CSE 3341.03 Winter 2008 Introduction to Program Verification February 7

1. CSE 3341.03 Winter 2008Introduction to Program VerificationFebruary 7 prover

2. applying Leibnitz's law • Ex. 5.6: verify that push(top(s), pop(s)) = s ? • no stack axiom covers this case • need a new inference rule: if pop(S1) = pop(S2) top(S1) = top(S2) then S1 = S2

3. stacks as lists alternative notation: stacks as Prolog listspush(X, nil) ->> [X]. push(X,S) ->> [X | S]. pop([X | Y]) ->> Y. top([X | Y]) ->> X. what does push(a, push(b, nil)) simplify to?

4. list computations /: theory(stack). % including rules for lists % example: pop([X|Y]) ->> Y. |: dup([a]).dup([a]) ->>[a,a] |: over([a,b,c]).over([a,b,c]) ->> [b,a,b,c]

5. tracing |:plus([a, b, x]). push(top([a, b, x])+top(pop([a, b, x])), pop(pop([a, b, x]))) [top([a, b, x])+top(pop([a, b, x]))|pop(pop([a, b, x]))] [top([a, b, x])+top(pop([a, b, x]))|pop([b, x])] [top([a, b, x])+top(pop([a, b, x])), x] [top([a, b, x])+top([b, x]), x] [top([a, b, x])+b, x] [a+b, x] plus([a, b, x]) ->> [b+a, x]

6. Forth a still useful language from the 70s (the era of the mini-computer) • scripting language for the Palace graphic-based chat group: iptscrae • used in writing device drivers by several hardware vendors. • bumper sticker from the 80s: "Forth you love if honk then"

7. translating Forth • how can we convert a Forth expression into a corresponding stack expression? • text shows how to automate translation of Forth into stack expressions for verification

8. translating Forth expressions to stack expressions • forth(S) ->> forth1(R) :- reverse(S, R). • forth1([dup | Rest]) ->> dup(forth1(Rest)). • forth1([over | Rest]) ->> over(forth1(Rest)). • forth1(['+' | Rest]) ->> plus(forth1(Rest)). • forth1(['-' | Rest]) ->> minus(forth1(Rest)). • forth1(['*' | Rest]) ->> times(forth1(Rest)). • forth1(['/' | Rest]) ->> divide(forth1(Rest)). • forth1([X | Rest]) ->> push(X, forth1(Rest)). • forth1([]) ->> nil.

9. simplify + wang = prover prover tool combines simplification with tautology checking, and handles identities: • example: x=3 and x=y+3 implies y=0. How does prover establish this? • substituting 3 for x: x=3 and 3=y+3 implies y=0 • rule in equality.simp: X+Y=W ->> X=Z :- ?

10. properties of ADT functions • defined ADT functions are intended to satisfy specific properties: E. g. top(dup(s)) = top(pop(dup(s))) and top(dup(s)) = top(s) (p. 24)

11. proving with equalities • to verify that an ADT (e. g. stack) function satisfies a set of desired conditions, • we have to prove a proposition of the form E1 and E2 . . where the Ei are equalities. • we can use simplification to prove each equality, but we need one more step to check that the conjunction is true. • to improve the scope of automatic proof, prover has the capability to process identities (paramodulation):

12. when does paramodulation work? • example: x=0 implies x<7. substitute 0 for x in the consequent x<7 • Ch. 5, p. 21 discusses why this works • it doesn’t always, e. g. not x<7 implies x= 0 is not equivalent to not 0<7 implies x=0. • only use paramodulation when the equality occurs on the left of the sequent reduced to non-logical terms: { . . . , x= E, . . . } >> { . . . }[E / x]

13. substitution • note notation for substitution in expressions • constant minor irritation in logic & computing: name clashes to substitute E for V and eliminate V, E must be free of V i. e., V doesn't occur in E

14. Exercise 4.1 with prover indigo 301 % prover Version 1.6.6SWI, February 14, 2007 Loading /cs/dept/course/2007-08/W/3341/arithmetic.simp Loading /cs/dept/course/2007-08/W/3341/equality.simp Loading /cs/dept/course/2007-08/W/3341/logic.simp |:(a + b = b + a) implies a < b < a. a+b=b+a implies a<b<a * Cannot prove true implies b<a and a<b.

15. |:assert((A <B < A ->> false)). |:(a + b = b + a) implies a < b < a. a+b=b+a implies a<b<a * Cannot prove true implies false. |:(a + b = b + a) implies a < b < a implies (a + b = b + a). a + b = b + a implies a < b < a implies a+b=b+a * Valid.

16. Queue axioms • exercise 5.4 p. 20 drop(Y -- X) = if(empty(Y), nil, drop(Y) -- X) first(Y -- X) = if(empty(Y), X, first(Y)) • what datatypes are X and Y ? • queue.simp? empty(nil) ->> true. empty(Y--X) ->> false. • what else?