Automated Formal Static Analysis and Retrieval of Source Code - JKU

2.2. FORWARD SYMBOLIC EXECUTION IN THE THEOREMA SYSTEM 13
2.2 Forward Symbolic Execution in the Theorema System
We integrated in the Theorema system a new verification environment based on symbolic execution
([Cow88, Kin76, HK76]), forward reasoning ([Dro90, LSS84]) and functional semantics
[McC63] for imperative program verification.
2.2.1 Basic Notions
A state σ is a set of replacements of the form {var → expr} with the meaning that every program
variable is initialized. We call the initialized variables – active variables. We also write sometimes
{var → expr} instead of {var 1 → expr 1 , var 2 → expr 2 , ...}.
Statements are used for building up programs. We use the following programming language
constructs: the abrupt statement Return, assignments (including recursive calls) and conditionals
(If with one and two branches). Recursive calls and conditionals insure the universality of the
programming language.
The specification of a program P is the tuple 〈I P , O P 〉, where I P is a first-order logic input
condition predicate and O P is a first-order logic output condition predicate. The program
correctness is proved relatively to its specification.
Forward reasoning was chosen in conjunction with symbolic execution for program analysis
because it follows naturally the execution of programs. The principle is as follows: we start from
the precondition of the program and apply a set of inference rules, depending on the type of the
program statement currently analyzed, and obtain a conjunction of formulae. The postcondition
of the program must be a logical consequence of the modified input condition.
In the program verification approaches using functional semantics, the flowchart of a program
is transformed into a function from its input state to its output state. We use this approach for
computing the program function which helps in defining the program semantics.
The approach that we integrated in the Theorema system is purely logical. We assume that the
properties of the constants, functions and predicates which are used in the program are specified
in an object theory Υ. (By a theory we understand a set of formulae in the language of predicate
logic with equality.) For the purpose of reasoning about imperative programs we construct a
certain meta–theory containing the properties of the meta–predicate Π (which checks a program
for syntactical correctness) and the meta–functions Σ (which defines the semantics of a program),
Γ (which generates the verification conditions) and Θ (which generates the termination condition).
The programming language constructs (statements), the program itself, as well as the terms and
the formulae from the object theory are meta–terms from the point of view of the meta-theory,
and they behave like quoted (because the meta–theory does not contain any equalities between
programming constructs, and also does not include the object theory).
2.2.2 A Meta-Logic for Reasoning about Imperative Programs
2.2.2.1 Syntax
We define the meta–level predicate Π for checking the appropriate syntax for the programs and,
additionally, if every variable used in the program is active and if every branch of the program has
a Return statement.