NTU Weekly Lesson Topic Worksheet

Lectures 16 and 17

Formal Program Specification and Intro to Axiomatic Verification

Following a brief review of symbolic logic and recursive functions, we consider formal program specification via pre- and post-conditions and functions (“Formal Program Specification”). We then turn our attention to axiomatic verification and the weak correctness predicate. Our initial focus will be reasoning about the correctness of programs utilizing assignment statements, sequencing, and selection statements (“Axiomatic Verification I”). You will also read a paper by Steve King, et al., which addresses an interesting question: “Is proof more cost-effective than testing?

Formal Program Specification

Context:

We begin the second half of the course this week by shifting our focus from testing to formal program verification, which requires some familiarity with notations used to formally specify the functional behavior of programs.

Purpose:

The purpose of this week’s first lecture is to review some basic ideas from symbolic logic and discrete math. Following this, you will be introduced to the use of two formal specification techniques: specification via pre- and post-conditions, and specification via functions.

Competency Objectives:

At the end of this lesson, you will be able to:

1. Say, “Oh yea, I remember learning about propositions, truth tables, predicates, sets, relations, and functions in the 3rd grade!”, or something similar.

2. Write pre- and post-conditions that capture the required behavior of simple programs.

3. Use functional forms such as conditional rules, recursion, and assignment functions to capture the required behavior of simple programs.

Key Points: 2

1. A proposition, P, is a statement of some alleged fact which must be either true or false, and not both.

2. Predicates are expressions containing one or more free variables (place holders) that can be filled by suitable objects to create propositions.

3. A rule of inference is expressed in the form:

A1, A2, …, An ------C

and is interpreted to mean (A1 Л A2 Л … Л An) Þ C.

4. The (functional) requirements of a program may be specified by providing: an explicit predicate on its state before execution (a pre-condition), and an explicit predicate on its state after execution (a post-condition).

5. A pre-condition represents assumptions than an implementer is allowed to make, and a post-condition represents the obligation that must be met.

6. Programs may also be specified via the use of an assignment function, e.g., f = (x, y := x+y, 0) for which the final value of x is the sum of the initial values of x and y, and the final value of y is 0.

7. Conditional rules are a sequence of (predicate ® rule) pairs separated by vertical bars and enclosed in parentheses:

(p1 ® r1 | p2 ® r2 | … | pk ® rk)

The meaning is: evaluate predicates p1, p2,…pk in order; for the first

predicate, pi, which evaluates to true, it any, use the rule ri; if no predicate evaluates to true, the rule is undefined. (Note that “®” ≠ “Þ”.)

Axiomatic Verification I

Context:

We begin our consideration of formal specification with Axiomatic Verification. The idea is to trace a program’s state changes from an initial (pre-) condition to a final (post-) condition according to a set of self-evident rules (axioms). The rules used depend on the program construct being considered at each step of the process.

Purpose:

To motivate an appreciation for the benefits of studying axiomatic verification (and formal verification techniques in general), to introduce important notational conventions used to assert program correctness w.r.t. given pre- and post-conditions, and to motivate an understanding of the rules used to reason about how 3

various program constructs effect changes in program state.

Competency Objectives:

At the end of this lesson, you will be able to:

1. Precisely interpret the deceptively simple but critically important Weak Correctness Predicate, {P} S {Q}.

2. Reason about the effect of assignment statements, sequencing, and condition statements on program state, and prove the correctness of simple programs composed of those constructs.

Key Points:

1. To prove that program S is (weakly) correct with respect to pre- condition P and post-condition Q, it is sufficient to show:

{P} S {Q}.

Interpretation of {P} S {Q}: “if the input (initial state) satisfies pre-condition P and program S executes and terminates, then the output (final state) will (=must) satisfy post-condition Q.”

2. In general, if you know {P} S {Q}, and you also know K Þ P and Q Þ W, then it follows that {K} S {W}.

3. In general, if you know {P} S1 {R} and you know {R} S2 {Q} then you know {P} S1; S2 {Q}.

4. The necessary conditions for {P} if b then S1 else S2 {Q} to hold are: {P Л b} S1 {Q} and {P Л Øb} S2 {Q}.

5. The necessary conditions for {P} if b then S {Q} to hold are: {P Л b} S {Q} and (P Л Øb) Þ Q.

Reading Assignment: (from the required reading packet)

King, et al., "Is Proof More Cost-Effective than Testing?" IEEE Transactions on Software Engineering, Vol. 26, No. 8, August 2000.

Self-Check Quiz Questions 4

1. (2 pts.) Describe TWO ways in which the predicate x>5 can give rise to a proposition. Illustrate your answer with an example of each.

2. (3 pts.) Give a pre- and post-condition for a program that sets Boolean variable FOUND to true if the non-empty array A[1:N] contains one or more occurrences of value Y and to false otherwise.

3. (3 pts.) What is the truth value of the following assertions?

a. {x>0} y := x+1 {y≥0}

b. {|x|=10} while x <> 5 do x := x-1 {|x|<10}

c. {x≥0} S {x>0} Þ {x=17} S {x≥0}

4. (2 pts.) Prove the assertion:

{Y=X} if X<0 then Y:=-X else A:=5 {Y=|X|}

using the if_then_else Rule of Inference.