Computer Science School of Computing Clemson University Mathematical Reasoning with Objects

School of Computing Clemson University Example Specification: Operation Do_Nothing (restores S: Stack); Goal: Same as ensures S = #S; Code: Procedure Do_Nothing (restores S: Stack); Var E: Entry; Pop(E, S); Push(E, S); end Do_Nothing;

School of Computing Clemson University Exercise: Complete table and prove! AssumeConfirm 0… … Pop(E, S); 1… … Push(E. S); 2… …

School of Computing Clemson University Exercise: Complete table and prove! AssumeConfirm 0… … Pop(E, S); 1… … Push(E. S); 2… …  But we can’t Because there are no stacks in math Because there are no “standard” math specifications of pop and push

Computer Science School of Computing Clemson University Mathematical Modeling

School of Computing Clemson University Unlike mathematics that is implicit…  We view programming integers as though they are mathematical integers (subject to bounds, of course)  We associate mathematical operators (e.g., +) with operations we can do on integers in programs (e.g., +)

School of Computing Clemson University Unlike mathematics that is implicit…  Mathematical connections need to be established and made explicit for typical software objects

School of Computing Clemson University Mathematical modeling  Type Integer is modeled by Z;  Constraints for all i: Integer, min_int <= i <= max_int;

School of Computing Clemson University Alternatively…  Type Integer is modeled by Z;  Let i be an example Integer;  Constraints min_int <= i <= max_int;

School of Computing Clemson University Initial value specification…  Type Integer is modeled by Z;  exemplar i;  Constraints min_int <= i <= max_int;  initialization ensures i = 0;

School of Computing Clemson University Specification of operations …  Type Integer is modeled by Z;  …  specification of operations, e.g., i++  Operation Increment (updates i: Integer);  requires i < max_int;  ensures i = #i + 1;

School of Computing Clemson University More examples …  What is a suitable way to model the state of a light bulb?  …

School of Computing Clemson University More examples …  Type Light_Bulb_State is modeled by B;  exemplar b;  Initialization ensures b = false;  Exercises: specification of operations Turn_On, Turn_Off, and Is_On

School of Computing Clemson University More examples …  How would you model the state of a traffic light?  …  Alternative models and discussion

School of Computing Clemson University Data abstraction examples …  How would you mathematically model a the contents of a stack?  Is a set model appropriate?  Why or why not?  What about a queue?

School of Computing Clemson University Mathematical Modeling Summary  To write formal specifications, we need to model the state mathematically  Some objects we use in programming, such as Integers and Reals, have implicit models  For others, such as stacks, queues, lists, etc., we need to conceive explicit mathematical models

School of Computing Clemson University Mathematical Modeling of Stacks Concept Stack_Template(type Entry; Max_Depth: Integer); uses String_Theory; Type Family Stack is modeled by … Operation Push… Operation Pop… … end Stack_Template;

School of Computing Clemson University Concept Stack_Template(type Entry; Max_Depth: Integer); uses String_Theory; Type Family Stack is modeled by Str(Entry); exemplar S; constraints |S| <= Max_Depth; initialization ensures S = empty_string; … end Stack_Template; Mathematical Modeling of Stacks

School of Computing Clemson University Specification of Stack Operations Operation Push (alters E: Entry; updates S: Stack); requires |S| < Max_Depth; ensures S = o #S; Operation Pop (replaces R: Entry; updates S: Stack); requires |S| > 0; ensures #S = o S; Operation Depth (restores S: Stack): Integer; ensures Depth = |S|; …

School of Computing Clemson University Exercise: Complete table and prove! AssumeConfirm 0… … Pop(E, S); 1… … Push(E. S); 2… …

School of Computing Clemson University Recall: Basics of Mathematical Reasoning  Suppose you are verifying code for some operation P Assume its requires clause in state 0 Confirm its ensures clause at the end  Suppose that P calls Q Confirm the requires clause of Q in the state before Q is called  Why? Because caller is responsible Assume the ensures clause of Q in the state after Q  Why? Because Q is assumed to work  Prove assertions to be confirmed

School of Computing Clemson University Collaborative Exercise: Answers AssumeConfirm 0… |S0| > 0 Pop(E, S); 1S0 = o S1 |S1| < Max_Depth Push(E. S); 2S2 = o S1 S2 = S0 …

School of Computing Clemson University Discussion  Is the code Correct? If not, fix it

School of Computing Clemson University Collaborative Exercise: Answers AssumeConfirm 0|S0| 0 Pop(E, S); 1S0 = o S1 |S1| < Max_Depth Push(E. S); 2S2 = o S1 S2 = S0 …

School of Computing Clemson University Discussion  Is the code Correct? If not, fix it  Important Idea: The reasoning table can be filled mechanically  Principles of reasoning about all objects and operations are the same Need mathematical specifications  VC generation and automated verification demo

School of Computing Clemson University Is the code correct for the given spec? Specification: Operation Do_Nothing (restores S: Stack); Code: Procedure Do_Nothing (restores S: Stack); Var E: Entry; If (Depth(S) /= 0) then Pop(E, S); Push(E, S); end; end Do_Nothing;

School of Computing Clemson University ConditionAssumeConfirm 0 If (Depth(S) /= 0) then 1|S0| /= 0 Pop(E, S); 2|S0| /= 0 Push(E, S); 3|S0| /= 0 end; 4S4 = S0 Establish the path conditions

School of Computing Clemson University Establish the sub-goals in state- oriented terms using a table ConditionAssumeConfirm 0 If (Depth(S) /= 0) then 1|S0| /= 0 Pop(E, S); 2|S0| /= 0 Push(E, S); 3|S0| /= 0 end; 4.1|S0| = 0S4 = S0S4 = S0 4.2|S0| /= 0S4 = S3S4 = S0

School of Computing Clemson University ConditionAssumeConfirm 0 If (Depth(S) /= 0) then 1|S0| /= 0…… Pop(E, S); 2|S0| /= 0…… Push(E, S); 3|S0| /= 0… end; 4.1|S0| = 0S4 = S0S4 = S0 4.2|S0| /= 0S4 = S3S4 = S0 Fill in other assumptions and obligations as before…

School of Computing Clemson University More Mathematical Reasoning  Create this example using the web interface, generate VCs, and prove them  For recursive implementations  Recursive calls are handled just as any other call  Need to show termination using a programmer-supplied decreasing “metric”  For iterative implementations, invariants and decreasing metrics are used