Download presentation

Presentation is loading. Please wait.

Published byEthan Suarez Modified over 2 years ago

1
Hoare-style program verification K. Rustan M. Leino Guest lecturer Rob DeLines CSE 503, Software Engineering University of Washington 28 Apr 2004

2
Review {P} skip {P} {P[w:=E]} w:=E {P} {PB} assert B {P} if {P} S {Q} and {Q} T {R}, then {P} S ; T {R} if {PB} S {R} and {PB} T {R}, then {P} if B then S else T end {R}

3
Loops To prove {P} while B do S end {Q} prove {P} {J} while B do {J B} {0 vf} {J B vf=VF} S {J vf

4
Example: Array sum {0N} k := 0; s := 0; while k N do s:=s+a[k] ; k:=k+ 1 end {s = (Σi | 0i

5
{0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf

6
Example: Array sum {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf

7
Example: Array sum {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf

8
{0N} {0 = (Σi | 0i<0 a[i]) 00N} k := 0; {0 = (Σi | 0i

9
Example: Array sum Invariance {s = (Σi | 0i

10
In-class exercise: computing cubes {0N} k := 0; r := 0; s := 1; t := 6; while kN do a[k] := r; r := r + s; s := s + t; t := t + 6; k := k + 1 end {(i | 0i

11
Computing cubes Guessing the invariant From the postcondition (i | 0i

12
Computing cubes Maintaining the invariant while kN do {(i | 0i

13
Computing cubes Maintaining the invariant while kN do {r = k 3 …} {r + s = k 3 + 3*k 2 + 3*k + 1} a[k] := r; r := r + s; s := s + t; t := t + 6; {r = k 3 + 3*k 2 + 3*k + 1} {r = (k+ 1 ) 3 } k := k + 1 {r = k 3 } end Add s = 3*k 2 + 3*k + 1 to the invariant, and then try to prove that it is maintained

14
Computing cubes Maintaining the invariant while kN do {s = 3*k 2 + 3*k + 1 …} {s + t = 3*k 2 + 6*k *k } a[k] := r; r := r + s; s := s + t; t := t + 6; {s = 3*k 2 + 6*k *k } {s = 3*(k+1) 2 + 3*(k+1) + 1} k := k + 1 {s = 3*k 2 + 3*k + 1} end Add t = 6*k + 6 to the invariant, and then try to prove that it is maintained

15
Computing cubes Maintaining the invariant while kN do {t = 6*k + 6 …} {t + 6 = 6*k } a[k] := r; r := r + s; s := s + t; t := t + 6; {t = 6*k } {t = 6*(k+1) + 6} k := k + 1 {t = 6*k + 6} end

16
Computing cubes Establishing the invariant {0N} {(i | 0i<0 a[i] = i 3 ) 00N 0 = = 3* * = 6*0 + 6} k := 0; r := 0; s := 1; t := 6; {(i | 0i

17
In-class exercise: computing cubes Answers Invariant: (i | 0i

18
Other common invariants k is the number of nodes traversed so far the current value of n does not exceed the initial value of n all array elements with an index less than j are smaller than x the number of processes whose program counter is inside the critical section is at most one the only principals that know the key K are A and B

19
Belgian chocolate How many breaks do you need to make 50 individual pieces from a 10x5 Belgian chocolate bar? Note: Belgian chocolate is so thick that you can't break two pieces at once. Invariant: #pieces = 1 + #breaks

20
Loop proof obligations a closer look To prove {P} while B do S end {Q} find invariant J and variant function vf such that: – invariant initially: P J – invariant maintained: {J B} S {J} – invariant sufficient: J B Q – vf well-founded – vf bounded: J B 0 vf – vf decreases: {J B vf=VF} S {vf

21
{0N} k := N; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf

22
{0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 2 {J vf

23
Loop proof obligations invariant is sufficient {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} k:=k+ 1 {J vf

24
Loop proof obligations variant function is well-founded {0N} k := 0; s := 0; r := 1.0 ; {J} while k N do {J kN} {0 vf} {J kN vf=VF} r := r / 2.0 ; {J vf

25
Loop proof obligations variant function is bounded {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} k:=k- 1 {J vf

26
Loop proof obligations variant function decreases {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} skip {J vf

27
Ranges in invariants {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf

28
Ranges: lower bound {s = (Σi | 0i

29
Ranges: upper bound {0N} k := 0; s := 0; {J} while kN do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf

30
Ranges: upper bound {0N} k := 0; s := 0; {J} while k < N do {J k

Similar presentations

© 2016 SlidePlayer.com Inc.

All rights reserved.

Ads by Google