Axiomatic Semantics. Semantics of Programming Languages course. Joosep Rõõmusaare

Transcription

1 Axiomatic Semantics Semantics of Programming Languages course Joosep Rõõmusaare 2014

2 Direct Proofs of Program Correctness Partial correctness properties are properties expressing that if a given program terminates, then there will be certain relationship between the initial and the final values of the variables. Partial correctness property of a program need not ensure that it terminates

3 Direct Proofs of Program Correctness We shall give examples that prove partial correctness of statements based directly on the operational and denotational semantics.

4 Direct Proofs of Program Correctness We shall prove that the factorial statement is partially correct That is, if the statement terminates, then the final value of y will be the factorial of the initial value of x

5 Natural Semantics Using natural semantics, the partial correctness of the factorial statement can be formalized as follows: It's partial correctness property because statement does not terminate if the initial value s x of x is non-positive.

6 Natural Semantics The proof proceeds in three stages: We prove that the body of the while loop satisfies: We prove that the while loop satisfies: We prove the partial correctness property for the complete program

7 Structural Operational Semantics Using structural operational semantics, the partial correctness of the factorial statement can be formalized as follows:

8 Structural Operational Semantics Proof proceeds in two stages: We prove by induction on the length of derivation sequences that We prove that

9 Denotational Semantics Using denotational semantics,the idea is to formulate the property as a predicate on the ccpo ; that is,

10 Denotational Semantics Partial correctness of the factorial statement will be written as where the predicate is defined by A predicate defined on a ccpo (D, ) is called an admissible predicate if and only if we have for every chain Y in D. Thus if holds on all the elements of the chain, then it also holds on the least upper bound of the chain.

11 Theorem 9.5 Denotational Semantics

12 Partial Correctness Assertions Assertion is a triple of the form { P } S { Q } where S is a statement and P (precondition) and Q (postcondition) are predicates { P } S { Q } means: if P holds in the initial state, and if the execution of S terminates when started in that state, then Q will hold in the state in which S halts PS: It's not required that S halt when started in states satisfying P.

13 Logical Variables Two kind of variables Program variables Logical Variables Logical variables don't occur in programs values will always be the same Logical variable example:

14 Assertion Language How to specify the preconditions and postconditions of the assertions: The intensional approach Introduces an explicit language called an assertion language and conditions will be formulas of that language The extensional approach Conditions are predicates, that is functions in State T Meaning of { P } S { Q } may be reformulated as saying that if P holds on a state s and if S executed from state s resulting in the state s' then Q holds on s'.

15 Assertion Language Each boolean expression b defines a predicate B [[b]] Using following notation:

16 The Inference System The partial correctness assertions will be specified by an inference system consisting of a set of axioms and rules. Formulas of the inference system have the form { P } S { Q } where S is a statement in the language While and P and Q are predicates. The inference system specifies an axiomatic semantics for While.

17 The Inference System Axiomatic system for partial correctness

18 Inference tree The Inference System Leaves will be instances of axioms Internal nodes will correspond to instances of rules Inference tree gives a proof of the property expressed by its root Provability of the assertion { P } S { Q } is written as

19 The Inference System Example Statement while true do skip.

20 The Inference System Example Proof of assertion

21 Properties of the Semantics Two programs S1 and S2 are provably equivalent according to the axiomatic semantics for all preconditions P and postconditions Q

22 Induction on the Shape of Inference Trees 1. Prove that the property holds for all the simple inference trees by showing that it holds for the axioms of the inference system. 2. Prove that the property holds for all composite inference trees: 1.for each rule assume that the property holds for its premises (induction hypothesis) 2.assume that the conditions of the rule are satisfied 3.then prove that it also holds for the conclusion of the rule.

23 Soundness and Completeness Relationship between inference system and the operational and denotational semantics The inference system is sound: if some partial correctness property can be proven using the inference system, then it does indeed hold according to the semantics. The inference system is complete: if some partial correctness property does hold according to the semantics, then we can also find a proof for it using the inference system.

24 Soundness and Completeness Using natural semantics The partial correctness assertion { P } S { Q } is said to be valid if and only if for all the states s, if P s = tt and and we shall write this as for some s' then Q s' = tt The soundness property is then expressed by and the completeness property is expressed by

25 Soundness and Completeness Theorem For all partial correctness assertions { P } S { Q }, we have if and only if

26 Soundness Lemma The inference system is sound; that is, for every partial correctness formula { P } S { Q }, we have

27 Soundness Proof [assp] [skipp] [compp] [ifp] [whilep] [consp]

28 Completeness The extensional approach Weakest liberal precondition for Q For each statement S and predicate Q: if and only if for all states s': if wlp(s,q) s = tt then Q s' = tt

29 Completeness Fact For every statement S and predicate Q, we have (*) (**) meaning that wlp(s,q) is the weakest possible precondition for S and Q.

30 Completeness Lemma The inference system is complete; that is, for every partial correctness formula { P } S { Q } we have

31 Completeness Proof Infer for all statements S and predicates Q. Cases: (*) x := a skip S1; S2 if b then S1 else S2 while b do S

32 The Inference System Axiomatic system for partial correctness

33 Expressiveness Problems Intensional Approach Preconditions and postconditions are formulas of some assertion language L. It's natural to let L includes the boolean expressions of While soundness proof same as intensional approach Contradiction in Completeness proof

34 Expressiveness Problems Intensional Approach Contradiction in Completeness proof Suppose that L only contains the boolean expressions of While. Assume that there is a formula bs of L such that for all states s we have Then also bs is a formula of L. Now we have: if and only if the computation of S on s loops if and only if the computation of S on s terminates