Discrete Mathematcs and Logic II.

Transcription

1 Discrete Mathematcs and Logic II. SFWR ENG 2FA3 Ryszard Janicki Winter 2014 Acknowledgments: Material based the paper Computing Properties of Numerical Imperative Programs by Symbolic Computation by Jacques Carette and Ryszard Janicki (2007). Ryszard Janicki Discrete Mathematcs and Logic II. 1 / 10

2 Consider the well-known procedure factorial, written in a small subset of Maple: factorial := proc(n::posint) local i, fac i:=1; fac:=1; while i < n do begin i:=i+1 fac:=fac i; end; end proc; Since n does not change its value in the above program we may consider it as a constant, so we may assume the above program has two integer variables i and fac. Ryszard Janicki Discrete Mathematcs and Logic II. 2 / 10

3 Dene D = ZZ ZZ, where ZZ is the set of integers, and denote the elements of D as (i, fac). Each assignment statement can be modeled by a function F i : D D, i = 1, 2, 4, 5, in the following manner: "i:=1" corresponds to F 1 (i, fac) = (1, fac), "fac:=1" corresponds to F 2 (i, fac) = (i, 1), "i:=i+1" corresponds to F 4 (i, fac) = (i + 1, fac), and "fac:=fac*i" maps to F 5 (i, fac) = (i, fac i). The test "i<n" can be modeled by two partial identity functions, I 3, Ī 3 : D D, where I 3 models "i<n", and Ī 3 models its complement, i.e. "i n". More precisely, "i<n" corresponds to I 3 (i, fac), and "i n" corresponds to Ī 3 (i, fac), where ( denotes undened) I 3 (i, fac) = { (i, fac) if i < n otherwise Ī 3 (i, fac) = { (i, fac) if i n otherwise Ryszard Janicki Discrete Mathematcs and Logic II. 3 / 10

4 Let R, R 1, R 2 be relations (each function is a relation!) that model the program statements S, S1, S2, respectively. Let T be a test modeled by partial identities I T and Ī T, and let the symbols and denote the composition of relations, and transitive and reexive closure of relations (Kleene star), respectively. Formally, if R, R 1, R 2 X X, then x(r 1 R 2 )y (z z X : xr 1 z zr 2 y) R = i=0 R i = (i i = 0,..., : R i ), where R 0 = Identity Alternative denition of R : xr y (i 0 i < : xr i y) Ryszard Janicki Discrete Mathematcs and Logic II. 4 / 10

5 We can now model the basic programming constructs as follows "S1;S2" is modeled by R 1 R 2, "if T then S1 else S2" is modeled by (I T R 1 ) (Ī T R 2 ), and "while T do S" is modeled by (I T R) Ī T. Using this scheme one can easily model the above program by writing the following (symbolic) relational expression: F = F 1 F 2 (I 3 F 4 F 5 ) Ī 3, or F = F 1 }{{} i:=1 F 2 }{{} fac:=1 i n i<n i:=i+1 fac:=fac i {}}{{}}{{}}{{}}{ ( I 3 F 4 F 5 ) Ī }{{ 3 } while i<n do i:=i+1;fac:=fac i od Ryszard Janicki Discrete Mathematcs and Logic II. 5 / 10

6 If R 1 and R 2 are (possibly partial) functions, calculating R = R 1 R 2 is easy: R(x 1,..., x n ) = R 2 (R 1 (x 1,..., x n )). If at least one of R 1, R 2 is not a function, in general, we have to use the rule: (x 1,..., x n )R 1 R 2 (z 1,..., z n ) (y 1,..., y n : (x 1,..., x n )R 1 (y 1,..., y n ) (y 1,..., y n )R 2 (z 1,..., z n )). Nevertheless, it might happen that R 1 R 2 is a function even if both R 1 and R 2 are not. In general R 1 R 2 is not a function, even if both R 1 and R 2 are functions. Similarly, R = i=0 R i = (i 0 i < : R i ) is almost never a function, even if R is a function, since if R is a function, then (x 1,..., x n )R (y 1,..., y n ) (i i 0 : (y 1,..., y n ) = R i (x 1,..., x n )), and this may happen for many, even innite number of i's. Ryszard Janicki Discrete Mathematcs and Logic II. 6 / 10

7 Lemma (1) 1 For any test T, if R 1 and R 2 are functions then (I T R 1 ) (Ī T R 2 ) is always a function. 2 For any test T, if R is a function, then (I T R) Ī T is either a function or the empty relation. 3 For any test T, if R is a function and (I T R) Ī T, then ((I T R) Ī T )(x) = R k(x) (x) where k(x) is the smallest j such that Ī T (R j (x 1,..., x n ))(x). Ryszard Janicki Discrete Mathematcs and Logic II. 7 / 10

8 Dene G = I 3 F 4 F 5 and H = G Ī 3, so F = F 1 F 2 H. First note that (F 1 F 2 )(i, fac) = F 2 (F 1 (i, fac)) = (1, 1), so F (i, fac) = H(F 2 (F 1 (i, fac))) = H(1, 1). For the function G we have: G(i, fac) = (I 3 F 4 F 5 )(i, fac) = F 5 (F 4 (I 3 (i, fac))) = Similarly : G 2 (i, fac) = G(G(i, fac)) = Hence : G j (i, fac) = { (i + 1, fac (i + 1)) { (i + 2, fac (i + 1) (i + 2)) if i + 1 < n if i + 1 n { (i + j, fac (i + 1) (i + 2)... (i + j)) if i + j 1 < n if i + j 1 n Notice that this last step requires a small amount of human ingenuity to see the pattern (although it can be automated in some cases). Ryszard Janicki Discrete Mathematcs and Logic II. 8 / 10

9 From Lemma 1(3) it follows H(i, fac) = G k (i, fac) where k = k(i, fac) is the smallest j such that Ī 3 (G j (i, fac)). In this case we can easily show that there is only one such j and that k(i, fac) = n i. Denote fac = fac (i + 1) (i + 2)... (i + j). First note that Ī 3 (G j (i, fac)) implies G j (i, fac), i.e. G j (i, fac) = (i + j, fac ) and i + j 1 < n. Furthermore Ī 3 (i + j, fac ) implies i + j n. From i + j 1 < n and i + j n we immediately get i + j = n, or j = n i. Hence k(i, fac) = n i, i.e. H(i, fac) = G n i (i, fac) = (n, fac (i + 1) (i + 2)... n). This means so F (i, fac) = H(1, 1) = (n, n!), (n n IN : factorial(n) = n!). Ryszard Janicki Discrete Mathematcs and Logic II. 9 / 10

10 To make this technique feasible for bigger, more realistic programs, we need a tool that would be able to do all those symbolic calculations. The reasoning presented above rely heavily on Lemma 1(3) and is rather typical for human beings. Many steps and observations are not easy to mechanize. Nevertheless, this technique has most likely better prospects to eventually lead to almost automatic theorem provers (at least for some special kind of programs), than Hoare Logic. On the other hand, for human beings skillful in nding loop invariant, Hoare Logic is probably more convenient. Ryszard Janicki Discrete Mathematcs and Logic II. 10 / 10