Software Verification Bertrand Meyer Chair of Software Engineering Lecture 2: Axiomatic semantics.
Axiomatic Semantics
description
Transcript of Axiomatic Semantics
CSE 755, part3
Axiomatic Semantics
Will consider axiomatic semantics (A.S.) of IMP:
<stmt> ::= skip | <assign> | <if> | <while> | <stmt>; <stmt>
| <input> | <output>
Only integer vars; no procedures/fns; vars declared implicitly
References:Kurtz (ch. 11); Pagan (ch. 4.3)
Summary:For each type of <stmt>, will define its a.s. via an axiomor rule of inference (or just rule). Using these, will be able to show (i.e., derive) that a given program behaves according to its specification.
1
CSE 755, part3
Preliminaries
State: State of a program P is a function that maps the program variables of P to their values in that state.Example: <x = 1, y = 2, z = 3>;
or: (x) = 1; (y) = 2; (z) = 3 (assuming P has 3 prog. var., x, y, z)
Usually have to deal with set of states:{ <x = 1, y = 2, z = 1>, <x = 1, y = 2, z = 2>,
<x = 1, y = 2, z = 3> } Better: Specify an assertion (or predicate, or condition)
satisfied by all the states in that set and no others:[ (x = 1) (y = 2) (1 z 3) ]
Important: Assertion Set of states that satisfy assertion
2
CSE 755, part3
Assertions/sets of states
[ (x = 1) (1 y 5) (1 z 10) ] : set with 50 states
[ (x = 1) (y = 2) ] : an infinite set
[ (x = 1) (1 y 5) ] : an 'even bigger' set
[ x = y + z ] : ...
[ x = x ]: the set of all states
true
[ x x ]: the empty set
false
3
CSE 755, part3
Assertions/sets of states
Convention:
p P (p is an assertion; P the corresponding set of states
[p q] P Q
[p q] P Q
[ p ] −P (or, rather "P bar"; i.e., U − P; U: universal set)
4
CSE 755, part3
Assertions/sets of states (contd)
"" (implication) can be thought of as a relation between two assertions:
[p q] : [P Q]
[p true] : [P U]
[false p] : [ P]
Can also think of "" as a single assertion:
[p q] :(p q )
Thus:
[p true] :true
[false p] :true
[p p ] :true (??)
[p p ] :false (??)
[(x 1) ( x = 2 )] : ?? 5
The context will tell us whether to think of implication as a relation between assertions or a single assertion
CSE 755, part3
Assertions (contd.)
"x < y" is a syntactic entity when it appears in a program
Elsewhere it is an assertion (satisfied by some states and not others).
A state satisfies the assertion x < y if (and only if) (x) is less than (y)
Notation: |= (x < y) : " satisfies (x < y)"
6
CSE 755, part3
Key NotationThe result
{p} S {q} (where p, q are assertions and S is a statement)
is operationally valid if:
If we start execution of S in any state P, the final state ' when S finishes execution will belong to Q
Examples:
{x = 1} skip {x = 1} : (Operationally) valid
{(x=1) (y=2) } skip {x = 1} : Valid
{x = 1} skip {(x=1) (y=2) } : Invalid (op. invalid)
{x = 1} skip {(x=1) (y=2) } : Valid
{(x=1) (y=2) } skip {x = 1} : ??
{(x=1) (y=2) } skip { true } : ??
{(x=1) (y=2) } skip { false } : ??
7
CSE 755, part3
"Results" (contd.)
{(x=1) (y=2) } x := x+1 {(x=2) (y=2)} : Valid
{(x=1) (y=2) } x := x+1 { (x = y) } : Valid
{(u=1) (v=2) } x := x+1 { (v = u+1) } : ??
{x=0} while (x < 10) do x := x+1 end {x=10} : Valid
What if the loop doesn't terminate?
{x 0} while (x < 10) do x := x+1 end {x=10}: ??
{x 0} while (x < 10) do x := x+1 end {x 10} : ??
8
CSE 755, part3
"Results" (contd.)
{ p } S { q } is a partial correctness result
It is valid if it is the case that:
if we start execution of S in any state P, and if the execution terminates, then the final state ' satisfies q
{x = 0} while (x 10) do x := x+1 end {x = 10} : Valid
{ true } while (x 10) do x := x+1 end {x = 10} : Also valid
Axiomatic semantics: provides a non-operational approach --in the form of a set of axioms and rules of inference-- using which we can 'axiomatically derive' our results
9
CSE 755, part3
Terminology (*important*!)
Assertion: may be Satisfied or Not Satisfied by a particular state
Result: may be Valid or Invalid in a given (operational) model
Result: may be Derivable or Not Derivable in a given axiom system
Some meaningless statements:
"{p} S {q} is true" (note: true is a particular assertion)
"{p} S {q} is valid for some states"
"(The assertion) p is not valid"
10
CSE 755, part3
Relation Between A.S. & Model
If a given result is derivable in a given axiom system A, will it be valid in an operational model M? Not necessarily.
Soundness (also "consistency"): An axiom system A is sound/consistent with model M if every result derivable using the axioms/rules of A is valid in M; i.e.:
|-A {p} S {q} |=M {p} S {q}
Completeness: An axiom system A is complete with respect to model M if every result that is valid in M is derivable using the axioms/rules of A:
|=M {p} S {q} |-A {p} S {q}
11
CSE 755, part3
Axiomatic Semantics of IMPA.S.: A collection of "axioms" and "rules of inference" ("rules")
specified using the same {p} S {q} notation
A0: skip axiom{ p } skip { p } where p is any assertion
Using this, can derive:
{ (x = 1) (y = 2) } skip { (x = 1) (y = 2) }
by taking p to be the assertion (x = 1) (y = 2) & using A0
Cannot derive:
{ (x = 1) } skip { (x = 1) (y = 2) }
which is good (why?)
Cannot derive:
{ (x = 1) (y = 2) } skip { (x = 1) }
which is bad (why?) 12
CSE 755, part3
Axiomatic Semantics of IMP
R0: Rule of Consequence:
{ p } S { q' }, q' q-------------------------------
{ p } S { q }(p, q, q': any assertions: S: any stmt)
Using R0 (and A0) we can derive:
{ (x = 1) (y = 2) } skip { (x = 1) }
Another form of rule of consequence:
p p', { p' } S { q }, -------------------------------
{ p } S { q }(p, q, p': any assertions: S: any stmt)Consider other forms of consequence (including inconsis. ones?
13
CSE 755, part3
Axiomatic Semantics of IMP (contd)
A1. Assignment axiom:
{ pxe } x := e { p } where p is any assertion;
pxe is obtained from p by (simultaneously) replacing
all occurrences of x in p by e. (Note: pxe p[x/e] )
We can derive:
14
{ x+1 = y+z } x := x+1 { x = y+z }(take p to be x = y+z )
{ y+z 0 } x := y+z { x 0 } (take p to be x 0 )
{ y+z = y+z } x := y+z { x = y+z } (take p to be x = y+z )
Operational Justification:If we want the state following the asgnmnt to satisfy p, the state before it should satisfy the same assertion - except with the value of e satisfying the conditions expected of the value of x
CSE 755, part3
Axiomatic Semantics of IMP (contd.)
Caution: In axiomatic derivations, you are only allowed to use the axioms and rules of the system; no appeals to operational intuitions. If you make such appeals, you have an operational argument, not an axiomatic derivation
Summary: The axiomatic semantics of a language consists of:
An axiom for each atomic statement
A rule (of inference) for each compound stmt
+ Logical rules
15
CSE 755, part3
Axiomatic Semantics of IMP (contd)
R1: Sequential Composition:
{ p } S1 { q' }, { q' } S2 { q }----------------------------------------
{ p } S1; S2 { q } (p, q', q: any assertions; S1, S2: any stmts.)
Using this, skip axiom, & assignment axiom, we can derive:
{x+1 = y+z} skip; x := x+1 {x = y+z}
Operational Justification: If state before S1 starts execution satisfies p, then, { p } S1 { q' } guarantees that the state when S1 finishes will satisfy q';
hence { q' } S2 { q } guarantees the state when S2 finishes will satisfy q;
hence conclusion of rule follows given these two results.
Caution: In (axiomatic) derivations, no appeals to operational intuitions!16
CSE 755, part3
Axiomatic Semantics of IMP (contd)write e out := out ^ e
A2. write axiom:{ p[out / out^e] } write e { p } (where p is any assertion)
read x ( x := head(in); in := tail(in) )
{ (p[in/tail(in)])[x/head(in)] }
x := head(in);
{ p[in/tail(in)] }
in := tail(in)
{ p }
A3. read axiom:
{ (p[in/tail(in)])[x/head(in)] } read x { p } (p: any assertion)
17
CSE 755, part3
Axiomatic Semantics of IMP (contd)Problem: Derive the following result (axiomatically):
{ (in = <3, 4>) (out = <>) }
read x; read y; write (x+y);
{ out = <7> }
Derivation (or "proof") outline:
{ (in = <3, 4>) (out = <>) } (rule of cons.)
{ out^(head(in) + head(tail(in)) = <7> } (read axiom)
read x;
{ out^(x + head(in)) = <7> } (read axiom)
read y;
{ out^(x + y) = <7> } (write axiom)
write (x+y);
{ out = <7> }
18
CSE 755, part3
Axiomatic Semantics of IMP (contd)
R2: If-then-else:
{ p b} S1 { q }, { p b} S2 { q }--------------------------------------------------
{ p } if b then S1 else S2 { q }
Operational Justification: Suppose we start in a state P. There are two ways to proceed: if b, execute S1; if not, execute S2. In either case, the hypothesis (assuming they are valid) guarantee that the final state will satisfy q. Hence conclusion follows.
Caution: In (axiomatic) derivations, no appeals to operational intuitions!
19
Axiomatic Semantics of IMP (contd)Problem: Derive the following result (axiomatically):
{ y = 1}
if (y = 1) then x := 1 else x := 2
{ x = 1 }
1. { (y = 1) (y = 1)} x := 1 { x = 1} (by Ass. ax, rule of conseq.)
2. { 2 = 1 } x := 2 { x = 1} (by Ass. ax, rule of conseq.)
3. { (y = 1) (y 1) } x := 2 { x = 1} (by (2), rule of conseq.)
4. { y = 1}
if (y = 1) then x := 1 else x := 2
{ x = 1 } (by (1), (3), and if-then-else rule)
Derive:
{ true} if (y = 1) then x := 1 else x := 2 { (x = 1) (x = 2) }
{ true} if (y = 1) then ... { [(y=1)(x = 1)] [(y1) (x = 2) }
20
CSE 755, part3
Axiomatic Semantics of IMP (contd)
R3: while rule:
p q, { q b } S { q }, (q b) r-------------------------------------------------------
{ p } while b do S { r }
The following rule, given rule of conseq., is equivalent: { q b } S { q },
-------------------------------------------------------{ q } while b do S { q b }
I.e.: Any result derivable using R3 is derivable using above
Operational justification: ...
R3 is complete ... somewhat surprising: we can always find an appropriate loop invariant
21
Problem: Derive the following result (axiomatically):{(x 0) (y 0)}
q := 0; r := x;
while ((r-y) 0) do q := q+ 1; r := r - x; end
{ (x = q*y + r) (0 r y)}
Take loop invariant p to be: p [(x = q*y + r) (0 r) (y 0)]
Derivation outline:
{(x 0) (y 0)}
q := 0; r := x;
{(x 0) (y 0) (q=0) (r=x)}
{ p }
while ...
{p ((r-y) 0)}
{ (x = q*y + r) (0 r y)}22
Key step 1:{ p (r-y) 0} q:=q+1;r:=r-y {p}(by ass. ax, seq. comp, conseq.)
Key step 2:[p ((r-y) 0)} [(x = q*y + r) (0 r y)(by math logic/oracle)
Derive:{in = <1,2,3, ..., 100> out = <> }
read x;
while (x 100) do write x; read x; end
{ out = <1, 2, ..., 99>}
Take loop invariant p to be: p [out^x^in = <1,2, ..., 100>]
Derivation outline:
{in = <1,2,3, ..., 100> out = <> }
read x;
{(x=1) (in = <2,3, ..., 100>) (out = <>) }
{out^x^in = <1,2, ..., 100>}
while (x 100) do write x; read x; end
{(out^x^in = <1,2, ..., 100>) (x = 100)}
{ out = <1, 2, ..., 99>}23
Derive:{in = <1,2,3, ..., 100> out = <> }
s := 0; read x;
while (x 100) do write s := s+x; read x; end
{ s = k=0,..99 k}
Take loop invariant p to be: [(#in=100-x) k.[(0 k #in) (in[k]=x+k)] (1 x 100) (s = k=0,..(x-1) k)]
A more intuitive loop invariant:
[(in = <x+1, ..., 100> (1 x 100) (s = k=0,..(x-1) k)]
Key step:
{p (x 100)}
s := s+x; read x;
{p}
Note: (head(in)=x+1) [implied by p] is important in showing that (p (x 100)) implies p' [obtained by taking p back]
24
CSE 755, part3
(In)Completeness
R3: while rule:
p q, { q b } S { q }, (q b) r-------------------------------------------------------
{ p } while b do S { r }
A simpler rule:p q, { q } S { q }, (q b) r
-------------------------------------------------------{ p } while b do S { r }
Using this rule, we can derive:{ x=0 } while (x10) do x := x+1 { x = 10}
Take p to be (x=0) and q to be true 25
CSE 755, part3
(In)Completeness (contd.)
The rule is incomplete:p q, { q } S { q }, (q b) r
-------------------------------------------------------{ p } while b do S { r }
Cannot derive:{ x=0 y=0 } while (x0) do y := y+1 { x=0 y=0 }
Proof: Suppose we could. Then there must exist q such that:a. (x=0 y=0) qb. {q} y := y+1 {q}c. (q x=0) (x=0 y=0)
Then <x=0, y=0, z=0> Q [by (a)]Hence <x=0, y=1, z=0> Q [by (b)]Hence <x=0, y=1, z=0> Q (x=0) [why?]But <x=0, y=1, z=0> is not in (x=0 y=0)Hence such a q cannot exist!
26
CSE 755, part3
Consistency/CompletenessHow do you show a system A is consistent and/or complete
(with respect to a model M)?
Generally tedious task.
Special case: If we are told that A' is consistent/complete and A is obtained from A' by making some changes to some rules of A', we may be able to use the following approach:
Completeness: Show that all results derivable in A' are also derivable in A. Then completeness of A' implies completeness of A (with respect to same model).
Consistency: Show that all results derivable in A are also derivable in A'. Then consistency of A' implies consistency of A (with respect to same model).
27
CSE 755, part3
Axiomatic Semantics of IMP (contd)
Suppose we change the if-then-else rule:
{ p b} S1 { q }, { p b} S2 { q }--------------------------------------------------
{ p } if b then S1 else S2 { q }
To:
{ p b} S1 { q b}, { p b} S2 { q b }------------------------------------------------------------
{ p } if b then S1 else S2 { q }
The resulting system will be consistent: show that every result derivable in the new system is derivable in the original system
Completeness?
28
CSE 755, part3
Total Correctness
How do we derive:{ in = <> } read x {false} ? (1)
We can't!
A better axiom for read:
(p in <>) (q[in/tail(in)])[x/head(in)] --------------------------------------------------
{ p } read x { q }With this axiom, we can derive (1).
Also suggests total correctness axiom for read :p [ in <> (q[in/tail(in)])[x/head(in)] ]
-----------------------------------------------------<p | read x | q>
29
CSE 755, part3
Total Correctness (contd.)
Similar considerations for assignment:{ (x=0) (y=3) } z := y/x {false} ? (1)
We can't!
A better axiom:(p D(e)) (q[x/e]
--------------------------------------------------{ p } x := e { q }
With this axiom, we can derive (1).
Also suggests total correctness axiom:
p [D(e) q[x/e] ] -----------------------------------------------------
<p | x := e | q>
30
CSE 755, part3
Total Correctness (contd.)
Total correctness rule for while:(p b) (f > 0)<p b f=k | S | p (f k) >
--------------------------------------------------< p | while b do S | p b >
a. Why does f have to be an integer function of the state?b. What if b is not well defined?c. What would happen if we change "<...|..|..>" in the second
line to "{...}..{..}"?
The other rules are essentially the same as the corresponding partial correctness rules:
<p | S1 | q1>, <q1 | S2 | q>--------------------------------------
<p | S1; S2| q>
31
CSE 755, part3
Total Correctness (contd.)
Derive:
< s=0 x=0 |
while x 10 do x:=x+1; s:=s+x; end
| s = 0 + 1 + 2 + 3 + ... + 10 >
Loop invariant:p (0 x 10 s = n=0..x n )
Progress function (also called: "progress metric", "convergence function" etc.):f(x,s) (10 x)
Check: (p (x 10)) (f 0) : easy
Derive:<p (x 10) (f=k) | x:=x+1; s:=s+x | p (f k) > : exercise
Hence original result follows from rule for loops
32
CSE 755, part3
Non-determinism
Guarded commands: Selection: [b1 S1 | b2 S2 | ... | bn Sn ]
To execute: choose any bi that evaluates to true and execute corresponding Si; if all bi are false, errore.g.: [ x y z := x | y x z := y ] : sets z to larger of x,y
Repetition: *[b1 S1 | b2 S2 | ... | bn Sn ]To execute: choose any bi that evaluates to true and
execute corresponding Si. Repeat until, after some no. of iterations all bi evaluate to false; at that point, stop.
Loop may not terminate, or may terminate in 0 iterationse.g.:
*[ x1 x2 exch(x1, x2) | x2 x3 exch(x2, x3) |x3 x4 exch(x3, x4) ] : sorts [x1, x2, x3, x4]
33
CSE 755, part3
Axiomatics of non-determinism
Selection:{ p b1 } S1 { q }, { p b2 } S2 { q },..., { p bn } Sn { q }---------------------------------------------------------------------------
{ p } [b1 S1 | b2 S2 | ... | bn Sn ] { q }
Repetition:{ p b1 } S1 { p }, { p b2 } S2 { p },..., { p bn } Sn { p }---------------------------------------------------------------------------
{ p } [b1 S1 | ... | bn Sn ] { p b1 b2 ... bn}
In selection rule, what if none of the bi's evaluates to true?
Total correctness rules?
34