Software Verification 1 Deductive Verification

Software Verification 1Deductive Verification Prof. Dr. Holger Schlingloff Institut für Informatik der Humboldt Universität und Fraunhofer Institut für Rechnerarchitektur und Softwaretechnik

Hoare calculus • ⊢ {[v:=t]} v=t {} (ass) • ⊢ {} skip {} (usually omitted) • if ⊢ {}1{}and ⊢ {} 2{}, then {} {1; 2}{} (seq) • if ⊢ {  b} 1{} and ⊢ {  ¬b} 2{}, then ⊢ {}if (b) 1 else 2 {} (ite) • if ⊢ {  b} {}, then ⊢ {}while (b) {  ¬b} (whi) • If ⊢ (’  ) and ⊢ {} {}, then ⊢ {’}  {} (imp1) • If ⊢ {}  {} and ⊢ (  ’), then ⊢ {}  {’} (imp2) • the semantics (meaning) of a program  is the set of all derivable Hoare-tripels {} {}

Examples • {x==17} x++ {x==18} • {x==17} y=x+1 {y==18} • {x==17} {x++; y=x+1} {y==19} • {a==m  b==n}if (a<=b) c = a else c = b{c==min(m,n)} • {a==m>0  b==n>0} while (a!=0) {c = a; a = b%a; b = c} {b==gcd(m,n)}

Sample proof: exponentiation Consider the following while-program  {c==1; while(b!=0){ if (b%2==0){b=b/2; a=a*a} else {b=b-1; c=c*a} } } We want to show that ⊢ {a==m  b==n}  {c==m**n}

Sample proof: exponentiation (1) ⊢ {a==m  b==n} c=1 {a==m  b==n  c==1} (ass) (2) ⊢ {a==m  b==n} c=1 {c*a**b==m**n} (imp,1) (3) ⊢ {c*(a*a)**(b/2)==m**n} b=b/2 {c*(a*a)**b==m**n} (ass) (4) ⊢ {c*a**b==m**n} b=b/2 {c*(a*a)**b==m**n} (3,imp) (5) ⊢ {c*(a*a)**b==m**n} a=a*a {c*a**b==m**n} (ass) (6) ⊢ {c*a**b==m**n} {b=b/2; a=a*a} {c*a**b==m**n} (seq,4,5) (7) ⊢ {c*a*a**(b-1)==m**n} b==b-1 {c*a*a**b==m**n} (ass) (8) ⊢ {c*a**b==m**n} b==b-1 {c*a*a**b==m**n} (7,imp) (9) ⊢ {c*a*a**b==m**n} c==c*a {c*a**b==m**n} (ass) (10) ⊢ {c*a**b==m**n} {b==b-1; c==c*a} {c*a**b==m**n} (seq,8,9) (11) ⊢ {c*a**b==m**n  b%2==0} {b=b/2; a=a*a} {c*a**b==m**n} (6,imp) (12) ⊢ {c*a**b==m**n  b%2!=0} {b==b-1; c==c*a} {c*a**b==m**n} (10,imp)

Sample proof: exponentiation (2) ⊢ {a==m  b==n} c=1 {c*a**b==m**n} (imp,1) (11) ⊢ {c*a**b==m**n  b%2==0} {b=b/2; a=a*a} {c*a**b==m**n} (12) ⊢ {c*a**b==m**n  b%2!=0} {b==b-1; c==c*a} {c*a**b==m**n} (13) ⊢ {c*a**b==m**n} if(b%2==0) {b=b/2; a=a*a} else {b==b-1; c==c*a} {c*a**b==m**n} (ite,11,12) (14) ⊢ {c*a**b==m**n  b!=0} if ... {c*a**b==m**n} (imp,13) (15) ⊢ {c*a**b==m**n} while (b!=0) if ... {c*a**b==m**n  b==0} (whi,14) (16) ⊢ {a==m  b==n} {c=1; while (b!=0) if ...} {c*a**b==m**n  b==0} (seq,2,15) (17) ⊢ {a==m  b==n}  {c==m**n} (imp,16)

Other notation • else { • {c*a**b=m**n  b!=0  b%2!=0} • b=b-1; • {c*a*a**b=m**n } • c=c*a • {c*a**b=m**n } • } • {c*a**b=m**n } • } • {c*a**b=m**n  b==0} • } • {c==m**n} {a==m  b==n} {c==1; {a==m  b==n  c==1} {c*a**b=m**n} while(b!=0){ {c*a**b=m**n  b!=0} if (b%2==0){ {c*a**b=m**n  b!=0  b%2==0} b=b/2; {c*(a*a)**b=m**n} a=a*a {c*a**b=m**n} } {c*a**b=m**n}

A more complex example: gcd {a==m>0  b==n>0} while (a!=b) if (a>b) a=a-b else b=b-a {a==b==gcd(m,n)} where a==gcd(m,n) iff a|m  a|n  x (x|m  x|n ⇒ x<=a) What we need to know from math is (x < y)  gcd (x, y) == gcd (x, y − x) (x > y)  gcd (x, y) == gcd (x, x − y) (x == y)  gcd (x, y) == x

show gcd(x,y)==gcd(x,y−x) (x < y)  gcd (x, y) == gcd (x, y − x) If x<y, then y-x>0, hence gcd(x,y-x) is well-defined. If z|x and z|y then z|(y-x): x=z*x’, y=z*y’  y-x=z*(y’-x’) If z|x and z|(y-x) then z|y: x=z*x’, (y-x)=z*(y-x)’  x+(y-x)=y=z*(x’+(y-x)’) Hence {z: z|x  z|y} == {z: z|x  z|(y-x)} Which means gcd (x, y) == gcd (x, y − x)

Hoare proof for gcd {a==m>0  b==n>0} {gcd(a,b)==gcd(m,n)} while (a!=b) {gcd(a,b)==gcd(m,n)  a!=b} if (a>b) {gcd(a,b)==gcd(m,n)a>ba!=b} {gcd(a-b,b)==gcd(m,n)} a=a-b {gcd(a,b)==gcd(m,n)} else • {gcd(a,b)==gcd(m,n)a<=ba!=b} {gcd(a,b-a)==gcd(m,n)} b=b-a {gcd(a,b)==gcd(m,n)} {gcd(a,b)==gcd(m,n)} {a==b  gcd(a,b)==gcd(m,n)} {a==b==gcd(m,n)}

gcd, Alternative Version {a==m>0  b==n>0} while (a!=0) {c = a; a = b%a; b = c} {b==gcd(m,n)} Proof: homework!

Software Verification 1 Deductive Verification