Arguing for program correctness and writing correct programs
|
|
- Lilian Jennings
- 5 years ago
- Views:
Transcription
1 Arguing for program correctness and writing correct programs Saying things about states, programs Program state s1: x=4, y=-1.5, A={ me, you, he Assertions about program states x=3 False in s1 (y=x) x>=0 True in s1 Programs connect pairs of states e.g. x := x+4 leads from s1 to a state where x is now 9 Assertions about programs {Q code {P FOR ALL STATES s,s : if Q was true in starting state s, and code finishes in state s, then R mus be true in ending state s {x>3 x := x+4 {x>6 {x>3 x := x+4 {x>10 true false (e.g.,start state when x=4) ABorgida 1 ABorgida 2 Instead of Easier notation in my lecture notes {x=3 x := x+4 {x>6 we will write // x = 3 x := x + 4 // x > 6 We use x := x+4 for the Java assignment statement x = x+4; because otherwise equality = in logical formulas is confused with = in assignment statements. Reasoning about programs in general //PREcondition: what you assume in order for the program to work correctly //POSTcondition: what you want your program to ensure/ accomplish ABorgida 3 ABorgida 4
2 Reasoning about assignment statements BACKWARDS! The weakest condition that holds before an assignment x := e which guarantees condition P afterwards is { P with x replaced by e // (y + x) z > (y+x)/2 y := y + x; // y z > y/2 (A condition p is weaker than q, if q implies p. e.g. y>1 implies y>0 so y>0 is weaker than y>1 ) Proof for a Hoare assertion about assignment Therefore, to prove {Q x := e {P step #1 {P with x replaced by e x := e {P step #2 >>> show Q implies {P with x replaced by e using algebra,logic //PRE y > 0 >>>> show y> 0 implies y+4=1 // y + 4 > 1 x:= 4; // y + x > 1 y := y + x; // y > 1 ABorgida 5 ABorgida 6 (Aside, only for those who care: why the rule {P x :=e {P with x replaced by e is wrong ) Try reasoning forward from PRE to POST here //PRE: y = 4 y := y + 3; // y + 3 = 4 >>> y = 4-3 // POST: y= 1 Initial state: y will be 4 in memory This would be the result of applying the forward rule But in the final state the above program y will be 7, not 1!!! (Aside, only for those who care: why Epp s way of using x old and x new does not work in general ) Try reasoning forward from PRE to POST here //PRE: y = 4 // y old = 4 y := y + 1; // y new = y old + 1 y := y + 1; // y new = y old + 1 which leaves y new = 5, not 6 as desired. One would have to go on to use ( y new ) new etc. ABorgida 7 ABorgida 8
3 Simple example Reasoning about Loops with Invariants //PRE: true //POST: sum = Unfortunately, there is no weakest precondition for loops, which you can drive back, as for assignment. ABorgida 9 ABorgida 10 What is a loop invariant? A loop invariant INV is an assertion about relationship between program variables. It is used like P(n) in induction, but n is counting the number of times thru the loop, so it doesn t appear in our formulas. //PRE: What is assumed for the program to work <Set-up> // need INV true here [Prove Basis P(0)] while ( TEST CONDITION C) { // have INV here [assume I.H. P(k)] <Loop body> // need INV here [Prove P(k+1)] // therefore have INV here [Have proven by induction Forall n P(n) //POST: What is desired at the end (Between the top and bottom of the loop, headway is being made towards reaching the loop's goal. This might disturb (make false) the invariant. The point of Loop Invariants is the promise that the invariant will be What is a loop invariant? Augment the preceding with knowledge about how WHILE loop works by testing the loop condition //PRE: What is assumed for the program to work <Set-up> // need INV here while ( TEST CONDITION C) { // have INV here & C <Loop body> // need INV here // therefore have INV here & ( C) //POST: What is desired at the end restored before repeating the loop body each time.) ABorgida 12 ABorgida 11
4 Loop invariant in pictures A formal statement INV about the relationship between variables in your program. needs to be proven true just before the loop is ever run (establishing the invariant) [Induction basis] assume/have it true at the top of loop, when you enter it [Induction Hypothesis] needs to be proven true again at the bottom of the loop, after the loop body is executed (maintaining the invariant). infer at the exit from the loop it is still true! (by induction on # of times thru loop) enter loop body body body exit INV INV INV loop INV & C & C & C & C because we got into the body because we exited ABorgida 14 ABorgida 13 Simple example (cont d) //PRE: //POST: sum = Think about why program works? Trace it 2. Find an INV 3. Then show post condition is implied by INV 4. Then show the loop body maintain INV (it is an invariant) 5. Then show the set-up establishes INV. Simple example guessing an invariant by tracing //PRE: //POST: sum = k sum = = = Where INV belongs in this program //have PRE : << just before loop begins //need INV: sum = k (prove) << just after loop entry //have INV&: (sum= k)&(k 25) (assume) INV: sum = k << at end of loop body //need INV: sum = k (prove) << just after loop exit //have INV+: sum = k) & k=25 (proven) //need POST: sum = (prove) ABorgida 15 ABorgida 16
5 Proof obligations //PRE: true // INV: sum = k (prove true here) #A // INV&: sum = k & k 25 (assume here) #B // INV: sum = k (prove true here) #C // INV+: sum = k & k=25 (proven by now) #D //need POST: sum = We will not be able to go top-down, because the assignment := rule is backwards/bottom-up. So, we will have to show #D implies POST push #C backwards through the body, and then show #B implies it push #A backwards through the initialization, and show PRE implies it ABorgida 17 i) Prove POST implied //PRE: true #1 // INV: sum = k (prove) #4 // INV : sum = k &(k 25) (assume) #5 // INV: sum = k (prove) #8 // INV : sum = k & (k=25) (have) #9 >>> show #9! #10: just substitute 25 for k, & drop 0 //POST: sum = (prove) #10 ABorgida 18 ii) Push backward invariant in loop body using assignment //PRE: true // INV: sum = k (prove) // INV : sum = k &(k 25) (assume) ii) Push backward invariant (cont d) //PRE: true // INV: sum = k (prove) // INV : sum = k &(k 25) (assume) // sum + k := k // INV: sum = k (prove) // INV : sum = k & (k=25) >>> #9! #10 //need POST: sum = // sum + (k+1) = (k+1) // sum + k := k // INV: sum = k (prove) // INV : sum = k & (k = 25) have >>> #9! #10 //need POST: sum = ABorgida 19 ABorgida 20
6 iii) Prove #5 implies #6 //PRE: true #1 iv) Push INV at #4 back //PRE: true #1 // INV: sum = k (prove) #4 // INV : sum = k &(k 25) (assume) #5 >>>show #5! #6: subtract (k+1) from both sides of #6 // sum + (k+1) = (k+1) #6 // sum + k := k #7 // INV: sum = k (prove) #8 // INV : sum = k & (k=25) (have) #9 >>> #9! #10: //POST: sum = (prove) #10 ABorgida 21 // k = k #3 // INV: sum = k (prove) #4 // INV&: sum = k &(k 25) (assume) #5 >>> #5! #6 // sum + (k+1) = (k+1) #6 // sum + k := k #7 // INV: sum = k (prove) #8 // INV+: sum = k & (k=25) (have) #9 >>> #9! #10: //POST: sum = (prove) #10 ABorgida 22 iv) Push INV at #4 back (cont d) //PRE: true #1 // 0 = #2 // k = k #3 // INV: sum = k (prove) #4 // INV&: sum = k &(k 25) (assume) #5 >>> #5! #6 // sum + (k+1) = (k+1) #6 // sum + k := k #7 // INV: sum = k (prove) #8 // INV+: sum = k & (k=25) (have) #9 >>> #9! #10: //POST: sum = (prove) #10 ABorgida 23 v) Show #2 is implied by #1 //PRE: true #1 >>> show #1! #2: obviously true // 0 = #2 // k = k #3 // INV: sum = k (prove) #4 // INV&: sum = k &(k 25) (assume) #5 >>> #5! #6 // sum + (k+1) = (k+1) #6 // sum + k := k #7 // INV: sum = k (prove) #8 // INV+: sum = k & (k=25) (have) #9 >>> #9! #10: //POST: sum = (prove) #10 ABorgida 24
7 DONE! ABorgida 25 Identical proof for 25 replaced by N //PRE: true #1 >>>#1! #2: obviously true // 0 = #2 // k := k #3 // INV: sum = k (prove) #4 while (k!= N) { // INV&: sum = k &(k N) (assume) #5 >>> #5! #6: subtract (k+1) from both sides of #6 // sum + (k+1) = (k+1) #6 // sum + k := k #7 // INV: sum = k (prove) #8 // INV+: sum = k & (k=n) (have) #9 >>> #9! #10: substitute N for k //POST: sum = N (prove) #10 ABorgida 26 Can we find mistakes using invariants? Lets swap the two lines inside the loop: //PRE: //POST: sum = k sum = = = INV : sum = (k-1) Does INV (k=25) imply POST? INV (k=25) is sum = (25-1) which does not imply POST!! Bad program. (Proof gives you a hint on how to fix it: (k!=26) ABorgida 27 Multiplication program 1 //PRE: true // Strategy: 1. Find a reasonable INV 2. Check it guarantees POST, once the loop stops 3. Then show the loop body maintains INV 4. And then show the set-up establishes INV (Notation: on assignments, etc we will use function( int m, int n) to indicate that m and n are inputs, and will not change these.) ABorgida 29
8 // PRE: true y:= y + n; x:= x + 1; // Multiplication program 1 There are infinitely many (useless) loop invariants! look for something that when the loop ends guarantees the needed condition afterwards; understand how code works. (Repeated addition Trace the loop to see what values variables take, and so what conditions relate them.also ask yourself why should this program work x y n m n * Conjecture: INV is (y=x*n). 2 2n 3 3n ABorgida 30 Multiplication program 1 proof pattern After guessing an invariant INV, we will fill the following pattern: >>> prove PRE implies H H) is INV established before loop? G) F) need INV E) have INV & (x!= m) >>> prove E implies D D) C) B) need INV A) have INV & (x=m) >>> prove A implies POST is INV maintained by the loop body? is POST established by INV& C? ABorgida 31 Multiplication program 1:fill in proof pattern >>> prove PRE implies H H) G) >>> prove E implies D D) C) Multiplication program 1:fill in proof pattern >>> prove PRE -> H H) G) >>> prove E implies D D) C) need y=(x+1)*n >>> prove A implies POST y=x*n & x=m y=m*n >>> A implies POST ABorgida 33 ABorgida 34
9 Multiplication program 1:fill in proof pattern >>> prove PRE -> H H) G) >>> prove E implies D D) need (y+n)=(x+1)*n C) need y=(x+1)*n >>> A implies POST Multiplication program 1:fill in proof pattern >>> prove PRE -> H H) G) >>> prove E implies D D) need (y+n)=(x+1)*n C) need y=(x+1)*n >>> A implies POST D is y+n=x*n+n; subtract n from both sides, leaving y=x*n E implies this. QED ABorgida 35 ABorgida 36 Multiplication program 1:fill in proof pattern >>> prove PRE -> H H) G) need y=0*n >>> E implies D D) need (y+n)=(x+1)*n C) need y=(x+1)*n >>> A implies POST Multiplication program 1:fill in proof pattern >>> prove PRE -> H H) need 0=0*n G) need y=0*n >>> E implies D D) need (y+n)=(x+1)*n C) need y=(x+1)*n >>> A implies POST ABorgida 37 ABorgida 38
10 Multiplication program 1:fill in proof pattern >>> prove PRE implies H H) need 0=0*n G) need y=0*n >>> E implies D D) need (y+n)=(x+1)*n C) need y=(x+1)*n >>> A implies POST True 0=0 QED Summary of approach 1. Guess at an invariant INV such that INV& Cond! POST 2. Leave blank lines between code text lines 3. Work your way up filling in the blanks using Hoare or regular logic //have PRE: >>> algebra/logic proof <intialization code> //need INV: while (Cond) { // have INV & Cond: >>> algebra/logic proof <loop body> // need INV: // have INV & Cond >>> algebra/logic proof // need POST: ABorgida 39 ABorgida 40 Summary of proof for multiplication 1 have PRE: True >>> Prove True! 0=0*n [algebra] need 0 = 0*n need y=0*n need INV: y=x*n have INV & C: y=x*n & x!=m >>> prove (y=x*n & x!=m)! y+n=(x+1)*n [algebra] need y+n = (x+1)*n need y=(x+1)*n need INV: y=x*n have INV & ~C == y=x*n & ~(x!=m) >>> prove previous line! POST [algebra] Another multiplication program 2 PRE: 0 <= m while (x < m) { trace the loop to see what values variables take, and so what conditions relate them x y n 2 2n Conjecture: INV is still (y=x*n). Verify that INV /\ ~(x < m) implies y=m*n -- see next page ABorgida 41 ABorgida 42
11 multiplication program 2 Finding the right invariant that implies POST Conjecture: INV is (y=n*x). Verify that INV & (x < m) (y=n*x) & (x>=m) implies y=m*n OUCH! It does not! So we need to strengthen the invariant so it makes x=m. Can do so by adding (x <= m) to INV, because this together with (x>=m) yields x=m. Let INV in this case be (y=n*x) & (x <= m) multiplication program 2 proof outline PRE:??? >>> show PRE -> A A) B) C) need INV: y=x*n & x<=m while (x < m) { D) have INV & C: y=x*n & x<=m & x<m >>> show D -> D D ) E) & x<=m G)have INV & ~C: y=x*n & x<=m & ~(x < m) >>> show G -> POST (done) Then INV & (x>=m) does imply x=m, and hence y=m*n, POST ABorgida 44 ABorgida 43 multiplication program 2 push back invariant PRE:??? need y=x*n & x<=m while (x < m) { //D: have y=x*n & x<=m & x<m //>>> show D! D using algebra // D : need (y+n)=(x+1)*n & (x+1) <= m // E: need y=(x+1)*n & (x+1) <= m // F: need y=x*n & x<=m have y=x*n & x<=m & ~(x < m) multiplication program 2 push back invariant PRE:??? need y=x*n & x<=m while (x < m) { //D: have y=x*n & x<=m & x<m //>>> show D! D using algebra // D : need (y+n)=(x+1)*n & (x+1) <= m // E: need y=(x+1)*n & (x+1) <= m // F: need y=x*n & x<=m have y=x*n & x<=m & ~(x < m) y=x*n implies y+n=x*n+n; if x and m are integers, then x<m implies x+1<=m QED ABorgida 45 ABorgida 46
12 mult program 2 - establish INV before loop PRE: //??? >>> prove PRE -> A A // 0=0*n & 0<=m // y=0*n & 0<=m // INV:need y=x*n & x<=m while (x < m) { // now y=x*n & x<=m & x<m // need (y+n)=(x+1)*n & (x+1) <= m // need y=(x+1)*n & (x+1) <= m // need y=x*n & x<=m // now y=x*n & x<=m & ~(x < m) // So PRE needs to ensure (0<=m) ABorgida 47 PRE: true while (x <= m) { multiplication program 3 trace the loop to see what values variables take, and so what conditions relate them x y Conjecture: 0 0 INV3 is INV2: (y=n*x) & (x<=m) 1 n Verify that INV2 /\ ~(x <= m) imply y=m*n. 2 2n (y=n*x) & (x<=m) & x>m false which implies anything. But sign of something amiss ABorgida 48 PRE:??? multiplication program 3 while (x <= m) { // have INV2 & (x<=m): (y=x*n & x<=m) & x<=m // need INV: y=x*n & x<=m here INV2 & ~(x<=m): (y=x*n & x<=m) & ~(x <= m) Try to prove that INV2 is in fact loop invariant PRE:??? multiplication program 3 OOPS: Logic & algebra do not give P4->P3!!! INV2 is not a loop invariant! while (x <= m) { // INV : have y=x*n & x<=m & x<=m >>>> prove that P4 P3 using algebra // P3: need (y+n)=(x+1)*n & (x+1) <= m // P2: need y=(x+1)*n & (x+1) <= m // INV: need y=x*n & x<=m here y=x*n & x<=m & ~(x <= m) ABorgida 49 ABorgida 50
13 PRE:??? multiplication program 3 OOPS: Logic & algebra do not give P4->P3!!! INV2 is not a loop invariant! while (x <= m) { // INV : have y=x*n & x<=m & x<=m >>>> prove that P4 P3 using algebra // P3: need (y+n)=(x+1)*n & (x+1) <= m // P2: need y=(x+1)*n & (x+1) <= m // INV: need y=x*n & x<=m here y=x*n & x<=m & ~(x <= m) What does this program compute? y=(m+1)*n. So there should be no loop invariant to show that it computes y=m*n Programs with counter pattern k := <init> while (k!= m) {... k := k + 1 Such programs tend to make an invariant hold for a range of values from <init> to k, so that at the end of the loop, when k=m, it holds for an entire range. ABorgida 51 ABorgida 52
Lecture Notes: Hoare Logic
Lecture Notes: Hoare Logic 17-654/17-754: Analysis of Software Artifacts Jonathan Aldrich (jonathan.aldrich@cs.cmu.edu) Lecture 3 1 Hoare Logic The goal of Hoare logic is to provide a formal system for
More informationHoare Logic: Proving Programs Correct
Hoare Logic: Proving Programs Correct 17-654/17-765 Analysis of Software Artifacts Jonathan Aldrich Reading: C.A.R. Hoare, An Axiomatic Basis for Computer Programming Some presentation ideas from a lecture
More informationAXIOMS OF AN IMPERATIVE LANGUAGE PARTIAL CORRECTNESS WEAK AND STRONG CONDITIONS. THE AXIOM FOR nop
AXIOMS OF AN IMPERATIVE LANGUAGE We will use the same language, with the same abstract syntax that we used for operational semantics. However, we will only be concerned with the commands, since the language
More informationBackward Reasoning: Rule for Assignment. Backward Reasoning: Rule for Sequence. Simple Example. Hoare Logic, continued Reasoning About Loops
Backward Reasoning: Rule for Assignment Hoare Logic, continued Reasoning About Loops { wp( x=expression,q) x = expression; { Q Rule: the weakest precondition wp( x=expression,q) is Q with all occurrences
More informationLecture 5 - Axiomatic semantics
Program Verification March 2014 Lecture 5 - Axiomatic semantics Lecturer: Noam Rinetzky Scribes by: Nir Hemed 1.1 Axiomatic semantics The development of the theory is contributed to Robert Floyd, C.A.R
More informationPart II. Hoare Logic and Program Verification. Why specify programs? Specification and Verification. Code Verification. Why verify programs?
Part II. Hoare Logic and Program Verification Part II. Hoare Logic and Program Verification Dilian Gurov Props: Models: Specs: Method: Tool: safety of data manipulation source code logic assertions Hoare
More informationHardware versus software
Logic 1 Hardware versus software 2 In hardware such as chip design or architecture, designs are usually proven to be correct using proof tools In software, a program is very rarely proved correct Why?
More informationMathematical Induction
Mathematical Induction Victor Adamchik Fall of 2005 Lecture 3 (out of three) Plan 1. Recursive Definitions 2. Recursively Defined Sets 3. Program Correctness Recursive Definitions Sometimes it is easier
More informationOutline. Introduction. 2 Proof of Correctness. 3 Final Notes. Precondition P 1 : Inputs include
Outline Computer Science 331 Correctness of Algorithms Mike Jacobson Department of Computer Science University of Calgary Lectures #2-4 1 What is a? Applications 2 Recursive Algorithms 3 Final Notes Additional
More informationReview: Hoare Logic Rules
Review: Hoare Logic Rules wp(x := E, P) = [E/x] P wp(s;t, Q) = wp(s, wp(t, Q)) wp(if B then S else T, Q) = B wp(s,q) && B wp(t,q) Proving loops correct First consider partial correctness The loop may not
More informationCITS5501 Software Testing and Quality Assurance Formal methods
CITS5501 Software Testing and Quality Assurance Formal methods Unit coordinator: Arran Stewart May 1, 2018 1 / 49 Sources Pressman, R., Software Engineering: A Practitioner s Approach, McGraw-Hill, 2005
More informationReasoning About Imperative Programs. COS 441 Slides 10
Reasoning About Imperative Programs COS 441 Slides 10 The last few weeks Agenda reasoning about functional programming It s very simple and very uniform: substitution of equal expressions for equal expressions
More informationAn Annotated Language
Hoare Logic An Annotated Language State and Semantics Expressions are interpreted as functions from states to the corresponding domain of interpretation Operators have the obvious interpretation Free of
More informationRecall our recursive multiply algorithm:
Recall our recursive multiply algorithm: PRECONDITION: x and y are both binary bit arrays of length n, n a power of 2. POSTCONDITION: Returns a binary bit array equal to the product of x and y. REC MULTIPLY
More informationFormal Methods. CITS5501 Software Testing and Quality Assurance
Formal Methods CITS5501 Software Testing and Quality Assurance Pressman, R. Software Engineering: A Practitioner s Approach. Chapter 28. McGraw-Hill, 2005 The Science of Programming, David Gries, 1981
More informationCS 1110: Introduction to Computing Using Python Loop Invariants
CS 1110: Introduction to Computing Using Python Lecture 21 Loop Invariants [Andersen, Gries, Lee, Marschner, Van Loan, White] Announcements Prelim 2 conflicts due by midnight tonight Lab 11 is out Due
More informationLecture 1 Contracts : Principles of Imperative Computation (Fall 2018) Frank Pfenning
Lecture 1 Contracts 15-122: Principles of Imperative Computation (Fall 2018) Frank Pfenning In these notes we review contracts, which we use to collectively denote function contracts, loop invariants,
More informationRecursion and Induction
Recursion and Induction Paul S. Miner NASA Langley Formal Methods Group p.s.miner@nasa.gov 28 November 2007 Outline Recursive definitions in PVS Simple inductive proofs Automated proofs by induction More
More informationCS 161 Computer Security
Wagner Spring 2014 CS 161 Computer Security 1/27 Reasoning About Code Often functions make certain assumptions about their arguments, and it is the caller s responsibility to make sure those assumptions
More informationReasoning about programs
Reasoning about programs Last time Coming up This Thursday, Nov 30: 4 th in-class exercise sign up for group on moodle bring laptop to class Final projects: final project presentations: Tue Dec 12, in
More informationLast time. Reasoning about programs. Coming up. Project Final Presentations. This Thursday, Nov 30: 4 th in-class exercise
Last time Reasoning about programs Coming up This Thursday, Nov 30: 4 th in-class exercise sign up for group on moodle bring laptop to class Final projects: final project presentations: Tue Dec 12, in
More informationQualifying Exam Languages
Illinois Institute of Technology Department of Computer Science Qualifying Exam Languages Fall 2015 This is a closed book and closed notes exam. Do ALL problems in this booklet. Read each question very
More informationComplexity, Induction, and Recurrence Relations. CSE 373 Help Session 4/7/2016
Complexity, Induction, and Recurrence Relations CSE 373 Help Session 4/7/2016 Big-O Definition Definition: g(n) is in O( f(n) ) if there exist positive constants c and n0 such that g(n) c f(n) for all
More informationReadability [Skrien 4.0] Programs must be written for people to read, and only incidentally for machines to execute.
Readability [Skrien 4.0] Programs must be written for people to read, and only incidentally for machines to execute. Abelson & Sussman Use a good set of coding conventions, such as the ones given in the
More informationa correct statement? You need to know what the statement is supposed to do.
Using assertions for correctness How can we know that software is correct? It is only correct if it does what it is supposed to do. But how do we know what it is supposed to do? We need a specification.
More information1 The sorting problem
Lecture 6: Sorting methods - The sorting problem - Insertion sort - Selection sort - Bubble sort 1 The sorting problem Let us consider a set of entities, each entity having a characteristics whose values
More informationLecture 1 Contracts. 1 A Mysterious Program : Principles of Imperative Computation (Spring 2018) Frank Pfenning
Lecture 1 Contracts 15-122: Principles of Imperative Computation (Spring 2018) Frank Pfenning In these notes we review contracts, which we use to collectively denote function contracts, loop invariants,
More informationSpecifications. Prof. Clarkson Fall Today s music: Nice to know you by Incubus
Specifications Prof. Clarkson Fall 2015 Today s music: Nice to know you by Incubus Question Would you like a tiny bonus to your final grade for being here on time today? A. Yes B. Sí C. Hai D. Haan E.
More informationSoftware Architecture. Abstract Data Types
Software Architecture Abstract Data Types Mathematical description An ADT is a mathematical specification Describes the properties and the behavior of instances of this type Doesn t describe implementation
More informationHarvard School of Engineering and Applied Sciences CS 152: Programming Languages
Harvard School of Engineering and Applied Sciences CS 152: Programming Languages Lecture 19 Tuesday, April 3, 2018 1 Introduction to axiomatic semantics The idea in axiomatic semantics is to give specifications
More informationCS Lecture 19: Loop invariants
CS 1110 Lecture 19: Loop invariants Announcements Prelim 2 conflicts Today (April 2) is two weeks before the prelim, and the deadline for submitting prelim conflicts. Instructor travel This week and the
More informationSemantics. There is no single widely acceptable notation or formalism for describing semantics Operational Semantics
There is no single widely acceptable notation or formalism for describing semantics Operational Describe the meaning of a program by executing its statements on a machine, either simulated or actual. The
More informationCIS 500 Software Foundations. Final Exam. May 3, Answer key
CIS 500 Software Foundations Final Exam May 3, 2012 Answer key This exam includes material on the Imp language and the simply-typed lambda calculus. Some of the key definitions are repeated, for easy reference,
More information6.170 Lecture 6 Procedure specifications MIT EECS
6.170 Lecture 6 Procedure specifications MIT EECS Outline Satisfying a specification; substitutability Stronger and weaker specifications Comparing by hand Comparing via logical formulas Comparing via
More informationVerifying Safety Property of Lustre Programs: Temporal Induction
22c181: Formal Methods in Software Engineering The University of Iowa Spring 2008 Verifying Safety Property of Lustre Programs: Temporal Induction Copyright 2008 Cesare Tinelli. These notes are copyrighted
More informationFall Recursion and induction. Stephen Brookes. Lecture 4
15-150 Fall 2018 Stephen Brookes Lecture 4 Recursion and induction Last time Specification format for a function F type assumption guarantee (REQUIRES) (ENSURES) For all (properly typed) x satisfying the
More informationAnnouncements. CS243: Discrete Structures. Strong Induction and Recursively Defined Structures. Review. Example (review) Example (review), cont.
Announcements CS43: Discrete Structures Strong Induction and Recursively Defined Structures Işıl Dillig Homework 4 is due today Homework 5 is out today Covers induction (last lecture, this lecture, and
More informationSymbolic Execution and Proof of Properties
Chapter 7 Symbolic Execution and Proof of Properties Symbolic execution builds predicates that characterize the conditions under which execution paths can be taken and the effect of the execution on program
More informationIntroduction to Axiomatic Semantics
Introduction to Axiomatic Semantics Meeting 10, CSCI 5535, Spring 2009 Announcements Homework 3 due tonight Homework 2 is graded 13 (mean), 14 (median), out of 21 total, but Graduate class: final project
More informationCORRECTNESS ISSUES AND LOOP INVARIANTS
Aout A2 and feedack. Recursion 2 CORRECTNESS ISSUES AND LOOP INVARIANTS S2 has een graded. If you got 30/30, you will proaly have no feedack. If you got less than full credit, there should e feedack showing
More informationOverview. A mathema5cal proof technique Proves statements about natural numbers 0,1,2,... (or more generally, induc+vely defined objects) Merge Sort
Goals for Today Induc+on Lecture 22 Spring 2011 Be able to state the principle of induc+on Iden+fy its rela+onship to recursion State how it is different from recursion Be able to understand induc+ve proofs
More informationCS158 Section B Exam 1 Key
CS158 Section B Exam 1 Key Name This is a closed-book exam. The only items not supplied that you are allowed to use are writing implements. You have 50 minutes to complete this exam. The total amount of
More informationFundamentals of Software Engineering
Fundamentals of Software Engineering Reasoning about Programs - Selected Features Ina Schaefer Institute for Software Systems Engineering TU Braunschweig, Germany Slides by Wolfgang Ahrendt, Richard Bubel,
More informationHow invariants help writing loops Author: Sander Kooijmans Document version: 1.0
How invariants help writing loops Author: Sander Kooijmans Document version: 1.0 Why this document? Did you ever feel frustrated because of a nasty bug in your code? Did you spend hours looking at the
More informationCorrectness of specifications. Correctness. Correctness of specifications (2) Example of a Correctness Proof. Testing versus Correctness Proofs
CS 390 Lecture 17 Correctness A product is correct if it satisfies its output specifications when operated under permitted conditions Correctness of specifications Incorrect specification for a sort (Figure
More informationConcurrent Programming Lecture 3
Concurrent Programming Lecture 3 3rd September 2003 Atomic Actions Fine grain atomic action We assume that all machine instructions are executed atomically: observers (including instructions in other threads)
More informationASYMPTOTIC COMPLEXITY
Simplicity is a great virtue but it requires hard work to achieve it and education to appreciate it. And to make matters worse: complexity sells better. - Edsger Dijkstra ASYMPTOTIC COMPLEXITY Lecture
More informationLectures 20, 21: Axiomatic Semantics
Lectures 20, 21: Axiomatic Semantics Polyvios Pratikakis Computer Science Department, University of Crete Type Systems and Static Analysis Based on slides by George Necula Pratikakis (CSD) Axiomatic Semantics
More informationVerification Condition Generation
Verification Condition Generation Jorge Sousa Pinto Departamento de Informática / Universidade do Minho jsp@di.uminho.pt www.di.uminho.pt/~jsp Outline (1) - From Hoare Logic to VCGen algorithms: an architecture
More informationSECTION 1: CODE REASONING + VERSION CONTROL
SECTION 1: CODE + OUTLINE Introductions Code Reasoning Forward Reasoning Backward Reasoning Weaker vs. Stronger statements Version control CSE 331 Summer 2018 slides borrowed and adapted from Alex Mariakis
More informationLecture Notes on Contracts
Lecture Notes on Contracts 15-122: Principles of Imperative Computation Frank Pfenning Lecture 2 August 30, 2012 1 Introduction For an overview the course goals and the mechanics and schedule of the course,
More information12/30/2013 S. NALINI,AP/CSE
12/30/2013 S. NALINI,AP/CSE 1 UNIT I ITERATIVE AND RECURSIVE ALGORITHMS Iterative Algorithms: Measures of Progress and Loop Invariants-Paradigm Shift: Sequence of Actions versus Sequence of Assertions-
More informationSpark verification features
Spark verification features Paul Jackson School of Informatics University of Edinburgh Formal Verification Spring 2018 Adding specification information to programs Verification concerns checking whether
More informationSECTION 1: CODE REASONING + VERSION CONTROL
SECTION 1: CODE + OUTLINE Introductions Code Reasoning Forward Reasoning Backward Reasoning Weaker vs. Stronger statements Version control CSE 331 Spring 2018 slides borrowed and adapted from Alex Mariakis
More informationChapter 3 (part 3) Describing Syntax and Semantics
Chapter 3 (part 3) Describing Syntax and Semantics Chapter 3 Topics Introduction The General Problem of Describing Syntax Formal Methods of Describing Syntax Attribute Grammars Describing the Meanings
More information(a) (4 pts) Prove that if a and b are rational, then ab is rational. Since a and b are rational they can be written as the ratio of integers a 1
CS 70 Discrete Mathematics for CS Fall 2000 Wagner MT1 Sol Solutions to Midterm 1 1. (16 pts.) Theorems and proofs (a) (4 pts) Prove that if a and b are rational, then ab is rational. Since a and b are
More informationProgramming Languages Third Edition
Programming Languages Third Edition Chapter 12 Formal Semantics Objectives Become familiar with a sample small language for the purpose of semantic specification Understand operational semantics Understand
More informationCSE 20 DISCRETE MATH WINTER
CSE 20 DISCRETE MATH WINTER 2016 http://cseweb.ucsd.edu/classes/wi16/cse20-ab/ Today's learning goals Explain the steps in a proof by (strong) mathematical induction Use (strong) mathematical induction
More information#23: Sequences March 28, 2009
#23: Sequences March 28, 2009 a mysterious rule easy peasy Suppose n is an integer, and consider this simple rule: if n is even, divide it by two; otherwise, multiply n by 3, and add one. Pretty simple,
More informationSEQUENCES, MATHEMATICAL INDUCTION, AND RECURSION
CHAPTER 5 SEQUENCES, MATHEMATICAL INDUCTION, AND RECURSION Alessandro Artale UniBZ - http://www.inf.unibz.it/ artale/ SECTION 5.5 Application: Correctness of Algorithms Copyright Cengage Learning. All
More informationHoare Logic. COMP2600 Formal Methods for Software Engineering. Rajeev Goré
Hoare Logic COMP2600 Formal Methods for Software Engineering Rajeev Goré Australian National University Semester 2, 2016 (Slides courtesy of Ranald Clouston) COMP 2600 Hoare Logic 1 Australian Capital
More informationFundamental mathematical techniques reviewed: Mathematical induction Recursion. Typically taught in courses such as Calculus and Discrete Mathematics.
Fundamental mathematical techniques reviewed: Mathematical induction Recursion Typically taught in courses such as Calculus and Discrete Mathematics. Techniques introduced: Divide-and-Conquer Algorithms
More informationBasic Verification Strategy
ormal Verification Basic Verification Strategy compare behavior to intent System Model of system behavior intent Verifier results Intent Usually, originates with requirements, refined through design and
More informationProgram Verification. Aarti Gupta
Program Verification Aarti Gupta 1 Agenda Famous bugs Common bugs Testing (from lecture 6) Reasoning about programs Techniques for program verification 2 Famous Bugs The first bug: A moth in a relay (1945)
More informationCompositional Cutpoint Verification
Compositional Cutpoint Verification Eric Smith (Stanford University) Collaborators: David Dill (Stanford University) David Hardin (Rockwell Collins) Contact ewsmith@stanford.edu Background Based on A Symbolic
More informationAnnouncements. Specifications. Outline. Specifications. HW1 is due Thursday at 1:59:59 pm
Announcements HW1 is due Thursday at 1:59:59 pm Specifications 2 Outline Specifications Benefits of specifications Specification conventions Javadoc JML PoS specifications Specifications A specification
More informationCompiler Design Prof. Y. N. Srikant Department of Computer Science and Automation Indian Institute of Science, Bangalore
Compiler Design Prof. Y. N. Srikant Department of Computer Science and Automation Indian Institute of Science, Bangalore Module No. # 10 Lecture No. # 16 Machine-Independent Optimizations Welcome to the
More informationTesting, Debugging, and Verification
Testing, Debugging, and Verification Formal Specification, Part II Srinivas Pinisetty 23 November 2017 Introduction Today: Introduction to Dafny: An imperative language with integrated support for formal
More informationThe Rule of Constancy(Derived Frame Rule)
The Rule of Constancy(Derived Frame Rule) The following derived rule is used on the next slide The rule of constancy {P } C {Q} {P R} C {Q R} where no variable assigned to in C occurs in R Outline of derivation
More informationFormal Methods of Software Design, Eric Hehner, segment 24 page 1 out of 5
Formal Methods of Software Design, Eric Hehner, segment 24 page 1 out of 5 [talking head] This lecture we study theory design and implementation. Programmers have two roles to play here. In one role, they
More informationSECTION 5.1. Sequences
SECTION 5.1 Sequences Sequences Problem: count number of ancestors one has 2 parents, 4 grandparents, 8 greatgrandparents,, written in a row as 2, 4, 8, 16, 32, 64, 128, To look for pattern of the numbers,
More informationSection 1.4 Proving Conjectures: Deductive Reasoning
Section 1.4 Proving Conjectures: Deductive Reasoning May 9 10:15 AM 1 Definition: Proof: A mathematical argument showing that a statement is valid in all cases, or that no counterexample exists. Generalization:
More informationWhat is Iteration? CMPT-101. Recursion. Understanding Recursion. The Function Header and Documentation. Recursively Adding Numbers
What is Iteration? CMPT-101 Week 6 Iteration, Iteration, Iteration, Iteration, Iteration, Iteration,... To iterate means to do the same thing again and again and again and again... There are two primary
More informationWarm-Up Problem. 1. What is the definition of a Hoare triple satisfying partial correctness? 2. Recall the rule for assignment: x (assignment)
Warm-Up Problem 1 What is the definition of a Hoare triple satisfying partial correctness? 2 Recall the rule for assignment: x (assignment) Why is this the correct rule and not the following rule? x (assignment)
More informationLecture 10 Design by Contract
CS 5959 Writing Solid Code Fall 2015 Nov-23 Lecture 10 Design by Contract Zvonimir Rakamarić University of Utah Design by Contract Also called assume-guarantee reasoning Developers annotate software components
More informationChecking Program Properties with ESC/Java
Checking Program Properties with ESC/Java 17-654/17-765 Analysis of Software Artifacts Jonathan Aldrich 1 ESC/Java A checker for Java programs Finds null pointers, array dereferences Checks Hoare logic
More informationChapter 3. Describing Syntax and Semantics ISBN
Chapter 3 Describing Syntax and Semantics ISBN 0-321-49362-1 Chapter 3 Topics Describing the Meanings of Programs: Dynamic Semantics Copyright 2015 Pearson. All rights reserved. 2 Semantics There is no
More informationIntroduction to Axiomatic Semantics (1/2)
#1 Introduction to Axiomatic Semantics (1/2) How s The Homework Going? Remember: just do the counterexample guided abstraction refinement part of DPLL(T). If you notice any other errors, those are good
More informationUnit #3: Recursion, Induction, and Loop Invariants
Unit #3: Recursion, Induction, and Loop Invariants CPSC 221: Basic Algorithms and Data Structures Jan Manuch 2017S1: May June 2017 Unit Outline Thinking Recursively Recursion Examples Analyzing Recursion:
More informationChapter 3: Theory of Modular Arithmetic 1. Chapter 3: Theory of Modular Arithmetic
Chapter 3: Theory of Modular Arithmetic 1 Chapter 3: Theory of Modular Arithmetic SECTION A Introduction to Congruences By the end of this section you will be able to deduce properties of large positive
More informationAn Interesting Way to Combine Numbers
An Interesting Way to Combine Numbers Joshua Zucker and Tom Davis October 12, 2016 Abstract This exercise can be used for middle school students and older. The original problem seems almost impossibly
More informationFormal Systems II: Applications
Formal Systems II: Applications Functional Verification of Java Programs: Java Dynamic Logic Bernhard Beckert Mattias Ulbrich SS 2017 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State
More information6. Hoare Logic and Weakest Preconditions
6. Hoare Logic and Weakest Preconditions Program Verification ETH Zurich, Spring Semester 07 Alexander J. Summers 30 Program Correctness There are many notions of correctness properties for a given program
More informationSpecifications and Assertions
Specifications and Assertions Jan van Eijck Master SE, 29 September 2010 Abstract As a start, we give further examples of Alloy specifications. Next we turn to specification of imperative programs. Assertions
More informationUnit #2: Recursion, Induction, and Loop Invariants
Unit #2: Recursion, Induction, and Loop Invariants CPSC 221: Algorithms and Data Structures Will Evans 2012W1 Unit Outline Thinking Recursively Recursion Examples Analyzing Recursion: Induction and Recurrences
More informationIntegers and Mathematical Induction
IT Program, NTUT, Fall 07 Integers and Mathematical Induction Chuan-Ming Liu Computer Science and Information Engineering National Taipei University of Technology TAIWAN 1 Learning Objectives Learn about
More informationSEQUENCES, MATHEMATICAL INDUCTION, AND RECURSION
CHAPTER 5 SEQUENCES, MATHEMATICAL INDUCTION, AND RECURSION Copyright Cengage Learning. All rights reserved. SECTION 5.5 Application: Correctness of Algorithms Copyright Cengage Learning. All rights reserved.
More informationSemantic Analysis Type Checking
Semantic Analysis Type Checking Maryam Siahbani CMPT 379 * Slides are modified version of Schwarz s compiler course at Stanford 4/8/2016 1 Type Checking Type errors arise when operations are performed
More informationFormal Specification. Objectives
Formal Specification cmsc435-1 Objectives To explain why formal specification techniques help discover problems in system requirements To describe the use of algebraic techniques for interface specification
More informationTHE PRINCIPLE OF INDUCTION. MARK FLANAGAN School of Electrical, Electronic and Communications Engineering University College Dublin
THE PRINCIPLE OF INDUCTION MARK FLANAGAN School of Electrical, Electronic and Communications Engineering University College Dublin The Principle of Induction: Let a be an integer, and let P(n) be a statement
More information1 Unit 8 'for' Loops
1 Unit 8 'for' Loops 2 Control Structures We need ways of making decisions in our program To repeat code until we want it to stop To only execute certain code if a condition is true To execute one segment
More informationSoftwaretechnik. Program verification. Albert-Ludwigs-Universität Freiburg. June 28, Softwaretechnik June 28, / 24
Softwaretechnik Program verification Albert-Ludwigs-Universität Freiburg June 28, 2012 Softwaretechnik June 28, 2012 1 / 24 Road Map Program verification Automatic program verification Programs with loops
More informationCSE 331 Midterm Exam 11/9/15 Sample Solution
Remember: For all of the questions involving proofs, assertions, invariants, and so forth, you should assume that all numeric quantities are unbounded integers (i.e., overflow can not happen) and that
More informationLECTURES 3 and 4: Flows and Matchings
LECTURES 3 and 4: Flows and Matchings 1 Max Flow MAX FLOW (SP). Instance: Directed graph N = (V,A), two nodes s,t V, and capacities on the arcs c : A R +. A flow is a set of numbers on the arcs such that
More informationSoftwaretechnik. Program verification. Software Engineering Albert-Ludwigs-University Freiburg. June 30, 2011
Softwaretechnik Program verification Software Engineering Albert-Ludwigs-University Freiburg June 30, 2011 (Software Engineering) Softwaretechnik June 30, 2011 1 / 28 Road Map Program verification Automatic
More informationProgram Verification. Program Verification 307/434
Program Verification Program Verification 307/434 Outline Introduction: What and Why? Pre- and Postconditions Conditionals while-loops and Total Correctness Arrays Program Verification Introduction 308/434
More informationExcerpt from "Art of Problem Solving Volume 1: the Basics" 2014 AoPS Inc.
Chapter 5 Using the Integers In spite of their being a rather restricted class of numbers, the integers have a lot of interesting properties and uses. Math which involves the properties of integers is
More informationCSC313 High Integrity Systems/CSCM13 Critical Systems. CSC313/CSCM13 Chapter 2 1/ 221
CSC313 High Integrity Systems/CSCM13 Critical Systems CSC313/CSCM13 Chapter 2 1/ 221 CSC313 High Integrity Systems/ CSCM13 Critical Systems Course Notes Chapter 2: SPARK Ada Sect. 2 (f) Anton Setzer Dept.
More informationComparing procedure specifications
Comparing procedure specifications CSE 331 University of Washington Michael Ernst Outline Satisfying a specification; substitutability Stronger and weaker specifications Comparing by hand Comparing via
More informationCSE 417 Network Flows (pt 4) Min Cost Flows
CSE 417 Network Flows (pt 4) Min Cost Flows Reminders > HW6 is due Monday Review of last three lectures > Defined the maximum flow problem find the feasible flow of maximum value flow is feasible if it
More information