COMS E6998 Formal Verification of System Software
Fall 2018
Ronghui Gu
Goal of formal verification: software without bugs.
The goal is to prove the following specification:
using the following logical formalism:
Examples:
Language Syntax:
Language Semantics:
State : a map from variables to values
Program semantics is defined as a labeled transition system
which states that, starting from the initial state , the execution of program will result in the final state .
Assertion: A logical formula describing a set of valuations on program variables with some interesting property.
Assertion semantics: if the integer model and the environment (i.e., state) models the assertion
The partial correctness Hoare triple is valid iff
The total correctness Hoare triple is valid iff
For program without loops, we have
Assignment Rule
Example:
Forward assignment rule:
Sequential Rule
Example:
Conditional Branch Rule
Example:
// Proof. // { ⊤ } (PRE) if x > 0 then else // { y >= 0 } (IF)
Q: What if and ?
Partial Correctness of Loops Rule
is the loop invariants.
Take it in this way, the inference rule is to derive the pre- and postconditions of “”:
Partial Correctness Semantics:
Example:
// Proof. // { x0 = x+z } (PRE) while z != 0 // { x0 = x+z ∧ z = 0 } (WHILE)
Q Prove where
// Program Fact1 is y := 1; z := 0; while (z != x)
// Proof. // { x > 0 } (PRE) // { 1 = 0! } (WEAK) y := 1; // { y = 0! } (ASG) z := 0; // { y = z! } (ASG) while (z != x) // { y = z! ∧ ~(z != x)} (WHILE) // { y = x!} (WEAK)
Total Correctness of Loops Rule
c = x; while (c != 1)
// Proof. // [ x > 0 ] (PRE) // [ 1 = 0! ] (WEAK) y := 1; // [ y = 0! ] (ASG) z := 0; // [ y = z! ] (ASG) // [ y = z! ∧ 0 <= x-z ] (WEAK) while (z != x) // [ y = z! ∧ ~(z != x)] (WHILE) // [ y = x! ] (WEAK)
Intuitively, the largest set of states (represented as an assertion) starting from which if a program is executed, the resulting states satisfy a given post-condition , which is denoted as “”.
Definition
Given and , a weakest precondition is an assertion
such that
Assignment:
Seq:
Condition:
Example: what is “”?
Loops:
Loops with invariant: although we know that this loop invariant exists, in practice, such an abstract construction cannot be handled efficiently by theorem provers. Hence, loop invariants and variants are provided by human users.
If is provided as a correct loop invariant, then we have “” iff
Example: Given the following program
while (i < n) invariant i
Theorem (Soundness)
Hoare Logic is sound:
Theorem (Relative Completeness)
If there is a complete proof system for proving assertions in the underlying logic, then all valid Hoare triples have a proof.
Proof.
Given and the properties of the weakest precondition, we have that
Thus, as long as , we know that