Programming Languages

Transcription

1 CSE 230: Winter 2008 Principles of Programming Languages Lecture 7: Axiomatic Semantics Axiomatic Semantics over low Graphs c {P} if P P {P } {Q} c if Q Q {Q} {Q } Ranjit Jhala UC San Diego Relaxing specifications via rule of consequence Sequential Composition Conditionals C 1 C 2 {P} {Q} {R} {x-1 y} y-1} {x y} x:= x-1 {x y-1} { x 0. x 0 y y:= y-1 Æ x=x 0-1} {x y} Backwards using weakest preconditions orwards using strongest postconditions { y 0 x 0. x 0 y 0 Æ x=x 0-1 Æ y=y 0-1} {P} E {PÆE} { PÆ E} { x 0 } x=0 {x 0Æx=0} { x 0 {x 1} Æ x=0 } orwards {(P 1 ÆE)Ç(P 2 Æ E)} E {P 1 } { P 2 } { x=0 Ç x 1} x=0 {x=0} {x 1} Backwards

2 Joins Conditional+Join: orward { x 0 Ç a = 0 } {P 1 } {P 2 } {P} {P} { x 0 } a := 2*x x<>0 { x=0 Æ a=0 } { x 0 Ç a = 2*x} {P 1 Ç P 2 } {P} { a == 2*x } orwards Backwards Check the implications (simplifications) Conditionals+Joins: Backward { (x 0 Æ true) Ç (x = 0 Æ a = 2*x) } x<>0 { 2*x = 2*x } { a = 2*x } { a = 2*x} a := 2*x { a = 2*x } orward or Backward? orward reasoning Know the precondition Want to know what postcond the code guarantees Backward reasoning Know what we want to code to establish Want to know under what preconditions this happens

3 Another Example: Double Locking lock Locking Rules Boolean variable locked = lock is held or not unlock unlock lock { locked Æ P[true/locked] } lock { P } lock behaves as assert(!locked);locked:=true An attempt to re-acquire an acquired lock or release a released lock will cause a deadlock. { locked Æ P[false/locked] } unlock { P } unlock behaves as assert(locked);locked:=false Calls to lock and unlock must alternate. Locking Example { locked Æ x = 0 } { locked Æ x = 0 } { locked Æ x = 0 } lock x=0 { locked } { locked Æ x 0 } {lockedæx=0 Ç lockedæ x 0) } x=0 { locked Æ x = 0 } { locked Æ x 0 } { locked Æ (x = 0) } unlock { locked } Review x:=e { Q } { P } if Q P[E\x] } { P } { P 1 } { P 2 } { P } if P 1 P and P 2 P E { P 1 } { P 2 } if PÆE P 1 if PÆ E P 2 Implication is always in the direction of the control flow

4 What about real languages? Loops unction calls Pointers Reasoning about loops: Rules ` {A Æ b} c {A} ` {A} while b do c {AÆ b} Rewrite A with I : Loop Invariant P I ` {I Æ b} c {I} ` {I} while b do c {IÆ b} ` {P} while b do c {Q} Rule of Consequence IÆ b Q Reasoning about loops: low Graphs Loops can be handled using conditionals and joins Consider the while b do S statement { P } { I } Loop invariant { I } S b { Q } { I Æ E } if P I (loop invariant holds initially) and IÆ b Q (loop establishes the postcondition) and { I Æ b } S { I } (loop invariant is preserved) Loop Example Verify: {x=8 Æ y=16} while(x>0){x--; y-=2;} {y=0} x--; y-=2 { I } { I Æ x>0 } x>0 { x = 8 Æ y = 16 } { I } ind an appropriate invariant I Holds initially x = 8 Æ y = 16 Holds at the end y == 0 { y = 0 }

5 Loop Example (II) Guess invariant y = 2*x { y = 2*x } x--; y-=2 { x = 8 Æ y = 16 } { y = 2*x } x>0 { y = 0 } { y = 2*x Æ x > 0 } Check : Initial: x = 8 Æ y = 16 y = 2*x Preservation: y = 2*x Æ x>0 y 2 = 2*(x 1) inal: y = 2*x Æ x 0 y = 0 Invalid Loop Example (III) Guess invariant y = 2*x Æ x 0 { y=2*x Æ x 0} { x = 8 Æ y = 16 } { y = 2*x Æ x 0} x>0 { y = 0 } x--; y-=2 { y = 2*x Æ x 0 Æ x>0 } Check Initial: x = 8 Æ y = 16 y = 2*x Æ x 0 Preservation: y = 2*x Æ x 0 Æ x>0 y 2 = 2*(x 1) Æ x 1 0 inal: y = 2*x Æ x 0 Æ x 0 y = 0 Loops Discussion Simple forward/backward propagation fails Require loop invariants Hardest part of program verification Guess the invariants (existing programs) Write the invariants (new programs) Note: Invariant depends on what you want to prove! Verification Example int square(int n) { int k=0, r=0, s=1; while(k!= n) { { true } r = r + s; k:=0 s=s+2; Pick I: r = k r:=0 2 k=k + 1; s:=1 } { r=0 Æ k=0} return r;??? } I : {r = k 2 } r:=r+s s:=s+2 k!=n k:=k+1 k {r=n 2 } {r=k 2 {r=k Æ k=n} 2 Æk=n} Need: {r=k 2 Æ k=n} c {r=k 2 } i.e. {r=k 2 Æ k=n} WP(c,{r=k 2 }) i.e. {r=k 2 Æ k=n} {r+s=(k+1) 2 } Invalid

6 Verification Example Need: {r=k 2 Æ s=2k+1 Æ } c {r=k 2 Æ s=2k+1} i.e. {r=k 2 Æ s=2k+1 } WP(c,{r=k 2 Æs=2k+1}) i.e. {r=k 2 Æ s=2k+1 } {r+s=(k+1) 2 Æ (s+2) = 2(k+1)+1}??? { true } Valid k:=0 r:=0 s:=1 { r=0 Æ k=0 Æ s=0} I : {r=k 2 Æ s=2k+1} r:=r+s s:=s+2 k!=n {r=k 2 k:=k+1 {r=n 2 } {r=k 2 Æs=2k+1Æ } Æs=2k+1 Æk=n} What about real languages? Loops unction calls Pointers unctions are big instructions Suppose we have verified bsearch int bsearch(int a[], int p) { { sorted(a) } Precondition { r=-1 Ç (r 0 Æ r < a.length Æ a[r]=p)} return res; Postcondition } unction spec = precondition i + postconditon Also called a contract unction Calls Consider a call to function y:=f(int E) return variable r precondition Pre, postcondition Post Rule for function call: ` P Pre[E/x] `{Pre} f {Post} ` Post[E/x,y/r] Q ` {P} y:=f(e){q}

7 unction Calls Consider a call to function y:=f(int x) return variable r precondition Pre, postcondition Post Rule for function call: y = (E) { P } if P Pre[E/x] } { Q } and Post[E/x,y/r] Q unction Call: Example int bsearch(int a[],int p) { Consider the call { sorted(a) } {sorted(arr) } { r=-1ç(r 0 Æ r<a.lengthæ a[r]=p)} [] y:=bsearch(arr,5) return res; {y=-1 Ç arr[y]=5} } if(y!=-1){ {y!=-1 Æ (y=-1çarr[y]=5} {arr[y]=5} sorted[array] ay] Pre[a := array] ay] Post[y/r,arr/a, 5/p] (y=-1 Ç arr[y]=5) What about real languages? Loops unction calls Pointers Assignment and Aliasing Does assignment rule work with aliasing? If *x and *y are aliased then: {x=y} *x:=5 {*x+*y=10}

8 Hoare Rules: Assignment and References When is the following Hoare triple valid? { A } *x := 5 { *x + *y = 10 } Ashould be *y = 5 or x = y but Hoare rule for assignment gives: [5/*x](*x + *y = 10) = 5 + *y = 10 = *y = 5 (uh oh! we lost one case! What gives?) Hoare Rules: Assignment and References Modeling writes with memory expressions reat memory as a whole w/ memory variables (M) upd(m,e 1,E 2 ) : update M at addr E 1 with value E 2 sel(m,e 1 ) : read M at address E 1 Reason about memory expressions with McCarthy s rule sel(upd(m, E 1, E 2 ), E 3 ) = E 2 if E 1 = E 3 sel(m, E 3 ) if E 1 E 3 Assignment (update) changes the value of memory {B[upd(M, E 1 1, E 2 2) )/M]} *E 1:=E 2 {B} Memory Aliasing Consider again: {A} *x:=5 {*x+*y=10 {x+y=10} We obtain: A = [upd(m, x, 5)/M] (*x+*y=10) = [upd(m, x, 5)/M] (sel(m,x) + sel(m,y) = 10) = sel(upd(m, x, 5), x) + sel(upd(m, x, 5), y) = 10 = 5 + sel(upd(m, x, 5), y) = 10 = if x = y then = 10 else 5 + sel(m, y) = 10 = x=y or *y = 5 Program Verification ools Semi-automated You write some invariants and specifications ool tries to fill in the other invariants And to prove all implications Explains when implication is invalid: counterexample for your specification ESC/Java is one of the best tools

9 Algorithmic Program Verification or how does ESC/Java work? Q: How to algorithmically i ll prove {P} c {Q}? If no loops: 1. Compute: WP(c,Q) 2. Prove: P WP(c,Q) Verification Condition Discharged using Auto. heorem Prover VC Generation for Loops Suppose all loops annotated with Invariant while I b do c Again, lets compute a VC such that: if VC is valid (true) then {P} c {Q} Q: Why not iff? as the loop invariants i may be bogus VCGen We will write a function VCG: comm (pred pred list) (pred pred list) Suppose (Q,L ) = VCG(c,(Q,L)) hen VC for {P} c {Q} is: P Q Æ {f in L } f L : the set of conditions that must be true rom loops (init,preservation,final) Q : precondition modulo invariants VCGen VCG: comm (pred pred list) (pred pred list) VCG(c,(Q,L)) (Q = (Q,L L ) hen VC for {P} c {Q} is: P Q Æ {f in L } f let rec VCG(c,(Q,L)) = match c with x:= e -> (Q[e/x], L) c1;c2 -> VCG(c1,VCG(c2,(Q, L))) c1;c2 > VCG(c1,VCG(c2,(Q, L))) if b then c1 else c2 -> let (Q1,L1) = VCG( c1,(q, L)) (Q2 L2) VCG( 2 (Q L)) (Q2,L2) = VCG( c2,(q, L)) in ((bæq1)ç( bæq2), L1 L2 ) while I b do c -> let (Q,L ) = VCG(c,(Q, L)) in (I, L {IÆb Q } {IÆ b Q} )

10 ESC/Java Semi-automated You write the invariants ESC/Java: VCGen: Simplify: heoremprover to prove VC Explains when implication is invalid: counterexample for your specification