50.530: Software Engineering
Sun JunSUTD
Week 9: Hoare Logic
• Delta Debugging is based on testing.• The bug localization methods are based on
testing.• The specification mining methods are based
on testing. • The dynamic race detection methods are
based on testing.
Testing is Limited
the behaviors we wanted
AC
the behaviors we have
the initial state
a test which shows a bug
“Testing shows the presence, not the absence of bugs.” ---Dijkstra
Example
Initially: x = y = 0
thread 1 { x = random.nextInt(0, 100000); count++;}
thread 2 { if (x==3771) { ERROR; }}
Testing would unlikely spot the error.
But humans do, why?
Program verification is to show the absence of bugs based on logic.
Verification. Why?
• There are systems which simply cannot afford any error, e.g., control software for nuclear plants, space missions, high-speed trains, cars (e.g., for cruise control), etc.
• Some systems are much more secure if they are verified, e.g., many security problems are really software bugs.
• All systems are better off if they could be verified.
Plus, the problem is really challenging and interesting.
Verification is Hard
Example: the Halting problem• The problem is to determine, given a
program* and an input to the program, whether the program will eventually halt when run with that input.
• Turing proved no algorithm can exist which will always correctly decide whether, for a given arbitrary program and its input, the program halts when run with that input.*in a programming language which is equivalent to a Turing machine.
Example
float sumUp (float[] array, int length) { float result = 0.0;
int i = 0 ; while (i < length) {
result += array[i];i++;
}
return result;}
How do we prove this program is correct?
What exactly do I want this program to do?
Function Specification
• We do need a specification in order to verify. • Assume the specification is based predicate
logic. • A predicate is a Boolean function over
program state, i.e., an expression that returns a Boolean value. – e.g., x = 3, y > x, x>0 => y+z = w, s = sum(x1, x2,
x3), for all I in 0..n-1, a[i] > a[i-1]
Function Specification
• A function specification for a method usually consists of a pre-condition and a post-condition.
• Example:– given a semi-prime, your program outputs its
prime factors
What if the pre-condition is not satisfied, e.g., you are given a number which is not a semi-prime?
Correctness
• Partial Correctness: If the pre-condition is satisfied and the method terminates, it is guaranteed to satisfy the post-condition.
• Total Correctness: If the pre-condition is satisfied, it is guaranteed that the method terminates and satisfies the post-condition.
Function Specification: Example
float sumUp (float[] array, int length) { float result = 0.0;
int i = 0 ; while (i < length) {
result += array[i];i++;
}
return result;}
{length >= 0 && array.length = length}
{result = sum(array[j] for all j in 0..length)}
pre-condition
post-condition
AN AXIOMATIC BASIS FOR COMPUTER PROGRAMMING
C. A. R. Hoare, Communications of the ACM 1969
Hoare Triples
If we start in a state where Pre is true and execute Program, then Program will terminate in a state where Post is true.
Examples:{true} x:=5 {x=5}{x=y} x := x+3 {x=y+3}{x=a} if(x<0)then x:=-x {x=|a|}
{Pre}Program{Post}
Questions
Are the following Hoare triples?
{x<0} while (x != 0) { x:= x-1;} {true}
{false} x := 3 {x = 8}
{x>-1} x:=x*2+3 {x>1}
Strongest Post-conditions
The following are all valid Hoare triples. • {x = 5} x := x * 2 {true}• {x = 5} x := x * 2 {x > 0}• {x = 5} x := x * 2 {x = 10}All are true, but which one is the most useful, if we know x = 5 is satisfied before the program executes.
Definition: If {Pre} Program {Post} and Post Post’ for all ⇒Post’ such that {Pre} Program {Post’}, then Post is the strongest post-condition sp(Program, Pre) of Program with respect to Pre.
Question
What is sp(x:=x*2+3, {x>-1})?
Weakest Pre-conditions
The following are all valid Hoare triples. • {x = 5 && y = 10} z := x / y {z < 1}• {x < y && y > 0} z := x / y {z < 1}• {y ≠ 0 && x / y < 1} z := x / y {z < 1}
All are true, but which one is the most useful (so that it allows us to invoke the program in the most general condition) if we know z < 1 is satisfied after the program?
Definition: If {Pre} Program {Post} and Pre’ Pre for all Pre’ such ⇒that {Pre’} program {Post}, then Pre is the weakest precondition wp(Program,Post) of Program with respect to Post.
Question
What is wp(if(x<0)then x:=-x, x=|a|)?
Forward Analysis
Theorem: {Pre} Program {Post} holds if and only if sp(Program,Pre) Post . ⇒
In other words, a Hoare Triple is valid if the post-condition is weaker than necessary, but not if it is too strong.
Example: Since sp(x := x * 2, x=5) ≡ x=10, {x = 5} x := x * 2 {x > 0} holds.
Backward Analysis
Theorem: {Pre} Program {Post} holds if and only if Pre ⇒ wp(Program,Post).
In other words, a Hoare Triple is valid if the precondition is stronger than necessary, but not if it is too weak.
Example: Since wp(z := x / y, z < 1) ≡ y ≠ 0 && x / y < 1, {x < y && y > 0} z := x / y {z < 1} is valid.
Example
float sumUp (float[] array, int length) { float result = 0.0;
int i = 0 ; while (i < length) {
result += array[i];i++;
}
return result;}
How do we prove the following?
{length >= 0 && array.length = length}sumUp(array, length){result = sum(array[j] for all j in 0..length-1)}
We need systematic ways to deal with assignments, loops, conditionals, etc.
Axiomatic Approach
• Hoare logic rules: – For each kind of program (like assignment, loop,
etc.), define a rule so that we can compute the weakest pre-condition for a given post-condition or the strongest post-condition for a given pre-condition.
Hoare Logic Rules: Assignment
Example: wp(x := 3, x + y > 0) ≡ (x+y)[3/x] > 0
≡ 3 + y > 0 ≡ y > -3
wp(x := E, post) ≡ post[E/x]
where post [E/x] is the predicate obtained by replacing x with E in post.
Another way to under this rule:for any pre, it must satisfypre && x = 3 implies x+y>0
Exercise 1
What is wp(x := 3*y + z, x * y - z > 0)?
Hoare Logic Rules: Assignment
Example: sp(x := 3, x + y > 0) ≡ oldx+y > 0 && x = 3sp(x := 3x, x + y > 0)
≡ oldx+y > 0 && x = 3oldx ≡ x + 3y > 0
sp(x := E, pre) ≡ x = E[oldx/x] && pre [oldx/x]
where oldx is a fresh variable representing the old value of x; pre[oldx/x] first renames x to oldx to avoid conflict.
Hoare Logic Rules: Sequence
Example: wp(x := x + 1; y := x + y, y > 5)
≡ wp(x := x+1, wp(y:=x+y, y>5))≡ wp(x := x+1, x+y>5)≡ x+y > 4
wp(program1; program2, post) ≡ wp(program1, wp(program2, post))
We first get the weakest pre-condition of program2 with respect to post and then use that the post-condition for program1.
Exercise 2
What is wp(x := 3*y + z; x = 5, x * y - z > 0)?
Hoare Logic Rules: Sequence
Example: sp(x := x + 1; y := x + y, y > 5)
≡ ???
sp(program1; program2, pre) ≡ sp(program2, sp(program1, pre))
We first get the strongest post-condition of program1 and then use that the pre-condition for program2.
Hoare Logic Rules: Conditional
Example: wp(if x > 0 then y := z else y := -z, y > 5)
≡ x > 0 => wp(y:=z, y>5) && x <= 0 => wp(y:=-z, y>5) ≡ x > 0 => z > 5 && x <= 0 => -z>5
wp(if B then Program1 else Program2; post) ≡ B => wp(program1, post) && !B => wp(program2, post)
Hoare Logic Rules: Conditional
Example: sp(if x > 0 then y := z else y := -z, y > 5)
≡ ???
sp(if B then Program1 else Program2; pre) ≡ sp(program1, B && pre) || sp(program2, !B && pre)
Hoare Logic Rules: Loops
How do we find the following?wp( while (i < x) {
f = f*i; i := i+1;
}, f = x!) This is the ONE step that can’t be automated.
Similarly for calculating the strongest post-condition.
Hoare Logic Rules: Loops
*** (1): the pre-condition satisfies the invariant (2): the invariant remains valid after executing the loop body
when B is satisfied (3): the invariant and !B is strong enough to imply the post-
condition
{pre}while B do program{post} if there exists an invariant inv such that the following are satisfied:
(1) pre => inv(2) {inv && B} program {inv}(3) inv && !B => post
and the loop terminates
Are we missing something?
inv
Big ViewB !B
post
{inv && B}program{inv}
pre
one iteration
Example{length >= 0 && array.length = length}float result = 0.0;int i = 0 ;while (i < length) {
result += array[i];i++;
}{result = sum(array[j] for all j in 0..length-1)}
Apply strongest post-condition calculation
{length >= 0 && array.length = length && i = 0 && result = 0.0}while (i < length) {
result += array[i];i++;
}{result = sum(array[j] for all j in 0..length-1)}
Example: Finding Invariants
Proof: Let inv be 0 <= i <= length and result = sum(array[j] for all j in 0..i-1);1. inv is true right before the loop starts, i.e.,length >= 0 && array.length = length && i = 0 && result = 0.0 => 0 <= i <= length and result = sum(array[j] for all j in 0..i-1)
{length >= 0 && array.length = length && i = 0 && result = 0.0}while (i < length) {
result += array[i];i++;
}{result = sum(array[j] for all j in 0..length-1)}
How do we find a loop invariant?
Example: Finding Invariants
Proof: 2. inv is a loop invariant, i.e.,{0 <= i <= length and result = sum(array[j] for all j in 0..i-1) && i < length}result += array[i]; i++;{0 <= i <= length and result = sum(array[j] for all j in 0..i-1)}
{length >= 0 && array.length = length && i = 0 && result = 0.0}while (i < length) {
result += array[i];i++;
}{result = sum(array[j] for all j in 0..length-1)}
Example: Finding Invariants
Proof: 3. inv and i >= length implies the post-condition, i.e.,0 <= i <= length and result = sum(array[j] for all j in 0..i-1) && i >= length=> i = length and result = sum(array[j] for all j in 0..i-1) Hence, the program is partially correct.
{length >= 0 && array.length = length && i = 0 && result = 0.0}while (i < length) {
result += array[i];i++;
}{result = sum(array[j] for all j in 0..length-1)}
We will prove termination later
Invariant Intuition
• For code without loops, we apply the Hoare triple rules to get the weakest pre-condition or the strongest post-condition.
• For code with loops, we are doing one proof of correctness for multiple loop iterations– Don’t know how many iterations there will be– Need our proof to cover all of them– The invariant expresses a general condition that is
true for every execution, but is still strong enough to give us the post-condition we need.
Termination
• Find a variant function v such that:– v is an upper bound on the number of loops
remaining– (inv && B) v > 0: the variant function evaluates ⇒
to a finite integer value greater than zero at the beginning of the loop
– {inv && B && oldv=v} program {v < oldv}: the value of the variant function decreases each time the loop body executes.
Example: Finding Variant
Variant function: length-i• length-i is an upper
bound on the number of iterations.
• It is positive initially.• It decrease every time.
Hence the algorithm is terminating and the Hoare triple holds. Finally!
{length >= 0 && array.length = length && i = 0 && result = 0.0}while (i < length) {
result += array[i];i++;
}{result = sum(array[j] for all j in 0..length-1)}
Exercise 3
• Prove the following in 20 minutes
static int gcd(int K, int M) { int k= K; int m = M; while(k!=m) {
if (k > m) {k = k-m;} else {m = m-k;}
} return k;}
{K > 0 and M > 0}
{the returned value is GCD of the inputs}
Proving Real Programs
• How do we apply this kind of proving to real-world programs with classes, inheritance, higher-order functions, etc.?– On source code level, transform a program to a
form which has only simple constructs like above.– Or work on the assembly code.
PROVING PROGRAM TERMINATIONByron Cook et al. Communications of the ACM 2011
Undeciabilitythe halting problem
“The problem is undecidable.” (1936)
“Forget about it then.”“But that’s like the termination problem.”
“Proving termination is not always impossible.”
The problem
The Halting Problem: “using only a finite amount of time, determine whether a given program will always finish running or could execute forever.”
The Halting Problem: “using only a finite amount of time, determine whether a given program will always finish running or could execute forever or answer unknown otherwise – the less unknown the better.”
Turing’s Method
• Find a ranking function f, which maps a program state to the domain of a well-founded relation– By definition, there is no infinite descending chain
in a well-founded relation.• Show that the “rank” decrease according to
the relation along every possible step of the algorithm.
Example
Assume that x and y are integers in math.
How do we prove that this loop terminates?
x = input();y = input();
while (x > 0 and y > 0) do { if (input() == 1) {
x = x-1;y = y+1;
} else {
y = y-1; }}
ExampleProof: Let f be 2x+y. The set of (bounded) integer forms a well-founded relation.
At the beginning of the loop: 2x+y is some positive integer (since x >0 and y > 0). The following Hoare triple holds.
{2x+y = V} if (input() = 1) { x = x-1; y = y+1;}else { y = y-1;}{2x+y = V’ && V’ < V}
Finish the proof by showing the Hoare triple holds.
Good News:
Every loop that terminates has a ranking function.
Bad News:
We don’t know if a loop is terminating or not.
For some loops, the ranking function could be complicated.
How do we go about searching for this ranking function?
Exercise 4: Terminating?
while (x > 0) { x--;}
while (x > 0 || y > 0) { x--; y--;}
while (x > 0) { x := x-y; y++;}
while (x > 0) { y=x; while (y>0) {
y--; }}
while (x > 0) { y=x; while (y>0) {
y--; } x--;}
while (x > 0) { y=x; x--; while (y>0) {
y--; } if (x == 300) {
y=20; }}
Assume x >= 0 and y >= 0
Example
Intuitively, is this loop always terminating? And Why?
What is the ranking function?No function into the natural numbers exists that suffices to prove termination.
x = input();y = input();
while (x > 0 and y > 0) do { if (input() = 1) {
x = x-1;y = input();
} else {
y = y-1; }}
Disjunctive Termination Arguments
One Ranking Function• For 60+ years, people
have been devoted to methods on finding one ranking function automatically.
• Hard to find in many cases.
• Once found, it is easy to check the validity of the argument.
Multiple Ranking Functions• Recent trend• Easier to find, because
it can be expressed in small, mutually independent pieces.
• It is much more difficult to validate.
Example
Disjunctive Termination Argument (two ranking functions: x and y): “x goes down by at least 1 and is larger than 0ORy goes down by at least 1 and is larger than 0”
x = input();y = input();
while (x > 0 and y > 0) do { if (input() = 1) {
x = x-1;y = input();
} else {
y = y-1; }}
How do we use this argument to prove termination?
Disjunctive Termination Argument
It is not sufficient to prove that the rank decreases through one iteration.
Theorem: If every ranking function maps a program state to the domain of a well-founded relation and the rank decreases through all possible unrolling of the loop, then the loop terminates.
Example
The following is true for every one iteration:“x goes down by at least 1 and is larger than 0ORy goes down by at least 1 and is larger than 0”
x = input();y = input();
while (x > 0 and y > 0) do { if (input() = 1) {
x = x-1;y = y+1;
} else {
x = x+1y = y-1;
}}
Is this terminating?
Intuition
One ranking function:Since the “rank” decreasing every time, eventually it will stop and the loop terminates.
Multiple ranking functions:Every iteration at least one “rank” decrease, but some other rank might increase and the decrement might be un-done later.
If we show that at least one “rank” decrease for any arbitrary number of iterations, then the loop terminates.
How do we show that something holds through arbitrary number of iterations?
Termination as Assertion Checkingcopied := falsex = input(); y = input();
while (x > 0 and y > 0) do { if (copied) {
assert((x <= oldx-1 && oldx >0 ) || (y <= oldy-1 && oldy >0 )) } else if (input() == 1) {
copied = true; oldx = x; oldy = y; }
if (input() = 1) { x = x-1; y = y+1; } else { x = x+1; y = y-1; }}
Would you agree that if the assertion is always true, we proved that x or y is decreasing through arbitrary number of iterations?
Example: Assertion Checking
If we know that the assertion is true, then it is implied that y >= 1 is true (at that location) through arbitrary number if iterations.
if (y >= 1) { while (x >0) {
assert(y >= 1);x = x – y;
}}
Bad News: Assertion checking in general is undecidable.
Good News: There are tools for assertion checking.
***We will discuss how to do assertion checking in later classes.
State-Of-the-Art
• Many tools for proving termination– Terminator, T2, ARMC, Aprove, etc.
• Latest empirical study:– 449 benchmarks (including Windows device
drivers, the Apache web server, the PostgreSQL server, etc.) ranging from hundreds LOC to 30K LOC.
– 260 are known to be terminating; 181 non-terminating;
Empirical Study
Summary
• Termination checking is not always impossible.• It is not always possible either (see examples
soon).• So far we are able to handle programs of size
30K LOC or less. • Serious researchers are needed in this area.
Further Challengesc = headwhile (c != null) { if (c.next != null && c.next.data == 5) {
c.next = c.next.next; } c = c.next}
How would you argue that the program is terminating or not?
How would you know whether the linked list is acyclic or not?
There are no integers here. How would you find the function automatically?
Integers are NOT “Integers”
x := 10while x > 9 do { x := x – 2^32;}
x := 10while x > 0 do { x := x + 2;}
Are these terminating?
Source Code vs Binary Code
Java Programs
Bytecode
JVM
Physical Machine
Is it terminating here?
Is it terminating here?
Is it terminating here?
Is it terminating here?
Concurrency + Termination
while x > 0 { x := x-1; lock(mu); b := x; unlock(mu);}
Thread 1
while y > 0 { lock(mu); y := b; unlock(mu);}
Thread 2
How do we prove both threads are terminating?
Collatz Program
while (x > 1) { if (x is divisible by 2) {
x := x / 2; } else {
x := 3x+1; }}
Is this program always terminating or not?
If you solve it, you will be well-known.
Exercise 5
x = input();
while (x >= 0) { y := 1; while (y < x) {
y = 2*y; } x = x – 1;}
Show the above is terminating.