Exercise Solutions: Functional Verification

Exercise Solutions: Functional Verification Software Testing and Verification Prepared by Stephen M. Thebaut, Ph.D. University of Florida

Exercise (from Lecture Notes #21) “Identity” function: x,y := x,y • Given P = if x>=y then x,y := y,x f1 = (x>y  x,y := y,x | true  I) f2 = (x>y x,y := y,x | x<y  I) f3 = (x≠y x,y := y,x) • Fill in the following “correctness table”: P C=Complete S=Sufficient N=Neither f1 f2 f3

Exercise (from Lecture Notes #22) • Prove f = [A] where f = (x=17  x,y := 17,20 | true  x,y := x,-x) and A is: if x=17 then y := x+3 else y := -x end_if_else

if_then_else Correctness Conditions • Complete correctness conditions for f = [if p then G else H] (where g = [G] and h = [H] have already been shown): Prove: p (f = g) Л ¬p (f = h) • Working correctness questions: • When p is true, does f equal g? • When p is false, does f equal h?

Proof that f = [P] f = (x=17  x,y := 17,20 | true  x,y := x,-x) A: if x=17 then y := x+3 else y := -x end_if_else

Proof that f = [P] f = (x=17  x,y := 17,20 | true  x,y := x,-x) A: if x=17 then y := x+3 G else y := -x H end_if_else

Proof that f = [P] f = (x=17  x,y := 17,20 | true  x,y := x,-x) A: if x=17 then y := x+3 G else y := -x H end_if_else By observation, g = x,y := x,x+3 h = x,y := x,-x

Proof that f = [P] (cont’d) • Therefore, by the Axiom of Replacement, it is sufficient to show: f = (x=17  x,y := 17,20 | true  x,y := x,-x) = [if x=17 then (x,y := x,x+3)else(x,y := x,-x)] g h p

Proof that f = [P] (cont’d) • Therefore, by the Axiom of Replacement, it is sufficient to show: f = (x=17  x,y := 17,20 | true  x,y := x,-x) = [if x=17 then (x,y := x,x+3)else(x,y := x,-x)] When p is true does f equal g? When p is false does f equal h? g h p

Proof that f = [P] (cont’d) • Therefore, by the Axiom of Replacement, it is sufficient to show: f = (x=17  x,y := 17,20 | true  x,y := x,-x) = [if x=17 then (x,y := x,x+3)else(x,y := x,-x)] When p is true does f equal g? (x=17)  (f = (x,y := 17,20)) When p is false does f equal h? g h p

Proof that f = [P] (cont’d) • Therefore, by the Axiom of Replacement, it is sufficient to show: f = (x=17  x,y := 17,20 | true  x,y := x,-x) = [if x=17 then (x,y := x,x+3)else(x,y := x,-x)] When p is true does f equal g? (x=17)  (f = (x,y := 17,20)) (x=17)  (g = (x,y := x,x+3) When p is false does f equal h? g h p

Proof that f = [P] (cont’d) • Therefore, by the Axiom of Replacement, it is sufficient to show: f = (x=17  x,y := 17,20 | true  x,y := x,-x) = [if x=17 then (x,y := x,x+3)else(x,y := x,-x)] When p is true does f equal g? (x=17)  (f = (x,y := 17,20)) (x=17)  (g = (x,y := x,x+3) = (x,y := 17,20)) When p is false does f equal h? g h p

Proof that f = [P] (cont’d) • Therefore, by the Axiom of Replacement, it is sufficient to show: f = (x=17  x,y := 17,20 | true  x,y := x,-x) = [if x=17 then (x,y := x,x+3)else(x,y := x,-x)] When p is true does f equal g? (x=17)  (f = (x,y := 17,20)) (x=17)  (g = (x,y := x,x+3) √ = (x,y := 17,20)) When p is false does f equal h? g h p

Proof that f = [P] (cont’d) • Therefore, by the Axiom of Replacement, it is sufficient to show: f = (x=17  x,y := 17,20 | true  x,y := x,-x) = [if x=17 then (x,y := x,x+3)else(x,y := x,-x)] When p is true does f equal g? (x=17)  (f = (x,y := 17,20)) (x=17)  (g = (x,y := x,x+3) √ = (x,y := 17,20)) When p is false does f equal h? (x≠17)  (f = (x,y := x,-x)) g h p

Proof that f = [P] (cont’d) • Therefore, by the Axiom of Replacement, it is sufficient to show: f = (x=17  x,y := 17,20 | true  x,y := x,-x) = [if x=17 then (x,y := x,x+3)else(x,y := x,-x)] When p is true does f equal g? (x=17)  (f = (x,y := 17,20)) (x=17)  (g = (x,y := x,x+3) √ = (x,y := 17,20)) When p is false does f equal h? (x≠17)  (f = (x,y := x,-x)) (x≠17)  (h = (x,y := x,-x)) g h p

Proof that f = [P] (cont’d) • Therefore, by the Axiom of Replacement, it is sufficient to show: f = (x=17  x,y := 17,20 | true  x,y := x,-x) = [if x=17 then (x,y := x,x+3)else(x,y := x,-x)] When p is true does f equal g? (x=17)  (f = (x,y := 17,20)) (x=17)  (g = (x,y := x,x+3) √ = (x,y := 17,20)) When p is false does f equal h? (x≠17)  (f = (x,y := x,-x)) (x≠17)  (h = (x,y := x,-x)) g h p √

Exercise 1 (from Lecture Notes #23) • For program M below, where all variables are integers, hypothesize a function f for [M] and prove f = [M]. while i<n do t := t*x i := i+1 end_while

Exercise 1 (from Lecture Notes #23) • For program M below, where all variables are integers, hypothesize a function f for [M] and prove f = [M]. while i<n do t := t*x i := i+1 end_while Hypothesized f:

Exercise 1 (from Lecture Notes #23) • For program M below, where all variables are integers, hypothesize a function f for [M] and prove f = [M]. while i<n do t := t*x i := i+1 end_while Hypothesized f: (i<n  i,t :=

Exercise 1 (from Lecture Notes #23) • For program M below, where all variables are integers, hypothesize a function f for [M] and prove f = [M]. while i<n do t := t*x i := i+1 end_while Hypothesized f: (i<n  i,t := n,

Exercise 1 (from Lecture Notes #23) • For program M below, where all variables are integers, hypothesize a function f for [M] and prove f = [M]. while i<n do t := t*x i := i+1 end_while Hypothesized f: (i<n  i,t := n,txn-i

Exercise 1 (from Lecture Notes #23) • For program M below, where all variables are integers, hypothesize a function f for [M] and prove f = [M]. while i<n do t := t*x i := i+1 end_while Hypothesized f: (i<n  i,t := n,txn-i | i≥n 

Exercise 1 (from Lecture Notes #23) • For program M below, where all variables are integers, hypothesize a function f for [M] and prove f = [M]. while i<n do t := t*x i := i+1 end_while Hypothesized f: (i<n  i,t := n,txn-i | i≥n  I)

Exercise 1 (from Lecture Notes #23) • For program M below, where all variables are integers, hypothesize a function f for [M] and prove f = [M]. while i<n do t := t*x i := i+1 end_while Hypothesized f: (i<n  i,t := n,txn-i | i≥n  I) Alternative f:

Exercise 1 (from Lecture Notes #23) • For program M below, where all variables are integers, hypothesize a function f for [M] and prove f = [M]. while i<n do t := t*x i := i+1 end_while Hypothesized f: (i<n  i,t := n,txn-i | i≥n  I) Alternative f: (i≤n  i,t := n,txn-i | i>n  I)

Exercise 1 (from Lecture Notes #23) • For program M below, where all variables are integers, hypothesize a function f for [M] and prove f = [M]. while i<n do t := t*x i := i+1 end_while Hypothesized f: (i<n  i,t := n,txn-i | i≥n  I) Alternative f: (i≤n  i,t := n,txn-i | i>n  I) Does it make any difference which we use?

while_do Correctness Conditions • Complete correctness conditions for f = [while p do g] (where g = [G] has already been shown): Prove: term(f,M)Л p (f = f o g) Л ¬p(f = I)

Proof that f = [M] f = (i<n  i,t := n,txn-i | i≥n  I) M: while i<n do t := t*x i := i+1 end_while

Proof that f = [M] f = (i<n  i,t := n,txn-i | i≥n  I) M: while i<n do t := t*x i := i+1 end_while p G

Proof that f = [M] f = (i<n  i,t := n,txn-i | i≥n  I) M: while i<n do t := t*x i := i+1 end_while By observation, g = [G] = (i,t := i+1,tx) p G

Proof that f = [M] f = (i<n  i,t := n,txn-i | i≥n  I) M: while i<n do t := t*x i := i+1 end_while By observation, g = [G] = (i,t := i+1,tx) • Is loop termination guaranteed for any argument in D(f)? p G

Proof that f = [M] f = (i<n  i,t := n,txn-i | i≥n  I) M: while i<n do t := t*x i := i+1 end_while By observation, g = [G] = (i,t := i+1,tx) • Is loop termination guaranteed for any argument in D(f)? YES. (Show this using the Method of Well-Founded Sets.) p G

Proof that f = [M] (cont’d) • Does (i≥n)  ( f = I )?

Proof that f = [M] (cont’d) • Does (i≥n)  ( f = I )? ( Recall: f = (i<n  i,t := n,txn-i | i≥n  I))

Proof that f = [M] (cont’d) • Does (i≥n)  ( f = I )? √ ( Recall: f = (i<n  i,t := n,txn-i | i≥n  I))

Proof that f = [M] (cont’d) • Does (i≥n)  ( f = I )? √ • Does (i<n)  ( f = f o g )? ( Recall: f = (i<n  i,t := n,txn-i | i≥n  I))

Proof that f = [M] (cont’d) • Does (i≥n)  ( f = I )? √ • Does (i<n)  ( f = f o g )? (i<n)  ( f = i,t := n,txn-i) ( Recall: f = (i<n  i,t := n,txn-i | i≥n  I))

Proof that f = [M] (cont’d) • Does (i≥n)  ( f = I )? √ • Does (i<n)  ( f = f o g )? (i<n)  ( f = i,t := n,txn-i) (i<n)  ( f o g = f o (i,t := i+1,tx)) ( Recall: f = (i<n  i,t := n,txn-i | i≥n  I))

Proof that f = [M] (cont’d) • Does (i≥n)  ( f = I )? √ • Does (i<n)  ( f = f o g )? (i<n)  ( f = i,t := n,txn-i) (i<n)  ( f o g = f o (i,t := i+1,tx)) What is f when appliedafter g changes the initial value ofi? ( Recall: f = (i<n  i,t := n,txn-i | i≥n  I))

Proof that f = [M] (cont’d) • Does (i≥n)  ( f = I )? √ • Does (i<n)  ( f = f o g )? (i<n)  ( f = i,t := n,txn-i) (i<n)  ( f o g = f o (i,t := i+1,tx)) What is f when appliedafter g changes the initial value ofi? There are two cases to consider: i=n-1 & i<n-1 ( Recall: f = (i<n  i,t := n,txn-i | i≥n  I))

Proof that f = [M] (cont’d) • Does (i<n)  ( f = f o g )? case a: (i=n-1)  ( f = i,t := n,txn-i ( Recall: f = (i<n  i,t := n,txn-i | i≥n  I))

Proof that f = [M] (cont’d) • Does (i<n)  ( f = f o g )? case a: (i=n-1)  ( f = i,t := n,txn-(n-1) ( Recall: f = (i<n  i,t := n,txn-i | i≥n  I))

Proof that f = [M] (cont’d) • Does (i<n)  ( f = f o g )? case a: (i=n-1)  ( f = i,t := n,txn-(n-1) = i,t := n,tx) ( Recall: f = (i<n  i,t := n,txn-i | i≥n  I))

Exercise Solutions: Functional Verification