Dr. Muhammed Al-Mulhem 1ICS ICS 535 Design and Implementation of Programming Languages Part 1 Fundamentals (Chapter 4) Axiomatic Semantics ICS 535 Design and Implementation of Programming Languages Part 1 Fundamentals (Chapter 4) Axiomatic Semantics

Dr. Muhammed Al-Mulhem 2ICS Axiomatic Semantics Based on formal logic (predicate calculus) Based on formal logic (predicate calculus) Original purpose: proof correctness of programs. Original purpose: proof correctness of programs. The logical expressions are called assertions. The logical expressions are called assertions. An assertion before a statement (a precondition) describes the constraints on the program variables at that point in the program. An assertion before a statement (a precondition) describes the constraints on the program variables at that point in the program. An assertion following a statement (a postcondition) describes the new constraints on those variables after execution of the statement. An assertion following a statement (a postcondition) describes the new constraints on those variables after execution of the statement.

Dr. Muhammed Al-Mulhem 3ICS Example We examine assertions from the point of view that preconditions are computed from given postconditions. We examine assertions from the point of view that preconditions are computed from given postconditions. Assume all variables are integer. Assume all variables are integer. Postconditions and preconditions are presented in braces. Postconditions and preconditions are presented in braces. A simple example: A simple example: sum = 2 * x + 1 {sum > 1} sum = 2 * x + 1 {sum > 1} The postcondition is {sum > 1} The postcondition is {sum > 1} One possible precondition is {x > 10} One possible precondition is {x > 10}

Dr. Muhammed Al-Mulhem 4ICS Weakest precondition A weakest precondition is the least restrictive precondition that will guarantee the postcondition. A weakest precondition is the least restrictive precondition that will guarantee the postcondition. For example, in the above statement and postcondition, For example, in the above statement and postcondition, { x > 10 } { x > 50 } { x > 100 } Are all valid precondition. The weakest precondition of all preconditions in this case is { x > 10 } The weakest precondition of all preconditions in this case is { x > 10 }

Dr. Muhammed Al-Mulhem 5ICS Correctness proofs If the Weakest precondition can be computed from the given postconditions for each statement of a language, then correctness proofs can be constructed for programs in that language as follows: If the Weakest precondition can be computed from the given postconditions for each statement of a language, then correctness proofs can be constructed for programs in that language as follows: The proof is begun by using the desired result of the program’s execution as the postcondition of the last statement of the program. The proof is begun by using the desired result of the program’s execution as the postcondition of the last statement of the program. This postcondition, along with the last statement, is used to compute the weakest precondition for the last statement. This postcondition, along with the last statement, is used to compute the weakest precondition for the last statement. This precondition is then used as the postcondition for the second last statement. This precondition is then used as the postcondition for the second last statement. This process continues until the beginning of the program is reached. This process continues until the beginning of the program is reached.

Dr. Muhammed Al-Mulhem 6ICS Correctness proofs At that point, the precondition of the first statement states the condition under which the program will compute the desired results. At that point, the precondition of the first statement states the condition under which the program will compute the desired results. If this condition is implied by the input specification of the program, the program has been verified to be correct. If this condition is implied by the input specification of the program, the program has been verified to be correct. To use axiomatic semantics for correctness proofs or for formal semantic specifications, either an axiom or an inference rule must be available for each kind of statement in the language. To use axiomatic semantics for correctness proofs or for formal semantic specifications, either an axiom or an inference rule must be available for each kind of statement in the language. An axiom is a true logical statement. An axiom is a true logical statement. An inference rule is a method of inferring the truth of an assertion based on other assertions. An inference rule is a method of inferring the truth of an assertion based on other assertions.

Dr. Muhammed Al-Mulhem 7ICS Axiomatic Semantics: Assignment statement Let x = E be a general assignment statement and Q be the postcondition. Let x = E be a general assignment statement and Q be the postcondition. Then its weakest precondition P, is defined by the axiom Then its weakest precondition P, is defined by the axiom P = Q x→E P is computed as Q with all instances of x replaced by E. P is computed as Q with all instances of x replaced by E.

Dr. Muhammed Al-Mulhem 8ICS Example For example, consider the following statement and postcondition. For example, consider the following statement and postcondition. a = b / { a < 10} The weakest precondition is computed by subsituting b/2-1 in the postcondition The weakest precondition is computed by subsituting b/2-1 in the postcondition b / < 10 b < 22

Dr. Muhammed Al-Mulhem 9ICS Notations for axiomatic semantics The usual notations are: The usual notations are: {P} S {Q} Where P is the precondition, Q is the postcondition and S is the statement. Where P is the precondition, Q is the postcondition and S is the statement. For the assignment statement, the notation is For the assignment statement, the notation is {Q x→E } x = E {Q}

Dr. Muhammed Al-Mulhem 10ICS Example Compute the precondition for the assignment statement Compute the precondition for the assignment statement x = 2 * y - 3 { x > 25 } The weakest precondition is computed as The weakest precondition is computed as 2 * y -3 > 25 y > 14

Dr. Muhammed Al-Mulhem 11ICS Example What about if the left side of the assignment appears in the right side of the assignment? What about if the left side of the assignment appears in the right side of the assignment? x = x + y - 3 {x > 10} The weakest precondition is The weakest precondition is x + y - 3 > 10 y > 13 – x Has no effect on the process of computing the precondition. Has no effect on the process of computing the precondition.

Dr. Muhammed Al-Mulhem 12ICS Axiomatic Semantics: Sequences The precondition for a sequence of statements cannot be described by an axiom, because the precondition depends on the particular kind of statements in the sequence. The precondition for a sequence of statements cannot be described by an axiom, because the precondition depends on the particular kind of statements in the sequence. The precondition can only be described with an inference rule. The precondition can only be described with an inference rule. Let S1 and S2 be adjacent statements. Let S1 and S2 be adjacent statements. Assume that S1 and S2 have the following pre/postconditions: Assume that S1 and S2 have the following pre/postconditions: {P1} S1 {P2} {P2} S2 {P3} The inference rule for such two-statement sequence is The inference rule for such two-statement sequence is The axiomatic semantics of the sequence S1; S2 is The axiomatic semantics of the sequence S1; S2 is

Dr. Muhammed Al-Mulhem 13ICS Axiomatic Semantics: Sequences The above inference rule states that to get the sequence precondition, the precondition of the second statement is computed. The above inference rule states that to get the sequence precondition, the precondition of the second statement is computed. This new assertion is used as the postcondition of the first statement, which can then be used to compute the precondition of the first statement. This new assertion is used as the postcondition of the first statement, which can then be used to compute the precondition of the first statement. This precondition can be used as the precondition for the whole sequence. This precondition can be used as the precondition for the whole sequence.

Dr. Muhammed Al-Mulhem 14ICS Example Assume we have the following sequence of statements: Assume we have the following sequence of statements: x1 = E1 x2 = E2 Then we have Then we have {P3 x2→E2 } x2 = E2 {P3} {P3 x2→E2 } x1→E1 x1 = E1 {P3 x2→E2 } Therefore, the precondition for the sequence x1=E1; x2=E2 with postcondition P3 is {P3 x2→E2 } x1→E1 Therefore, the precondition for the sequence x1=E1; x2=E2 with postcondition P3 is {P3 x2→E2 } x1→E1

Dr. Muhammed Al-Mulhem 15ICS Example Consider the following sequence and postcondition: Consider the following sequence and postcondition: y = 3 * x + 1; x = y + 3; {x < 10} The precondition for the last assignment statement is The precondition for the last assignment statement is y < 7 Which is used as the postcondition for the first statement. Which is used as the postcondition for the first statement. The precondition for the first statement and the sequence can be now computed. The precondition for the first statement and the sequence can be now computed. 3 * x + 1 < 7 x < 2

Dr. Muhammed Al-Mulhem 16ICS Axiomatic Semantics: Selection The general form of the selection statement is The general form of the selection statement is If B then S1 elese S2 The inference rule is The inference rule is This rule indicates that selection statements must be proven for both when the condition expression is true and when it is false. This rule indicates that selection statements must be proven for both when the condition expression is true and when it is false. The first logical statement above the line represents the then clause; the second represents the else clause. The first logical statement above the line represents the then clause; the second represents the else clause. We need a precondition P that can be used in the precondition of both the then and else clauses. We need a precondition P that can be used in the precondition of both the then and else clauses.

Dr. Muhammed Al-Mulhem 17ICS Example Consider the following selection statement: Consider the following selection statement: if ( x > 0 ) y = y - 1 else y = y + 1 Suppose the postcondition, Q for the selection statement is {y>0} Suppose the postcondition, Q for the selection statement is {y>0} We can then use the axiom for assignment on the then clause. We can then use the axiom for assignment on the then clause. y = y - 1 { y > 0} This produces {y -1 > 0} or {y > 1}. It can be used as the P part of the precondition of the then clause It can be used as the P part of the precondition of the then clause Now, Apply the same axiom for the else clause Now, Apply the same axiom for the else clause y = y + 1 { y > 0} which produces y = y + 1 { y > 0} or { y > -1} Because {y > 1} → {y > -1} Because {y > 1} → {y > -1} The rule uses {y > 1} for the precondition of the whole selection statement. The rule uses {y > 1} for the precondition of the whole selection statement.