CS156: The Calculus of Computation

Transcription

1 Page 1 of 61 CS156: The Calculus of Computation Zohar Manna Winter 2010 Chapter 5: Program Correctness: Mechanics

2 Page 2 of 61 Program A: LinearSearch with function 0 l u < rv i. l i u a[i] = e bool LinearSearch(int[] a, int l, int u, int e) { (int i := l; i u; i := i + 1) { if (a[i] = e) return true; return false;

3 Page 3 of 61 Function LinearSearch searches subarray of array a of integers for specified value e. Function specifications Function precondition (@pre) It behaves correctly only if 0 l and u < a Function postcondition (@post) It returns true iff a contains the value e in the range [l,u] for loop: initially set i to be l, execute the body and increment i by 1 as long as i - program annotation

4 Page 4 of 61 Program B: BinarySearch with function 0 l u < a sorted(a, rv i. l i u a[i] = e bool BinarySearch(int[] a, int l, int u, int e) { if (l > u) return false; else { int m := (l + u) div 2; if (a[m] = e) return true; else if (a[m] < e) return BinarySearch(a, m + 1, u, e); else return BinarySearch(a, l,m 1, e);

5 Page 5 of 61 The recursive function BinarySearch searches sorted subarray a of integers for specified value e. sorted: weakly increasing order, i.e. sorted(a, l,u) i, j. l i j u a[i] a[j] Defined in the combined theory of integers and arrays, T Z A Function specifications Function precondition (@pre) It behaves correctly only if 0 l and u < a and sorted(a, l, u). Function postcondition (@post) It returns true iff a contains the value e in the range [l,u]

6 Page 6 of 61 Program C: BubbleSort with sorted(rv, 0, rv 1) int[] BubbleSort(int[] a 0 ) { int[] a := a 0 ; (int i := a 1; i > 0; i := i 1) { (int j := 0; j < i; j := j + 1) { if (a[j] > a[j + 1]) { int t := a[j]; a[j] := a[j + 1]; a[j + 1] := t; return a;

7 1 Except the last iteration, which expands the sorted region by two cells, so that an entire array of length n is sorted in n 1 iterations. Page 7 of 61 Function BubbleSort sorts integer array a a: unsorted sorted largest by bubbling the largest element of the left unsorted region of a toward the sorted region on the right. Each iteration of the outer loop expands the sorted region by one cell. 1 Function specification Function postcondition (@post): BubbleSort returns array rv sorted on the range [0, rv 1].

8 Page 8 of 61 Sample execution of BubbleSort j i j i j i j i j, i j i

9 Page 9 of 61 Program Annotation Function Specifications function precondition (@pre) function postcondition (@post) Runtime Assertions 0 j < a 0 j + 1 < a a[j] := a[j + 1] Loop Invariants L : l i j. l j < i a[j] e The L : gives a name to the formula, just like the F : we ve used in other formulae.

10 Page 10 of 61 Program A: LinearSearch with runtime 0 l u < rv i. l i u a[i] = e bool LinearSearch(int[] a, int l, int u, int e) { L : (int i := l; i u; i := i + 1) 0 i < a ; if (a[i] = e) return true; return false;

11 Page 11 of 61 Program B: BinarySearch with runtime 0 l u < a sorted(a, rv i. l i u a[i] = e bool BinarySearch(int[] a, int l, int u, int e) { if (l > u) return false; else 2 0; int m := (l + u) div 0 m < a ; if (a[m] = e) return true; else 0 m < a ; if (a[m] < e) return BinarySearch(a, m + 1, u, e); else return BinarySearch(a, l,m 1, e);

12 Page 12 of 61 Program C: BubbleSort with sorted(rv, 0, rv 1) int[] BubbleSort(int[] a 0 ) { int[] a := a 0 ; L 1 : (int i := a 1; i > 0; i := i 1) { L 2 : (int j := 0; j < i; j := j + 1) 0 j < a 0 j + 1 < a ; if (a[j] > a[j + 1]) { int t := a[j]; a[j] := a[j + 1]; a[j + 1] := t; return a;

13 Page 13 of 61 Loop Invariants F cond { body apply body as long as cond holds assertion F holds at the beginning of every iteration evaluated before cond is checked F ( init ; cond ; incr ) { body init ; F cond { body ; incr

14 Page 14 of 61 Program A: LinearSearch with loop 0 l u < rv j. l j u a[j] = e bool LinearSearch(int[] a, int l, int u, int e) { : l i ( j. l j < i a[j] e) (int i := l; i u; i := i + 1) { if (a[i] = e) return true; return false;

15 Page 15 of 61 Proving Partial Correctness A function is partially correct if when the program s precondition is satisfied on entry, its postcondition is satisfied when the program halts/exits. A program + annotation is reduced to finite set of verification conditions (VCs), FOL formulae If all VCs are T-valid, then the program obeys its specification (partially correct)

16 Page 16 of 61 Basic Paths: Loops To handle loops, we break the program into basic precondition or loop invariant sequence of instructions (with no loop loop invariant, runtime assertion, or postcondition

17 Page 17 of 61 Program A: LinearSearch I Basic Paths of LinearSearch 0 l u < a i := : l i j. l j < i a[j] e : l i j. l j < i a[j] e assume i u; assume a[i] = e; rv := rv j. l j u a[j] = e

18 Page 18 of 61 Program A: LinearSearch II : l i j. l j < i a[j] e assume i u; assume a[i] e; i := i + : l i j. l j < i a[j] e : l i j. l j < i a[j] e assume i > u; rv := rv j. l j u a[j] = e

19 Page 19 of 61 Visualization of basic paths of LinearSearch (1) L

20 Page 20 of 61 Program C: BubbleSort with loop a 0 > sorted(rv, 0, rv 1) int[] BubbleSort(int[] a 0 ) { int[] a := a 0 ; for 0 i < 1 : partitioned(a, 0, i, i + 1, a 1) sorted(a, i, a 1) (int i := a 1; i > 0; i := i 1) {

21 Page 21 of 61 for 1 i < a 0 j i partitioned(a, 0, i, i + 1, a 2 : partitioned(a, 0, j 1, j, j) sorted(a, i, a 1) (int j := 0; j < i; j := j + 1) { if (a[j] > a[j + 1]) { int t := a[j]; a[j] := a[j + 1]; a[j + 1] := t; return a;

22 Page 22 of 61 Partition in T Z T A. partitioned(a, l 1, u 1, l 2, u 2 ) i, j. l 1 i u 1 < l 2 j u 2 a[i] a[j] That is, each element of a in the range [l 1, u 1 ] is each element in the range [l 2, u 2 ]. Basic Paths of a 0 > 0 a := a 0 ; (1) i := a 1; [ ] 0 i < a partitioned(a, 0, i, i + 1, a 1 : sorted(a, i, a 1)

23 Page 23 of 61 [ (2) ] 0 i < a partitioned(a, 0, i, i + 1, a 1 : sorted(a, i, a 1) assume i > 0; j := 0; [ ] 1 i < a 0 j i partitioned(a, 0, i, i + 1, a 2 : partitioned(a, 0, j 1, j, j) sorted(a, i, a 1)

24 Page 24 of 61 [ (3) ] 1 i < a 0 j i partitioned(a, 0, i, i + 1, a 2 : partitioned(a, 0, j 1, j, j) sorted(a, i, a 1) assume j < i; assume a[j] > a[j + 1]; t := a[j]; a[j] := a[j + 1]; a[j + 1] := t; j := j + 1; [ ] 1 i < a 0 j i partitioned(a, 0, i, i + 1, a 2 : partitioned(a, 0, j 1, j, j) sorted(a, i, a 1)

25 Page 25 of 61 [ (4) ] 1 i < a 0 j i partitioned(a, 0, i, i + 1, a 2 : partitioned(a, 0, j 1, j, j) sorted(a, i, a 1) assume j < i; assume a[j] a[j + 1]; j := j + 1; [ ] 1 i < a 0 j i partitioned(a, 0, i, i + 1, a 2 : partitioned(a, 0, j 1, j, j) sorted(a, i, a 1)

26 Page 26 of 61 [ (5) ] 1 i < a 0 j i partitioned(a, 0, i, i + 1, a 2 : partitioned(a, 0, j 1, j, j) sorted(a, i, a 1) assume j i; i := i 1; [ ] 0 i < a partitioned(a, 0, i, i + 1, a 1 : sorted(a, i, a 1)

27 [ (6) ] 0 i < a partitioned(a, 0, i, i + 1, a 1 : sorted(a, i, a 1) assume i 0; rv := sorted(rv, 0, rv 1) Visualization of basic paths of (1) (6) (5) L 1 L 2 (3), (4) Page 27 of 61

28 Page 28 of 61 Basic Paths: Function Calls Loops produce unbounded number of paths loop invariants cut loops to produce finite number of basic paths Reursive calls produce unbounded number of paths function specifications cut function calls In 0 l u < a 1 : 0 m + 1 u < a sorted(a,m + 1,u) return BinarySearch(a,m + 2 : 0 l m 1 < a sorted(a,l,m 1) return BinarySearch(a,l,m 1,e)...F[a,l,u,e]...F[a,m + 1,u,e]...F[a,l,m 1,e]

29 Page 29 of 61 Program B: BinarySearch with function call 0 l u < a sorted(a, rv i. l i u a[i] = e bool BinarySearch(int[] a, int l, int u, int e) { if (l > u) return false; else { int m := (l + u) div 2; if (a[m] = e) return true; else if (a[m] < e) 1 : 0 m + 1 u < a sorted(a, m + 1, u); return BinarySearch(a, m + 1, u, e); else 2 : 0 l m 1 < a sorted(a, l,m 1); return BinarySearch(a, l,m 1, e);

30 Page 30 of 61 0 l u < a sorted(a, l,u) assume l > u; rv := rv i. l i u a[i] = e 0 l u < a sorted(a, l,u) assume l u; m := (l + u) div 2; assume a[m] = e; rv := rv i. l i u a[i] = e

31 Page 31 of 61 0 l u < a sorted(a, l,u) assume l u; m := (l + u) div 2; assume a[m] e; assume a[m] < 1 : 0 m + 1 u < a sorted(a, m + 1, u)

32 Page 32 of 61 0 l u < a sorted(a, l,u) assume l u; m := (l + u) div 2; assume a[m] e; assume a[m] 2 : 0 l m 1 < a sorted(a, l,m 1)

33 Page 33 of 61 0 l u < a sorted(a, l,u) assume l u; m := (l + u) div 2; assume a[m] e; assume a[m] < e; assume v 1 i. m + 1 i u a[i] = e; rv := v 1 rv i. l i u a[i] = e

34 Page 34 of 61 0 l u < a sorted(a, l,u) assume l u; m := (l + u) div 2; assume a[m] e; assume a[m] e; assume v 2 i. l i m 1 a[i] = e; rv := v 2 rv i. l i u a[i] = e

35 Page 35 of (3), (4) (5), (6) R 1 (1) (2) R 2 (4) Figure: Visualization of basic paths of BinarySearch

36 Program States Program counter pc holds current location of control State s of P assignment of values to all variables (proper types) of P Example: s : { pc L2, a [0; 1; 2], i 3, j 0 is a state of BubbleSort. Reachable state s of P a state that can be reached during some computation of P Example: s : { pc L2, a [0; 1; 2], i 2, j 0 is a reachable state of BubbleSort. Page 36 of 61

37 Weakest Precondition wp(f, S) For FOL formula F, program statement S, s = wp(f, S) iff statement S is executed on state s to produce state s, and s = F: s s wp(f, S) S F wp(f, assume c) c F wp(f[v], v := e) F[e] For S 1 ;...;S n, wp(f, S 1 ;...;S n ) wp(wp(f, S n ), S 1 ;...;S n 1 ) Page 37 of 61

38 Page 38 of 61 Verification Conditions Verification Condition of basic F is S 1 ;... S n G F wp(g, S 1 ;...;S n ) Also denoted by {F S 1 ;...;S n {G That is, for every state s, if s = F then s = G (after the path S 1 ; S 2 ;...;S n is executed)

39 Example: Basic F : x 0 S 1 : x := x + G : x 1 (1) The VC is F wp(g, S 1 ). That is, wp(g, S 1 ) wp(x 1, x := x + 1) (x 1){x x + 1 x x 0 Therefore the VC of path (1) is x 0 x 0, which is T Z -valid. Page 39 of 61

40 Page 40 of 61 Example 1: Shortcut (backward substitution) VC: x 0 x 0 {{{{ F wp(g,s 1 : x 0 x i.e. x 0 S 1 : x := x + 1; x : x 1

41 Page 41 of 61 Example: Basic path (2) of LinearSearch : F : l i j. l j < i a[j] e S 1 : assume i u; S 2 : assume a[i] = e; S 3 : rv := G : rv j. l j u a[j] = e The VC is F wp(g, S 1 ; S 2 ; S 3 ). That is, wp(g, S 1 ; S 2 ; S 3 ) wp(wp(rv j. l j u a[j] = e, rv := true), S 1 ; S 2 ) wp(true j. l j u a[j] = e, S 1 ; S 2 ) wp( j. l j u a[j] = e, S 1 ; S 2 ) wp(wp( j. l j u a[j] = e, assume a[i] = e), S 1 ) wp(a[i] = e j. l j u a[j] = e, S 1 ) wp(a[i] = e j. l j u a[j] = e, assume i u) i u (a[i] = e j. l j u a[j] = e)

42 Page 42 of 61 Therefore the VC of path (2) is l i ( j. l j < i a[j] e) (i u (a[i] = e j. l j u a[j] = e)) (1) or, equivalently, l i ( j. l j < i a[j] e) i u a[i] = e j. l j u a[j] = e (2) according to the equivalence F 1 F 2 (F 3 (F 4 F 5 )) (F 1 F 2 F 3 F 4 ) F 5. This formula (2) is (T Z T A )-valid.

43 Page 43 of 61 Example 2: Shortcut (backward substitution) VC: l i ( j.a[j]) {{ F i u a[i] = e ( : F : l i j.l j < i a[j] e {{ A[j] i u a[i] = e ( j.b[j]) S 1 : assume i u; a[i] = e ( j.b[j])

44 Page 44 of 61 Example 2: Shortcut (backward substitution), cont. S 1 : assume i u; a[i] = e ( j.b[j]) S 2 : assume a[i] = e; true ( j.b[j]) i.e. ( j.b[j])) S 3 : rv := true; rv ( G : rv j.l j u a[j] = e {{ B[j]

45 Page 45 of 61 P-invariant and P-inductive I Consider program P with function f s.t. function precondition F pre and initial location L 0. A P-computation is a sequence of states s 0, s 1, s 2,... such that s 0 [pc] = L 0 and s 0 = F pre, and for each i, s i+1 is the result of executing the instruction at s i [pc] on state s i. where s i [pc] = value of pc given by state s i.

46 Page 46 of 61 P-invariant and P-inductive II A formula F annotating location L of program P is P-invariant if for all P-computations s 0, s 1, s 2,... and for each index i, s i [pc] = L s i = F Annotations of P are P-invariant iff each annotation of P is P-invariant at its location. Not Implementable: checking if F is P-invariant requires an infinite number of P-computations in general. Annotations of P are P-inductive iff all VCs generated from the basic paths of program P are T-valid P-inductive P-invariant In Practice: we check if the annotations are P-inductive.

47 Partial Correctness: For program P, if there is a P-invariant annotation, then P is partially correct. Page 47 of 61 Theorem (Verification Conditions) If for every basic 1 : F S 1 ;. S n j : G of program P, the verification condition {F S 1 ;...;S n {G is T-valid, then the annotations are P-inductive, and therefore P-invariant.

48 Page 48 of 61 Total Correctness Total Correctness = Partial Correctness + Termination For every input that satisfies F pre, the program eventually halts and produces output that satisfies F post. Proving function termination: Choose set W with well-founded relation Usually set of n-tuples of natural numbers with the lexicographic relation < n Find function δ (ranking function) mapping program states W such that δ decreases according to along every basic path. Since is well-founded, there cannot exist an infinite sequence of program states. The program must terminate.

49 Page 49 of 61 Showing decrease of ranking function For basic path with ranking F δ[x] S 1 ;. S k ; κ[x]... ranking function... ranking function We must prove that the value of κ W after executing S 1 ; ; S n is less than the value of δ W before executing the statements Thus, we show the verification condition F wp(κ δ[x 0 ], S 1 ; ; S k ){x 0 x.

50 Page 50 of 61 Example: BubbleSort loops Choose (N 2, < 2 ) as int[] BubbleSort(int[] a 0 ) { int[] a := a 0 ; 1 : i (i + 1, i + 1)...ranking function δ 1 (int i := a 1; i > 0; i := i 1) {

51 Page 51 of 61 2 : i i j 0 (i + 1, i j)...ranking function δ 2 (int j := 0; j < i; j := j + 1) { if (a[j] > a[j + 1]) { int t := a[j]; a[j] := a[j + 1]; a[j + 1] := t; return a;

52 Page 52 of 61 We have to prove loop invariants are inductive (we don t show here) function decreases along each basic path. The relevant basic 1 : i L 1 : (i + 1, i + 1) assume i > 0; j := 0; L 2 : (i + 1, i j) (1) Path (1): i i > 0 (i + 1, i 0) < 2 (i + 1, i + 1)

53 Page 53 of 2 : i i j 0 L 2 : (i + 1, i j) assume j < i; j := j + 1; L 2 : (i + 1, i j) (2, 3) Paths (2) and (3): i i j 0 j < i (i + 1, i (j + 1)) < 2 (i + 1, i j)

54 Page 54 of 2 : i i j 0 L 2 : (i + 1, i j) assume j i; i := i 1; L 1 : (i + 1, i + 1) (4) Path (4): i +1 0 i j 0 j i ((i 1)+1, (i 1)+1) < 2 (i +1, i j) All VCs are valid. Hence, BubbleSort always halts.

55 Page 55 of 61 Construction of last VC The verification condition for Path (4) is generated as follows: wp((i + 1, i + 1) < 2 (i 0 + 1, i 0 j 0 ), assume j i; i := i 1) wp(((i 1) + 1, (i 1) + 1) < 2 (i 0 + 1, i 0 j 0 ), assume j i) j i (i, i) < 2 (i 0 + 1, i 0 j 0 ) Replace back (i 0, j 0 ) (i, j): j i (i, i) < 2 (i + 1, i j), producing the VC i i j 0 j i (i, i) < 2 (i + 1, i j).

56 Page 56 of 61 Example 3: Shortcut (backward substitution) VC: i i j 0 j i (i, i) < 2 (i + 1, i j) i i j 0 j i (i, i) < 2 (i 0 + 1, i 0 j 0 2 : i i j 0 L 2 : (i + 1, i j) assume j i; i := i 1; L 1 : (i + 1, i + 1) j i (i, i) < 2 (i 0 + 1, i 0 j 0 ) j i (i, i) < 2 (i 0 + 1, i 0 j 0 ) (i, i) < 2 (i 0 + 1, i 0 j 0 ) (i + 1, i + 1) < 2 (i 0 + 1, i 0 j 0 )

57 Page 57 of 61 Example 3: Shortcut (backward substitution) VC: i i j 0 j i (i, i) < 2 (i + 1, i 2 : i i j 0 L 2 : (i + 1, i j) assume j i; i := i 1; L 1 : (i + 1, i + 1) j i (i, i) < 2 (i + 1, i j) j i (i, i) < 2? (i, i) < 2? (i + 1, i + 1) < 2?

58 Example: Binary Search recursive calls Choose (N, <) as well-founded set and ranking function δ : u u l + 1 u l ranking function δ bool BinarySearch(int[] a, int l, int u, int e) { if (l > u) return false; else { int m := (l + u) div 2; if (a[m] = e) return true; else if (a[m] < e) 1 : u (m + 1) BinarySearch(a, m + 1, u, e); else 2 : (m 1) l BinarySearch(a, l,m 1, e); Page 58 of 61

59 Page 59 of are P-invariant Show decrease in u l + u l u l + 1 assume l u; m := (l + u) div 2; assume a[m] e; assume a[m] < e; u (m + 1) + 1 (1) Verification condition: u l l u u (((l + u) div 2) + 1) + 1 < u l + 1

60 Page 60 of 61 Show decrease in u l + u l u l + 1 assume l u; m := (l + u) div 2; assume a[m] e; assume a[m] e; (m 1) l + 1 (2) Verification condition: u l l u (((l + u) div 2) 1) l + 1 < u l + 1

61 Page 61 of 61 Note: two other basic paths (... return false and... return true) are irrelevant to the termination argument (recursion ends at each). Both VCs are T Z -valid. Thus BinarySearch halts on all input in which l is initially at most u + 1.