Program Verification
description
Transcript of Program Verification
![Page 1: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/1.jpg)
13 Aug 2013
Program Verification
![Page 2: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/2.jpg)
Proofs about ProgramsWhy make you study logic?Why make you do proofs?Because we want to prove properties of
programsIn particular, we want to prove properties of
variables at specific points in a program
![Page 3: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/3.jpg)
Isn’t testing enough?Assuming the program compiles…Testing demonstrates for specific examples
that the program seems to be running as intended.
Testing can only show existence of some bugs rather than exhaustively identifying all of them.
Verification however…
![Page 4: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/4.jpg)
Program Verification
We consider a program to be correct if it produces the expected output for every possible input.
This requires a formal specification of program behavior and techniques for inferring correctness.
Fortunately, we know about logic.
![Page 5: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/5.jpg)
Program Correctness ProofsTwo parts:
Correct answer when the program terminates (called partial correctness)
The program does terminate
We will only do part 1Prove that a method is correct if it terminates
![Page 6: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/6.jpg)
Predicate Logic & ProgramsVariables in programs are like variables in
predicate logic:They have a domain of discourse (data type)They have values (drawn from the data type)
Variables in programs are different from variables in predicate logic:Their values change over time
![Page 7: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/7.jpg)
Specification of Program Segments
Two parts:Initial Assertion: a statement of what must be
true about the input values or values of variables at the beginning of the program segmentE.g Method that determines the sqrt of a number,
requires the input (parameters) to be >= 0Final Assertion: a statement of what must be
true about the output values or values of variables at the end of the program segmentE.g. What is the output/final result after a call to the
method?
![Page 8: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/8.jpg)
Specification of Program Segments
Initial Assertion: sometimes called the precondition
Final Assertion: sometimes called the postcondition
Note: these assertions can be represented as propositions or predicates. For simplicity, we will write them generally as propositions.
{ // prgm code}
Post-conditions
after code executes
z = 3
Pre-conditions
before code executes
x = 1
![Page 9: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/9.jpg)
Hoare Triple“A program, or program segment, S,
is said to be partially correct with respect to the initial assertion p
and the final assertion q if, whenever p is true
for the input values of S and S terminates, then q is true for the output values of S.” [Rosen 7th edition, p. 372]
Notation: p{S}q
{ // prgm code: S}
Post-conditions
after code executes
q
Pre-conditions
before code executes
p
![Page 10: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/10.jpg)
Simple Example
Assume that our proof system already includes rules of arithmetic…
Consider the following code:
y = 2;z = x + y;
Initial Assertion: p(x), x =1Final assertion: q(z), z =3
What is true BEFORE code
executes
What is true AFTER code
executes
![Page 11: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/11.jpg)
Simple Example, continued
Here {S} contains two code statementsSo, p {S} q for this example is
(p(x), x =1) (q(z), z =3)y = 2;
z = x + y;
y = 2;
z = x + y;
p Pre-Condition
x = 1
Post-Condition q
z = 3
S : Program Segment
![Page 12: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/12.jpg)
Rule 1: Composition Rule
Once we prove correctness of program segments, we can combine the proofs together to prove correctness of an entire program.
p S1 qq S2 r
p S1;S2 r
{ // prgm code: S1}
Post-conditionsafter code executes
Is pre-condition for next
q
Pre-conditions
before code executes
p
{ // prgm code: S2}
Post-conditions
after code executes
r
![Page 13: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/13.jpg)
Rule 2: Conditional Statements
Givenif (condition)
statement;and
Initial assertion: pFinal assertion: q
What does this mean? What must we prove?
If ( condition ){ S}
Post-conditions
after code executes
q
Pre-conditions
before code executes
p
![Page 14: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/14.jpg)
Rule 2: Conditional Statements, …
Given if (condition)
statement;with Initial assertion: p and Final assertion: q
Must show that when p is true and condition is true then q is true
when S terminates: when p is true and condition is false, then q is true
(S does not execute)
qSconditionp
qconditionp
![Page 15: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/15.jpg)
Conditional Rule Example
if (x > y) y = x;
Initial assertion: T (true)Final assertion: q(y,x) means yx
Consider the two cases…
![Page 16: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/16.jpg)
Conditional Rule
p condition S qp condition q
p if condition S q
![Page 17: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/17.jpg)
Conditional Rule Example
if (x > y) y = x;
Initial assertion: T (true)Final assertion: q(y,x) means yx
(p(x), true) (q(y,x), yx)if (x > y)
y = x;
![Page 18: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/18.jpg)
Conditional Rule Example (in code)
input x, y; . . . // Initial: true if (x > y) y = x; // Final: y>=x . . . .
Initial assertion: T (true)Final assertion: q(y,x) means yx
![Page 19: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/19.jpg)
Conditional Rule 2 ExampleVerify the the program segment
if (x % 2 == 1)x = x + 1
Is correct with respect to the initial assertion T and the final assertion x is even
![Page 20: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/20.jpg)
Rule 2a: Conditional with Else
if (condition)S1;
elseS2;
Rule is:
p condition S1 qp condition S2 q
p if condition S1 else S2 q
![Page 21: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/21.jpg)
Conditional Rule 2a Example
if (x < 0) abs = -x;
elseabs = x;
Initial assertion: T (true)
Final assertion: q(abs), abs=|x|
(p(x), true) (q(abs), abs=|x|)
if (x < 0)
abs = -x;
else
abs = x;
![Page 22: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/22.jpg)
Conditional Rule 2a Example
if (x < 0) abs = -x;
else abs = x;
Initial assertion: T (true)Final assertion: q(abs), abs=|x|
Consider the two cases…
![Page 23: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/23.jpg)
Conditional Rule 2a, Code // true if (x < 0) abs = -x; // x < 0 -> abs = |x|
else abs = x; // x >= 0 -> abs = x // abs = |x|
Initial assertion: TFinal assertion: q(abs), abs=|x|
![Page 24: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/24.jpg)
Conditional Rule 2a ExampleVerify the the program segment
if (balance > 100)newBalance = balance * 1.02
elsenewBalance = balance * 1.005
Is correct with respect to the initial assertion balance > 0 and the final assertion (balance > 100 ^ newBalance = balance * 1.02) v (balance <= 100 ^ newBalance = balance * 1.005)
![Page 25: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/25.jpg)
How to we prove loops correct?General idea: loop invariantFind a property that is true before the loopShow that it must still be true after every
iterationTherefore it is true after the loop
![Page 26: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/26.jpg)
Rule 3: Loop Invariantwhile (condition)
S;Rule:
p condition S p p while condition S condition p
Note these are both p!
Note both conclusions
![Page 27: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/27.jpg)
Loop Invariant Examplek = 1; i = 0;while (i < n) {
k = k * 10;i = i + 1;
}•Initial assertion: n > = 0•Final assertion q(k, n) means k = 10 ^ n
![Page 28: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/28.jpg)
Loop Invariant Example (Cont.)What is the loop invariant?
k = 10 ^ ii <= n
Evaluate program segmentBefore entering loopIf loop terminates, p true and i < n falseAfter loop, k = 10 ^i and i <= n is true, but i
< n false, so i >= n, soi = n and k = 10^i = 10^n
![Page 29: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/29.jpg)
Loop Invariant Examplei = 1;factorial = 1;while (i < n) {
i = i + 1;factorial = factorial * i;
}•Initial assertion: n >= 1•Final assertion q(factorial, n) is factorial = n!
![Page 30: Program Verification](https://reader035.fdocuments.us/reader035/viewer/2022062314/568144ea550346895db1bb55/html5/thumbnails/30.jpg)
Loop Invariant Example (Cont.)What is the loop invariant?
factorial = i!i <= n
Evaluate program segmentBefore entering loopIf loop terminates, p true and i < n falseAfter loop, factorial = i! and i <= n is true,
but i < n false, so i >= n, soi = n and factorial = i! = n!