This is an old revision of the document!
Correctness of A/G Reasoning
Correctness as Approximation of Relations
Specification provides a relation that is intended to approximate relation defining the meaning of procedure, that is, we would like to prove \[
r \subseteq s
\]
Following Relational Semantics of Procedures, consider one procedure and its associated function \[
m : {\cal R} \to {\cal R}
\] and its fixed point .
The idea of approach based on specifications is to prove that, if we assume that procedure calls satisfy the specification, then we can prove the specification for the procedure we are verifying. In other words, specifications provide a relation such that \[
m(s) \subseteq s
\] We claim that where .
Proof:
Expressing Approximation Using Assume and Assert
Consider a program with only one state variable .
We express our approximation as \[
\begin{array}{l} assert\, (P(x));\\ havoc(x); \\ assume(Q(x)) \end{array}
\]
So, we would like to show that \[
r\qquad \subseteq\qquad \begin{array}{l} (assert\, (P(x));\\ havoc(x); \\ assume\, (Q(x))) \end{array}
\] is implied by the condition we are checking: \[
\begin{array}{l} (assume\, (P(x));\\ r; \\ assert\, (Q(x))) \end{array} \qquad\subseteq \qquad havoc(x)
\]
Shunting rules
Recall Assert and error conditions. We say that relation respects errors if for an error state we have for all states .
For relations , that respect errors, we have \[
assume(P) \mathop{;} r \subseteq s\ \ \leftrightarrow\ \ r \subseteq assert(P) \mathop{;} s
\] \[
r \mathop{;} assert(Q) \subseteq s\ \ \leftrightarrow\ \ r \subseteq s \mathop{;} assume(Q)
\]
Proofs:
- using relations
- using weakest preconditions (see homework in SAV'07)