Software Verification 1 Deductive Verification

1. Software Verification 1Deductive Verification Prof. Dr. Holger Schlingloff Institut für Informatik der Humboldt Universität und Fraunhofer Institut für Rechnerarchitektur und Softwaretechnik

2. Where are we? • Einführung • Aussagenlogik • Prädikatenlogik • einfache Funktionskontrakte • Schleifeninvarianten undTerminierung • Prädikate und logische Funktionen • Spezifikation von Datentypen • Parallele Programme, Deadlocks, Livelocks • Objektorientierte Programme

3. Termination • Hoare-Tripel: {}  {}if  holds before the execution of , then  holds afterwards (1) ⊢ {Τ}skip{Τ} (skip) (2) ⊢ {Τ Τ}skip{Τ} (1, imp1) (3) ⊢ {Τ}while (Τ) skip{Τ } (2,whi) (4) ⊢ {Τ}while (Τ) skip{} (3, imp2) I.e., if T holds before the execution of while (Τ) skip, then  holds afterwards I.e., after the execution of while (Τ) skip anythingholds

4. {T}  {}: if  terminates, then  holds afterwards • Hoare logic incapable of formulating statements about termination • Total correctness of  with respect to : • {T}  {} •  terminates • Notation    • Clearly, if contains no loops, then {}  {} implies    • How to prove termination of loops?

5. Well-founded orders • A binary relation < is called a strict partial order iff it is • irreflexive: ¬ x<x • transitive: x<y  y<z  x<z • asymmetric: x<y  ¬ y<x • A partial order is called total order iff it is • total: xy (x<y  y<x) • A strict partial order is called well-founded iff • there is no infinite descending chain,i.e., no infinite set {x0, x1, x2, x3, ...} such that x0>x1>x2>x3 ... • equivalently, if every non-empty set S has a minimal element(i.e., S xS yx (x<y)) • A well-founded total order is called a well-order

6. Well-orderings • natural numbers, < • integers - x<y iff |x|<|y| or |x|=|y| and x<y • pairs - ? • strings - ? • binary trees - ? • rational numbers - ? • real matrices - ? Counterexamples?

7. Transfinite induction • Let (n) be any statement, where nM and < is a well-founded partial order on M If for all xM it holds that if (y) for all y<x, then (x) then (n) for all nM x ((y<x (y))  (x))  n (n)

8. Proof x ((y<x (y))  (x))  n (n) • Assume for contradiction that x ((y<x (y))  (x)), i.e., x (¬(x)  (y<x ¬ (y)))and that x0¬(x0). • Then x1<x0 ¬(x1)) • Therefore x2<x1 ¬(x2)) etc. • Continuing, we get an infinite descending chain of elements, contradicting well-foundedness

9. Special Cases • natural induction:(0)  x ((x))  (x+1))  n (n) • mathematical induction:Let M be finitely generated, i.e., there are constructor-functions f1,...,fn and M0M such that all xM canbewrittenas x=f(f(...(x0)..), whereeach f is a constructorfunctionand x0M0 • if (x0) for all x0M0and • ((x)  (f(x))) for all xMand all constructorfunctions f • then(x)for all xM

10. Termination proofs • Let (M,<) be a well-founded order and (z) be a formula involving zM • if ⊢   (z0) for some z0M and ⊢ (z)b  (z’)  ¬b for some z’<z, then ⊢  while (b) ¬b • (z) is called variant of the loop

11. Special case (Termination only) • if ⊢   (z) for some zM, and ⊢ (z) b  (z’) for some z’<z, and ⊢ ((z) ¬b  ), then ⊢  while (b)  • if ⊢ (z) for some zM and ⊢ (z)  (z’) ¬b for some z’<z then ⊢ T while (b) T

12. Example proof • Show ⊢ a>=0 while (a>0) a--T • well-founded ordering: natural numbers (N0,<); (z) = (a==z) (z)=(floor(a)==z) • a>=0  (a==z) for some zN0a>=0  (floor(a)==z) for some zN0 • ⊢ a==z a-- a==z-1⊢ floor(a)==z a-- floor(a)==z-1 Would this proof hold for float a?

13. Termination of gcd {a==m>0  b==n>0} while (a!=b) if (a>b) a=a-b else b=b-a {a==b==gcd(m,n)} We want to show that ⊢a==m>0  b==n>0  T Variant (z) = (z==a+b); wfo: N0 Show: ⊢ (z) if... (z’) for some z’<z Proof: let z’=z-min(a,b)

14. A more intricate example = {b=1; while (a<=100 || b!=1) if (a<=100) {a+=11; b++;} else {a-=10; b--;} a-=10; } Show: ⊢0<a<=100  a==91