Predicate Transforms I

Transcription

1 Predicate Transforms I Software Testing and Verification Lecture Notes 19 Prepared by Stephen M. Thebaut, Ph.D. University of Florida

2 Predicate Transforms I 1. Introduction: weakest pre-conditions (wp s) weakest liberal pre-conditions (wlp s) strongest post-conditions (sp s) 2. Proving {P} S {Q} using predicate transforms 3. Transform rules for: assignment statements sequencing selection statements

3 Introduction What are Predicate Transforms? Rules for transforming post-conditions into pre-conditions or vice-versa. They provide algorithms to reduce the problem of verifying Hoare triples to proving predicate calculus formulas. Thus, predicate transforms operationalize Hoare Logic. Also known as Predicate Transformers

4 Introduction (cont d) What is a weakest pre-condition? It is the weakest condition on the initial state of program S ensuring termination in state Q. It is denoted wp(s,q) and read, the weakest pre-condition of S with respect to Q.

5 Introduction (cont d) What is a weakest liberal pre-condition? It is the weakest condition on the initial state of program S ensuring state Q on termination IF S TERMINATES. It is denoted wlp(s,q) and read, the weakest liberal pre-condition of S with respect to Q.

6 Introduction (cont d) What is a strongest post-condition? It is the strongest condition on the final state of program S given that P holds initially and GIVEN THAT S TERMINATES. It is denoted sp(s,p) and read, the strongest post-condition of S with respect to P.

7 Predicate Transforms I 1. Introduction: weakest pre-conditions (wp s) weakest liberal pre-conditions (wlp s) strongest post-conditions (sp s) 2. Proving {P} S {Q} using predicate transforms 3. Transform rules for: assignment statements sequencing selection statements

8 ROI s (algorithms) for proving program correctness using predicate transforms P wp(s,q) {P} S {Q} strongly P wlp(s,q) {P} S {Q} sp(s,p) Q {P} S {Q}

9 ROI s (algorithms) for proving program correctness (cont d) Note the relationship between weakest liberal pre-conditions and strongest postconditions: P wlp(s,q) sp(s,p) Q We now consider rules for computing predicate transforms for structured programs comprised of assignment statements, if-then (-else) statements, and (in part II) while loops.

10 Predicate Transforms I 1. Introduction: weakest pre-conditions (wp s) weakest liberal pre-conditions (wlp s) strongest post-conditions (sp s) 2. Proving {P} S {Q} using predicate transforms 3. Transform rules for: assignment statements sequencing selection statements

11 wp and wlp Rule for Assignment Statements Rule: w(l)p(x:=e, Q(x,y,z)) Q(E,y,z)

12 wp and wlp Rule for Assignment Statements Rule: w(l)p(x:=e, Q(x,y,z)) Q(E,y,z) Examples: w(l)p(x:=y+3, x>0) =

13 wp and wlp Rule for Assignment Statements Rule: w(l)p(x:=e, Q(x,y,z)) Q(E,y,z) Examples: w(l)p(x:=y+3, x>0) = w(l)p(x:=x+1, x n+1) =

14 wp and wlp Rule for Assignment Statements Rule: w(l)p(x:=e, Q(x,y,z)) Q(E,y,z) Examples: w(l)p(x:=y+3, x>0) = w(l)p(x:=x+1, x n+1) = w(l)p(x:=7, x=7) = (cont d)

15 wp and wlp Rule for Assignment Statements Rule: w(l)p(x:=e, Q(x,y,z)) Q(E,y,z) Examples: (cont d) w(l)p(x:=7, x=6) =

16 wp and wlp Rule for Assignment Statements Rule: w(l)p(x:=e, Q(x,y,z)) Q(E,y,z) Examples: (cont d) w(l)p(x:=7, x=6) = w(l)p(x:=7, y=7) =

17 wp and wlp Rule for Assignment Statements Rule: w(l)p(x:=e, Q(x,y,z)) Q(E,y,z) Examples: (cont d) w(l)p(x:=7, x=6) = w(l)p(x:=7, y=7) = w(l)p(y:=-x, y= x ) =

18 sp Rule for Assignment Statements Rule: sp(x:=e, P) x=e(x,y,z) Л P(x,y,z)

19 sp Rule for Assignment Statements Rule: sp(x:=e, P) x=e(x,y,z) Л P(x,y,z) Examples: sp(x:=y+3, y>-3) =

20 sp Rule for Assignment Statements Rule: sp(x:=e, P) x=e(x,y,z) Л P(x,y,z) Examples: sp(x:=y+3, y>-3) = sp(x:=x+1, x<n) =

21 sp Rule for Assignment Statements Rule: sp(x:=e, P) x=e(x,y,z) Л P(x,y,z) Examples: sp(x:=y+3, y>-3) = sp(x:=x+1, x<n) = sp(x:=7, true) = (cont d)

22 sp Rule for Assignment Statements Rule: sp(x:=e, P) x=e(x,y,z) Л P(x,y,z) Examples: (cont d) sp(x:=7, false) =

23 sp Rule for Assignment Statements Rule: sp(x:=e, P) x=e(x,y,z) Л P(x,y,z) Examples: (cont d) sp(x:=7, false) = sp(x:=7, y=7) =

24 sp Rule for Assignment Statements Rule: sp(x:=e, P) x=e(x,y,z) Л P(x,y,z) Examples: (cont d) sp(x:=7, false) = sp(x:=7, y=7) = sp(y:=-x, y= x ) =

25 Predicate Transforms I 1. Introduction: weakest pre-conditions (wp s) weakest liberal pre-conditions (wlp s) strongest post-conditions (sp s) 2. Proving {P} S {Q} using predicate transforms 3. Transform rules for: assignment statements sequencing selection statements

26 wp and wlp Rule for Sequencing Rule: w(l)p(s 1 ;S 2 ;...;S n-1 ;S n, Q) w(l)p(s 1, w(l)p(s 2,...w(l)p(S n-1, w(l)p(s n, Q)) ))

27 wp and wlp Rule for Sequencing (cont d) Example: w(l)p(c:=d+1; B:=C 2; A:=B 2, A=36)

28 wp and wlp Rule for Sequencing (cont d) Example: w(l)p(c:=d+1; B:=C 2; A:=B 2, A=36) C:=D+1 B:=C 2 A:=B 2 { A=36 }

29 wp and wlp Rule for Sequencing (cont d) Example: w(l)p(c:=d+1; B:=C 2; A:=B 2, A=36) C:=D+1 C:=D+1 B:=C 2 B:=C 2 A:=B 2 { A=36 } A:=B 2 { A=36 }

30 sp Rule for Sequencing Rule: sp(s 1 ;S 2 ;...;S n-1 ;S n, P) sp(s n, sp(s n-1,...sp(s 2, sp(s 1, P)) ))

31 sp Rule for Sequencing (cont d) Example 1: sp(c:=d+1; B:=C 2; A:=B 2, D=1)

32 sp Rule for Sequencing (cont d) Example 1: sp(c:=d+1; B:=C 2; A:=B 2, D=1) { D=1 } C:=D+1 B:=C 2 A:=B 2

33 sp Rule for Sequencing (cont d) Example 1: sp(c:=d+1; B:=C 2; A:=B 2, D=1) { D=1 } C:=D+1 B:=C 2 A:=B 2

34 sp Rule for Sequencing (cont d) Compound programs often include multiple assignments to the same variable, e.g., X := X+1;...; X := Y-X;...; X := Z Y;... It is sometimes useful to anchor the initial values of such variables using some suitable notation such as X 0 when applying the sp Rule for Assignment Statements. Consider the following example...

35 sp Rule for Sequencing (cont d) Example 2: sp(s, true) where S is X:=X+1; X:=Y X; X:=X-1 { true } (1) X:=X+1 anchoring initial value of X to X 0 : { X=X +1 Л true } = { X=X 0 +1 } (2) X:=Y X { X=YX Л X =X 0 +1 } = { X=Y(X 0 +1) } (3) X:=X-1 { X=X -1 Л X =Y(X 0 +1) } = { X=Y(X 0 +1)-1 } reverting to standard X notation: Therefore, sp(s, true) is X=YX +Y-1

36 Predicate Transforms I 1. Introduction: weakest pre-conditions (wp s) weakest liberal pre-conditions (wlp s) strongest post-conditions (sp s) 2. Proving {P} S {Q} using predicate transforms 3. Transform rules for: assignment statements sequencing selection statements

37 wp and wlp Rule for if-then-else Statement Rule: w(l)p(if b then S 1 else S 2, Q) (b Л w(l)p(s 1, Q)) V ( b Л w(l)p(s 2, Q))

38 wp and wlp Rule for if-then-else Statement Rule: w(l)p(if b then S 1 else S 2, Q) (b Л w(l)p(s 1, Q)) V ( b Л w(l)p(s 2, Q)) T b F S 1 S 2 {Q}

39 wp and wlp Rule for if-then-else Statement Rule: w(l)p(if b then S 1 else S 2, Q) (b Л w(l)p(s 1, Q)) V ( b Л w(l)p(s 2, Q)) b Л w(l)p(s 1, Q) T b F S 1 S 2 {Q}

40 wp and wlp Rule for if-then-else Statement Rule: w(l)p(if b then S 1 else S 2, Q) (b Л w(l)p(s 1, Q)) V ( b Л w(l)p(s 2, Q)) b Л w(l)p(s 1, Q) T b F b Л w(l)p(s 2, Q) S 1 S 2 {Q}

41 wp and wlp Rule for if-then-else Statement Example: w(l)p(if x<0 then y:=-x else y:=x, y= x )

42 wp and wlp Rule for if-then-else Statement Example: b S 1 S 2 Q w(l)p(if x<0 then y:=-x else y:=x, y= x ) = (b Л w(l)p(s 1, Q)) V ( b Л w(l)p(s 2, Q)) = (x<0 Л w(l)p(y:=-x, y= x )) V (x 0 Л w(l)p(y:=x, y= x )) = (x<0 Л -x= x ) V (x 0 Л x= x ) = (x<0 Л x 0) V (x 0 Л x 0) = (x<0 V x 0) = true

43 wp and wlp Rule for if-then Statement Rule: w(l)p(if b then S, Q) (b Л w(l)p(s, Q)) V ( b Л Q)

44 wp and wlp Rule for if-then Statement Rule: w(l)p(if b then S, Q) (b Л w(l)p(s, Q)) V ( b Л Q) T b S F {Q}

45 wp and wlp Rule for if-then Statement Rule: w(l)p(if b then S, Q) (b Л w(l)p(s, Q)) V ( b Л Q) b Л w(l)p(s, Q) S T b F {Q}

46 wp and wlp Rule for if-then Statement Rule: w(l)p(if b then S, Q) (b Л w(l)p(s, Q)) V ( b Л Q) b Л w(l)p(s, Q) S T b F b Л Q {Q}

47 wp and wlp Rule for if-then Statement (cont d) Example: w(l)p(if x<0 then y:=-x, y= x )

48 wp and wlp Rule for if-then Statement (cont d) Example: b S Q w(l)p(if x<0 then y:=-x, y= x ) = (b Л w(l)p(s, Q)) V ( b Л Q)) = (x<0 Л w(l)p(y:=-x, y= x )) V (x 0 Л y= x ) = (x<0 Л -x= x ) V (x 0 Л y= x ) = (x<0 Л x 0) V (x 0 Л y= x ) = (x<0 V (x 0 Л y= x )) = (x<0 V (x 0 Л y=x)) = (x<0 V y=x)

49 Exercise Prove the assertion below using the wlp ROI. {Z=B} if A>B then Z := A {Z=Max(A,B)}

50 Exercise Prove the assertion below using the wlp ROI. P S Q {Z=B} if A>B then Z := A {Z=Max(A,B)}

51 Exercise Prove the assertion below using the wlp ROI. P S Q {Z=B} if A>B then Z := A {Z=Max(A,B)} Recall the wlp ROI: P wlp(s,q) {P} S {Q}

52 sp Rule for if-then-else Statement Rule: sp(if b then S 1 else S 2, P) sp(s 1, b Л P) V sp(s 2, b Л P)

53 sp Rule for if-then-else Statement Rule: sp(if b then S 1 else S 2, P) sp(s 1, b Л P) V sp(s 2, b Л P) {P} T b F S 1 S 2

54 sp Rule for if-then-else Statement Rule: sp(if b then S 1 else S 2, P) sp(s 1, b Л P) V sp(s 2, b Л P) {P} T b F S 1 S 2 sp(s 1, b Л P)

55 sp Rule for if-then-else Statement Rule: sp(if b then S 1 else S 2, P) sp(s 1, b Л P) V sp(s 2, b Л P) {P} T b F S 1 S 2 sp(s 1, b Л P) sp(s 2, b Л P)

56 sp Rule for if-then Statement Rule: sp(if b then S, P) sp(s, b Л P) V ( b Л P)

57 sp Rule for if-then Statement Rule: sp(if b then S, P) sp(s, b Л P) V ( b Л P) {P} T b S F

58 sp Rule for if-then Statement Rule: sp(if b then S, P) sp(s, b Л P) V ( b Л P) {P} T b S F sp(s, b Л P)

59 sp Rule for if-then Statement Rule: sp(if b then S, P) sp(s, b Л P) V ( b Л P) {P} T b sp(s, b Л P) S F b Л P

60 Example Prove the assertion: {y=x} if x<0 then y:=-x {y= x } using the strongest post-condition (sp) ROI.

61 Example Prove the assertion: {y=x} if x<0 then y:=-x {y= x } using the strongest post-condition (sp) ROI. Recall the sp ROI: sp(s,p) Q {P} S {Q}

62 Example Prove the assertion: {y=x} if x<0 then y:=-x {y= x } using the strongest post-condition (sp) ROI. P (1) sp(if x<0 then y:=-x, y=x) = sp(y:=-x, x<0 Л y=x) V (x 0 Л y=x) = (y=-x Л x<0 Л y =x) V (x 0 Л y=x) (2) (y=-x Л x<0 Л y =x) V (x 0 Л y=x) => (x<0 Л y=-x) V (x 0 Л y=x) => y= x Q

63 Coming Up Next Transform rules for while loops

64 Predicate Transforms I Software Testing and Verification Lecture Notes 19 Prepared by Stephen M. Thebaut, Ph.D. University of Florida