\documentclass[t]{beamer}
\mode<presentation>

\newcommand{\lecnumber}{5}

\include{cocmacros}
\newcommand{\uuline}[1]{\underline{\underline{#1}}}
\newcommand{\ures}[3]{
  \begin{array}{c@{\hspace*{2em}}c} 
    #1 & #2 \\ \hline \multicolumn{2}{c}{#3} 
  \end{array}}
\newcommand{\uex}{\underline{Example}}

\title{\lecnumber. Program Correctness: Mechanics}
\date{}
\institute[Stanford University]

\begin{document}

\setbeamertemplate{footline}[text line]
{
	%\begin{large}
	\hspace*{\stretch{1}}\lecnumber - \insertframenumber \bigskip
	%\end{large}
}

\begin{frame}[c]
\Large
\textsc{The Calculus of Computation:}\\
Decision Procedures with\\
Applications to Verification

\bigskip
\bigskip
by\\
Aaron Bradley\\
Zohar Manna

\bigskip
\bigskip
Springer 2007
\end{frame}

\begin{frame}
	\titlepage
\end{frame}

\begin{frame}
\underline{Program A}: \uuline{LinearSearch} with function specification
\begin{figure}
  \begin{pilisting}
    \lsearchSpecified
  \end{pilisting}
\end{figure}
\end{frame}

\begin{frame}
Function \uuline{LinearSearch} searches subarray of array $a$ of integers for specified value $e$.

\bigskip
\underline{Function specifications}
\begin{itemize}
\item Function postcondition $(@post)$\\
It returns \underline{true} iff $a$ contains the value $e$ in the range $[\ell,u]$
\item Function precondition $(@pre)$\\
It behaves correctly only if $0\le \ell$ and $u < |a|$
\end{itemize}

\bigskip
\underline{for loop}: initially set $i$ to be $\ell$,\\
\smallskip
\qquad execute the body and increment $i$ by 1\\
\smallskip
\qquad as long as $i \le n$

\bigskip
$@$ - program annotation
\end{frame}

\begin{frame}
\underline{Program B}: \uuline{BinarySearch} with function specification
\begin{figure}
  \begin{pilisting}
    \bsearchSpecified
  \end{pilisting}
\end{figure}
\end{frame}

\begin{frame}
The recursive function \uuline{BinarySearch} searches subarray of sorted array $a$ of integers for specified value $e$.

\bigskip
\underline{sorted}: weakly increasing order, i.e.
\[
\psort(a,\ell,u) \Bequiv \forall i,j.\ \ell \le i \le j \le u \bimplies \ard{a}{i} \le \ard{a}{j}
\]
Defined in the combined theory of integers and arrays, $T_{\integers \cup A}$

\bigskip
\underline{Function specifications}
\begin{itemize}
\item Function postcondition $(@post)$\\
It returns \underline{true} iff $a$ contains the value $e$ in the range $[\ell,u]$
\item Function precondition $(@pre)$\\
It behaves correctly only if $0\le \ell$ and $u < |a|$
\end{itemize}
\end{frame}

\begin{frame}[shrink=5]
\underline{Program C}: \uuline{BubbleSort} with function specification
\begin{figure}
  \begin{pilisting}
    \bbsortSortedSpecified
  \end{pilisting}
\end{figure}
\end{frame}

\begin{frame}
Function \uuline{BubbleSort} sorts integer array $a$
\begin{center}
{\Large
a: \fbox{\ uns\rnode{U}{or}ted\ } \fbox{\rnode{S}{\ }\ sorted\ \ }
}
\psset{nodesep=3pt}
\ncarc[arcangle=-90]{->}{U}{S}\bput{:U}{largest}
\end{center}

\bigskip
\bigskip
by ``bubbling'' the largest element of the left unsorted region of $a$ toward the sorted region on the right.

\bigskip
Each iteration of the outer loop expands the sorted region by one cell.
\end{frame}

\begin{frame}[shrink=5]
{\Large Sample execution of BubbleSort}
\begin{figure}
\newcommand{\sep}{\hspace*{2em}}
\[
\begin{array}{@{}c@{\sep}c@{\sep}c@{\sep}c@{\sep}c@{\sep}c@{\sep}c@{}}
2 & 3 & 4 & 1 & 2 & \rnode{51}{5} & \rnode{61}{6} \\
j &   &   &   & i &   &   \\ \\
2 & 3 & 4 & 1 & 2 & \rnode{51}{5} & \rnode{61}{6} \\
  & j &   &   & i &   &   \\ \\
2 & 3 & \circlenode{42}{4} & \circlenode{12}{1} & 2 & \rnode{52}{5} & \rnode{62}{6} \\
  &  & j &   & i &   &   \\ \\
2 & 3 & 1 & \circlenode{43}{4} & \circlenode{23}{2} & \rnode{53}{5} & \rnode{63}{6} \\
  &   &   & j & i &   &   \\ \\
2 & 3 & 1 & 2 & 4 & \rnode{54}{5} & \rnode{64}{6} \\
  &  &   &   & j,i &   &   \\ \\
2 & 3 & 1 & 2 & \rnode{45}{4} & 5 & \rnode{65}{6} \\
j &   &   & i &   &   &

\ncbox[nodesep=.15,boxsize=.3,linearc=.2,linestyle=dotted]{51}{61}
\ncbox[nodesep=.15,boxsize=.3,linearc=.2,linestyle=dotted]{52}{62}
\ncbox[nodesep=.15,boxsize=.3,linearc=.2,linestyle=dotted]{53}{63}
\ncbox[nodesep=.15,boxsize=.3,linearc=.2,linestyle=dotted]{54}{64}
\ncbox[nodesep=.15,boxsize=.3,linearc=.2,linestyle=dotted]{45}{65}

\ncarc[arcangle=45]{<->}{42}{12}
\ncarc[arcangle=45]{<->}{43}{23}

\end{array}
\]
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Program Annotation}
\begin{itemize}
\item \underline{Function Specifications}\\
\smallskip
function postcondition $(@post)$\\
\smallskip
function precondition $(@pre)$\\
\bigskip
\item \underline{Runtime Assertions}\\
\begin{tabular}{ll}
e.g., & $@\ 0 \le j < |a| \band 0 \le j+1 < |a|$\\
& $a[j]:=a[j+1]$
\end{tabular}\\
\bigskip
\item \underline{Loop Invariants}\\
\begin{tabular}{ll}
e.g., & $@\ L: \ell \le i \band \forall j.\ \ell \le j < i \bimplies a[j] \ne e$\\
\end{tabular}
\end{itemize}
\end{frame}

\begin{frame}
\underline{Program A}: LinearSearch with runtime assertions
\begin{figure}
  \begin{pilisting}
    \lsearchRuntimeSpecified
  \end{pilisting}
\end{figure}
\end{frame}

\begin{frame}
\underline{Program B}: BinarySearch with runtime assertions
\begin{figure}
  \begin{pilisting}
    \bsearchRuntimeSpecified
  \end{pilisting}
\end{figure}
\end{frame}

\begin{frame}
\underline{Program C}: BubbleSort with runtime assertions
{\small
\begin{figure}
  \begin{pilisting}
    \bbsortRuntimeSpecifiedShort
  \end{pilisting}
\end{figure}
}
\end{frame}

\begin{frame}
\frametitle{Loop Invariants}
\qquad $
\begin{piprogram}
  \piwhile \\
  \hspace*{1em} \piassert F \\
  \hspace*{1em} {\sparam{cond}}\ \{ \ {\sparam{body}}\ \}
\end{piprogram}
$\\
\smallskip
\begin{itemize}
\item apply $\sparam{body}$ as long as $\sparam{cond}$ holds
\item assertion $F$ holds at the beginning of every iteration\\
evaluated before $\sparam{cond}$ is checked
\end{itemize}

\medskip
\qquad $\begin{piprogram}
  \pifor \\
  \hspace*{1em} \piassert F \\
  \hspace*{1em} ({\sparam{init}}; {\sparam{cond}}; {\sparam{incr}})\ \{\ {\sparam{body}}\ \}
\end{piprogram}$\\
\bigskip
\qquad $\Bimplies$\\
\bigskip
\qquad $\begin{piprogram}
  \sparam{init}; \\
  \piwhile \\
  \hspace*{1em} \piassert F \\
  \hspace*{1em} {\sparam{cond}}\ \{\ \sparam{body}\ \sparam{incr}\ \}
\end{piprogram}$
\end{frame}

\begin{frame}
\underline{Program A}: LinearSearch with loop invariants
\begin{figure}
  \begin{pilisting}
    \lsearchProved
  \end{pilisting}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Proving Partial Correctness}
A function is \underline{partially correct} if\\
\quad when the function's precondition is satisfied on entry,\\
\quad its postcondition is satisfied when the function halts.

\bigskip
\begin{itemize}
\item A function + annotation is reduced to finite set of
\underline{verification conditions} (VCs), FOL formulae
\item If all VCs are valid, then the function obeys
its specification (partially correct)
\end{itemize}

\end{frame}

\begin{frame}
\underline{Basic Paths: Loops}\\
\smallskip
To handle loops, we break the function into \underline{basic paths}

\bigskip
\qquad \begin{tabular}{l}
$@\ \leftarrow$ precondition or loop invariant\\
\\
sequence of instructions\\
(with no loop invariants)\\
\\
$@\ \leftarrow$ loop invariant, assertion, or postcondition
\end{tabular}
\end{frame}

\begin{frame}
{\Large \underline{Program A: LinearSearch}}\\
\medskip
\underline{Basic Paths of LinearSearch}\\
\smallskip
\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{1}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \pipre 0 \le \ell \band u < |a| \\
  i \pia \ell; \\
  \piassert \piloc{L}:\ \ell \le i \band \forall j.\ \ell \le j < i \bimplies a[j] \ne e
\end{array}$ \hspace*{\fill}\\
\rule[.5ex]{\textwidth}{.2mm}

\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{2}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \piassert \piloc{L}:\ \ell \le i \band \forall j.\ \ell \le j < i \bimplies a[j] \ne e \\
  \piassume i \le u; \\
  \piassume a[i] = e; \\
  \pirv \pia \pitrue; \\
  \pipost \pirv \biff \exists j.\ \ell \le j \le u \band a[j] = e
\end{array}$ \hspace*{\fill}\\
\rule[.5ex]{\textwidth}{.2mm}
\end{frame}

\begin{frame}
\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{3}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \piassert\piloc{L}:\ \ell \le i \band \forall j.\ \ell \le j < i \bimplies a[j] \ne e \\
  \piassume i \le u; \\
  \piassume a[i] \ne e; \\
  i \pia i + 1; \\
  \piassert\piloc{L}:\ \ell \le i \band \forall j.\ \ell \le j < i \bimplies a[j] \ne e
\end{array}$ \hspace*{\fill}\\
\rule[.5ex]{\textwidth}{.2mm}

\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{4}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \piassert\piloc{L}:\ \ell \le i \band \forall j.\ \ell \le j < i \bimplies a[j] \ne e \\
  \piassume i > u; \\
  \pirv \pia \pifalse; \\
  \pipost \pirv \biff \exists j.\ \ell \le j \le u \band a[j] = e
\end{array}$ \hspace*{\fill}\\
\rule[.5ex]{\textwidth}{.2mm}
\end{frame}

\begin{frame}
Visualization of basic paths of LinearSearch
\begin{figure}[tb]
  \centering
  \begin{tabular}{c}
    \ovalnode{0}{$\pipre$} \\
    \\
    \circlenode{1}{$L$} \\
    \\
    \ovalnode{f}{$\pipost$}

    \ncline{->}{0}{1}
    \trput{\pipathn{1}}
    \nccircle[angleA=90]{->}{1}{.5}
    \tlput{\pipathn{3}}
    \ncline{->}{1}{f}
    \trput{\pipathn{2},\pipathn{4}}
  \end{tabular}
\end{figure}
\end{frame}

\newcommand{\pifunctionx}[5]{
    \pipre #1 \\
    \pipost #2 \\
    \pityp{#3} \pifn{#4}(#5)
}
\newcommand{\piforstmtx}[4]{
  \pifor \\
  \hspace*{1em} \piassert #1 \\
  \hspace*{1em} (#2;\ #3;\ #4)
}
\newcommand{\pirfforstmtx}[5]{
  \pifor \\
  \hspace*{1em} \piassert #1 \\
  \hspace*{1em} \pirank #2 \\
  \hspace*{1em} (#3;\ #4;\ #5)
}

\begin{frame}
\underline{Program C}: BubbleSort with loop invariants
\begin{figure}
\rule{\textwidth}{.5mm}	
\[
  \begin{array}{l}
  \pifunctionx{\true}{
    \psort(\pirv, 0, |\pirv| - 1)
  }{int[]}{BubbleSort}{\pityp{int[]} a_0}
  \ \{ \\
  \hspace*{1em}
    \begin{array}{@{}l@{}}
    \pityp{int[]} a \pia a_0; \\
    \piforstmtx{\piloc{L_1}:\ \piassertion{
	-1 \le i < |a| \\
	\band \ppart(a, 0, i, i+1, |a|-1) \\
	\band \psort(a, i, |a|-1)
    }}{\pityp{int} i \pia |a| - 1}{i > 0}{i \pia i - 1}
	\ \{ \\
    \end{array}
  \end{array}
\]
\end{figure}
\end{frame}

\begin{frame}
\begin{figure}
\[
  \begin{array}{l}
    \hspace*{1em}
    \begin{array}{@{}l@{}}
      \hspace*{1em}
      \begin{array}{@{}l@{}}
      \piforstmt{\piloc{L_2}:\ \piassertion{
	1 \le i < |a| \band 0 \le j \le i \\
	\band \ppart(a, 0, i, i+1, |a|-1) \\
	\band \ppart(a, 0, j-1, j, j) \\
	\band \psort(a, i, |a|-1)
      }}{\pityp{int} j \pia 0}{j < i}{j \pia j + 1}{
	\piifstmt{a[j] > a[j + 1]}{
	  \pityp{int} t \pia a[j]; \\
	  a[j] \pia a[j+1]; \\
	  a[j+1] \pia t;
    }} \\
      \end{array}\\
	\} \\
    \pireturn a;
    \end{array}\\
  \}
  \end{array}
\]
\rule{\textwidth}{.5mm}	
\end{figure}
\end{frame}

\begin{frame}
\underline{Partition}\\
\[
\begin{multiline}
  \ppart(a,\ell_1,u_1,\ell_2,u_2) \\
  \hspace*{1em} \Bequiv
  \forall i,j.\ \ell_1 \le i \le u_1 < \ell_2 \le j \le u_2 \bimplies \ard{a}{i} \le \ard{a}{j}
\end{multiline}
\]
in $\tint \cup \tarr$.

\smallskip
That is, each element of $a$ in the range $[\ell_1, u_1]$ is $\le$
each element in the range $[\ell_2,u_2]$.

\medskip
\underline{Basic Paths of BubbleSort}

\smallskip
\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{1}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \pipre \true; \\
  a \pia a_0; \\
  i \pia |a| - 1; \\
  \piassert\piloc{L_1}:\ -1 \le i < |a| \band \ppart(a, 0, i, i+1, |a|-1)\\
  \qquad \band \psort(a, i, |a|-1)
\end{array}$\\
\rule[.5ex]{\textwidth}{.2mm}
\end{frame}

\begin{frame}[shrink=3]
\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{2}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \piassert\piloc{L_1}:\ -1 \le i < |a| \band \ppart(a, 0, i, i+1, |a|-1)\\
  \qquad \band \psort(a, i, |a|-1) \\
  \piassume i > 0; \\
  j \pia 0; \\
  \piassert\piloc{L_2}:\ \piassertion{
    1 \le i < |a| \band 0 \le j \le i
    \band \ppart(a, 0, i, i+1, |a|-1) \\
    \band \ppart(a, 0, j-1, j, j)
    \band \psort(a, i, |a|-1)
  }
\end{array}$\\
\rule[.5ex]{\textwidth}{.2mm}

\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{3}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \piassert\piloc{L_2}:\ \piassertion{
    1 \le i < |a| \band 0 \le j \le i
    \band \ppart(a, 0, i, i+1, |a|-1) \\
    \band \ppart(a, 0, j-1, j, j)
    \band \psort(a, i, |a|-1)
  } \\
  \piassume j < i; \\
  \piassume a[j] > a[j+1]; \\
  t \pia a[j]; \\
  a[j] \pia a[j+1]; \\
  a[j+1] \pia t; \\
  j \pia j + 1; \\
  \piassert\piloc{L_2}:\ \piassertion{
    1 \le i < |a| \band 0 \le j \le i
    \band \ppart(a, 0, i, i+1, |a|-1) \\
    \band \ppart(a, 0, j-1, j, j)
    \band \psort(a, i, |a|-1)
  }
\end{array}$ \hspace*{\fill}\\
\rule[.5ex]{\textwidth}{.2mm}
\end{frame}

\begin{frame}
\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{4}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \piassert\piloc{L_2}:\ \piassertion{
    1 \le i < |a| \band 0 \le j \le i
    \band \ppart(a, 0, i, i+1, |a|-1) \\
    \band \ppart(a, 0, j-1, j, j)
    \band \psort(a, i, |a|-1)
  } \\
  \piassume j < i; \\
  \piassume a[j] \le a[j+1]; \\
  j \pia j + 1; \\
  \piassert\piloc{L_2}:\ \piassertion{
    1 \le i < |a| \band 0 \le j \le i
    \band \ppart(a, 0, i, i+1, |a|-1) \\
    \band \ppart(a, 0, j-1, j, j)
    \band \psort(a, i, |a|-1)
  }
\end{array}$ \hspace*{\fill}\\
\rule[.5ex]{\textwidth}{.2mm}

\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{5}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \piassert\piloc{L_2}:\ \piassertion{
    1 \le i < |a| \band 0 \le j \le i
    \band \ppart(a, 0, i, i+1, |a|-1) \\
    \band \ppart(a, 0, j-1, j, j)
    \band \psort(a, i, |a|-1)
  } \\
  \piassume j \ge i; \\
  i \pia i - 1; \\
  \piassert\piloc{L_1}:\ -1 \le i < |a| \band \ppart(a, 0, i, i+1, |a|-1)\\
  \qquad \band \psort(a, i, |a|-1)
\end{array}$ \hspace*{\fill}\\
\rule[.5ex]{\textwidth}{.2mm}
\end{frame}

\begin{frame}
\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{6}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \piassert\piloc{L_1}:\ -1 \le i < |a| \band \ppart(a, 0, i, i+1, |a|-1) \band\\
  \qquad \psort(a, i, |a|-1) \\
  \piassume i \le 0; \\
  \pirv \pia a; \\
  \pipost \psort(\pirv, 0, |\pirv|-1)
\end{array}$ \hspace*{\fill}\\
\rule[.5ex]{\textwidth}{.2mm}

\medskip
Visualization of basic paths of BubbleSort
\begin{figure}[tb]
  \centering
  \begin{tabular}{ccc}
    & \ovalnode{0}{$\pipre$} \\
    \\
    & \circlenode{1}{$L_1$} \\
    \\
    \ovalnode{f}{$\pipost$} &&
    \circlenode{2}{$L_2$}
    \\ \\ \\

    \ncline{->}{0}{1}
    \trput{\pipathn{1}}
    \ncarc[arcangle=45]{->}{1}{2}
    \trput{\pipathn{2}}
    \ncarc[arcangle=-45]{->}{1}{f}
    \tlput{\pipathn{6}}
    \ncarc[arcangle=45]{->}{2}{1}
    \tlput{\pipathn{5}}
    \nccircle[angleA=180]{->}{2}{.5}
    \tbput{\pipathn{3}, \pipathn{4}}
  \end{tabular}
\end{figure}
\end{frame}

\begin{frame}
\underline{Basic Paths: Function Calls}\\
\smallskip
\begin{itemize}
\item \underline{Loops} produce unbounded number of paths\\
\quad \underline{loop invariants} cut loops to produce\\
\quad finite number of basic paths
\item \underline{Reursive calls} produce unbounded number of paths\\
\quad \underline{function specifications} cut function calls
\end{itemize}

\bigskip
In BinarySearch
\small
\[
  \begin{array}{ll}
  \pipre 0 \le \ell \band u < |a| \band \psort(a, \ell, u)
  & \dots F[a,\ell,u,e]\\
  \hspace*{4em} \vdots\\
  \hspace*{2em}
	\piassert\piloc{R_1}:\ 0 \le m+1 \band u < |a| \band \psort(a,m+1,u) 
  & \dots F[a,m+1,u,e]\\
  \hspace*{2em}
	\pireturn \pifn{BinarySearch}(a, m+1, u, e)\\
  \hspace*{4em} \vdots\\
  \hspace*{2em}
	\piassert\piloc{R_2}:\ 0 \le \ell \band m-1 < |a| \band \psort(a,\ell,m-1)
  & \dots F[a,\ell,m-1,e]\\
  \hspace*{2em}
	\pireturn \pifn{BinarySearch}(a, \ell, m-1, e)
  \end{array}
\]
\end{frame}

\begin{frame}
\underline{Program B}: BinarySearch with function call assertions
\begin{figure}
  \begin{pilisting}
    \bsearchProved
  \end{pilisting}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{Verification Conditions}
\begin{itemize}
\item \underline{Program counter} pc --- holds current location of control
\item \underline{State} s --- assignment of values to all variables\\
\smallskip
\quad \underline{Example}: Control resides at $L_1$ of BubbleSort\\
\smallskip
\qquad $s:\ \{\pipc \Mapsto L_1,\ a \Mapsto [2;0;1],\ i \Mapsto 2,\ j \Mapsto 0,$\\
\qquad \qquad \qquad $t \Mapsto 2,\ \pirv \Mapsto []\}$
\item \underline{Weakest precondition} $\wpre{F}{S}$\\
\smallskip
For FOL formula $F$, program statement $S$, \\
If $s \Models \wpre{F}{S}$ and if statement $S$ is executed on state $s$ 
to produce state $s'$, then $s' \Models F$
\end{itemize}
\small
\begin{figure}[tb]
\centering
\psset{unit=.35mm}
\pspicture(0,0)(120,100)
\psccurve(10,70)(60,60)(70,10)(20,20)(10,70)
\rput{0}(30,40){$\bullet s$}
\rput{0}(42,20){$\wpre{F}{S}$}
\psccurve(110,90)(100,40)(50,30)(60,80)(110,90)
\rput{0}(100,90){$\bullet s'$}
\rput{0}(80,40){$F$}
\pscurve[linestyle=dashed]{->}(35,45)(65,55)(95,85)
\rput{0}(70,55){$S$}
\endpspicture
\end{figure}
\end{frame}

\begin{frame}
\underline{Weakest Precondition} $\wpre{F}{S}$
\begin{itemize}
\item $\wpre{F}{\piassume c} \Bequiv c \bimplies F$
\item $\wpre{F[v]}{v \pia e} \Bequiv F[e]$
\item For $S_1;\ldots;S_n$,\\
$\wpre{F}{S_1;\ldots;S_n} \Bequiv \wpre{\wpre{F}{S_n}}{S_1;\ldots;S_{n-1}}$
\end{itemize}

\bigskip
\underline{Verification Condition} of basic path\\
\smallskip
\hspace*{2em}
$\begin{array}{l}
  \piassert F \\
  S_1; \\
  \ldots \\
  S_n; \\
  \piassert G
\end{array}$\\
\smallskip
\quad is\\
\smallskip
\qquad $F \bimplies \wpre{G}{S_1;\ldots;S_n}$

\smallskip
\quad Also denoted by\\
\smallskip
\qquad $\htrip{F}{S_1;\ldots;S_n}{G}$

\end{frame}

\begin{frame}
\underline{Example}: Basic path\\
\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{1}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \piassert F:\ x \ge 0 \\
  S_1:\ x \pia x + 1; \\
  \piassert G:\ x \ge 1
\end{array}$\\
\rule[.5ex]{\textwidth}{.2mm}\\
The VC is\\
\qquad $F \bimplies \wpre{G}{S_1}$\\
\smallskip
That is,\\
\qquad 
$\begin{array}{l}
  \wpre{G}{S_1}
  \\
  \Bequiv
  \wpre{x \ge 1}{x \pia x + 1}
  \\
  \Bequiv
  (x \ge 1)\set{x \Mapsto x + 1}
  \\
  \Bequiv
  x + 1 \ge 1
  \\
  \Bequiv
  x \ge 0
\end{array}$\\
\smallskip
Therefore the VC of path (1)\\
\qquad $x \ge 0 \bimplies x \ge 0~,$\\
\smallskip
which is $\tint$-valid.
\end{frame}

\begin{frame}
\underline{Example}: Basic path (2) of LinearSearch\\
\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{2}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \piassert\piloc{L}:\ F:\ \ell \le i \band \forall j.\ \ell \le j < i \bimplies a[j] \ne e \\
  S_1:\ \piassume i \le u; \\
  S_2:\ \piassume a[i] = e; \\
  S_3:\ \pirv \pia \pitrue; \\
  \pipost G:\ \pirv \biff \exists j.\ \ell \le j \le u \band a[j] = e
\end{array}$\\
\rule[.5ex]{\textwidth}{.2mm}\\
The VC is\\
\qquad $F \bimplies \wpre{G}{S_1;S_2;S_3}$\\
\smallskip
That is,\\
$\begin{array}{l}
  \wpre{G}{S_1;S_2;S_3}
  \\
  \Bequiv
  \wpre{
    \wpre{
      \pirv \biff \exists j.\ \ell \le j \le u \band a[j] = e
    }{\pirv \pia \pitrue}
  }{S_1;S_2}
  \\
  \Bequiv
  \wpre{
    \pitrue \biff \exists j.\ \ell \le j \le u \band a[j] = e
  }{S_1;S_2}
  \\
  \Bequiv
  \wpre{
    \exists j.\ \ell \le j \le u \band a[j] = e
  }{S_1;S_2}
  \\
  \Bequiv
  \wpre{
    \wpre{
      \exists j.\ \ell \le j \le u \band a[j] = e
    }{\piassume a[i] = e}
  }{S_1}
  \\
  \Bequiv
  \wpre{
    a[i] = e \bimplies \exists j.\ \ell \le j \le u \band a[j] = e
  }{S_1}
  \\
  \Bequiv
  \wpre{
    a[i] = e \bimplies \exists j.\ \ell \le j \le u \band a[j] = e
  }{\piassume i \le u}
  \\
  \Bequiv
  i \le u \bimplies (a[i] = e \bimplies \exists j.\ \ell \le j \le u \band a[j] = e)
\end{array}
$
\end{frame}

\begin{frame}
Therefore the VC of path (2)
\[
\begin{array}{ll}
\begin{multiline}
  \ell \le i \band (\forall j.\ \ell \le j < i \bimplies a[j] \ne e) \\
  \bimplies
  (i \le u \bimplies (a[i] = e
  \bimplies \exists j.\ \ell \le j \le u \band a[j] = e))
\end{multiline}
& (1)
\end{array}
\]
or, equivalently,
\[
\begin{array}{ll}
\begin{multiline}
  \ell \le i
  \band (\forall j.\ \ell \le j < i \bimplies a[j] \ne e)
  \band i \le u \band a[i] = e \\
  \bimplies
  \exists j.\ \ell \le j \le u \band a[j] = e
\end{multiline}
& (2)
\end{array}
\]
according to the equivalence
\[
F_1 \band F_2 \bimplies (F_3 \bimplies (F_4 \bimplies F_5))
\Bequiv
(F_1 \band F_2 \band F_3 \band F_4) \bimplies F_5~.
\]
This formula (2) is $(\tint \cup \tarr)$-valid.
\end{frame}

\begin{frame}
\frametitle{$P$-invariant and $P$-inductive}
Consider program $P$ with function $f$ s.t.\\
\smallskip
\quad function precondition $F_0$ and\\
\quad initial location $L_0$.\\
\bigskip
A \underline{$P$-computation} is a sequence of states\\
\smallskip
\qquad $s_0, s_1, s_2, \ldots$\\
\smallskip
\quad such that
\begin{itemize}
\item $s_0[pc]=L_0$ and $s_0 \Models F_0$, and
\item for each $i$, $s_{i+1}$ is the result of executing the instruction at $s_i[pc]$ on state $s_i$.
\end{itemize}
\quad where $s_i[pc] = $ value of $pc$ given by state $s_i$
\end{frame}

\begin{frame}
A formula $F$ annotating location $L$ of program $P$ is \underline{$P$-invariant} if for all $P$-computations
$s_0, s_1, s_2, \ldots$ and for each index $i$,\\
\smallskip
\qquad $s_i[pc]=L \quad \Bimplies \quad s_i \Models F$\\
\bigskip
Annotations of $P$ are \underline{$P$-invariant} (\underline{invariant}) iff
each annotation of $P$ is $P$-invariant at its location.

\bigskip
Annotations of $P$ are \underline{$P$-inductive} (\underline{inductive}) iff
all VCs generated from program $P$ are $T$-valid\\
\bigskip
\qquad $P$-inductive \quad $\Bimplies$ \quad $P$-invariant
\end{frame}

\begin{frame}
\frametitle{Total Correctness}
\underline{Total Correctness} = \underline{Partial Correctness} + \underline{Termination}

\bigskip
Given that the input satisfies the function precondition,
the function eventually halts and produces output that
satisfies the function postcondition.

\bigskip
Proving function termination:
\begin{itemize}
\item Choose set $S$ with well-founded relation $\prec$\\
Usually set of $n$-tupules of natural numbers with the lexicographic extension $<_n$
\item Find function $\delta$ (\underline{ranking function})\\
mapping\\
\qquad program states \quad $\bimplies \quad S$\\
such that $\delta$ decreases according to $\prec$ along every basic path.
\end{itemize}

\smallskip
Since $\prec$ is well-founded, there cannot exist an infinite sequence of program states.
\end{frame}

\begin{frame}
\underline{Choosing well-founded relation and ranking function}\\
\bigskip
\uex: Ackermann function --- recursive calls\\
\smallskip
\quad Choose $(\naturals^2, <_2)$ as well-founded set
\small
  \begin{pilisting}
    \pirffunction{
      x \ge 0 \band y \ge 0
    }{
      \pirv \ge 0
    }{
      (x,y) \qquad \qquad \ldots \mbox{ranking function  } \delta:\ (x,y)
    }{int}{Ack}{\pityp{int} x,\ \pityp{int} y}{
      \piifstmt{x = 0}{
	\pireturn y + 1;
      } \\
      \pielse\piifstmt{y = 0}{
	\pireturn \pifn{Ack}(x-1, 1);
      } \\
      \pielsestmt{
	\pityp{int} z \pia \pifn{Ack}(x,y-1); \\
	\pireturn \pifn{Ack}(x-1,z);
      }
    }
  \end{pilisting}

\end{frame}

\begin{frame}
\begin{itemize}
\item Show $\delta:\ (x,y)$ maps into $\naturals^2$, i.e.,\\
\qquad $x \ge 0$ and $y \ge 0$ are invariants
\item Show $\delta:\ (x,y)$ decreases from function entry to each recursive call.
We show this.
\end{itemize}
The basic paths are:\\
\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{1}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \pipre x \ge 0 \band y \ge 0 \\
  \pirank (x,y) \\
  \piassume x \ne 0; \\
  \piassume y = 0; \\
  \pirank (x-1,1)
\end{array}$\\
\rule[.5ex]{\textwidth}{.2mm}

\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{2}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \pipre x \ge 0 \band y \ge 0 \\
  \pirank (x,y) \\
  \piassume x \ne 0; \\
  \piassume y \ne 0; \\
  \pirank (x,y-1)
\end{array}$\\
\rule[.5ex]{\textwidth}{.2mm}
\end{frame}

\begin{frame}
\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{3}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \pipre x \ge 0 \band y \ge 0 \\
  \pirank (x,y) \\
  \piassume x \ne 0; \\
  \piassume y \ne 0; \\
  \piassume v_1 \ge 0; \\
  z \pia v_1; \\
  \pirank (x-1,z)
\end{array}$\\
\rule[.5ex]{\textwidth}{.2mm}
\end{frame}

\begin{frame}
\underline{Showing decrease of ranking function}

\smallskip
For basic path with ranking function\\
\begin{spipath}{}
\piassert F \\
\pirank \delta[\vx] \\
S_1; \\
\vdots \\
S_k; \\
\pirank \kappa[\vx]
\end{spipath}

We must prove that\\
\quad the value of $\kappa$ after executing $S_1;\cdots;S_n$\\
\quad is less than\\
\quad the value of $\delta$ before executing the statements\\
Thus, we show the verification condition
\[
F \bimplies \wpre{\kappa \prec \delta[\vx_0]}{S_1;\cdots;S_k}\set{\vx_0 \Mapsto \vx}~.
\]
\end{frame}

\begin{frame}
\uex: Ackermann function --- recursive calls\\
\smallskip
Verification conditions for the three basic paths
\begin{enumerate}
\item $x \ge 0 \band y \ge 0 \band x \ne 0 \band y = 0 \Bimplies (x-1,1) <_2 (x,y)$
\item $x \ge 0 \band y \ge 0 \band x \ne 0 \band y \ne 0 \Bimplies (x,y-1) <_2 (x,y)$
\item $x \ge 0 \band y \ge 0 \band x \ne 0 \band y \ne 0 \band v_1 \ge 0 \Bimplies (x-1,v_1) <_2 (x,y)$
\end{enumerate}

Then compute
\[
\begin{array}{@{}l}
\Wpre{(x-1,z) <_2 (x_0,y_0)}{\piassume x \ne 0;\ \piassume y \ne 0;\ \piassume v_1 \ge 0;\ z \pia v_1} \\
\mbox{} \Bequiv \Wpre{(x-1,v_1) <_2 (x_0,y_0)}{\piassume x \ne 0;\ \piassume y \ne 0;\ \piassume v_1 \ge 0} \\
\mbox{} \Bequiv x \ne 0 \band y \ne 0 \band v_1 \ge 0 \bimplies (x-1,v_1) <_2 (x_0,y_0)
\end{array}
\]
Renaming $x_0$ and $y_0$ to $x$ and $y$, respectively, gives
\[
x \ne 0 \band y \ne 0 \band v_1 \ge 0 \bimplies (x-1,v_1) <_2 (x,y)~.
\]
Noting that path \pipathn{3} begins by asserting $x \ge 0 \band y \ge
0$, we finally have
\[
x \ge 0 \band y \ge 0 \band x \ne 0 \band y \ne 0 \band v_1 \ge 0 \Bimplies (x-1,v_1) <_2 (x,y)~.
\]
\end{frame}

\begin{frame}
\uex: BubbleSort --- loops\\
\smallskip
Choose $(\naturals^2, <_2)$ as well-founded set
\begin{figure}
\rule{\textwidth}{.5mm}	
\[
  \begin{array}{l}
  \pifunctionx{\true}{\true
  }{int[]}{BubbleSort}{\pityp{int[]} a_0}
  \ \{ \\
  \hspace*{1em}
    \begin{array}{@{}l@{}}
    \pityp{int[]} a \pia a_0; \\
    \pirfforstmtx{
      \piloc{L_1}:\ i+1 \ge 0
    }{
      (i+1,\ i+1) \qquad \qquad \ldots \mbox{ranking function } \delta_1
    }{\pityp{int} i \pia |a| - 1}{i > 0}{i \pia i - 1}
	\ \{ \\
    \end{array}
  \end{array}
\]
\end{figure}
\end{frame}

\begin{frame}
\begin{figure}
\[
  \begin{array}{l}
    \hspace*{1em}
    \begin{array}{@{}l@{}}
      \hspace*{1em}
      \begin{array}{@{}l@{}}
      \pirfforstmt{
	\piloc{L_2}:\ i+1 \ge 0 \band i-j \ge 0
      }{
	(i+1,\ i-j) \qquad \qquad \ldots \mbox{ranking function } \delta_2
      }{\pityp{int} j \pia 0}{j < i}{j \pia j + 1}{
	\piifstmt{a[j] > a[j + 1]}{
	  \pityp{int} t \pia a[j]; \\
	  a[j] \pia a[j+1]; \\
	  a[j+1] \pia t;
    }} \\
      \end{array}\\
	\} \\
    \pireturn a;
    \end{array}\\
  \}
  \end{array}
\]
\rule{\textwidth}{.5mm}	
\end{figure}
\end{frame}

\begin{frame}
We have to prove
\begin{itemize}
\item loop invariants are inductive
\item function decreases along each basic path.
\end{itemize}
The relevant basic paths\\

\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{1}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
\piassert\piloc{L_1}:\ i+1 \ge 0 \\
\pirank\piloc{L_1}:\ (i+1,i+1) \\
\piassume i > 0; \\
j \pia 0; \\
\pirank\piloc{L_2}:\ (i+1,i-j)
\end{array}$\\
\rule[.5ex]{\textwidth}{.2mm}

\rule[.5ex]{.40\textwidth}{.2mm}
\hspace*{\fill}\pipathn{2},\pipathn{3}\hspace*{\fill}
\rule[.5ex]{.40\textwidth}{.2mm}\\
$\begin{array}{l}
\piassert\piloc{L_2}:\ i+1 \ge 0 \band i-j \ge 0 \\
\pirank\piloc{L_2}:\ (i+1,i-j) \\
\piassume j < i; \\
\cdots \\
j \pia j + 1; \\
\pirank\piloc{L_2}:\ (i+1,i-j)
\end{array}$\\
\rule[.5ex]{\textwidth}{.2mm}
\end{frame}

\begin{frame}
\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{4}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
\piassert\piloc{L_2}:\ i+1 \ge 0 \band i-j \ge 0 \\
\pirank\piloc{L_2}:\ (i+1,i-j) \\
\piassume j \ge i; \\
i \pia i-1; \\
\pirank\piloc{L_1}:\ (i+1,i+1)
\end{array}$\\
\rule[.5ex]{\textwidth}{.2mm}

\smallskip
\underline{Verification conditions}\\
\smallskip
Path \pipathn{1}
\[
i+1 \ge 0 \band i > 0 \Bimplies (i+1,i-0) <_2 (i+1,i+1)~,
\]
Paths \pipathn{2} and \pipathn{3}
\[
i+1 \ge 0 \band i-j \ge 0 \band j < i \Bimplies (i+1,i-(j+1)) <_2 (i+1,i-j)~,
\]
Path \pipathn{4}
\[
i+1 \ge 0 \band i-j \ge 0 \band j \ge i \Bimplies ((i-1)+1,(i-1)+1) <_2 (i+1,i-j)~,
\]
which are valid. Hence, BubbleSort always halts.
\end{frame}

\end{document}
