An Improved Rule for While Loops in Deductive Program Verification - PowerPoint PPT Presentation

An Improved Rule for While Loops in Deductive Program Verification Bernhard Beckert 1 Steffen Schlager 2 Peter H. Schmitt 2 1 Universit¨ at Koblenz-Landau 2 Universit¨ at Karlsruhe ICFEM 2005, Manchester Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 1 / 18

Outline Preliminaries & Definitions 1 Program logic: Dynamic Logic for Java Programs frames: Modifier Sets State transitions: Updates (Improved) Invariant Rule 2 An Invariant Rule for Total Correctness 3 An Invariant Rule for JavaCard 4 Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 2 / 18

Program Logic – Dynamic Logic for Java Syntax Basis: typed first-order logic Modal operators [ p ] and � p � for each sequential Java program p Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 3 / 18

Program Logic – Dynamic Logic for Java Syntax Basis: typed first-order logic Modal operators [ p ] and � p � for each sequential Java program p Semantics Semantics of p is a partial function Modal operators say something about the final state of p [ p ] φ : If p terminates, then in its final state φ holds (partial correctness) � p � φ : p terminates and in its final state φ holds (total correctness) ψ → [ p ] φ the same as Hoare triple { ψ } p { φ } Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 3 / 18

Signature Signature Signature Σ contains rigid and non-rigid function symbols. ◮ Rigid functions are e.g. + , − , 0 , 1 , . . . ◮ Non-rigid functions are used to model program variables and arrays that are modified by programs, e.g. program variables, arrays, etc. A location is a non-rigid ground term that can be modified by a program, e.g. a [0] = 5; Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 4 / 18

Modifier Sets Specify locations that might be changed by a program Definition (Modifier Set) Let f j a non-rigid function symbol, and t j 1 , . . . , t j n j terms ( j ≥ 1). Then, the set f 1 ( t 1 1 . . . , t 1 f k ( t k 1 . . . , t k { n 1 ) , . . . , n k ) } of pairs is a modifier set. Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 5 / 18

Modifier Sets Specify locations that might be changed by a program Definition (Modifier Set) Let g j be a Dynamic Logic formula, f j a non-rigid function symbol, and t j 1 , . . . , t j n j terms ( j ≥ 1). Then, the set { � g 1 , f 1 ( t 1 1 . . . , t 1 n 1 ) � , . . . , � g k , f k ( t k 1 . . . , t k n k ) � } of pairs is a modifier set. Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 5 / 18

Example Example i=0; j=0; while ( i < length(a)) { a[ i]=0; i=i+1; } Modifier sets for the loop correct: {� true , i � , � true , j � , � 0 ≤ x < length ( a ) , a [ x ] �} Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 6 / 18

Example Example i=0; j=0; while ( i < length(a)) { a[ i]=0; i=i+1; } Modifier sets for the loop correct: {� true , i � , � true , j � , � 0 ≤ x < length ( a ) , a [ x ] �} not correct: {� 0 ≤ x < length ( a ) , a [ x ] �} Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 6 / 18

State Updates Classical DL: state changes represented by substitutions Example � i=0; � φ ↔ φ 0 i Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 7 / 18

State Updates Classical DL: state changes represented by substitutions Example � i=0; � φ ↔ φ 0 i Aliasing in object-oriented languages causes case distinctions Example � Case 1: i . = j a[i] . = 0 → � a[j]=1; � a[i] � . = a[j] � i � . Case 2: = j Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 7 / 18

State Updates Classical DL: state changes represented by substitutions Example � i=0; � φ ↔ φ 0 i Aliasing in object-oriented languages causes case distinctions Example � Case 1: i . = j a[i] . = 0 → � a[j]=1; � a[i] � . = a[j] � i � . Case 2: = j Case distinction not always necessary Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 7 / 18

State Updates Classical DL: state changes represented by substitutions Example � i=0; � φ ↔ φ 0 i Aliasing in object-oriented languages causes case distinctions Example � Case 1: i . = j a[i] . = 0 → � a[j]=1; � a[i] � . = a[j] � i � . Case 2: = j Case distinction not always necessary Idea: collect updates and do not apply until program has disappeared Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 7 / 18

State Updates Classical DL: state changes represented by substitutions Example � i=0; � φ ↔ φ 0 i Aliasing in object-oriented languages causes case distinctions Example � Case 1: i . = j a[i] . = 0 → � a[j]=1; � a[i] � . = a[j] � i � . Case 2: = j Case distinction not always necessary Idea: collect updates and do not apply until program has disappeared Allows simplification before application, updates sometimes cancel out previous ones Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 7 / 18

State Updates Definition (Syntax of Updates) For all non-rigid ground terms l , and all terms v , if φ is a formula, then { l := v } φ is a formula as well. The expressions { l := v } are called updates. Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 8 / 18

State Updates Definition (Syntax of Updates) For all non-rigid ground terms l , and all terms v , if φ is a formula, then { l := v } φ is a formula as well. The expressions { l := v } are called updates. Definition (Semantics of Updates) = { l := v } φ iff s ′ | s | = φ where s ′ coincides with s except for the interpretation of l , which in s ′ has the same value as v in s . Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 8 / 18

Quantified Updates Definition (Syntax of Quantified Updates) Let { f ( t 1 , . . . , t n ) := v } be an update and g a DL formula Then { g , f ( t 1 , . . . , t n ) := v } φ is a DL formula as well. The expression { g , f ( t 1 , . . . , t n ) := v } is called quantified update. Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 9 / 18

Invariant Rule for DL Sequent Calculus Loop Invariant Rule Γ ⊢ U Inv , ∆ Inv ∧ ǫ ⊢ [ α ] Inv Inv ∧ ¬ ǫ ⊢ [ β ] φ Γ ⊢ U [ while ( ǫ ) { α } β ] φ, ∆ Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 10 / 18

Invariant Rule for DL Sequent Calculus Loop Invariant Rule Γ ⊢ U Inv , ∆ Inv ∧ ǫ ⊢ [ α ] Inv Inv ∧ ¬ ǫ ⊢ [ β ] φ Γ ⊢ U [ while ( ǫ ) { α } β ] φ, ∆ Inv holds in the beginning Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 10 / 18

Invariant Rule for DL Sequent Calculus Loop Invariant Rule Γ ⊢ U Inv , ∆ Inv ∧ ǫ ⊢ [ α ] Inv Inv ∧ ¬ ǫ ⊢ [ β ] φ Γ ⊢ U [ while ( ǫ ) { α } β ] φ, ∆ Inv holds in the beginning Inv is in fact an invariant of the loop body Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 10 / 18

Invariant Rule for DL Sequent Calculus Loop Invariant Rule Γ ⊢ U Inv , ∆ Inv ∧ ǫ ⊢ [ α ] Inv Inv ∧ ¬ ǫ ⊢ [ β ] φ Γ ⊢ U [ while ( ǫ ) { α } β ] φ, ∆ Inv holds in the beginning Inv is in fact an invariant of the loop body Inv implies the postcondition if loop terminates Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 10 / 18

Invariant Rule for DL Sequent Calculus Loop Invariant Rule Γ ⊢ U Inv , ∆ Inv ∧ ǫ ⊢ [ α ] Inv Inv ∧ ¬ ǫ ⊢ [ β ] φ Γ ⊢ U [ while ( ǫ ) { α } β ] φ, ∆ Inv holds in the beginning Inv is in fact an invariant of the loop body Inv implies the postcondition if loop terminates Context Γ , ∆ , U must be omitted in 2nd and 3rd premiss Beckert, Schlager, Schmitt ( Universit¨ at Koblenz-Landau, Universit¨ An Improved Rule for While Loops at Karlsruhe) ICFEM 2005 10 / 18