Verification Frameworks and Hoare Logic

Transcription

1 CMSC 630 February 11, Verification Frameworks and Hoare Logic Sources K. Apt and E.-R. Olderog. Verification of Sequential and Concurrent Programs (Second Edition). Springer-Verlag, Berlin, D. Gries. The Science of Programming. Springer-Verlag, Berlin, 1981.

2 CMSC 630 February 11, Verification Frameworks This course is about verifying systems mathematically. In order to do this, one needs a verification framework, which consists of following components. Class Sys of system descriptions. Sys must be given mathematically, with (at least) semantics and (usually) syntax. Class Spec of system specifications/requirements. Spec must also be given mathematically. Relation sat Sys Spec. Once a verification framework has been defined, verifying a specific systems S Sys against a specific requirementr Spec means proving thats sat R.

3 CMSC 630 February 11, Verification Frameworks (cont.) Given a verification framework, how does one establish whether or nots sat R? Two main approaches. Proof-based: Develop proof rules for proving S sat R and use them to prove correctness Algorithmic: Give decision procedures for computing if S sat R holds. In this class we will study several different verification frameworks, including ones that are proof-based and others that are algorithmic.

4 CMSC 630 February 11, Hoare Logic and Program Verification The first verification framework we will study: Hoare Logic. Sys consists of programs written in a simple guarded commands programming notation. Spec consists of pairs of formulas given in first-order logic (= predicate calculus); predicates typically refer to program variables. S sat R holds if, whenever program is started in state satisfying first predicate and program terminates, the final state satisfies the second predicate. Verification conducted using proof rules. The logic is sometimes called Floyd-Hoare logic and dates back to a paper by Hoare in It was a very active topic of research in 70s and 80s for sequential and parallel programs.

5 CMSC 630 February 11, The GC Programming Language Systems in Hoare Logic are given as programs in a small programming language called GC (for guarded commands).. We assume existence of following sets. Var: Program variables (assume integer-valued). AE: Arithmetic expressions built using constants, variables, operators, etc. (e.g x + 1) BE: Boolean expressions (e.g. x = 0,(y = 0) (x = 2)). Note Together with definitions offv AE,BE and subst, we have the syntactic component of a data theory: Z, Var, AE, BE,FV AE,BE, subst (Z = {..., 1,0,1,...} is the set of integers.)

6 CMSC 630 February 11, GC Statements Letv 1,... Var,e 1,... AE, andg 1,... BE. Then the setsof GC statements is defined as follows. S ::= skip no-op halt abort v 1,...,v n :=e 1,...,e n assignment (*) S; S sequential composition if G 1 S... G n S fi alternative composition do G 1 S... G n S od iteration (*) Inv 1,...,v n := e 1,...,e n, there is an additional syntactic restriction: ifi j thenv i v j (i.e. v i andv j must be different variables).

7 CMSC 630 February 11, Semantics of GC To treat GC programs mathematically, they must be given a mathematical meaning, or semantics. There are different ways to do this. Denotational. Programs are defined as functions mapping states (initial values of variables) to (sets of) states. Operational. Programs defined in terms of how they execute. Our semantics of GC will be an operational semantics given in the Structural Operational Semantics (SOS) style developed by Scottish computer scientist Gordon Plotkin in the early 80s. He only published a peer-reviewed paper on the subject in 2004; results previously available in 1981 Aarhus University (Denmark) technical report (Tech. Rep. DAIMI FN-19). SOS relies on specifying operational semantics using inference rules. Two types of SOS specifications: evaluation ( big-step ) defines what programs evaluate to, while transition ( small-step ) defines a program s atomic execution steps.

8 CMSC 630 February 11, A Big-Step SOS for GC The big-step SOS for GC will involve defining a relation= (S Σ) Σ, whereσis the set of program states defined below. Intuitively, S,σ = σ holds when statements, starting in stateσ, is able to terminate in stateσ. Definition Σ, the set of states, is defined as the set of mappings Var Z.

9 CMSC 630 February 11, Defining= for GC The evaluation relation = for GC is defined inductively using inference rules. Premises of rules will typically involve evaluation of subexpressions. Conclusion will define evaluation of over-all statement, given premises. Assumptions: A function[[ ]] AE AE Σ Z;[[e]] AE (σ) returns the value ofein stateσ. A relation = BE Σ BE;σ = BE G holds when G is true in stateσ. State updating can be generalized as follows: ifσ Σ andv 1,...,v n,k 1,...,k n are sequences of variables/integers with the property that ifi j, thenv i v j, then k i ifx = v i (σ[v 1 k 1,,v n k n ])(x) = σ(x) otherwise Note [[ ]] AE, = BE is the semantic part of the data theory of program expressions!

10 CMSC 630 February 11, Defining = : Rules (1/2) skip,σ = σ (skip) k 1 = [[e 1 ]] AE (σ)... k n = [[e n ]] AE (σ) v 1,...,v n :=e 1,...,e n,σ = σ[v 1 k 1,...,v n k n ] (:=) S 1,σ = σ S 2,σ = σ S 1 ;S 2,σ = σ (;) σ = BE G i S i,σ = σ if G 1 S 1... G n S n fi,σ = σ (if)

11 CMSC 630 February 11, Defining = : Rules (2/2) σ = BE G 1... σ = BE G n do G 1 S 1 G n S n od,σ = σ (do 1 ) σ = BE G i S i,σ = σ do G 1 S 1 G n S n od,σ = σ do G 1 S 1 G n S n od,σ = σ (do 2 ) Notes There are no rules for halt! This means there can be no statesσ,σ such that halt,σ = σ. Implication: halt does not terminate. if fi does not terminate if all the guards are false in a given state. (Why?) if fi and do od can give rise to nondeterminism. (How?) Notation IfS S andσ Σ then[[s]](σ) = {σ Σ S,σ = σ }.

12 CMSC 630 February 11, State Predicates In Hoare Logic we now definesys = S. What aboutspec? Program specifications will involve first-order formulas (sometimes called state predicates in the literature). What are state predicates? First-order logical formulas over the data theory of program expressions (i.e. AE, BE, etc.). Examples 1. x < 3 2. j Z. 0 j < i (min A[j]) LetΦbe the set of state predicates. The semantics of state predicates is the usual one for first-order logic a relation = Σ Φ, whereσ = φ means φ is true in stateσ.

13 CMSC 630 February 11, Specifications in Hoare Logic We can now define the set of specifications in Hoare Logic. In a specification P, Q : Spec = Φ Φ P is called the precondition. Q is called the postcondition.

14 CMSC 630 February 11, The Satisfaction Relation in Hoare Logic The third component in the Hoare Logic verification framework is sat : when does a program satisfy a specification? Definition Let S be a program (statement), P, Q be a precondition/postcondition pair. Then S sat P,Q if and only if, for everyσ,σ such that thatσ = P and S,σ = σ,σ = Q. Terminology Judgments in Hoare Logic are called Hoare triples and are written {P}S {Q}. A Hoare triple{p}s {Q} is valid if it is the case thats sat P,Q. Note The notation of satisfaction here is called partial correctness, because programs are not required to terminate. Total correctness imposes an additional termination requirement.

15 CMSC 630 February 11, Proving the Validity of Hoare Triples We have now defined the Hoare Logic verification framework. How do we now verify programs? Traditional approach relies on proofs using a collection of inference rules. Rules have form premises conclusion (name), premises is a list of judgments and first-order statements (i.e. elements of Φ!), and conclusion is a judgment. If a rule has no hypotheses, it is sometimes called an axiom. A rule encodes a single step of reasoning and can be applied once its premises have been proved. Notation IfP Φ,v 1,... Var,e 1,... AE thenp v 1,...,v n e 1,...,e n is Hoare-speak for (simultaneous) substitution of eachv i bye i inp.

16 CMSC 630 February 11, Axioms of Hoare Logic {P} skip{p} (skip) {P} halt{q} (halt) {P v 1,...,v n e 1,...,e n }v 1,...,v n :=e 1,...,e n {P} (:=)

17 CMSC 630 February 11, Inference Rules of Hoare Logic: Program Constructs {P}S 1 {Q} {P}S 1 ;S 2 {R} {Q}S 2 {R} (;) {P G 1 }S 1 {Q} {P G n }S n {Q} {P} if G 1 S 1 G n S n fi{q} (if) {I G 1 }S 1 {I} {I G n }S n {I} {I} do G 1 S 1 G n S n od{i G 1 G n } (do) Note In Rule(do), state predicate I is often called a loop invariant.

18 CMSC 630 February 11, Inference Rules of Hoare Logic: State Predicate Reasoning P P {P}S {Q} Q Q {P }S {Q } ( ) Note In this rule,p P andq Q are intended tautologies. They must be proven using a proof system for first-order logic (i.e. not using Hoare Logic).

19 CMSC 630 February 11, Example Consider the following program Pr, which should calculate the quotient and remainder of dividing x by y. r, q := x, 0; do y r r, q := r-y, q+1 od We would like to prove {x 0} Pr{x = q y+r 0 r < y} In what follows, definei = (x = q y+r 0 r).

20 CMSC 630 February 11, Example (cont.) Recall I = (x = q y+r 0 r) {x = (q+1) y+r y 0 (r y)} r,q := r y,q+1 {I} (:=) (1) (I (y r)) (x = (q+1) y+(r y) 0 (r y)) (2) {I (y r)} r,q := r y,q+1 {I} ( )2,1 (3) {I} do...od {I (y > r)} (do)3 (4) {x = 0 y+x (0 x)} r,q := x,0 {I} (:=) (5) x 0 ((x = 0 y+x) (0 x)) (6) {x 0} r,q := x,0 {I} ( )5,6 (7) {x 0} r,q := x,0; do...od {I (y > r)} (;)7,4 (8) (I (y > r)) (x = q y+r 0 r < y) (9) {x 0} Pr {(x = q y+r 0 r < y} ( )8,9(10)

21 CMSC 630 February 11, Reasoning in Practice: Proof Outlines Proofs are usually given as proof outlines. 1. State predicates are inserted into program text so that every statement (simple and compound) has a pre- and postcondition. 2. A proof outline is valid if every embedded triple is valid and adjacent predicates related by implication. {x 0} {x = 0 y+x 0 x} r, q := x, 0; {I} do y r {I y r} od {I y > r} {x = q y+r 0 r < y} r, q := r-y, q+1 {I}

22 CMSC 630 February 11, Formal Definition of Set P of Proof Outlines Given inductively! In the following rules,r,r 1,... are partial proof outlines: R S may be a program; or R = {P}S may be a program with a precondition (S S); or R = S{Q} may be a program with a postcondition (S S); or R P may be a full proof outline.

23 CMSC 630 February 11, Inductive Definition of P {P} skip {P} P {P v 1,...,v n e 1,...,e n }v 1,...,v n := e 1,...,e n {P} P {P}R 1 {P } P {P }R 2 {Q} P {P}R 1 ;{P }R 2 {Q} P {P G 1 }R 1 {Q} P {P G n }R n {Q} P {P} if G 1 {P G 1 }R 1 {Q} G n {P G n }R n {Q} fi{q} P {I G 1 }R 1 {I} P {I G n }R n {I} P {I} do G 1 {I G 1 }R 1 {I} G n {I G n }R n {I} od{i i G i} P P P {P}R{Q} P {P }{P}R{Q} P {P}R{Q} P Q Q {P}R{Q}{Q } P

24 CMSC 630 February 11, Reasoning in Practice: Where do Preconditions Come from? Begin by capturing as a postconditionqwhat the result of the programs should be. Use axioms and inference rules to reason backwards to obtain a preconditionp fors. Result is a of the triple{p}s {Q}. This idea can be formalized via weakest liberal preconditions. First, we can associate a set of states with any state predicate as follows. Definition Letφ Φ be a state predicate. Then[[φ]] = {σ Σ σ = φ} Definition LetS be a statement andφ Φ be a state predicate. Then the weakest liberal precondition, wlp(s,φ) ofs with respect toφis given by: wlp(s,φ) = {σ Σ [[S]](σ) [[φ]]}

25 CMSC 630 February 11, Weakest Liberal Preconditions Can Be Computed Syntactically! Edsger Dijkstra initiated study on this problem in Theorem LetS be a program andφastate predicate. Then the following hold. 1. wlp(skip,φ) = [[φ]] 2. wlp(halt,φ) = Σ = [[tt]] 3. wlp(v 1,...,v n :=e 1,...,e n,φ) = [[φ v 1,...,v n e 1,...,e n ]] 4. wlp(s 1 ;S 2,φ) = wlp(s 1, wlp(s 2,φ)) 5. wlp(if G 1 S 1 G n S n fi,φ) = ([[ G 1 ]] wlp(s 1,φ)) ([[ G n ]] wlp(s n,φ)) Note In (5)[[ G i ]] wlp(s i,φ) may be seen as equivalent to G i wlp(s i,φ). What about do od?

26 CMSC 630 February 11, wlp and do wlp(do od,φ) may be represented syntactically in theory, but it is impractical to compute (relies on encoding computations of while loops as integers). We can come close, however. Fact LetD = do G 1 S 1 G n S n od. Then [[D]](σ) = [[if G 1 (S 1 ;D) G n (S n ;D) (G 1 G n ) skip fi]](σ) In other words,[[d]] is a solution to a recursive equation involving if fi. Given D, φ, consider the following. H 0 = [[tt]] = Σ H j = ([[ G1 ]] wlp(s 1,H j 1 )) ([[ G n ]] wlp(s n,h j 1 )) ([[( (G 1 G n )) φ]]) Fact wlp(d,φ) = j 0 H j Why is this close, but not necessarily the answer? Because obvious approach to representing theh j falls outside the syntax of first-order logic.

27 CMSC 630 February 11, Reasoning in Practice: Loop Invariants The inference rule for do-loops requires the creation of a loop invariant which must hold each time through the loop. Coming up with the right loop invariants is often the trickiest aspect of sequential program verification. General strategy: weaken postcondition of loop, by e.g. deleting conjuncts, replacing constant with variable, etc. Gries book, Chapter 16, has good tips and examples. Invariants generally capture design information and are very useful as documentation, even if you don t prove your programs correct.

28 CMSC 630 February 11, Soundness and Relative Completeness Recall soundess and completeness. Soundness: Can only valid things be proved? Completeness: Can all valid things be proved? We can study these issues for Hoare Logic! Theorem (Soundness) Suppose{P} S {Q} is provable. Then it is valid. Theorem (Relative Completeness) Suppose that there is a complete proof system for establishingp Q. Then the validity of{p}s {Q} implies{p}s {Q} is provable. Question Why is only relative completeness possible, in general?