Extreme predicates beyond continuity K. Rustan M. Leino Principal Researcher Research in Software Engineering (RiSE), Microsoft Research, Redmond Visiting Professor Department of Computing, Imperial College London IFIP WG 2.3 meeting 57, Pasadena, CA, 11 January 2016

Motivation Reasoning about predicates defined as least/greatest fixpoints Language features that make definitions and proof look natural Translation to automated decisions procedure What I want: Syntactic detection of continuity Features that encapsulate “the workaround”

Even where x ranges over integers

Multiple solutions Least solution in P Greatest solution in P

Names and notational conventions LEAST SOLUTION GREATEST SOLUTION

Extreme predicates in Dafny LEAST SOLUTION GREATEST SOLUTION inductive predicate P(x: int) { x == 0 || P(x-2) } copredicate P(x: int) { x == 0 || P(x-2) }

Semantics of INC

Proofs What to proveHow to prove it

Proofs What to proveHow to prove it

Proofs What to proveHow to prove it via iterates

Proofs What to proveHow to prove it inductive lemma colemma

Iterates LEAST SOLUTION GREATEST SOLUTION

Example: Iterates of least solution of Even

Show and tell Language support: Even, INC

Enforcing continuity Syntactic restrictions: Inductive predicate is disallowed if recursive call sits inside a  Co-inductive predicate is disallowed if recursive call sits inside a  Example: copredicate P(x: int) { P(x+1) || exists m :: 0 <= m && P(m) }

Continuity is needed if 0 ≤ n if n < 0

Problem with continuity: Co-inductive big-step semantics

Show and tell Continuity workaround: move the quantification out

Summary Is continuity the same condition as “no recursive calls inside unbounded  /  ”? When is the distribution workaround for continuity safe? What language support would one want for it?