CSE 637 Program Semantics and Verification

1
CSE 637Program Semantics and Verification
2
Reactive Systems

• Examples
• Operating Systems
• Embedded Systems (e.g. Heart Stimulator)
• Protocols
• Main Characteristics
• Termination is rather an error than a desired
  outcome.

Program
Environment
3
Properties of Reactive Systems

• Safety Property
• Something BAD never happens.
• Checking safety property is same as checking if
  a BAD state is ever reachable.
• Example It never happens that all traffic
  lights are simultaneously green.
• Liveness Property
• Something GOOD should eventually happen.

4
Verification Problem

• Problem Statement
• Given A program P, and a property f.
• Prove Whether P satisfies f.
• Examples of Properties
• - Program is syntactically correct.
• (BNF)
• - Program is type correct (type checking).
• (AST, Rules)
• - Array type array (index) out of bound.
• (Symbolic execution)
• a u 3v 5, evaluate (u3v)
• - All cars are going to eventually pass the
  intersection.

Complexity of Property
5
Compiler Passes
String of tokens
String of chars
Control/ data-flow analysis
Intermediate code generation
AST
3AC
scanner
parser
6
Compiler Passes (contd.)

• if a gt b then x 1 else x x 1
• if a gt b then x 1 else x x 1

scanner
id
op
id
id
op
cnst
cnst
id
op
id
op
parser
if then else
gt
a b x 1 x
x 1
7
Example Reaching Definitions
b0

• while i gt 0 do
• x a
• y b
• if (a gt b)
• x c
• else
• 4. y d
• i i 1
• od

i gt 0
b1
false
b9
true
b2
x a
b3
y b
a gt b
b4
b5
b6
y d
x c
b7
i i - 1
b8
8
Example Reaching Definitions (contd.)

• while i gt 0 do
• x a
• y b
• if (a gt b)
• x c
• else
• 4. y d
• i i 1
• od

gen(b0) gen(b1) gen(b4) gen(b7)
Ø kill(b0) Ø gen(b2) 1, kill(b2)
3 gen(b3) 2, kill(b3) 4 gen(b5) 3,
kill(b5) 1 gen(b6) 4, kill(b6)
2 gen(b8) 5, kill(b7) Ø
in
gen
b
out(b) gen(b) U (in(b) kill(b))
kill
out
9
Reaching Definitions Algorithm

• Input CFG with genB, killB computed for
  each block B.
• Output inB, outB for each block B.
• Method iterative least fixpoint computation
  starting with inB Ø.
• / Initialize outB on the assumption that inB
  Ø for all B /
• for each block B do outB genB end
• change true
• while change do begin / fixpoint iteration /
• change false
• for each block B do begin / graph traversal
  /
• inB Up in pred(B) outp
• oldout outB
• outB genB U (inB killB)
• if ( outB ? oldout ) then change true
• end
• end