Bradley, Manna. The Calculus of Computation, Springer, 2007

168 6 Program Correctness: Strategies

beq(rv , a0, 0, ℓ − 1) beq(rv , a0, u + 1, |a0| − 1) .

The bounded equality predicate beq is defined

beq(a, b, k1, k2) i. k1 ≤ i ≤ k2 → a[i] = b[i]

in the theory TZ TA. It asserts that two arrays are equal in the index range [k1, k2].

The annotations for partition vary slightly because of its return type:

|rv .array| = |a0| beq(rv .array, a0, 0, ℓ − 1)beq(rv .array, a0, u + 1, |a0| − 1)

Since partition returns an integer (pivot) and an array (array) in a qs structure, the postcondition asserts facts about rv .array.

To finish with qsort, formalize that qsort sorts the range [ℓ, u] of the given array:

sorted(rv , ℓ, u) .

So far, then, we have specified qsort as follows:

To finish the specification of partition, recall that partition is intended to return an array that is partitioned around the pivot element. Therefore, let us formalize the description that we gave above. Observe that the specification of random guarantees that

ℓ ≤ rv .pivot ≤ u ,

as desired. Now, for the left subarray,

i. ℓ ≤ i < rv .pivot → rv .array[i] ≤ rv .array[rv .pivot] ,

or, as a partition,

partitioned(rv .array, ℓ, rv .pivot − 1, rv .pivot, rv .pivot) ,

while for the right subarray,

i. rv .pivot < i ≤ u → rv .array[rv .pivot] < rv .array[i] .

We weaken this assertion slightly to

partitioned(rv .array, rv .pivot, rv .pivot, rv .pivot + 1, u) ,

tioning for the next level of recursion, which we already observed earlier as the final partitioned assertions of the function postcondition.

The annotations of QuickSort and qsort are inductive. Exercise 6.3 asks the reader to finish the proof by annotating the for loop of partition so that the annotations of partition are also inductive.

6.2.2 Total Correctness

To prove total correctness — that QuickSort actually returns a sorted arrays — we need to prove that QuickSort always halts. Our implementation of QuickSort has both recursive behavior in function qsort and looping behavior in function partition. We must analyze both possible sources of nontermination.

To prove that the loop in partition always halts, let us use the obvious ranking function of δ1 : u −j suggested by the structure of the loop. δ1 clearly maps the program state to Z, but we prove the stronger fact that δ1 actually maps the program state to N with well-founded relation <. In particular, we prove that

•u − j ≥ 0 is a loop invariant;

•and u − j decreases on each iteration.

Annotating the loop with the bounds on j suggested by the loop structure proves that the loop always halts:

for

@L1 : ℓ ≤ j j ≤ u ↓ δ1 : u − j

(int j := ℓ; j < u; j := j + 1)

Proving that the recursion of qsort always halts is superficially more difficult. The argument that we would like to make is that u − ℓ decreases on each recursive call, which requires proving that the pivot value returned by partition lies within the range [ℓ, u].

Observe, however, that u − ℓ may be negative when qsort is called with ℓ > u. But in this case, ℓ = u + 1, for either |a0| = 0, and qsort was called from QuickSort; or p.pivot = ℓ or p.pivot = u, and qsort was called recursively. More generally, we can establish that u − ℓ + 1 ≥ 0 is an invariant of qsort. Hence, δ2 : u − ℓ + 1 is our proposed ranking function that maps the program states to N with well-founded relation <.

Figure 6.5 formalizes the arguments that δ1 and δ2 are ranking functions. Notice that bounds on i are proved as loop invariants at L1. These bounds imply that rv .pivot lies within the range [ℓ, u] as required.

One trick that would avoid reasoning about the case in which ℓ > u is to cut the recursion at a point within qsort rather than at function entry. Figure 6.6 provides an alternate argument in which the ranking function labels the

172 6 Program Correctness: Strategies

@pre u − ℓ + 1 ≥ 0 @post

↓ δ2 : u − ℓ + 1

int[] qsort(int[] a0, int ℓ, int u) { int[] a := a0;

if (ℓ ≥ u) return a; else {

qs p := partition(a, ℓ, u);

a:= p.array;

a:= qsort(a, ℓ, p.pivot − 1);

a:= qsort(a, p.pivot + 1, u); return a;

}

}

@pre ℓ ≤ u

@post ℓ ≤ rv .pivot rv .pivot ≤ u qs partition(int[] a0, int ℓ, int u) {

.

.

.

int i := ℓ − 1; for

@L1 : ℓ ≤ j j ≤ u ℓ − 1 ≤ i i < j

}

Fig. 6.5. QuickSort always halts

else branch in qsort. The first branch terminates the recursion. partition is annotated as in Figure 6.5.

6.3 Summary

This chapter presents strategies for specifying and proving the correctness of sequential programs. It covers:

•Strategies for proving partial correctness. The need for strengthening annotations. Basic facts; the precondition method.

174 6 Program Correctness: Strategies

@pre

@post sorted(rv , 0, |rv | − 1) int[] InsertionSort(int[] a0) {

int[] a := a0; for @

(int i := 1; i < |a|; i := i + 1) { int t := a[i];

for @

(int j := i − 1; j ≥ 0; j := j − 1) { if (a[j] ≤ t) break;

a[j + 1] := a[j];

}

a[j + 1] := t;

}

return a;

}

Fig. 6.8. InsertionSort

6.2(InsertionSort). Prove the partial correctness of InsertionSort. That is, annotate the function; list basic paths and verification conditions; and argue that the VCs are valid. See Figure 6.8.

As in other languages, the break statement moves control to the loop exit.

6.3(QuickSort). Finish the proof of the sortedness property of QuickSort. That is, annotate partition of Figure 6.3 so that its precondition and postcondition annotations given at the end of Section 6.2 are inductive.

6.4(MergeSort). Prove the partial correctness of MergeSort. See Figure 6.9. The function merge uses the pi keyword new, which allocates an array of the

specified size. Therefore, it is known after the allocation to buf that |buf | = u − ℓ + 1.

First, deduce the function specifications for ms and merge by focusing on MergeSort and ms. Prove MergeSort and ms correct with respect to these annotations. Then analyze merge.

Since MergeSort is fairly long, you need not list basic paths and VCs. Just present MergeSort with its inductive annotations.

6.5 (Weak permutation). Define weak permutation as follows:

Unfortunately, the decision procedures for arrays discussed in Chapter 11 cannot decide the validity of VCs arising from wperm annotations, as such VCs fall outside of the studied fragments of TA. Instead, we describe an approximation.

Exercises 175

Consider annotating BubbleSort as in Figure 6.10. The define keyword defines a global constant. In this case, e is defined to have some nondeterministic value; that is, e stands for an arbitrary integer. The annotations then use this e in wperm literals, where wperm is defined as follows:

wperm(a, a0, e) ( i. a[i] = e) ↔ ( j. a0[j] = e) .

Compared to the full definition (6.1) of weak permutation, wperm does not have a universally quantified variable e; instead, it uses a given expression e, in this case the global constant e.

(a)Argue that the annotations of Figure 6.10 are inductive. That is, list the VCs and argue their validity.

(b)Argue that the annotations imply that BubbleSort actually satisfies the weakest permutation property. That is, prove that the validity of the VC

wperm(a, a0, e) a′ = . . . → wperm(a′, a0, e)

implies the validity of the VC

( e. ( i. a[i] = e) ↔ ( j. a0[j] = e)) a′ = . . .

→( e. ( i. a′[i] = e) ↔ ( j. a0[j] = e)) .

(c)Can this approximation be used to prove the weakest permutation property of

(i)InsertionSort (Figure 6.8)?

(ii)MergeSort (Figure 6.9)?

(iii)QuickSort (Section 6.2)?

If so, prove it. If not, explain why not.

6.6(Sets with arrays). Implement an API (application programming interface) for manipulating sets. The underlying data structure of the implementation is arrays.

(a)Prove the correctness of the union function of Figure 6.11 by adding inductive annotations.

(b)Implement and specify and prove the correctness of an intersection function, which takes two arrays a0 and b0 and returns the intersection of the sets they represent.

(c)Implement and specify and prove the correctness of a subset function, which takes two arrays a0 and b0 and returns true i the first set, represented by a0, is a subset of the second set, represented by b0.

6.7(Sets with sorted arrays). Implement an API for manipulating sets. The underlying data structure of the implementation is sorted arrays.

(a)Prove the correctness of the union function of Figure 6.12 by adding inductive annotations.

176 6 Program Correctness: Strategies

(b)Implement and specify and prove the correctness of an intersection function, which takes two sorted arrays a0 and b0 and returns the intersection of the sets they represent as a sorted set.

(c)Implement and specify and prove the correctness of a subset function,

which takes two sorted arrays a0 and b0 and returns true i the first set, represented by a0, is a subset of the second set, represented by b0.

6.8(QuickSort halts). Provide the basic paths and verification conditions for the proof of Section 6.2.2 that QuickSort always halts.

6.9(Intuitive ranking functions). Following the proof that the recursion of qsort halts, move the location of the ranking function annotations in the following functions to produce more intuitive arguments:

(a)BinarySearch, Figure 5.2

(b)BubbleSort, Figure 5.3

(c)InsertionSort, Figure 6.8

6.10(Fewer annotations). Notice in the annotated BubbleSort of Figure

5.17that there are only a finite number of basic paths from function entry to L2, from L2 to function exit, and from L2 back to itself.

(a)List these basic paths.

(b)Annotate only the inner loop of BubbleSort so that the VCs corresponding to the basic paths of (a) are valid.

(c)Treat InsertionSort of Figure 5.25 similarly.

(d)Similarly, annotate only the inner loop of BubbleSort with a ranking annotation.

(e)Treat InsertionSort similarly.

Exercises 177

@pre

@post sorted(rv , 0, |rv | − 1) int[] MergeSort(int[] a) { return ms(a, 0, |a| − 1);

}

@pre @post

int[] ms(int[] a0, int ℓ, int u) { int[] a := a0;

if (ℓ ≥ u) return a; else {

int m := (ℓ + u) div 2;

a:= ms(a, ℓ, m);

a:= ms(a, m + 1, u);

a:= merge(a, ℓ, m, u); return a;

}

}

@pre @post

int[] merge(int[] a0, int ℓ, int m, int u) { int[] a := a0, buf := new int[u − ℓ + 1]; int i := ℓ, j := m + 1;

for @

(int k := 0; k < |buf |; k := k + 1) { if (i > m) {

buf [k] := a[j];

j:= j + 1;

}else if (j > u) { buf [k] := a[i];

i := i + 1;

}else if (a[i] ≤ a[j]) { buf [k] := a[i];

i := i + 1;

}else {

buf [k] := a[j]; j := j + 1;

}

}

for @

(k := 0; k < |buf |; k := k + 1) { a[ℓ + k] := buf [k];

}

return a;

}

Fig. 6.9. MergeSort