Hoare Logic: Part II

Transcription

1 Hoare Logic: Part II COMP2600 Formal Methods for Software Engineering Jinbo Huang Australian National University COMP 2600 Hoare Logic II 1

2 Factorial {n 0} fact := 1; i := n; while (i >0) do fact := fact * i; i := i -1 {fact = n!} COMP 2600 Hoare Logic II 2

3 First we need a loop invariant P fact := 1; i := n; while (i >0) do fact := fact * i; i := i -1 {fact = n!} After each iteration, fact = n (n 1) (i + 1) P (fact i! = n!) seems plausible However, we want (P i 0) (fact = n!) Take P (fact i! = n! i 0) COMP 2600 Hoare Logic II 3

4 Check P (fact i! = n! i 0) is an invariant That is, {P i > 0} fact := fact * i; i := i-1 {P} By assignment, we have Equivalently, {fact (i 1)! = n! i 1 0} i := i-1 {fact i! = n! i 0} {fact (i 1)! = n! i > 0} i := i-1 {fact i! = n! i 0} By assignment again, we have {fact i (i 1)! = n! i > 0} fact := fact * i {fact (i 1)! = n! i > 0} This precondition is precisely P i > 0 COMP 2600 Hoare Logic II 4

5 Completing the proof P (fact i! = n! i 0) Apply the while-rule: {P} while (i>0)... {P i 0} By postcondition weakening, {P} while (i>0)... {fact = n!} Check that the initialisation establishes the invariant: {n 0} fact := 1; i := n {fact i! = n! i 0} COMP 2600 Hoare Logic II 5

6 Formally P (fact i! = n! i 0) 1. {1 n! = n! n 0} fact := 1 {fact n! = n! n 0} (Assignment) 2. {n 0} fact := 1 {fact n! = n! n 0} (1, Equivalence) 3. {fact n! = n! n 0} i := n {P} (Assignment) 4. {fact i (i 1)! = n! i > 0} fact := fact * i {fact (i 1)! = n! i > 0} 5. {P i > 0} fact := fact * i {fact (i 1)! = n! i > 0} (Assignment) (4, Equivalence) 6. {fact (i 1)! = n! i 1 0} i := i-1 {P} (Assignment) COMP 2600 Hoare Logic II 6

7 7. {fact (i 1)! = n! i > 0} i := i-1 {P} (6, Equivalence) 8. {P i > 0} fact := fact * i; i := i-1 {P} (5, 7, Sequencing) 9. {P} while (i>0)... {P i 0} (8, While) 10. {P} while (i>0)... {fact = n!} (9, Postcondition Weakening) 11. {n 0} Program {fact = n!} (2, 3, 10, Sequencing) COMP 2600 Hoare Logic II 7

8 Completeness of Hoare Logic All true Hoare triples can be proved (with expressive assertion language) However, we may not be able to verify a proof! Consider precondition strengthening rule: P s P w {P w } S {Q} {P s } S {Q} Not all arithmetic truths (P s P w ) can be proved (Gödel s incompleteness theorem) Hence, completeness is relative to access to arithmetic truths COMP 2600 Hoare Logic II 8

9 Weakest Precondition An assertion/condition maps program states to {true, false} (x > y)(σ) = true iff x > y in state σ Define assertion wp for all programs S and postconditions Q wp(s,q)(σ) = true iff for all states σ, (executing S in σ results in σ ) (Q(σ ) = true) With quantification, assertion language can express all wp(s, Q) Quantification required, e.g., to say x is a multiple of y : i. x = i y Formal proof uses Gödel s β function to encode sequence of numbers (representing states) of arbitrary length with small number of variables COMP 2600 Hoare Logic II 9

10 Properties of wp Definition: wp(s,q)(σ) = true iff for all states σ, (executing S in σ results in σ ) (Q(σ ) = true) {wp(s,q)} S {Q} wp is indeed a valid precondition If {P} S {Q} then P wp(s,q) wp is the weakest possible precondition ( denotes true or valid ) COMP 2600 Hoare Logic II 10

11 Proving Completeness of Hoare Logic Need only show {wp(s,q)} S {Q} for all S,Q If {P} S {Q} then P wp(s,q) So {P} S {Q} by precondition strengthening Proof by structural induction Assignment Sequencing Conditional While ( denotes provable ) COMP 2600 Hoare Logic II 11

12 Proof of Completeness: Assignment Need to show {wp(x:=e,q)} x:=e {Q} But wp(x:=e,q) = Q(e/x) Hence result follows by assignment rule COMP 2600 Hoare Logic II 12

13 Proof of Completeness: S 1 ; S 2 Need to show {wp(s 1 ; S 2,Q)} S 1 ; S 2 {Q} By induction, {wp(s 2,Q)} S 2 {Q} {wp(s 1,wp(S 2,Q))} S 1 {wp(s 2,Q)} By sequencing rule, {wp(s 1,wp(S 2,Q))} S 1 ; S 2 {Q} Finally, wp(s 1 ; S 2,Q) wp(s 1,wp(S 2,Q)), or wp(s 1 ; S 2,Q)(σ) wp(s 1,wp(S 2,Q))(σ) COMP 2600 Hoare Logic II 13

14 Proof of Completeness: if b then S 1 else S 2 Need to show {wp(if b then S 1 else S 2,Q)} if b then S 1 else S 2 {Q} By induction, {wp(s 1,Q)} S 1 {Q},{wp(S 2,Q)} S 2 {Q} Define P (b wp(s 1,Q)) ( b wp(s 2,Q)) By precondition equivalence and conditional rule, {P b} S 1 {Q},{P b} S 2 {Q} {P} if b then S 1 else S 2 {Q} Finally, by case analysis on b, wp(if b then S 1 else S 2,Q) P COMP 2600 Hoare Logic II 14

15 Proof of Completeness: while b do S Let P = wp(while b do S,Q) Lemma 1 b P Q P guarantees that Q holds in resulting state If b then while terminates immediately without modifying state Hence b (P Q) COMP 2600 Hoare Logic II 15

16 Proof of Completeness: while b do S Let P = wp(while b do S,Q) Lemma 2 b P wp(s,p), or equivalently {b P} S {P} Let σ be initial state where b P holds, σ the state after S terminates (trivial if S doesn t terminate). Wish to show P(σ ) = true If while doesn t terminate from σ, P(σ ) = true by definition of wp Let σ be state after while terminates Consider the run of while from σ: Q(σ ) = true Consider the run of while from σ : P(σ ) = true by definition of wp COMP 2600 Hoare Logic II 16

17 Proof of Completeness: while b do S Let P = wp(while b do S,Q) By induction, {wp(s,p)} S {P} By Lemma 2 (b P wp(s,p)) and precondition strengthening, {b P} S {P} By while-rule, Lemma 1 ( b P Q), and postcondition weakening, {P} while b do S {Q} COMP 2600 Hoare Logic II 17

18 Hoare logic expresses partial correctness {P} S {Q} means if P holds initially and S terminates then Q holds afterwards Does not guarantee that S terminates All Hoare triples are true where S does not terminate Hence no Hoare triple can express that S terminates Can express that S does not terminate though: {true} S {false} Provable if while condition is an invariant COMP 2600 Hoare Logic II 18

19 An Extension to Handle Total Correctness [P] S [Q] means if P holds initially then S terminates and Q holds afterwards Total correctness = partial correctness + termination To assert termination alone: [P] S [true] COMP 2600 Hoare Logic II 19

20 Rules for Total Correctness For deriving total correctness assertions [P] S [Q] all old rules continue to work, except one Assignment Precondition strengthening, postcondition weakening Sequencing Conditional While COMP 2600 Hoare Logic II 20

21 Rules for Total Correctness [Q(e)] x := e [Q(x)] (Assignment) Assumes evaluation of expression e always terminates Fine for our toy language Require expression to always return a number In general, depends on the language Can expression involve calls to functions, which may not terminate? Even absent while-loops, recursion could cause nontermination What if there s an error, e.g., division by zero? COMP 2600 Hoare Logic II 21

22 Rules for Total Correctness P s P w [P s ] S [Q] [P w ] S [Q] (Precondition Strengthening) [P] S [Q s ] [P] S [Q w ] Q s Q w (Postcondition Weakening) [P] S 1 [Q] [P] S 1 ; S 2 [R] [Q] S 2 [R] (Sequencing) [P b] S 1 [Q] [P b] S 2 [Q] [P] if b then S 1 else S 2 [Q] (Conditional) COMP 2600 Hoare Logic II 22

23 Termination of while [y > 0] while (y <= r) do r := r-y; q := q+1 [true] COMP 2600 Hoare Logic II 23

24 Termination of while [y > 0] while (y <= r) do r := r-y; q := q+1 [true] Observations: q := q+1 irrelevant y doesn t change, stays > 0 r strictly decreases on each iteration Hence y <= r will eventually be false COMP 2600 Hoare Logic II 24

25 Termination of while: General Condition [y > 0] while (y <= r) do r := r-y; q := q+1 [true] Find a variant, an expression E such that E stays 0 at beginning of each iteration E strictly decreases on each iteration What s a good E for this example? COMP 2600 Hoare Logic II 25

26 Total Correctness of while To show [P] while b do S [P b] in addition to showing partial correctness, find E such that E stays 0 at beginning of each iteration: P b E 0 E strictly decreases on each iteration [P b (E = n)] S [P (E < n)] (n is auxiliary variable not appearing elsewhere, used to remember initial value of E ) COMP 2600 Hoare Logic II 26

27 While-Rule for Total Correctness P b E 0 [P b (E = n)] S [P (E < n)] [P] while b do S [P b] (While) where n is an auxiliary variable not appearing elsewhere COMP 2600 Hoare Logic II 27

28 Using the Rule P b E 0 [P b (E = n)] S [P (E < n)] [P] while b do S [P b] (While) Prove [y > 0] while (y <= r) do {r := r-y; q := q+1} [true] 1. (y > 0) (y r) (r 0) (Math) 2. [(y > 0) (r < n)] q := q+1 [(y > 0) (r < n)] (Assignment) 3. [(y > 0) (r y < n)] r := r-y [(y > 0) (r < n)] (Assignment) 4. (y > 0) (y r) (r = n) (y > 0) (r y < n) (Math) 5. [(y > 0) (y r) (r = n)] r := r-y [(y > 0) (r < n)] (3, 4, Precondition Strengthening) 6. [(y > 0) (y r) (r = n)] r := r-y; q += q+1 [(y > 0) (r < n)] COMP 2600 Hoare Logic II 28

29 (5, 2, Sequencing) 7. [y > 0] while... [(y > 0) (y > r)] (1, 6, While) 8. [y > 0] while... [true] (7, Postcondition Weakening) COMP 2600 Hoare Logic II 29

30 Using the Rule P b E 0 [P b (E = n)] S [P (E < n)] [P] while b do S [P b] (While) [n 0] fact := 1; i := n; while (i >0) do fact := fact * i; i := i -1 [fact = n!] Same invariant P (fact i! = n! i 0) Variant E i (use m instead of n in while-rule) COMP 2600 Hoare Logic II 30

31 While-Rule for Total Correctness: Soundness P b E 0 [P b (E = n)] S [P (E < n)] [P] while b do S [P b] (While) Premises imply partial correctness of the while: [P b (E = n)] S [P (E < n)] [P b (E = n)] S [P] [P b] S [P] {P b} S {P} {P} while b do S {P b} (postcondition weakening) (n doesn t appear elsewhere) (total correctness implies partial correctness) (soundness of original while-rule) (All triples in the above chain of reasoning are semantic assertions) COMP 2600 Hoare Logic II 31

32 While-Rule for Total Correctness: Soundness P b E 0 [P b (E = n)] S [P (E < n)] [P] while b do S [P b] (While) Premises imply termination of the while: Show while b do S terminates from any state σ satisfying P, by induction on the value of E in σ If b(σ), done. Assume b(σ); have E(σ) 0 by left premise Base case (E(σ) = 0): Behavior of S (or the while) does not depend on value of n May as well assume n = 0 in σ Right premise implies P (E < 0) after one iteration This, together with left premise, implies b, hence termination of while COMP 2600 Hoare Logic II 32

33 While-Rule for Total Correctness: Soundness P b E 0 [P b (E = n)] S [P (E < n)] [P] while b do S [P b] (While) Premises imply termination of the while: Show while b do S terminates from any state σ satisfying P, by induction on the value of E in σ Inductive step: Hypothesis: while... terminates from any state σ satisfying P, if E(σ ) k Assume E(σ) = k + 1; may as well assume n = k + 1 in σ Right premise implies P (E k) after one iteration Hence while... terminates from that state, by induction hypothesis COMP 2600 Hoare Logic II 33

34 Total Correctness = Partial Correctness + Termination Do our rules agree with this equation? [P] S [Q] {P} S {Q} and [P] S [true]? [P] S [Q] [P] S [Q] (Soundness) {P} S {Q} (Semantics of Hoare Triples) {P} S {Q} (Completeness of Rules for Partial Correctness) [P] S [Q] [P] S [true] (Postcondition Weakening) COMP 2600 Hoare Logic II 34

35 Total Correctness = Partial Correctness + Termination Do our rules agree with this equation? {P} S {Q} and [P] S [true] [P] S [Q]? (You won t be asked to prove/disprove this) COMP 2600 Hoare Logic II 35

36 While-Rule for Total Correctness: Completeness P b E 0 [P b (E = n)] S [P (E < n)] [P] while b do S [P b] (While) Do we have a complete Hoare logic for total correctness? If [P] while... [Q], can we always find a suitable E to prove it? Values of variables in the while can change with no apparent pattern Can we always map them to a decreasing number with a simple expression E (using only +,, )? COMP 2600 Hoare Logic II 36

37 While-Rule for Total Correctness: Generalized Version P(z + 1) b P(0) b [P(z + 1)] S [P(z)] [ z. P(z)] while b do S [P(0)] where auxiliary variable z ranges over natural numbers (i.e., z 0) Think of z as remaining number of iterations before termination COMP 2600 Hoare Logic II 37

38 Using Generalized While-Rule P(z + 1) b P(0) b [P(z + 1)] S [P(z)] [ z. P(z)] while b do S [P(0)] where auxiliary variable z ranges over natural numbers (i.e., z 0) Prove [true] while (i > 0) do i := i-1 [true] P(z) (i = z) (i < 0 z = 0). Assuming z 0, we have P(z + 1) = (i = z + 1) (i < 0 z + 1 = 0) = (i = z + 1); this b P(0) = (i = 0) (i < 0 0 = 0) = (i 0); this is b [(i = z + 1) (i < 1 z = 0)] i := i-1 [P(z)] [P(z + 1)] i := i-1 [P(z)] (Assignment, Equiv.) (Precondition Strengthening) COMP 2600 Hoare Logic II 38

39 Using Generalized While-Rule P(z + 1) b P(0) b [P(z + 1)] S [P(z)] [ z. P(z)] while b do S [P(0)] where auxiliary variable z ranges over natural numbers (i.e., z 0) Prove [true] while (i > 0) do i := i-1 [true] P(z) (i = z) (i < 0 z = 0) Now apply generalized while-rule: [ z. (i = z) (i < 0 z = 0)] = [true] while (i > 0) do i := i-1 [(i = 0) (i < 0 0 = 0)] = [i 0] Final step by postcondition weakening COMP 2600 Hoare Logic II 39

40 Generalized While-Rule: Completeness P(z + 1) b P(0) b [P(z + 1)] S [P(z)] [ z. P(z)] while b do S [P(0)] where z ranges over natural numbers (i.e., z 0) Don t we have the same issue finding a decreasing expression? No, because we no longer need to express a function that computes z Given arbitrary numbers x 0,x 1,...,x k (representing sequence of states), there is a function β(m,n,i) such that β(m,n,i) = x i for all 0 i k Predicate β(m,n,z) = x implicitly turns arbitrary sequence of states (x ) into a decreasing number z Resulting Hoare logic is complete COMP 2600 Hoare Logic II 40