Automated Theorem Proving

Lecture 1

Program verification is undecidable!

Given program P and specification S, does P satisfy S?

The model checking approach

• Create a model of the program in a decidable formalism

• Verify the model algorithmically• Difficulties

– Model creation is burden on programmer– The model might be incorrect.

• If verification fails, is the problem in the model or the program?

The axiomatic approach

• Add auxiliary specifications to the program to decompose the verification task into a set of local verification tasks

• Verify each local verification problem• Difficulties

– Auxiliary spec is burden on programmer– Auxiliary spec might be incorrect.

• If verification fails, is the problem with the auxiliary specification or the program?

Theorem Proving and Software

Meets spec/Found Bug

Theorem in a logic

Program

Specification

Semantics

VCgeneration

Validity

Provability(theorem proving)

• Soundness:– If the theorem is valid then the program meets specification– If the theorem is provable then it is valid

Overview of the Next Few Lectures

• From programs to theorems– Verification condition generation

• From theorems to proofs– Theorem provers– Decision procedures

Programs ! Theorems = Axiomatic Semantics

• Consists of:– A language for making assertions about programs– Rules for establishing when assertions hold

• Typical assertions:– During the execution, only non-null pointers are

dereferenced – This program terminates with x = 0

• Partial vs. total correctness assertions– Safety vs. liveness properties– Usually focus on safety (partial correctness)

Hoare Triples

• Partial correctness: { A } s { B}– When you start s in any state that satisfies A – If the execution of s terminates– It does so in a state that satisfies B

• Total correctness: [ A ] s [ B ]– When you start s in any state that satisfies A– The execution of s terminates and– It does so in a state that satisfies B

• Defined inductively on the structure of statements

Hoare Rules

{A} s1 {C} {C} s2 {B}

{ A } s1; s2 {B}

{A Æ E} s1 {B} {A Æ :E} s2 {B}

{A} if E then s1 else s2 {B}

{I Æ E} s {I} I Æ : E ) B

{ I} while E do s {B}

Hoare Rules: Assignment

• Example: { A } x := x + 2 {x >= 5 }. What is A?• General rule:

• Surprising how simple the rule is !• The key is to compute “backwards” the

precondition from the postcondition• Forward rule is more complicated:

{ B[E/x] } x := E {B}

{ A } x := E {9 x’. A[x’/x] Æ x = E[x’/x] }

Weakest preconditions

Dijkstra’s idea: To verify that { A } s { B}

a) Let Pre(s, B) = {A’ | { A’} s { B} }

b) (Pre(s,B), )) is a lattice - false Pre(s,B) - if Pre(s,B) and Pre(s,B), then Pre(s,B) - if Pre(s,B) and Pre(s,B), then Pre(s,B)

c) WP(s, B) = lub(Pre(s, B))

d) Compute WP(s, B) and prove A WP(s, B)

Predicate lattice

false true)

strong weak Pre(s, B)

weakestprecondition: WP(s, B)A

Weakest preconditions

• WP(x := E, B) = B[E/x]

• WP(s1; s2, B) = WP(s1, WP(s2, B))

• WP(if E then s1 else s2, B) = E ) WP(s1, B) Æ : E ) WP(s2, B)

• WP(assert E, B) = E B

Example

returns crequires trueensures c = a bbool or(bool a, bool b) { if (a) c := true else c := b}

Conjecture to be proved:true (a true = a b) (a b = a b)

WP(S, c = a b) = (a true = a b) (a b = a b)

S

Weakest preconditions (Contd.)

• What about loops? • Define a family of weakest preconditions

– WPk(while E do S, B) = weakest precondition from which if the loop terminates in k or fewer iterations, then it terminates in B

WP0 = : E ) B

WPi+1 = WPi (E ) WP(s, WPi))

• WP(while E do S, B) = Æk ¸ 0 WPk = glb {WPk | k ¸ 0}– Hard to compute– Can we find something easier yet sufficient ?

Not quite weakest preconditions

• Recall what we are trying to do:false true)

strong weak Pre(s, B)

weakestprecondition: WP(s, B)A

verification condition: VC(s, B)

• We shall construct a verification condition: VC(s, B)– The loops are annotated with loop invariants !– VC is guaranteed stronger than WP– But hopefully still weaker than A: A ) VC(s, B) ) WP(s, B)

Verification condition generation

• Computed in a manner similar to WP• Except the rule for while: VC(whileI,T E do s, B) =

I Æ ( I ((E ) VC(s, I)) Æ (:E ) B)) )[T0/T]

• I is the loop invariant (provided by the programmer)

• T is the set of loop targets (can be approximated by scanning the loop body)

I holdson entry

I is preserved in an arbitrary iteration

B holds when the loop terminates

returns crequires b >= 0ensures c = a + bint add(int a, int b) { int t; t := b c := a invariant t 0 c = a + b - t while (t > 0) { c := c + 1 t := t - 1 }}

Example

Conjecture to be proved:b 0 VC(A, c = a + b)

VC(B, t 0 c = a + b - t) t - 1 0 c + 1 = a + b – (t – 1)

BL

A

VC(L, c = a + b) t 0 c = a + b – t (t 0 c = a + b – t t > 0 t - 1 0 c + 1 = a + b – (t - 1) t 0 c = a + b)[c0/c,t0/t]

VC(L, c = a + b) t 0 c = a + b – t (t0 0 c0 = a + b – t0 t0 > 0 t0 - 1 0 c0 + 1 = a + b – (t0 - 1) t0 0 c0 = a + b)

VC(A, c = a + b) b 0 a = a + b – b (t0 0 c0 = a + b – t0 t0 > 0 t0 - 1 0 c0 + 1 = a + b – (t0 - 1) t0 0 c0 = a + b)

Invariants Are Not Easy

• Consider the following code from QuickSortint partition(int *a, int L0, int H0, int pivot) {

int L = L0, H = H0;

while(L < H) { while(a[L] < pivot) L ++; while(a[H] > pivot) H --; if(L < H) { swap a[L] and a[H] }

L++; } return L}

• Consider verifying only memory safety• What is the loop invariant for the outer loop ?

Verification conditions (Contd.)

• What about procedure calls?– Annotate each procedure with a

precondition pre and a postcondition post

– VC(f(), B) = pre (post B)

Program verification

• Annotate each procedure with a precondition and a postcondition and each loop with an invariant

• Verify each procedure separately

requires preensures postf() { S;}

Verify that the formula VC(f) pre VC(S, post) is valid

Proving verification conditions

• What is the decision procedure for proving validity of VC(f)?

• Depends on the logic in which VC(f) is expressed

VC(f) pre VC(S, post)

VC(f) pre VC(S, post)

Verification condition logic

• Atoms connected by boolean operators , , ,

• Atoms depend on the program variables and operations on them

– boolean, integer, memory

• Atoms depend on the language of assertions, i.e., program assertions, loop invariants, preconditions and postconditions

– quantification, reachability predicate

Assume each assertion is a quantifier-free boolean combination of expressions over program variables.

• VC(f) is a boolean combination of atoms– Each atom is a relation over terms – Each term is built using functions and logical

constants

• Logical constants are different from program variables– program variables change over time– logical constants are fixed

• The logical constants in VC(f) refer to the values of program variables at the beginning of f.

Case I: Boolean programs

• Boolean-valued variables and boolean operations

Formula := A | | A Atom := bb SymBoolConst

Example

returns crequires trueensures c = a bbool or(bool a, bool b) { if (a) c := true else c := b}

Conjecture to be proved:true (a true = a b) (a b = a b)

VC(S, c = a b) = (a true = a b) (a b = a b)

S

Case II: Arithmetic programs

• In addition, integer-valued variables with affine operations

Formula := A | | A Atom := b | t = 0 | t < 0 | t 0 t Term := c | x | t + t | t – t | ctb SymBoolConst x SymIntConst c {…,-1,0,1,…}

returns crequires b >= 0ensures c = a + bint add(int a, int b) { int t; t := b c := a invariant t 0 c = a + b - t while (t > 0) { c := c + 1 t := t - 1 }}

Example

Conjecture to be proved:b 0 VC(A, c = a + b)

VC(B, t 0 c = a + b - t) t - 1 0 c + 1 = a + b – (t – 1)

BL

A

VC(L, c = a + b) t 0 c = a + b – t (t 0 c = a + b – t t > 0 t - 1 0 c + 1 = a + b – (t - 1) t 0 c = a + b)[c0/c,t0/t]

VC(L, c = a + b) t 0 c = a + b – t (t0 0 c0 = a + b – t0 t0 > 0 t0 - 1 0 c0 + 1 = a + b – (t0 - 1) t0 0 c0 = a + b)

VC(A, c = a + b) b 0 a = a + b – b (t0 0 c0 = a + b – t0 t0 > 0 t0 - 1 0 c0 + 1 = a + b – (t0 - 1) t0 0 c0 = a + b)

Case III: Memory programs

• In addition, a memory with read and write operations– an unbounded set of objects– a finite set of fields in each object– each field contains a boolean value, an integer

value, or a reference to an object• For each field f, two operations Select and

Update– Select(f,o) is the content of the memory at

object o and field f– Update(f,o,v) is a new memory obtained by

updating field f of object o to v

Memory axioms

for all objects o and o’, and memories m: o = o’ Select(Update(m,o,v),o’) = v o o’ Select(Update(m,o,v),o’) = Select(m,o’)

Modeling memory operations

Treat each field f as a map variable:a = b.f a = Select(f,b)a.f = b f = Update(f,a,b)

{ ? } a.f = 5 { a.f + b.f = 10 }

WP(a.f = 5, a.f + b.f = 10) WP(f = Update(f,a,5), Select(f,a) + Select(f,b) = 10) Select(Update(f,a,5),a) + Select(Update(f,a,5),b) = 10

Simplify using memory axiom

Select(Update(f,a,5),a) + Select(Update(f,a,5),b) = 10iff

5 + Select(Update(f,a,5),b) = 10iff

Select(Update(f,a,5),b) = 5iff

a = b 5 = 5 a b Select(f,b) = 5

iffa b Select(f,b) = 5

Formula := A | | A Atom := b | t = 0 | t < 0 | t 0 t Term := c | x | t + t | t – t | ct | Select(m,t)m MemTerm := f | Update(m,t,t)b SymBoolConst x SymIntConst c {…,-1,0,1,…}

Decision procedures

• Boolean programs– Propositional satisfiability

• Arithmetic programs– Propositional satisfiability modulo theory

of linear arithmetic

• Memory programs– Propositional satisfiability modulo theory

of linear arithmetic + arrays