Download presentation

Presentation is loading. Please wait.

Published byGeorgia Billings Modified about 1 year ago

1
1 Theorem Proving and Model Checking in PVS 15-820A Proving Software with PVS Edmund Clarke Daniel Kroening Carnegie Mellon University

2
2 Theorem Proving and Model Checking in PVS Outline Modeling Software with PVS –Complete Example for Sequential Software, including proof –The Magic GRIND –Modularization

3
3 Theorem Proving and Model Checking in PVS Modeling Software with PVS C: TYPE = [# a: [below(10)->integer], i: nat #] 1. Define Type for STATE int a[10]; unsigned i; int main() {... } A

4
4 Theorem Proving and Model Checking in PVS Modeling Software with PVS A 2. Translate your program into goto program int a[10]; unsigned i,j,k; int main() { i=k=0; while(i<10) { i++; k+=2; } j=100; k++; } int a[10]; unsigned i,j,k; int main() { L1: i=k=0; L2: if(!(i<10)) goto L4; L3: i++; k+=2; goto L2; L4: j=100; k++; }

5
5 Theorem Proving and Model Checking in PVS Modeling Software with PVS A 3. Partition your program into basic blocks int a[10]; unsigned i,j,k; int main() { L1: i=k=0; L2: if(!(i<10)) goto L4; L3: i++; k+=2; goto L2; L4: j=100; k++; } L1(c: C):C= c WITH [i:=0, k:=0] L2(c: C):C= c L3(c: C):C= c WITH [i:=c`i+1, k:=c`k+2] L4(c: C):C= c WITH [j:=100, k:=c`k+1] 4. Write transition function for each basic block

6
6 Theorem Proving and Model Checking in PVS Modeling Software with PVS 5. Combine transition functions using a program counter int a[10]; unsigned i,j,k; int main() { L1: i=k=0; L2: if(!(i<10)) goto L4; L3: i++; k+=2; goto L2; L4: j=100; k++; } PCt: TYPE = { L1, L2, L3, L4, END } t(c: C): C= CASES c`PC OF L1: L1(c) WITH [PC:=L2], L2: L2(c) WITH [PC:= IF NOT (c`i<10) THEN L4 ELSE L3 ENDIF, L3: L3(c) WITH [PC:=L2], L4: L4(c) WITH [PC:=END], END: c ENDCASES A

7
7 Theorem Proving and Model Checking in PVS Modeling Software with PVS A 6. Define Configuration Sequence c(T: nat, initial: C):RECURSIVE C= IF T=0 THEN initial WITH [PC:=L1] ELSE t(c(T-1, initial)) ENDIF MEASURE T 7. Now prove properties about PC=LEND states program_correct: THEOREM FORALL (initial: C): FORALL (T: nat | c(T)`PC=LEND): c(T)`result=correct_result(initial)

8
8 Theorem Proving and Model Checking in PVS C: TYPE = [# size: nat, a: [nat -> integer], x: integer, i: nat, result: bool, PC: PCt #] Example I bool find_linear(unsigned size, const int a[], int x) { unsigned i; for(i=0; i

9
9 Theorem Proving and Model Checking in PVS bool find_linear(unsigned size, const int a[], int x) { L1: i=0; L2: if(!(i

10
10 Theorem Proving and Model Checking in PVS Example III/IV A 3. Partition your program into basic blocks L1(c: C):C=c WITH [i:=0] L2(c: C):C=c L3(c: C):C=c L4(c: C):C=c WITH [result:=TRUE] L5(c: C):C=c L6(c: C):C=c WITH [i:=c`i+1] L7(c: C):C=c L8(c: C):C=c WITH [result:=FALSE] 4. Write transition function for each basic block bool find_linear (unsigned size, const int a[], int x) { L1: i=0; L2: if(!(i

11
11 Theorem Proving and Model Checking in PVS Example V 5. Combine transition functions using a program counter t(c: C):C=CASES c`PC OF L1: L1(c) WITH [PC:=L2], L2: L2(c) WITH [PC:= IF NOT c`i < c`size THEN L8 ELSE L3 ENDIF], L3: L3(c) WITH [PC:= IF NOT c`a(c`i)=c`x THEN L6 ELSE L4 ENDIF], L4: L4(c) WITH [PC:=L5], L5: L5(c) WITH [PC:=LEND], L6: L6(c) WITH [PC:=L7], L7: L7(c) WITH [PC:=L2], L8: L8(c) WITH [PC:=LEND], LEND: c ENDCASES A bool find_linear (unsigned size, const int a[], int x) { L1: i=0; L2: if(!(i

12
12 Theorem Proving and Model Checking in PVS Example VI A 6. Define Configuration Sequence c(T: nat, initial: C):RECURSIVE C= IF T=0 THEN initial WITH [PC:=L1] ELSE t(c(T-1, initial)) ENDIF MEASURE T 7. Now prove properties about PC=LEND states program_correct: THEOREM FORALL (initial: C): FORALL (T: nat | c(T)`PC=LEND): c(T)`result=correct_result(initial) What is the correct result?

13
13 Theorem Proving and Model Checking in PVS C: TYPE = [# size: nat, a: [nat -> integer], x: integer, i: nat, result: bool, PC: PCt #] Example IV correct_result(c: C): bool= EXISTS (j: below(c`size)): c`a(j)=c`x A OK! LET’S PROVE THIS!

14
14 Theorem Proving and Model Checking in PVS C: TYPE = [# size: nat, a: [nat -> integer], x: integer, i: nat, result: bool, PC: PCt #] Something useful first… A program_correct: THEOREM FORALL (initial: C): FORALL (T: nat | c(T)`PC=LEND): c(T)`result=correct_result(initial) This relates initial state and final state We need to say: c(T)`a = initial`a Æ c(T)`x = initial`x Æ c(T)`size = initial`size OR: The program only changes i, result, PC We need to say: c(T)`a = initial`a Æ c(T)`x = initial`x Æ c(T)`size = initial`size OR: The program only changes i, result, PC

15
15 Theorem Proving and Model Checking in PVS invar_constants(T: nat, initial: C): bool= c(T, initial)`size=initial`size AND c(T, initial)`a =initial`a AND c(T, initial)`x =initial`x; constants: LEMMA FORALL (initial:C, T: nat): invar_constants(T, initial) Something useful first… A We need to say: c(T)`a = initial`a Æ c(T)`x = initial`x Æ c(T)`size = initial`size OR: The program only changes i, result, PC We need to say: c(T)`a = initial`a Æ c(T)`x = initial`x Æ c(T)`size = initial`size OR: The program only changes i, result, PC Proof: Induction on T + GRIND next: the real invariant…

16
16 Theorem Proving and Model Checking in PVS FORALL (j: below(c`i)): c`a(j)/=c`x Loop Invariant bool find_linear(unsigned size, const int a[], int x) { unsigned i; for(i=0; i

17
17 Theorem Proving and Model Checking in PVS The Invariant A invar(c: C):bool=CASES c`PC OF L1: % i=0; L2: % if(!(i

18
18 Theorem Proving and Model Checking in PVS The Invariant A invar(c: C):bool=CASES c`PC OF L1: % i=0; L2: FORALL (j: below(c`i)): c`a(j)/=c`x, % if(!(i

19
19 Theorem Proving and Model Checking in PVS The Invariant A invar(c: C):bool=CASES c`PC OF L1: TRUE, % i=0; L2: FORALL (j: below(c`i)): c`a(j)/=c`x, % if(!(i

20
20 Theorem Proving and Model Checking in PVS The Invariant A invar(c: C):bool=CASES c`PC OF L1: TRUE, % i=0; L2: FORALL (j: below(c`i)): c`a(j)/=c`x, % if(!(i

21
21 Theorem Proving and Model Checking in PVS The Invariant A invar(c: C):bool=CASES c`PC OF L1: TRUE, % i=0; L2: FORALL (j: below(c`i)): c`a(j)/=c`x, % if(!(i

22
22 Theorem Proving and Model Checking in PVS The Invariant A invar(c: C):bool=CASES c`PC OF L1: TRUE, % i=0; L2: FORALL (j: below(c`i)): c`a(j)/=c`x, % if(!(i

23
23 Theorem Proving and Model Checking in PVS The Invariant invar(c: C):bool=CASES c`PC OF L1: TRUE, % i=0; L2: FORALL (j: below(c`i)): c`a(j)/=c`x, % if(!(i

24
24 Theorem Proving and Model Checking in PVS The Invariant DARING CLAIM “Once you have found the invariant, the proof is done.” We now have the invariant. Lets do the actual proof. Who believes we are done? A

25
25 Theorem Proving and Model Checking in PVS The Gentzen Sequent {-1} i(0)`reset {-2} i(4)`reset |------- {1} i(1)`reset {2} i(2)`reset {3} (c(2)`A AND NOT c(2)`B) Disjunction (Consequents) Conjunction (Antecedents) Or: Reset in cycles 0, 4 is on, and off in 1, 2. Show that A and not B holds in cycle 2.

26
26 Theorem Proving and Model Checking in PVS The Magic of (GRIND) Myth: Grind does it all… Reality: Use it when: –Case splitting, skolemization, expansion, and trivial instantiations are left Does not do induction Does not apply lemmas “... frequently used to automatically complete a proof branch…”

27
27 Theorem Proving and Model Checking in PVS The Magic of (GRIND) If it goes wrong… –you can get unprovable subgoals –it might expand recursions forever How to abort? –Hit Ctrl-C twice, then (restore) How to make it succeed? –Before running (GRIND), remove unnecessary parts of the sequent using (DELETE fnum). It will prevent that GRIND makes wrong instantiations and expands the wrong definitions.

28
28 Theorem Proving and Model Checking in PVS NOW LET’S PROVE THE INVARIANT

29
29 Theorem Proving and Model Checking in PVS A word on automation… A The generation of C, t, and c can be trivially automated Most of the invariant can be generated automatically – all but the actual loop invariant (case L7/L2) The proof is automatic unless quantifier instantiation is required

30
30 Theorem Proving and Model Checking in PVS Modularization t(c: C):C=CASES c`PC OF L1: L1(c) WITH [PC:=L2], L2: L2(c) WITH [PC:= IF NOT c`i < c`size THEN L8 ELSE L3 ENDIF], L3: L3(c) WITH [PC:= IF NOT c`a(c`i)=c`x THEN L6 ELSE L4 ENDIF], L4: L4(c) WITH [PC:=L5], L5: L5(c) WITH [PC:=LEND], L6: L6(c) WITH [PC:=L7], L7: L7(c) WITH [PC:=L2], L8: L8(c) WITH [PC:=LEND], LEND: c ENDCASES bool find_linear (unsigned size, const int a[], int x) { L1: i=0; L2: if(!(i

31
31 Theorem Proving and Model Checking in PVS Modularization A epsilon_ax: AXIOM (EXISTS x: p(x)) => p(epsilon(p)) find_linear(start: C): C= c( epsilon! (T: nat): c(T, start)`PC=LEND, start) a T such that c(T, start)`PC=LEND "epsilon! (x:t): p(x)” is translated to "epsilon(LAMBDA (x:t): p(x))” THIS IS WHAT REQUIRES TERMINATION

32
32 Theorem Proving and Model Checking in PVS Modularization A termination: THEOREM FORALL (initial: C): EXISTS (T: nat): c(T, initial)`PC=LEND epsilon_ax: AXIOM (EXISTS x: p(x)) => p(epsilon(p)) allows to show the left hand side of the right hand side then says c(epsilon! (T: nat): c(T, start)`PC=LEND, start)`PC=LEND

33
33 Theorem Proving and Model Checking in PVS Modularization A find_linear(start: C): C= c( epsilon! (T: nat): c(T, start)`PC=LEND, start) What to prove about it? find_linear_correct: THEOREM FORALL (c: C): LET new=find_linear(c) IN new=c WITH [result:=correct_result(c)] ? ? What is missing?

34
34 Theorem Proving and Model Checking in PVS Modularization A find_linear(start: C): C= c( epsilon! (T: nat): c(T, start)`PC=LEND, start) What to prove about it? find_linear_correct: THEOREM FORALL (c: C): LET new=find_linear(c) IN new=c WITH [result:=correct_result(c), PC:=new`PC, i:=new`i] “All variables but result, PC, and i are unchanged, and result is the correct result.”

35
35 Theorem Proving and Model Checking in PVS NOW LET’S PROVE THE THEOREM

Similar presentations

© 2017 SlidePlayer.com Inc.

All rights reserved.

Ads by Google