Presentation is loading. Please wait.

Presentation is loading. Please wait.

Program verification: flowchart programs Book: chapter 7.

Similar presentations


Presentation on theme: "Program verification: flowchart programs Book: chapter 7."— Presentation transcript:

1 Program verification: flowchart programs Book: chapter 7

2 History Verification of flowchart programs: Floyd, 1967 Hoares logic: Hoare, 1969 Linear Temporal Logic: Pnueli, Krueger, 1977 Model Checking: Clarke & Emerson, 1981

3 Program Verification Predicate (first order) logic. Partial correctness, Total correctness Flowchart programs Invariants, annotated programs Well founded ordering (for termination) Hoares logic

4 Predicate (first order logic) Variables, functions, predicates Terms Formulas (assertions)

5 Signature Variables: v1, x, y18 Each variable represents a value of some given domain (int, real, string, …). Function symbols: f(_,_), g2(_), h(_,_,_). Each function has an arity (number of paramenters), a domain for each parameter, and a range. f:int*int->int (e.g., addition), g:real->real (e.g., square root) A constant is a predicate with arity 0. Relation symbols: R(_,_), Q(_). Each relation has an arity, and a domain for each parameter. R : real*real (e.g., greater than). Q : int (e.g., is a prime).

6 Terms Terms are objects that have values. Each variable is a term. Applying a function with arity n to n terms results in a new term. Examples: v1, 5.0, f(v1,5.0), g2(f(v1,5.0)) More familiar notation: sqr(v1+5.0)

7 Formulas Applying predicates to terms results in a formula. R(v1,5.0), Q(x) More familiar notation: v1>5.0 One can combine formulas with the boolean operators (and, or, not, implies). R(v1,5.0)->Q(x) x>1 -> x*x>x One can apply existentail and universal quantification to formulas. x Q(X) x1 R(x1,5.0) X Y R(x,y)

8 A model, A proofs A model gives a meaning (semantics) to a first order formula: A relation for each relation symbol. A function for each function symbol. A value for each variable. An important concept in first order logic is that of a proof. We assume the ability to prove that a formula holds for a given model. Example proof rule (MP) :

9 Flowchart programs Input variables: X=x1,x2,…,xl Program variables: Y=y1,y2,…,ym Output variables: Z=z1,z2,…,zn start halt Y=f(X) Z=h(X,Y)

10 Assignments and tests Y=g(X,Y)t(X,Y) FT

11 start halt (y1,y2)=(0,x1) y2>=x2 (y1,y2)=(y1+1,y2-x2) (z1,z2)=(y1,y2) Initial condition Initial condition: the values for the input variables for which the program must work. x1>=0 /\ x2>0 F T

12 start halt (y1,y2)=(0,x1) y2>=x2 (y1,y2)=(y1+1,y2-x2) (z1,z2)=(y1,y2) The input-output claim The relation between the values of the input and the output variables at termination. x1=z1*x2+z2 /\ 0<=z2 { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/3/799438/slides/slide_12.jpg", "name": "start halt (y1,y2)=(0,x1) y2>=x2 (y1,y2)=(y1+1,y2-x2) (z1,z2)=(y1,y2) The input-output claim The relation between the values of the input and the output variables at termination.", "description": "x1=z1*x2+z2 /\ 0<=z2

13 Partial correctness, Termination, Total correctness Patial correctness: if the initial condition holds and the program terminates then the input-output claim holds. Termination: if the initial condition holds, the program terminates. Total correctness: if the initial condition holds, the program terminates and the input-output claim holds.

14 start halt (y1,y2)=(0,x1) y2>=x2 (y1,y2)=(y1+1,y2-x2) (z1,z2)=(y1,y2) Subtle point: The program is partially correct with respect to x1>=0/\x2>=0 and totally correct with respect to x1>=0/\x2>0 T F

15 start halt (y1,y2)=(0,x1) y2>=x2 (y1,y2)=(y1+1,y2-x2) (z1,z2)=(y1,y2) Annotating a scheme Assign an assertion for each pair of nodes. The assertion expresses the relation between the variable when the program counter is located between these nodes. A B CD E FT

16 Annotating a scheme with invariants A): x1>=0 /\ x2>=0 B): x1=y1*x2+y2 /\ y2>=0 C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2 D):x1=y1*x2+y2 /\ y2>=0 /\ y2=x2 (y1,y2)=(y1+1,y2-x2)(z1,z2)=(y1,y2) A B CD E F T

17 Verification conditions: assignment A) B) [Y\g(X,Y)] A): x1>=0 /\ x2>=0 B): x1=y1*x2+y2 /\ y2>=0 B) [Y\g(X,Y)] = x1=0*x2+x1 /\ x1>=0 (y1,y2)=(0,x1) A B A B Y=g(X,Y)

18 (y1,y2)=(y1+1,y2-x2) Second assignment C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2 B): x1=y1*x2+y2 /\ y2>=0 B)[Y\g(X,Y]: x1=(y1+1)*x2+y2- x2 /\ y2-x2>=0 C B

19 (z1,z2)=(y1,y2) Third assignment D):x1=y1*x2+y2 /\ y2>=0 /\ y2 { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/3/799438/slides/slide_19.jpg", "name": "(z1,z2)=(y1,y2) Third assignment D):x1=y1*x2+y2 /\ y2>=0 /\ y2=0 /\ y2

20 Verification conditions: tests B) /\ t(X,Y) C) B) /\¬t(X,Y) D) B): x1=y1*x2+y2 /\y2>=0 C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2 D):x1=y1*x2+y2 /\ y2>=0 /\ y2=x2 B C D B C D t(X,Y) F T FT

21 Exercise: prove partial correctness Initial condition: x>=0 Input-output claim: z=x! start halt (y1,y2)=(0,1) y1=x (y1,y2)=(y1+1,(y1+1)*y2)z=y2 TF

22 Annotating a scheme Assign an assertion for each pair of nodes. The assertion expresses the relation between the variable when the program counter is located between these nodes. start halt (y1,y2)=(0,x1) y2>=x2 (y1,y2)=(y1+1,y2-x2) (z1,z2)=(y1,y2) A B CD E falsetrue

23 Annotating a scheme with invariants A): x1>=0 /\ x2>=0 B): x1=y1*x2+y2 /\ y2>=0 C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2 D):x1=y1*x2+y2 /\ y2>=0 /\ y2=x2 (y1,y2)=(y1+1,y2-x2)(z1,z2)=(y1,y2) A B CD E false true

24 Verification conditions: assignment A) B) [Y\g(X,Y)] A): x1>=0 /\ x2>=0 B): x1=y1*x2+y2 /\ y2>=0 B) [Y\g(X,Y)] = x1=0*x2+x1 /\ x1>=0 A B (y1,y2)=(0,x1) A B Y=g(X,Y)

25 Assignment condition (y1,y2)=(0,x1) A B y1=2 y1=x1 2=x1

26 Another way to understand condition (y1,y2)=(0,x1) A B y1=2 y1=x1 Use two versions of variables: before assignment and after. E.g., y1 and y1, respectively. postcondition: y1=x1 assignment: y1=2 precondition: 2=x1 2=x1

27 Assignment condition (y1,y2)=(0,x1) A B y1=y1+5 y1=10 y1=5

28 Assignment condition (y1,y2)=(0,x1) A B y1=y1+5 y1=10 y1=5 Postcondition: y1=10 Assignment: y1=y1+5 Precondition: y1+5=10, I.e., y1=5

29 Verification conditions: assignment B): x1=y1*x2+y2 /\ y2 >=0 Assignment: y1=0 /\ y2=x1 B) [Y\g(X,Y)] = x1=0*x2+x1 /\ x1>=0 (or simply x1>=0) A B (y1,y2)=(0,x1) A): x1>=0 /\ x2>=0

30 Second assignment Precondition: B): x1=y1*x2+y2 /\ y2>=0 Assignment: y1=y1+1/\y2=y2-x2 Postcondition: B)[Y\g(X,Y)]: x1=(y1+1)*x2+y2-x2 /\ y2-x2>=0 (y1,y2)=(y1+1,y2-x2) C B

31 Second assignment C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2 B): x1=y1*x2+y2 /\ y2>=0 B)[Y\g(X,Y)]: x1=(y1+1)*x2+y2-x2 /\ y2-x2>=0 C B

32 (z1,z2)=(y1,y2) Third assignment D):x1=y1*x2+y2 /\ y2>=0 /\ y2 { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/3/799438/slides/slide_32.jpg", "name": "(z1,z2)=(y1,y2) Third assignment D):x1=y1*x2+y2 /\ y2>=0 /\ y2=0 /\ y2

33 Verification conditions: tests B) /\ t(X,Y)) C) ( B) /\ ¬t(X,Y)) D) B): x1=y1*x2+y2 /\ y2>=0 C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2 D):x1=y1*x2+y2 /\ y2>=0 /\ y2=x2 B C D B C D t(X,Y) false true falsetrue

34 Exercize: prove partial correctness Initial condition: x>=0 Input-output claim: z=x! start halt (y1,y2)=(0,1) y1=x (y1,y2)=(y1+1,(y2+1)y2)z=y2 truefalse

35 What have we achieved? For each statement S that appears between points X and Y we showed that if the control is in X when (X) holds and S is executed, then (Y) holds. Initially, we know that (A) holds. The above two conditions can be combined into an induction on the number of statements that were executed: If after n steps we are at point X, then (X) holds.

36 Another example (A) : x>=0 (F) : z^2<=x<(z+1)^2 z is the biggest number that is not greater than sqrt x. start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2)z=y1 B C D F truefalse E y2=y2+y3

37 Some insight 1+3+5+…+(2n+1)=(n+1)^2 y2 accumulates the above sum, until it is bigger than x. y3 ranges over odd numbers 1,3,5,… y1 is n-1. start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2)z=y1 B C D F truefalse E y2=y2+y3

38 Invariants It is sufficient to have one invariant for every loop (cycle in the programs graph). We will have (C)=y1^2<=x /\ y2=(y1+1)^2 /\ y3=2*y1+1 start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2)z=y1 B C D F truefalse E y2=y2+y3

39 Obtaining (B) By backwards substitution in (C). (C)=y1^2<=x /\ y2=(y1+1)^2 /\ y3=2*y1+1 (B)=y1^2<=x /\ y2+y3=(y1+1)^2 /\ y3=2*y1+1 start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2)z=y1 B C D F truefalse E y2=y2+y3

40 Check assignment condition (A)=x>=0 (B)=y1^2<=x /\ y2+y3=(y1+1)^2 /\ y3=2*y1+1 (B) relativized is 0^2<=x /\ 0+1=(0+1)^2 /\ 1=2*0+1 Simplified: x>=0 start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2)z=y1 B C D F truefalse E y2=y2+y3

41 Obtaining (D) By backwards substitution in (B). (B)=y1^2<=x /\ y2+y3=(y1+1)^2 /\ y3=2*y1+1 (D)=(y1+1)^2<=x /\ y2+y3+2=(y1+2)^2 /\ y3+2=2*(y1+1)+1 start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2)z=y1 B C D F truefalse E y2=y2+y3

42 Checking (C)=y1^2<=x /\ y2=(y1+1)^2 /\ y3=2*y1+1 (C)/\y2<=x) (D) (D)=(y1+1)^2<=x /\ y2+y3+2=(y1+2)^2 /\ y3+2=2*(y1+1)+1 start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2)z=y1 B C D F truefalse E y2=y2+y3

43 y1^2<=x /\ y2=(y1+1)^2 /\ y3=2*y1+1 /\y2<=x (y1+1)^2<=x /\ y2+y3+2=(y1+2)^2 /\ y3+2=2*(y1+1)+1 y1^2<=x /\ y2=(y1+1)^2 /\ y3=2*y1+1 /\y2<=x (y1+1)^2<=x /\ y2+y3+2=(y1+2)^2 /\ y3+2=2*(y1+1)+1 y1^2<=x /\ y2=(y1+1)^2 /\ y3=2*y1+1 /\y2<=x (y1+1)^2<=x /\ y2+y3+2=(y1+2)^2 /\ y3+2=2*(y1+1)+1

44 Not finished! Still needs to: Calculate (E) by substituting backwards from (F). Check that (C)/\y2>x (E) start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2)z=y1 B C D F truefalse E y2=y2+y3

45 Proving termination

46 Well-founded sets Partially ordered set (W,<): If aa2>a3>…

47 Examples for well founded sets Natural numbers with the bigger than relation. Finite sets with the set inclusion relation. Strings with the substring relation. Tuples with alphabetic order: (a1,b1)>(a2,b2) iff a1>a2 or [a1=a2 and b1>b2]. (a1,b1,c1)>(a2,b2,c2) iff a1>a2 or [a1=a2 and b1>b2] or [a1=a2 and b1=b2 and c1>c2].

48 Why does the program terminate y2 starts as x1. Each time the loop is executed, y2 is decremented. y2 is natural number The loop cannot be entered again when y2=x2 C true

49 Proving termination Choose a well-founded set (W,<). Attach a function u(N) to each point N. Annotate the flowchart with invariants, and prove their consistency conditions. Prove that (N) (u(N) in W).

50 How not to stay in a loop? Show that u(M)>=u(N). At least once in each loop, show that u(M)>u(N). S M N T N M

51 How not to stay in a loop? For stmt: (M) (u(M)>=u(N)rel) For test (true side): ( (M)/\test) (u(M)>=u(N)) For test (false side): ( (M)/\¬test) (u(M)>=u(L)) stmt M N test N M true L false

52 What did we achieve? There are finitely many control points. The value of the function u cannot increase. If we return to the same control point, the value of u must decrease (its a loop!). The value of u can decrease only a finite number of times.

53 Why does the program terminate u(A)=x1 u(B)=y2 u(C)=y2 u(D)=y2 u(E)=z2 W: naturals > : greater than start halt (y1,y2)=(y1+1,y2-x2)(z1,z2)=(y1,y2) (y1,y2)=(0,x1) A B D E false y2>=x2 C true

54 Recall partial correctness annotation A): x1>=0 /\ x2>=0 B): x1=y1*x2+y2 /\ y2>=0 C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2 D):x1=y1*x2+y2 /\ y2>=0 /\ y2=x2 (y1,y2)=(y1+1,y2-x2)(z1,z2)=(y1,y2) A B CD E false true

55 Strengthen for termination A): x1>=0 /\ x2>0 B): x1=y1*x2+y2 /\ y2>=0/\x2>0 C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2/\x2>0 D):x1=y1*x2+y2 /\ y2>=0 /\ y2 0 E):x1=z1*x2+z2 /\ 0<=z2=x2 (y1,y2)=(y1+1,y2-x2)(z1,z2)=(y1,y2) A B CD E falsetrue

56 We shall show: u(A)=x1 u(B)=y2 u(C)=y2 u(D)=y2 u(E)=z2 u(A)>=u(B) u(B)>=u(C) u(C)>u(B) u(B)>=u(D) u(D)>=u(E) start halt (y1,y2)=(y1+1,y2-x2)(z1,z2)=(y1,y2) (y1,y2)=(0,x1) A B D E false y2>=x2 C true

57 Proving decrement C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2/\x2>0 u(C)=y2 u(B)=y2 u(B)rel=y2-x2 C) y2>y2-x2 (notice that C) x2>0) start halt (y1,y2)=(0,x1) y2>=x2 (y1,y2)=(y1+1,y2-x2)(z1,z2)=(y1,y2) A B CD E falsetrue

58 Integer square prog. (C)=y1^2<=x /\ y2=(y1+1)^2 /\ y3=2*y1+1 (B)=y1^2<=x /\ y2+y3=(y1+1)^2 /\y3=2*y1+1 start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2)z=y1 B C D F truefalse E y2=y2+y3

59 u(A)=x+1 u(B)=x-y2+1 u(C)=max(0,x-y2) u(D)=x-y2+1 u(E)=u(F)=0 u(A)>=u(B) u(B)>u(C) u(C)>=u(D) u(D)>=u(B) Need some invariants, i.e., y2 0 at points B and D, and y3>0 at point C. start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2)z=y1 B C D F truefalse E y2=y2+y3


Download ppt "Program verification: flowchart programs Book: chapter 7."

Similar presentations


Ads by Google