1. Axiomatic Verification II
Software Testing and Verification
Lecture Notes 18
Prepared by
Stephen M. Thebaut, Ph.D.
University of Florida

2. Axiomatic Verification II
Reasoning about iteration (while loops)
Strong correctness and proving termination

3. Review of Proof Rules
Before proceeding to while loops, let’s capture our previous reasoning about sequencing, selection statements, and state condition replacement in appropriate rules of inference (ROI).
ROI for Sequencing:
{P} S1 {R}, {R} S2 {Q}
{P} S1; S2 {Q}

4. Review of Proof Rules (cont’d)
ROI for if_then_else statement:
{P Л b } S1 {Q}, {P Л b} S2 {Q}
{P} if b then S1 else S2 {Q}
ROI for if_then statement:
{P Л b } S {Q}, (P Л b)  Q
{P} if b then S {Q}

5. Review of Proof Rules (cont’d)
ROI for State Condition Replacement†:
K  P, {P} S {Q}, Q  W
{K} S {W}
† Also known as the consequence rule.

6. Reasoning about Iteration
Consider the assertion:
{P} while b do S {Q}
What are the necessary conditions for this assertion to hold?

7. Necessary Conditions: while_do
So, we know that {P} while b do S {Q} will hold if the following conditions hold:
Case 0: (P Л b)  Q
Case 1: {P Л b} S {K1}, (K1 Л b)  Q
Case 2: {K1 Л b} S {K2}, (K2 Л b)  Q …
Case N: {KN-1 Л b} S {KN}, (KN Л b)  Q …
Great! But who has the time to show that an infinite number of conditions hold?

8. Reasoning about Iteration (cont’d)
To eliminate the infinite sequence of conditions, replace each Ki with I (where I  Ki for every i). Then the conditions above become:
Case 0: (P Л b)  Q
Case 1: {P Л b} S {I}, (I Л b)  Q
All other Cases: {I Л b} S {I}
To simplify, require further that P  I. Then the four conditions reduce to three:
P  I, {I Л b} S {I}, (I Л b)  Q

9. Reasoning about Iteration (cont’d)
Thus, a ROI for the while_do statement is:
P  I, {I Л b} S {I}, (I Л b)  Q
{P} while b do S {Q}
where the three antecedents are sometimes given the names initialization, preservation, and finalization, respectively.
The assertion “I” in this context is informally referred to as an Invariant, or more precisely as a Q-adequate loop invariant.

10. Invariants and Q-adequate invariants
A loop invariant is a Boolean-valued predicate that satisfies initialization and preservation.
A Q-adequate loop invariant is a loop invariant that also satisfies finalization.
Note that there may be an arbitrary number of valid loop invariants. For example, true is a trivial loop invariant for any while loop.
The stronger the invariant, the more one can conclude from it together with b.

11. Example 3 Use the Q-adequate invariant I: Z=XJ to prove:
{true}
Z := X
J := 1
while J<>Y do
Z := Z+X
J := J+1
end_while
{Z=XY}
Initialization: P  I
Preservation: {I Л b} S {I}
Finalization: (I Л b)  Q

12. Example 3 Use the Q-adequate invariant I: Z=XJ to prove:
{true}
Z := X
J := 1
while J<>Y do
Z := Z+X
J := J+1
end_while
{Z=XY}
Initialization: P  I
What is “P”?
(Z=X Л J=1) P

13. Example 3 Use the Q-adequate invariant I: Z=XJ to prove:
{true}
Z := X
J := 1
while J<>Y do
Z := Z+X
J := J+1
end_while
{Z=XY}
Initialization: P  I
What is “P”?
(Z=X Л J=1)
Does (Z=X Л J=1)  Z=XJ?
 X=X(1) P 

14. Example 3 Use the Q-adequate invariant I: Z=XJ to prove:
{true}
Z := X
J := 1
while J<>Y do
Z := Z+X
J := J+1
end_while
{Z=XY}
Initialization: P  I
What is “P”?
(Z=X Л J=1)
Does (Z=X Л J=1)  Z=XJ?
Yep! P

15. Example 3 Use the Q-adequate invariant I: Z=XJ to prove:
{true}
Z := X
J := 1
while J<>Y do
Z := Z+X
J := J+1
end_while
{Z=XY}
Initialization: P  I 

16. Example 3 Use the Q-adequate invariant I: Z=XJ to prove:
{true}
Z := X
J := 1
while J<>Y do
Z := Z+X
J := J+1
end_while
{Z=XY}
Initialization: P  I 
Preservation: {I Л b} S {I}
{Z=XJ Л JY}
Z := Z+X
{Z=X(J+1) Л JY}
J := J+1
{Z=X((J-1)+1) Л J-1Y}
 Z=XJ b S

17. Example 3 Use the Q-adequate invariant I: Z=XJ to prove:
{true}
Z := X
J := 1
while J<>Y do
Z := Z+X
J := J+1
end_while
{Z=XY}
Initialization: P  I 
Preservation: {I Л b} S {I} 

18. Example 3 Use the Q-adequate invariant I: Z=XJ to prove:
{true}
Z := X
J := 1
while J<>Y do
Z := Z+X
J := J+1
end_while
{Z=XY}
Initialization: P  I 
Preservation: {I Л b} S {I} 
Finalization: (I Л b)  Q

19. Example 3 Use the Q-adequate invariant I: Z=XJ to prove:
{true}
Z := X
J := 1
while J<>Y do
Z := Z+X
J := J+1
end_while
{Z=XY}
Initialization: P  I 
Preservation: {I Л b} S {I} 
Finalization: (I Л b)  Q
Does (Z=XJ Л J=Y)  Z=XY?
 XJ=X(J)
Yep! 

20. Example 3 Use the Q-adequate invariant I: Z=XJ to prove:
{true}
Z := X
J := 1
while J<>Y do
Z := Z+X
J := J+1
end_while
{Z=XY}
Initialization: P  I 
Preservation: {I Л b} S {I} 
Finalization: (I Л b)  Q 

21. Heuristics for Identifying “I”
Hypothesize a predicate that reflects the incre-mental progress made toward satisfying Q with each iteration.
Check finalization. If necessary, refine the pre-dicate so as to be just strong enough to imply Q on termination (i.e., when b becomes false).
Check initialization. If necessary, refine the pre-dicate so as to be just weak enough to be implied by P and return to step (2).
Check preservation. If necessary, refine the pre-dicate so as to ensure preservation with respect to S and return to step (2).

22. finish true false true strengthen false true weaken false false refine
Hypothesize I
true
Finalization ?
false
true
strengthen
Initialization ?
false
true
weaken
Preservation ?
false
false
finish
Initialization ?
refine
true
false
Preservation ?
true

23. Example 4 Synthesize a Q-adequate invariant and prove:     Nope!
Sum := 0
J := 1
while J<=N do
Sum := Sum + X[J]
J := J+1
end_while
{Sum = X[i]}
Hypothesized I:
Does finalization
hold? I.e., does
J-1
Sum = X[i] 
i=1
J-1
(Sum = X[i] Л J>N)  
i=1 N N 
Sum = X[i]?
Nope! 
i=1
i=1

24. Example 4 Synthesize a Q-adequate invariant and prove:    
Sum := 0
J := 1
while J<=N do
Sum := Sum + X[J]
J := J+1
end_while
{Sum = X[i]}
Hypothesized I: (try #2)
Does finalization
hold? I.e., does
J-1
Sum = X[i] Л JN+1 
i=1
J-1
(Sum = X[i] Л JN+1 Л
J>N)  
i=1 N N 
Sum = X[i]? 
i=1
i=1
Yep!

25. Example 4 Synthesize a Q-adequate invariant and prove:   Sum := 0
J := 1
while J<=N do
Sum := Sum + X[J]
J := J+1
end_while
{Sum = X[i]}
Hypothesized I: (try #2)
Finalization 
J-1
Sum = X[i] Л JN+1 
i=1 N 
i=1

26. Example 4 Does initialization
Synthesize a Q-adequate invariant and prove:
{N1}
Sum := 0
J := 1
while J<=N do
Sum := Sum + X[J]
J := J+1
end_while
{Sum = X[i]}
Hypothesized I: (try #2)
Does initialization
hold? I.e., does
J-1
Sum = X[i] Л JN+1 
i=1
(N1 Л Sum=0 Л J=1) 
J-1
(Sum = X[i] Л JN+1)?  N 
i=1
i=1
Yep!

27. Example 4 Initialization 
Synthesize a Q-adequate invariant and prove:
{N1}
Sum := 0
J := 1
while J<=N do
Sum := Sum + X[J]
J := J+1
end_while
{Sum = X[i]}
Hypothesized I: (try #2)
Finalization 
Initialization 
J-1
Sum = X[i] Л JN+1 
i=1 N 
i=1

28. Example 4 Synthesize a Q-adequate invariant and prove:     
Sum := 0
J := 1
while J<=N do
Sum := Sum + X[J]
J := J+1
end_while
{Sum = X[i]}
Hypothesized I: (try #2)
Does preservation hold?
J-1
Sum = X[i] Л JN+1 
i=1
J-1
{Sum = X[i] Л JN+1 Л JN} 
i=1
Sum := Sum + X[J] J N
{Sum = X[i] Л JN}  
i=1
i=1
J := J+1
J-1
{Sum = X[i] Л J-1N} = {I}  
i=1

29. Example 4 Initialization  Preservation 
Synthesize a Q-adequate invariant and prove:
{N1}
Sum := 0
J := 1
while J<=N do
Sum := Sum + X[J]
J := J+1
end_while
{Sum = X[i]}
Hypothesized I: (try #2)
Finalization 
Initialization 
Preservation 
J-1
Sum = X[i] Л JN+1 
i=1 N 
i=1

30. Strong Correctness
Program S is said to be strongly correct with respect to pre-condition P and post-condition Q iff:
{P} S {Q} (i.e., S is weakly correct with respect to P and Q), and
P implies that S will terminate.

31. Strong Correctness (cont’d)
Is it possible to prove that a program will terminate?
Are there programs for which termination is undecidable?
To write a program which should terminate but doesn’t is a minor sin. To write a program for which termination is undecidable is a major sin. –Harlan Mills

32. Let’s Pause for a Moment…
I remember, as a young boy, watching small, brown frogs jump from Lilly pad to Lilly pad in the pond behind our house. They seemed to never tire of this…

33. Proving Termination – the Method of Well-Founded Sets†
For each program loop, identify a measure based on one or more program variables that satisfies the following properties:
decreases (or increases) with each iteration
is bounded from below (or above), and
can assume only a finite number of values before reaching the bound
†A well-founded set (S, >) consists of a set of elements S and an
ordering > defined on the elements, such that there can be no
infinite descending sequences of elements.

34. Proving Termination – the Method of Well-Founded Sets (cont’d)
Example: consider a linear search of an unordered list for the value K:
{true}
Found := false
J := 1
while (J<=N and (not Found)) do
Found := (K=X[J])
J := J+1
end_while
{(Found Л K=X[J-1]) V (Found Л i∈{1,…,N}• KX[i])}

35. Proving Termination – the Method of Well-Founded Sets (cont’d)
Proof of termination:
Measure: “J”
J increases with each iteration since J:=J+1 is executed with each iteration and J does not otherwise change.
J is bounded from above (by N+1) since if J exceeds N, J<=N will evaluate to false and the loop must terminate.

36. Proving Termination – the Method of Well-Founded Sets (cont’d)
Proof of termination: (cont’d)
Since J increases by an integral amount with each iteration, it can assume only a finite number of values before reaching N+1: {1, 2,…, N, N+1}.
Therefore, by the Method of Well-Founded Sets, the loop must terminate.

37. Exercise
The weak correctness of the assertion below was established earlier. Can the Method of Well-Founded Sets be used to prove the program will terminate?
{true}
Z := X
J := 1
while J<>Y do
Z := Z+X
J := J+1
end_while
{Z=XY}

38. A while_do ROI for strong correctness
We can incorporate a termination term, t, in the while loop ROI.
Let t denote a whole number† which decreases with each iteration and implies termination when less than or equal to 0:
PI, (IЛb)(t>0), {IЛbЛt=N} S {IЛt<N}, (IЛb)Q
{P} while b do S {Q} strongly
† Any well-founded ordering may be used for the domain of t.

39. Problem Set 5: Axiomatic Verification
Note especially...
Problem 4: deriving and using a suitable Rule of Inference for the “repeat_until” construct, and
Problem 6: alternative, hypothesized Rules of Inference for the “while” construct...are they valid or not?

40. Axiomatic Verification II
Software Testing and Verification
Lecture Notes 18
Prepared by
Stephen M. Thebaut, Ph.D.
University of Florida