Deterministic Program The While Program

Transcription

1 Deterministic Program The While Program Shangping Ren Department of Computer Science Illinois Institute of Technology February 24, 2014 Shangping Ren Deterministic Program The While Program February 24, / 25

2 Outline 1 Verification Total Correctness: Proof System TW 2 Developing Programs 3 Proof Outlines Shangping Ren Deterministic Program The While Program February 24, / 25

3 Verification Total Correctness: Proof System TW Proof System (TW) Axiom 1: Skip : the same as in PW Axiom 2: Assignment : the same as in PW Rule 3: Composition : the same as in PW Rule 4: Conditional : the same as in PW Rule 5: Loop : different from PW (given as Rule 7) Rule 6: Consequence : the same as in PW Shangping Ren Deterministic Program The While Program February 24, / 25

4 Verification Total Correctness: Proof System TW Rule 7 : Total Correctness for Loops {p B} S {p}, {p B t = z} S {t < z}, p t 0 {p} while B do S od {p B} Where t is an integer expression and z is an integer variable that does not occur in p, B, t, or S. Why are we talking about variables that don t exist? Shangping Ren Deterministic Program The While Program February 24, / 25

5 Verification Total Correctness: Proof System TW Example 2, Revisited Verify the Total Correctness DIV quo := 0; rem := x; while rem >= y do rem := rem - y; quo := quo + 1 od Verify under total correctness: {x 0 y > 0}DIV {quo y + rem = x 0 rem < y} Shangping Ren Deterministic Program The While Program February 24, / 25

6 Verification Total Correctness: Proof System TW Example 2, Revisited Verify the Total Correctness DIV quo := 0; rem := x; while rem >= y do rem := rem - y; quo := quo + 1 od inv: p quo y + rem = x rem 0 y > 0; B: B rem y; bd t: t rem; z: an integer variable that does not occur in p, B, t, and DIV Shangping Ren Deterministic Program The While Program February 24, / 25

7 Verification Total Correctness: Proof System TW Example 2, Revisited Verify the Total Correctness inv: p quo y + rem = x rem 0 y > 0; B: B rem y; bd t: t rem; z: an integer variable that does not occur in p, B, t, and DIV 1 Invariant is established: {x 0 y > 0}quo := 0; rem := x{p} 2 Loop body does not change the loop invariant {p B}rem := rem y; quo := quo + 1{p} 3 Bounded integer decreases after each iteration {p B rem = z}rem := rem y; quo := quo + 1{rem < z} 4 Invariant implies bounded integer is non-negative: p t 0 5 When it terminates, the postcondition holds p B p rem < y Shangping Ren Deterministic Program The While Program February 24, / 25

8 The Five Equations Developing Programs To do this we need to develop five equations. 1 {r}t {p} 2 {p B}S{p} 3 {p B t = z} S {t < z} 4 p t 0 5 p B q Shangping Ren Deterministic Program The While Program February 24, / 25

9 Extended Example Developing Programs Given an array A, populate array B with the running sum of A. E.g., if A = {1, 1, 2, 3, 4}, then B = {1, 2, 4, 7, 11}. Shangping Ren Deterministic Program The While Program February 24, / 25

10 Proof Outlines for Loops Partial Correctness {p B}S {p} {inv : p}while B do {p B}S {p} od {p B} Total Correctness {p B} S {p}, {p B t = z} S {t < z}, p t 0 {inv : p}{bd : t}while B do {p B}S {p} od {p B} Shangping Ren Deterministic Program The While Program February 24, / 25

11 The Proof Outline for Total Correctness We have a program of the form satisfying under total correctness {r} T ; {inv : p} {bd : t} while B do {p B} S {p} od {p B} {q} R T ; while B do S od {r}r{q} Shangping Ren Deterministic Program The While Program February 24, / 25

12 The Proof Outline for Total Correctness {r} T ; {inv : p} {bd : t} while B do {p B} S {p} od {p B} {q} 21 {x y y > 0} 22 quo := 0; rem := x; 23 {inv : p}{bd : rem} 24 while rem y do 25 {p rem y} 26 rem := rem - y; quo := quo {p} 28 od 29 {p rem < y} 30 {quo y + rem = x 0 rem < y} where p quo y + rem = x rem 0 y > 0 Still need to verify the other two promises in Rule 7. Shangping Ren Deterministic Program The While Program February 24, / 25

13 Decomposition for the Total Correctness Proof Proof under total correctness: {p}s{q} We can separate the proof process into two steps: 1 Establish a partial correctness formula {p}s{q} 2 Proof termination with simpler total correctness formula {p}s{true } Axiom A1: Decomposition p {p}s{q}, t {p}s{true } {p}s{q} Shangping Ren Deterministic Program The While Program February 24, / 25

14 Auxiliary Axims and Rules Axiom A2: Invariance and where free(p) change(s) = φ Rule A3: Disjunction Rule A4: Conjunction {p}s{p} {r}s{q} {p r}s{p q} {p}s{q}, {r}s{q} {p r}s{q} {p 1 }S{q 1 }, {p 2 }S{q 2 } {p 1 p 2 }S{q 1 q 2 } Shangping Ren Deterministic Program The While Program February 24, / 25

15 Auxiliary Axims and Rules Axiom A5: Substitution where u var(s) t change(s). {p}s{q} {p[u := t]}s{q[u := t]} Axiom A6: -Introduction {p}s{q} { x : p]}s{q} where x does not occur in S or in free(q). Shangping Ren Deterministic Program The While Program February 24, / 25

16 Strengthening Precondition and Weakening Postconditions Given a valid triple {p}s{q}, how can we modify p and q and maintain validity? if p 0 p 1 then p 0 is stronger than p 1 and p 1 is weaker than p 0. Example: x = 0 is stronger than x = 0 x = 1 is stronger than x 0 Consequence Rule: we can strength a precondition and weaken a postcondition. What is the strongest predicate? What is the weakest one? Shangping Ren Deterministic Program The While Program February 24, / 25

17 Strengthening Precondition and Weakening Postconditions Given a valid triple {p}s{q}, how can we modify p and q and maintain validity? if p 0 p 1 then p 0 is stronger than p 1 and p 1 is weaker than p 0. Example: x = 0 is stronger than x = 0 x = 1 is stronger than x 0 Consequence Rule: we can strength a precondition and weaken a postcondition. What is the strongest predicate? What is the weakest one? Shangping Ren Deterministic Program The While Program February 24, / 25

18 Strengthening Precondition and Weakening Postconditions Given a valid triple {p}s{q}, how can we modify p and q and maintain validity? if p 0 p 1 then p 0 is stronger than p 1 and p 1 is weaker than p 0. Example: x = 0 is stronger than x = 0 x = 1 is stronger than x 0 Consequence Rule: we can strength a precondition and weaken a postcondition. What is the strongest predicate? What is the weakest one? Shangping Ren Deterministic Program The While Program February 24, / 25

19 Strengthening Precondition and Weakening Postconditions Given a valid triple {p}s{q}, how can we modify p and q and maintain validity? if p 0 p 1 then p 0 is stronger than p 1 and p 1 is weaker than p 0. Example: x = 0 is stronger than x = 0 x = 1 is stronger than x 0 Consequence Rule: we can strength a precondition and weaken a postcondition. What is the strongest predicate? What is the weakest one? Shangping Ren Deterministic Program The While Program February 24, / 25

20 What about Weakening Preconditions and Strengthening Postconditions? if p p 0 and {p}s{q} is valid, can we conclude {p 0 }S{q} is valid? Consider {x = 0}y := x x{y = x}, what about {x = 0 x = 1}y := x x{y = x} or {x 0}y := x x{y = x} if q 0 q and {p}s{q} is valid, can we conclude {p}s{q 0 } is valid? Shangping Ren Deterministic Program The While Program February 24, / 25

21 Definitions about wlp and wp Definition: let S be a while program and Φ a set of proper states, Weakest Liberal Precondition wlp of S with respect to Φ: wlp(s, Φ) = {σ M[[S]](σ) Φ} Weakest Precondition wp of S with respect to Φ: wp(s, Φ) = {σ M tot [[S]](σ) Φ} Shangping Ren Deterministic Program The While Program February 24, / 25

22 Definitions about wlp and wp Definition: let S be a while program and Φ a set of proper states, Weakest Liberal Precondition wlp of S with respect to Φ: wlp(s, Φ) = {σ M[[S]](σ) Φ} Weakest Precondition wp of S with respect to Φ: wp(s, Φ) = {σ M tot [[S]](σ) Φ} Shangping Ren Deterministic Program The While Program February 24, / 25

23 Theorem about wlp and wp Remember the notation of [[p]]? Theorem: let S be a while program and q an assertion. Then the following holds: 1 There is an assertion p defining wlp(s, [[q]]), i.e., with [[p]] = wlp(s, [[q]]) 2 There is an assertion p defining wp(s, [[q]]), i.e., with [[p]] = wp(s, [[q]]). We also write wlp(s, [[q]]) as wlp(s, q) and wp(s, [[q]]) as wp(s, q) Shangping Ren Deterministic Program The While Program February 24, / 25

24 Weakest Liberal Precondition The following statements hold for all while programs and assertions: 1 skip: wlp(skip, q) q, 2 assignment: wlp(u := t, q) q[u := t], 3 sequence: wlp(s 1 ; S 2, q) wlp(s 1, wlp(s 2, q)), 4 conditional: wlp(if B then S 1 else S 2 fi, q) (B wlp(s 1, q) ( B wlp(s 2, q)), 5 S while B do S 1 od : wlp(s, q) B wlp(s 1, wlp(s, q)), 6 S while B do S 1 od : wlp(s, q) B q 7 {p}s{q}: = {p}s{q}iff p wlp(s, q) Shangping Ren Deterministic Program The While Program February 24, / 25

25 wlp(s, q) as Loop Invariant Previous slides (5) S while B do S 1 od : wlp(s, q) B wlp(s 1, wlp(s, q)), and (7) {p}s{q}: = {p}s{q}iff p wlp(s, q) We have = {wlp(s, q) B}S 1 {wlp(s, q)}, i.e., wlp(s, q) is a loop invariant of S. Shangping Ren Deterministic Program The While Program February 24, / 25

26 Weakest Precondition The following statements hold for all while programs and assertions: 1 skip: wp(skip, q) q, 2 assignment: wp(u := t, q) q[u := t], 3 sequence: wp(s 1 ; S 2, q) wp(s 1, wp(s 2, q)), 4 conditional: wp(if B then S 1 else S 2 fi, q) (B wp(s 1, q) ( B wp(s 2, q)), 5 S while B do S 1 od : wp(s, q) B wp(s 1, wp(s, q)), 6 S while B do S 1 od : wp(s, q) B q 7 {p}s{q}: = tot {p}s{q}iff p wp(s, q) Shangping Ren Deterministic Program The While Program February 24, / 25

27 Strongest Postcondition For given p and S, there exists a strongest postcondition q such that {p}s{q} is valid, i.e., For partial correctness, {p}s{q} iff sp(p, S) q. For total correctness, {p}s{q} iff sp(p, S) q and S terminates on all states of p Shangping Ren Deterministic Program The While Program February 24, / 25

28 Strongest Postcondition For given p and S, there exists a strongest postcondition q such that {p}s{q} is valid, i.e., For partial correctness, {p}s{q} iff sp(p, S) q. For total correctness, {p}s{q} iff sp(p, S) q and S terminates on all states of p Shangping Ren Deterministic Program The While Program February 24, / 25

29 Strongest Postcondition For given p and S, there exists a strongest postcondition q such that {p}s{q} is valid, i.e., For partial correctness, {p}s{q} iff sp(p, S) q. For total correctness, {p}s{q} iff sp(p, S) q and S terminates on all states of p Shangping Ren Deterministic Program The While Program February 24, / 25

30 Strongest Postconditions for Loop-Free Programs sp(p, skip ) p sp(p, u := v) p[u := u 0 ] u = (v[u := u 0 ]) sp(p, S 1 ; S 2 ) sp(sp(p, S 1 ), S 2 ) sp(p, if B then S 1 else S 2 fi ) sp(p B, S 1 ) sp(p B, S 2 ) Shangping Ren Deterministic Program The While Program February 24, / 25

31 Strongest Postcondition Examples sp(y 0, x := y) y 0[x := z] x = (y[x := z]) y 0 x = y Therefore, we have {y 0}x := y{y 0 x = y}, and the y 0 x = y is the strongest postcondition for the given precondition and the assignment statement. As y 0 x = y x 0, apply consequence rule to {y 0}x := y{y 0 x = y}, we have {y 0}x := y{x 0}. The weakest precondition of given post condition x 0 and program x := y is nevertheless y 0, i.e., wp(x := y, x 0) y 0. Shangping Ren Deterministic Program The While Program February 24, / 25