Presentation is loading. Please wait.

Presentation is loading. Please wait.

Formal Methods in software development

Similar presentations


Presentation on theme: "Formal Methods in software development"— Presentation transcript:

1 Formal Methods in software development
a.a.2016/2017 Prof. Anna Labella 2/28/2019

2 concurrent and sequential systems
Hoare Logic Dealing with critical situations Software aging See Ben Ari, Huth Ryan chap.4 2/28/2019

3 Verifying satisfiability of properties A posteriori
Model Checking Automatic Model-based Verifying satisfiability of properties A posteriori Application: concurrent and reactive systems Hoare Logic Semiautomatic Proof-based Verifying satisfiability of properties A priori Application: sequential and transformational programs 2/28/2019

4 Our language Our core language has three syntactic domains: integer expressions, boolean expressions and commands Arithmetical expressions E ::= n | x | (−E) | (E + E) | (E − E) | (E ∗ E) Propositions B ::= true | false | (!B) | (B &B) | (B ||B) | (E < E) Commands C ::= x = E | C;C | if B {C} else {C} | while B {C} 2/28/2019

5 Hoare triples Let us define |=part (|φ|) S (|ψ|)
If s is a state verifying φ, then, by applying the instruction S, we obtain a state where ψ holds. φ is called “precondition” ψ “postcondition” 2/28/2019

6 Hoare triples: examples
(|x> 0|) S (| y.y < x |) Many possible solutions: 2/28/2019

7 Partial and total correctness
If preconditions are verified: A then, after the execution of the program B1 postconditions are verified: B2 A  (B1  B2) 2/28/2019

8 Partial correctness If preconditions are verified: A Then,
if the program teminates B1 postconditions are verified: B2 A  (B1  B2) 2/28/2019

9 Total correctness If preconditions are verified: A then,
the program terminates B1 and postconditions are verified: B2 A  (B1  B2) !?!?! 2/28/2019

10 Total correctness The only command that can be non terminating is the while command 2/28/2019

11 A deductive system tree-like proofs 2/28/2019

12 Hoare logic (proof rules for partial correctness)
(|φ1|) C1 (|φ2|) (|φ2|) C2(|φ3|) composition (|φ1|) C1 ; C2 (|φ3|) ________________________ assignment (|ψ [E/x]|) x = E (|ψ|) (|φB|) C1 (|ψ|) (|φ¬ B|) C2 (|ψ|) if-statement (|φ|) if B then C1 else C2 (|ψ|) (|ψB|) C (|ψ|) partial while (|ψ|) while B do C (|ψ¬B|) (|φ’ φ|) (|φ|) C (|ψ|) (|ψ  ψ’|) implied (|φ’|) C (|ψ’|) 2/28/2019

13 Proofs as trees They are difficult to deal with 2/28/2019

14 Proof tableaux (|φ0|) C1 (|φ1|) C2 ……(|φn-1|) Cn (|φn|) How?
Reduce a program to a concatenation of steps, inserting justification between any two of them (|φ0|) C1 (|φ1|) C2 ……(|φn-1|) Cn (|φn|) Going backword from the postcondition to the precondition How? 2/28/2019

15 Weaker condition φ  ψ means that φ is stronger than ψ
(because “not as true as” ψ) We proceed backwards: Given (|φ|) C (|ψ|), we can compute the weakest precondition wp (C, ψ) (predicate trasformer) s.t. wp (C, ψ) C (|ψ|) Hence to prove a triple, we have to show: (|φ|) C (|ψ|)  φwp (C, ψ) 2/28/2019

16 Semantically We usually identify the set of states verifying a property with the property itself and work bottom up in the verification looking for the maximal set of states verifying the precondition in order to get the postcodition φ  ψ means that the set of states verifying |φ| is contained in the set of states verifying |ψ| |φ|  |ψ| 2/28/2019

17 (inductive definition)
Weakest precondition (inductive definition) Hence we look for the maximal set of states s.t., starting from one of them, after doing C, we reach a state Satisfying the postcondition wp (x = E, ψ) = [E/x] ψ wp (C;C‘, ψ) = wp (C, wp (C‘, ψ )) wp (if B then C1 else C2, ψ ) = (B wp (C1, ψ ) (B  wp (C2, ψ)) wp (while B do C, ψ) = ( B  ψ )(B wp (C; while B do C, ψ)) 2/28/2019

18 Exercises 2/28/2019

19 Exercises (| u = x + y |) z = x; assignment z = z + y; assignment
u=z; assignment (| u = x + y |) 2/28/2019

20 Exercises (| z = x + y |) (| u = x + y |) z = x; assignment
z = z + y; assignment (| z = x + y |) u=z; assignment (| u = x + y |) 2/28/2019

21 Exercises (assignment)
z = x; assignment (| z + y = x + y |) z = z + y; assignment (| z = x + y |) u=z; assignment (| u = x + y |) 2/28/2019

22 Exercises (assignment)
(| x + y = x + y |) z = x; assignment (| z + y = x + y |) z = z + y; assignment (| z = x + y |) u=z; assignment (| u = x + y |) 2/28/2019

23 Exercises (assignment)
(| x + y = x + y |) z = x; assignment (| z + y = x + y |) z = z + y; assignment (| z = x + y |) u=z; assignment (| u = x + y |) 2/28/2019

24 Exercises (assignment)
2/28/2019

25 Exercises (assignment)
The first one is immediate (| x = x |) (| y = x |) (| x = x  x>1|) (| x = x  x>a|) (| y = x  y>a|) (|y > 0  x>y|) 2/28/2019

26 Exercises (assignment)
2/28/2019

27 Exercises (assignment)
x := x+1 ; y := x+1 u := x+2 ; v := y+3 ; z := u+v 2/28/2019

28 Exercises (assignment)
(| x = x + 2 |) t = x + 1; (| t + 1 = x + 2 |) z = t + 1; (| z = x + 2 |) y = z; (| y = x + 2 |) 2/28/2019

29 Exercises (if then else)
2/28/2019

30 Exercises (if then else)
(| x>y|) (|  x>y|) (| y = min (x, y) |) (| x = min (x, y) |) z = y; z = x; (| z = min (x, y) |) 2/28/2019

31 Exercises (if then else)
2/28/2019

32 Invariants (while do) 2/28/2019

33 Example (while do) 2/28/2019

34 Example cont’d 2/28/2019

35 Example cont’d 2/28/2019

36 Exercise (while do) Invariant? Total correctness? 2/28/2019

37 Hoare triples: total correctness
Let us define |= tot(|φ|) S (|ψ|) If s is a state verifying φ, then, by applying the instruction S, then S terminates and we obtain a state where ψ holds. φ is called “precondition” ψ “postcondition” 2/28/2019

38 Hoare logic: total correctness
If we want to prove total correctness, we need (|ψB  0≤E=E0|) C (|ψ0≤E<E0|) total while (|ψ0≤E|) while B do C (|ψ¬B|) Variants 2/28/2019

39 Hoare triples: total correctness
Fac1 2/28/2019

40 Hoare logic: total correctness
2/28/2019


Download ppt "Formal Methods in software development"

Similar presentations


Ads by Google