Software Testing and Verification Lecture 17 - cise.ufl.edu Testing and Verification Lecture 17....

Axiomatic Verification I

Prepared by

Stephen M. Thebaut, Ph.D.

University of Florida

Software Testing and Verification

Lecture 17


• Introduction

• Weak correctness predicate

• Assignment statements

• Sequencing

• Selection statements

Introduction

• What is Axiomatic Verification†?

A formal method of reasoning about the functional correctness of a structured, sequential program by tracing its state changes from an initial (i.e., pre-) condition to a final (i.e., post-) condition according to a set of self-evident rules (i.e., axioms).

† Also know as “Hoare logic” or “Floyd-Hoare logic.”

Introduction (cont’d)

• What is its primary goal?

To provide a means for “proving” (and in some cases, “disproving”) the functional correctness of a sequential program with respect to its (formal) specification.


• What are the benefits of studying axiomatic verification?

– Understanding its limitations.

– Deeper insights into programming and program structures.

– Criteria for judging both programs and programming languages.

– The ability to formally verify small (or parts of large) sequential programs.


• Bottom line: even if you never attempt to “prove” a program correct outside this course, the study of formal verification should change the way you write and read programs.

There are two ways of constructing a software

design: One way is to make it so simple that

there are obviously no deficiencies, and the

other way is to make it so complicated that

there are no obvious deficiencies. The first

method is far more difficult. –Tony Hoare

Weak Correctness Predicate

• To prove that program S is (“weakly” or

“partially”) correct with respect to pre-condition P and post-condition Q, it is sufficient to show: {P} S {Q}.

• Interpretation of {P} S {Q}: “if the input (initial state) satisfies pre-condition P and (if) program S executes and terminates, then the output (final state) must satisfy post-condition Q.”

Weak Correctness Predicate (cont’d)

P (before S

executes)

S

terminates

Q (after S

executes)

{P} S {Q}

T YES must be T T

T YES could be F F

F Don’t Care Don’t Care T*

Don’t Care NO N/A T*

* In this case, {P} S {Q} is said to be “vacuously true.”

• Truth table interpretation:


• Truth table interpretation:

P (before S

executes)

S

terminates

Q (after S

executes)

{P} S {Q}

T YES must be T T

T YES could be F F

F Don’t Care Don’t Care T*

Don’t Care NO N/A T*

* In this case, {P} S {Q} is said to be “vacuously true.”


• Note that {P} S {Q} is really just a “double conditional” of the form:

(A Л B) C

where A is “P holds before executing S”, B is “S terminates”, and C is “Q holds after executing S”.

• Therefore, the one and only case for which {P} S {Q} is false is: “Q could be false if S terminates, given that P held before S executes.”


• What are the truth values of the following assertions?

(1) {x=1} y := x+1 {y>0}



(1) {x=1} y := x+1 {y>0}

True, because if P holds initially, Q must hold when S terminates



(2) {x>0} x := x-1 {x>0}



(2) {x>0} x := x-1 {x>0}

False, because Q may not hold when S

terminates given that P holds initially.



(3) {1=2} k := 5 {k<0}



(3) {1=2} k := 5 {k<0}

True (vacuously), since P cannot hold before S

executes.



(4) {true} while x <> 5 do x := x-1 {x=5}

(Hint: When will S terminate?)



(4) {true} while x <> 5 do x := x-1 {x=5}

(Hint: When will S terminate?)

True, since Q must hold if S terminates.


• We now consider techniques for proving that such assertions hold for structured programs comprised of assignment statements, if-then (-else) statements, and while loops. (Why these constructs?)

Reasoning about Assignment

Statements

• For each of the following pre-conditions, P,and assignment statements, S, identify a “strong” post-condition, Q, such that {P} S {Q}

would hold.

• A “strong” post-condition captures all after-execution state information of interest.

• However, we won’t bother with assertions such as X=X’ (“the final value of X is the same as the initial value of X”) for the time being.


Statements (cont’d){P} S {Q}

{J=6} K := 3

{J=6} J := J+2

{A<B} Min := A

{A<B Л B<C} D := C

{X<0} Y := -X

{X[I]=J} I := I+1

{X[I-1]=J} J := J+1



{J=6} K := 3 {J=6}

{J=6} J := J+2

{A<B} Min := A

{A<B Л B<C} D := C

{X<0} Y := -X

{X[I]=J} I := I+1

{X[I-1]=J} J := J+1



{J=6} K := 3 {K=3}

{J=6} J := J+2

{A<B} Min := A

{A<B Л B<C} D := C

{X<0} Y := -X

{X[I]=J} I := I+1

{X[I-1]=J} J := J+1



{J=6} K := 3 {J=6 Л K=3}

{J=6} J := J+2

{A<B} Min := A

{A<B Л B<C} D := C

{X<0} Y := -X

{X[I]=J} I := I+1

{X[I-1]=J} J := J+1



{J=6} K := 3 {J=6 Л K=3}

{J=6} J := J+2 {J=8}

{A<B} Min := A

{A<B Л B<C} D := C

{X<0} Y := -X

{X[I]=J} I := I+1

{X[I-1]=J} J := J+1

{P} S {Q}

{J=6} K := 3 {J=6 Л K=3}

{J=6} J := J+2 {J=8}

{A<B} Min := A

{A<B Л B<C} D := C

{X<0} Y := -X

{X[I]=J} I := I+1

{X[I-1]=J} J := J+1


Statements (cont’d)



{J=6} K := 3 {J=6 Л K=3}

{J=6} J := J+2 {J=8}

{A<B} Min := A {A<B Л Min=A}

{A<B Л B<C} D := C

{X<0} Y := -X

{X[I]=J} I := I+1

{X[I-1]=J} J := J+1



{J=6} K := 3 {J=6 Л K=3}

{J=6} J := J+2 {J=8}


{A<B Л B<C} D := C {A<B Л B<C Л D=C}

{X<0} Y := -X

{X[I]=J} I := I+1

{X[I-1]=J} J := J+1



{J=6} K := 3 {J=6 Л K=3}

{J=6} J := J+2 {J=8}



{X<0} Y := -X {X<0}

{X[I]=J} I := I+1

{X[I-1]=J} J := J+1



{J=6} K := 3 {J=6 Л K=3}

{J=6} J := J+2 {J=8}



{X<0} Y := -X {X<0 Л Y>0}

{X[I]=J} I := I+1

{X[I-1]=J} J := J+1



{J=6} K := 3 {J=6 Л K=3}

{J=6} J := J+2 {J=8}



{X<0} Y := -X {X<0 Л Y=-X}

{X[I]=J} I := I+1

{X[I-1]=J} J := J+1



{J=6} K := 3 {J=6 Л K=3}

{J=6} J := J+2 {J=8}



{X<0} Y := -X {X<0 Л Y=-X}

{X[I]=J} I := I+1 {X[I-1]=J}

{X[I-1]=J} J := J+1

Illustrative Example

{X[I]=J}

X: ___ ___ ___ ___ ___ ___ ___

1 2 3 4 5 6 7

17

J = 17, I = 4

I := I+1

{X[I-1]=J}

X: ___ ___ ___ ___ ___ ___ ___

1 2 3 4 5 6 7

17

J = 17, I = 4 5



{J=6} K := 3 {J=6 Л K=3}

{J=6} J := J+2 {J=8}



{X<0} Y := -X {X<0 Л Y=-X}

{X[I]=J} I := I+1 {X[I-1]=J}

{X[I-1]=J} J := J+1



{J=6} K := 3 {J=6 Л K=3}

{J=6} J := J+2 {J=8}



{X<0} Y := -X {X<0 Л Y=-X}

{X[I]=J} I := I+1 {X[I-1]=J}

{X[I-1]=J} J := J+1 {X[I-1]=J-1}

Illustrative Example

{X[I-1]=J}

X: ___ ___ ___ ___ ___ ___ ___

1 2 3 4 5 6 7

17

J = 17, I = 5

J := J+1

{X[I-1]=J-1}

X: ___ ___ ___ ___ ___ ___ ___

1 2 3 4 5 6 7

17

J = 17 18, I = 5



• For each of the following post-conditions, Q,

and assignment statements, S, identify a“weak” pre-condition, P, such that {P} S {Q}

would hold.

(A “weak” pre-condition reflects only what

needs to be true initially.)



{P} S {Q}

I := 4 {J=7 Л I=4}

I := 4 {I=4}

I := 4 {I=17}

I := I+2 {I>6}

Y := X+3 {Y=10}

Y := X+3 {Y<8}



{P} S {Q}

{J=7ЛI=4}

I := 4 {J=7 Л I=4}

I := 4 {I=4}

I := 4 {I=17}

I := I+2 {I>6}

Y := X+3 {Y=10}

Y := X+3 {Y<8}



{P} S {Q}

{J=7} I := 4 {J=7 Л I=4}

I := 4 {I=4}

I := 4 {I=17}

I := I+2 {I>6}

Y := X+3 {Y=10}

Y := X+3 {Y<8}



{P} S {Q}

{J=7} I := 4 {J=7 Л I=4}

{K=17} I := 4 {I=4}

I := 4 {I=17}

I := I+2 {I>6}

Y := X+3 {Y=10}

Y := X+3 {Y<8}



{P} S {Q}

{J=7} I := 4 {J=7 Л I=4}

{true} I := 4 {I=4}

I := 4 {I=17}

I := I+2 {I>6}

Y := X+3 {Y=10}

Y := X+3 {Y<8}



{P} S {Q}

{J=7} I := 4 {J=7 Л I=4}

{true} I := 4 {I=4}

{false} I := 4 {I=17}

I := I+2 {I>6}

Y := X+3 {Y=10}

Y := X+3 {Y<8}



{P} S {Q}

{J=7} I := 4 {J=7 Л I=4}

{true} I := 4 {I=4}

{false} I := 4 {I=17}

{I>4} I := I+2 {I>6}

Y := X+3 {Y=10}

Y := X+3 {Y<8}



{P} S {Q}

{J=7} I := 4 {J=7 Л I=4}

{true} I := 4 {I=4}

{false} I := 4 {I=17}

{I>4} I := I+2 {I>6}

{X=7} Y := X+3 {Y=10}

Y := X+3 {Y<8}



{P} S {Q}

{J=7} I := 4 {J=7 Л I=4}

{true} I := 4 {I=4}

{false} I := 4 {I=17}

{I>4} I := I+2 {I>6}

{X=7} Y := X+3 {Y=10}

{X<5} Y := X+3 {Y<8}

When does ({P} S {Q}) ({K} S {W})?

• We just determined that

{J=7} I := 4 {J=7 Л I=4}

holds.

• We can deduce from this that

{J=7} I := 4 {J=7}

also holds since {J=7 Л I=4} is stronger than{J=7}. That is, because:

{J=7 Л I=4} {J=7}


(cont’d)

• Similarly, if we know that

{J=7} I := 4 {J=7 Л I=4}

holds, it follows that

{J=7 Л K=17} I := 4 {J=7 Л I=4}

also holds since {J=7} is weaker than{J=7 Л K=17}. That is, because:

{J=7 Л K=17} {J=7}


(cont’d)

• Thus, we can replace pre-conditions with ones that are stronger, and post-conditions with ones that are weaker.

• Note that if A B, we say that A is strongerthan B, or equivalently, that B is weakerthan A.

Practice quiz question…

• In general, which would be the better marketing strategy for increasing your software sales…advertising the software as having a strong pre-condition and a weakpost-condition, or vice-versa? Give a concrete example which illustrates your answer.

Reasoning about Sequencing

• Suppose that we know

{X[I]=J} I := I+1 {X[I-1]=J}

and we know

{X[I-1]=J} J := J+1 {X[I-1]=J-1}.


• Suppose that we know

{X[I]=J} I := I+1 {X[I-1]=J}

and we know

{X[I-1]=J} J := J+1 {X[I-1]=J-1}.

Then it follows that

{X[I]=J}

I := I +1

{X[I-1]=J}

J := J+1

{X[I-1]=J-1}


(cont’d)

• In general: if you know {P} S1 {R} and you know {R} S2 {Q} then you know {P} S1; S2 {Q}.

Example 1

• Prove the assertion:

{A=5} B := A+2; C := B-A; D := A-C {A=5 Л D=3}

Example 1


{A=5} B := A+2; C := B-A; D := A-C {A=5 Л D=3}

{A=5}

B := A+2;

Example 1


{A=5} B := A+2; C := B-A; D := A-C {A=5 Л D=3}

{A=5}

B := A+2;

{A=5 Л B=7}

Example 1


{A=5} B := A+2; C := B-A; D := A-C {A=5 Л D=3}

{A=5}

B := A+2;

{A=5 Л B=7}

C := B-A;

Example 1


{A=5} B := A+2; C := B-A; D := A-C {A=5 Л D=3}

{A=5}

B := A+2;

{A=5 Л B=7}

C := B-A;

{A=5 Л B=7 Л C=2}

Example 1


{A=5} B := A+2; C := B-A; D := A-C {A=5 Л D=3}

{A=5}

B := A+2;

{A=5 Л B=7}

C := B-A;

{A=5 Л B=7 Л C=2}

D := A-C

Example 1


{A=5} B := A+2; C := B-A; D := A-C {A=5 Л D=3}

{A=5}

B := A+2;

{A=5 Л B=7}

C := B-A;

{A=5 Л B=7 Л C=2}

D := A-C

{A=5 Л B=7 Л C=2 Л D=3}

Example 1


{A=5} B := A+2; C := B-A; D := A-C {A=5 Л D=3}

{A=5}

B := A+2;

{A=5 Л B=7}

C := B-A;

{A=5 Л B=7 Л C=2}

D := A-C

{A=5 Л B=7 Л C=2 Л D=3}

?

Example 1


{A=5} B := A+2; C := B-A; D := A-C {A=5 Л D=3}

{A=5}

B := A+2;

{A=5 Л B=7}

C := B-A;

{A=5 Л B=7 Л C=2}

D := A-C

{A=5 Л B=7 Л C=2 Л D=3} {A=5 Л D=3}

?

Example 1


{A=5} B := A+2; C := B-A; D := A-C {A=5 Л D=3}

{A=5}

B := A+2;

{A=5 Л B=7}

C := B-A;

{A=5 Л B=7 Л C=2}

D := A-C

{A=5 Л B=7 Л C=2 Л D=3} {A=5 Л D=3}

Reasoning about If_then_else

Statements

• Consider the assertion:

{P} if b then S1 else S2 {Q}

• What are the necessary conditions for this assertion to hold?

b

S1S2

{P}

{Q}

T F

Necessary Conditions: If_then_else

b

S1S2

{P}

{Q}

T F


b

S1S2

{P}

{Q}

T F{P Л b } S1 {Q}


b

S1S2

{P}

{Q}

T F{P Л b } S1 {Q}

{P Л b} S2 {Q}


b

S1S2

{P}

{Q}

T F{P Л b } S1 {Q}

{P Л b} S2 {Q}

“and” or “or”


b

S1S2

{P}

{Q}

T F{P Л b } S1 {Q}

{P Л b} S2 {Q}

and

Reasoning about If_then Statements

• Consider the assertion:

{P} if b then S {Q}

• What are the necessary conditions for this assertion to hold?

b

S

{Q}

T

F

{P}

Necessary Conditions: If_then

b

S

{P}

{Q}

T

F


b

S

{P}

{Q}

T{P Л b } S {Q}

F


b

S

{P}

{Q}

T{P Л b } S {Q}

andF


b

S

{P}

{Q}

T{P Л b } S {Q}

(P Л b) Q

andF

Example 2


{Z=B} if A>B then Z := A {Z=Max(A,B)}

Example 2



P b S Q

Example 2



(1) {P Л b } S {Q}:

(2) (P Л b) Q:

P b S Q

Example 2



(1) {P Л b } S {Q}:

{Z=B Л A>B} Z := A { ? }

(2) (P Л b) Q:

P b S Q

Example 2



(1) {P Л b } S {Q}:

{Z=B Л A>B} Z := A {Z=A Л A>B}

(2) (P Л b) Q:

P b S Q

Example 2



(1) {P Л b } S {Q}:

{Z=B Л A>B} Z := A {Z=A Л A>B} Q

(2) (P Л b) Q:

P b S Q

Example 2



(1) {P Л b } S {Q}:


(2) (P Л b) Q:

(Z=B Л AB) ?

P b S Q

Example 2



(1) {P Л b } S {Q}:


(2) (P Л b) Q:

(Z=B Л AB) Q

P b S Q

Proof Rules

• Before proceeding to while loops, let’s capture our previous reasoning about sequencing, selection statements, and state condition replacement in appropriate rules of inference (ROI).

ROI for Sequencing:

{P} S1 {R}, {R} S2 {Q}

{P} S1; S2 {Q}

(cont'd)

Proof Rules (cont’d)

ROI for if_then_else statement:

{P Л b } S1 {Q}, {P Л b} S2 {Q}

{P} if b then S1 else S2 {Q}

ROI for if_then statement:

{P Л b } S {Q}, (P Л b) Q

{P} if b then S {Q}

(cont'd)

Proof Rules (cont’d)

ROI for State Condition Replacement†:

K P, {P} S {Q}, Q W

{K} S {W}

† Also known as the CONSEQUENCE rule.

Coming Up Next…

• Reasoning about iteration (while loops)

• Strong correctness and proving termination


Prepared by

Stephen M. Thebaut, Ph.D.

University of Florida

Software Testing and Verification

Lecture 17

Software Testing and Verification Lecture 17 - cise.ufl.edu Testing and Verification Lecture 17....

Documents

Transcript of Software Testing and Verification Lecture 17 - cise.ufl.edu Testing and Verification Lecture 17....