Programming Languages

Transcription

1 CSE 230: Winter 2008 Principles of Programming Languages Lecture 6: Axiomatic Semantics Deriv. Rules for Hoare Logic `{A} c {B} Rules for each language construct ` {A} c 1 {B} ` {B} c 2 {C} ` {A} skip {A} ` {A} c 1 ; c 2 {C} ` {A Æ b} c 1 {B} `{A { Æ b} } c 2 {B} ` {A} if b then c 1 else c 2 {B} Ranjit Jhala UC San Diego ` {A Æ b} c {A} ` {A} while b do c {AÆ b} ` {[e/x]a} x:=e {A} And the rule of consequence ree and Bound Variables Key idea in logic/pl: scoping & substitution Assertions are equivalent up to renaming of bound variables (a.k.a. alpha-renaming) Examples: x.x = x is the same as y.y = y Renamebound x with y x. y.x = y is the same as z. x.z = x Renamebound x with z and y with x Substitution [e /x] eis substituting e for x in e Also written as e[e /x] Note: only substitute the free occurrences Alpha-rename bound variables to avoid conflicts o subst. [e /x] in y.x y = y rename y if it occurs in e Result of alpha-renaming: z. e = z We say that substitution i avoids variable capture [ x/z ] x.z = x is? x.x x = x Wrong y.x = y Correct

2 Other Hoare Rules Multiple rules possible for some constructs ` {A} x:=e { x 0.[x 0 /x]a Æ x=[x 0 /x]e} ` A Æ b I ` {I} c {A} ` AÆ b B ` {A} while b do c {B} Exercise: Derive new rules from old ones using the rule of consequence Example: Assignment Assume x does not appear in e Prove {true} x:=e { x = e } As [e/x](x = e) e = [e/x]e e = e Use assignment rule then use consequence rule x does not appear in e true e = e ` {e = e} x:=e {x = e} ` {true} x:=e {x = e} Example: Conditional Prove: {true} if y 0 then x:=1 else x:=y {x>0} trueæy 0 1>0 ` {1>0} x:=1 {x>0} trueæy>0 y>0 ` {y>0} x:=y{x>0} ` {trueæy 0} x:=1 {x>0} ` {trueæy>0} x:=y {x>0} ` {true} if y 0 then x:=1 else x:=y {x > 0} Rule for if-then-else Rule for assignment + consequence Example: Loop Prove: ` {x 0} while x 5 do x:=x+1 {x=6} Use the rule for while with invariant x 6: x 6 Æ x 5 x+1 6 ` {x+1 6} x:=x+1 {x 6} ` {x 6 Æ x 5} x:=x+1 {x 6} ` {x 6} while x 5 do x:=x+1 {x 6 Æ x>5} inish off with consequence rule: x 0 x 6 ` {x 6} while {x 6Æx>5} x 6Æx>5 x=6 ` {x 0} while {x = 6}

3 Soundness of Axiomatic Semantics ormal statement of soundness: If ` {A} c {B} then ² {A} c {B} Proof: or, equivalently If H:: ` {A} c {B} then for all σ st s.t. σ ² A and D::<c,σ> σ we have σ ² B simultaneous induction on structure t of D and H Program Verification Hoare rules mostly syntax directed, but: When to apply the rule of consequence? What invariant to use for while? How to prove implications (in conseq rule)? he last one involves theorem proving: Doable Loop invariants are the hardest problem echnique: Weakest Preconditions ` { y >10 } x := y {x > 0} ` { y >100 } x := y {x > 0} ` { x=2 Æ y=5 } x := y {x > 0} After what preconditions does postcond. x>0 hold? WP(c,B): weakest predicate s.t. {WP(c,B)} c {B} or any A we have {A} c {B} iff A WP(c,B) How to verify {A} c {B}? 1.Compute: WP(c,B) 2.Prove: A WP(c,B) Weakest Preconditions Define wp(c, B) inductively on c, following Hoare rules wp(c 1 ;c 2, B) = ` {A} c 1 {B} ` {B} c 2 {C} wp(c 1, wp(c 2, B)) ` {A} c 1 ; c 2 {C} wp(x:=e, B) = [e/x]b ` {[e/x]a} x:=e {A} wp(if e then c 1 else c 2, B) = ` {AÆb} c 1 {B} `{A Æ b} c 2 {B} e wp(c( 1, B) Æ e wp(c( 2, B) ` {A} if b then c 1 else c 2 {B}

4 Weakest Preconditions for Loops Start from the equivalence while b do c = if b then (c; while b do c) else skip Let W = wp(while b do c, B) It must be that: W = (b wp(c, W) Æ b B) But this is a recursive equation! We ll return to finding loop WPs later echnique: Strongest Postconditions ` { y > 100 } x := y {x > 10} ` { y > 100 } x := y {x > 20} ` { y > 100 } x := y {x > 100} What postcond. is guaranteed after prec. y>100? SP(c,A): strongest predicate s.t. {B} c {SP(c,A)} or any B we have {A} c {B} iff SP(c,A) B How to verify {A} c {B}? 1.Compute: SP(c,A) 2.Prove: SP(c,A) B Strongest Postconditions Axiomatic Semantics over low Graphs Define sp(c, B) inductively on c, following Hoare rules sp(c 1 ;c 2, A) = sp(c 2, sp(c 1,A)) sp(x:=e, A) = x 0. [x 0 /x]a Æ x=[x 0 /x]e ` {A} c 1 {B} ` {B} c 2 {C} ` {A} c 1 ; c 2 {C} ` {A} x:=e { x 0.[x 0 /x]a Æ x=[x 0 /x]e} {P} if P P {P } c c {Q} if Q Q {Q} {Q } sp(if e then c 1 else c 2, A) = (eæsp(c 1, A)) Ç ( eæsp(c 2,B)) ` {AÆb} c 1 {B} `{A Æ b} c 2 {B} ` {A} if b then c 1 else c 2 {B} Relaxing specifications via rule of consequence

5 Sequential Composition Conditionals C 1 C 2 {P} {Q} {R} {x-1 y} y-1} {x y} x:= x-1 {x y-1} { x 0. x 0 y y:= y-1 Æ x=x 0-1} {x y} Backwards using weakest preconditions orwards using strongest postconditions { y 0 x 0. x 0 y 0 Æ x=x 0-1 Æ y=y 0-1} {P} E {PÆE} { PÆ E} { x 0 } {x 0Æ} { x 0 {x 1} Æ } orwards {(P 1 ÆE)Ç(P 2 Æ E)} E {P 1 } { P 2 } { Ç x 1} {} {x 1} Backwards Joins Conditional+Join: orward { x 0 Ç a = 0 } {P 1 } {P 2 } {P} {P} { x 0 } a := 2*x x<>0 { Æ a=0 } { x 0 Ç a = 2*x} {P 1 Ç P 2 } {P} { a == 2*x } orwards Backwards Check the implications (simplifications)

6 Conditionals+Joins: Backward { (x 0 Æ true) Ç (x = 0 Æ a = 2*x) } x<>0 { 2*x = 2*x } { a = 2*x } { a = 2*x} a := 2*x { a = 2*x } orward or Backward? orward reasoning Know the precondition Want to know what postcond the code guarantees Backward reasoning Know what we want to code to establish Want to know under what preconditions this happens Another Example: Double Locking lock Locking Rules Boolean variable locked = lock is held or not unlock unlock lock { locked Æ P[true/locked] } lock { P } lock behaves as assert(!locked);locked:=true An attempt to re-acquire an acquired lock or release a released lock will cause a deadlock. { locked Æ P[false/locked] } unlock { P } unlock behaves as assert(locked);locked:=false Calls to lock and unlock must alternate.

7 Locking Example { locked Æ x = 0 } { locked Æ x = 0 } { locked Æ x = 0 } lock { locked } { locked Æ x 0 } Next time unner examples Loops unctions {lockedæ Ç lockedæ x 0) } { locked Æ x = 0 } { locked Æ x 0 } { locked Æ (x = 0) } unlock { locked }