# Hoare-style program verification K. Rustan M. Leino Guest lecturer Rob DeLines CSE 503, Software Engineering University of Washington 28 Apr 2004.

## Presentation on theme: "Hoare-style program verification K. Rustan M. Leino Guest lecturer Rob DeLines CSE 503, Software Engineering University of Washington 28 Apr 2004."— Presentation transcript:

Hoare-style program verification K. Rustan M. Leino Guest lecturer Rob DeLines CSE 503, Software Engineering University of Washington 28 Apr 2004

Review {P} skip {P} {P[w:=E]} w:=E {P} {PB} assert B {P} if {P} S {Q} and {Q} T {R}, then {P} S ; T {R} if {PB} S {R} and {PB} T {R}, then {P} if B then S else T end {R}

Loops To prove {P} while B do S end {Q} prove {P} {J} while B do {J B} {0 vf} {J B vf=VF} S {J vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_3.jpg", "name": "Loops To prove {P} while B do S end {Q} prove {P} {J} while B do {J B} {0 vf} {J B vf=VF} S {J vf

Example: Array sum {0N} k := 0; s := 0; while k N do s:=s+a[k] ; k:=k+ 1 end {s = (Σi | 0i { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_4.jpg", "name": "Example: Array sum {0N} k := 0; s := 0; while k N do s:=s+a[k] ; k:=k+ 1 end {s = (Σi | 0i

{0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_5.jpg", "name": "{0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf

Example: Array sum {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_6.jpg", "name": "Example: Array sum {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf

Example: Array sum {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_7.jpg", "name": "Example: Array sum {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf

{0N} {0 = (Σi | 0i<0 a[i]) 00N} k := 0; {0 = (Σi | 0i { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_8.jpg", "name": "{0N} {0 = (Σi | 0i<0 a[i]) 00N} k := 0; {0 = (Σi | 0i

Example: Array sum Invariance {s = (Σi | 0i { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_9.jpg", "name": "Example: Array sum Invariance {s = (Σi | 0i

In-class exercise: computing cubes {0N} k := 0; r := 0; s := 1; t := 6; while kN do a[k] := r; r := r + s; s := s + t; t := t + 6; k := k + 1 end {(i | 0i { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_10.jpg", "name": "In-class exercise: computing cubes {0N} k := 0; r := 0; s := 1; t := 6; while kN do a[k] := r; r := r + s; s := s + t; t := t + 6; k := k + 1 end {(i | 0i

Computing cubes Guessing the invariant From the postcondition (i | 0i { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_11.jpg", "name": "Computing cubes Guessing the invariant From the postcondition (i | 0i

Computing cubes Maintaining the invariant while kN do {(i | 0i { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_12.jpg", "name": "Computing cubes Maintaining the invariant while kN do {(i | 0i

Computing cubes Maintaining the invariant while kN do {r = k 3 …} {r + s = k 3 + 3*k 2 + 3*k + 1} a[k] := r; r := r + s; s := s + t; t := t + 6; {r = k 3 + 3*k 2 + 3*k + 1} {r = (k+ 1 ) 3 } k := k + 1 {r = k 3 } end Add s = 3*k 2 + 3*k + 1 to the invariant, and then try to prove that it is maintained

Computing cubes Maintaining the invariant while kN do {s = 3*k 2 + 3*k + 1 …} {s + t = 3*k 2 + 6*k + 3 + 3*k + 3 + 1} a[k] := r; r := r + s; s := s + t; t := t + 6; {s = 3*k 2 + 6*k + 3 + 3*k + 3 + 1} {s = 3*(k+1) 2 + 3*(k+1) + 1} k := k + 1 {s = 3*k 2 + 3*k + 1} end Add t = 6*k + 6 to the invariant, and then try to prove that it is maintained

Computing cubes Maintaining the invariant while kN do {t = 6*k + 6 …} {t + 6 = 6*k + 6 + 6} a[k] := r; r := r + s; s := s + t; t := t + 6; {t = 6*k + 6 + 6} {t = 6*(k+1) + 6} k := k + 1 {t = 6*k + 6} end

Computing cubes Establishing the invariant {0N} {(i | 0i<0 a[i] = i 3 ) 00N 0 = 0 3 1 = 3*0 2 + 3*0 + 1 6 = 6*0 + 6} k := 0; r := 0; s := 1; t := 6; {(i | 0i { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_16.jpg", "name": "Computing cubes Establishing the invariant {0N} {(i | 0i<0 a[i] = i 3 ) 00N 0 = 0 3 1 = 3*0 2 + 3*0 + 1 6 = 6*0 + 6} k := 0; r := 0; s := 1; t := 6; {(i | 0i

In-class exercise: computing cubes Answers Invariant: (i | 0i { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_17.jpg", "name": "In-class exercise: computing cubes Answers Invariant: (i | 0i

Other common invariants k is the number of nodes traversed so far the current value of n does not exceed the initial value of n all array elements with an index less than j are smaller than x the number of processes whose program counter is inside the critical section is at most one the only principals that know the key K are A and B

Belgian chocolate How many breaks do you need to make 50 individual pieces from a 10x5 Belgian chocolate bar? Note: Belgian chocolate is so thick that you can't break two pieces at once. Invariant: #pieces = 1 + #breaks

Loop proof obligations a closer look To prove {P} while B do S end {Q} find invariant J and variant function vf such that: – invariant initially: P J – invariant maintained: {J B} S {J} – invariant sufficient: J B Q – vf well-founded – vf bounded: J B 0 vf – vf decreases: {J B vf=VF} S {vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_20.jpg", "name": "Loop proof obligations a closer look To prove {P} while B do S end {Q} find invariant J and variant function vf such that: – invariant initially: P J – invariant maintained: {J B} S {J} – invariant sufficient: J B Q – vf well-founded – vf bounded: J B 0 vf – vf decreases: {J B vf=VF} S {vf

{0N} k := N; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_21.jpg", "name": "{0N} k := N; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf

{0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 2 {J vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_22.jpg", "name": "{0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 2 {J vf

Loop proof obligations invariant is sufficient {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} k:=k+ 1 {J vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_23.jpg", "name": "Loop proof obligations invariant is sufficient {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} k:=k+ 1 {J vf

Loop proof obligations variant function is well-founded {0N} k := 0; s := 0; r := 1.0 ; {J} while k N do {J kN} {0 vf} {J kN vf=VF} r := r / 2.0 ; {J vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_24.jpg", "name": "Loop proof obligations variant function is well-founded {0N} k := 0; s := 0; r := 1.0 ; {J} while k N do {J kN} {0 vf} {J kN vf=VF} r := r / 2.0 ; {J vf

Loop proof obligations variant function is bounded {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} k:=k- 1 {J vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_25.jpg", "name": "Loop proof obligations variant function is bounded {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} k:=k- 1 {J vf

Loop proof obligations variant function decreases {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} skip {J vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_26.jpg", "name": "Loop proof obligations variant function decreases {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} skip {J vf

Ranges in invariants {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_27.jpg", "name": "Ranges in invariants {0N} k := 0; s := 0; {J} while k N do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf

Ranges: lower bound {s = (Σi | 0i { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_28.jpg", "name": "Ranges: lower bound {s = (Σi | 0i

Ranges: upper bound {0N} k := 0; s := 0; {J} while kN do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_29.jpg", "name": "Ranges: upper bound {0N} k := 0; s := 0; {J} while kN do {J kN} {0 vf} {J kN vf=VF} s:=s+a[k] ; k:=k+ 1 {J vf

Ranges: upper bound {0N} k := 0; s := 0; {J} while k < N do {J k { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/1/248622/slides/slide_30.jpg", "name": "Ranges: upper bound {0N} k := 0; s := 0; {J} while k < N do {J k

Download ppt "Hoare-style program verification K. Rustan M. Leino Guest lecturer Rob DeLines CSE 503, Software Engineering University of Washington 28 Apr 2004."

Similar presentations