CSC5125 Program Verification

1
CSC5125 Program Verification

• Introduction

2
What is program verification?

• An attempt to show, generally mathematically,
  that a program does what it is supposed to do

3
Why study program verification?

• Semantics is an interesting area in theoretical
  computer science
• Wed like to be able to write better programs

4
Why is program verification needed?

• Some bugs are bad
• Expense to fix
• Cost to a customer/the company that developed the
  s/w
• Therac 25
• Arianne 5
• Many others!

5
Why is program verification needed?

• What about testing?
• Part of the software engineering process
• Testing can only show the presence of bugs, not
  their absence

6
Why arent program verification tools/processes
widely used?

• Its hard
• Higher learning curve
• Generally takes longer to develop s/w when trying
  to show it works at the same time
• It isnt foolproof
• Verification consists of specifications (what
  properties are to be verified) and their proof of
  correctness

7
Why arent program verification tools/processes
widely used?

• Verification consists of specifications (what
  properties are to be verified) and their proof of
  correctness
• Cannot mechanically guarantee the correctness of
  a specification (Goedel)
• Can only prove correctness of the mathematical
  abstraction, not of the system itself (which
  depends on the correctness of the compilation,
  the correct operation of the underlying hardware,
  etc.)

8
Why arent program verification tools/processes
widely used?

• Problems of scalability
• We will only be working with very small programs
• However, there are several formal methods systems
  available for larger scale development
• Possible independent study a study of the Z
  specification language

9
Conclusion wrt program verification

• PV isnt perfect, but is probably as close as we
  can reasonably get!
• PV is useful for mission critical s/w
• You will become a better programmer in learning
  about PV (unless you forget everything you
  learned about PV at the end of this class)

10
What sorts of languages can we use PV for?

• Sequential vs. concurrent (why is concurrent
  harder?)
• Imperative vs. declarative (why is imperative
  harder?)

11
An example using (mathematical) logic to prove
correctness
When will this program return bad results?
12
Using logical assertions
On what input will this program fail to give
correct output?
13
Another attempt
Under what inputs will this program give
incorrect output?
14
Another attempt
Correct, but we should also use invariants!
15
Assertions in Java

• Requires JDK 1.4
• Syntax
• assert boolean_expression
• assert boolean_expression number
• assert boolean_expression string
• On compile, add source 1.4 option
• javac myprogram.java source 1.4
• On run, add ea option first
• java ea myprogram

16
Example with invariants