { y=b t=a } x := y { x=b t=a } y := t { x=b y=a } 15

16 Absolute value program if x<0 then else x := -x skip if b then S is syntactic sugar for if b then S else skip The latter form is easier to reason about 16

17 Absolute value program specify {? } if x<0 then x := -x else skip {? } 17

18 Absolute value program specify { x=v } if x<0 then x := -x else skip { x= v } 18

19 Prove using weakest precondition { x=v } { } if x<0 then { } x := -x { } else { } skip { } {x= v } 19

20 Prove using weakest precondition { x=v } { (-x= v x<0) (x= v x 0) } if x<0 then { -x= v } x := -x { x= v } else { x= v } skip { x= v } { x= v } 20

21 Making the proof system more practical 21

22 Conjunction rule [conj p ] { P } S { Q } { P } S { Q } { P P } S {Q Q } Allows breaking up proofs into smaller, easier to manage, sub-proofs 22

23 Breaks if C is nondeterministic [disj p ] More useful rules { P } C { Q } { P } C { Q } { P P } C {Q Q } [exist p ] { P } C { Q } { v. P } C { v. Q } v FV(C) { P } C { Q } [univ p ] { v. P } C { v. Q } v FV(C) [Inv p ] { F } C { F } Mod(C) FV(F)={} Mod(C) = set of variables assigned to in sub-statements of C FV(F) = free variables of F 23

24 Invariance + Conjunction = Constancy [constancy p ] { P } C { Q } { F P } C { F Q } Mod(C) FV(F)={} Mod(C) = set of variables assigned to in sub-statements of C FV(F) = free variables of F 24

25 Today Strongest postcondition Extension for memory Proving termination 25

26 Strongest postcondition calculus By Vadim Plessky ( [see page for license], via Wikimedia Commons 26

27 Floyd s strongest postcondition rule [ass Floyd ] { P } x := a { v. x=a[v/x] P[v/x] } where v is a fresh variable The value of x in the pre-state Example { z=x } x:=x+1 {? } This rule is often considered problematic because it introduces a quantifier needs to be eliminated further on We will now see a variant of this rule 27

28 Floyd s strongest postcondition rule [ass Floyd ] { P } x := a { v. x=a[v/x] P[v/x] } where v is a fresh variable meaning: {x=z+1} Example { z=x } x:=x+1 { v. x=v+1 z=v } This rule is often considered problematic because it introduces a quantifier needs to be eliminated further on We will now see a variant of this rule 28

29 Small assignment axiom Create an explicit Skolem variable in precondition Then assign the resulting value to x First evaluate a in the precondition state (as a may access x) [ass floyd ] { x=v } x:=a { x=a[v/x] } where v FV(a) Examples: {x=n} x:=5*y {x=5*y} {x=n} x:=x+1 {x=n+1} {x=n} x:=y+1 {x=y+1} [exist p ] { n. x=n} x:=y+1 { n. x=y+1} therefore {true} x:=y+1 {x=y+1} [constancy p ] {z=9} x:=y+1 {z=9 x=y+1} 29

30 Small assignment axiom [ass { x=v } x:=a { x=a[v/x] } floyd ] Examples: {x=n} x:=5*y {x=5*y} {x=n} x:=x+1 {x=n+1} where v FV(a) {x=n} x:=y+1 {x=y+1} [exist p ] { n. x=n} x:=y+1 { n. x=y+1} therefore {true} x:=y+1 {x=y+1} [constancy p ] {z=9} x:=y+1 {z=9 x=y+1} 30

31 Small assignment axiom [ass { x=v } x:=a { x=a[v/x] } floyd ] Examples: {x=n} x:=5*y {x=5*y} {x=n} x:=x+1 {x=n+1} where v FV(a) {x=n} x:=y+1 {x=y+1} [exist p ] { n. x=n} x:=y+1 { n. x=y+1} therefore {true} x:=y+1 {x=y+1} [constancy p ] {z=9} x:=y+1 {z=9 x=y+1} 31

32 Small assignment axiom [ass { x=v } x:=a { x=a[v/x] } floyd ] Examples: {x=n} x:=5*y {x=5*y} {x=n} x:=x+1 {x=n+1} where v FV(a) {x=n} x:=y+1 {x=y+1} [exist p ] { n. x=n} x:=y+1 { n. x=y+1} therefore {true} x:=y+1 {x=y+1} [constancy p ] {z=9} x:=y+1 {z=9 x=y+1} 32

33 1. sp(skip, P) = P Calculating sp 2. sp(x := a, P) = v. x=a[v/x] P[v/x] 3. sp(s 1 ; S 2, P) = sp(s 2, sp(s 1, P)) 4. sp(if b then S 1 else S 2, P) = sp(s 1, b P) sp(s 2, b P) 5. sp(while b do { } S, P) = b where {b } S { } and P b 33

34 Prove using strongest postcondition { x=a y=b } t := x x := y y := t { x=b y=a } 34

35 Prove using strongest postcondition { x=a y=b } t := x { x=a y=b t=a } x := y y := t { x=b y=a } 35

36 Prove using strongest postcondition { x=a y=b } t := x { x=a y=b t=a } x := y { x=b y=b t=a } y := t { x=b y=a } 36

37 Prove using strongest postcondition { x=a y=b } t := x { x=a y=b t=a } x := y { x=b y=b t=a } y := t { x=b y=a t=a } { x=b y=a } // cons 37

38 Prove using strongest postcondition { x=v } if x<0 then { x=v x<0 } x := -x { x=-v x>0 } else { x=v x 0 } skip { x=v x 0 } { v<0 x=-v v 0 x=v } { x= v } 38

39 Prove using strongest postcondition { x=v } if x<0 then { x=v x<0 } x := -x { x=-v x>0 } else { x=v x 0 } skip { x=v x 0 } { v<0 x=-v v 0 x=v } { x= v } 39

40 Sum program specify Define Sum(0, n) = n {? } x := 0 res := 0 while (x<y) do res := res+x x := x+1 {? } { x=sum(0, n) } { y=n+1 } { x+y=sum(0, n+1) } Background axiom 40

41 Sum program specify Define Sum(0, n) = n { y 0 } x := 0 res := 0 while (x<y) do res := res+x x := x+1 { res = Sum(0, y) } { x=sum(0, n) } { y=n+1 } { x+y=sum(0, n+1) } Background axiom 41

42 Sum program prove Define Sum(0, n) = n { x=sum(0, n) } { y=n+1 } { x+y=sum(0, n+1) } { y 0 } x := 0 res := 0 Inv = while (x<y) do res := res+x x := x+1 { res = Sum(0, y) } 42

43 Sum program prove Define Sum(0, n) = n { x=sum(0, n) } { y=n+1 } { x+y=sum(0, n+1) } { y 0 } x := 0 { y 0 x=0 } res := 0 Inv = while (x<y) do res := res+x x := x+1 { res = Sum(0, y) } 43

44 Sum program prove Define Sum(0, n) = n { x=sum(0, n) } { y=n+1 } { x+y=sum(0, n+1) } { y 0 } x := 0 { y 0 x=0 } res := 0 { y 0 x=0 res=0 } Inv = while (x<y) do res := res+x x := x+1 { res = Sum(0, y) } 44

45 Sum program prove Define Sum(0, n) = n { x=sum(0, n) } { y=n+1 } { x+y=sum(0, n+1) } { y 0 } x := 0 { y 0 x=0 } res := 0 { y 0 x=0 res=0 } Inv = { y 0 res=sum(0, x) x y } while (x<y) do res := res+x x := x+1 { res = Sum(0, y) } 45

46 Sum program prove Define Sum(0, n) = n { x=sum(0, n) } { y=n+1 } { x+y=sum(0, n+1) } { y 0 } x := 0 { y 0 x=0 } res := 0 { y 0 x=0 res=0 } Inv = { y 0 res=sum(0, x) x y } while (x<y) do { y 0 res=m x=n n y m=sum(0, n) x<y } { y 0 res=m x=n m=sum(0, n) n<y } res := res+x x := x+1 { res = Sum(0, y) } 46

47 Sum program prove Define Sum(0, n) = n { x=sum(0, n) } { y=n+1 } { x+y=sum(0, n+1) } { y 0 } x := 0 { y 0 x=0 } res := 0 { y 0 x=0 res=0 } Inv = { y 0 res=sum(0, x) x y } while (x<y) do { y 0 res=m x=n n y m=sum(0, n) x<y } { y 0 res=m x=n m=sum(0, n) n<y } res := res+x { y 0 res=m+x x=n m=sum(0, n) n<y } x := x+1 { res = Sum(0, y) } 47

48 Sum program prove Define Sum(0, n) = n { x=sum(0, n) } { y=n+1 } { x+y=sum(0, n+1) } { y 0 } x := 0 { y 0 x=0 } res := 0 { y 0 x=0 res=0 } Inv = { y 0 res=sum(0, x) x y } while (x<y) do { y 0 res=m x=n n y m=sum(0, n) x<y } { y 0 res=m x=n m=sum(0, n) n<y } res := res+x { y 0 res=m+x x=n m=sum(0, n) n<y } x := x+1 { y 0 res=m+x x=n+1 m=sum(0, n) n<y } { y 0 res=sum(0, x) x=n+1 n<y } // sum axiom { y 0 res=sum(0, x) x y } // cons { res = Sum(0, y) } 48

49 Sum program prove Define Sum(0, n) = n { x=sum(0, n) } { y=n+1 } { x+y=sum(0, n+1) } { y 0 } x := 0 { y 0 x=0 } res := 0 { y 0 x=0 res=0 } Inv = { y 0 res=sum(0, x) x y } while (x<y) do { y 0 res=m x=n n y m=sum(0, n) x<y } { y 0 res=m x=n m=sum(0, n) n<y } res := res+x { y 0 res=m+x x=n m=sum(0, n) n<y } x := x+1 { y 0 res=m+x x=n+1 m=sum(0, n) n<y } { y 0 res=sum(0, x) x=n+1 n<y } // sum axiom { y 0 res=sum(0, x) x y } // cons { y 0 res=sum(0, x) x y x y } { y 0 res=sum(0, y) x=y } { res = Sum(0, y) } 49

50 Buggy sum program { y 0 } x := 0 { y 0 x=0 } res := 0 { y 0 x=0 res=0 } Inv = { y 0 res=sum(0, x) } = { y 0 res=m x=n m=sum(0, n) } while (x y) do { y 0 res=m x=n m=sum(0, n) x y n y } x := x+1 { y 0 res=m x=n+1 m=sum(0, n) n y} res := res+x { y 0 res=m+x x=n+1 m=sum(0, n) n y} { y 0 res-x=sum(0, x-1) n y} { y 0 res=sum(0, x) } { y 0 res=sum(0, x) x>y } {res = Sum(0, y) } 50

51 Handling data structures 51

52 Problems with Hoare logic and heaps { P[a/x] } x := a { P } Consider the annotated program { y=5 } y := 5; { y=5 } x := &y; { y=5 } *x := 7; { y=5 } Is it correct? The rule works on a syntactic level unaware of possible aliasing between different terms (y and *x in our case) 52

53 Problems with Hoare logic and heaps { P[a/x] } x := a { P } {(x=&y z=5) (x &y y=5)} *x = z; { y=5 } What should the precondition be? 53

54 Problems with Hoare logic and heaps { P[a/x] } x := a { P } {(x=&y z=5) (x &y y=5)} *x = z; { y=5 } We split into cases depending on possible aliasing 54

55 Problems with Hoare logic and heaps { P[a/x] } x := a { P } {(x=&y z=5) (x &y y=5)} *x = z; { y=5 } What should the precondition be? Joseph M. Morris: A General Axiom of Assignment A different approach: heaps as arrays Really successful approach for heaps is based on Separation Logic 55

56 Axiomatizing data types S ::= x := a x := y[a] y[a] := x skip S 1 ; S 2 if b then S 1 else S 2 while b do S We added a new type of variables array variables Model array variable as a function y : Z Z We need the two following axioms: { y[x a](x) = a } { z x y[x a](z) = y(z) } 56

57 Array update rules (wlp) S ::= x := a x := y[a] y[a] := x skip S 1 ; S 2 if b then S 1 else S 2 while b do S Treat an array assignment y[a] := x as an update to the array function y y := y[a x] meaning y = v. v=a? x : y(v) A very general approach allows handling many data types [array-update] { P[y[a x]/y] } y[a] := x { P } [array-load] { P[y(a)/x] } x := y[a] { P } 57

58 Array update rules (wlp) example Treat an array assignment y[a] := x as an update to the array function y y := y[a x] meaning y = v. v=a? x : y(v) [array-update] { P[y[a x]/y] } y[a] := x { P } {x=y[i 7](i)} y[i]:=7 {x=y(i)} {x=7} y[i]:=7 {x=y(i)} [array-load] { P[y(a)/x] } x := y[a] { P } {y(a)=7} x:=y[a] {x=7} 58

59 Array update rules (sp) In both rules v, g, and b are fresh [array-update F ] { x=v y=g a=b } y[a] := x { y=g[b v] } [array-load F ] { y=g a=b } x := y[a] { x=g(b) } 59

60 Example of proving program with arrays 60

61 Array-max program specify nums : array N : int // N stands for num s length { N 0 nums=orig_nums } x := 0 res := nums[0] while x < N if nums[x] > res then res := nums[x] x := x { x=n } 2. { m. (m 0 m<n) nums(m) res } 3. { m. m 0 m<n nums(m)=res } 4. { nums=orig_nums } 61

62 Array-max program nums : array N : int // N stands for num s length { N 0 nums=orig_nums } x := 0 res := nums[0] while x < N if nums[x] > res then res := nums[x] x := x + 1 Post 1 : { x=n } Post 2 : { nums=orig_nums } Post 3 : { m. 0 m<n nums(m) res } Post 4 : { m. 0 m<n nums(m)=res } 62

63 Proof strategy Prove each goal 1, 2, 3, 4 separately and use conjunction rule to prove them all After proving {N 0} C {x=n} {nums=orig_nums} C {nums=orig_nums} We have proved {N 0 nums=orig_nums} C {x=n nums=orig_nums} We can refer to assertions from earlier proofs in writing new proofs 63

64 Array-max example: Post 1 nums : array N : int // N stands for num s length { N 0 } x := 0 { N 0 x=0 } res := nums[0] { x=0 } Inv = { x N } while x < N { x=k k<n } if nums[x] > res then { x=k k<n } res := nums[x] { x=k k<n } { x=k k<n } x := x + 1 { x=k+1 k<n } { x N x N } { x=n } 64

65 Array-max example: Post 2 nums : array N : int // N stands for num s length { nums=orig_nums } x := 0 { nums=orig_nums } res := nums[0] { nums=orig_nums } Inv = { nums=orig_nums } while x < N { nums=orig_nums x < N } if nums[x] > res then { nums=orig_nums } res := nums[x] { nums=orig_nums } { nums=orig_nums } x := x + 1 { nums=orig_nums } { nums=orig_nums x N } { nums=orig_nums } 65

66 Array-max example: Post 3 nums : array { N 0 0 m<n } // N stands for num s length x := 0 { x=0 } res := nums[0] { x=0 res=nums(0) } Inv = { 0 m<x nums(m) res } while x < N { x=k res=ores 0 m<k nums(m) ores } if nums[x] > res then { nums(x)>ores res=ores x=k 0 m<k nums(m) ores } res := nums[x] { res=nums(x) nums(x)>ores x=k 0 m<k nums(m) ores } { x=k 0 m k nums(m) res } { (x=k 0 m k nums(m) res) (ores nums(x) res=ores x=k res=ores 0 m<k nums(m) ores)} { x=k 0 m k nums(m) res } x := x + 1 { x=k+1 0 m k nums(m) res } { 0 m<x nums(m) res } { x=n 0 m<x nums(m) res} [univ p ]{ m. 0 m<n nums(m) res } 66

67 Proving termination 67

68 Total correctness semantics for While [ass p ] [skip p ] [comp p ] [if p ] [while p ] [ P[a/x] ] x := a [ P ] [ P ] skip [ P ] [ P ] S 1 [ Q ], [ Q ] S 2 [ R ] [ P ] S 1 ; S 2 [ R ] [ b P ] S 1 [ Q ], [ b P ] S 2 [ Q ] [ P ] if b then S 1 else S 2 [ Q ] [ P(z+1) ] S [ P(z) ] [ z. P(z) ] while b do S [ P(0) ] P(z+1) b P(0) b [cons p ] [ P ] S [ Q ] [ P ] S [ Q ] if P P and Q Q 68

69 Total correctness semantics for While Rank, or Loop variant [ass p ] [skip p ] [comp p ] [if p ] [while p ] [ P[a/x] ] x := a [ P ] [ P ] skip [ P ] [ P ] S 1 [ Q ], [ Q ] S 2 [ R ] [ P ] S 1 ; S 2 [ R ] [ b P ] S 1 [ Q ], [ b P ] S 2 [ Q ] [ P ] if b then S 1 else S 2 [ Q ] [ b P t=k ] S [ P t<k ] [ P ] while b do S [ b P ] P t 0 [cons p ] [ P ] S [ Q ] [ P ] S [ Q ] if P P and Q Q 69

70 Proving termination There is a more general rule based on wellfounded relations Partial orders with no infinite strictly decreasing chains Exercise: write a rule that proves only that a program S, started with precondition P terminates [ ] S [ ] 70

71 Proving termination There is a more general rule based on wellfounded relations Partial orders with no infinite strictly decreasing chains Exercise: write a rule that proves only that a program S, started with precondition P terminates [ P ] S [ true ] 71

72 Array-max specify termination nums : array N : int // N stands for num s length x := 0 res := nums[0] Variant = [? ] while x < N if nums[x] > res then res := nums[x] x := x + 1 [? ] 72

73 Array-max specify termination nums : array N : int // N stands for num s length x := 0 res := nums[0] Variant = [ N-x ] while x < N [? ] if nums[x] > res then res := nums[x] x := x + 1 [? ] [ true ] 73

74 Array-max prove loop variant nums : array N : int // N stands for num s length x := 0 res := nums[0] Variant = [ t=n-x ] while x < N [ x<n N-x=k N-x 0 ] if nums[x] > res then res := nums[x] x := x + 1 // [ N-x<k N-x 0 ] [ true ] 74

75 Array-max prove loop variant nums : array N : int // N stands for num s length x := 0 res := nums[0] Variant = [ t=n-x ] while x < N Capture initial value of x, since it changes in the loop [ x=x0 x0<n N-x0=k N-x0 0 ] if nums[x] > res then res := nums[x] x := x + 1 // [ N-x<k N-x 0 ] [ true ] 75

76 Array-max prove loop variant nums : array N : int // N stands for num s length x := 0 res := nums[0] Variant = [ t=n-x ] while x < N [ x=x0 x0<n N-x0=k N-x0 0 ] if nums[x] > res then res := nums[x] [ x=x0 x0<n N-x0=k N-x0 0 ] // Frame x := x + 1 // [ N-x<k N-x 0 ] [ true ] 76

77 Array-max prove loop variant nums : array N : int // N stands for num s length x := 0 res := nums[0] Variant = [ t=n-x ] while x < N [ x=x0 x0<n N-x0=k N-x0 0 ] if nums[x] > res then res := nums[x] [ x=x0 x0<n N-x0=k N-x0 0 ] // Frame x := x + 1 [ x=x0+1 x0<n N-x0=k N-x0 0 ] // [ N-x<k N-x 0 ] [ true ] 77

78 Array-max prove loop variant nums : array N : int // N stands for num s length x := 0 res := nums[0] Variant = [ t=n-x ] while x < N [ x=x0 x0<n N-x0=k N-x0 0 ] if nums[x] > res then res := nums[x] [ x=x0 x0<n N-x0=k N-x0 0 ] // Frame x := x + 1 [ x=x0+1 x0<n N-x0=k N-x0 0 ] [ N-x<k N-x 0 ] // cons [ true ] 78

79 Zune calendar bug while (days > 365) { if (IsLeapYear(year)) { if (days > 366) { days -= 366; year += 1; } } } else { days -= 365; year += 1; } 79

80 Fixed code while (days > 365) { if (IsLeapYear(year)) { if (days > 366) { days -= 366; year += 1; } else { break; } } else { days -= 365; year += 1; } } 80

81 Fixed code specify termination [? ] while (days > 365) { if (IsLeapYear(year)) { if (days > 366) { days -= 366; year += 1; } else { break; } } else { days -= 365; year += 1; } } [? ] 81

82 Fixed code specify variant [ true ] Variant = [? ] while (days > 365) { if (IsLeapYear(year)) { if (days > 366) { days -= 366; year += 1; } else { break; } } else { days -= 365; year += 1; } [? ] } [ true ] 82

83 Fixed code proving termination [ true ] Variant = [ t=days ] while (days > 365) { [ days>365 days=k days 0 ] if (IsLeapYear(year)) { if (days > 366) { days -= 366; year += 1; } else { break; [ false ] } } else { days -= 365; year += 1; } // [ days 0 days<k ] } [ true ] Let s model break by a small cheat assume execution never gets past it 83

84 Fixed code proving termination [ true ] Variant = [ t=days ] while (days > 365) { [ days 0 k=days days>365 ] -> [ days 0 k=days days>365 ] if (IsLeapYear(year)) { } [ k=days days>365 ] if (days > 366) { [ k=days days>365 days>366 ] -> [ k=days days>366 ] days -= 366; [ days=k-366 days>0 ] year += 1; [ days=k-366 days>0 ] } else { [ k=days days>365 days 366 ] break; [ false ] } [ (days=k-366 days>0) false ] -> [ days<k days>0 ] } else { [ k=days days>365 ] days -= 365; [ k-365=days days-365>365 ] -> [ k-365=days days 0 ] -> [ days<k days 0 ] year += 1; [ days<k days 0 ] [ days<k days 0 ] } [ true ] 84

85 Challenge: proving non-termination Write a rule for proving that a program does not terminate when started with a precondition P Prove that the buggy Zune calendar program does not terminate [while-nt p ] { b P } S { b } { P } while b do S { false } 85

86 conclusion 86

87 Extensions to axiomatic semantics Assertions for execution time Exact time Order of magnitude time Assertions for dynamic memory Separation Logic Assertions for parallelism Owicki-Gries Concurrent Separation Logic Rely-guarantee 87

88 Axiomatic verification conclusion Very powerful technique for reasoning about programs Sound and complete Extendible Static analysis can be used to automatically synthesize assertions and loop invariants 88

89 Next lecture: static analysis