Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness) Thomas Noll Software Modeling and Verification Group RWTH Aachen University https://moves.rwth-aachen.de/teaching/ss-19/sv-sw/
Recap: Hoare Logic Outline of Lecture 11 Recap: Hoare Logic Incompleteness of Hoare Logic Relative Completeness of Hoare Logic Total Correctness 2 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Recap: Hoare Logic Hoare Logic Goal: syntactic derivation of valid partial correctness properties. Here A [ x �→ a ] denotes the syntactic replacement of every occurrence of x by a in A . Tony Hoare (* 1934) Definition (Hoare Logic) The Hoare rules are given by (skip) { A } skip { A } (asgn) { A [ x �→ a ] } x := a { A } (seq) { A } c 1 { C } { C } c 2 { B } (if) { A ∧ b } c 1 { B } { A ∧ ¬ b } c 2 { B } { A } c 1 ; c 2 { B } { A } if b then c 1 else c 2 end { B } = ( B ′ ⇒ B ) = ( A ⇒ A ′ ) { A ′ } c { B ′ } { A ∧ b } c { A } (cons) | | (while) { A } while b do c end { A ∧ ¬ b } { A } c { B } A partial correctness property is provable (notation: ⊢ { A } c { B } ) if it is derivable by the Hoare rules. In (while), A is called a (loop) invariant. 3 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Recap: Hoare Logic Soundness of Hoare Logic Theorem (Soundness of Hoare Logic) For every partial correctness property { A } c { B } , ⊢ { A } c { B } ⇒ | = { A } c { B } . Proof. Let ⊢ { A } c { B } . By induction over the structure of the corresponding proof tree we = I A , C � c � σ = ⊥ or C � c � σ | = I B show that, for every σ ∈ Σ and I ∈ Int such that σ | (on the board). 4 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Incompleteness of Hoare Logic Outline of Lecture 11 Recap: Hoare Logic Incompleteness of Hoare Logic Relative Completeness of Hoare Logic Total Correctness 5 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Incompleteness of Hoare Logic Incompleteness of Hoare Logic I Soundness: only valid partial correctness properties are provable � Completeness: all valid partial correctness properties are systematically derivable � 6 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Incompleteness of Hoare Logic Incompleteness of Hoare Logic I Soundness: only valid partial correctness properties are provable � Completeness: all valid partial correctness properties are systematically derivable � Theorem 11.1 (G¨ odel’s Incompleteness Theorem) The set of all valid assertions { A ∈ Assn | | = A } is not recursively enumerable, i.e., there exists no proof system for Assn in which all valid assertions are systematically derivable. Proof. Kurt G¨ odel see [Winskel 1996, p. 110 ff] (1906–1978) 6 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Incompleteness of Hoare Logic Incompleteness of Hoare Logic II Corollary 11.2 There is no proof system in which all valid partial correctness properties can be enumerated. 7 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Incompleteness of Hoare Logic Incompleteness of Hoare Logic II Corollary 11.2 There is no proof system in which all valid partial correctness properties can be enumerated. Proof. Given A ∈ Assn , | = A is obviously equivalent to { true } skip { A } . Thus the enumerability of all valid partial correctness properties would imply the enumerability of all valid assertions. 7 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Incompleteness of Hoare Logic Incompleteness of Hoare Logic II Corollary 11.2 There is no proof system in which all valid partial correctness properties can be enumerated. Proof. Given A ∈ Assn , | = A is obviously equivalent to { true } skip { A } . Thus the enumerability of all valid partial correctness properties would imply the enumerability of all valid assertions. Remark: alternative proof (using computability theory): { true } c { false } is valid iff c does not terminate on any input state. But the set of all non-terminating WHILE statements is not enumerable. 7 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Relative Completeness of Hoare Logic Outline of Lecture 11 Recap: Hoare Logic Incompleteness of Hoare Logic Relative Completeness of Hoare Logic Total Correctness 8 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Relative Completeness of Hoare Logic Relative Completeness of Hoare Logic I • We will see: actual reason of incompleteness is rule = ( B ′ ⇒ B ) = ( A ⇒ A ′ ) { A ′ } c { B ′ } (cons) | | { A } c { B } since it is based on the validity of implications within Assn 9 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Relative Completeness of Hoare Logic Relative Completeness of Hoare Logic I • We will see: actual reason of incompleteness is rule = ( B ′ ⇒ B ) = ( A ⇒ A ′ ) { A ′ } c { B ′ } (cons) | | { A } c { B } since it is based on the validity of implications within Assn • The other language constructs are “enumerable” 9 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Relative Completeness of Hoare Logic Relative Completeness of Hoare Logic I • We will see: actual reason of incompleteness is rule = ( B ′ ⇒ B ) = ( A ⇒ A ′ ) { A ′ } c { B ′ } (cons) | | { A } c { B } since it is based on the validity of implications within Assn • The other language constructs are “enumerable” • Therefore: separation of proof system (Hoare Logic) and assertion language ( Assn ) 9 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Relative Completeness of Hoare Logic Relative Completeness of Hoare Logic I • We will see: actual reason of incompleteness is rule = ( B ′ ⇒ B ) = ( A ⇒ A ′ ) { A ′ } c { B ′ } (cons) | | { A } c { B } since it is based on the validity of implications within Assn • The other language constructs are “enumerable” • Therefore: separation of proof system (Hoare Logic) and assertion language ( Assn ) • One can show: if an “oracle” is available which decides whether a given assertion is valid, then all valid partial correctness properties can be systematically derived 9 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Relative Completeness of Hoare Logic Relative Completeness of Hoare Logic I • We will see: actual reason of incompleteness is rule = ( B ′ ⇒ B ) = ( A ⇒ A ′ ) { A ′ } c { B ′ } (cons) | | { A } c { B } since it is based on the validity of implications within Assn • The other language constructs are “enumerable” • Therefore: separation of proof system (Hoare Logic) and assertion language ( Assn ) • One can show: if an “oracle” is available which decides whether a given assertion is valid, then all valid partial correctness properties can be systematically derived ⇒ “Relative completeness” 9 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Relative Completeness of Hoare Logic Relative Completeness of Hoare Logic II Theorem 11.3 (Cook’s Completeness Theorem) Hoare Logic is relatively complete, i.e., for every partial correctness property { A } c { B } : | = { A } c { B } ⇒ ⊢ { A } c { B } . Stephen A. Cook (* 1939) Thus: if we know that a partial correctness property is valid, then we know that there is a corresponding proof. 10 of 22 Semantics and Verification of Software Summer Semester 2019 Lecture 11: Axiomatic Semantics of WHILE III (Completeness & Total Correctness)
Recommend
More recommend
