Program Analysis and Verification

Transcription

1 Program Analysis and Verification Noam Rinetzky Lecture 4: Axiomatic Semantics Slides credit: Tom Ball, Dawson Engler, Roman Manevich, Erik Poll, Mooly Sagiv, Jean Souyris, Eran Tromer, Avishai Wool, Eran Yahav

2 Natural semantics for While [ass ns ] [skip ns ] x := a, s s[x A a s] skip, s s [comp ns ] S 1, s s, S 2, s s S 1 ; S 2, s s [if tt ns] S 1, s s if b then S 1 else S 2, s s if B b s = tt [if ff ns] S 2, s s if b then S 1 else S 2, s s if B b s = ff 2

3 Natural semantics for While [while ff ns] while b do S, s s if B b s = ff [while tt ns] S, s s, while b do S, s s while b do S, s s if B b s = tt 3

4 Axiomatic semantics for While [ass p ] [skip p ] { P[a/x] } x := a { P } { P } skip { P } [comp p ] { P } S 1 { Q }, { Q } S 2 { R } { P } S 1 ; S 2 { R } [if p ] { b P } S 1 { Q }, { b P } S 2 { Q } { P } if b then S 1 else S 2 { Q } [while p ] { b P } S { P } { P } while b do S { b P } [cons p ] { P } S { Q } { P } S { Q } if P P and Q Q 4

5 Assertions, a.k.a Hoare triples { P } C { Q } precondition statement a.k.a command postcondition P and Q are state predicates Example: x>0 If P holds in the initial state, and if execution of C terminates on that state, then Q will hold in the state in which C halts C is not required to always terminate {true} while true do skip {false} 5

6 Valid assertions We say that { P } C { Q } is valid if for all states s, if s P and C, s s then s Q Denoted by p { P } C { Q } Q P s C C(P) s 6

7 Assignment rule [ass p ] { P[a/x] } x := a { P } A backwards rule x := a always finishes Why is this true? Recall operational semantics: s[x A a s] P [ass ns ] x := a, s s[x A a s] Example: {y*z<9} x:=y*z {x<9} What about {y*z<9 w=5} x:=y*z {w=5}? 7

8 Assignment rule [ass p ] { P} x := a { v.p[v/x] x=a[v/x] } A forward rule x := a always finishes Why is this true? s P s[v sx] P[v/x] 8

9 skip rule [skip p ] { P } skip { P } [skip ns ] skip, s s 9

10 Composition rule [comp p ] { P } S 1 { Q }, { Q } S 2 { R } { P } S 1 ; S 2 { R } [comp ns ] S 1, s s, S 2, s s S 1 ; S 2, s s Holds when S 1 terminates in every state where P holds and then Q holds and S 2 terminates in every state where Q holds and then R holds 10

11 Condition rule [if p ] { b P } S 1 { Q }, { b P } S 2 { Q } { P } if b then S 1 else S 2 { Q } [if tt ns] [if ff ns] S 1, s s if b then S 1 else S 2, s s S 2, s s if b then S 1 else S 2, s s if B b s = tt if B b s = ff 11

12 Loop rule [while p ] { b P } S { P } { P } while b do S { b P } [while ff ns] [while tt ns] while b do S, s s S, s s, while b do S, s s while b do S, s s if B b s = ff if B b s = tt Here P is called an invariant for the loop Holds before and after each loop iteration Finding loop invariants most challenging part of proofs When loop finishes, b is false 12

13 Rule of consequence [cons p ] { P } S { Q } { P } S { Q } if P P and Q Q Allows strengthening the precondition and weakening the postcondition The only rule that is not sensitive to the form of the statement 13

14 Rule of consequence [cons p ] { P } S { Q } { P } S { Q } if P P and Q Q Why do we need it? Allows the following {y*z<9} x:=y*z {x<9} {y*z<9 w=5} x:=y*z {x<10} 14

15 Axiomatic semantics for While Axiom for every primitive statement [ass p ] { P[a/x] } x := a { P } [skip p ] { P } skip { P } [comp p ] { P } S 1 { Q }, { Q } S 2 { R } { P } S 1 ; S 2 { R } Inference rule for every composed statement [if p ] [while p ] { b P } S 1 { Q }, { b P } S 2 { Q } { P } if b then S 1 else S 2 { Q } { b P } S { P } { P } while b do S { b P } [cons p ] { P } S { Q } { P } S { Q } if P P and Q Q 15

16 Properties of the semantics Equivalence What is the analog of program equivalence in axiomatic verification? Soundness Can we prove incorrect properties? Completeness Is there something we can t prove? 16

17 Valid assertions We say that { P } C { Q } is valid if for all states s, if s P and C, s s then s Q Denoted by p { P } C { Q } Q P s C C(P) s 17

18 Soundness and completeness The inference system is sound: p { P } C { Q } implies p { P } C { Q } The inference system is complete: p { P } C { Q } implies p { P } C { Q } 18

19 Soundness: Hoare logic is sound and (relatively) complete p { P } C { Q } implies p { P } C { Q } (Relative) completeness: p { P } C { Q } implies p { P } C { Q } Provided we can prove any implication R R 19

20 Soundness: Hoare logic is sound and (relatively) complete p { P } C { Q } implies p { P } C { Q } (Relative) completeness: p { P } C { Q } implies p { P } C { Q } Provided we can prove any implication R R FYI, nobody tells us how to find a proof 20

21 Is there an Algorithm? { x=n } y := 1; { x>0 y*x!=n! n x } while (x=1) do { x-1>0 (y*x)*(x-1)!=n! n (x-1) } y := y*x; { x-1>0 y*(x-1)!=n! n (x-1) } x := x 1 { y*x!=n! n>0 } Annotated programs provides a compact representation of inference trees 21

22 ? 22

23 Predicate Transformers 23

24 Weakest liberal precondition A backward-going predicate transformer The weakest liberal precondition for Q is s wlp(c, Q) if and only if for all states s if C, s s then s Q Propositions: 1. p { wlp(c, Q) } C { Q } 2. If p { P } C { Q } then P wlp(c, Q) 24

25 Strongest postcondition A forward-going predicate transformer The strongest postcondition for P is s sp(p, C) if and only if there exists s such that if C, s s and s P 1. p { P } C { sp(p, C) } 2. If p { P } C { Q } then sp(p, C) Q 25

26 Predicate transformer semantics wlp and sp can be seen functions that transform predicates to other predicates wlp C : Predicate Predicate { P } C { Q } if and only if wlp C Q = P sp C : Predicate Predicate { P } C { Q } if and only if sp C P = Q 26

27 Hoare logic is (relatively) complete Proving p { P } C { Q } implies p { P } C { Q } is the same as proving p { wlp(c, Q) } C { Q } Suppose that p { P } C { Q } then (from proposition 2) P { wlp(c, Q) } [cons p ] { P } S { Q } { wlp(c, Q) } S { Q } 27

28 Calculating wlp 1. wlp(skip, Q) = Q 2. wlp(x := a, Q) = Q[a/x] 3. wlp(s 1 ; S 2, Q) = wlp(s 1, wlp(s 2, Q)) 4. wlp(if b then S 1 else S 2, Q) = (b wlp(s 1, Q)) ( b wlp(s 2, Q)) 5. wlp(while b do S, Q) =? hard to capture 28

29 Calculating wlp of a loop Idea: we know the following statements are semantically equivalent while b do S if b do (S; while b do S) else skip Let s try to substitute and calculate on wlp(while b do S, Q) = wlp(if b do (S; while b do S) else skip, Q) = (b wlp(s; while b do S, Q)) ( b wlp(skip, Q)) = (b wlp(s, wlp(while b do S, Q))) ( b Q) LoopInv = (b wlp(s, LoopInv)) ( b Q) We have a recurrence The loop invariant 29

30 Prove the following triple { timer 0 } while (timer > 0) do timer := timer 1 { timer = 0 } LoopInv = (b wlp(s, LoopInv)) ( b Q) Let s substitute LoopInv with timer 0 Show that timer 0 is equal to (timer>0 wlp(timer:=timer-1, timer 0)) (timer 0 timer=0) = (timer>0 (timer 0)[timer-1/timer]) (timer 0 timer=0) = (timer>0 timer-1 0) (timer 0 timer=0) = timer>0 timer=0 = timer 0 30

31 Issues with wlp-based proofs Requires backwards reasoning not very intuitive Backward reasoning is non-deterministic causes problems when While is extended with dynamically allocated heaps (aliasing) Also, a few more rules will be helpful 31

32 Conjunction rule [conj p ] { P } S { Q } { P } S { Q } { P P } S {Q Q } Not necessary (for completeness) but practically useful Starting point of extending Hoare logic to handle parallelism Related to Cartesian abstraction Will point this out when we learn it 32

33 Structural Rules [disj p ] { P } C { Q } { P } C { Q } { P P } C {Q Q } [exist p ] [univ p ] { P } C { Q } { v. P } C { v. Q } { P } C { Q } { v. P } C { v. Q } v FV(C) v FV(C) [Inv p ] { F } C { F } Mod(C) FV(F)={} Mod(C) = set of variables assigned to in sub-statements of C FV(F) = free variables of F 33

34 Invariance + Conjunction = Constancy [constancy p ] { P } C { Q } { F P } C { F Q } Mod(C) FV(F)={} Mod(C) = set of variables assigned to in sub-statements of C FV(F) = free variables of F 34

35 Floyd s strongest postcondition rule [ass Floyd ] { P } x := a { v. x=a[v/x] P[v/x] } where v is a fresh variable Example { z=x } x:=x+1 {? v. x=v+1 z=v } This rule is often considered problematic because it introduces a quantifier needs to be eliminated further on We will now see a variant of this rule 35

36 Small assignment axiom Create an explicit Skolem variable in precondition Then assign the resulting value to x First evaluate a in the precondition state (as a may access x) [ass floyd ] { x=v } x:=a { x=a[v/x] } where v FV(a) Examples: {x=n} x:=5*y {x=5*y} {x=n} x:=x+1 {x=n+1} {x=y} x:=y+1 {x=y+1} {x=n} x:=y+1 {x=y+1} [exist p ] { n. x=n} x:=y+1 { n. x=y+1} therefore {true} x:=y+1 {x=y+1} [constancy p ] {z=9} x:=y+1 {z=9 x=y+1} 36

37 Small assignment axiom [ass { x=v } x:=a { x=a[v/x] } floyd ] Examples: {x=n} x:=5*y {x=5*y} {x=n} x:=x+1 {x=n+1} where v FV(a) {x=n} x:=y+1 {x=y+1} [exist p ] { n. x=n} x:=y+1 { n. x=y+1} therefore {true} x:=y+1 {x=y+1} [constancy p ] {z=9} x:=y+1 {z=9 x=y+1} 43

38 Small assignment axiom [ass { x=v } x:=a { x=a[v/x] } floyd ] Examples: {x=n} x:=5*y {x=5*y} {x=n} x:=x+1 {x=n+1} where v FV(a) {x=n} x:=y+1 {x=y+1} [exist p ] { n. x=n} x:=y+1 { n. x=y+1} therefore {true} x:=y+1 {x=y+1} [constancy p ] {z=9} x:=y+1 {z=9 x=y+1} 44

39 Example 1: Absolute value program { } if x<0 then x := -x else skip { } 48

40 Absolute value program { x=v } if x<0 then { x=v x<0 } x := -x { x=-v x>0 } else { x=v x 0 } skip { x=v x 0 } { v<0 x=-v v 0 x=v} { x= v } 49

41 Example 2: Variable swap program { } t := x x := y y := t { } 50

42 Variable swap program { x=a y=b } t := x { x=a y=b t=a } x := y { x=b y=b t=a } y := t { x=b y=a t=a } { x=b y=a } // cons 51

43 Example 3: Axiomatizing data types S ::= x := a x := y[a] y[a] := x skip S 1 ; S 2 if b then S 1 else S 2 while b do S We added a new type of variables array variables Model array variable as a function y : Z Z We need the two following axioms: { y[x a](x) = a } { z x y[x a](z) = y(z) } 52

44 Array update rules (wp) S ::= x := a x := y[a] y[a] := x skip S 1 ; S 2 if b then S 1 else S 2 A very general approach allows handling many data types while b do S Treat an array assignment y[a] := x as an update to the array function y y := y[a x] meaning y = v. v=a? X : y(v) [array-update] { P[y[a x]/y] } y[a] := x { P } [array-load] { P[y(a)/x] } x := y[a] { P } 53

45 Array update rules (wp) example Treat an array assignment y[a] := x as an update to the array function y y := y[a x] meaning y = v. v=a? x : y(v) [array-update] { P[y[a x]/y] } y[a] := x { P } {x=y[i 7](i)} y[i]:=7 {x=y(i)} {x=7} y[i]:=7 {x=y(i)} [array-load] { P[y(a)/x] } x := y[a] { P } {y(a)=7} x:=y[a] {x=7} 54

46 Array update rules (sp) In both rules v, g, and b are fresh [array-update F ] { x=v y=g a=b } y[a] := x { y=g[b v] } [array-load F ] { y=g a=b } x := y[a] { x=g(b) } 55

47 Array-max program nums : array N : int // N stands for num s length { N 0 nums=orig_nums } x := 0 res := nums[0] while x < N if nums[x] > res then res := nums[x] x := x { x=n } 2. { m. (m 0 m<n) nums(m) res } 3. { m. m 0 m<n nums(m)=res } 4. { nums=orig_nums } 56

48 Array-max program nums : array N : int // N stands for num s length { N 0 nums=orig_nums } x := 0 res := nums[0] while x < N if nums[x] > res then res := nums[x] x := x + 1 Post 1 : { x=n } Post 2 : { nums=orig_nums } Post 3 : { m. 0 m<n nums(m) res } Post 4 : { m. 0 m<n nums(m)=res } 57

49 Summary C programming language P assertions {P} C {Q} judgments { P[a/x] } x := a { P } proof Rules Soundness Completeness {x = N} y:=factorial(x){ y = N!} proofs 58

50 Extensions to axiomatic semantics Procedures Total correctness assertions Assertions for execution time Exact time Order of magnitude time Assertions for dynamic memory Separation Logic Assertions for parallelism Owicki-Gries Concurrent Separation Logic Rely-guarantee 59

51 Concurrency Operational Semantics

52 While + Concurrency Abstract syntax: a ::= n x a 1 + a 2 a 1 a 2 a 1 a 2 b ::= true false a 1 = a 2 a 1 a 2 b b 1 b 2 S ::= x := a skip S 1 ; S 2 if b then S 1 else S 2 while b do S cobegin S 1 S n coend 69

53 While + Concurrency cobegin S 1 S n coend All the interleaving of S 1 S n are executed Example: cobegin x:=1 (x:=2; x:=x+2) Possible outcomes for x: 1, 3, 4 70

54 While + parallelism: structural semantics [par 1 sos] S 1, s S 1, s S 1 S 2, s S 1 S 2, s [par 2 sos] S 1, s s S 1 S 2, s S 2, s [par 3 sos] S 2, s S 2, s S 1 S 2, s S 1 S 2, s [par 4 sos] S 2, s s S 1 S 2, s S 1, s 71

55 Example: derivation sequences of a parallel statement x:=1 (x:=2; x:=x+2), s 72

56 Concurrency Axiomatic Semantics

57 Axiomatic semantics for While Axiom for every primitive statement [ass p ] { P[a/x] } x := a { P } [skip p ] { P } skip { P } [comp p ] { P } S 1 { Q }, { Q } S 2 { R } { P } S 1 ; S 2 { R } Inference rule for every composed statement [if p ] [while p ] { b P } S 1 { Q }, { b P } S 2 { Q } { P } if b then S 1 else S 2 { Q } { b P } S { P } { P } while b do S { b P } [cons p ] { P } S { Q } { P } S { Q } if P P and Q Q 75

58 Proofs { P 1 } S 1 { Q 2 } { P 2 } S 2 { Q 2 } {P 1 Λ P 1 } S 1 S 2 { Q 2 Λ Q 2 } Challenge: Interference 76

59 Axiomatic Semantics (Hoare Logic) Disjoint parallelism Global invariant Owicky Gries [PhD. 76] { P } S 1 S 2 { Q } Rely/Guarantee [Jones. ] 77

60 Disjoint Parallelism { P 1 } S 1 { Q 2 } { P 2 } S 2 { Q 2 } {P 1 Λ P 1 } S 1 S 2 { Q 2 Λ Q 2 } FV(P 1,S 1,Q 1 ) FV(P 2,S 2,Q 2 ) = 78

61 Global Invariant I { P 1 } S 1 { Q 2 } I { P 2 } S 2 { Q 2 } I {P 1 Λ P 1 } S 1 S 2 { Q 2 Λ Q 2 } FV(P 1,S 1,Q 1 ) FV(P 2,S 2,Q 2 ) = FV(I) FV(P 1,Q 1 ) FV(P 2,Q 2 ) = FV(P i,q i ) FV(I) = i=1,2 79

62 Meaning of (atomic) Commands A relation between pre-states and post-states c c 0 c 1 c k S 0, s 0 S 1, s 1 s k+1 80

63 Meaning of (atomic) Commands A relation between pre-states and post-states c c 0 c 1 c k S 0, s 0 S 1, s 1 s k+1 81

64 Meaning of (atomic) Commands A relation between pre-states and post-states c 0 c 1 c k c k+1 c k+2 c k+3 c k+3 c n S 0, s 0 s 1 s k+1 s k+2 s k+3 s k+3 s k+4 s n+1 82

65 Intuition: Global Invariant Every (intermediate) state satisfies invariant I c 0 c 1 c k c k+1 c k+2 c k+3 c k+3 c n S 0, s 0 s 1 s k+1 s k+2 s k+3 s k+3 s k+4 s n+1 I= 83

66 Intuition: Global Invariant Thread-view c 0 c 1 c k c k+1 c k+2 c k+3 c k+3 c n S 0, s 0 s 1 s k+1 s k+2 s k+3 s k+3 s k+4 s n+1 I= 84

67 Global Invariant I { P } S 1 { R } I { R } S 2 { Q } I { P } S 1 ; S 2 { Q } I { P 1 } S 1 { Q 2 } I { P 2 } S 2 { Q 2 } I {P 1 Λ P 1 } S 1 S 2 { Q 2 Λ Q 2 } 85

68 Global Invariant I { P } S 1 { R } I { R } S 2 { Q } I { P } S 1 ; S 2 { Q } { P Λ I } S { Q Λ I } I { P } S { Q } I { P 1 } S 1 { Q 2 } I { P 2 } S 2 { Q 2 } I {P 1 Λ P 1 } S 1 S 2 { Q 2 Λ Q 2 } FV(P 1,S 1,Q 1 ) FV(P 2,S 2,Q 2 ) = FV(I) FV(P 1,Q 1 ) FV(P 2,Q 2 ) = FV(P i,q i ) FV(I) = i=1,2 86

69 Owicki-Gries Reasoning Susan Owicki David Gries 87

70 Owicky-Gries: Interference in Proofs A command C with a precondition pre(c) does not interfere with the proof of {P} S {Q} if: {Q pre(c) } C {Q} For any S S: {pre(s ) pre(c) } C {pre(s )} {P 1 } C 1 {Q 1 }... {P k } C k {Q k } are interference free if i j and x:=a C i, x:=a does not interfere with {P j } C j {Q j } 88

71 Parallel Composition Rule I { P 1 } S 1 { Q 2 } I { P 2 } S 2 { Q 2 } I {P 1 Λ P 1 } S 1 S 2 { Q 2 Λ Q 2 } {P 1 } C 1 {Q 1 }... {P k } C k {Q k } are interference free 89

72 90

73 91

74 92

75 93

76 94

77 95

78 96

79 97

80 98

81 99

82 10

83 101

84 102

85 103

86 104

87 105

88 Owicky-Gries: Limiations Checking interference can be hard Non-compositionality Until you finished the local proofs cannot check interference Proofs need to be saved Hard to handle libraries and missing code A non-standard meaning of Hoare triples Depends on the interference of other threads with the proof Soundness is non-trivial Completeness depends on auxiliary variables 106

89 Rely/Guarantee Reasoning Cliff Jones 107

90 Rely / Guarantee Aka assume Guarantee Cliff Jones Main idea: Modular capture of interference Compositional proofs 108

91 Commands as relations It is convenient to view the meaning of commands as relations between pre-states and post-states In {P} C {Q} P is a one state predicate Q is a two-state predicate Recall auxiliary variables Example {true} x := x + 1 {x= x + 1} 109

92 Intuition: Rely Guarantee Thread-view c 0 c 1 c k c k+1 c k+2 c k+3 c k+3 c n S 0, s 0 s 1 s k+1 s k+2 s k+3 s k+3 s k+4 s n+1 110

93 Intuition: Rely Guarantee Thread-view c 0 c 1 c k c k+1 c k+2 c k+3 c k+3 c n S 0, s 0 s 1 s k+1 s k+2 s k+3 s k+3 s k+4 s n+1 G RRRR G G R G RRRR 111

94 Intuition: Rely Guarantee Thread-view c 0 c 1 c k c k+1 c k+2 c k+3 c k+3 c n S 0, s 0 s 1 s k+1 s k+2 s k+3 s k+3 s k+4 s n+1 G R * G G R * G R * 112

95 Relational Post-Conditions meaning of commands a relations between pre-states and post-states Option I: {P} C {Q} P is a one state predicate Q is a two-state predicate Example {true} x := x + 1 {x= x + 1} 113

96 Relational Post-Conditions meaning of commands a relations between pre-states and post-states Option II: {P} C {Q} P is a one state predicate P is a one-state predicate Use logical variables to record pre-state Example {x = X} x := x + 1 {x= X + 1} 114

97 Intuition (again) Hoare: { P } S { Q } ~ {P} {Q} R/G: R,G { P } S { Q } ~ {P} {Q} C C R G R R G G G 115

98 Goal: Parallel Composition R G 2, G 1 { P } S 1 S 2 { Q } R G 1, G 2 { P } S 1 S 2 { Q } (PAR) R, G 1 G 2 { P } S 1 S 2 { Q } 116

99 Relational Post-Conditions meaning of commands a relations between pre-states and post-states Option I: {P} C {Q} P is a one state predicate Q is a two-state predicate Example {true} x := x + 1 {x= x + 1} 117

100 From one- to two-state relations p(, ) =p( ) p(, ) =p( ) A single state predicate p is preserved by a two-state relation R if p R p, : p( ) R(, ) p( ) 118

101 Operations on Relations (P;Q)(, )= :P(, ) Q(, ) ID(, )= ( = ) R * =ID R (R;R) (R;R;R) 119

102 Formulas ID(x) = (x = x) ID(p) =(p p) Preserve (p)= p p 120

103 Informal Semantics c (p, R, G, Q) For every state such that p: Every execution of c on state with (potential) interventions which satisfy R results in a state such that (, ) Q The execution of every atomic sub-command of c on any possible intermediate state satisfies G 121

104 Informal Semantics c (p, R, G, Q) For every state such that p: Every execution of c on state with (potential) interventions which satisfy R results in a state such that (, ) Q The execution of every atomic sub-command of c on any possible intermediate state satisfies G c [p, R, G, Q] For every state such that p: Every execution of c on state with (potential) interventions which satisfy R must terminate in a state such that (, ) Q The execution of every atomic sub-command of c on any possible intermediate state satisfies G 122

105 A Formal Semantics Let C R denotes the set of quadruples < 1, 2, 3, 4 > s.t. that when c executes on 1 with potential interferences by R it yields an intermediate state 2 followed by an intermediate state 3 and a final state 4 as usual 4 = when c does not terminate C R = {< 1, 2, 3, 4 > : : < 1, > R ( <C, > * 2 2 = 3 = 4, C : <C, > * <C, > ( ( 2 = 1 2 = ) ( 3 = 3 = ) 4 = ) <, 2, 3, 4 > C R ) c (p, R, G, Q) For every < 1, 2, 3, 4 > C R such that 1 p < 2, 3 > G If 4 : < 1, 4 > Q 123

106 Simple Examples X := X + 1 (true, X=X, X =X+1 X=X, X =X+1) X := X + 1 (X 0, X X, X>0 X=X, X>0) X := X + 1 ; Y := Y + 1 (X 0 Y 0, X X Y Y, G, X>0 Y>0) 124

107 Inference Rules Define c (p, R, G, Q) by structural induction on c Soundness If c (p, R, G, Q) then c (p, R, G, Q) 125

108 Atomic Command {p} c {Q} (Atomic) atomic {c} (p, preserve(p), Q ID, Q) 126

109 Conditional Critical Section {p b} c {Q} (Critical) await b then c (p, preserve(p), Q ID, Q) 127

110 Sequential Composition c 1 (p 1, R, G, Q 1 ) c 2 (p 2, R, G, Q 2 ) Q 1 p 2 (SEQ) c 1 ; c 2 (p 1, R, G, (Q 1 ; R * ; Q 2 )) 128

111 Conditionals c 1 (p b 1, R, G, Q) p b R * b 1 c 2 (p b 2, R, G, Q) p b R* b 2 (IF) if atomic {b} then c 1 else c 2 (p, R, G, Q) 129

112 Loops c (j b 1, R, G, j) j b R * b 1 R Preserve(j) (WHILE) while atomic {b} do c (j, R, G, b j) 130

113 Refinement c (p, R, G, Q) p p Q Q R R G G (REFINE) c (p, R, G, Q ) 131

114 Parallel Composition c 1 (p 1, R 1, G 1, Q 1 ) c 2 (p 2, R 2, G 2, Q 2 ) G 1 R 2 G 2 R 1 (PAR) c 1 c 2 (p 1 p 1, (R 1 R2), (G 1 G 2 ), Q) where Q= (Q 1 ; (R 1 R 2 )*; Q 2 ) (Q 2 ; (R 1 R 2 )*; Q 1 ) 132

115 13

116 13

117 13

118 13

119 13

120 13

121 13

122 14

123 14

124 14

125 14

126 14

127 14

128 14

129 14

130 Issues in R/G Total correctness is trickier Restrict the structure of the proofs Sometimes global proofs are preferable Many design choices Transitivity and Reflexivity of Rely/Guarantee No standard set of rules Suitable for designs 148