Spring 2015 Program Analysis and Verification. Lecture 4: Axiomatic Semantics I. Roman Manevich Ben-Gurion University

Transcription

1 Spring 2015 Program Analysis and Verification Lecture 4: Axiomatic Semantics I Roman Manevich Ben-Gurion University

2 Agenda Basic concepts of correctness Axiomatic semantics (pages ) Hoare Logic Properties of the semantics Weakest precondition 2

3 Tentative syllabus Semantics Static Analysis Abstract Interpretation fundamentals Analysis Techniques Crafting your own Natural Semantics Automating Hoare Logic Lattices Numerical Domains Soot Structural semantics Control Flow Graphs Fixed-Points Alias analysis From proofs to abstractions Axiomatic Verification Equation Systems Chaotic Iteration Interprocedural Analysis Systematically developing transformers Collecting Semantics Galois Connections Shape Analysis Domain constructors CEGAR Widening/ Narrowing 3

4 program correctness 4

5 Program correctness concepts Property = a certain relationship between initial state and final state Main focus of this course Partial correctness = properties that hold if program terminates Termination = program always terminates i.e., for every input state partial correctness + termination = total correctness Other correctness concepts exist: liveness, resource usage, 5

6 Factorial example S fac y := 1; while (x=1) do (y := y*x; x := x 1) Factorial partial correctness property = if the statement terminates then the final value of y will be the factorial of the initial value of x What if x < 0? Formally, using natural semantics:? S fac, implies y = ( x)! 6

7 Verifying factorial with natural semantics 7

8 Natural semantics for While [ass ns ] [skip ns ] [comp ns ] [if tt ns] [if ff ns] [while ff ns] x := a, [x A a ] skip, S 1,, S 2, S 1 ; S 2, S 1, if b then S 1 else S 2, S 2, if b then S 1 else S 2, while b do S, if B b = tt if B b = ff if B b = ff [while tt ns] S,, while b do S, while b do S, if B b = tt 8

9 Staged proof 9

10 Stages s y (s x)! = s y (s x)! s x > 0 s s y (s x)! = s y (s x)! s x = 1 s x > 0 y := y*x; x := x 1 s s while (x=1) do (y := y*x; x := x 1) s s y = (s x)! s x > 0 s y := 1; while (x=1) do (y := y*x; x := x 1) s 10

11 Inductive proof over iterations s y (s x)! = s y (s x)! s x > 0 s (y := y*x; x := x 1) s s while (x=1) do (y := y*x; x := x 1) s s y (s x)! = s y (s x)! s x = 1 s x > 0 s while (x=1) do (y := y*x; x := x 1) s s y (s x)! = s y (s x)! s x = 1 s x > 0 11

12 First stage 12

13 Second stage 13

14 while (x=1) do (y := y*x; x := x 1), s s 14

15 Third stage 15

16 How easy was that? Proof is very laborious Need to connect all transitions and argue about relationships between their states Reason: too closely connected to semantics of programming language Proof is long Makes it hard to find possible mistakes How did we know to find this proof? Is there a methodology? 16

17 I ll use operational semantics Can you prove my program correct? Better use axiomatic verification 17

18 One of the oldest surviving fragments of Euclid's Elements, a textbook used for millennia to teach proof-writing techniques. The diagram accompanies Book II, Proposition 5 "P. Oxy. I 29" by Euclid - Licensed under Public Domain via Wikimedia Commons

19 A systematic approach to program verification 19

20 Axiomatic verification approach What do we need in order to prove that the program does what it supposed to do? Specify the required behavior: express properties Compare the behavior with the one obtained by the operational semantics Develop a proof system for showing that the program satisfies a requirement Mechanically use the proof system to show correctness 20

21 Axiomatic semantics contributors Robert Floyd C.A.R. Hoare Edsger W. Dijkstra 1967: use assertions as foundation for static correctness proofs 1969: use Floyd s ideas to define axiomatic semantics An axiomatic basis for computer programming Predicate transformer semantics: weakest precondition and strongest postcondition 21

22 Assertions, a.k.a Hoare triples { P } C { Q } precondition statement a.k.a command postcondition P and Q are state predicates expressed as logical formulas Example: x>0 If P holds in the initial state, and if execution of C terminates on that state, then Q will hold in the state in which C halts C is not required to always terminate {true} while true do skip {false} 22

23 Total correctness assertions [ P ] C [ Q ] If P holds in the initial state, execution of C must terminate on that state, and Q will hold in the state in which C halts 23

24 Specifying correctness of factorial 24

25 Factorial example: specify precondition/postcondition {? } y := 1; while (x=1) do (y := y*x; x := x 1) {? } 25

26 First attempt We need a way to remember value of x before execution { x>0 } y := 1; while (x=1) do (y := y*x; x := x 1) { y=x! } Holds only for value of x at state after execution finishes 26

27 Fixed assertion A logical variable, must not appear in statement - immutable { x=n } y := 1; while (x=1) do (y := y*x; x := x 1) { y=n! n>0 } 27

28 The proof outline { n!*(n+1) = (n+1)! } Background axiom { x=n } y := 1; { x>0 y*x!=n! n x } while (x=1) do { x-1>0 (y*x)*(x-1)!=n! n (x-1) } y := y*x; { x-1>0 y*(x-1)!=n! n (x-1) } x := x 1 { y*x!=n! n>0 x=1 } 28

29 Formalizing partial correctness via hoare logic 29

30 States and predicates program states (State) undefined A state predicate P is a (possibly infinite) set of states P P holds in state P 30

31 FO Logic reminder We write A B if for all states if A then B { A } { B } For every predicate A: false A true We write A B if A B and B A false 5=7 In writing Hoare-style proofs, we will often replace a predicate A with A such that A A and A is simpler 31

32 Formalizing Hoare triples S ns C = { P } C { Q } if C, else,. ( P C, ) Q alternatively Convention: P for all P. P S ns C Q P C Q C(P) Why did we choose natural semantics? 32

33 Formalizing Hoare triples S sos C = { P } C { Q } if C, * else,. ( P C, * ) Q alternatively Convention: P for all P. P S sos C Q P C Q C(P) 33

34 How do we express predicates? Extensional approach Abstract mathematical functions P : State {tt, ff} Intensional approach via language of formulae 34

35 An assertion language Bexp is not expressive enough to express predicates needed for many proofs Extend Bexp Allow quantification z. z. z. z = k n Import well known mathematical concepts n! n (n-1)

36 An assertion language Either a program variables or a logical variable a ::= n x a 1 + a 2 a 1 a 2 a 1 a 2 A ::= true false a 1 = a 2 a 1 a 2 A A 1 A 2 A 1 A 2 A 1 A 2 z. A z. A 36

37 Some FO logic definitions before we get to the rules 37

38 Free/bound variables A variable is said to be bound in a formula when it occurs in the scope of a quantifier Otherwise it is said to be free i. k=i m (i ) i. j+1=i+3) FV(A) the free variables of A Defined inductively on the abstract syntax tree of A 38

39 Computing free variables FV(n) {} FV(x) {x} FV(a 1 +a 2 ) FV(a 1 a 2 ) FV(a 1 -a 2 ) FV(a 1 ) FV(a 2 ) FV(true) FV(false) {} FV(a 1 =a 2 ) FV(a 1 a 2 ) FV(a 1 ) FV(a 2 ) FV( A) FV(A) FV(A 1 A 2 ) FV(A 1 A 2 ) FV(A 1 A 2 ) FV(a 1 ) FV(a 2 ) FV( z. A) FV( z. A) FV(A) \ {z} 39

40 Substitution An expression t is pure (a term) if it does not contain quantifiers A[t/z] denotes the assertion A which is the same as A, except that all instances of the free variable z are replaced by t A i. k=i m A[5/k] =? A[5/i] =? 40

41 Calculating substitutions n[t/z] = n x[t/z] = x x[t/x] = t (a 1 + a 2 )[t/z] = a 1 [t/z] + a 2 [t/z] (a 1 a 2 )[t/z] = a 1 [t/z] a 2 [t/z] (a 1 - a 2 )[t/z] = a 1 [t/z] - a 2 [t/z] 41

42 Calculating substitutions true[t/x] = true false[t/x] = false (a 1 = a 2 )[t/z] = a 1 [t/z] = a 2 [t/z] (a 1 a 2 )[t/z]= a 1 [t/z] a 2 [t/z] ( A)[t/z] = (A[t/z]) (A 1 A 2 )[t/z] = A 1 [t/z] A 2 [t/z] (A 1 A 2 )[t/z] = A 1 [t/z] A 2 [t/z] (A 1 A 2 )[t/z] = A 1 [t/z] A 2 [t/z] ( z. A)[t/z] = z. A ( z. A)[t/y] = z. A[t/y] ( z. A)[t/z] = z. A ( z. A)[t/y] = z. A[t/y] 42

43 six are completely enough and now the rules 43

44 Axiomatic semantics for While Notice similarity to natural semantics rules [ass p ] [skip p ] [comp p ] { P[a/x] } x := a { P } { P } skip { P } { P } S 1 { Q }, { Q } S 2 { R } { P } S 1 ; S 2 { R } [if p ] { b P } S 1 { Q }, { b P } S 2 { Q } { P } if b then S 1 else S 2 { Q } What s different about this rule? [while p ] { b P } S { P } { P } while b do S { b P } [cons p ] { P } S { Q } { P } S { Q } if P P and Q Q 44

45 Assignment rule [ass p ] { P[a/x] } x := a { P } A backwards rule x := a always finishes Why is this true? Recall operational semantics: [x A a ] P [ass ns ] x:= a, [x A a ] Exercises: {?} x:=y*z {x<9} {?} x:=x+1 {x>8} {?} x:=y*z {w=5} 45

46 skip rule [skip p ] { P } skip { P } [skip ns ] skip, 46

47 Composition rule [comp p ] { P } S 1 { Q }, { Q } S 2 { R } { P } S 1 ; S 2 { R } [comp ns ] S 1,, S 2, S 1 ; S 2, Holds when S 1 terminates in every state where P holds and then Q holds and S 2 terminates in every state where Q holds and then R holds 47

48 Condition rule [if p ] { b P } S 1 { Q }, { b P } S 2 { Q } { P } if b then S 1 else S 2 { Q } [if tt ns] [if ff ns] S 1, if b then S 1 else S 2, S 2, if b then S 1 else S 2, if B b = tt if B b = ff 48

49 Loop rule [while p ] { b P } S { P } { P } while b do S { b P } [while ff ns] [while tt ns] while b do S, S,, while b do S, while b do S, if B b = ff if B b = tt Here P is called an invariant for the loop Holds before and after each loop iteration Finding loop invariants most challenging part of proofs When loop finishes, b is false 49

50 Rule of consequence [cons p ] { P } S { Q } { P } S { Q } if P P and Q Q Allows strengthening the precondition and weakening the postcondition The only rule that is not related to a statement 50

51 Rule of consequence [cons p ] { P } S { Q } { P } S { Q } if P P and Q Q Why do we need it? Allows the following {y*z<9} x:=y*z {x<9} {y*z<9 w=5} x:=y*z {x<9} 51

52 Next lecture: axiomatic semantics II