<<

Week 1 Week 1

CS3001: Approach CS3001: Formal Methods

Andrew Butterfield1 When What 1Foundations & Methods Group, Monday 12noon Lecture; mini-Exercise Software Systems Laboratory Thursday 12noon mini-Solution; Tutorial/Examples; “real-world” Andrew.Butterfi[email protected] Room F.13, O’Reilly Institute Thursday 2pm Lecture

Semester II, 2011

3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

CS3001: Assessment CS3001: Resources

www.scss.tcd.ie/Andrew.Butterfield/Teaching/CS3001/ Exam: 80% Main Reference Text: Coursework: 20% Unifying Theories of Programming, C.A.R. Hoare and Jifeng He, Project: 10% Class (Mini-)Exercises: 10% Prentice Hall, 1998. Mini-exercises handed out at end of Monday class. (available online at http://www.unifyingtheories.org/) Mini-solutions due in at start of Thursday 12noon class. Secondary Texts: These deadlines are hard, as solutions will be given out at A Logical Approach to Discrete Math, D. Gries & the start of the 12noon Thursday class. F. B. Schneider, Springer, 1993 (your JF math text!). Using Z , J. Woodcock & J. Davies, Prentice Hall 1996. (available online at http://www.usingZ.com/)

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

What are “Formal” Systems? Example: System ~z= (“H-Cross-I”)

Symbols: ~ z = Well-Formed Sequences, H-Things and I-Things, where: Specified collection of Symbols (lexicon) H-Thing:A ~ followed by Crosses: Specified ways of putting them together (well-formedness) Crosses : Zero or more z Specific ways of manipulating symbol-sequences I-Thing:A = followed by two H-Things (inference rules) Manipulations (let f1 and f2 stand for arbitrary Crosses). Typically the goal is to transform a starting sequence to a hhI-absorbii = f becomes f final one having desired properties. ~~ 1 ~ 1 hhswap-Cross-Hii =~f1z~f2 becomes =~f1~zf2

Goal: convert a starting I-Thing into a H-Thing

3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

Example Interpretation

~ 0 zero =~zz~zzz z +1 succ = hhswap-Cross-Hii = + plus =~z~zzzz =~ ~ + 0 + 1 + 1 0 + 1 + 1 + 12 + 3 = hhswap-Cross-Hii zz zzz =~z~zzzz + 0 + 1 0 + 1 + 1 + 1 + 11 + 4 = ~~zzzzz =~~zzzzz + 0 0 + 1 + 1 + 1 + 1 + 10 + 5 = hhI-absorbii ~zzzzz 0 + 1 + 1 + 1 + 1 + 15 ~zzzzz =~f1z~f2 99K =~f1~zf2 (n + 1) + m = n + (m + 1) =~~f1 99K ~f1 0 + m = m

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

What’s the point? Formal Logic

We present a , called Predicate Calculus We can give very precise meanings to the symbols, Symbols The manipulations can have a very-well defined meaning, Those used for expressions and propositional but, the symbols can be manipulated without our having to logic, as well as ∃, ∀, •. understand these meanings. Well-Formedness which is exactly how a computer does it ! Predicates: Well structured expressions whose Formal Methods allow us to limit the scope for human error type is Boolean. and to exploit the use of machines to help our analysis. Manipulation Rules Classified as Axioms and Inference Rules. Goal To prove a given Predicate is “True”.

3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

Expressions Expressions (Aggregates)

We build basic expressions out of constants (k ∈ Const), variables (v ∈ Var ), tuples, functions and operators:

e ∈ Expr ::= k | v constants, variables e ∈ Expr ::=( e1,..., en) | {...} aggregates | (e1,..., en) | {...} aggregates | e e application 1 2 Aggregates are distinguished by different : | e1 ⊕ e2 infix application | (e) parenthesised expr. (e1,..., en) tuples {e1,..., en} sets Read e ∈ Expr ::= ... as “e, an Expr , is …” he1,..., eni sequences . Read k as “a constant k ” . Read | as “or” We do not give a complete definition here of expressions, and will extend this as the course progresses.

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

Expressions (Function application) Expressions (Infix operators)

We define function application without brackets, so f x denotes function f applied to argument x (if f is a prefix function — most are !) e ∈ Expr ::= e1 ⊕ e2 infix operator application We can write function application with brackets if we prefer so f (x) and f x are equivalent. Here ⊕ denotes any infix binary operator, such as In some of the literature, function application is shown +, −, ∗, /, =, <, >, ≤, ≥, ∪, ∩,... explicitly with a dot, so f .x is the same as f x (or f (x) ). Parentheses and precedence behave in the same manner In the case where f is a postfix function, then applying f to as found in most programming languages, so x + y ∗ z is x is written as x f (e.g. raising to a power — x 2 is the the same as x + (y ∗ z), but different from (x + y ) ∗ z. squaring function 2 post-applied to x). The notation used is often a matter of style, and depends on context.

3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

Well-Typedness Types

We make use of a rich variety of given types and type constructors: We require expressions to be well typed. e.g. we want to outlaw nonsense like3 + (A ∪ B) or S, T ∈ Type ::= 1 unit type h1, 0, 1, 0i − 5 = True | B boolean values we write the assertion that expression e has type T as | A (ASCII) characters | N | Z | Q | R | C numbers e : T |P T set of T | T1 × · · · × Tn cross-product | T ∗ sequence of T We can consider (for now) a type T as being the set of | S → T function from S to T values that are allowed for something of that type. There are rules for checking (and/or inferring) expression types, which we ignore for now.

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

Expressions (Type annotations) Expression Meaning

What is our intended meaning for an expression ? (e.g. e ∈ Expr ::= ... x 2 + y) | (e : T ) type annotation it depends on the value of x and y so, let x = 3 and y = 5 (say) Usually we let expression types be determined from OK, so then x 2 + y has value 14. context, but if necessary we can annotate The “meaning” of an expression is the relationship it (sub-)expressions with types, i.e. creates between the values of its variables and its own 2 overall value: (x : Q) = 2 instead of x 2 = 2 “meaning : values(x, y) → value”

Note that an incorrect annotation is not a type error, but is simply a stat, so ((A ∪ B): N) is ill-typed, even if A ∪ B is Alternatively, we can view the meaning as a function from well-typed (presumably with A : PT and B : PT , for some variables to the expression’s value. type T ).

3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

Environments Evaluating Expressions against Environments

Given an environment (as per previous slide), it is possible to We call the association of values with variables an determine the value for an expression in a systematic way. Environment (or Interpretation) and is a table associating a value with every (whose value is defined). ix + offset 6 length list We assume environments are always well-formed, in that = “ lookup above table” the associated value is always of the correct type. 4 + 2 6 length h1, 1, 2, 3, 5, 8, 13i = “ defn. of + and length. (?) ” Variable : Type Value 6 7 list : ∗ h1, 1, 2, 3, 5, 8, 13i 6 e.g.: N = “ defn. of (?) ” ix : 4 6 N True offset : N 2 (?) Where do we find the definitions +, length and 6 ?

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

Class 2 Modelling Environments

We usually model Environments mathematically as a finite partial map (ρ) from variables to values:

ρ ∈ Env = Var 7→Value

Here the ‘type’ Value should considered as the union of all possible types. A table entry mapping variable v to value k is written as v 7→ k. A table is a set of table entry mappings (order is irrelevant):

{list 7→ h1, 1, 2, 3, 5, 8, 13i, ix 7→ 4, offset 7→ 2}

3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

Expressions as Functions Predicates

Given an expression, and then an environment, we can get A Predicate is an “expression” whose type is boolean (B). the value of that expression in that environment. We can therefore view the meaning of an expression as a P ∈ Pred ::= ... (partial (?)) function from environments to values. [[P]]: Env → B Let [[e]] denote the “meaning of e”, then we can say Remember that “type” Value contains values of all types, including , so ⊆ Value. [[e]]: Env 7→Value B B Unlike expressions, where evaluation w.r.t. an environment The meaning function, given an expression, returns a may be undefined, we insist that predicates always partial function from environment to values. evaluate to either True or False.

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

Atomic Predicates True & False An Atomic Predicate is an expression whose overall type is Boolean, and whose constituent parts have non-Boolean types A, B, C ∈ AtmPred ::= e : B Two special predicates true and false always return True and False respectively, regardless of the environment. True and true are not the same: They can be viewed as a function from an environment to True : is a boolean value the values true or false. B true : Env → B is a predicate, a function from environments to . [[A]] : Env → B B Similarly for False and false. In practise we can often ignore the distinction, using them Examples: interchangeably. x + 3 6 y f (x) = g(x) − h(x) reverse(hxi a xs) = (reverse xs) a hxi

3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

Identities Predicate Logic

Given atomic predicates we can build a richer language using Propositional Connectives (¬ , ∧, ∨, ⇒, ≡): (Atomic) Predicate Expressions of the form: P ∈ Pred ::= true | false | A atomic predicates e1 = e2 |¬ P logical negation | P1 ∧ P2 conjunction (logic-and) where e1 and e2 have the same type, are known as | P1 ∨ P2 disjunction (logic-or) Identities. | P1 ⇒ P2 implication Identities play a major role in what is to come. | P1 ≡ P2 equivalence

This gives us the same power as , a.k.a. “digital logic”.

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

Predicate Logic Syntax Predicate Meanings (Propositions)

The predicate meaning function can be described as follows: Considerably more power is obtained by adding Quantifiers [[true]]ρ = True (∀, ∃, ∃1) to the language: b [[false]]ρ =b False P ∈ Pred ::= ... already discussed [[e]]ρ =b [[e]]ρ pred. meaning = expr. meaning |∀ x : T • P universal quantification (for-all) [[¬ P]]ρ =b logical inverse of [[P]]ρ |∃ x : T • P existential quantification (there-exists) [[P1 ∧ P2]]ρ =b Trueiff both [[P1]]ρ and [[P2]]ρare [[P1 ∨ P2]]ρ = Trueiff either [[P1]]ρ or [[P2]]ρare |∃ 1 x : T • P unique existence quantification b | [P] universal closure We define implication and equivalence by translation The type annotations (: T ) are optional and are often omitted P ⇒ P = ¬ P ∨ P when clear from context (or irrelevant!) 1 2 1 2 P1 ≡ P2 =( P1 ⇒ P2) ∧ (P2 ⇒ P1)

3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

Manipulating Environments (Maps) The Meaning of Quantifiers (I)

We can now give the meaning for the main two quantifiers as: We define the domain of an environment (dom ρ) as the set of all variables mentioned in ρ. [[∀ x : T • P]]ρ =b for all values k in T 0 We can use one environment (ρ ) to override part or all of we have [[P]]ρ⊕{x7→k } = True another (ρ), indicating this by ρ ⊕ ρ0. The bindings in the second map, extend and take precedence “∀ x : T • P is true if P is true for all x : T ” of those in the first map — e.g.: [[∃ x : T • P]]ρ =b for at least one value k in T {a 7→ 1, b 7→ 2, c 7→ 3}⊕{ c 7→ 33, d 7→ 44} we have [[P]]ρ⊕{x7→k } = True = {a 7→ 1, b 7→ 2, c 7→ 33, d 7→ 44} “∃ x : T • P is true if P is true for at least one x : T ”

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

The Meaning of Quantifiers (II) Evaluating Quantifiers

We can now give the meaning for the other two quantifiers as: Consider: [[∃1 x : T • P]]ρ =b for exactly one k in T we have [[P]]ρ⊕{x7→k } = True ∀ n : N • prime(n) ∧ n > 2 ⇒ ¬ prime(n + 1) True, or False? “∃1 x : T • P is true if P is true for exactly one x : T ” To evaluate a quantifier, we may need to generate all 0 0 ρ0 [[[P]]]ρ =b for any ρ such that dom ρ = dom ρ possible environments involving the bound variable — we have [[P]]ρ0 = True tricky if type has an infinite number of values. In general, in order to reason about quantifiers we need to “[P] is true if P is true for all values of all its variables” use Axioms and Inference Rules.

3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

Class 3 Logic Example I

Under what circumstances is the following true?

(x < 3 ∧ x > 5) ⇒ x = x + 1

3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

Example I Commentary Implication Truth-Table

(x < 3 ∧ x > 5) ⇒ x = x + 1 The for implication is as follows: = “ definition of ⇒ ” P Q P ⇒ Q ¬ (x < 3 ∧ x > 5) ∨ x = x + 1 False False True = “5 < x < 3 clearly impossible ” False True True ¬ (false) ∨ x = x + 1 True False False = “ negation ” True True True true ∨ x = x + 1 Simply put, for P ⇒ Q, = “ logical-OR ” if P is false, then the whole thing is true, true regardless of Q. It is always true !

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

Logic Example II Example II Commentary

The following statement is true: ∀ n : N • n > 2 ⇒ (prime(n) ⇒ ¬ prime(n + 1))

∀ n : N • n > 2 ⇒ prime(n) ⇒ ¬ prime(n + 1) Case n 6 2: False ⇒ ... is true. Case n > 2 ∧ ¬ prime(n) : True ⇒ (False ⇒ ...) is true. How might we argue this? Case n > 2 ∧ prime(n) : 2 is only even prime, so here n is odd, so n + 1 is even and therefore not prime.

3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

Quantifier Expansion Logic Example III

We can view quantifiers as (approximate) shorthand for Assuming all variables are natural numbers, is the statement repeated logical-and/or: ∀ x • ∃ x • x < y ∀ n : N • P(n)= P(0) ∧ P(1) ∧ P(2) ∧ P(3) ∧ ... equivalent to ∃ n : N • P(n)= P(0) ∨ P(1) ∨ P(2) ∨ P(3) ∨ ... ∀ x • x < y, or The equality is exact if the type quantified over is finite: ∃ z • z < y, ∀ b : B • P(b)= P(False) ∧ P(True) or neither? ∃ b : B • P(b)= P(False) ∨ P(True) (What precisely do the three statements actually mean?) What about ∃ z • z < x?

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

Example III Commentary (1) Example III Commentary (2)

[[∀ x • x < y]] [[∀ x • ∃ x • x < y ]]ρ ρ = “ by our semantics ” = “ by our ” [[x < y]] , for all k [[∃ x • x < y ]]ρ⊕{x7→k}, for all k ρ⊕{x7→k} = “ by our semantics ” = “ false if we choose k = ρ(y) + 1” 0 False [[x < y ]]ρ⊕{x7→k}⊕{x7→k 0}, for all k , for some k = “ 2nd override masks 1st ” 0 [[∃ z • z < y ]]ρ [[x < y ]]ρ⊕{x7→k 0}, for all k, for some k = “ choose k 0 = 0” = “ by our semantics ” [[z < y ]] , for some k [[0 < y ]]ρ ρ⊕{z7→k} = “ true for natural number y if non-zero ” = “ choose k = 0” y 6= 0 [[0 < y ]]ρ = “ true for natural number y if non-zero ” y 6= 0 This is a statement about y , not about x, and the outer ∀ x ∃ is masked by inner x. 3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

Example III Commentary (3) Logic Example IV

Define the following in terms of other predicates: [[∃ • < ]] z z x ρ ∃ x • P(x) = “ by our semantics ” 1 [[z < x]]ρ⊕{z7→k}, for some k Here P(x) indicates explicitly that P mentions x. = “ choose k = 0” A reminder: [[0 < x]]ρ = “ true for natural number x if non-zero ” [[∃1 x : T • P]]ρ =b for exactly one k in T x 6= 0 we have [[P]]ρ⊕{x7→k} = True

This is a statement about x, not y , or z. “∃1 x : T • P is true if P is true for exactly one x : T ”

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

Example IV Commentary Logic Example V

∃1 x • P(x) =b( ∃ x • P(x)) Simplify the following predicate: ∧ (∀ x • ∀ y • (P(x) ∧ P(y )) ⇒ x = y) ∃ x • x = y + z ∧ x < 2 ∗ y There exists only one x satisfying P, iff there is at least one x satisfying P and for all x and y if both x and y satisfy P then it must the case that x = y.

3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

Example V Commentary Formal Methods: early History

1967, Robert W. Floyd, “Assigning Meanings to Programs” Mathematical Aspects of Computer Science, AMS, Vol.19, ∃ x • x = y + z ∧ x < 2 ∗ y pp19–32 = “ The only way this can be true is when x = y + z ” Floyd described a technique for annotating flowcharts with “ so replace x by that. ” predicates describing what should be true at every point in ∃ x • y + z = y + z ∧ y + z < 2 ∗ y the execution. = “ x is not mentioned, so ∃ is now redundant ” 1969, C. A. R. Hoare, “An axiomatic basis for computer y + z = y + z ∧ y + z < 2 ∗ y programming” Communications of the ACM, Vol.12, No.10, pp576—580,583 October. = “ y + z = y + z is clearly true ” y + z < 2 ∗ y Hoare introduced the notation known today as a “Hoare triple”: = “ ” Pre{prog}Post z < y “if Pre holds at the start and prog terminates, then Post will be true at the end”.

3BA31 Formal Methods 3BA31 Formal Methods Week 1 Week 1

Floyd’67: Annotated flowchart example Hoare’69: Proof example

     r :=x;       q:=0;         while  ¬ (y r )   6   true y r ∧  6       do  x=r +y ×q      r :=r −y ;         q:=1+q 

image © 1969 ACM image © 1967 AMS 3BA31 Formal Methods 3BA31 Formal Methods

Week 1 Week 1

Floyd/Hoare as a foundation

The framework we shall explore is known as “Unifying Theories of Programming” (UTP) It is a direct descendant of the Floyd/Hoare approach UTP aims to link theories of different kinds of programming language: imperative, concurrent, functional, logical, dataflow, assembler, … C.A.R. (Tony) Hoare is one of the prime movers behind UTP he spent most of time in Oxford at the Programming Research Group (PRG) now with Microsoft Research, Cambridge most famous outside the formal methods community for QuickSort !

3BA31 Formal Methods 3BA31 Formal Methods