Software Verification 1 Deductive Verification Prof. Dr. Holger Schlingloff Institut für Informatik der Humboldt Universität und Fraunhofer Institut für offene Kommunikationssysteme FOKUS

Folie 2 H. Schlingloff, Software-Verifikation I Solvable Questions … What is the difference between propositional and predicate logic? Typed versus untyped FOL? What is a first-order model? How to prove completeness? Decidability and recursive enumerability? Resolution: how does it work? How to transform a formula into CNF? Equality?

Folie 3 H. Schlingloff, Software-Verifikation I FOL = Equality is not definable in FOL First order logic with equality contains an additional (binary) relation == which is always interpreted as equality of domain elements  Written in infix notation, i.e. (x==y) for ==(x,y) Axioms  (x==x) reflexivity  (x==y  (y==z  x==z)) transitivity  (x==y  y==x) symmetry  (x==y  (    (y:=x))) substitution Could this be a theory of SPASS?

Folie 4 H. Schlingloff, Software-Verifikation I Specifying a Database Specification of, e.g., a telephone book Entries are Name and Number Access functions are look_up, update, and remove An empty database is characterized by the predicate isEmpty Constructor function is initial, which yields an empty database

Folie 5 H. Schlingloff, Software-Verifikation I Axioms for the Database

Folie 6 H. Schlingloff, Software-Verifikation I Finding Models Our specification could be input to SPASS  types have to be modeled by predicates We use Z3 here  SMT-solver by Microsoft research  online in the “rise4fun” toolsuite  full prefix notation (p x (f x)) instead of p(x,f(x)) (remove initial name) instead of remove(initial, name) (= (+ 1 1) 2) instead of = 2

Folie 7 H. Schlingloff, Software-Verifikation I

Folie 8 H. Schlingloff, Software-Verifikation I

Folie 9 H. Schlingloff, Software-Verifikation I Treatment of Partial Functions One possibility: treat partial functions as relations, with the additional axiom (forall (x y z) (=> (and (f x y) (f x z)) (= y z))) Relations can be regarded as boolean functions! Other possibility: add an explicit “undefined” value (declare-const undef Number) (assert (forall ((n Name)) (= (look_up initial n) undef)))

Folie 10 H. Schlingloff, Software-Verifikation I Some Experiments

Folie 11 H. Schlingloff, Software-Verifikation I Strategies and Tactics Can be used to guide the resolution Example: splitting clauses, solving equations, reordering steps Knowledge of strategies essential for sophisticated proofs No guarantees exist that even “simple” proofs can be found