\documentclass[t]{beamer}
\mode<presentation>

\newcommand{\lecnumber}{6}

\include{cocmacros}
\newcommand{\uuline}[1]{\underline{\underline{#1}}}
\newcommand{\ures}[3]{
  \begin{array}{c@{\hspace*{2em}}c} 
    #1 & #2 \\ \hline \multicolumn{2}{c}{#3} 
  \end{array}}
\newcommand{\uex}{\underline{Example}}

\title{\lecnumber. Program Correctness: Strategies}
\date{}
\institute[Stanford University]

\begin{document}

\setbeamertemplate{footline}[text line]
{
	%\begin{large}
	\hspace*{\stretch{1}}\lecnumber - \insertframenumber \bigskip
	%\end{large}
}

\newcommand{\pifunctionx}[5]{
    \pipre #1 \\
    \pipost #2 \\
    \pityp{#3} \pifn{#4}(#5)
}
\newcommand{\piforstmtx}[4]{
  \pifor \\
  \hspace*{1em} \piassert #1 \\
  \hspace*{1em} (#2;\ #3;\ #4)
}
\newcommand{\pirfforstmtx}[5]{
  \pifor \\
  \hspace*{1em} \piassert #1 \\
  \hspace*{1em} \pirank #2 \\
  \hspace*{1em} (#3;\ #4;\ #5)
}

\begin{frame}[c]
\Large
\textsc{The Calculus of Computation:}\\
Decision Procedures with\\
Applications to Verification

\bigskip
\bigskip
by\\
Aaron Bradley\\
Zohar Manna

\bigskip
\bigskip
Springer 2007
\end{frame}

\begin{frame}
	\titlepage
\end{frame}

\begin{frame}
\frametitle{Developing Inductive Assertions}
Some structured techniques for developing inductive annotations for proving partial correctness.
Just heuristics.

\bigskip
\underline{Basic Facts}\\
\smallskip
\uex: LinearSearch
\[
\begin{multiline}
  \piforstmt{
    \piloc{L}:\ \ell \le i \le u + 1
  }{\pityp{int} i \pia \ell}{i \le u}{i \pia i + 1}{
    \piif (a[i] = e)\ \pireturn \pitrue;
  }
\end{multiline}
\]
\end{frame}

\begin{frame}
\uex: BubbleSort
\[
\begin{multiline}
  \piforstmt{
    \piloc{L_1}:\ -1 \le i < |a| 
  }{\pityp{int} i \pia |a| - 1}{i > 0}{i \pia i - 1}{
    \piforstmt{
      \piloc{L_2}:\ 0 < i < |a| \band 0 \le j \le i 
    }{\pityp{int} j \pia 0}{j < i}{j \pia j + 1}{
      \piifstmt{a[j] > a[j + 1]}{
	\pityp{int} t \pia a[j]; \\
	a[j] \pia a[j+1]; \\
	a[j+1] \pia t;
  }}}
\end{multiline}
\]
\end{frame}

\begin{frame}
\underline{The Precondition Method}

\begin{tabular}{lr}
  \begin{tabular}{l}
  $\bullet$ Given annotation $@L:\ F$\\
  $\bullet$ Compute the precondition of $F$ backward\\
  $\bullet$ Find new annotation $@L':\ F'$\\
  \end{tabular}
  &
  \begin{tabular}{c}
  $@L:\ F'$\\
  $s_1;\rnode{A}{\ }$\\
  $\vdots$\\
  $s_n;\rnode{B}{\ }$\\
  $@L':\ F$
  \end{tabular}
\end{tabular}
\ncline[doubleline=true]{->}{B}{A}

\uex: BinarySearch\\
\small
$\begin{array}{l}
  \pifunction{H?}{\true}{bool}{BinarySearch}{
    \pityp{int[]} a,\ \pityp{int} \ell,\ \pityp{int} u,\ \pityp{int} e
  }{
    \piif (\ell > u)\ \pireturn \pifalse; \\
    \pielsestmt{
      \piassert 2 \ne 0; \qquad \qquad \qquad \ldots \mbox{basic fact}\\
      \pityp{int} m \pia (\ell + u) \pidiv 2; \\
      \piassert 0 \le m < |a|; \qquad \qquad \ldots \mbox{basic fact}\\
      \piif (a[m] = e)\ \pireturn \pitrue; \\
      \pielse \piif (a[m] < e)\ \pireturn \pifn{BinarySearch}(a, m+1, u, e); \\
      \pielse \pireturn \pifn{BinarySearch}(a, \ell, m-1, e);
    }
  }
\end{array}$
\end{frame}

\begin{frame}
\rule[.5ex]{.45\textwidth}{.2mm}
\hspace*{\fill}\pipathn{$\cdot$}\hspace*{\fill}
\rule[.5ex]{.45\textwidth}{.2mm}\\
$\begin{array}{l}
  \pipre H:\ ? \\
  S_1:\ \piassume \ell \le u; \\
  S_2:\ m \pia (\ell+u) \pidiv 2; \\
  \piassert F:\ 0 \le m < |a|
\end{array}$\\
\rule[.5ex]{\textwidth}{.2mm}

\bigskip
Compute
\[
\begin{multiline}
  \wpre{F}{S_1;S_2}
  \\
  \Bequiv
  \wpre{\wpre{F}{m \pia (\ell+u) \pidiv 2}}{S_1}
  \\
  \Bequiv
  \wpre{F\set{m \Mapsto (\ell+u) \pidiv 2}}{S_1}
  \\
  \Bequiv
  \wpre{F\set{m \Mapsto (\ell+u) \pidiv 2}}{\piassume \ell \le u}
  \\
  \Bequiv
  \ell \le u \bimplies F\set{m \Mapsto (\ell+u) \pidiv 2}
  \\
  \Bequiv
  \ell \le u \bimplies 0 \le (\ell+u) \pidiv 2 < |a|
  \\
  \ \Leftarrow\
  0 \le \ell \band u < |a|
\end{multiline}
\]
\end{frame}

\begin{frame}
\begin{center} 
\fbox{$\pipre H:\ 0 \le \ell \band u < |a|$}
\end{center}
\bigskip
guaranteed\\
\smallskip
\qquad $0 \le \ell \band u < |a| \bimplies \wpre{F}{S_1;S_2}$\\
\smallskip
is $\tint$-valid. The runtime assertion\\
\smallskip
\qquad $0 \le m < |a|$\\
\smallskip
holds in every execution of BinarySearch in which the precondition\\
\smallskip
\qquad $\pipre 0 \le \ell \band u < |a|$\\
\smallskip
is satisfied.
\end{frame}

\end{document}
