Review: Hoare triples, wp, sp from previous lecture03.

Big Picture of VCG

We will first consider programs without loops.

Normal Form of Loop-Free Programs

Compositional VCG

Forward VCG

Backward VCG

Assert and Error Conditions

Java Loop Desugaring

Hoare Logic Rule for Loops

Practical Aspects of VCG

\[ \frac{(\models P \rightarrow I);\ \{I\}c\{I\};\ (\models I \rightarrow Q)}

   {\{P\}\ {\it l{}o{}o{}p}\{I\}(c)\ \{Q\}}

\]

What is the rule for

\[ \frac{(\models P \rightarrow I?);\ \{I? \}c\{I\};\ (\models I? \rightarrow Q)}

   {\{P\}\ {\it while}\{I\}(F)(c)\ \{Q\}}

\]

• Calculus of Computation Textbook, Chapter 5 (Program Correctness: Mechanics)

• Weakest preconditions for unstructured programs

• one-point rule for equality
• introducing fresh names for branches
• general-purpose simplifications
• concolic testing idea

• Avoiding exponential explosion: generating compact verification conditions
• Verification Condition Generation via Theorem Proving
• CUTE Tool

assert(F) = irrecoverable error if is false, terminates execution.

wp computes conditions sufficient for errors not to happen.

Postconditions are just asserts at the end of the program.

How to build a system with relations where at the same time

wp(assert(F),Q) = (F & Q)
wp(assume(F),Q) = (F --> Q)

Then

wp(assert(false); assume(false),Q) = false
wp(assume(false); assume(false),Q) = true

so cannot have any more.

Sketch of how this can be done is in a homework from last year.

Notes on wp from last year