Strength; Weakest Preconditions
|
|
- Barnard Jenkins
- 6 years ago
- Views:
Transcription
1 12/14: solved Strength; Weakest Preconditions CS 536: Science of Programming, Spring 2018 A. Why To combine correctness triples, we need to weaken and strengthen conditions. A weakest precondition is the most general requirement that a program must meet to produce the right result. B. Objectives At the end of today you should understand What weakening and strengthening are. What weakest preconditions (wp) and weakest liberal preconditions (wlp) are. How the domain predicate of an expression ensures it doesn t cause runtime failure. How to calculate the wp and wlp of loop-free programs, with the help of domain predicates. C. Stronger and Weaker Predicates Generalizing the Sequence Rule: We ve already seen that two triples {p} S₁ {q} and {q} S₂ {r} can be combined to form the sequence {p} S₁ ; S₂ {r}. Say we want to combine two triples that don t have a common middle condition, {p} S₁ {q} and {q } S₂ {r}. We can do this iff q q. If S₁ terminates in state τ and {p} S₁ {q} is valid, then τ q. If q q, then τ q, so if {q } S₂ {r}, then if running S₂ in τ terminates, it terminates in a state satisfying r. This reasoning works both for partial and total correctness. Our earlier rule with q q is a special case of this more general rule (since q always implies itself). Definition: If q r then q is stronger than r and r is weaker than q. I.e., the set of states that satisfy q is the set of states that satisfy r. (Technically, we should say stronger than or equal to and weaker than or equal to, since we can have q r, but it s too much of a mouthful. Then strictly stronger means stronger than or equal to and not equal to; strictly weaker is similar.) Note: One notation for implication is p q; it's important not to read that as a superset symbol, since the set of states for p the set of states for q. Example 1: x = 0 is stronger than x = 0 x = 1, which is stronger than x 0. A predicate corresponds to the set of states that satisfy it, so we can use Venn diagrams with sets of states to display comparisons of predicate strength. In Figure 1, p q because the set of states for p set of states for q. We don t have p r, q r, r p, or r q, but we do have p r (all of p is outside r), r p, and q p. In Figure 2, we see that stronger predicates stand for smaller sets of states. No states satisfy F (false), so it is the strongest predicate. F stands for, the empty set of states. Weaker states stand for larger sets of states. Since every state satisfies T (true), T stands for Σ, the set of all states. CS : Science of Programming 1 James Sasaki, 2018
2 p q r Stronger p F x = 0 x 0 x Z q r Σ x Z y = 0 Weaker q (in p q) T Figure 1: Predicates As Sets of States Figure 2: Weaker Predicates Stand For Larger Sets of States D. Strengthening and Weakening Conditions This idea of freely going from stronger to weaker predicates applies to individual triples, not just sequences. Both of the following properties are valid for both partial and total correctness of triples (i.e., for and tot ). Preconditions can always be strengthened: If p₀ p₁ and {p₁} S {q}, then {p₀} S {q}. Postconditions can always be weakened: If q₀ q₁ and {p} S {q₀}, then {p} S {q₁}. Example 2: If {x 0} S {y = 0} is valid, then so are {x 0} S {y = 0 y = 1} (Weak. postcondition) {x = 0} S {y = 0} (Str. precondition) {x = 0} S {y = 0 y = 1} (Str. precond. and weak. postcond.) Note these rules still apply if p₀ p₁ or q₀ q₁. Example 3: Let p₀ s = sum(0, k) and p₁ s+k+1 = sum(0, k+1) Since p₀ p₁, we can strengthen {p₁} S {q} to {p₀} S {q} (where q s = sum(0, k)). Just because we can strengthen preconditions and weaken postconditions doesn t mean we should. In the limit, strengthening preconditions and weakening postconditions gives us uninteresting correctness triples: σ {F} S {q} and σ tot {F} S {q} have the strongest possible preconditions σ {p} S {T} has the weakest possible postcondition σ tot {p} S {T} has the weakest possible postcondition but it does tell us that S terminates when you start it in p. From the programmer s point of view, if {p} S {q} has a bug, then strengthening p or weakening q can get rid of the bug without changing S. Example 4: If {p} S {q} causes an error if x = 0, we can tell the user to use {p x 0} S {q}. Example 5: If {p} S {q} causes an error because S terminates with y = 1 (and y = 1 does not imply q), we can tell the user to use {p} S {q y = 1}. From the user's point of view, weaker preconditions and stronger postconditions make triples more useful: CS : Science of Programming 2 James Sasaki, 2018
3 Weaker precondition adds starting states: If p q then going from {p} S {r} to {q} S {r} provides more information because it increases the set of states that we say S can start in and end with r. Basically, we combine {p} S {r} and { p q} S {r} to get {q} S {r}. Stronger postconditions remove ending states: If q r then going from {p} S {r} to{p} S {q} provides more information because it decreases the set of states we say S will end in. E. The Weakest Precondition (wp) If {p} S {q} is valid, it s often the case that p only describes a subset of the set of all states that lead to satisfaction of q. I.e., we can often weaken p to some other predicate that still works as a precondition for S and q. Say {p} S {q} is valid but { p} S {q} is satisfiable: Say {r} S {q} is valid, where r p. Since {p} S {q} and {r} S {q} are both valid, so is {p r} S {q}. Since r p, we know p p r is valid but p r p is not, so p is strictly stronger than p r: The set of states that satisfy p r is a strict superset of the set of states that satisfy p. This means that going from {p} S {q} to {p r} S {q} weakens the precondition for S and q: It increases the set of states we can start in and end up with q satisfied. Though we can strengthen a precondition arbitrarily far (to F in the limit), we usually can t weaken a precondition all the way to T: We keep weakening p while maintaining {p} S {q}, but eventually we get to a p that can't be weakened any more and still get us to q. In particular, if { p} S {q} is unsatisfiable, then there s no r that implies p that we can use to weaken p to p r while maintaining satisfaction of q. Example 6: If x N, then {x 6} x := x*x {x 4} is valid, but it s also the case that {x < 6} x := x*x {x 4} is satisfiable (e.g., when x = 5), so we can extend x 6 with x 5 (i.e., x 6 x = 5) and maintain validity. On the other hand, {x 2} x := x*x {x 4} is valid and {x < 2} x := x*x {x 4} is unsatisfiable, so there s no way to weaken x 2 and maintain validity. Definition: The weakest precondition of program S and postcondition q, written wp(s, q), is the predicate w such that tot {w} S {q} and for every σ w, we have M(S, σ) q (i.e., M(S, σ) includes or for some τ M(S, σ), we have τ q). Example 7: wp(x := y*y, x 4) y*y 4. If σ y*y 4 then M(S, σ) x 4. If σ y*y 4 then M(S, σ) x 4. Example 8: If x Z, then wp(if x 0 then y := x else y := -x fi, y = abs(x)) T. No matter what state we start in, this program sets y to the absolute value of x. Equivalently, in no state does it not set y to the absolute value of x. Note that since you can t weaken T, if T is a valid precondition for S and q, then it s also the weakest precondition for S and q. The wp(s, q) concept is important, so it s good to look more into it. First, as a predicate, wp(s, q) is only unique up to logical equivalence. In some sense, a predicate is just a name for the set of states that satisfy it, which is why (e.g.) x = 0 x-1 = 1. So let w wp(s, q) CS : Science of Programming 3 James Sasaki, 2018
4 means that w can be any of the logically equivalent predicates that are satisfied by exactly the set of states {σ Σ M(S, σ) q}, which is the definition of wp(s, q) as a set of states. If w wp(s, q), then w has two properties. First, it s a precondition for S and q: tot {w} S {q}. Note since w is a precondition, any stronger p that implies w is also a precondition: If p w then if σ p then σ w, so M(S, σ) q. Since σ tot {p} S {q} holds for any σ, we know p is a valid precondition. The second property for w, being the weakest precondition, can be characterized a couple of ways: In the definition of w wp(s, q), the weakest precondition part is (σ w M(S, σ) q). This turns out to be equivalent to saying that any valid precondition for S and q must be stronger than w: If tot {p} S {q}, then p w. To see this, take the contrapositive of (σ w M(S, σ) q), which is (M(S, σ) q σ w, which in turn implies σ w, since σ is a state. If σ tot {p} S {q}, then σ p implies M(S, σ) q, which implies σ w, so σ p w. Since this holds for any σ that satisfies p, we know p w is valid. So if w is any valid precondition ( tot {w} S {q}), then p w σ tot {p} S {q}. Only if w is the weakest precondition do we get the other direction, σ tot {p} S {q} p w. F. wp and Deterministic Programs If S is deterministic, then S leads to a unique result: M(S, σ) = {τ} for some τ Σ. If S terminates normally (τ Σ), then the start state σ is part of either wp(s, q) or wp(s, q), depending on whether τ satisfies q or q. Since wp(s, q) is the set of states that lead to satisfaction of q, wp(s, q) is the set of states that lead to an error or to satisfaction of q. Similarly, wp(s, q) is the set of states that lead to an error or to satisfaction of q. The intersection of these two sets, wp(s, q) wp(s, q), is the set of states that lead to an error. Since σ must lead S either to termination satisfying q, termination satisfying q, or nontermination, every state satisfies exactly one of wp(s, q), wp(s, q), and wp(s, q) wp(s, q). Let E wp(s, q) wp(s, q), then we get the identities wp(s, q) E wp(s, q). The negation of S terminates with q true is S doesn t terminate or it terminates with q false. wp(s, q) E wp(s, q) is symmetric: The negation of S terminates with q false is S doesn t terminate or it terminates with q true. If S contains a loop and M(S, σ) diverges (and σ Σ), then σ wp(s, q) wp(s, q). (See Figure 3.) On the left of Figure 3 is the set of all states Σ broken up into three partitions The states that establish q form wp(s, q) = {σ Σ M(S, σ) = {τ} and τ q} The states that establish q form wp(s, q) = {σ Σ M(S, σ) = {τ} and τ q} The states that lead to form wp(s, q) wp(s, q) = {σ Σ M(S, σ) = { }} The arrows indicate that starting from wp(s, q) or wp(s, q) yields a state that satisfies q or q respectively. Starting from a state outside both weakest preconditions leads to an error. CS : Science of Programming 4 James Sasaki, 2018
5 Establish q wp(s, q) E (Causes error) wp(s, q) wp(s, q) Establish q wp(s, q) σ Σ S (converges to q) S (yields an error) S (converges to q) τ q τ q M(S, σ) = {τ} Figure 3: The Weakest Precondition for Deterministic S G. wp and Nondeterministic Programs If S is nondeterministic, then M(S, σ) is a nonempty subset of Σ that can contain more than one member. If everything in M(S, σ) satisfies q, then σ wp(s, q). Similarly, if everything in M(S, σ) satisfies q, then σ wp(s, q). As with deterministic programs, the three predicates wp(s, q), wp(s, q), and wp(s, q) wp(s, q) together cover together all possible states. With deterministic programs, σ wp(s, q) wp(s, q) iff running S in σ causes an error. This is because M(S, σ) is a singleton set {τ], and τ must either be or satisfy q or satisfy q. For deterministic S: σ wp(s, q) wp(s, q) iff M(S, σ) = { }. But with nondeterministic programs, even if M(S, σ) doesn t include, (i.e., tot {T} S {T}), it can still mix states that satisfy q with states that satisfy q. A set like that neither satisfies q nor q. Figure 4 illustrates M(S, σ) q and M(S, σ) q because M(S, σ) {τ₁, τ₂} where τ₁ q and τ₂ q. For nondeterministic S, σ wp(s, q) wp(s, q) iff (1) M(S, σ) or (2) There exist τ₁, τ₂ M(S, σ) with τ₁ q and τ₂ q. Establish q wp(s, q) E (Causes error) wp(s, q) wp(s, q) σ Establish q wp(s, q) σ Σ τ₁ q τ₂ q M(S, σ) {τ₁, τ₂}, τ₁ q, and τ₂ q Figure 4: σ wp(s, q) wp(s, q) even though S terminates Example 9: Let S if x 0 x := 10 x 0 x := 20 fi, and let Σ₀ = M(S, {x = 0}) be the set with two states {{x = 10}, {x = 20}}. Then Σ₀ x = 10, x 10, x = 20, and x 20. (We do have Σ₀ x = 10 x = 20.) CS : Science of Programming 5 James Sasaki, 2018
6 H. Disjunctive Postconditions There are some relationships that hold between the wp of a predicate and the wp's of its subpredicates. E.g., if you start in a state that is guaranteed to lead to a result that satisfies q₁ and q₂ separately, then the result will also satisfy q₁ q₂, and vice versa. In symbols, wp(s, q₁) wp(s, q₂) wp(s, q₁ q₂). This relationship holds for both deterministic and nondeterministic S. The relationship between wp(q₁ q₂) and wp(q₁) and wp(q₂) differs for deterministic and nondeterministic S. Deterministic S: For all S, wp(s, q₁) wp(s, q₂) wp(s, q₁ q₂) Nondeterministic S: For all S, wp(s, q₁) wp(s, q₂) wp(s, q₁ q₂), but doesn't hold for some S. For deterministic S, M(S, σ) = {τ} for some τ Σ. If τ q₁ q₂ then either τ q₁ or τ q₂ (or both). So if M(S, σ) { }, then M(S, σ) q₁ q₂ iff M(S, σ) q₁ or M(S, σ) q₂. Because of this, wp(s, q₁) wp(s, q₂) wp(s, q₁ q₂). For nondeterministic S, we still have wp(s, q₁) wp(s, q₂) wp(s, q₁ q₂). I.e., if you start in a state that's guaranteed to terminate satisfying q₁, or guaranteed to terminate satisfying q₂, then that state is guaranteed to terminate satisfying q₁ q₂. For nondeterministic S, the other direction, wp(s, q₁) wp(s, q₂) wp(s, q₁ q₂), doesn't always hold: S can guarantee establishing q₁ q₂ without leaving any way to guarantee satisfaction of just q₁ or just q₂. Example 10: Let CoinFlip if T x := 0 T x := 1 fi. For all σ, M(CoinFlip, σ) = {{x = 0, x = 1}}, which x = 0 x = 1 but x = 0 and x = 1. Let Heads wp(coinflip, x = 0), Tails = wp(coinflip, x = 1), and Heads_or_Tails = wp(coinflip, x = 0 x = 1). We find Heads Tails F but Heads_or_Tails T. Altogether, (Heads Tails) (but not ) Heads_or_Tails. So for nondeterministic S, even though tot {wp(s, q)} S {q}, if q is disjunctive, it's possible for you to run S in a state σ wp(s, q) but still terminate without error in a state satisfying q. (For deterministic S, this won't happen.) E.g., if S if B then x := 0 else x := 1 fi, then M(S, σ) x = 0 or M(S, σ) x = 1 (tails), wp(s, x = 0) B and wp(s, x = 1) B. I. The Weakest Liberal Precondition (wlp) The relationship between the weakest precondition (wp) and the weakest liberal precondition (wlp) is the same as total vs partial correctness. wp(s, q) is the set of start states that guarantee termination establishing q. wlp(s, q) is the set of start states that guarantee (causing an error or termination establishing q). Definition: The weakest liberal precondition of S and q, written wlp(s, q), is the predicate w such that {w} S {q} and for every σ w, M(S, σ) and M(S, σ) q. If we start in a state σ satisfying wlp(s, q) then either some execution path for S in σ causes an error or else all execution paths for S in σ lead to final states that q. If we start in a σ satisfying wlp(s, q), then every execution path for S in σ leads to a final state and at least one of the final states q. CS : Science of Programming 6 James Sasaki, 2018
7 We always have wp(s, q) wlp(s, q); the other direction, wp(s, q) wlp(s, q), only holds if S never causes an error. Example 11: Let W while x 0 do x := x-1; y := 0 od; let q x = 0 y = 0 (so q x 0 y 0) Then for M(W, σ), If σ x = 0 then M(W, σ) = {σ} If σ x > 0 then M(W, σ) = {σ[x 0][y 0]} If σ x < 0 then M(W, σ) = { } So wp(w, q) x > 0 x = y = 0 and wlp(w, q) wp(w, q) x < 0 Also, wp(w, q) x = 0 y 0 and wlp(w, q) wp(w, q) x < 0 For the wp, q x 0 y 0, but there s no way for W to terminate satisfying x 0, and the only way for W to terminate with y 0 is to start with x = 0. That wlp is the weakest precondition for partial correctness is analogous to wp being the weakest precondition for total correctness: If w wlp(s, q), then {w} S {q} and for all p, {p} S {q} iff p w. J. Calculating wlp for Loop-Free Programs It s easy to calculate the wlp of a loop-free program. If a loop-free program cannot cause a runtime error then its wp and wlp are the same, which is also nice. The following algorithm takes S and q where S has no loops and syntactically calculates a particular predicate for wlp(s, q), which is why it s described using wlp(s, q) instead of wp(s, q). wlp(skip, q) q wlp(v := e, Q(v)) Q(e) where Q is a predicate function over one variable The operation that takes us from Q(v) to Q(e) is called syntactic substitution; we ll look at it in more detail soon, but in the simple case, we simply inspect the definition of Q, searching its text for occurrences of the variable v and replacing them with copies of e. wlp(s₁; S₂, q) wlp(s₁, wlp(s₂,q)) wlp(if B then S₁ else S₂ fi, q) (B w₁) ( B w₂) where w₁ wlp(s₁,q) and w₂ wlp(s₂,q). If you want, you can write (B w₁) ( B w₂), which is equivalent. wlp(if B₁ S₁ B₂ S₂ fi (B₁ w₁) (B₂ w₂) where w₁ wlp(s₁,q) and w₂ wlp(s₂,q). For the nondeterministic if, don t write (B₁ w₁) (B₂ w₂) instead of (B₁ w₁) (B₂ w₂); they aren t logically equivalent. When B₁ and B₂ are both true, either S₁ or S₂ can run, so we need B₁ B₂ w₁ w₂. Using (B₁ w₁) (B₂ w₂) fails because it allows for the possibility that B₁ and B₂ are both true but one of w₁ and w₂ is not true. This isn t a problem when B₂ B₁, which is why we can use (B w₁) ( B w₂) with deterministic if statements. Some examples of calculating wp/wlp: The programs in these examples end in state, so the wp and wlp are equivalent. CS : Science of Programming 7 James Sasaki, 2018
8 Example 12: wp(x := x+1, x 0) x+1 0 Example 13: wp(y := y+x; x := x+1, x 0) wp(y := y+x, wlp(x := x+1, x 0)) wp(y := y+x, x+1 0) x+1 0 Example 14: wp(y := y+x; x := x+1, x y) wp(y := y+x, wp(x := x+1, x y)) wp(y := y+x, x+1 y) x+1 y+x If we were asked only to calculate the wp, we'd stop here. If we also wanted to logically simplify the wp then x+1 y+x y 1. Example 15: (Swap the two assignments in Example 14) wp(x := x+1; y := y+x, x y) wp(x := x+1, wp(y := y+x, x y)) wp(x := x+1, x y+x)) x+1 y+x+1 [ y 0 if you want to logically simplify] Example 16: wp(if y 0 then x := y fi, x 0) wp(if y 0 then x := y else skip fi, x 0) (y 0 wp(x := y, x 0)) (y < 0 wp(skip, x 0)) (y 0 y 0) (y < 0 x 0). If we want to simplify logically, we can continue with y 0 (y < 0 x 0) (y 0 y < 0) (y 0 x 0) y 0 x 0 (which is also y < 0 x 0, if you prefer) K. Avoiding Runtime Errors in Expressions To avoid runtime failure of σ(e), we'll take the context in which we're evaluating e and augment it with a predicate that guarantee non-failure of σ(e). For example, for {P(e)} v := e {P(v)}, we'll augment the precondition to guarantee that evaluation of e won't fail. Definition: For each expression e, we define a domain predicate D(e) where σ D(e) implies σ(e) e. This predicate has to be defined recursively, since we need to handle complex expressions like D(b[b[i]]) 0 i < size(b) 0 b[i] < size(b). As with wp and sp, the domain predicate for an expression is unique only up to logical equivalence. For example, D(x/y + u/v) y 0 v 0 v 0 y 0. We must define D for each kind of expression that can cause a runtime error: D(b[e]) 0 e < size(b) D(e) D(e₁/e₂) D(e₁ % e₂) e₂ 0 D(e₁) D(e₂) D(sqrt(e)) e 0 D(e) And so on, depending on the datatypes and operations being used. CS : Science of Programming 8 James Sasaki, 2018
9 We also have to check the subexpressions of larger expressions: If op doesn't cause errors then D(e₁ op e₂) D(e₁) D(e₂) D(op e) D(e) For conditional expressions: D(if B then e₁ else e₂ fi) (B D(e₁)) ( B D(e₂)) D(B). Evaluation of a variable or constant doesn't cause failure: D(e) T if e some constant c or variable v. Example 17: D(b[b[i]]) 0 b[i] < size(b) D(b[i]) 0 b[i] < size(b) 0 i < size(b) D(i) 0 i < size(b) 0 b[i] < size(b) Example 18: D((-b + sqrt(b*b - 4*a*c))/(2*a)) 2*a 0 (b*b - 4*a*c) 0. In detail, D((-b + sqrt(b*b - 4*a*c))/(2*a)) 2*a 0 D((-b + sqrt(b*b - 4*a*c)) D(2*a) 2*a 0 D(-b) D(sqrt(b*b - 4*a*c)) 2*a 0 (b*b - 4*a*c 0) D(b*b - 4*a*c) 2*a 0 (b*b - 4*a*c 0) Example 19: D(if 0 i < size(b) then b[i] else 0 fi) T. In detail, D(if 0 i < size(b) then b[i] else 0 fi) (B D(b[i])) ( B D(0)) D(B) where B 0 i < size(b) (B D(b[i])) ( B T) since D(B) and D(0) T! (B 0 i < size(b) D(i)) expanding D(b[i]) T!!!!!!!! since B 0 i < size(b) L. Avoiding Runtime Errors in Loop-Free Programs Recall that we extended our notion of operational semantics to include S, σ * E, e to indicate that evaluation of S causes a runtime failure. For loop-free programs, we can avoid runtime failure of statements by adding domain predicates to the preconditions of statements.. Definition: wp(s, q) extends the definition of wlp as follows: wp(v := e, P(v)) D(e) wlp(v := e, p) D(e) P(e) wp(if B then S₁ else S₂ fi, q) D(B) (B wp(s₁, q)) ( B wp(s₂, q)) wp(if B₁ S₁ B₂ S₂ fi, q) D(B₁) D(B₂) (B₁ B₂) (B₁ wp(s₁, q)) (B₂ wp(s₂, q)) * The condition (B₁ B₂) ensures that the nondeterministic if-fi won t fail because none of the guard booleans hold. The two remaining clauses of wp match their wlp counterparts: * This can easily be extended to if-fi with not just two arms. CS : Science of Programming 9 James Sasaki, 2018
10 wp(skip, q) wlp(skip, q) q wp(s₁; S₂, q) wp(s₁, wp(s₂, q)) Example 20: wlp(x := y; z := v/x, z > x+2) wlp(x := y, wlp(z := v/x, z > x+2)) wlp(x := y, v/x > x+2) v/y > y+2 wp(x := y; z := v/x, z > x+2) wp(x := y, wp(z := v/x, z > x+2)) wp(x := y, x 0 v/x > x+2) y 0 v/y > y+2 Example 22: Let S if b[i] b[j] z := b[i] b[j] b[i] z := b[j] fi. Define a Q(v) that says v is the min of b[i] and b[j] via Q(v) (v = b[i] v = b[j]) v b[i] v b[j]). Note we can simplify Q(b[i]) b[i] b[j] and Q(b[j]) b[j] b[i]. Then wp(s, Q(z)) D(b[i] b[j]) D(b[j] b[i]) (b[i] b[j] b[j] b[i]) (b[i] b[j] wp(z := b[i], Q(z))) (b[j] b[i] wp(z := b[j], Q(z))) (0 i < size(b) 0 j < size(b)) (0 j < size(b) 0 i < size(b)) T (b[i] b[j] wp(z := b[i], Q(z))) (b[j] b[i] wp(z := b[j], Q(z))) 0 i, j < size(b))* (b[i] b[j] Q(b[i])) (b[j] b[i] Q(b[j])) 0 i, j < size(b)) (b[i] b[j] b[i] b[j]) (b[j] b[i] (b[j] b[i]) 0 i, j < size(b) * 0 i, j < size(b)) is shorthand for 0 i < size(b)) 0 j < size(b)) CS : Science of Programming 10 James Sasaki, 2018
11 Illinois Institute of Technology Activities 10 & 11 Strength; Weakest Preconditions CS 536: Science of Programming A. Why The weakest precondition is the most general precondition that a program needs in order to run correctly. B. Objectives At the end of this activity you should Be able to calculate the wp of a simple loop-free program. C. Problems For all the problems, just syntactically calculate the wp; don't also logically simplify the result. 1. Calculate wp(k := k - s, n = 3 k = 4 s = -7). 2. Calculate wp(n := n*(n-k), n = 3 k = 4 s = -7). 3. Calculate wp(if B then x := x/2 fi; y := x, x = 5 y = z). 4. Calculate wp(n := n*(n-k); k := k - s, n > k + s) 5. Calculate wp(if x 0 then x := x*2 else x := y fi; x := c*x, a x < y) For Problems 6 8, let Q(i, s) 0 i n s = sum(0, i) where sum(u, v) is the sum of u, u+1,, v (when u v) or 0 (when u > v). 6. Calculate wp(s := s+i; i := i+1, Q(i, s)) 7. Calculate wp(s := s+i+1; i := i+1, Q(i, s)) 8. Calculate wp(i := i+1; s := s+i, Q(i, s)). (Problems 7 and 8 have the same result.) 9. Let w wlp(s, q). The definition of wlp tells us that if σ w, then M(S, σ) Σ and M(S, σ) q. Using this, show that w is the weakest precondition for partial correctness: if {p} S {q} then p w. Hint: Make the argument analogous to the one for wp. 10. How are wp(s, q₁ q₂) and wp(s, q₁) wp(s, q₂), related if S is deterministic? If S is nondeterministic? For Problems 11 and 12, be sure to include the domain predicates. If you want, logically simplify as you go. 11. Use wp to calculate a total correctness precondition p for {p} x := y/b[i] {x > 0}. 12. Use wp to calculate total correctness conditions p₁ and p₂ for {p₁} y := sqrt(b[j]) {z < y} and {p₂} j := x/j {p₁} CS 536: Science of Programming 11 James Sasaki, 2018
12 Illinois Institute of Technology Activities 10 & Which of the following statements are correct? a. For all σ Σ, σ wp(s, q) iff M(S, σ) q b. For all σ Σ, σ wlp(s, q) iff M(S, σ) Σ q c. tot {wp(s, q)} S {q} d. {wlp(s, q)} S {q} e. tot {p} S {q} iff p wp(s, q) f. {p} S {q} iff p wlp(s, q) g. { wp(s, q)} S { q} h. tot { wlp(s, q)} S { q} i. wlp(s, q) wlp(s, q) is not satisfiable j. p wp(s, q) iff tot {p} S {q} k. p wlp(s, q) iff {p} S {q} CS 536: Science of Programming 12 James Sasaki, 2018
13 Illinois Institute of Technology Activities 10 & 11 Activity 10 Solution 1. wp(k := k - s, n = 3 k = 4 s = -7) n = 3 k-s = 4 s = wp(n := n*(n-k), n = 3 k = 4 s = -7) n*(n-k) = 3 k = 4 s = wp(if B then x := x/2 fi; y := x, x = 5 y = z) wp(if B then x := x/2 fi, wp(y := x, x = 5 y = z)) wp(if B then x := x/2 fi, x = 5 x = z) (B wp(x := x/2, x = 5 x = z)) ( B wp(skip, x = 5 x = z)) (B x/2 = 5 x/2 = z) ( B x = 5 x = z) 4. wp(n := n*(n-k); k := k-s, n > k+s) wp(n := n*(n-k), wp(k := k-s, n > k+s)) wp(n := n*(n-k), n > k-s+s) n*(n-k) > k-s+s 5. wp(if x 0 then x := x*2 else x := y fi; x := c*x, a x < y) wp(s, wp(x := c*x, a x < y)) where S is the if statement wp(s, a c*x < y) wp(if x 0 then x := x*2 else x := y fi, a c*x < y) (x 0 wp(x := x*2, a c*x < y)) (x < 0 wp(x := y, a c*x < y)) (x 0 a c*(x*2) < y) (x < 0 a c*y < y) For Problems 6 8, q 0 i n s = sum(0, i). 6. wp(s := s+i; i := i+1, q) wp(s := s+i, wp(i := i+1, 0 i n s = sum(0, i))) wp(s := s+i, 0 i+1 n s = sum(0, i+1)) 0 i+1 n s+i = sum(0, i+1) 7. wp(s := s+i+1; i := i+1, q) wp(s := s+i+1, wp(i := i+1, 0 i n s = sum(0, i))) wp(s := s+i+1, 0 i+1 n s = sum(0, i+1)) 0 i+1 n s+i+1 = sum(0, i+1) 8. wp(i := i+1; s := s+i, q) wp(i := i+1, wp(s := s+i, 0 i n s = sum(0, i))) wp(i := i+1, 0 i n s+i = sum(0, i)) 0 i+1 n s+(i+1) = sum(0, i+1) [Same as for Problem 7] CS 536: Science of Programming 13 James Sasaki, 2018
14 Illinois Institute of Technology Activities 10 & Assume {p} S {q}; we want to show that p w where w wlp(s, q). The definition of wlp tells us that for any σ w, we have M(S, σ) Σ and M(S, σ) q. The contrapositive of this is ((M(S, σ) Σ or M(S, σ) q) σ w). Since σ Σ, σ w implies σ w. Turning back to the triple, σ {p} S {q} implies (σ p (M(S, σ) Σ or M(S, σ) q)). Applying the contrapositive tells us (σ p σ w), so σ p w. Since this holds for any σ Σ, we know p w. 10. For deterministic S, wp(s, q₁ q₂) = wp(s, q₁) wp(s, q₂). For nondeterministic S, we have instead of =. (See Example 10.) 11. For {p} x := y/b[i] {x > 0}, let p wp(x := y/b[i], x > 0) D(y/b[i]) (y/b[i] > 0). (0 i < size(b) b[i] 0) (y/b[i] > 0) 12. For {p₁} y := sqrt(b[j]) {z < y}, let p₁ wp(y := sqrt(b[j]), z < y) D(sqrt(b[j])) wlp(y := sqrt(b[j]), z < y) 0 j < size(b) b[j] 0 z < sqrt(b[j]) For {p₂} j := x/j; {p₁}, let p₂ wp(j := x/j, p₁) D(x/j) wlp(j := x/j, p₁) j 0 (0 j < size(b) b[j] 0 z < sqrt(b[j]))[x/j / j] j 0 0 x/j < size(b) b[x/j] 0 z < sqrt(b[x/j]). 13. (Properties of wp and wlp) The following properties are correct: (a) and (b) are the basic definitions of wp and wlp (c) and (d) say that wp and wlp are preconditions (e) and (f) say that wp and wlp are weakest preconditions (g) and (h) also say that wp and wlp are weakest (j) and (k) are the contrapositives of (e) and (f). However, (i) is incorrect: It claims that wlp(s, q) wlp(s, q) is never satisfiable, but if M(S, σ) { }, then σ satisfies both wlp(s, q) and wlp(s, q). CS 536: Science of Programming 14 James Sasaki, 2018
Proof Rules for Correctness Triples
Proof Rules for Correctness Triples CS 536: Science of Programming, Fall 2018 A. Why? We can t generally prove that correctness triples are valid using truth tables. We need proof axioms for atomic statements
More informationLoop Convergence. CS 536: Science of Programming, Fall 2018
Solved Loop Convergence CS 536: Science of Programming, Fall 2018 A. Why Diverging programs aren t useful, so it s useful to know how to show that loops terminate. B. Objectives At the end of this lecture
More informationDeterministic Program The While Program
Deterministic Program The While Program Shangping Ren Department of Computer Science Illinois Institute of Technology February 24, 2014 Shangping Ren Deterministic Program The While Program February 24,
More informationHoare Calculus and Predicate Transformers
Hoare Calculus and Predicate Transformers Wolfgang Schreiner Wolfgang.Schreiner@risc.uni-linz.ac.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.uni-linz.ac.at
More informationCSE 331 Software Design & Implementation
CSE 331 Software Design & Implementation Kevin Zatloukal Summer 2017 Lecture 2 Reasoning About Code With Logic (Based on slides by Mike Ernst, Dan Grossman, David Notkin, Hal Perkins, Zach Tatlock) Recall
More informationCSE 331 Winter 2018 Reasoning About Code I
CSE 331 Winter 2018 Reasoning About Code I Notes by Krysta Yousoufian Original lectures by Hal Perkins Additional contributions from Michael Ernst, David Notkin, and Dan Grossman These notes cover most
More informationWeakest Precondition Calculus
Weakest Precondition Calculus COMP2600 Formal Methods for Software Engineering Rajeev Goré Australian National University Semester 2, 2016 (Most lecture slides due to Ranald Clouston) COMP 2600 Weakest
More informationClassical Program Logics: Hoare Logic, Weakest Liberal Preconditions
Chapter 1 Classical Program Logics: Hoare Logic, Weakest Liberal Preconditions 1.1 The IMP Language IMP is a programming language with an extensible syntax that was developed in the late 1960s. We will
More informationAxiomatic Semantics: Verification Conditions. Review of Soundness and Completeness of Axiomatic Semantics. Announcements
Axiomatic Semantics: Verification Conditions Meeting 12, CSCI 5535, Spring 2009 Announcements Homework 4 is due tonight Wed forum: papers on automated testing using symbolic execution 2 Questions? Review
More informationHoare Logic: Part II
Hoare Logic: Part II COMP2600 Formal Methods for Software Engineering Jinbo Huang Australian National University COMP 2600 Hoare Logic II 1 Factorial {n 0} fact := 1; i := n; while (i >0) do fact := fact
More informationCOP4020 Programming Languages. Introduction to Axiomatic Semantics Prof. Robert van Engelen
COP4020 Programming Languages Introduction to Axiomatic Semantics Prof. Robert van Engelen Assertions and Preconditions Assertions are used by programmers to verify run-time execution An assertion is a
More informationAxiomatic Semantics. Lecture 9 CS 565 2/12/08
Axiomatic Semantics Lecture 9 CS 565 2/12/08 Axiomatic Semantics Operational semantics describes the meaning of programs in terms of the execution steps taken by an abstract machine Denotational semantics
More informationPropositional and Predicate Logic
8/24: pp. 2, 3, 5, solved Propositional and Predicate Logic CS 536: Science of Programming, Spring 2018 A. Why Reviewing/overviewing logic is necessary because we ll be using it in the course. We ll be
More informationPropositional and Predicate Logic
Propositional and Predicate Logic CS 536-05: Science of Programming This is for Section 5 Only: See Prof. Ren for Sections 1 4 A. Why Reviewing/overviewing logic is necessary because we ll be using it
More informationFormal Reasoning CSE 331. Lecture 2 Formal Reasoning. Announcements. Formalization and Reasoning. Software Design and Implementation
CSE 331 Software Design and Implementation Lecture 2 Formal Reasoning Announcements Homework 0 due Friday at 5 PM Heads up: no late days for this one! Homework 1 due Wednesday at 11 PM Using program logic
More informationPredicate Transforms I
Predicate Transforms I Software Testing and Verification Lecture Notes 19 Prepared by Stephen M. Thebaut, Ph.D. University of Florida Predicate Transforms I 1. Introduction: weakest pre-conditions (wp
More informationCS 341 Homework 16 Languages that Are and Are Not Context-Free
CS 341 Homework 16 Languages that Are and Are Not Context-Free 1. Show that the following languages are context-free. You can do this by writing a context free grammar or a PDA, or you can use the closure
More informationHoare Logic I. Introduction to Deductive Program Verification. Simple Imperative Programming Language. Hoare Logic. Meaning of Hoare Triples
Hoare Logic I Introduction to Deductive Program Verification Işıl Dillig Program Spec Deductive verifier FOL formula Theorem prover valid contingent Example specs: safety (no crashes), absence of arithmetic
More informationthat shows the semi-decidability of the problem (i.e. a semi-decision procedure for EXISTS-HALTING) and argue that it is correct.
Exercise 1 (15) Consider the following problem: EXISTS-HALTING INSTANCE: A program Π, which takes as input a string over the alphabet {a, b, c,..., z}. QUESTION: Does there exist an input I, such that
More informationWhat happens to the value of the expression x + y every time we execute this loop? while x>0 do ( y := y+z ; x := x:= x z )
Starter Questions Feel free to discuss these with your neighbour: Consider two states s 1 and s 2 such that s 1, x := x + 1 s 2 If predicate P (x = y + 1) is true for s 2 then what does that tell us about
More informationAxiomatic Semantics: Verification Conditions. Review of Soundness of Axiomatic Semantics. Questions? Announcements
Axiomatic Semantics: Verification Conditions Meeting 18, CSCI 5535, Spring 2010 Announcements Homework 6 is due tonight Today s forum: papers on automated testing using symbolic execution Anyone looking
More informationLecture Notes: Axiomatic Semantics and Hoare-style Verification
Lecture Notes: Axiomatic Semantics and Hoare-style Verification 17-355/17-665/17-819O: Program Analysis (Spring 2018) Claire Le Goues and Jonathan Aldrich clegoues@cs.cmu.edu, aldrich@cs.cmu.edu It has
More informationFormal Methods for Probabilistic Systems
1 Formal Methods for Probabilistic Systems Annabelle McIver Carroll Morgan Source-level program logic Introduction to probabilistic-program logic Systematic presentation via structural induction Layout
More informationAxiomatic Semantics. Hoare s Correctness Triplets Dijkstra s Predicate Transformers
Axiomatic Semantics Hoare s Correctness Triplets Dijkstra s Predicate Transformers Goal of a program = IO Relation Problem Specification Properties satisfied by the input and expected of the output (usually
More informationProgramming Languages and Compilers (CS 421)
Programming Languages and Compilers (CS 421) Sasa Misailovic 4110 SC, UIUC https://courses.engr.illinois.edu/cs421/fa2017/cs421a Based in part on slides by Mattox Beckman, as updated by Vikram Adve, Gul
More informationMid-Semester Quiz Second Semester, 2012
THE AUSTRALIAN NATIONAL UNIVERSITY Mid-Semester Quiz Second Semester, 2012 COMP2600 (Formal Methods for Software Engineering) Writing Period: 1 hour duration Study Period: 10 minutes duration Permitted
More informationThe Assignment Axiom (Hoare)
The Assignment Axiom (Hoare) Syntax: V := E Semantics: value of V in final state is value of E in initial state Example: X:=X+ (adds one to the value of the variable X) The Assignment Axiom {Q[E/V ]} V
More informationALGEBRA. 1. Some elementary number theory 1.1. Primes and divisibility. We denote the collection of integers
ALGEBRA CHRISTIAN REMLING 1. Some elementary number theory 1.1. Primes and divisibility. We denote the collection of integers by Z = {..., 2, 1, 0, 1,...}. Given a, b Z, we write a b if b = ac for some
More informationHoare Logic: Reasoning About Imperative Programs
Hoare Logic: Reasoning About Imperative Programs COMP1600 / COMP6260 Dirk Pattinson Australian National University Semester 2, 2018 Programming Paradigms Functional. (Haskell, SML, OCaml,... ) main paradigm:
More informationPolynomial Space. The classes PS and NPS Relationship to Other Classes Equivalence PS = NPS A PS-Complete Problem
Polynomial Space The classes PS and NPS Relationship to Other Classes Equivalence PS = NPS A PS-Complete Problem 1 Polynomial-Space-Bounded TM s A TM M is said to be polyspacebounded if there is a polynomial
More informationSolutions to exercises for the Hoare logic (based on material written by Mark Staples)
Solutions to exercises for the Hoare logic (based on material written by Mark Staples) Exercise 1 We are interested in termination, so that means we need to use the terminology of total correctness, i.e.
More informationProof Calculus for Partial Correctness
Proof Calculus for Partial Correctness Bow-Yaw Wang Institute of Information Science Academia Sinica, Taiwan September 7, 2016 Bow-Yaw Wang (Academia Sinica) Proof Calculus for Partial Correctness September
More informationSpring 2014 Program Analysis and Verification. Lecture 6: Axiomatic Semantics III. Roman Manevich Ben-Gurion University
Spring 2014 Program Analysis and Verification Lecture 6: Axiomatic Semantics III Roman Manevich Ben-Gurion University Syllabus Semantics Static Analysis Abstract Interpretation fundamentals Analysis Techniques
More informationDynamic Semantics. Dynamic Semantics. Operational Semantics Axiomatic Semantics Denotational Semantic. Operational Semantics
Dynamic Semantics Operational Semantics Denotational Semantic Dynamic Semantics Operational Semantics Operational Semantics Describe meaning by executing program on machine Machine can be actual or simulated
More informationIntroduction to Logic in Computer Science: Autumn 2006
Introduction to Logic in Computer Science: Autumn 2006 Ulle Endriss Institute for Logic, Language and Computation University of Amsterdam Ulle Endriss 1 Plan for Today Today s class will be an introduction
More informationA Short Introduction to Hoare Logic
A Short Introduction to Hoare Logic Supratik Chakraborty I.I.T. Bombay June 23, 2008 Supratik Chakraborty (I.I.T. Bombay) A Short Introduction to Hoare Logic June 23, 2008 1 / 34 Motivation Assertion checking
More informationCritical Reading of Optimization Methods for Logical Inference [1]
Critical Reading of Optimization Methods for Logical Inference [1] Undergraduate Research Internship Department of Management Sciences Fall 2007 Supervisor: Dr. Miguel Anjos UNIVERSITY OF WATERLOO Rajesh
More informationTHE AUSTRALIAN NATIONAL UNIVERSITY Second Semester COMP2600/COMP6260 (Formal Methods for Software Engineering)
THE AUSTRALIAN NATIONAL UNIVERSITY Second Semester 2016 COMP2600/COMP6260 (Formal Methods for Software Engineering) Writing Period: 3 hours duration Study Period: 15 minutes duration Permitted Materials:
More informationCSE 105 THEORY OF COMPUTATION
CSE 105 THEORY OF COMPUTATION Spring 2017 http://cseweb.ucsd.edu/classes/sp17/cse105-ab/ Today's learning goals Sipser Ch 5.1 Define and explain core examples of decision problems: A DFA, E DFA, EQ DFA,
More informationHoare Logic: Reasoning About Imperative Programs
Hoare Logic: Reasoning About Imperative Programs COMP1600 / COMP6260 Dirk Pattinson Australian National University Semester 2, 2017 Catch Up / Drop in Lab When Fridays, 15.00-17.00 Where N335, CSIT Building
More informationProgram Analysis and Verification
Program Analysis and Verification 0368-4479 Noam Rinetzky Lecture 4: Axiomatic Semantics Slides credit: Tom Ball, Dawson Engler, Roman Manevich, Erik Poll, Mooly Sagiv, Jean Souyris, Eran Tromer, Avishai
More informationReasoning About Imperative Programs. COS 441 Slides 10b
Reasoning About Imperative Programs COS 441 Slides 10b Last time Hoare Logic: { P } C { Q } Agenda If P is true in the initial state s. And C in state s evaluates to s. Then Q must be true in s. Program
More informationCMPSCI 250: Introduction to Computation. Lecture #11: Equivalence Relations David Mix Barrington 27 September 2013
CMPSCI 250: Introduction to Computation Lecture #11: Equivalence Relations David Mix Barrington 27 September 2013 Equivalence Relations Definition of Equivalence Relations Two More Examples: Universal
More informationProgramming Languages
CSE 230: Winter 2008 Principles of Programming Languages Lecture 6: Axiomatic Semantics Deriv. Rules for Hoare Logic `{A} c {B} Rules for each language construct ` {A} c 1 {B} ` {B} c 2 {C} ` {A} skip
More informationSoundness and Completeness of Axiomatic Semantics
#1 Soundness and Completeness of Axiomatic Semantics #2 One-Slide Summary A system of axiomatic semantics is sound if everything we can prove is also true: if ` { A } c { B } then ² { A } c { B } We prove
More informationFirst Order Logic vs Propositional Logic CS477 Formal Software Dev Methods
First Order Logic vs Propositional Logic CS477 Formal Software Dev Methods Elsa L Gunter 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 Slides based in part on previous lectures
More informationSpring 2015 Program Analysis and Verification. Lecture 6: Axiomatic Semantics III. Roman Manevich Ben-Gurion University
Spring 2015 Program Analysis and Verification Lecture 6: Axiomatic Semantics III Roman Manevich Ben-Gurion University Tentative syllabus Semantics Static Analysis Abstract Interpretation fundamentals Analysis
More informationProgram Analysis Part I : Sequential Programs
Program Analysis Part I : Sequential Programs IN5170/IN9170 Models of concurrency Program Analysis, lecture 5 Fall 2018 26. 9. 2018 2 / 44 Program correctness Is my program correct? Central question for
More informationVerification Frameworks and Hoare Logic
CMSC 630 February 11, 2015 1 Verification Frameworks and Hoare Logic Sources K. Apt and E.-R. Olderog. Verification of Sequential and Concurrent Programs (Second Edition). Springer-Verlag, Berlin, 1997.
More informationCOMP2111 Glossary. Kai Engelhardt. Contents. 1 Symbols. 1 Symbols 1. 2 Hoare Logic 3. 3 Refinement Calculus 5. rational numbers Q, real numbers R.
COMP2111 Glossary Kai Engelhardt Revision: 1.3, May 18, 2018 Contents 1 Symbols 1 2 Hoare Logic 3 3 Refinement Calculus 5 1 Symbols Booleans B = {false, true}, natural numbers N = {0, 1, 2,...}, integers
More informationTHE AUSTRALIAN NATIONAL UNIVERSITY Second Semester COMP2600 (Formal Methods for Software Engineering)
THE AUSTRALIAN NATIONAL UNIVERSITY Second Semester 2012 COMP2600 (Formal Methods for Software Engineering) Writing Period: 3 hours duration Study Period: 15 minutes duration Permitted Materials: One A4
More informationHoare Logic (I): Axiomatic Semantics and Program Correctness
Hoare Logic (I): Axiomatic Semantics and Program Correctness (Based on [Apt and Olderog 1991; Gries 1981; Hoare 1969; Kleymann 1999; Sethi 199]) Yih-Kuen Tsay Dept. of Information Management National Taiwan
More informationCS 301. Lecture 18 Decidable languages. Stephen Checkoway. April 2, 2018
CS 301 Lecture 18 Decidable languages Stephen Checkoway April 2, 2018 1 / 26 Decidable language Recall, a language A is decidable if there is some TM M that 1 recognizes A (i.e., L(M) = A), and 2 halts
More informationTHE AUSTRALIAN NATIONAL UNIVERSITY Second Semester COMP2600 (Formal Methods in Software Engineering)
THE AUSTRALIAN NATIONAL UNIVERSITY Second Semester 2007 COMP2600 (Formal Methods in Software Engineering) Writing Period: 3 hours duration Study Period: 15 minutes duration Permitted Materials: None Answer
More informationCS156: The Calculus of Computation Zohar Manna Autumn 2008
Page 3 of 52 Page 4 of 52 CS156: The Calculus of Computation Zohar Manna Autumn 2008 Lecturer: Zohar Manna (manna@cs.stanford.edu) Office Hours: MW 12:30-1:00 at Gates 481 TAs: Boyu Wang (wangboyu@stanford.edu)
More informationChapter 7 Propositional Satisfiability Techniques
Lecture slides for Automated Planning: Theory and Practice Chapter 7 Propositional Satisfiability Techniques Dana S. Nau CMSC 722, AI Planning University of Maryland, Spring 2008 1 Motivation Propositional
More informationDeductive Verification
Deductive Verification Mooly Sagiv Slides from Zvonimir Rakamaric First-Order Logic A formal notation for mathematics, with expressions involving Propositional symbols Predicates Functions and constant
More informationAxiomatic semantics. Semantics and Application to Program Verification. Antoine Miné. École normale supérieure, Paris year
Axiomatic semantics Semantics and Application to Program Verification Antoine Miné École normale supérieure, Paris year 2015 2016 Course 6 18 March 2016 Course 6 Axiomatic semantics Antoine Miné p. 1 /
More informationEssential facts about NP-completeness:
CMPSCI611: NP Completeness Lecture 17 Essential facts about NP-completeness: Any NP-complete problem can be solved by a simple, but exponentially slow algorithm. We don t have polynomial-time solutions
More informationAutomata Theory and Formal Grammars: Lecture 1
Automata Theory and Formal Grammars: Lecture 1 Sets, Languages, Logic Automata Theory and Formal Grammars: Lecture 1 p.1/72 Sets, Languages, Logic Today Course Overview Administrivia Sets Theory (Review?)
More informationCS 336. We use the principle of inclusion and exclusion. Let B. = {five digit decimal numbers ending with a 5}, and
CS 336 1. The important issue is the logic you used to arrive at your answer. 2. Use extra paper to determine your solutions then neatly transcribe them onto these sheets. 3. Do not submit the scratch
More informationAN INTRODUCTION TO SEPARATION LOGIC. 2. Assertions
AN INTRODUCTION TO SEPARATION LOGIC 2. Assertions John C. Reynolds Carnegie Mellon University January 7, 2011 c 2011 John C. Reynolds Pure Assertions An assertion p is pure iff, for all stores s and all
More informationChapter 7 Propositional Satisfiability Techniques
Lecture slides for Automated Planning: Theory and Practice Chapter 7 Propositional Satisfiability Techniques Dana S. Nau University of Maryland 12:58 PM February 15, 2012 1 Motivation Propositional satisfiability:
More informationProgram verification. 18 October 2017
Program verification 18 October 2017 Example revisited // assume(n>2); void partition(int a[], int n) { int pivot = a[0]; int lo = 1, hi = n-1; while (lo
More informationWhy Learning Logic? Logic. Propositional Logic. Compound Propositions
Logic Objectives Propositions and compound propositions Negation, conjunction, disjunction, and exclusive or Implication and biconditional Logic equivalence and satisfiability Application of propositional
More informationLecture Notes on Software Model Checking
15-414: Bug Catching: Automated Program Verification Lecture Notes on Software Model Checking Matt Fredrikson André Platzer Carnegie Mellon University Lecture 19 1 Introduction So far we ve focused on
More information1 Propositional Logic
CS 2800, Logic and Computation Propositional Logic Lectures Pete Manolios Version: 384 Spring 2011 1 Propositional Logic The study of logic was initiated by the ancient Greeks, who were concerned with
More informationIn this episode of The Verification Corner, Rustan Leino talks about Loop Invariants. He gives a brief summary of the theoretical foundations and
In this episode of The Verification Corner, Rustan Leino talks about Loop Invariants. He gives a brief summary of the theoretical foundations and shows how a program can sometimes be systematically constructed
More informationComputation and Logic Definitions
Computation and Logic Definitions True and False Also called Boolean truth values, True and False represent the two values or states an atom can assume. We can use any two distinct objects to represent
More informationProof Techniques (Review of Math 271)
Chapter 2 Proof Techniques (Review of Math 271) 2.1 Overview This chapter reviews proof techniques that were probably introduced in Math 271 and that may also have been used in a different way in Phil
More informationPart V. Intractable Problems
Part V Intractable Problems 507 Chapter 16 N P-Completeness Up to now, we have focused on developing efficient algorithms for solving problems. The word efficient is somewhat subjective, and the degree
More informationDenotational Semantics
5 Denotational Semantics In the operational approach, we were interested in how a program is executed. This is contrary to the denotational approach, where we are merely interested in the effect of executing
More informationKB Agents and Propositional Logic
Plan Knowledge-Based Agents Logics Propositional Logic KB Agents and Propositional Logic Announcements Assignment2 mailed out last week. Questions? Knowledge-Based Agents So far, what we ve done is look
More informationLecture 17: Floyd-Hoare Logic for Partial Correctness
Lecture 17: Floyd-Hoare Logic for Partial Correctness Aims: To look at the following inference rules Page 1 of 9 sequence; assignment and consequence. 17.1. The Deduction System for Partial Correctness
More informationTruth-Functional Logic
Truth-Functional Logic Syntax Every atomic sentence (A, B, C, ) is a sentence and are sentences With ϕ a sentence, the negation ϕ is a sentence With ϕ and ψ sentences, the conjunction ϕ ψ is a sentence
More informationFoundations of Computation
The Australian National University Semester 2, 2018 Research School of Computer Science Tutorial 6 Dirk Pattinson Foundations of Computation The tutorial contains a number of exercises designed for the
More informationChapter 3 Deterministic planning
Chapter 3 Deterministic planning In this chapter we describe a number of algorithms for solving the historically most important and most basic type of planning problem. Two rather strong simplifying assumptions
More informationLecture Notes on Compositional Reasoning
15-414: Bug Catching: Automated Program Verification Lecture Notes on Compositional Reasoning Matt Fredrikson Ruben Martins Carnegie Mellon University Lecture 4 1 Introduction This lecture will focus on
More informationChapter 3. Cartesian Products and Relations. 3.1 Cartesian Products
Chapter 3 Cartesian Products and Relations The material in this chapter is the first real encounter with abstraction. Relations are very general thing they are a special type of subset. After introducing
More informationWe are going to discuss what it means for a sequence to converge in three stages: First, we define what it means for a sequence to converge to zero
Chapter Limits of Sequences Calculus Student: lim s n = 0 means the s n are getting closer and closer to zero but never gets there. Instructor: ARGHHHHH! Exercise. Think of a better response for the instructor.
More informationThis is logically equivalent to the conjunction of the positive assertion Minimal Arithmetic and Representability
16.2. MINIMAL ARITHMETIC AND REPRESENTABILITY 207 If T is a consistent theory in the language of arithmetic, we say a set S is defined in T by D(x) if for all n, if n is in S, then D(n) is a theorem of
More informationMathematical Foundations of Logic and Functional Programming
Mathematical Foundations of Logic and Functional Programming lecture notes The aim of the course is to grasp the mathematical definition of the meaning (or, as we say, the semantics) of programs in two
More informationCS156: The Calculus of Computation
Page 1 of 61 CS156: The Calculus of Computation Zohar Manna Winter 2010 Chapter 5: Program Correctness: Mechanics Page 2 of 61 Program A: LinearSearch with function specification @pre 0 l u < a @post rv
More informationA Humble Introduction to DIJKSTRA S A A DISCIPLINE OF PROGRAMMING
A Humble Introduction to DIJKSTRA S A A DISCIPLINE OF PROGRAMMING Do-Hyung Kim School of Computer Science and Engineering Sungshin Women s s University CONTENTS Bibliographic Information and Organization
More informationProbabilistic Guarded Commands Mechanized in HOL
Probabilistic Guarded Commands Mechanized in HOL Joe Hurd joe.hurd@comlab.ox.ac.uk Oxford University Joint work with Annabelle McIver (Macquarie University) and Carroll Morgan (University of New South
More informationAnnouncements. CS311H: Discrete Mathematics. Propositional Logic II. Inverse of an Implication. Converse of a Implication
Announcements CS311H: Discrete Mathematics Propositional Logic II Instructor: Işıl Dillig First homework assignment out today! Due in one week, i.e., before lecture next Wed 09/13 Remember: Due before
More informationChapter 2. Assertions. An Introduction to Separation Logic c 2011 John C. Reynolds February 3, 2011
Chapter 2 An Introduction to Separation Logic c 2011 John C. Reynolds February 3, 2011 Assertions In this chapter, we give a more detailed exposition of the assertions of separation logic: their meaning,
More informationCompleteness in the Monadic Predicate Calculus. We have a system of eight rules of proof. Let's list them:
Completeness in the Monadic Predicate Calculus We have a system of eight rules of proof. Let's list them: PI At any stage of a derivation, you may write down a sentence φ with {φ} as its premiss set. TC
More informationPROBLEM SET 3: PROOF TECHNIQUES
PROBLEM SET 3: PROOF TECHNIQUES CS 198-087: INTRODUCTION TO MATHEMATICAL THINKING UC BERKELEY EECS FALL 2018 This homework is due on Monday, September 24th, at 6:30PM, on Gradescope. As usual, this homework
More informationA Tutorial Introduction to CSP in Unifying Theories of Programming
A Tutorial Introduction to CSP in Unifying Theories of Programming Ana Cavalcanti and Jim Woodcock Department of Computer Science University of York Heslington, York YO10 5DD, UK {Ana.Cavalcanti,Jim.Woodcock}@cs.york.ac.uk
More informationIntroduction to Axiomatic Semantics
#1 Introduction to Axiomatic Semantics #2 How s The Homework Going? Remember that you can t just define a meaning function in terms of itself you must use some fixed point machinery. #3 Observations A
More informationCIS (More Propositional Calculus - 6 points)
1 CIS6333 Homework 1 (due Friday, February 1) 1. (Propositional Calculus - 10 points) --------------------------------------- Let P, Q, R range over state predicates of some program. Prove or disprove
More informationPropositional Language - Semantics
Propositional Language - Semantics Lila Kari University of Waterloo Propositional Language - Semantics CS245, Logic and Computation 1 / 41 Syntax and semantics Syntax Semantics analyzes Form analyzes Meaning
More informationCHAPTER 4 CLASSICAL PROPOSITIONAL SEMANTICS
CHAPTER 4 CLASSICAL PROPOSITIONAL SEMANTICS 1 Language There are several propositional languages that are routinely called classical propositional logic languages. It is due to the functional dependency
More informationInformal Statement Calculus
FOUNDATIONS OF MATHEMATICS Branches of Logic 1. Theory of Computations (i.e. Recursion Theory). 2. Proof Theory. 3. Model Theory. 4. Set Theory. Informal Statement Calculus STATEMENTS AND CONNECTIVES Example
More informationHerbrand Theorem, Equality, and Compactness
CSC 438F/2404F Notes (S. Cook and T. Pitassi) Fall, 2014 Herbrand Theorem, Equality, and Compactness The Herbrand Theorem We now consider a complete method for proving the unsatisfiability of sets of first-order
More informationCM10196 Topic 2: Sets, Predicates, Boolean algebras
CM10196 Topic 2: Sets, Predicates, oolean algebras Guy McCusker 1W2.1 Sets Most of the things mathematicians talk about are built out of sets. The idea of a set is a simple one: a set is just a collection
More informationDesign of Distributed Systems Melinda Tóth, Zoltán Horváth
Design of Distributed Systems Melinda Tóth, Zoltán Horváth Design of Distributed Systems Melinda Tóth, Zoltán Horváth Publication date 2014 Copyright 2014 Melinda Tóth, Zoltán Horváth Supported by TÁMOP-412A/1-11/1-2011-0052
More informationAnnouncements. Assignment 5 due today Assignment 6 (smaller than others) available sometime today Midterm: 27 February.
Announcements Assignment 5 due today Assignment 6 (smaller than others) available sometime today Midterm: 27 February. You can bring in a letter sized sheet of paper with anything written in it. Exam will
More informationMathematics 114L Spring 2018 D.A. Martin. Mathematical Logic
Mathematics 114L Spring 2018 D.A. Martin Mathematical Logic 1 First-Order Languages. Symbols. All first-order languages we consider will have the following symbols: (i) variables v 1, v 2, v 3,... ; (ii)
More information