Warm-Up Problem. 1. What is the definition of a Hoare triple satisfying partial correctness? 2. Recall the rule for assignment: x (assignment)

Size: px
Start display at page:

Download "Warm-Up Problem. 1. What is the definition of a Hoare triple satisfying partial correctness? 2. Recall the rule for assignment: x (assignment)"

Transcription

1 Warm-Up Problem 1 What is the definition of a Hoare triple satisfying partial correctness? 2 Recall the rule for assignment: x (assignment) Why is this the correct rule and not the following rule? x (assignment) 1/25

2 Warm-Up Problem 1 What is the definition of a Hoare triple satisfying partial correctness? 2 Recall the rule for assignment: x (assignment) Why is this the correct rule and not the following rule? x (assignment) Solution: With the second rule, triples like x=2 are provable which would allow us to prove false statements 1/25

3 Program Verification Conditionals Carmen Bruni Lecture 19 Based on slides by Jonathan Buss, Lila Kari, Anna Lubiw and Steve Wolfman with thanks to B Bonakdarpour, A Gao, D Maftuleac, C Roberts, R Trefler, and P Van Beek 2/25

4 Last Time Give reasons for performing formal verification vs testing Define a Hoare Triple Define Partial Correctness Prove that a Hoare triple is satisfied under partial correctness for a program containing assignment statements 3/25

5 Learning Goals Understand and use implied statements as needed Prove that a Hoare triple is satisfied under partial correctness for a program containing assignment and conditional statements 4/25

6 Question How do we show that the following Hoare triple is satisfied under partial correctness? x = y + 1; 5/25

7 Question How do we show that the following Hoare triple is satisfied under partial correctness? x = y + 1; Assignment here only gives us that x = y + 1; However, we know that implies that How do we write this? 5/25

8 Inference Rules with Implications Rule of Precondition strengthening : (implied) Rule of Postcondition weakening : (implied) Example of use: x = y + 1; implied assignment 6/25

9 More Questions What if my code has multiple lines? Why are we allowed to correctly compose annotations? 7/25

10 Inference Rule for Sequences of Instructions (composition) In order to prove, we need to find a midcondition for which we can prove and (In our examples, the midcondition will usually be determined by a rule, such as assignment But in general, a midcondition might be very difficult to determine) 8/25

11 Proof Format: Annotated Programs Interleave program statements with assertions, each justified by an inference rule The composition rule is implicit Assertions should hold true whenever the program reaches that point in its execution 9/25

12 Proof Format: Annotated Programs If implied inference rule is used, we must supply a proof of the implication We ll do these proofs after annotating the program Each assertion should be an instance of an inference rule Normally, Don t simplify the assertions in the annotated program Do the simplification while proving the implied conditions 10/25

13 Example: Composition of Assignments To show: the following is satisfied under partial correctness We work bottom-up for assignments t = x ; x = y ; y = t ; 11/25

14 Example: Composition of Assignments To show: the following is satisfied under partial correctness We work bottom-up for assignments t = x ; x = y ; y = t ; is assignment 11/25

15 Example: Composition of Assignments To show: the following is satisfied under partial correctness We work bottom-up for assignments t = x ; x = y ; y = t ; is assignment assignment 11/25

16 Example: Composition of Assignments To show: the following is satisfied under partial correctness We work bottom-up for assignments t = x ; x = y ; y = t ; assignment assignment assignment 11/25

17 Example: Composition of Assignments To show: the following is satisfied under partial correctness We work bottom-up for assignments t = x ; x = y ; y = t ; implied [proof required] assignment assignment assignment Finally, show implies 11/25

18 Example Show that the following Hoare triple is satisfied under partial correctness x = x + y; y = x + y; x = x + y; 12/25

19 Example Show that the following Hoare triple is satisfied under partial correctness x = x + y; y = x + y; x = x + y; Why is it that and satisfies the pre-condition but not the post condition and yet the above Hoare triple is satisfied under partial correctness? 12/25

20 Example Show that the following Hoare triple is satisfied under partial correctness x = x + y; y = x + y; x = x + y; Why is it that and satisfies the pre-condition but not the post condition and yet the above Hoare triple is satisfied under partial correctness? Answer: The code will actually mutate and! The and at the end is not the same as the original 12/25

21 Programs with Conditional Statements Conditionals 13/25

22 Deduction Rules for Conditionals if-then-else: C C if (B) C else C if-then-else if-then (without else): C if (B) C if-then Conditionals 14/25

23 Template for Conditionals With else Annotated program template for if-then-else: if ( ) { } else { } if-then-else (justify depending on a subproof ) if-then-else (justify depending on a subproof ) if-then-else [justifies this, given previous two] Conditionals 15/25

24 Template for Conditionals Without else Annotated program template for if-then: if ( ) { } if-then [add justification based on ] if-then Implied: Proof of Conditionals 16/25

25 Example: Conditional Code Example: Prove the following is satisfied under partial correctness true if ( max < x ) { if ( ) { max = x ; } } max First, let s recall our proof method Conditionals 17/25

26 The Steps of Creating a Proof Three steps in doing a proof of partial correctness: 1 First annotate using the appropriate inference rules 2 Then back up in the proof: add an assertion before each assignment statement, based on the assertion following the assignment 3 Finally prove any implieds : Annotations from (1) above containing implications Adjacent assertions created in step (2) Proofs here are written in Math 135 style They can use Predicate Logic, basic arithmetic, or any other appropriate reasoning Conditionals 18/25

27 Doing the Steps 1 Add annotations for the if-then statement true if ( max < x ) { true max if-then } max = x ; max to be shown max if-then Implied: true max max Conditionals 19/25

28 Doing the Steps 1 Add annotations for the if-then statement 2 Push up for the assignments true if ( max < x ) { true max max = x ; max } max if-then Implied: if-then assignment true max max Conditionals 19/25

29 Doing the Steps 1 Add annotations for the if-then statement 2 Push up for the assignments 3 Identify implieds to be proven true if ( max < x ) { true max max = x ; max } max if-then if-then Implied (a) assignment Implied (b): true max max Conditionals 19/25

30 Proving Implied Conditions The auxiliary implied proofs can be done in Math 135 style (and assuming the necessary arithmetic properties) We will write them informally, but clearly Proof of Implied (a): true max The statement is a tautology since is reflexive and so the required implication holds Conditionals 20/25

31 Implied (b) Proof of Implied (b): Show, which in this case is true max max The hypothesis, true max can be simplified to max Then by properties of, and, the conclusion, max, follows Conditionals 21/25

32 Example 2 for Conditionals Prove the following is satisfied under partial correctness true if ( x > y ) max = x; } else { max = y; } max max Conditionals 22/25

33 Example 2: Annotated Code true if ( x > y ) { max = x ; max max else max = y ; max max max max if-then-else if-then-else if-then-else Conditionals 23/25

34 Example 2: Annotated Code true if ( x > y ) { max = x ; max max else max = y ; max max max max if-then-else assignment if-then-else assignment if-then-else Conditionals 23/25

35 Example 2: Annotated Code true if ( x > y ) { max = x ; max max else max = y ; max max max max if-then-else implied (a) assignment if-then-else implied (b) assignment if-then-else Conditionals 23/25

36 Example 2: Implied Conditions (a) Prove From and from the trivially true, it follows that From this it follows that (b) Prove From and from the trivially true, it follows that From this it follows that Conditionals 24/25

37 Try Some on Your Own! Show that the following two Hoare triples are satisfied under partial correctness: true x = y ; if (y > 1){ x = x - 1; } else { x = x * x + 1; } w = x + 1 ; if (w >= 0){ w = (w+1)*(w+1)+ 1; } Is the left hand Hoare triple still satisfied under partial correctness if we replace with? Conditionals 25/25

Warm-Up Problem. Let be a set of well-formed Predicate logic formulas. Let be well-formed Predicate logic formulas. Prove or disprove the following.

Warm-Up Problem. Let be a set of well-formed Predicate logic formulas. Let be well-formed Predicate logic formulas. Prove or disprove the following. Warm-Up Problem Let be a set of well-formed Predicate logic formulas Let be well-formed Predicate logic formulas Prove or disprove the following If then 1/35 Program Verification Carmen Bruni Lecture 18

More information

Warm-Up Problem. Let L be the language consisting of as constant symbols, as a function symbol and as a predicate symbol. Give an interpretation where

Warm-Up Problem. Let L be the language consisting of as constant symbols, as a function symbol and as a predicate symbol. Give an interpretation where Warm-Up Problem Let L be the language consisting of as constant symbols, as a function symbol and as a predicate symbol Give an interpretation where is false Use a finite domain in your interpretation

More information

Warmup Problem. Describe how structural induction differs from our MATH 135 notion of induction. 1/25

Warmup Problem. Describe how structural induction differs from our MATH 135 notion of induction. 1/25 Warmup Problem Describe how structural induction differs from our MATH 135 notion of induction 1/25 CS 245: Logic and Computation Carmen Bruni Lecture 3 Based on slides by Jonathan Buss, Lila Kari, Anna

More information

Warmup Problem. Translate the following sentence from English into Propositional Logic. I want to eat ice cream even though I am on a diet.

Warmup Problem. Translate the following sentence from English into Propositional Logic. I want to eat ice cream even though I am on a diet. Warmup Problem Translate the following sentence from English into Propositional Logic I want to eat ice cream even though I am on a diet 1/25 CS 245: Logic and Computation Carmen Bruni Lecture 2 Based

More information

Program Verification. Program Verification 307/434

Program Verification. Program Verification 307/434 Program Verification Program Verification 307/434 Outline Introduction: What and Why? Pre- and Postconditions Conditionals while-loops and Total Correctness Arrays Program Verification Introduction 308/434

More information

An Annotated Language

An Annotated Language Hoare Logic An Annotated Language State and Semantics Expressions are interpreted as functions from states to the corresponding domain of interpretation Operators have the obvious interpretation Free of

More information

Lecture 5 - Axiomatic semantics

Lecture 5 - Axiomatic semantics Program Verification March 2014 Lecture 5 - Axiomatic semantics Lecturer: Noam Rinetzky Scribes by: Nir Hemed 1.1 Axiomatic semantics The development of the theory is contributed to Robert Floyd, C.A.R

More information

Harvard School of Engineering and Applied Sciences CS 152: Programming Languages

Harvard School of Engineering and Applied Sciences CS 152: Programming Languages Harvard School of Engineering and Applied Sciences CS 152: Programming Languages Lecture 19 Tuesday, April 3, 2018 1 Introduction to axiomatic semantics The idea in axiomatic semantics is to give specifications

More information

Lectures 20, 21: Axiomatic Semantics

Lectures 20, 21: Axiomatic Semantics Lectures 20, 21: Axiomatic Semantics Polyvios Pratikakis Computer Science Department, University of Crete Type Systems and Static Analysis Based on slides by George Necula Pratikakis (CSD) Axiomatic Semantics

More information

Shared Variables and Interference

Shared Variables and Interference Solved Shared Variables and Interference CS 536: Science of Programming, Fall 2018 A. Why Parallel programs can coordinate their work using shared variables, but it s important for threads to not interfere

More information

Hoare Logic. COMP2600 Formal Methods for Software Engineering. Rajeev Goré

Hoare Logic. COMP2600 Formal Methods for Software Engineering. Rajeev Goré Hoare Logic COMP2600 Formal Methods for Software Engineering Rajeev Goré Australian National University Semester 2, 2016 (Slides courtesy of Ranald Clouston) COMP 2600 Hoare Logic 1 Australian Capital

More information

Lecture Notes: Hoare Logic

Lecture Notes: Hoare Logic Lecture Notes: Hoare Logic 17-654/17-754: Analysis of Software Artifacts Jonathan Aldrich (jonathan.aldrich@cs.cmu.edu) Lecture 3 1 Hoare Logic The goal of Hoare logic is to provide a formal system for

More information

Reasoning About Imperative Programs. COS 441 Slides 10

Reasoning About Imperative Programs. COS 441 Slides 10 Reasoning About Imperative Programs COS 441 Slides 10 The last few weeks Agenda reasoning about functional programming It s very simple and very uniform: substitution of equal expressions for equal expressions

More information

Part II. Hoare Logic and Program Verification. Why specify programs? Specification and Verification. Code Verification. Why verify programs?

Part II. Hoare Logic and Program Verification. Why specify programs? Specification and Verification. Code Verification. Why verify programs? Part II. Hoare Logic and Program Verification Part II. Hoare Logic and Program Verification Dilian Gurov Props: Models: Specs: Method: Tool: safety of data manipulation source code logic assertions Hoare

More information

Shared Variables and Interference

Shared Variables and Interference Illinois Institute of Technology Lecture 24 Shared Variables and Interference CS 536: Science of Programming, Spring 2018 A. Why Parallel programs can coordinate their work using shared variables, but

More information

Hoare logic. A proof system for separation logic. Introduction. Separation logic

Hoare logic. A proof system for separation logic. Introduction. Separation logic Introduction Hoare logic Lecture 6: Examples in separation logic In the previous lecture, we saw how reasoning about pointers in Hoare logic was problematic, which motivated introducing separation logic.

More information

AXIOMS OF AN IMPERATIVE LANGUAGE PARTIAL CORRECTNESS WEAK AND STRONG CONDITIONS. THE AXIOM FOR nop

AXIOMS OF AN IMPERATIVE LANGUAGE PARTIAL CORRECTNESS WEAK AND STRONG CONDITIONS. THE AXIOM FOR nop AXIOMS OF AN IMPERATIVE LANGUAGE We will use the same language, with the same abstract syntax that we used for operational semantics. However, we will only be concerned with the commands, since the language

More information

Hoare Logic: Proving Programs Correct

Hoare Logic: Proving Programs Correct Hoare Logic: Proving Programs Correct 17-654/17-765 Analysis of Software Artifacts Jonathan Aldrich Reading: C.A.R. Hoare, An Axiomatic Basis for Computer Programming Some presentation ideas from a lecture

More information

Induction and Semantics in Dafny

Induction and Semantics in Dafny 15-414 Lecture 11 1 Instructor: Matt Fredrikson Induction and Semantics in Dafny TA: Ryan Wagner Encoding the syntax of Imp Recall the abstract syntax of Imp: a AExp ::= n Z x Var a 1 + a 2 b BExp ::=

More information

Introduction to Axiomatic Semantics

Introduction to Axiomatic Semantics Introduction to Axiomatic Semantics Meeting 10, CSCI 5535, Spring 2009 Announcements Homework 3 due tonight Homework 2 is graded 13 (mean), 14 (median), out of 21 total, but Graduate class: final project

More information

Symbolic Execution and Proof of Properties

Symbolic Execution and Proof of Properties Chapter 7 Symbolic Execution and Proof of Properties Symbolic execution builds predicates that characterize the conditions under which execution paths can be taken and the effect of the execution on program

More information

6. Hoare Logic and Weakest Preconditions

6. Hoare Logic and Weakest Preconditions 6. Hoare Logic and Weakest Preconditions Program Verification ETH Zurich, Spring Semester 07 Alexander J. Summers 30 Program Correctness There are many notions of correctness properties for a given program

More information

Proofs about Programs

Proofs about Programs Proofs about Programs Program Verification (Rosen, Sections 5.5) TOPICS Program Correctness Preconditions & Postconditions Program Verification Assignment Statements Conditional Statements Loops Composition

More information

Program Verification (Rosen, Sections 5.5)

Program Verification (Rosen, Sections 5.5) Program Verification (Rosen, Sections 5.5) TOPICS Program Correctness Preconditions & Postconditions Program Verification Assignments Composition Conditionals Loops Proofs about Programs Why study logic?

More information

Semantics. There is no single widely acceptable notation or formalism for describing semantics Operational Semantics

Semantics. There is no single widely acceptable notation or formalism for describing semantics Operational Semantics There is no single widely acceptable notation or formalism for describing semantics Operational Describe the meaning of a program by executing its statements on a machine, either simulated or actual. The

More information

Introduction to dependent types in Coq

Introduction to dependent types in Coq October 24, 2008 basic use of the Coq system In Coq, you can play with simple values and functions. The basic command is called Check, to verify if an expression is well-formed and learn what is its type.

More information

Hoare Logic and Model Checking

Hoare Logic and Model Checking Hoare Logic and Model Checking Kasper Svendsen University of Cambridge CST Part II 2016/17 Acknowledgement: slides heavily based on previous versions by Mike Gordon and Alan Mycroft Introduction In the

More information

Softwaretechnik. Program verification. Software Engineering Albert-Ludwigs-University Freiburg. June 30, 2011

Softwaretechnik. Program verification. Software Engineering Albert-Ludwigs-University Freiburg. June 30, 2011 Softwaretechnik Program verification Software Engineering Albert-Ludwigs-University Freiburg June 30, 2011 (Software Engineering) Softwaretechnik June 30, 2011 1 / 28 Road Map Program verification Automatic

More information

CITS5501 Software Testing and Quality Assurance Formal methods

CITS5501 Software Testing and Quality Assurance Formal methods CITS5501 Software Testing and Quality Assurance Formal methods Unit coordinator: Arran Stewart May 1, 2018 1 / 49 Sources Pressman, R., Software Engineering: A Practitioner s Approach, McGraw-Hill, 2005

More information

Hoare Logic and Model Checking. A proof system for Separation logic. Introduction. Separation Logic

Hoare Logic and Model Checking. A proof system for Separation logic. Introduction. Separation Logic Introduction Hoare Logic and Model Checking In the previous lecture we saw the informal concepts that Separation Logic is based on. Kasper Svendsen University of Cambridge CST Part II 2016/17 This lecture

More information

Fall Recursion and induction. Stephen Brookes. Lecture 4

Fall Recursion and induction. Stephen Brookes. Lecture 4 15-150 Fall 2018 Stephen Brookes Lecture 4 Recursion and induction Last time Specification format for a function F type assumption guarantee (REQUIRES) (ENSURES) For all (properly typed) x satisfying the

More information

Checking Program Properties with ESC/Java

Checking Program Properties with ESC/Java Checking Program Properties with ESC/Java 17-654/17-765 Analysis of Software Artifacts Jonathan Aldrich 1 ESC/Java A checker for Java programs Finds null pointers, array dereferences Checks Hoare logic

More information

Logic and Computation Lecture 20 CSU 290 Spring 2009 (Pucella) Thursday, Mar 12, 2009

Logic and Computation Lecture 20 CSU 290 Spring 2009 (Pucella) Thursday, Mar 12, 2009 Logic and Computation Lecture 20 CSU 290 Spring 2009 (Pucella) Thursday, Mar 12, 2009 Note that I change the name of the functions slightly in these notes from what I used in class, to be consistent with

More information

SECTION 1: CODE REASONING + VERSION CONTROL

SECTION 1: CODE REASONING + VERSION CONTROL SECTION 1: CODE + OUTLINE Introductions Code Reasoning Forward Reasoning Backward Reasoning Weaker vs. Stronger statements Version control CSE 331 Summer 2018 slides borrowed and adapted from Alex Mariakis

More information

Abstract Interpretation

Abstract Interpretation Abstract Interpretation Ranjit Jhala, UC San Diego April 22, 2013 Fundamental Challenge of Program Analysis How to infer (loop) invariants? Fundamental Challenge of Program Analysis Key issue for any analysis

More information

SECTION 1: CODE REASONING + VERSION CONTROL

SECTION 1: CODE REASONING + VERSION CONTROL SECTION 1: CODE + OUTLINE Introductions Code Reasoning Forward Reasoning Backward Reasoning Weaker vs. Stronger statements Version control CSE 331 Spring 2018 slides borrowed and adapted from Alex Mariakis

More information

Secure Information Flow by Self-Composition

Secure Information Flow by Self-Composition Secure Information Flow by Self-Composition Paper by Gilles Barthe, Pedro R. D Argenio, and Tamara Rezk Slides by Isaac Sheff Background Noninterference Type Systems new features and policies require extensions

More information

Softwaretechnik. Program verification. Albert-Ludwigs-Universität Freiburg. June 28, Softwaretechnik June 28, / 24

Softwaretechnik. Program verification. Albert-Ludwigs-Universität Freiburg. June 28, Softwaretechnik June 28, / 24 Softwaretechnik Program verification Albert-Ludwigs-Universität Freiburg June 28, 2012 Softwaretechnik June 28, 2012 1 / 24 Road Map Program verification Automatic program verification Programs with loops

More information

Specification and Verification I

Specification and Verification I Title: Lecturer: Class: Specification and Verification I Mike Gordon Computer Science Tripos, Part II Duration: Twelve lectures Specification and Verification I Mike Gordon Overview These lecture notes

More information

The Rule of Constancy(Derived Frame Rule)

The Rule of Constancy(Derived Frame Rule) The Rule of Constancy(Derived Frame Rule) The following derived rule is used on the next slide The rule of constancy {P } C {Q} {P R} C {Q R} where no variable assigned to in C occurs in R Outline of derivation

More information

Chapter 3. Describing Syntax and Semantics ISBN

Chapter 3. Describing Syntax and Semantics ISBN Chapter 3 Describing Syntax and Semantics ISBN 0-321-49362-1 Chapter 3 Topics Describing the Meanings of Programs: Dynamic Semantics Copyright 2015 Pearson. All rights reserved. 2 Semantics There is no

More information

CIS 500 Software Foundations. Final Exam. May 3, Answer key

CIS 500 Software Foundations. Final Exam. May 3, Answer key CIS 500 Software Foundations Final Exam May 3, 2012 Answer key This exam includes material on the Imp language and the simply-typed lambda calculus. Some of the key definitions are repeated, for easy reference,

More information

== is a decent equivalence

== is a decent equivalence Table of standard equiences 30/57 372 TABLES FOR PART I Propositional Logic Lecture 2 (Chapter 7) September 9, 2016 Equiences for connectives Commutativity: Associativity: P Q == Q P, (P Q) R == P (Q R),

More information

Runtime Checking and Test Case Generation for Python

Runtime Checking and Test Case Generation for Python Runtime Checking and Test Case Generation for Python Anna Durrer Master Thesis Chair of Programming Methodology D-INFK ETH Supervisor: Marco Eilers, Prof. Peter Müller 24. Mai 2017 1 Introduction This

More information

The semantics of a programming language is concerned with the meaning of programs, that is, how programs behave when executed on computers.

The semantics of a programming language is concerned with the meaning of programs, that is, how programs behave when executed on computers. Semantics The semantics of a programming language is concerned with the meaning of programs, that is, how programs behave when executed on computers. The semantics of a programming language assigns a precise

More information

LOGIC AND DISCRETE MATHEMATICS

LOGIC AND DISCRETE MATHEMATICS LOGIC AND DISCRETE MATHEMATICS A Computer Science Perspective WINFRIED KARL GRASSMANN Department of Computer Science University of Saskatchewan JEAN-PAUL TREMBLAY Department of Computer Science University

More information

Verification Condition Generation

Verification Condition Generation Verification Condition Generation Jorge Sousa Pinto Departamento de Informática / Universidade do Minho jsp@di.uminho.pt www.di.uminho.pt/~jsp Outline (1) - From Hoare Logic to VCGen algorithms: an architecture

More information

A proof-producing CSP solver: A proof supplement

A proof-producing CSP solver: A proof supplement A proof-producing CSP solver: A proof supplement Report IE/IS-2010-02 Michael Veksler Ofer Strichman mveksler@tx.technion.ac.il ofers@ie.technion.ac.il Technion Institute of Technology April 12, 2010 Abstract

More information

A CRASH COURSE IN SEMANTICS

A CRASH COURSE IN SEMANTICS LAST TIME Recdef More induction NICTA Advanced Course Well founded orders Slide 1 Theorem Proving Principles, Techniques, Applications Slide 3 Well founded recursion Calculations: also/finally {P}... {Q}

More information

Propositional Calculus. Math Foundations of Computer Science

Propositional Calculus. Math Foundations of Computer Science Propositional Calculus Math Foundations of Computer Science Propositional Calculus Objective: To provide students with the concepts and techniques from propositional calculus so that they can use it to

More information

Software Engineering Lecture Notes

Software Engineering Lecture Notes Software Engineering Lecture Notes Paul C. Attie August 30, 2013 c Paul C. Attie. All rights reserved. 2 Contents I Hoare Logic 11 1 Propositional Logic 13 1.1 Introduction and Overview..............................

More information

Outline. Introduction. 2 Proof of Correctness. 3 Final Notes. Precondition P 1 : Inputs include

Outline. Introduction. 2 Proof of Correctness. 3 Final Notes. Precondition P 1 : Inputs include Outline Computer Science 331 Correctness of Algorithms Mike Jacobson Department of Computer Science University of Calgary Lectures #2-4 1 What is a? Applications 2 Recursive Algorithms 3 Final Notes Additional

More information

Lecture 3: Recursion; Structural Induction

Lecture 3: Recursion; Structural Induction 15-150 Lecture 3: Recursion; Structural Induction Lecture by Dan Licata January 24, 2012 Today, we are going to talk about one of the most important ideas in functional programming, structural recursion

More information

Program Verification. Aarti Gupta

Program Verification. Aarti Gupta Program Verification Aarti Gupta 1 Agenda Famous bugs Common bugs Testing (from lecture 6) Reasoning about programs Techniques for program verification 2 Famous Bugs The first bug: A moth in a relay (1945)

More information

Testing, Debugging, and Verification

Testing, Debugging, and Verification Testing, Debugging, and Verification Formal Specification, Part II Srinivas Pinisetty 23 November 2017 Introduction Today: Introduction to Dafny: An imperative language with integrated support for formal

More information

Lecture 10 Design by Contract

Lecture 10 Design by Contract CS 5959 Writing Solid Code Fall 2015 Nov-23 Lecture 10 Design by Contract Zvonimir Rakamarić University of Utah Design by Contract Also called assume-guarantee reasoning Developers annotate software components

More information

Introduction to Axiomatic Semantics (1/2)

Introduction to Axiomatic Semantics (1/2) #1 Introduction to Axiomatic Semantics (1/2) How s The Homework Going? Remember: just do the counterexample guided abstraction refinement part of DPLL(T). If you notice any other errors, those are good

More information

CSE 307: Principles of Programming Languages

CSE 307: Principles of Programming Languages CSE 307: Principles of Programming Languages Advanced Topics R. Sekar Topics 1 / 14 1. 2 / 14 Section 1 3 / 14 Semantics of Programs Syntax defines what programs are valid. Semantics defines what the valid

More information

Arguing for program correctness and writing correct programs

Arguing for program correctness and writing correct programs Arguing for program correctness and writing correct programs Saying things about states, programs Program state s1: x=4, y=-1.5, A={ me, you, he Assertions about program states x=3 False in s1 (y=x) x>=0

More information

Programming Languages Third Edition

Programming Languages Third Edition Programming Languages Third Edition Chapter 12 Formal Semantics Objectives Become familiar with a sample small language for the purpose of semantic specification Understand operational semantics Understand

More information

Transforming Programs into Recursive Functions

Transforming Programs into Recursive Functions SBMF 2008 Transforming Programs into Recursive Functions Magnus O. Myreen, Michael J. C. Gordon 1 Computer Laboratory, University of Cambridge 15 JJ Thomson Avenue, Cambridge, UK Abstract This paper presents

More information

Forward Assignment; Strongest Postconditions

Forward Assignment; Strongest Postconditions 3/1 new version Forward Assignment; Strongest Postconditions CS 536: Science of Programming, Spring 2018 A. Why? At times, a forward version of the assignment rule is more appropriate than the backward

More information

How invariants help writing loops Author: Sander Kooijmans Document version: 1.0

How invariants help writing loops Author: Sander Kooijmans Document version: 1.0 How invariants help writing loops Author: Sander Kooijmans Document version: 1.0 Why this document? Did you ever feel frustrated because of a nasty bug in your code? Did you spend hours looking at the

More information

Introduction to Axiomatic Semantics (1/2)

Introduction to Axiomatic Semantics (1/2) #1 Introduction to Axiomatic Semantics (1/2) How s The Homework Going? Remember that you can t just define a meaning function in terms of itself you must use some fixed point machinery. #2 #3 Observations

More information

Denotational Semantics of a Simple Imperative Language Using Intensional Logic

Denotational Semantics of a Simple Imperative Language Using Intensional Logic Denotational Semantics of a Simple Imperative Language Using Intensional Logic Marc Bender bendermm@mcmaster.ca CAS 706 - Programming Languages Instructor: Dr. Jacques Carette Dept. of Computing and Software

More information

Chapter 3 (part 3) Describing Syntax and Semantics

Chapter 3 (part 3) Describing Syntax and Semantics Chapter 3 (part 3) Describing Syntax and Semantics Chapter 3 Topics Introduction The General Problem of Describing Syntax Formal Methods of Describing Syntax Attribute Grammars Describing the Meanings

More information

CIS 890: Safety Critical Systems

CIS 890: Safety Critical Systems CIS 890: Safety Critical Systems Lecture: SPARK -- Analysis Tools Copyright 2007, John Hatcliff. The syllabus and all lectures for this course are copyrighted materials and may not be used in other course

More information

Hoare triples. Floyd-Hoare Logic, Separation Logic

Hoare triples. Floyd-Hoare Logic, Separation Logic Hoare triples Floyd-Hoare Logic, Separation Logic 1. Floyd-Hoare Logic 1969 Reasoning about control Hoare triples {A} p {B} a Hoare triple partial correctness: if the initial state satisfies assertion

More information

COMP 507: Computer-Aided Program Design

COMP 507: Computer-Aided Program Design Fall 2014 April 7, 2015 Goal: Correctness proofs Prove that an algorithm written in an imperative language is correct Induction for algorithmic correctness Induction for functional programs: The program

More information

Software Quality Assurance

Software Quality Assurance Software Quality Assurance Every week we see new examples of: computer systems error/failure Here are some examples, taken from different industries Airport chaos after computer crash By Vanessa Allen,

More information

Spark verification features

Spark verification features Spark verification features Paul Jackson School of Informatics University of Edinburgh Formal Verification Spring 2018 Adding specification information to programs Verification concerns checking whether

More information

hwu-logo.png 1 class Rational { 2 int numerator ; int denominator ; 4 public Rational ( int numerator, int denominator ) {

hwu-logo.png 1 class Rational { 2 int numerator ; int denominator ; 4 public Rational ( int numerator, int denominator ) { Code Contracts in C# Hans-Wolfgang Loidl School of Mathematical and Computer Sciences, Heriot-Watt University, Edinburgh Semester 1 2017/18 Motivation Debugging programs is time-consuming

More information

CSC313 High Integrity Systems/CSCM13 Critical Systems. CSC313/CSCM13 Chapter 2 1/ 221

CSC313 High Integrity Systems/CSCM13 Critical Systems. CSC313/CSCM13 Chapter 2 1/ 221 CSC313 High Integrity Systems/CSCM13 Critical Systems CSC313/CSCM13 Chapter 2 1/ 221 CSC313 High Integrity Systems/ CSCM13 Critical Systems Course Notes Chapter 2: SPARK Ada Sect. 2 (f) Anton Setzer Dept.

More information

Goals: Define the syntax of a simple imperative language Define a semantics using natural deduction 1

Goals: Define the syntax of a simple imperative language Define a semantics using natural deduction 1 Natural Semantics Goals: Define the syntax of a simple imperative language Define a semantics using natural deduction 1 1 Natural deduction is an instance of first-order logic; that is, it is the formal

More information

Lecture 1 Contracts : Principles of Imperative Computation (Fall 2018) Frank Pfenning

Lecture 1 Contracts : Principles of Imperative Computation (Fall 2018) Frank Pfenning Lecture 1 Contracts 15-122: Principles of Imperative Computation (Fall 2018) Frank Pfenning In these notes we review contracts, which we use to collectively denote function contracts, loop invariants,

More information

Code Contracts in C#

Code Contracts in C# Code Contracts in C# Hans-Wolfgang Loidl School of Mathematical and Computer Sciences, Heriot-Watt University, Edinburgh Semester 1 2018/19 H-W. Loidl (Heriot-Watt Univ) F20SC/F21SC

More information

6.0 ECTS/4.5h VU Programm- und Systemverifikation ( ) June 22, 2016

6.0 ECTS/4.5h VU Programm- und Systemverifikation ( ) June 22, 2016 6.0 ECTS/4.5h VU Programm- und Systemverifikation (184.741) June 22, 2016 Kennzahl (study id) Matrikelnummer (student id) Familienname (family name) Vorname (first name) Gruppe (version) A 1.) Coverage

More information

Review: Hoare Logic Rules

Review: Hoare Logic Rules Review: Hoare Logic Rules wp(x := E, P) = [E/x] P wp(s;t, Q) = wp(s, wp(t, Q)) wp(if B then S else T, Q) = B wp(s,q) && B wp(t,q) Proving loops correct First consider partial correctness The loop may not

More information

Programming Languages Fall 2014

Programming Languages Fall 2014 Programming Languages Fall 2014 Lecture 7: Simple Types and Simply-Typed Lambda Calculus Prof. Liang Huang huang@qc.cs.cuny.edu 1 Types stuck terms? how to fix it? 2 Plan First I For today, we ll go back

More information

Strategies for Proofs

Strategies for Proofs Strategies for Proofs Landscape with House and Ploughman Van Gogh Discrete Structures (CS 173) Madhusudan Parthasarathy, University of Illinois 1 Goals of this lecture A bit more logic Reviewing Implication

More information

6.170 Lecture 6 Procedure specifications MIT EECS

6.170 Lecture 6 Procedure specifications MIT EECS 6.170 Lecture 6 Procedure specifications MIT EECS Outline Satisfying a specification; substitutability Stronger and weaker specifications Comparing by hand Comparing via logical formulas Comparing via

More information

Section 2.4: Arguments with Quantified Statements

Section 2.4: Arguments with Quantified Statements Section 2.4: Arguments with Quantified Statements In this section, we shall generalize the ideas we developed in Section 1.3 to arguments which involve quantified statements. Most of the concepts we shall

More information

Proof Carrying Code(PCC)

Proof Carrying Code(PCC) Discussion p./6 Proof Carrying Code(PCC Languaged based security policy instead of OS-based A mechanism to determine with certainity that it is safe execute a program or not Generic architecture for providing

More information

CORRECTNESS ISSUES AND LOOP INVARIANTS

CORRECTNESS ISSUES AND LOOP INVARIANTS Aout A2 and feedack. Recursion 2 CORRECTNESS ISSUES AND LOOP INVARIANTS S2 has een graded. If you got 30/30, you will proaly have no feedack. If you got less than full credit, there should e feedack showing

More information

Global Optimization. Lecture Outline. Global flow analysis. Global constant propagation. Liveness analysis. Local Optimization. Global Optimization

Global Optimization. Lecture Outline. Global flow analysis. Global constant propagation. Liveness analysis. Local Optimization. Global Optimization Lecture Outline Global Optimization Global flow analysis Global constant propagation Liveness analysis Compiler Design I (2011) 2 Local Optimization Recall the simple basic-block optimizations Constant

More information

Lecture 1 Contracts. 1 A Mysterious Program : Principles of Imperative Computation (Spring 2018) Frank Pfenning

Lecture 1 Contracts. 1 A Mysterious Program : Principles of Imperative Computation (Spring 2018) Frank Pfenning Lecture 1 Contracts 15-122: Principles of Imperative Computation (Spring 2018) Frank Pfenning In these notes we review contracts, which we use to collectively denote function contracts, loop invariants,

More information

Proving Properties on Programs From the Coq Tutorial at ITP 2015

Proving Properties on Programs From the Coq Tutorial at ITP 2015 Proving Properties on Programs From the Coq Tutorial at ITP 2015 Reynald Affeldt August 29, 2015 Hoare logic is a proof system to verify imperative programs. It consists of a language of Hoare triples

More information

Formal Methods. CITS5501 Software Testing and Quality Assurance

Formal Methods. CITS5501 Software Testing and Quality Assurance Formal Methods CITS5501 Software Testing and Quality Assurance Pressman, R. Software Engineering: A Practitioner s Approach. Chapter 28. McGraw-Hill, 2005 The Science of Programming, David Gries, 1981

More information

Main Goal. Language-independent program verification framework. Derive program properties from operational semantics

Main Goal. Language-independent program verification framework. Derive program properties from operational semantics Main Goal Language-independent program verification framework Derive program properties from operational semantics Questions: Is it possible? Is it practical? Answers: Sound and complete proof system,

More information

Operational Semantics 1 / 13

Operational Semantics 1 / 13 Operational Semantics 1 / 13 Outline What is semantics? Operational Semantics What is semantics? 2 / 13 What is the meaning of a program? Recall: aspects of a language syntax: the structure of its programs

More information

Hardware versus software

Hardware versus software Logic 1 Hardware versus software 2 In hardware such as chip design or architecture, designs are usually proven to be correct using proof tools In software, a program is very rarely proved correct Why?

More information

Pet: An Interactive Software Testing Tool

Pet: An Interactive Software Testing Tool Pet: An Interactive Software Testing Tool Elsa Gunter, Robert Kurshan, and Doron Peled Bell Laboratories 600 Mountain Ave. Murray Hill, NJ 07974 Abstract. We describe here the Pet (standing for path exploration

More information

Foundations of Computer Science Spring Mathematical Preliminaries

Foundations of Computer Science Spring Mathematical Preliminaries Foundations of Computer Science Spring 2017 Equivalence Relation, Recursive Definition, and Mathematical Induction Mathematical Preliminaries Mohammad Ashiqur Rahman Department of Computer Science College

More information

(a) (4 pts) Prove that if a and b are rational, then ab is rational. Since a and b are rational they can be written as the ratio of integers a 1

(a) (4 pts) Prove that if a and b are rational, then ab is rational. Since a and b are rational they can be written as the ratio of integers a 1 CS 70 Discrete Mathematics for CS Fall 2000 Wagner MT1 Sol Solutions to Midterm 1 1. (16 pts.) Theorems and proofs (a) (4 pts) Prove that if a and b are rational, then ab is rational. Since a and b are

More information

Axiomatic Specification. Al-Said, Apcar, Jerejian

Axiomatic Specification. Al-Said, Apcar, Jerejian Axiomatic Specification Al-Said, Apcar, Jerejian 1 Axioms: Wffs that can be written down without any reference to any other Wffs. Wffs that are stipulated as unproved premises for the proof of other wffs

More information

Programming Languages Fall 2013

Programming Languages Fall 2013 Programming Languages Fall 2013 Lecture 3: Induction Prof. Liang Huang huang@qc.cs.cuny.edu Recursive Data Types (trees) data Ast = ANum Integer APlus Ast Ast ATimes Ast Ast eval (ANum x) = x eval (ATimes

More information

Axiomatic Semantics. Automated Deduction - George Necula - Lecture 2 1

Axiomatic Semantics. Automated Deduction - George Necula - Lecture 2 1 Axiomatic Semantics Automated Deduction - George Necula - Lecture 2 1 Programs Theorems. Axiomatic Semantics Consists of: A language for making assertions about programs Rules for establishing when assertions

More information

Hoare logic. WHILE p, a language with pointers. Introduction. Syntax of WHILE p. Lecture 5: Introduction to separation logic

Hoare logic. WHILE p, a language with pointers. Introduction. Syntax of WHILE p. Lecture 5: Introduction to separation logic Introduction Hoare logic Lecture 5: Introduction to separation logic In the previous lectures, we have considered a language, WHILE, where mutability only concerned program variables. Jean Pichon-Pharabod

More information

Software Security: Vulnerability Analysis

Software Security: Vulnerability Analysis Computer Security Course. Software Security: Vulnerability Analysis Program Verification Program Verification How to prove a program free of buffer overflows? Precondition Postcondition Loop invariants

More information

Inferring Invariants in Separation Logic for Imperative List-processing Programs

Inferring Invariants in Separation Logic for Imperative List-processing Programs Inferring Invariants in Separation Logic for Imperative List-processing Programs Stephen Magill Carnegie Mellon University smagill@cs.cmu.edu Aleksandar Nanevski Harvard University aleks@eecs.harvard.edu

More information