An Approach To Formalization of an Extension of Floyd-Hoare Logic

Transcription

1 An Approach To Formalizaion of an Exension of Floyd-Hoare Logic Arur Korni lowicz 1, Andrii Kryvolap 2, Mykola Nikichenko 2, Ievgen Ivanov 2 1 Insiue of Informaics, Universiy of Bia lysok, Cio lkowskiego 1M, Bia lysok, Poland 2 Taras Shevchenko Naional Universiy of Kyiv 64/13, Volodymyrska Sree, Kyiv, Ukraine arurk@mah.uwb.edu.pl, krivolapa@gmail.com, nikichenko@unicyb.kiev.ua, ivanov.eugen@gmail.com Absrac. The classical Floyd-Hoare logic is defined for he case of oal pre- and poscondiions and parial programs (i.e. programs can be undefined on some inpu daa, bu condiions mus be defined on all daa). In his paper we propose an exension of his logic for he case of parial condiions and parial programs on hierarchically organized daa. These daa are based on he naming relaion and are called nominaive daa. They can convenienly represen many daa srucures used in programming. The semanics of he proposed logic is represened by special algebras of parial funcions and predicaes over nominaive daa. Operaions of hese algebras are called composiions. We presen an inference sysem for he menioned logic and propose an approach o is formalizaion in Mizar proof assisan. The obained resuls can be used in sofware verificaion. Keywords. Formal mehods, sofware verificaion, Floyd-Hoare logic, proof assisan, nominaive daa. Key Terms. Specificaion Process, Verificaion Process 1 Inroducion Floyd-Hoare logic [1 3] is a formal sysem widely used for reasoning abou program correcness. I is based on he noion of a Floyd-Hoare riple (asserion) which consiss of a precondiion, a program, and a poscondiion and means he following requiremen: when inpu daa saisfies he precondiion, he program oupu mus saisfy he poscondiion, if he program erminaes. Specificaion of program properies in erms of Floyd-Hoare riples is naural and reasoning is convenien hanks o a composiional proof sysem. A survey of he imporan resuls on properies of he Hoare s proof sysem (soundness, compleeness in specific senses) and is exensions was given in [3]. In he classical Floyd-Hoare logic predicaes (pre- and poscondiions) are assumed o be oal (defined on all daa) and programs can be parial (in he

2 sense ha if a program does no erminae, is resuling value is undefined). The abiliy o deal wih parialiy is an imporan aspec, because parial operaions frequenly arise in programming. In mos programming languages some basic operaions on daa such as arihmeic division are already parial. Furhermore, parialiy of programs may be caused by non-erminaion which can arise from loop consrucs and/or recursion. For similar reasons parialiy can arise in sofware specificaions. In [4] he following classificaion of parialiy phenomena in sofware specificaions was proposed: non-erminaion, i.e. if evaluaion of an expression does no erminae, is value is assumed o be undefined and he operaion is considered parial; error value, i.e. if some values of an operaion s argumen are illegal (e.g. division by zero, Pop operaion applied o an empy sack, ec.), he resul of he operaion on such values is assumed o be undefined and he operaion is considered parial; and nondeerminism, i.e. if a resul of an operaion on an argumen value is no deermined uniquely by he specificaion of his operaion (operaion is underspecified), he resul of applicaion of he operaion o such a value is assumed o be undefined and he operaion is considered parial. Oher opinions on he meanings of parialiy in sofware specificaions can be found in [5 7]. In [5] a axonomy of he ways of dealing wih parialiy in sofware specificaion languages and logics was proposed. Among differen approaches noable are excluding parial funcions from consideraion and providing alernaive noaions (e.g. graph of a parial funcion), using a hree-valued (many-valued) logic, where he hird value represens an undefined resul, or making all funcion applicaions denoe [5]. I should be noed ha almos all approaches ha ry o no allow parial programs and/or predicaes ha describe program guards or properies explicily and reduce or ranslae hem o he classical case of oal funcions and predicaes have drawbacks analyzed in deail in [4 6]. A more naural and poenially fruiful approach is o allow parialiy in boh programs and program specificaions and consruc non-classical proof sysems allowing explici reasoning abou properies of such programs and specificaions. This approach is applied in his paper o Floyd-Hoare logic. More specifically, in he classical Floyd-Hoare logic he predicaes describing program pre- and poscondiions are assumed o be oal. Bu obviously, i is desirable o be able o use parial operaions in pre- and poscondiions of programs, where parialiy may be inerpreed in one of he senses proposed in [4]. So i is desirable o obain an exension of Floyd-Hoare logic ha is able o deal wih boh parial programs and parial predicaes. We consider such an exension in his paper. In he previous works [8, 9] we have considered exensions of Floyd-Hoare logic o parial mappings over daa represened as parial mappings on named values (called nominaive ses) and proposed he corresponding inference sysems and invesigaed heir soundness and exensional and inensional compleeness. However, nominaive ses (which can be considered as parial funcions from names o values) naurally represen only a fla daa organizaion in low-level programming. Using Floyd-Hoare logic

3 wih parial mappings over nominaive ses for reasoning abou programs which operae on complex daa srucures (e.g. rees) is inconvenien, because one needs o ake ino accoun many low-level deails abou daa srucure implemenaion. For his reason, in his paper we propose an exension of Floyd-Hoare logic for he case of parial condiions and parial programs on hierarchically organized daa. As was shown in [10] hierarchically organized daa (more specifically, a class of such daa called nominaive daa [10]) is sufficien for represening many daa srucures (like mulidimensional arrays, liss, rees, ables, ec.) ha are frequenly used in programming. To develop such an exension we will adop he composiion-nominaive approach [11] o program formalizaion. This approach aims o propose a mahemaical basis for developmen of formal mehods of analysis and synhesis of sofware sysems and is grounded on several principles [11], including he Developmen principle (from absrac o concree), he Principle of inegriy of inensional and exensional aspecs, he Principle of prioriy of semanics over synax, Composiionaliy principle, and he Nominaiviy principle. The laer Nominaiviy principle saes ha nominaive daa [2] (a special class of hierarchically organized daa) are adequae mahemaical models of various forms of daa ha are processed and sored in compuing sysems. There exis several ypes of nominaive daa [11] (wih simple or complex names and wih simple or complex values), bu all of hem are based on naming relaions ha associae names and values. In he composiion-nominaive approach on he absrac level a compuing sysem is modeled as a parial funcion ha maps nominaive daa (inpu daa) o nominaive daa (oupu daa). Such funcions are called binominaive. Properies of daa are represened as parial predicaes on nominaive daa. Nominaive funcions and predicaes can be composed in many ways, e.g. by sequenial composiion, branching, and so on. Operaions ha consruc composed sysems from consiuens are called composiions. A se of composiions ogeher wih a se of funcions obained from a chosen se of basic funcions by applicaions of composiions forms an algebraic sysem (program algebra) which is a semanic model of a programming language. The synax of his language follows naurally from his semanic model: programs are represened as erms of he described algebra. The relaion of he above menioned noions o semanics of programming languages can be illusraed on a simple programming language WHILE [12]. This is an imperaive language in which programs are composed from saemens which conain boolean and arihmeic expressions. A program sae is an assignmen of values o variable names which can be modeled as a nominaive se. Semanics of a saemen can be represened as a parial binominaive funcion (a mapping from saes o saes) and semanics of a boolean or arihmeic expression can be represened as a funcion on nominaive daa which akes boolean or ineger values. Semanics of saemens are composed o obain semanics of a program. In accordance wih he composiion-nominaive approach he semanic componen of our Floyd-Hoare logic exension will be based on program algebra (a se of funcions and predicaes on nominaive daa which can be obained from

4 some chosen basic funcions and predicaes using a specific se of composiions). In his paper he carrier ses of our program algebra will consis of parial funcions and predicaes over nominaive daa wih complex names and complex values [10]. We will rea a Floyd-Hoare riple as a composiion wih wo predicaes on nominaive daa and a program (a parial binominaive funcion which belongs o he carrier se of he program algebra) as argumens. The predicaes represen pre- and poscondiions and he resul of he composiion is a predicae. However, he classical definiion of Floyd-Hoare riple validiy leads o Floyd-Hoare composiion ha is no monoone [8]. Monooniciy is one of he key properies used for reasoning abou programs. I is also imporan for reasoning abou loop-free programs and using hem as approximaions of programs wih loops. This explains he need of a special definiion of Floyd-Hoare composiion for he exension of Floyd-Hoare logic on parial predicaes which is monoone, bu converges o he classical definiion, if predicaes are oal. Such a definiion was presened in [8] and we will adap i o he case considered in his paper. To make our Floyd-Hoare logic exension pracically applicable for program verificaion one can implemen i in a proof assisan sofware [13]. Many well known proof assisans (e.g. Isabelle, Coq, PVS, ec.) provide a subsanial suppor for reasoning abou oal funcions, programs, predicae and are convenien for eiher formulaing he classical Floyd-Hoare logic axiomaically, or embedding i in heir logics. For example, Isabelle proof assisan includes he Hoare HOL (Higher-Order Logic)-based heory ha provides an implemenaion of Hoare logic for a simple imperaive programming language wih WHILE loops following [14, 15]. However, a suppor of reasoning abou programs using parial predicae pre- and poscondiions is generally no developed. We propose an approach o formalizaion of our exended Floyd-Hoare logic which suppors parial pre- and poscondiions in he proof assisan Mizar [16, 17]. This proof assisan is based on firs-order logic and axiomaic se heory (Tarski-Grohendieck se heory) and has one of he riches libraries of formalized mahemaical heories ha spans many branches of mahemaics. This library is called Mizar Mahemaical Library (MML). Consequenly, Mizar has well developed ools for working wih parial funcions and predicaes and is well-suied for our purposes. Besides, he Mizar sysem has a degree of proof auomaion suppor such as discovery of a lis of proven facs ha imply he curren goal which may be used as basis for implemening sofware verificaion in a semi-auomaic mode. To simplify and parially auomae applicaion of he Floyd-Hoare logic o proving program properies i is convenien o have a corresponding sysem of inference rules. The radiional inference sysem for he language WHILE [12] is sound and exensionally complee for he classical Floyd-Hoare logic wih oal predicaes [12] (exensional compleeness means ha pre- and poscondiions may be arbirary predicaes [12]; inensional compleeness means ha pre- and poscondiions should be presened by formulas of a given language). Soundness and compleeness are imporan for pracical applicabiliy of an inference sysem

5 (if a sysem is no sound, asserions ha can be inferred using his sysem may be false; if a sysem is no complee, some of he valid asserions could be impossible o infer). However, his inference sysem is no sound and complee for parial predicaes as was shown in [8]. To deal wih he soundness and complees problem we will modify he radiional inference sysem for he language WHILE and inroduce addiional consrains on inference rules ha correspond o he new definiion of validiy of Floyd-Hoare asserions, and invesigae is soundness and exensional compleeness. The obained resuls exend he resuls concerning inference sysems for a Floyd-Hoare logic wih parial predicaes over fla (nonhierarchical) daa obained in [8, 9]. The paper is organized in he following way. In Secion 2 we describe he noion of nominaive daa and define main operaions on hem. In Secion 3 we describe he semanic base of our exended Floyd-Hoare logic. In Secion 4 we specify he synax of our exended Floyd-Hoare logic. In Secion 5 we propose an inference sysem for our logic and consider problems of is soundness and compleeness. In Secion 6 we describe an approach o formalizaion of our exended Floyd-Hoare logic in Mizar. In Secion 7 we describe he relaed work. In Secion 8 we give conclusions. 2 Algebra of Nominaive Daa In he composiion-nominaive approach daa are reaed as nominaive daa. There are several ypes of nominaive daa, bu all of hem are based on naming relaions. The simples ype of nominaive daa is he class of nominaive ses which are parial mappings from a se of names (program variables) o a se of basic values. Oher ypes of nominaive daa represen hierarchical daa organizaions [10]. Before giving definiions, le us inroduce he following noaion. p To disinguish oal funcions from parial we will use he symbol for parial funcions and n for oal. We will also use he symbol for parial funcions wih finie graph. For any parial funcion f : D p D on some se D: f(d) denoes ha f is defined on d D; f(d) = d denoes ha f is defined on d D wih a value d D ; f(d) denoes ha f is undefined on d D; dom(f) = {d D f(d) } is he domain of a funcion (noe ha in differen branches of mahemaics here exis differen definiions of he domain of a parial funcions; we will adop he convenion used in recursion heory); We will denoe by f 1 (d 1 ) = f 2 (d 2 ) he srong equaliy, i.e. he condiion ha f 1 (d 1 ) if and only if f 2 (d 2 ), and if f 1 (d 1 ), hen f 1 (d 1 ) = f 2 (d 2 ). For any nonempy se V we will denoe by V + he se of all nonempy finie sequences (words) of elemens of V. For any word u V + we will denoe by u is lengh. If u, v V +, we will denoe by uv he concaenaion of u and v. We will wrie u v, if u is a prefix of v, and u < v, if u v, u v.

6 For any se of names V and a se of basic values A he corresponding class V A of nominaive ses is defined as V A = V p A. We will use he following noaions for nominaive ses: [v 1 a 1,..., v n a n ], where v 1,..., v n are names from V and a 1,... a n are aoms from A, denoes a nominaive se wih he graph {(v 1, a 1 ),..., (v n, a n )}; [v i a i i I], where I is some se of indices, means a nominaive se wih he graph {(v i, a i ) i I}; v a d, where d is a nominaive se, means ha d(v) = a, i.e. he value of he variable v in d is a; [] or denoes he empy nominaive se (a nowhere defined funcion). Nominaive daa are buil over classes of names V and basic values (aoms) A using naming relaions name value. A rough idea is ha a nominaive daa d is eiher an aom from A, or has he form [v 1 d 1,..., v n d n ], where v 1,..., v n are names from V and d 1,..., d n are eiher aoms or oher nominaive daa. Nominaive daa are classified in accordance wih he following 2 parameers [10]: values can be simple (unsrucured) or complex (srucured), and names can be simple (unsrucured) or complex (srucured). These parameers give 4 ypes of nominaive daa. To define he noion of a complex name we will use he Developmen principle (from absrac o concree) and consider he simples case of name consrucion: complex names are sequences of simple names which saisfy he associaiviy propery [10]. More specifically, we will assume ha complex names are consruced wih he help of concaenaion operaion (which is associaive). We will adop he following Principle of associaive consrucion and processing of complex names [10]: complex names are consruced from simple names using concaenaion, and daa wih complex names mus be processed by operaions ha ake ino accoun associaiviy of names. Moreover, we will require ha daa wih complex names saisfy he Principle of unambiguous associaive naming [10]: one complex name mus have a mos one corresponding value in any given daa. The definiions of 4 ypes of nominaive daa (T ND SS, T ND SC, T ND CS, T ND CC ) are given below. We will assume ha V and A are fixed nonempy ses of simple names and basic values. We will call he elemens of V + complex names. 1. Daa of he ype T ND SS (daa wih simple names and simple values) are elemens of he se V n A. For example, if u, v V, 1, 2 A. [u 1, v 2],

7 2. Daa of he ype T ND SC (daa wih simple names and complex values) are elemens of he se ND(V, A), where ND(V, A) = k 0 ND k (V, A), ( ND 0 (V, A) = A { }, ND k+1 (V, A) = ND k (V, A) V ) n ND k (V, A) for all k = 0, 1, 2,... Daa of his class are hierarchically consruced, for example, [u 1, v [w 2]], if u, v, w V and 1, 2 A. Such daa can be represened by oriened rees wih arcs labeled by names and leafs labelled by aoms. We will call any finie sequence of names p = (v 1, v 2,..., v k ) a pah. A pah in a given daa d ND(V, A) is a pah (v 1, v 2,..., v k ) such ha he value of he expression (...((d(v 1 ))(v 2 ))...(v k )) is defined (i corresponds o a pah from he roo o a leaf in a ree). If p = (v 1, v 2,..., v k ) is a pah in d, we will say ha (...((d(v 1 ))(v 2 ))...(v k )) is he value of p in d and denoe i as d(v 1, v 2,..., v k ). A erminal pah is a pah wih aomic or empy value. The rank of d is he leas k such ha d ND k (V, A). 3. Daa of he ype T ND CS (daa wih complex names and simple values) are elemens of he se NDV S(V, A), where NDV S(V, A) is he se of all elemens of A (V + n A) such ha eiher d A, or d V + n A and all srings from dom(d) are pairwise incomparable in he sense of he prefix relaion. For example, [uv 1, uw 2, w 3], if u, v, w V are differen and 1, 2, 3 A. 4. Daa of he ype T ND CC (daa wih complex names and complex values) are elemens of he se NDV C(V, A), where NDV C(V, A) is he se of all d ND(V +, A) such ha for any wo pahs (u 1, u 2,..., u k ) and (v 1, v 2,..., v l ) in d, neiher of which is a prefix of anoher, words u 1 u 2...u k and v 1 v 2...v l are incomparable in he sense of prefix relaion (principle of unambiguous associaive naming). For example, if u, v, w V are differen, 1, 2 A. [uv 1, w [uw 2]], In [8] i was shown how convenional daa srucures can be represened by differen kinds of nominaive daa. The mos complex and ineresing ype of nominaive daa is T ND CC, so we will use i in his paper.

8 The main operaions on nominaive daa are operaions of denaming (aking a value of a name), naming (assigning o a name a new value), and overlapping (overwriing). Below we give definiions of hese operaions for nominaive daa of he ype T ND CC. For any word u V + and any daa d NDV C(V, A) le us denoe (division of d by u). d/u = [v 1 d(v) d(v), v = uv 1, v 1 V + ] p Definiion 1. Associaive denaming v a : NDV C(V, A) NDV C(V, A) is an operaion wih a parameer v V + defined by inducion on lengh of v as follows: if v = 1, hen v a (d) = d(v), if d(v) ; v a (d) = d/v if d(v) and d/v, and v a (d) oherwise. if v = n > 1, hen v a (d) = v 1 a (x a (d)), where v = xv 1, x V, v 1 V n 1 (principle of associaive denaming). For example, (uv) a ([u [vw 1, u 2]]) = [w 1]. I is easy o check ha v a saisfies he following propery (associaiviy) u a (d) = u n a (u n 1 a (... u 1 a (d)...)) for all complex names u, u 1, u 2,..., u n V + such ha u = u 1 u 2...u n. Definiion 2. Naming is an operaion v : NDV C(V, A) NDV C(V, A) wih a parameer v V + such ha v(d) = [v d]. Overlapping can be considered as an operaion which updaes values in he firs argumen wih he values from he second argumen. I joins wo daa and resolves name conflics in favor of is second argumen. We will define wo kinds of overlapping: global and local. Global overlapping can be used for formalizaion of procedures calls and he local overlapping formalizes he assignmen operaor in programming languages. Definiion 3. Global overlapping is a binary operaion a : NDV C(V, A) NDV C(V, A) p NDV C(V, A) defined inducively by he rank of he firs argumen as follows. Le NDV C k (V, A) = NDV C(V, A) ND k (V, A) (daa of he rank no greaer han k).

9 Inducion base. If d 0 NDV C 0 (V, A), hen { d 1 a d 2 d 2, d 1 = and d 2 NDV C(V, A)\A; = undefined, d 1 A or d 2 A. Inducion sep. Assume ha he value d 1 a d 2 is defined for all d 1, d 2 such ha d 1 NDV C k (V, A). Le d 1 NDV C k+1 (V, A) and d 1 / NDV C k (V, A). Then d 1 a d 2 = d, where d NDV C(V, A) is defined by is values on names u V + : d(u) = d 2 (u), if u dom(d 2 ) and u does no have a proper prefix which belongs o dom(d 1 ). d(u) = d 1 (u) a (d 2 /u), if d 1 (u) and d 1 (u) / A, and u is a proper prefix of some elemen of dom(d 2 ); d(u) = d 2 /u, if d 1 (u) and d 1 (u) A, and u is a proper prefix of some elemen of dom(d 2 ); d(u) = d 1 (u), if d 1 (u) and u is no comparable (in he sense of prefix relaion) wih any elemen of dom(d 2 ); d(u), oherwise. The following examples illusrae his operaion: 1. [u d 1 ] a [v d 2 ] = [u d 1, v d 2 ], if u, v are incomparable in he sense of prefix relaion; 2. [uv d 1 ] a [u d 2 ] = [u d 2 ], i.e. a value under a name in he second argumen overwries a value under exension of his name in he firs argumen; 3. [u d 1 ] a [uv d 2 ] = [u (d 1 s [v d 2 ])] (d 1 / A), i.e., a value under a name in he second argumen modifies values under prefixes of his name in he firs argumen. Definiion 4. Local overlapping is an operaion v p a : NDV C(V, A) NDV C(V, A) NDV C(V, A) wih a parameer v V + such ha For example, d 1 v ad 2 = d1 a ( v(d 2 )). [u 1] v a[w 2] = [u 1, v [w 2]]. Definiion 5. An algebra of nominaive daa of ype T ND CC (denoed as NDA(V, A)) is an algebra wih he carrier NDV C(V, A) and he operaions { v} v V +, {v a } v V +, { v a} v V +.

10 3 Semanics of Exended Floyd-Hoare Logic Le Bool = {F, T } denoe he se of Boolean values, P r V,A p = NDV C(V, A) Bool. The elemens of P r V,A are called parial nominaive predicaes. They can be used o represen semanics of condiions in programs. Le F P rg V,A p = NDV C(V, A) NDV C(V, A). The elemens of F P rg V,A are called binominaive funcions. They can be used o represen semanics of programs. Muli-sored algebras on ses of parial nominaive predicaes and parial binominaive funcions can be used o define semanics of program logics [11, 18]. The operaions of such algebras will be called composiions. There are many possible ways o define composiions ha provide means o consruc complex programs from simpler ones. We have chosen he following composiions o include hem as basic o he logics of program level: parameric assignmen composiion AS x which corresponds o assignmen operaor := ; composiion of idenical program id which corresponds o he skip operaor of he WHILE language; composiion of sequenial execuion ; condiional composiion IF which corresponds o he if-hen-else operaor; cycle (loop) composiion WH which corresponds o he while-do operaor. We also need composiions ha provide he possibiliy o consruc predicaes describing properies of programs. The main composiion of his kind is he Floyd-Hoare composiion FH. I akes a precondiion, a poscondiion, and a program as inpus and yields a predicae ha represens respecive Floyd-Hoare asserion. We will also define a composiion of preimage predicae ransformer inspired by weakes precondiion inroduced by Dijksra [19]. Le us give definiions of he menioned composiions. Definiion 6. Disjuncion is a binary composiion : P r V,A P r V,A P r V,A such ha for all p, q P r V,A and d NDV C(V, A): T, if p(d) = T or q(d) = T, (p q)(d) = F, if p(d) = F and q(d) = F, undefined in oher cases. Definiion 7. Negaion is a unary composiion : P r V,A P r V,A such ha for all p P r V,A and d NDV C(V, A): F, if p(d) = T, ( p)(d) = T, if p(d) = F, undefined in oher cases.

11 We will consider conjuncion p q of predicaes p, q as an abbreviaion for ( p q). Definiion 8. Exisenial quanificaion over hierarchical daa is a unary composiion x : P r V,A P r V,A wih a parameer x V + such ha for all p P r V,A and d NDV C(V, A): T, if p(d x ad ) = T for some d NDV C(V, A), ( x p)(d) = F, if p(d x ad ) = F for all d NDV C(V, A), undefined in oher cases. For each n = 1, 2, 3,... denoe by Ūn(V ) he se of all uples (x 1,..., x n ) (V + ) n of n complex names such ha x 1, x 2,..., x n are pairwise incomparable in he sense of prefix relaion. Also, le us denoe Ū(V ) = n=1 Ūn(V ). Definiion 9. For each n = 1, 2, 3,..., superposiion of n funcions ino a funcion is a n+1-ary composiion S ˉx F : (F P rg V,A ) n+1 F P rg V,A wih a parameer ˉx = (x 1,..., x n ) Ūn(V ) such ha for all f, g 1,..., g n F P rg V,A and d NDV C(V, A): S ˉx F (f, g 1,..., g n )(d) = f(d a [x 1 g 1 (d),..., x n g n (d)]). Definiion 10. For each n = 1, 2, 3,..., superposiion of n funcions ino a predicae is a n+1-ary composiion S ˉx P : P r V,A (F P rg V,A ) n P r V,A wih a parameer ˉx = (x 1,..., x n ) Ūn(V ) such ha for all p P r V,A, g 1,..., g n F P rg V,A, and d NDV C(V, A): S ˉx P (p, g 1,..., g n )(d) = p(d a [x 1 g 1 (d),..., x n g n (d)]). Definiion 11. Denominaion is a null-ary composiion x : F P rg V,A wih a parameer x V + such ha for each d NDV C(V, A): x(d) = x a (d). Definiion 12. Assignmen over hierarchical daa is a composiion AS x : F P rg V,A F P rg V,A wih a parameer x V + such ha for each f F P rg V,A and d NDV C(V, A): AS x (f)(d) = d x af(d).

12 Definiion 13. Ideniy program composiion is a null-ary composiion id : F P rg V,A such ha for each d NDV C(V, A): id(d) = d. Definiion 14. Sequenial execuion is a binary composiion : F P rg V,A F P rg V,A F P rg V,A such ha for all f, g F P rg V,A and d NDV C(V, A): (f g)(d) = g(f(d)). Definiion 15. Branching is a ernary composiion IF : P r V,A F P rg V,A F P rg V,A F P rg V,A such ha for all r P r V,A (condiion), f, g F P rg V,A (branches bodies), and d NDV C(V, A): f(d), if r(d) = T and f(d), IF (r, f, g)(d) = g(d), if r(d) = F and g(d), undefined in oher cases. Definiion 16. While cycle is a binary composiion W H : P r V,A F P rg V,A F P rg V,A such ha for each r P r V,A (condiion), f F P rg V,A (loop body), and d NDV C(V, A): W H(p, f)(d) = f (n) (d), if here exiss an ineger n 0 such ha p(f (i) (d)) = T for all i = 0, 1,..., n 1 and p(f (n) (d)) = F, where f (i) denoes f f... f and f }{{} (0) = id; i and W H(p, f)(d), oherwise. Definiion 17. Monoone Floyd-Hoare composiion F H : P r V,A F P rg V,A P r V,A P r V,A is a composiion such ha for all p, q P r V,A (pre- and poscondiion), f F P rg V,A (program), and d NDV C(V, A): T, if p(d) = F or q(f(d)) = T, F H(p, f, q)(d) = F, if p(d) = T and q(f(d)) = F, undefined in oher cases.

13 Definiion 18. Predicae ransformer composiion is a binary composiion P C : F P rg V,A P r V,A P r V,A such ha for all q P r V,A, f F P rg V,A, and d NDV C(V, A): T, if f(d) and q(f(d)) = T, P C(f, q)(d) = F, if f(d) and q(f(d)) = F, undefined in oher cases. Predicae ransformer composiion is he same as Glushkov predicion operaion (sequenial execuion of a funcion and a predicae) [10]. We call his composiion (defined for parial predicaes) as preimage predicae ransformer composiion in order o relae i o he weakes precondiion predicae ransformer [19]. Noe ha F H(p, pr, q) = p P C(pr, q). The Floyd-Hoare composiion is called monoone, because i saisfies he following propery, as was shown in [8]: p p, q q, f f F H(p, f, q) F H(p, f, q ), where inclusion is undersood as inclusion of he graphs of funcions and predicaes. Definiion 19. An (associaive) nominaive program algebra N P A(V, A) is a wo-sored algebra < P r V,A, F P rg V,A ;,, { x} x V +, {S ˉx P }ˉx Ū(V ), {S ˉx F }ˉx Ū(V ), { x} x V +, id, {AS x } x V +,, IF, W H, F H, P C >. This algebra is he semanic base of our exension of Floyd-Hoare logic o parial predicaes and (hierarchical) nominaive daa wih complex names and complex values. 4 Synax and Inerpreaion Terms of he algebra NP A(V, A) defined over some ses of predicae symbols P s and program symbols P rs specify he synax (language) of he logic. Le us give definiions of he ses of program exs P V,P s,p rs, formulas F r V,P s,p rs, and Floyd-Hoare asserions F HF r V,P s,p rs. The ses P V,P s,p rs and F r V,P s,p rs are defined inducively (here we use he symbols of composiions in he purely synacic sense, i.e. hey are currenly no associaed wih semanics): 1. if pr P rs, hen pr P V,P s,p rs ; 2. if n 1, pr, pr 1,..., pr n P rs, and ˉx Ūn(V ), hen S ˉx F (pr, pr 1,..., pr n ) P V,P s,p rs ; 3. if x V + and pr P rs, hen AS x (pr) P V,P s,p rs ;

14 4. x P V,P s,p rs for each x V + and id P V,P s,p rs ; 5. if pr 1, pr 2 P V,P s,p rs, hen pr 1 pr 2 P V,P s,p rs ; 6. if Φ F r V,P s,p rs and pr 1, pr 2 P V,P s,p rs, hen IF (Φ, pr 1, pr 2 ) P V,P s,p rs ; 7. if Φ F r V,P s,p rs and pr P V,P s,p rs, hen W H(Φ, pr) P V,P s,p rs ; 8. if P P s, hen P F r V,P s,p rs ; 9. if Φ, Ψ F r V,P s,p rs, hen Φ Ψ, Φ Ψ F r V,P s,p rs ; 10. if Φ F r V,P s,p rs, hen Φ F r V,P s,p rs ; 11. if n 1, Φ F r V,P s,p rs, pr 1,..., pr n P rs, and ˉx Ūn(V ), hen S ˉx P (Φ, pr 1,..., pr n ) F r V,P s,p rs ; 12. if Φ F r V,P s,p rs and v V +, hen vφ F r V,P s,p rs. The se F HF r V,P s,p rs is he se of all formulas of he form {p}f{q}, where p, q F r V,P s,p rs and f P V,P s,p rs. Definiion 20. Le V be a se of basic names, P s be a se of predicae symbols, P rs be a se of program symbols, and A be an arbirary se. Then an inerpreaion J is a riple (NDA(V, A), I P s, I P rs ), where I P s : P s P r V,A is an inerpreaion mapping for predicae symbols and I P rs : P rs F P rg V,A is an inerpreaion mapping for program symbols. For any inerpreaion J = (NDA(V, A), I P s, I P rs ) we will denoe by J F r and J P he formula and program ex inerpreaion mappings V,P s,p rs J F r : F r P r V,A, V,P s,p rs J P : P F P rg V,A which are he sandard exensions of I P s and I P rs o F r V,P s,p rs V,P s,p rs and P respecively (defined by srucural inducion). Also, we will denoe by J F HF r he V,P s,p rs inerpreaion mapping of Floyd-Hoare asserions J F HF r : F HF r P r V,A defined as follows: J F HF r ({p}f{q}) = F H(J F r (p), J P (f), J F r (q)). In his paper we will no define inerpreaions explicily expecing ha hey are clear from he conex. For any P F r V,P s,p rs or P F HF r V,P s,p rs we will denoe by P J or (P ) J he predicae ha corresponds o P under inerpreaion J. We will omi he index J when i is clear from he conex. We will use he following noaion for any predicae p: p T = {d p(d) = T } is he ruh domain of a predicae p; p F = {d p(d) = F } is he falsiy domain p. Definiion 21. A formula P F r V,P s,p rs or a Floyd-Hoare asserion P F HF r V,P s,p rs is valid (irrefuable) in an inerpreaion J (denoed as J = P ), if P F J =. Definiion 22. A formula P F r V,P s,p rs or a Floyd-Hoare asserion P F HF r V,P s,p rs is valid (denoed as = P ), if i is valid in every inerpreaion.

15 Le us define he logical consequence relaion = F r V,P s,p rs F r V,P s,p rs : p = q = p q, where p q means p q for any p, q F r V,P s,p rs. We will also need he following special logical consequence relaions such ha p = T q p T J qt J p = F q q F J pf J = T, = F F r V,P s,p rs V,P s,p rs F r for every inerpreaion J; for every inerpreaion J. 5 Inference Sysem for a Floyd-Hoare Logic wih Parial Predicaes over Nominaive daa To make he program logic which we have defined applicable o sofware verificaion problems i is necessary o presen an inference sysem. Such an inference sysem could be based on he inference sysem for he classical Floyd-Hoare logic wih oal predicaes for he language WHILE [12], bu i is known be unsound in he case of parial predicaes [9] which is considered in he paper. For his reason addiional consrains need o be added o achieve a sound inference sysem. We will wrie X p o denoe ha a formula p is derived in some inference sysem X. An inference sysem X is sound, if X p = p for each formula p, and is complee, if = p X p for each p. Compleeness can be reaed in exensional or inensional approaches. For exensional compleeness [9] pre- and poscondiions can be arbirary predicaes. Inensional compleeness requires ha pre- and poscondiions are presened by formulas in a given language. The classical inference sysem for he language WHILE [12] can be presened in semanic form as follows (x V ): R AS {S x P (p, h)} AS x (h) {p} R SEQ R WH {p} f {q}, {q} g {r} {p} f g {r} {r p} f {p} {p} W H(r, f) { r p} R SKIP {p} id {p} R IF {r p} f {q}, { r p} g {q} {p} IF (r, f, g) {q} R CONS {p } f {q } {p} f {q} p p, q q This inference sysem is sound and exensionally complee for oal predicaes, bu for parial predicaes i is no sound [9], because rules R SEQ, R WH, and R CONS do no guaranee a valid derivaion from valid premises. As one of soluions we propose he following inference sysem AC wih added consrains (x V +, n 1, ˉx Ūn): R AS {S x P (p, h)} AS x (h) {p} R SFID {S ˉx P (p, g 1,..., g n )}S ˉx F (id, g 1,..., g n ){p}

16 R SF {p}s ˉx F (id, g 1,..., g n ) f{q} {p}s ˉx F (f, g 1,..., g n ){q} R SKIP {p} id {p} R SEQ R IF R WH {p} f {q}, {q} g {r} {p} f g {r} {r p} f {q}, { r p} g {q} {p} IF (r, f, g) {q} {r p} f {p} {p} W H(r, f) { r p} R CONS {p } f {q } {p} f {q}, p = P C(f g, r), p = T p, q = F q, p = P C(W H(r, f), r p) In his sysem consrains are presened via consequence relaions =, = T, = F. These relaions can be subsiued by he corresponding inference relaions (, T, F ), bu his quesion is ouside he scope of he paper and we will no go ino deail here. Theorem 1. AC {P C(pr, q)}pr{q} for each pr and q. Proof (presened for some arbirary inerpreaion J, bu for simpliciy sake we omi his J from he ex of his proof). Le us use inducion over he srucure of pr. Base of inducion. Le us prove ha AC {P C(AS x (h), q)}as x (h){q}. By he rule R AS, i is sufficien o show ha P C(AS x (h), q) = SP x (q, h). Using he definiion of P C and assignmen i is easy o check ha P C(AS x (h), q)(d) = q(d x ah(d)). Moreover, we have: SP x (q, h) = q(d a[x h(d)]) = q(d x ah(d)) = P C(AS x (h), q). Thus AC {P C(AS x (h), q)}as x (h){q}. For AC {P C(id, q)}id{q} he proof is obvious. Inducive sep. 1. The case when pr is S ˉx F (f, g 1,..., g n ) is sraighforward. 2. Consider he case of sequenial execuion. Given he premises AC {P C(pr 1, P C(pr 2, q))}pr 1 {P C(pr 2, q)}, AC {P C(pr 2, q)}pr 2 {q}, he required derivaion AC {P C(pr 1 pr 2, q)}pr 1 pr 2 {q} can be proved in he same way as in he proof of he sequenial execuion case in [9, Theorem 4.2], so we omi a deailed proof here. 3. Consider he branching composiion. Assume ha AC {P C(pr 1, q)}pr 1 {q}, AC {P C(pr 2, q)}pr 2 {q}.

17 Le us prove ha AC {P C(IF (r, pr 1, pr 2 ), q)}if (r, pr 1, pr 2 ){q}. Le us prove r P C(IF (r, pr 1, pr 2 ), q) = T P C(pr 2, q). If d ( r P C(IF (r, pr 1, pr 2 ), q)) T, hen we have r(d) = F, IF (r, pr 1, pr 2 )(d), and q(if (r, pr 1, pr 2 )(d)) = T. Then IF (r, pr 1, pr 2 )(d) = pr 2 (d). Thus pr 2 (d) holds and q(pr 2 (d)) = T, so P C(pr 2, q)(d) = T, so d P C(pr 2, q) T. Thus r P C(IF (r, pr 1, pr 2 ), q) = T P C(pr 2, q). Similarly, r P C(IF (r, pr 1, pr 2 ), q) = T P C(pr 1, q). Then by R CONS Then using R IF we conclude ha AC {r P C(IF (r, pr 1, pr 2 ), q)}pr 1 {q}, AC { r P C(IF (r, pr 1, pr 2 ), q)}pr 2 {q}. AC {P C(IF (r, pr 1, pr 2 ), q)}if (r, pr 1, pr 2 ){q}. 4. Le us prove AC {P C(W H(r, pr), q)}w H(r, pr){q} for each pr, q, r. Le p = P C(W H(r, pr), q). Le p be a predicae such ha: p (d) = T, if p(d) = T and p (d) = F oherwise. We have AC {P C(pr, p )}pr{p }. Le us show ha r p = T P C(pr, p ). Noe ha p T = p T, whence p = T p. Assume ha (r p )(d) = T. Then p (d) = p(d) = T, whence q(w H(r, pr)(d)) = T. Moreover, r(d) = T, so here exiss d = pr(d) such ha W H(r, pr)(d ) = W H(r, pr)(d) and q(w H(r, pr)(d )) = T. Then p (d ) = p(d ) = P C(W H(r, pr), q)(d ) = T. From p (d ) = T and d = pr(d) we have P C(pr, p )(d) = T. We conclude ha r p = T P C(pr, p ). Le us prove ha r p = F q. Assume ha q(d) = F. If r(d) = T hen ( r p )(d) = F. If r(d) = F, hen p(d) = P C(W H(r, pr), q)(d) = F, so p (d) = p(d) = F and ( r p )(d) = F. If r(d), hen p(d) = P C(W H(r, pr), q)(d), whence p (d) = F and ( r p )(d) = F. In all cases, ( r p )(d) = F. Thus r p = F q. Le us show ha p = T P C(W H(r, pr), r p ). Assume ha p (d) = T. Then p(d) = T. Then here exiss d such ha W H(r, pr)(d) = d and q(d ) = T, because p = P C(W H(r, pr), q). By he definiion of W H, r(d ) = F and W H(r, pr)(d ) = d. Because W H(r, pr)(d ) = d and q(d ) = T, we have p(d ) = T = P C(W H(r, pr), q)(d ). Then p (d ) = T and ( r p )(d ) = T. Then W H(r, pr)(d) = d and P C(W H(r, pr), r p )(d) = T. We conclude ha p = T P C(W H(r, pr), r p ). Then p = P C(W H(r, pr), r p ). Moreover, from r p = T P C(pr, p ) and R CONS, AC {r p }pr{p }, so AC {p }W H(r, pr){ r p } by he rule R WH. Because r p = F q and p = T p, we have AC {p}w H(r, pr){q} by R CONS. Thus AC {P C(W H(r, pr), q)}w H(r, pr){q}.

18 We have considered all composiions, so, aking ino accoun ha an inerpreaion J was chosen arbirary, we have ha AC {P C(pr, q)}pr{q} for each pr and q. Theorem 2. The inference sysem AC is sound. This heorem can be proved analogously o [8, Theorem 4]. The compleeness problems (exensional and inensional) are more difficul. In his case i is reasonable o idenify differen classes of predicaes (similarly o [8, 9]) and o prove compleeness for such classes of predicaes. In his case Theorem 1 is used. 6 Towards Formalizaion of Exended Floyd-Hoare Logic in Mizar We proposed a formalizaion of nominaive daa in Mizar in [20]. In he menioned work differen ypes of nominaive daa were defined as Mizar modes wih se parameers V and A which mean he ses of basic names and aomic values respecively. We can use his formalizaion as a basis for formalizaion of he exended Floyd-Hoare logic for programs over nominaive daa of he ypes T ND CC and T ND SC. 1) Define he mode of binominaive funcions over nominaive daa of he ype T ND SC (please refer o [20] for he definiion of TypeSCNominaiveDaa menioned below): reserve V for se; reserve A for se; reserve D for TypeSCNominaiveDaa of V, A; definiion le V, A, D; mode TypeSCBinominaiveFuncion of D is ParFunc of D, D; end; and, similarly, he mode of binominaive funcions over nominaive daa of he ype T ND CC. This gives us a formalizaion of F P rg V,A defined in Secion 3. 2) Analogously define he modes of parial predicaes over nominaive daa of he ypes T ND SC, T ND CC over V, A (P r V,A ). 3) Formalize P V,P s,p rs (program exs), F r V,P s,p rs V,P s,p rs (formulas), F HF r (and Floyd-Hoare asserions) as Mizar modes wih parameers V, P s, P rs. 4) Formalize he inerpreaion mapping in accordance wih Definiion 20. 5) Formalize he relaion of validiy in an inerpreaion in accordance wih Definiion 21 and he relaion of validiy in accordance wih Definiion 22. 6) Formalize he logical consequence relaion p = q = p q for p, q F r V,P s,p rs and he special logical consequence relaions p = T q p T J qt J for any inerpreaion J, and p = F q qj F pf J for any inerpreaion J. 7) Formulae he inference rules of he AC inference sysem described in Secion 5 as Mizar schemes and prove heir semanic validiy. Finally, he proven inference rules can be used o prove semanics properies of programs defined by concree program exs (elemens of P V,P s,p rs ).

19 7 Relaed Work Logical approaches o program specificaion and reasoning abou program properies were used in he works by R. Floyd [1] and T. Hoare [2]. These approaches were based on axiomaic sysems wih oal predicaes and used riples of a precondiion, program, and a poscondiion. Laer i became eviden ha parialiy of predicaes and programs needs o be aken ino accoun which gave rise o hree-valued logics which represened undefinedness of a predicae by a special hird value. In paricular, such logics were sudied by Lukasiewicz, Kleene, Bochvar and ohers. A he same ime many oher exensions of he Floyd-Hoare logic were proposed as a basis for program verificaion, including Dynamic logic and Separaion logic. In Dynamic logic [21] special modaliies ha allow usage of program exs and specificaions alongside are used. A Floyd-Hoare asserion {p}pr{q} can be replaced wih a formula p [pr]q, where [pr]q indicaes ha if a program pr erminaes, hen necessarily holds q. For deerminisic programs, [pr]q is equal o our preimage composiion which also allows use of specificaions and program exs ogeher. Separaion logic [22] was inroduced o deal wih widespread usage of heap and poiners in programming. This logic has special means for specifying heap properies. Bu only a heap funcion ha maps memory addresses o values is assumed o be parial. In oher aspecs only oal predicaes are considered. The ways of dealing wih parialiy in curren sofware specificaion languages (VDM, RSL, Z, ec.) are described in [4]. Mos approaches use eiher a manyvalued logic or underspecificaion for dealing wih parialiy. 8 Conclusions We have proposed an exension of he Floyd-Hoare logic for he case of parial condiions and programs on hierarchically organized daa called nominaive daa. Such daa can be used o convenienly represen many daa srucures used in programming. We have proposed an inference sysem for our exended Floyd- Hoare logic and invesigaed is soundness and exensional compleeness and propose an approach o is formalizaion in he Mizar sysem. In he fuure works we plan o implemen he proposed approach and apply he resuls o sofware verificaion asks. References 1. Floyd, R.: Assigning meanings o programs. Mahemaical aspecs of compuer science 19 (1967) 2. Hoare, C.: An axiomaic basis for compuer programming. Commun. ACM 12 (1969) Ap, K.: Ten years of Hoare s logic: A survey par I. ACM Trans. Program. Lang. Sys. 3 (1981) Hähnle, R.: Many-valued logic, parialiy, and absracion in formal specificaion languages. Logic Journal of he IGPL 13 (2005)

20 5. Jones, C.: Reasoning abou parial funcions in he formal developmen of programs. In: Proceedings of AVoCS 05. Volume 145., Elsevier, Elecronic Noes in Theoreical Compuer Science (2006) Gries, D., Schneider, F.: Avoiding he undefined by underspecificaion. Technical repor, Ihaca, NY, USA (1995) 7. Duzi, M.: Do we have o deal wih parialiy? Miscellanea Logica 5 (2003) Kryvolap, A., Nikichenko, M., Schreiner, W.: Exending Floyd-Hoare logic for parial pre- and poscondiions. In Ermolayev, V., Mayr, H., Nikichenko, M., Spivakovsky, A., Zholkevych, G., eds.: Informaion and Communicaion Technologies in Educaion, Research, and Indusrial Applicaions. Volume 412 of Communicaions in Compuer and Informaion Science. Springer Inernaional Publishing (2013) Nikichenko, M., Kryvolap, A.: Properies of inference sysems for Floyd-Hoare logic wih parial predicaes. Aca Elecroechnica e Informaica 13 (2013) Skobelev, V., Nikichenko, M., Ivanov, I.: On algebraic properies of nominaive daa and funcions. In Ermolayev, V., Mayr, H., Nikichenko, M., Spivakovsky, A., Zholkevych, G., eds.: Informaion and Communicaion Technologies in Educaion, Research, and Indusrial Applicaions. Volume 469 of Communicaions in Compuer and Informaion Science. Springer Inernaional Publishing (2014) Nikichenko, M., Shkilniak, S.: Mahemaical logic and heory of algorihms. Publishing house of Taras Shevchenko Naional Universiy of Kyiv, Ukraine (in Ukrainian) (2008) 12. Nielson, H., Nielson, F.: Semanics wih applicaions a formal inroducion. Wiley professional compuing. Wiley (1992) 13. Wiedijk, F.: The seveneen provers of he world. Foreword by Dana S. Sco. Volume 3600 of Lecure Noes in Arificial Inelligence. Springer-Verlag Berlin Heidelberg (2006) 14. Gordon, M.: Mechanizing programming logics in higher order logic. In Birwisle, G., Subrahmanyam, P., eds.: In Curren Trends in Hardware Verificaion and Auomaed Theorem Proving. Springer-Verlag (1989) 15. Von Wrigh, J., Hekanaho, J., Luosarinen, P., Langbacka, T.: Mechanizing some advanced refinemen conceps. Formal Mehods in Sysem Design (1993) Bancerek, G., Byliński, C., Grabowski, A., Korni lowicz, A., Mauszewski, R., Naumowicz, A., P ak, K., Urban, J.: Mizar: Sae-of-he-ar and beyond. Volume 9150 of Lecure Noes in Compuer Science. Springer (2015) Grabowski, A., Korni lowicz, A., Naumowicz, A.: Four decades of Mizar. Journal of Auomaed Reasoning 55 (2015) Nikichenko, M., Tymofieiev, V.: Saisfiabiliy in composiion-nominaive logics. Cenral Europ. J. Compuer Science 2 (2012) Dijksra, E.: A Discipline of Programming. 1s edn. Prenice Hall PTR, Upper Saddle River, NJ, USA (1997) 20. Ivanov, I., Korni lowicz, A., Nikichenko, M.: Formalizaion of nominaive daa in Mizar. Proceedings of TAAPSD 2015, December 2015, Taras Shevchenko Naional Universiy of Kyiv, Ukraine (2015) Harel, D., Tiuryn, J., Kozen, D.: Dynamic Logic. MIT Press, Cambridge, MA, USA (2000) 22. Sannella, D., Tarlecki, A.: Foundaions of Algebraic Specificaion and Formal Sofware Developmen. Monographs in Theoreical Compuer Science. An EATCS Series. Springer (2012)