Lectures 20, 21: Axiomatic Semantics Polyvios Pratikakis Computer Science Department, University of Crete Type Systems and Programming Languages Based on slides by George Necula . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 1 / 39 Remember Operational Semantics We have a functional language with references We have defined the semantics of the language Operational semantics I Relatively simple (related to state machines) I Not compositional (due to loops and recursive calls) I Adequate guide for implementing an interpreter . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 2 / 39 More kinds of semantics There is also denotational semantics I Each program has a meaning in the form of a mathematical object I Compositional I More complex formalism (depending on the mathematics used) I Closer to a compiler from source to math Neither is good for showing program correctness I Operational semantics requires running the code I Denotational semantics requires complex calculations . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 3 / 39 Axiomatic semantics An axiomatic semantics consists of I A language for making assertions about programs I Rules for establishing when assertions hold Typical assertions I This program terminates I If this program terminates, the variables x and y have the same value throughout the execution of the program I The array accesses are within the array bounds Some typical languages of assertions I First-order logic I Other logics (temporal, linear) I Special-purpose specification languages (Z, Larch, JML) . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 4 / 39 History Program verification is almost as old as programming (e.g., “Checking a Large Routine”, Turing 1949) In the late ’60s, Floyd had rules for flow-charts and Hoare had rules for structured languages Since then, there have been axiomatic semantics for substantial languages, and many applications I Program verifiers (70s and 80s) I PREfix: Symbolic execution for bug hunting (WinXP) I Software validation tools I Malware detection I Automatic test generation . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 5 / 39 Hoare said “Thus the practice of proving programs would seem to lead to so- lution of three of the most pressing problems in software and pro- gramming, namely, reliability, documentation, and compatibility. However, program proving, certainly at present, will be difficult even for programmers of high caliber; and may be applicable only to quite simple program designs.” –C.A.R Hoare, “An Axiomatic Basis for Computer Programming”, 1969 . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 6 / 39 Dijkstra said “Program testing can be used to show the presence of bugs, but never to show their absence!” . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 7 / 39 Hoare also said “It has been found a serious problem to define these languages [ALGOL, FORTRAN, COBOL] with sufficient rigor to ensure com- patibility among all implementations. …one way to achieve this would be to insist that all implementations of the language shall satisfy the axioms and rules of inference which underlie proofs of properties of programs expressed in the language. In effect, this is equivalent to accepting the axioms and rules of inference as the ultimately definitive specification of the meaning of the language.” . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 8 / 39 Other Applications of Axiomatic Semantics The project of defining and proving everything formally has not succeeded (at least not yet) Proving has not replaced testing and debugging (and praying) Applications of axiomatic semantics I Proving the correctness of algorithms (or finding bugs) I Proving the correctness of hardware descriptions (or finding bugs) I “extended static checking” (e.g., checking array bounds) I Documentation of programs and interfaces . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 9 / 39 Safety and liveness Partial vs. total correectness assertions I Safety vs. liveness properties F Safety: nothing “bad” happens F Liveness: something “good” happens eventually I Usually focus on safety (partial correctness) . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 10 / 39 Assertions The assertions we make about programs are of the form fAg c fBg I If A holds in a state σ and hσ; ci # σ0 I Then B holds in σ0 A is the precondition and B is the postcondition For example fx ≤ yg z := x; z := z + 1 fx < yg This is called a Hoare triple or Hoare assertions . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 11 / 39 Assertions (cont’d) fAg c fBg is a partial correctness assertion I Does not imply termination [A] c [B] is a total correctness assertion I If A holds at state σ I Then there exists σ0 such that hσ; ci # σ0 I And B holds in state σ0 . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 12 / 39 State-based assertions Assertions that characterize the state of the execution I Recall: state = state of locals + state of memory Our assertions will need to be able to refer to I Variables I Contents of memory These are not state-based assertions I Variable x is live, lock L will be released I There is no correlation between the values of x and y . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 13 / 39 The assertion language We use a fragment of first-order predicate logic Formulas A ::= O j > j ? j A ^ A j A _ A j A => A j 8x:A j 9x:A Atoms O ::= f(O;:::; O) j e ≤ e j e = e j ::: Expressions e ::= n j true j false j ::: We can also have an arbitrary assortment of function symbols I ptr(e,T) – expression e denotes a pointer to a T I e : ptr(T) – same in a different notation I reachable(e1, e2) – list cell e2 is reachable from e1 I these can be built-in or defined . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 14 / 39 Semantics of assertions We introduced a language of assertions, we need to assign meanings to assertions I We ignore references to memory for now Notation σ j= A means that an assertion holds in a given state I This is well defined when σ is defined on all variables well-defined occurring in A The j= judgment is defined inductively on the structure of assertions . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 15 / 39 Semantics of assertions (cont’d) Formal definition σ j= true always σ j= e1 = e2 iff hσ; e1i # n1 and hσ; e2i # n2 and n1 = n2 σ j= e1 ≤ e2 iff hσ; e1i # n1 and hσ; e2i # n2 and n1 ≤ n2 σ j= A1 ^ A2 iff σ j= A1 and σ j= A2 σ j= A1 _ A2 iff σ j= A1 or σ j= A2 σ j= A1 => A2 iff σ j= A1 implies σ j= A2 σ j= 8x:A iff 8n 2 Z : σ[x := n] j= A σ j= 9x:A iff 9n 2 Z : σ[x := n] j= A . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 16 / 39 Semantics of assertions (cont’d) Now we can define formally the meaning of a partial correctness assertion j= fAg c fBg : 8σ : 9σ0 : (σ j= A ^ hσ; ci # σ0) ) σ0 j= B and the meaning of a total correctness assertion j= [A] c [B] I 8σ : 9σ0 : (σ j= A ^ hσ; ci # σ0) ) σ0 j= B I 8σ : σ j= A ) 9σ0 : hσ; ci # σ0 . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 17 / 39 Is this enough? Now we have the formal mechanism to decide when fAg c fBg I Start the program in all states that satisfies A I Run the program I Check that each final state satisfies B This is exhaustive testing Not enough I Cannot try the program in all states satisfying the precondition I Cannot find all final states for non-deterministic programs I It is impossible to effectively verify the truth ofa 8x:A postcondition (by using the definition of validity) . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 18 / 39 Derivations as validity witnesses We define a symbolic technique for deriving valid assertions from others that are known to be valid I We start with validity of first-order formulas We write ` A when we can derive (prove) assertion A I We want (8σ : σ j= A) iff σ ` A We write ` fAg c fBg when we can derive (prove) the partial correctness assertion I We want j= fAg c fBg iff ` fAg c fBg . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 19 / 39 Derivation rules for assertions The derivation rules for ` A are the usual from first-order logic Axioms in natural deduction style (inference rules): ` A ` B ` A[α/x] αfresh ` A ^ B ` 8x:A ` 8x:A ` A implies ` B ` A ) B ` A ` A[e/x] ` A ) B ` B ` 9x:A ` A[e/x] ` A[α/x] implies ` B ` 9x:A ` B . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 20 / 39 Derivation rules for triples Similarly, we define ` fAg c fBg when we can derive the triple using derivation rules There is a derivation rule for each instruction in the language Plus the rule of consequence ` A0 ) A ` fAg c fBg ` B ) B0 ` fA0g c fB0g . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 21 / 39 Derivation rules for Hoare logic One rule for each syntactic construct ` fAg skip fAg ` fAg c1 fBg ` fBg c2 fCg ` fAg c1; c2 fCg ` fA ^ bg c1 fBg ` fA ^ :bg c2 fBg ` fAg if b then c1 else c2 fBg . Pratikakis (CSD) Axiomatic Semantics CS546, 2020-2021 22 / 39 Hoare rules: loop The rule for while is not syntax directed I It needs a loop invariant ` fA ^ bg c fAg ` fAg while b do c fA ^ :bg Try and see what is wrong if you make changes (e.g.