Material: Specification and Reasoning. Book: Logic in Computer Science, M.Huth, M.Ryan, Cambridge University Press. Lectures mondays here,

Transcription

1 Material: Specification and Reasoning Lectures mondays here, Lecturer Pasquale Malacaria CS/428 Labs thursdays with Dino DiStefano Book: Logic in Computer Science, M.Huth, M.Ryan, Cambridge University Press. Plus additional material from the web page. pm/sar/ Some of the topics of this course aren t on textbooks, so attendance is essential. 1 2

2 Specification: Specification and Reasoning what does that mean? We want to learn how to say precisely what we want from a system (software or physical system) Reasoning: We want to learn to reason precisely about a system. 3 4

3 Why do we want to do that? Our computers work ok, they crash rarely (10 per cent), so why bother? The 99 percent problem... The 99.9 percent problem Think of the software controlling the following: Trains, airplanes, nuclear power stations, car cpu, underground, rockets, stock market, keyhole surgery, traffic controller, ships, power grid, water, gas supplies... basically everything outside personal use of computers need to work more than ok and often need to crash never. 5 6

4 How to achieve these high standard? Duplication? E.g. 3 computers running at the same time; output by majority Testing? white/ black box testing Do these things work for critical systems? Duplication: Two wrong do not make one right. Testing: How much can you test? 1 int var = 2 32 cases ( > spoonful of sea),... 4 int vars =2 128 cases (> particles in the universe). 7 8

5 The logical approach: We specify in some logics what we want to do. The system is interpreted as some kind of model for this logic We use standard logic techniques (e.g. proofs) to reason about the system, e.g. to prove or disprove that the system does what we want. Two relevant families of logics: Temporal logics: logic as you know it + operators to say things like at some point in the future P will be true or always in the future P will be true Program logics: logic as you know it + rules to say if P was true before the program statement c then P is true after c has been executed 9 10

6 Lecture 1: A meaningful example of temporal logic statement It will always be true that if the pressure in a nuclear reactor exceed a critical limit the alarm will be reaised Topics: Program Models, Transition Systems, To know this some kind of temporal logical proof is required. Kripke Transition systems, While Language

7 How can we model systems? For example how can we model a simple vending machine? What do we need to know to model a simple vending machine? (that thing where you insert coins and then choose a drink). and what is a model anyway? For our purposes a model is some kind of formalism which represents the behaviour of the system. A vending machine is basically a system which has an initial state and then changes its state according to the user behaviour: E.g.:If the user inserts the right amount the machine get into a state where the user can choose a drink

8 So let s take the view that a model for a simple vending machine is a formalism where we can represent the possible states of the machine and the transitions between these states. States:{ 1:start, 2:chooseDrink, 3:releaseCoke, 4:releaseOrange, 5:finish} The difference is that 2 3 happens when the user chooses a coke and 2 4 happens when he chooses an orange. We have hence to specify the action bringing from one state to another, e.g. 2 coke 3 Here is a picture of the system: Transitions:{1 2, 2 3, 2 4, 3 1, 4 1, 1 5} Something is still missing. Can you see what? What s the difference between 2 3 and 2 4? 15 16

9 Our model of the vending machine is an example of a Labeled Transition System. a Labeled Transition System is a triple T = (S, A, ) where S is a set of nodes Can we model programs in a similar way? What are the states? What are the transitions? A a set of actions S A S a set of labelled transitions A state is a snapshot of a system; in the case of a program what is its snapshot? int x=0; int y =5; x+=y*2; Note that if A = {a} (any singleton will do) we recover (directed) graphs

10 A snapshot of an executing program can be seen as the state of the memory when the current command is executed. A Program Model is a 5-tuple (S, A,, s, E) where S is a set of nodes (or program states) In our case: After : int x = 0; int y = 5; State : x = 0, y = 5 After : x = x + y 2; State : x = 10, y = So we can take as the state of a program at a program point the values of the program variables at that particular program point. A a set of actions (or program commands) S A S a set of labelled transitions s S is the initial state and E S the set of end states

11 Our simple program int x=0; int y =5; x+=y*2; can be interpreted in the following program model (S, A,, s, E): S = { 1,2,3,4}, where 1=ɛ, 2={x=0}, 3={x=0,y=5}, 4={x=10,y=5}. A = { int x=0, int y =5, x+=y*2} 1 int x=0 2, 2 int y=5 3, 3 x+=y 2 4 A more interesting example Consider the following fragment of a Java program: while (Mod(x)) { x=x/2; x++;} } where s = 1, E = {4}. Mod(x) returns true if x is even and false otherwise

12 Program Models and labeled transition systems are part of a family of models for various logical or physical systems. Labels on arcs denotes the possible actions of the system, i.e. its dynamics; it is however convenient to enrich the states of the system to include atomic propositions associated to states. A Kripke transition system over a set of atomic propositions P is a structure T = (S, A,, I) where T = (S, A) is a labeled transition system and I : S 2 P is an interpretation

13 I(s) = {p 1,..., p n } means p 1,..., p n are true in the state s. The idea is that with an interpretation we add the basic truths we want to hold at a particular state. Example: consider again int x=0; int y =5; x+=y*2; An interpretation for this program could be as follows: Some more interpretations for int x=0; int y =5; x+=y*2; I(1) = ɛ, I(2) = {y = 5}, I(3) = {x < y}, I(4) = {x > y} I(1) = I(2) = I(3) = I(4) = ɛ I(1) = I(2) = ɛ, I(3) = {x < y}, I(4) = {x > y} I(1) = I(2) = I(3) = I(4) = {x > 0} Hence an interpretation allows us to add basic truths to the model

14 Summary: Labeled transition systems (LTS)= states + transitions with labels. Program Models (PM)= (LTS)+initial state and final states. Kripke transition system(kts)=(lts)+ interpretation. The While language The programs we will consider will be written in a subset of java consisting of while and if statements and sequence of assignments. We call this the While language. Example z = 0; i = 0; while(!(i == y)){z+ = x; i + +; } LTS are a basic universal model of everything. PM are special LTS appropriate for programs. How restrictive is that? Can we translate all java programs we saw last year in that form? KTS are LTS with added basic logic

15 In short the answer is yes. example to give the idea: We just give an public class Account { private double balance; public Account(double initialbalance) { balance = initialbalance; } public void deposit(double amount) { balance += amount; } public void withdraw(double amount) { balance -= amount; } public class TestAccount { public static void main(string[] args) { Account acc1=new Account(1000); Account acc2=new Account(500); double sum=acc1.getbalance()+acc2.getbalance(); acc2.deposit(sum); } } public double getbalance() { return balance; } } 30 31

16 To translate into our simple language we start from the main and statement after statement we do: When creating a new object with some initial value we create one variable for each instance variable created in the original program and give the correspondent initial value. Replace all loop constructor with while. For example for(int i=0; i<n; i++){...} is replaced by int i=0; while (i<n){...i++;}. We then replace all method calls with the method bodies (you learned that in Programming 1). Here is what we get in our example: acc1balance=1000; acc2balance=500; Lecture 2: Course page: pm/sar We have seen so far: Some models for systems: LTS, PM, KTS. That Java can be translated into the much smaller while language. sum=acc1balance+acc2balance; acc2balance=sum; 32 33

17 Small step operational semantics (SSOP) for the While language: We can give a reasonably simple mathematical description of the evaluation process of the while language; it is called operational semantics. The SSOP is a way to describe formally how a program of the While language is evaluated. It also tell us precisely how to build the program model of a program. Why would we want to do that? To simplify we assume our programs contain only variables of type int. Our first task is to formalize the idea of a computer memory 34 35

18 x y z w The syntax of our While language is defined using the Backus-Naur form as follows: Commands are: C ::= Var = E skip C; C if (BE) {C} else {C} while (BE) {C} where Var ::= x y z... Here x = 5, y = 3, z = 32, w =? and we don t care what is in the other memory cells E ::= Var E + E E E E E E/E n... We then define the memory M as a partial map from name of variables to int undefined on some argu- Why partial (i.e. ments)? M : Var int 36 BE ::= E == E E < E E > E E is the set of (arithmetic) expressions and BE is the set of (boolean) expressions. e.g. x = 5; if(x > 3){x = x 4} else {skip} 37

19 SSOP Rules The SSOP tell us what happen when we meet a particular command in a given memory; The definition is given case by case and has one of the two following shapes: (command, memory) (command, memory ) (command, memory) memory In this last case the computation has ended. assign: (v = e, M) v=e M [v=e] Here M [v=e] is the memory M where the variable v is now mapped to e, i.e. M [v=e] (v ) = M(v ) if v v M [v=e] (v ) = e if v = v skip: (skip, M) skip M A pair (command, memory) is called a configuration. seq1: seq2: (c 1,M) c M (c 1 ;c 2,M) c (c 2,M ) (c 1,M) c (c 1,M ) (c 1 ;c 2,M) c (c 1 ;c 2,M ) 38 39

20 The rules for if require first to evaluate the boolean expression involved. For example (x = 5, ɛ) x=5 ɛ [x=5] here ɛ is the map undefined on all variables, i.e. ɛ(y) is undefined for all variables y Notice that when there is no ambiguity we can drop the labels over the arrows, so the above can be written To understand the rule consider the following example: x=0; if (x>3) x=1; else x=2; What would x become? That depend on if (x>3) is true; but we know that the value of x in the memory is 0 (i.e. M(x) = 0 so (x>3) is false. (x = 5, ɛ) ɛ [x=5] So when we meet a conditional we have to evaluate the expression, that is we have to replace all variable in the expression with their values at that program point

21 Given an expression e and a memory M let s M(e) denotes the boolean value obtained by replacing all variables in e with their value in M, e.g. M(x < y) = true if M(x) < M(y) M(x < y) = false if M(x) >= M(y) and M(x < y) is undefined if M(x) or M(y) are undefined. if1: M(e)=true (if e c 1 else c 2, M) e (c 1,M) Let s see for example the SSOP of the program P defined as: x=4; while (Mod(x)) { x=x/2; x++; } The SSOP of a program usually start with the empty memory ɛ. (x = 4, ɛ) x=4 M 0 (rule assign) where if2: M(e)=false (if e c 1 else c 2, M)!e (c 2,M) M 0 (v) = 4 if v = x, and is undefined otherwise We don t need any rule for while. This is because we can use the following recursive identity: while-if: while e c if e {c; while e c}else skip 42 Hence (P, ɛ) x=4 (P 1, M 0 ) with P 1 = while(mod(x)){x = x/2; x + +; } (rule seq1) 43

22 By using again rules assign and seq1 we get Using while-if rule we get (x + +; P 1, M 1 ) x++ (P 1, M 2 ) P 1 = if(mod(x)){x = x/2; x + +; P 1 } else skip; with M 2 (v) = 3 if v = x, and is undefined otherwise and using if1 (because (Mod(4))=true) We reapply again the identity while-if to get we get (P 1, M 0 ) (Mod(4)) (x = x/2; x + +; P 1, M 0 ) P 1 = if(mod(x)){x = x/2; x + +; P 1 } else skip; Now by rule assign we get but now (Mod(3))=false so (x = x/2, M 0 ) x=x/2 M 1 (P 1, M 2 ) (Mod(3)) (skip, M 2 ) with M 1 (v) = 2 if v = x, and is undefined otherwise and (skip rule) so (x = x/2; x + +; P 1, M 0 ) x=x/2 (x + +; P 1, M 1 ) (rule seq1) 44 (skip, M 2 ) skip M 2 So as expected the computation finish with the memory holding the value 3 for x. 45

23 SSOP and program models The standard program model of a program is defined as: States are the configurations (i.e. the pairs (command, memory)) generated by its SSOP. Actions are assignments and boolean expressions. Transitions are defined by the small steps assign and if1, if2 rules. The start state is the initial configuration and end states are those with no successor. Example: (x = 4; while(mod(x)){x = x/2; x + +;}, ɛ) x=4 (P 1, M 0 ) Mod(4) (x = x/2; x + +; P 1, M 0 ) x=x/2 (x + +; P 1, M 1 ) x++ (P 1, M 2 )!Mod(3) (skip, M 2 ) skip M

24 What about while (Mod(x)) { x=x/2; x++; } where A standard program model represents a particular run of the program. Is there a program model which represents all possible runs? or programs where some variables are not instantiated? Mod(x) return true if x is even and false otherwise

25 When is the rule seq2 applied? First think of a sequence of statements c 1 ; c 2 ;... ; c n This sequence should be seen as a sequence of two statements: Lecture 3: c 1 and c 2 ;... ; c n the second being itself a sequence of statements. (In mathematical terms we are saying that sequencing associates to the right) 50 51

26 Consider x = 0; while(x < 2)x + +; y = x + 1; this is a sequence of three statements: A: x = 0; B: while(x < 2)x + +; C: y = x + 1; which, according to the previous slide, we will consider as a sequence of two statements: By evaluating A;B;C according to the SSOP we will first apply seq1 where c 1 =A and c 2 =B;C We will then be left to evaluate c 1 ; c 2 where c 1 =B and c 2 = C in the memory M [x=0] But now we cannot apply seq1 to B;C because there is no rule of the form (while e c, M) M A and B;C 52 53

27 The best we can do is something along the following lines: So when evaluating B;C we cannot use seq1 but we can use seq2. In general it is easy to see that (while e c, M) (if e{ c; while e c} else skip, M) and then apply the appropriate if rule and get either ( c; while e c, M) or ( skip, M) seq1 and seq2 are exclusive if1 and if2 are exclusive. (B,M [x=0] ) ( c;b, M [x=0] ) if x < 2 (B,M [x=0] ) ( skip, M [x=0] ) if x 2 This implies that the while language is deterministic, i.e. for a given input a program always return the same value. This implies that Java is deterministic

28 What about while (Mod(x)) { x=x/2; x++; } where Mod(x) return true if x is even and false otherwise. A standard program model represents a particular run of the program. Is there a program model which represents all possible runs? or programs where some variables are not instantiated? Do you remember what a flowchart is? 56 57

29 Recall that a memory is a map M : Var int. The way flowcharts are usually taught is by reading the code and thinking this is an assignment, here we have a decision... What we are doing there is to abstract from the program data. What happen if we consider instead a memory as a map M : Var { }, i.e. the map which gives to all variables the same value { }? Then at the node x = x/2 i.e. M(x) =! This abstraction of program data can be formally presented using what is called abstract interpretation, a techniques we will give an example now: In the flowchart case a rough abstraction would consists of taking a singleton as the only possible value for program variables (instead of int), Let s call flow memory the map M : Var { } 58 59

30 Let s now modify SSOP by changing if1, if2 as follows: AbstractIf1: (if e c 1 else c 2, M) e (c 1, M) AbstractIf2: (if e c 1 else c 2, M)!e (c 2, M) Compute the ASSOP for the following program using the flow memory map M : Var { } while(mod(x)){x = x/2; x + +;} Let s call ASSOP this modified SSOP (Abstract small step operational semantics) The flowchart of a program P is the standard program model of the ASSOP of P using the flow memory. Nodes=configurations or memories of the program Edges=transitions according to the ASSOP rules 60 61

31 (while(mod(x)) {x=x/2;x++}, [x=*]) Or when there is no risk of confusion we can simplify it as follows: x++ {*} x++ {*} ( x=x/2; x++;while(mod(x)){x=x/2;x++},[x=*]) x=x/2 {*} {*} x=x/2 (x++;while(mod(x)){x=x/2;x++},[x=*]) {*} 62 63

32 In general an abstraction of the memory will replace the real values in the memory with some property of those values: x y z w The even/odd memory, M : Var {e, o, } M(x) = e if x has an even value x y z w M(x) = o if x has an odd value M(x) = if we don t know x value o o e * 64 65

33 the ASSOP(even/odd memory) of while(mod(x)){x = x/2; x + +;} {*} The sign memory M : Var {e, o, } M(x) = + if x value is positive x++ M(x) = if x value is negative {o} {e} M(x) = if we don t know x sign x=x/2 what is the ASSOP (sign memory) of {*} while(mod(x)){x = x/2; x + +;}? 66 67

34 Let s define The point memory M : Var {3,!3, } M(x) = 3 if x = 3 Is the following the ASSOP (point memory ) of while(mod(x)){x = x/2; x + +;}? {*} x++ M(x) =!3 if x 3 M(x) = if we don t know which class x belongs to. {3} {!3} x=x/2 {*} 68 69

35 The memory maps flow, even/odd, sign and point are just examples of abstractions; For most particular problems we can create an appropriate abstraction; Abstraction is the holy grail of computer science; the only way to study systems with billions of states by abstracting them to systems with few thousands of states. Question: is ASSOP deterministic? 70