1 / 40

Axiomatic Verification II

Axiomatic Verification II. Software Testing and Verification Lecture Notes 18. Prepared by Stephen M. Thebaut, Ph.D. University of Florida. Axiomatic Verification II. Reasoning about iteration (while loops) Strong correctness and proving termination. Review of Proof Rules.

bryantallen
Download Presentation

Axiomatic Verification II

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Axiomatic Verification II Software Testing and Verification Lecture Notes 18 Prepared by Stephen M. Thebaut, Ph.D. University of Florida

  2. Axiomatic Verification II • Reasoning about iteration (while loops) • Strong correctness and proving termination

  3. Review of Proof Rules • Before proceeding to while loops, let’s capture our previous reasoning about sequencing, selection statements, and state condition replacement in appropriate rules of inference (ROI). ROI for Sequencing: {P} S1{R}, {R} S2 {Q} {P} S1; S2 {Q}

  4. Review of Proof Rules (cont’d) ROI for if_then_else statement: {P Л b } S1 {Q}, {P Лb} S2 {Q} {P} if b then S1else S2 {Q} ROI for if_then statement: {P Л b } S {Q}, (P Лb)  Q {P} if b then S{Q}

  5. Review of Proof Rules (cont’d) ROI for State Condition Replacement†: K  P, {P} S {Q}, Q  W {K} S {W} †Also known as the consequencerule.

  6. Reasoning about Iteration • Consider the assertion: {P} while b do S {Q} • What are the necessary conditions for this assertion to hold?

  7. Necessary Conditions: while_do So, we know that {P} while b do S {Q} will hold if the following conditions hold: Case 0: (P Лb) Q Case 1: {P Л b} S {K1}, (K1 Лb)  Q Case 2: {K1Л b} S {K2}, (K2 Лb)  Q … Case N: {KN-1 Л b} S {KN}, (KN Лb)  Q … Great! But who has the time to show that an infinite number of conditions hold?

  8. Reasoning about Iteration (cont’d) • To eliminate the infinite sequence of conditions, replace each Ki with I (where I Ki for every i). Then the conditions above become: Case 0: (P Лb)  Q Case 1: {P Л b} S {I}, (IЛb)  Q All other Cases:{IЛ b} S {I} • To simplify, require further that P  I. Then the four conditions reduce to three: P  I, {I Л b} S {I}, (IЛb)  Q

  9. Reasoning about Iteration (cont’d) • Thus, a ROI for the while_do statement is: P  I, {IЛ b} S {I}, (IЛb)  Q {P} while b do S {Q} where the three antecedents are sometimes given the names initialization, preservation,and finalization, respectively. • The assertion “I” in this context is informally referred to as an Invariant, or more precisely as a Q-adequate loop invariant.

  10. Invariants and Q-adequate invariants • A loop invariantis a Boolean-valued predicate that satisfies initialization and preservation. • A Q-adequate loop invariantis a loop invariant that also satisfies finalization. • Note that there may be an arbitrary number of valid loop invariants. For example, true is a trivial loop invariant for any while loop. • The stronger the invariant, the more one can conclude from it together with b.

  11. {true} Z := X J := 1 while J<>Y do Z := Z+X J := J+1 end_while {Z=XY} Initialization: P  I Preservation:{IЛ b} S {I} Finalization: (IЛb)  Q Example 3 Use the Q-adequate invariantI: Z=XJto prove:

  12. {true} Z := X J := 1 while J<>Y do Z := Z+X J := J+1 end_while {Z=XY} Initialization: P  I What is “P”? (Z=X Л J=1) Example 3 Use the Q-adequate invariantI: Z=XJto prove: P

  13. {true} Z := X J := 1 while J<>Y do Z := Z+X J := J+1 end_while {Z=XY} Initialization: P  I What is “P”? (Z=X Л J=1) Does (Z=XЛJ=1) Z=XJ?  X=X(1) Example 3 Use the Q-adequate invariantI: Z=XJto prove: P 

  14. {true} Z := X J := 1 while J<>Y do Z := Z+X J := J+1 end_while {Z=XY} Initialization: P  I What is “P”? (Z=X Л J=1) Does(Z=X Л J=1) Z=XJ? Yep! Example 3 Use the Q-adequate invariantI: Z=XJto prove: P

  15. {true} Z := X J := 1 while J<>Y do Z := Z+X J := J+1 end_while {Z=XY} Initialization: P  I  Example 3 Use the Q-adequate invariantI: Z=XJto prove:

  16. {true} Z := X J := 1 while J<>Y do Z := Z+X J := J+1 end_while {Z=XY} Initialization: P  I  Preservation:{IЛ b} S {I} {Z=XJ Л JY} Z := Z+X {Z=X(J+1) ЛJY} J := J+1 {Z=X((J-1)+1) ЛJ-1Y}  Z=XJ Example 3 Use the Q-adequate invariantI: Z=XJto prove: b S

  17. {true} Z := X J := 1 while J<>Y do Z := Z+X J := J+1 end_while {Z=XY} Initialization: P  I  Preservation:{IЛ b} S {I}  Example 3 Use the Q-adequate invariantI: Z=XJto prove:

  18. {true} Z := X J := 1 while J<>Y do Z := Z+X J := J+1 end_while {Z=XY} Initialization: P  I  Preservation:{IЛ b} S {I}  Finalization: (IЛb)  Q Example 3 Use the Q-adequate invariantI: Z=XJto prove:

  19. {true} Z := X J := 1 while J<>Y do Z := Z+X J := J+1 end_while {Z=XY} Initialization: P  I  Preservation:{IЛ b} S {I}  Finalization: (IЛb)  Q Does(Z=XJЛJ=Y) Z=XY?  XJ=X(J) Yep! Example 3 Use the Q-adequate invariantI: Z=XJto prove: 

  20. {true} Z := X J := 1 while J<>Y do Z := Z+X J := J+1 end_while {Z=XY} Initialization: P  I  Preservation:{IЛ b} S {I}  Finalization: (IЛb)  Q  Example 3 Use the Q-adequate invariantI: Z=XJto prove:

  21. Heuristics for Identifying “I” • Hypothesize a predicate that reflects the incre-mental progress made toward satisfying Q with each iteration. • Check finalization. If necessary, refine the pre-dicate so as to be just strong enough to imply Q on termination (i.e., when b becomes false). • Check initialization. If necessary, refine the pre-dicate so as to be just weak enough to be implied by P and return to step (2). • Check preservation. If necessary, refine the pre-dicate so as to ensure preservation with respect to S and return to step (2).

  22. Hypothesize I true Finalization ? false true Initialization ? strengthen false true Preservation ? weaken false finish false refine Initialization ? true false Preservation ? true

  23. {N1} Sum:= 0 J := 1 while J<=N do Sum:= Sum + X[J] J := J+1 end_while {Sum = X[i]} HypothesizedI: Does finalization hold? I.e., does Example 4 Synthesize a Q-adequate invariant and prove: J-1  Sum = X[i] i=1 J-1  (Sum = X[i] Л J>N)  i=1 N N   Sum = X[i]? Nope! i=1 i=1

  24. {N1} Sum:= 0 J := 1 while J<=N do Sum:= Sum + X[J] J := J+1 end_while {Sum = X[i]} HypothesizedI: (try #2) Does finalization hold? I.e., does Example 4 Synthesize a Q-adequate invariant and prove: J-1  Sum = X[i] Л JN+1 i=1 J-1  (Sum = X[i] Л JN+1Л J>N)  i=1 N N  Sum = X[i]?  i=1 i=1 Yep!

  25. {N1} Sum:= 0 J := 1 while J<=N do Sum:= Sum + X[J] J := J+1 end_while {Sum = X[i]} HypothesizedI: (try #2) Finalization Example 4 Synthesize a Q-adequate invariant and prove: J-1  Sum = X[i] Л JN+1 i=1 N  i=1

  26. {N1} Sum:= 0 J := 1 while J<=N do Sum:= Sum + X[J] J := J+1 end_while {Sum = X[i]} HypothesizedI: (try #2) Does initialization hold? I.e., does Example 4 Synthesize a Q-adequate invariant and prove: J-1  Sum = X[i] Л JN+1 i=1 (N1 ЛSum=0 Л J=1)  J-1  (Sum = X[i] Л JN+1)? N  i=1 i=1 Yep!

  27. {N1} Sum:= 0 J := 1 while J<=N do Sum:= Sum + X[J] J := J+1 end_while {Sum = X[i]} HypothesizedI: (try #2) Finalization Initialization Example 4 Synthesize a Q-adequate invariant and prove: J-1  Sum = X[i] Л JN+1 i=1 N  i=1

  28. {N1} Sum:= 0 J := 1 while J<=N do Sum:= Sum + X[J] J := J+1 end_while {Sum = X[i]} HypothesizedI: (try #2) Does preservation hold? Example 4 Synthesize a Q-adequate invariant and prove: J-1  Sum = X[i] Л JN+1 i=1 J-1  {Sum = X[i] Л JN+1 ЛJN} i=1 Sum:= Sum + X[J] J  N {Sum = X[i] Л JN}  i=1 i=1 J := J+1 J-1  {Sum = X[i] Л J-1N} = {I}  i=1

  29. {N1} Sum:= 0 J := 1 while J<=N do Sum:= Sum + X[J] J := J+1 end_while {Sum = X[i]} HypothesizedI: (try #2) Finalization Initialization Preservation Example 4 Synthesize a Q-adequate invariant and prove: J-1  Sum = X[i] Л JN+1 i=1 N  i=1

  30. Strong Correctness • Program S is said to be strongly correct with respect to pre-condition P and post-condition Q iff: • {P} S {Q} (i.e., S is weakly correct with respect to P and Q), and • P implies that S will terminate.

  31. Strong Correctness (cont’d) • Is it possible to prove that a program will terminate? • Are there programs for which termination is undecidable? To write a program which should terminate but doesn’t is a minor sin. To write a program for which termination is undecidable is a major sin.–Harlan Mills

  32. Let’s Pause for a Moment… I remember, as a young boy, watching small, brown frogs jump from Lilly pad to Lilly pad in the pond behind our house. They seemed to never tire of this…

  33. Proving Termination – the Method of Well-Founded Sets† For each program loop, identify a measure based on one or more program variables that satisfies the following properties: • decreases (or increases) with each iteration • is bounded from below (or above), and • can assume only a finite number of values before reaching the bound †A well-founded set (S, >) consists of a set of elements S and an ordering > defined on the elements, such that there can be no infinite descending sequences of elements.

  34. Proving Termination – the Method of Well-Founded Sets (cont’d) • Example: consider a linear search of an unordered list for the value K: {true} Found:=false J := 1 while (J<=N and (not Found)) do Found:= (K=X[J]) J := J+1 end_while {(FoundЛ K=X[J-1]) V (FoundЛi∈{1,…,N}• KX[i])}

  35. Proving Termination – the Method of Well-Founded Sets (cont’d) Proof of termination: Measure: “J” • J increases with each iteration since J:=J+1 is executed with each iteration and J does not otherwise change. • J is bounded from above (by N+1) since if J exceeds N, J<=N will evaluate to false and the loop must terminate.

  36. Proving Termination – the Method of Well-Founded Sets (cont’d) Proof of termination: (cont’d) • Since J increases by an integral amount with each iteration, it can assume only a finite number of values before reaching N+1: {1, 2,…, N, N+1}. Therefore, by the Method of Well-Founded Sets, the loop must terminate.

  37. Exercise • The weak correctness of the assertion below was established earlier. Can the Method of Well-Founded Sets be used to prove the program will terminate? {true} Z := X J := 1 while J<>Y do Z := Z+X J := J+1 end_while {Z=XY}

  38. A while_do ROI for strong correctness • We can incorporate a termination term, t, in the while loop ROI. • Let t denote a whole number† which decreases with each iteration and implies termination when less than or equal to 0: PI, (IЛb)(t>0), {IЛbЛt=N} S {IЛt<N}, (IЛb)Q {P} while b do S {Q} strongly †Any well-founded ordering may be used for the domain of t.

  39. Problem Set 5: Axiomatic Verification • Note especially... • Problem 4: deriving and using a suitable Rule of Inference for the “repeat_until” construct, and • Problem 6: alternative, hypothesized Rules of Inference for the “while” construct...are they valid or not?

  40. Axiomatic Verification II Software Testing and Verification Lecture Notes 18 Prepared by Stephen M. Thebaut, Ph.D. University of Florida

More Related