Automated Formal Static Analysis and Retrieval of Source Code - JKU

2.4. IMPLEMENTATION AND EXAMPLES 23
(
∀
a,b
a≥0,b≥0
⎧
∧
⎪⎨
⎪⎩
a = 0 ⇒ π[a, b]
(a ≠ 0 ∧ b ≠ 0 ∧ a > b ∧ π[a − b, b]) ⇒ π[a, b]
(a ≠ 0 ∧ b ≠ 0 ∧ a ≠> b ∧ π[a, b − a]) ⇒ π[a, b]
(a ≠ 0 ∧ b = 0) ⇒ π[a, b]
)
=⇒
(
∀
a,b
a≥0,b≥0
)
π[a, b]
Description. The previously verification conditions were generated by analyzing each path of
the program and applying the notions of program syntax, semantics, partial correctness and termination
introduced previously.
Before the program starts to be analyzed, the substitution {a → a 0 , b → b 0 } and the formula
representing the accumulated assumptions a 0 ≥ 0 ∧ b 0 ≥ 0 are created. After the program is
completely analyzed, the input variables are universally quantified thus the reverting substitution
is done.
On the path 10, 1, 2, 3, 4, 11, the verification conditions were generated as follows: we add
to the formula a 0 ≥ 0 ∧ b 0 ≥ 0 the conjunct a = 0, corresponding to the T rue evaluation of the
If conditional. The Return statement determines the generation of the functional verification
condition 2.2, where the value of y from the postcondition was replaced by the value returned by
the program on this branch, namely b.
On the path 10, 1, 2, 5, 6, 7, 9, 11, the assignment from the line 7 requires a term decomposition
from the innermost to the outermost function symbol. The assumptions collected
before the term analysis is the formula a ≥ 0 ∧ b ≥ 0 ∧ a ≠ 0 ∧ b ≠ 0. The specification
of the functions composing the term GCD[a-b, b] has to be fulfilled. First the function
,,-” is analyzed, generating the safety condition 2.3, insuring the respective precondition.
The assumptions on this path are updated with the specification of the function ,,-”, namely
a ≥ 0 ∧ b ≥ 0) ∧ a ≠ 0 ∧ b ≠ 0 ∧ a > b ∧ a ≥ b.
The analysis of the function GCD is done similarly: the precondition has to hold for the
arguments of the recursive call, the output value as well. The functional verification condition
(2.5) is generated, where all the occurrences of the function GCD are replaced by the new constant
y1.
The path 10, 1, 2, 5, 8, 9, 11 is analyzed similar to the path 10, 1, 2, 5, 6, 7, 9, 11 and the path
10, 1, 2, 9, 11, similar to the path 10, 1, 2, 3, 4, 11.
The termination condition is obtained similarly to the verification conditions. It is an implication
of two first order logical formulae (we consider that the predicate π is fixed), both universally
quantified upon the input variables. The right hand side is always the predicate π with the input
variables as arguments and the left hand side is a conjunction of formulae, each conjunct (having
the shape of an implication) corresponding to the analysis of a single path. If on the path there
exists a recursive call then the new introduced predicate symbol π occurs in the both sides of the
implication within the conjunct (the second and the third conjunct corresponding to the second
and the third path of the program). The π occurring on the left hand side has the arguments of the
recursive call on the respective branch. If there is not a recursive call then the π occurs only on
the right hand side (the first and the forth conjunct).