1. Mathematical Reasoning with Data Abstractions
Jason Hallstrom and Murali Sitaraman
Clemson University

2. Formal Verification Goal: To prove correctness
Method: The rest of this presentation
Can prove correctness on all valid inputs
Can show absence of bugs

3. Example Specification: Operation Do_Nothing (restores S: Stack);
Goal: Same as ensures S = #S;
Code:
Procedure Do_Nothing (restores S: Stack);
Var E: Entry;
Pop(E, S);
Push(E, S);
end Do_Nothing;

4. Recall: Basics of Mathematical Reasoning
Suppose you are verifying code for some operation P
Assume its requires clause in state 0
Confirm its ensures clause at the end
Suppose that P calls Q
Confirm the requires clause of Q in the state before Q is called
Why? Because caller is responsible
Assume the ensures clause of Q in the state after Q
Why? Because Q is assumed to work
Prove assertions to be confirmed

5. Exercise: Complete table and prove!
Assume Confirm
0 … …
Pop(E, S);
1 … …
Push(E. S);
2 … …

6. Recall Specification of Stack Operations
Operation Push (alters E: Entry; updates S: Stack);
requires |S| < Max_Depth;
ensures S = <#E> o #S;
Operation Pop (replaces R: Entry; updates S: Stack);
requires |S| > 0;
ensures #S = <R> o S;
Operation Depth (restores S: Stack): Integer;
ensures Depth = |S|; …

7. Collaborative Exercise: Answers
Assume Confirm
0 … |S| > 0
Pop(E, S);
1 S0 = <E1> o S1 |S| < Max_Depth
Push(E. S);
2 S2 = <E1> o S1 S2 = S0 …

8. Discussion Is the code Correct? If not, fix it
Important Idea: The reasoning table can be filled mechanically
Principles of reasoning about all objects and operations are the same
Need mathematical specifications
VC generation and automated verification demo