Automated Formal Static Analysis and Retrieval of Source Code - JKU

2.2. FORWARD SYMBOLIC EXECUTION IN THE THEOREMA SYSTEM 17
8. Γ[σ, Φ, 〈If[ϕ τ←u[γ] , P T , P F ]〉 ⌣ P ] =
Γ[σ, Φ, 〈w := u[γ], If[ϕ τ←w , P T , P F ]〉 ⌣ P ]
9. Γ[σ, Φ, 〈If[ϕ, P T , P F ]〉 ⌣ P ] = ∧ { Γ[σ, Φ ∧ ϕσ, P T ⌣ P ]
Γ[σ, Φ ∧ ¬ϕσ, P F ⌣ P ]
The verification conditions corresponding to the program P are generated as follows: we
start analyzing the program P and, in the first step (Definition 2.2.3.1), we create the substitution
{¯x → ¯x 0 } (all the input variables are initialized in the initial state) and the path condition I P [ ¯x 0 ]
(the input condition has to be fulfilled before the program analysis).
The meta-level function Γ analyzes each statement of the program as follows:
• a composed term (definitions 2.2.3.3, 2.2.3.7 and 2.2.3.8) is first decomposed such that no
nested functions are present. After the decomposition, we analyze its parts separately.
• a Return statement (Definition 2.2.3.2) finishes the execution of the program on the current
path and a functional verification condition is generated. The formula representing the
postcondition depends on the input variable and the term returned by the Return statement.
The statements after the Return statement are ignored;
• a constant or variable assignment (Definition 2.2.3.4) updates the substitution σ, while a
function (definitions 2.2.3.5 and 2.2.3.6) and term assignments (Definition 2.2.3.7), have to
be treated in the following way: safety verification conditions have to be generated for every
function (including f): the arguments of them must satisfy the respective input condition
and afterwards the analysis of the program continues with the input condition of the function
as new assumption ;
• a conditional analysis determines the forking of the program into two branches: one when
ϕ evaluates to T rue and one in the opposite case. The branch P F of the program might be
also the empty tuple, case which corresponds to the If statement with one branch.
The order of the above clauses of Γ has a semantic meaning. Namely, we use this as an
abbreviation for additional conditions which should be added to the clauses of the definition in
order to specify that, for instance, the equality from the Definition 2.2.3.9 is applied only if no
subterm of ϕ is of the form u[γ] – as specified in the clause from the Definition 2.2.3.7.
2.2.2.4 Termination
We want to generate verification conditions which insure that a program is correct with respect
to a specification composed of two object–level formulae: the input condition I f [x] and the
output condition O f [x, y]. Apparently, the correctness could be expressed as: “The formula
∀
x
I f [x] ⇒ O f [x, P [x]] is a logical consequence of the theory Υ augmented with Σ[P ] and with
the verification conditions.” However, this always holds in the case that Σ[P ] is contradictory to
Υ, which may happen when the program is recursive. Therefore, it is crucial that the existence
(and possibly the uniqueness) of a f satisfying Σ[P ] is a logical consequence of the object theory
augmented with the verification conditions. More concretely, before using Σ[P ] as an assumption,