Example Correctness Proofs

Transcription

1 Example Correctness Proofs Kevin C. Zatloukal March 8, 2014 In these notes, we give three examples of proofs of correctness. These are intended to demonstrate the sort of proofs we would like to see in your problem set solutions. Each of the examples below considers a variation of the peak finding problem discussed in class. Recall that we defined a peak in an array (or matrix) to be an element that is at least as large as each of its neighbors. In an array A of length n, element A[i] is a peak if it is at least as large as A[i 1] (if i 0) and A[i + 1] (if i < n 1). In an m n matrix, element A[i, j] is a peak if it is at least as large as A[i 1, j] (if i 0), A[i + 1, j] (if i < m 1), A[i, j 1] (if j 0), and A[i, j + 1] (if j < n 1). All the elements of an array have two neighbors, except the endpoints. All elements of a matrix have four neighbors, except those on the boundary (which have three or two). For each example, we describe an algorithm and prove its correctness. Note that the descriptions of the algorithms are more terse than what you will want to provide in your own solutions. (Only the correctness proofs are intended to be complete examples.) Recall that a correctness proof require a proof of both termination and safety. The former means that the algorithm eventually terminates, while the latter means that, when it terminates, it gives a correct answer. Typically, at most one of these proofs is difficult. For a search-based algorithm (like the greedy algorithm for peak-finding), safety is easy because the algorithm actually checks that the element is a peak immediately before returning it. However, proving that the search terminates takes some work. On the other hand, for a divide-and-conquer algorithm (like the one described in class that starts by checking the middle element), termination is easy because the algorithm does a fixed amount of work before recursing on a strictly smaller problem (so termination follows by an easy induction argument). However, safety usually requires more work, as we will see below. Finally, it is worth noting that we do not need to prove termination at all if we have a bound on the running time of the algorithm (its asymptotic complexity). If we know that the algorithm terminates within f(n) time (our bound on the running time), then it certainly terminates. A bound on the running time is a stronger result than a termination proof. So if you re going to prove a bound on the running time, you don t need to separately prove termination. 1-Dimensional Array Algorithm In class, we saw an algorithm that operates as follows. We are asked to find a peak in the array A of length n. Let m = 1 2n. We first check whether A[m] is a peak by comparing it to A[m 1] and A[m + 1]. If A[m] is a peak, then return m. Otherwise, we either have A[m 1] > A[m] or A[m + 1] > A[m]. In the former case, we recurse on the subarray from 0 to m 1, and in the latter case, we recurse on the subarray from m + 1 to n 1 and return whatever element is returned by that call. 1

2 Correctness We need to show both termination and safety. First, we show safety. Theorem 1. The algorithm described above returns a peak in the array A. Proof. We prove this by induction on the number of recursive calls made, k. Base case (k = 0). The algorithm only makes 0 recursive calls in the case where A[m] is found to be a peak. The algorithm directly checks that A[m] > A[m 1] and A[m] > A[m + 1], so this is indeed a peak. Inductive case (k > 0). In this case, the algorithm makes a recursive call on a subarray. Suppose that this is the subarray from 0 to m 1. By assumption, the recursive call itself makes k 1 recursive calls, which is fewer than k calls, so by the inductive hypothesis, this call returns an element A[i] that is a peak on the subarray from 0 to m 1. If i < m 1, then being a peak in this subarray means A[i] > A[i 1] and A[i] > A[i + 1]. That means A[i] is a peak in the entire array as well. Otherwise, the recursive call returns A[m 1]. Being a peak in the subarray means only that A[m 1] > A[m 2]. Since we made the recursive call on 0 to m 1, however, we must have checked A[m 1] > A[m] before the recursive call, so we can see that A[m 1] is a peak in the entire array. The other case to consider is when the algorithm makes a recursive call on the subarray from m + 1 to n. In this case, the algorithm returns a peak by the same sort of argument as above. We can also prove termination by induction, but this time on the length of the array: if the algorithm does not terminate immediately, then it recurses on a strictly smaller array. We leave it as an exercise to write this up formally. 1-Dimensional Circular Array In this version of the problem, we consider the array to be circular. That is, if n is the length of the array, then A[n ] is considered to be adjacent not only to A[n 2] but also to A[0]. Likewise, A[0] is adjacent not only to A[1] but also to A[n 1]. We wish to find a peak, defined in this sense, in the array. Algorithm Idea As we saw above, the difficulty with solving this problem recursively is that an element at the end of a subarray can look like a peak but not be a peak of the entire array because the element just past the end of the subarray is actually larger. On the other hand, if we knew that both endpoints of the subarray were larger than the elements just past those ends, then any peak of the subarray would be a peak of the entire array. Unfortunately, we can t always guarantee that this condition holds. However, we can guarantee a slightly weaker condition: the larger of the two endpoints of the subarray is at least as large as both the elements just past the ends. (Larger than the element past that endpoint and also larger than the element past the other endpoint.) Call this Condition E. We will see that condition E is enough to ensure correctness. Algorithm We are given an array A and length n. If the array contains only a single element, then return that element as the peak. Otherwise, let m = 1 2 n. We start by computing v = max{a[0], A[n 1]} and w = max{a[m], A[m + 1]}. If v w, then recurse to subarray from 0 to m if A[0] = v and the subarray from m + 1 to n 1 if A[n 1] = v. Otherwise, we have w > v. In 2

3 that case, we recurse to the subarray from 0 to m if A[m] = w and the subarray from m + 1 to n 1 if A[m + 1] = w. Correctness As above, we first prove safety. Theorem 2. The above algorithm, when invoked on an array satisfying condition E, returns a peak in the entire array (not just the subarray). Proof. We again prove this by induction on the number of recursive calls made. If the algorithm makes no recursive calls, then that means we have an array with one element. In this case, there is only one endpoint (the one element). Condition E tells us that this element is larger than the elements just past the two ends, which are the two elements adjacent to it in the larger array. Hence, this element is a peak. As in the last proof, the recursive call itself makes fewer recursive calls, so we can apply the induction hypothesis provided that condition E is satisfied on that subarray. Assuming this is the case, the induction hypothesis tells us that the returned element is a peak in the entire array, not just the subarray. So it remains only to show that condition E holds on the subarray passed to the recursive call. We can simply enumerate the possible cases and check each case: v w and A[0] = v. In this case, the subarray is from 0 to m. A[0] is the larger of the two endpoints in this subarray, so we need to argue that it is larger than the elements just path both ends of the subarray. Since the our array satisfies condition E, we know that A[0] is larger than the element just past that end. The other end of the subarray is A[m]. The element just past that is A[m] and we know A[0] = v > w A[m]. Since A[0] is larger than the elements just past both endpoints, condition E holds. v w and A[n 1] = v. Condition E is satisfied by the subarray from m + 1 to n 1 by the same sort of argument as the previous case. v < w and A[m] A[m + 1]. Since A[m] = w > v A[0], we see that A[m] is the larger of the two endpoints of the subarray from 0 to m. The element just past the end on its own side is A[m + 1], which is less than A[m] by assumption. Since condition E is satisfied on our array, we know that the element just past A[0] is smaller than the larger of A[0] and A[n 1], which is v. And since A[m] = w > v, we see that A[m] is larger than this element as well. Thus, A[m] is larger than the elements past both endpoints, so condition E is satisfied. v < w and A[m + 1] > A[m]. Condition E is satisfied by the subarray from m + 1 to n 1 by the same sort of argument as the previous case. We use this theorem to prove safety. In order to do that, though, we must know that the array satisfies condition E. Our proof showed that, if the array initially satisfies E, then so will the subarray in the recursive call. But what about the array we start with? Think of the circular array, from 0 to n, as being a subarray of an infinitely long array that just repeats the elements of A in order. Suppose that A[0] is the larger endpoint, so A[0] A[n 1]. In the circular array, the elements just past these endpoints are A[ 1] = A[n 1] and A[n] = A[0]. Since A[0] A[0] and A[0] A[n 1], condition E is satisfied. By a similar argument, condition E is satisfied when A[n 1] > A[0]. 3

4 Since condition E is satisfied by the array passed to the first call, the above theorem tells us that the algorithm returns a peak. It remains to show termination. We can again prove this by induction on the length of the array. In order to use the inductive hypothesis, though, we need to know that we always invoke the algorithm recursively on an array that is strictly smaller than the one we are given. Convince yourself that this is always the case. (This is not just about the proof. If the algorithm called itself on the same array, it would have an infinite loop!) 2-Dimensional Array In this case, we have a regular array, but one that is 2-dimensional. We need to find a peak in the array, which means an element that is larger than its neighbors above, below, to the left, and to the right. Algorithm Idea We will use the same approach as in the previous case. However, in the 2-D case, we do not simply have two endpoints. (Instead, we have a large square of endpoints along the boundary.) Rather than computing the largest value each time, we will pass an additional argument that gives the value of some element along the boundary that is larger than all the elements just past the boundaries. Algorithm This algorithm takes as arguments an array A of size m n along with an element (i, j) whose value is an upper bound on all the values of the elements just past the boundary in all four directions. On the first call to the algorithm, there is no such element, but since there are no elements past the boundary initially, we can use any value, say, (i, j) := (1, 1). Once we have a value for v, the algorithm operates as follows. If the array contains only a single row or column, then return the maximum element in that row or column. Otherwise, let p = 1 2 m and q = 1 2n. We compute the maximum value along row p and column q. Call this w. If A[i, j] > w, then recurse on the quadrant that includes A[i, j] and do not include row p and column q (so these are the elements past the boundary), passing the same (i, j). Otherwise, w > A[i, j]. Let (i, j ) be the element with A[i, j ] = w. Next, look at the other two neighbors of (i, j ) (the ones not on row p or column q). If one of these is larger, then recurse on that quadrant and (do not include row p and column q) passing this element for (i, j). Otherwise, return A[i, j ] as the peak. Correctness Here is a shortened proof of safety. (You will want to include more detail than this in your problem set solutions.) Theorem 3. The algorithm above returns an element that is a peak in the entire array. Proof. We use induction as before. If the array contains only a row or column element, then we return the largest value in this row or column. But since there is just one column, this must include the value A[i, j] that is larger than all the elements past the boundary. The largest value is at least this larger, so it is larger than all of its neighbors, which are either in the single row or column of the array or are elements just past the boundary of the array. Otherwise, the algorithm finds the element in the middle row or column with largest value A[i, j ]. If A[i, j] > A[i, j ], then it recurses on a quadrant whose boundaries are either boundaries of our array or the row p or column q. We know that A[i, j] 4

5 is greater than all of this, so by induction, this returns a peak of the entire array. If A[i, j ] > A[i, j] and a neighbor of A[i, j ] is larger, then we recurse on a quadrant whose boundaries are all smaller than this neighbor since that neighbor is larger than everything in row p, column q, and the boundaries of our array (which are bounded by A[i, j] < A[i, j ], which is smaller than the neighbor). Again, condition F is satisfied, so the result is a peak by induction. In the final case, we find that A[i, j ] is larger than all its neighbors in the array. Any neighbors past the boundary of the array are smaller than A[i, j] < A[i, j ], so we see that this is also a peak in the entire array. Termination is shown in the same way as above. Again, note that we need to be sure that the subarray is always strictly smaller than the one passed in. 5