# Proofs of Program Correctness

Save this PDF as:

Size: px
Start display at page:

## Transcription

1 Proofs of Program Correctness CS160 Spring 2012 Proofs about Programs Why make you study logic? Why make you do proofs? Because we want to prove properties of programs In particular, we want to prove properties of variables at specific points in a program 1

2 Isn t testing enough? Assuming the program compiles Testing demonstrates for specific examples that the program seems to be running as intended. Testing can only show existence of some bugs rather than exhaustively identifying all of them. Verification however Program Verification We consider a program to be correctif it produces the expected output for every possible input. This requires a formal specification of program behavior and techniques for inferring correctness. Fortunately, we know about logic. 2

3 Program Correctness Proofs Two parts: Correct answer when the program terminates (called partial correctness) The program does terminate We will only do part 1 Prove that a method is correct if it terminates Predicate Logic & Programs Variables in programs are like variables in predicate logic: They have a domain of discourse (data type) They have values (drawn from the data type) Variables in programs are different from variables in predicate logic: Their values change over time 3

4 Specification of Program Segments Two parts: Initial Assertion:a statement of what must be true about the input values or values of variables at the beginning of the program segment E.g Method that determines the sqrt of a number, requires the input (parameters) to be >= 0 Final Assertion: a statement of what must be true about the output values or values of variables at the end of the program segment E.g. What is the output/final result after a call to the method? Specification of Program Segments Initial Assertion:sometimes called the precondition Final Assertion: sometimes called the postcondition Pre-conditions before code executes z = 3 Note: these assertions can be represented as propositions or predicates. For simplicity, we will write them generally as propositions. { // prgm code Post-conditions after code executes z = 3 4

5 Hoare Triple A program, or program segment, S, is said to be partially correct with respect to the initial assertion p and the final assertion q if, whenever pis true for the input values of S and Sterminates, then qis true for the output values of S. [Rosen 7 th edition, p. 372] Notation: p{sq Pre-conditions before code executes p { // prgm code: S Post-conditions after code executes q Simple Example Assume that our proof system already includes rules of arithmetic Consider the following code: y = 2; z = x + y; Initial Assertion: p(x), x =1 Final assertion: q(z), z =3 What is true BEFORE code executes What is true AFTER code executes 5

6 Simple Example, continued Here {S contains two code statements So, p {S q for this example is { y = 2; (p(x), x =1) z = x + y; (q(z), z =3) p Pre-Condition x = 1 S : Program Segment { y = 2; z = x + y; Post-Condition q z = 3 Rule 1: Composition Rule Once we prove correctness of program segments, we can combine the proofs together to prove correctness of an entire program. p{ S 1 q q{ S 2 r p{ S 1 ;S 2 r Pre-conditions before code executes p { { // prgm code: S1 Post-conditions after code executes Is pre-condition for next q // prgm code: S2 Post-conditions after code executes r 6

7 Rule 2: Conditional Statements Given if (condition) and statement; Initial assertion: p Final assertion: q What does this mean? What must we prove? Pre-conditions before code executes p If ( condition ) { S Post-conditions after code executes q Rule 2: Conditional Statements, Given if (condition) statement; with Initial assertion: p and Final assertion: q Must show that when pis true and conditionis true then qis true when Sterminates: ( p condition){ Sq when pis true and conditionis false, then qis true (S does not execute) p condition ( ) q 7

8 Conditional Rule Example if (x > y) y = x; Initial assertion: T (true) Final assertion: q(y,x) means y x Consider the two cases Conditional Rule ( p condition) { Sq ( p condition) q p{ if conditionsq 8

9 Conditional Rule Example if (x > y) y = x; Initial assertion: T (true) Final assertion: q(y,x) means y x (p(x), true) { if (x > y) y = x; (q(y,x), y x) Conditional Rule Example (in code) input x, y;... // Initial: true if (x > y) y = x; // Final: y>=x.... Initial assertion: T (true) Final assertion: q(y,x) means y x 9

10 Rule 2a: Conditional with Else if (condition) S1; else S2; Rule is: p condition ( ) S 1 ( p condition) S 2 { q { q p{ if condition S 1 else S 2 q Conditional Rule 2a Example if (x < 0) abs = -x; else abs = x; Initial assertion: T (true) Final assertion: q(abs), abs= x if (x < 0) { abs = -x; (p(x), true) (q(abs), else abs = x; abs= x ) 10

11 Conditional Rule 2a Example if (x < 0) abs = -x; else abs = x; Initial assertion: T (true) Final assertion: q(abs), abs= x Consider the two cases Conditional Rule 2a, Code // true if (x < 0) abs = -x; // x < 0 -> abs = x else abs = x; // x >= 0 -> abs = x // abs = x Initial assertion: T Final assertion: q(abs), abs= x 11

12 Example Method (factorial) public int factorial(int n) { int target; if (n < 1) target = 1; else target = n; int ctr = 1; int result = 1; while (ctr < target) { ctr++; result *= ctr; return result; Task: prove factorial correct Prove that the value returned by factorial(n) is n! Using: Logic predicate or propositional Arithmetic which we assume to be part of logic Hoare triples Which we briefly introduced earlier But will now expand to cover loops 12

13 How to Start The Key to Proofs: Decomposition Just like programming! Prove properties of pieces of code Straight-line segments of code Control blocks: If statement, loops, etc. Put them back together Rule 1: Composition Rule Once we prove correctness of program segments, we can combine the proofs together to prove correctness of an entire program. p{ S 1 q q{ S 2 r p{ S 1 ;S 2 r 13

14 Back to factorial public int factorial(int n) { int target; if (n < 1) target = 1; else target = n; int ctr = 1; int result = 1; while (ctr < target) { ctr++; result *= ctr; return result; Part 1: conditional Part 2: Straight-line code Part 3: Loop Rule 2: Conditional Statements Given if (condition) ( p condition) S statement; p condition and Initial assertion: p p if condition S Final assertion: q Must show that when pis true and conditionis true then qis true when S terminates (case 1) when pis true and conditionis false, then qis true (Sdoes not execute) (case 2) { q ( ) q { q 14

15 Rule 2a: Conditional with Else if (condition) S1; else S2; Rule is: ( p condition){ S1 q ( p condition){ S 2 q p{ if condition S else S q 1 2 Conditional Rule Example int target; if (n < 1) target = 1; else target = n; Code Fragment Initial assertion: T (i.e. nothing) Condition: less(n, 1) Final assertions: geq(target, 1) Eq(n, target) (less(n,1) eq(target, 1)) Consider the two cases 15

16 Case 1: condition is true N < 1 (because the condition is true) Target = 1 (because of S1) Postcondition Proof Case 1: condition ( ){ S q p 1 ( T less( n,1) ){ target = 1 ( eq( target, n) ( less( n,1) eq( target,1) )) eq(target, 1) Assignment geq(target, 1) Arithmetic (#1) less(n,1) Condition (assumed true) less(n,1) eq(1, target) Addition (#1,#3) eq(n, target) (less(n,1) eq(target, 1)) Implication (#4) Proposition Key geq(x,y) x >= y less(x,y) x < y eq(x,y) x = y 16

17 Proof Case 2: condition ( ){ S q p 2 ( T geq( n,1) ){ target = n ( geq( target,1) ( less( n,1) eq( target,1) )) geq(n, 1) Condition Negation eq(n,target) Assignment geq(target,1) Transitivity (#2,#3) eq(n, target) (less(n,1) eq(target, 1)) Implication (#6) Now back to Rule 2 (if/else) ( p condition){ S1 q ( p condition){ S 2 q p{ if condition S else S q P: T Condition: geq(n,1) S1: target = 1; S2: target = n; Q: geq(target, 1), eq(n, target) (less(n,1) eq(target, 1))

18 Back to factorial, part 2 int ctr = 1; int result = 1; Code Fragment How do we pick the preconditions? We don t need any to prove post-conditions But we will need some for the chain rule later Adopt the post-conditions from part 1 as preconditions How do we pick the postconditions? Inspiration (more later ) Preconditions: geq(target, 1) Part 2 Formalized eq(n, target) (less(n,1) eq(target, 1)) Postconditions: geq(target, 1) eq(n, target) (less(n,1) eq(target, 1)) eq(result, ctr!) 18

19 Definition of factorial To prove this last postcondition formally, we need to define factorial: n! n fac 1, n 1 ( n ) 1, n > 1 geq(target, 1) Part 2 Proof Precondition eq(n, target) (less(n,1) eq(target, 1)) Precondition eq(ctr, 1) eq(result, 1) eq(ctr, result!) Assignment Assignment Def. of factorial 19

20 Why do I need the extra preconditions? Remember the composition rule { S1 { q S2 r p{ S1; S2r In traditional logic, once a statement is true it is always true. In code proofs, it could change (e.g. by assignment) You can only assert preconditions as true if not contradicted by the code fragment Therefore you must show that the preconditions are still true after the code p q How to we prove loops correct? General idea: loop invariant Find a property that is true before the loop Show that it must still be true after every iteration Therefore it is true after the loop 20

21 Rule 3: Loop Invariant while (condition) S; Rule: ( p condition) { Sp p while condition S Note these are both p! { ( condition p) Note both conclusions Back to factorial, part 2 int ctr = 1; int result = 1; while (ctr < target) { ctr++; result *= ctr; return result; What is true (a) before the loop and (b) after each iteration of the loop? Hint: this function is computing factorial 21

22 Loop Invariants Initial assertions P: eq(ctr!, result) Before the start of the loop, result= ctr! Because 1 = 1! geq(target, 1) Before the start of the loop, target >= 1 eq(n, target) (less(n,1) eq(target, 1)) Target is either n or 1 (if n < 1) Condition: less(ctr, target) Final assertions: eq(ctr, target) eq(ctr!, result) Part 3 Proof ( p condition) { Sp p while condition S { ( condition p) less(ctr, target) Condition (assume true) eq(ctr_1!, result_1) Precondition eq(ctr_2, ctr_1+1) Assignment eq(result_2, ctr_2*result_1!) Assignment eq(result_2, (ctr_1+1)*result_1!) Arithmetic eq(result_2, ctr_2!) Def. of factorial Note #1: I use ctr_1 to denote the initial value of ctr, and ctr_2 to denote the value of ctr at end of loop 22

23 Now put it all together The preconditions of this proof match the post-conditions of the previous step, so. We can assert P: eq(result, ctr!) eq(n, target) (less(n,1) eq(target, 1)) We can assert the negation of the condition eq(ctr, target) Slight fudge here So by the associative laws eq(result, ctr!) eq(ctr, target) eq(n, target) or eq(result, ctr!) eq(ctr, target) eq(target,1) less(n,1) By our definition of factorial, both cases imply eq(result, n!) QED What to take away Correctness proofs Yes, they are long But do-able if you know logic & arithmetic Necessary for safety-critical systems Termination is still unproved Loop Invariants Common program analysis technique Used for documentation, debugging 23

### Rigorous Software Development CSCI-GA 3033-009

Rigorous Software Development CSCI-GA 3033-009 Instructor: Thomas Wies Spring 2013 Lecture 11 Semantics of Programming Languages Denotational Semantics Meaning of a program is defined as the mathematical

### Loop Invariants and Binary Search

Loop Invariants and Binary Search Chapter 4.3.3 and 9.3.1-1 - Outline Ø Iterative Algorithms, Assertions and Proofs of Correctness Ø Binary Search: A Case Study - 2 - Outline Ø Iterative Algorithms, Assertions

### Lecture Notes on Linear Search

Lecture Notes on Linear Search 15-122: Principles of Imperative Computation Frank Pfenning Lecture 5 January 29, 2013 1 Introduction One of the fundamental and recurring problems in computer science is

### 2. Methods of Proof Types of Proofs. Suppose we wish to prove an implication p q. Here are some strategies we have available to try.

2. METHODS OF PROOF 69 2. Methods of Proof 2.1. Types of Proofs. Suppose we wish to prove an implication p q. Here are some strategies we have available to try. Trivial Proof: If we know q is true then

### Handout #1: Mathematical Reasoning

Math 101 Rumbos Spring 2010 1 Handout #1: Mathematical Reasoning 1 Propositional Logic A proposition is a mathematical statement that it is either true or false; that is, a statement whose certainty or

### Java+ITP: A Verification Tool Based on Hoare Logic and Algebraic Semantics

: A Verification Tool Based on Hoare Logic and Algebraic Semantics Department of Computer Science University of Illinois at Urbana-Champaign 6th International Workshop on Rewriting Logic and its Applications,

### Predicate Logic. Example: All men are mortal. Socrates is a man. Socrates is mortal.

Predicate Logic Example: All men are mortal. Socrates is a man. Socrates is mortal. Note: We need logic laws that work for statements involving quantities like some and all. In English, the predicate is

### Chapter 3. Cartesian Products and Relations. 3.1 Cartesian Products

Chapter 3 Cartesian Products and Relations The material in this chapter is the first real encounter with abstraction. Relations are very general thing they are a special type of subset. After introducing

### 3. Mathematical Induction

3. MATHEMATICAL INDUCTION 83 3. Mathematical Induction 3.1. First Principle of Mathematical Induction. Let P (n) be a predicate with domain of discourse (over) the natural numbers N = {0, 1,,...}. If (1)

### Rigorous. Development. Software. Program Verification. & Springer. An Introduction to. Jorge Sousa Pinto. Jose Bacelar Almeida Maria Joao Frade

Jose Bacelar Almeida Maria Joao Frade Jorge Sousa Pinto Simao Melo de Sousa Rigorous Software Development An Introduction to Program Verification & Springer Contents 1 Introduction 1 1.1 A Formal Approach

### Verification of Imperative Programs in Theorema

Verification of Imperative Programs in Theorema Laura Ildikó Kovács, Nikolaj Popov, Tudor Jebelean 1 Research Institute for Symbolic Computation, Johannes Kepler University, A-4040 Linz, Austria Institute

### Generalized Modus Ponens

Generalized Modus Ponens This rule allows us to derive an implication... True p 1 and... p i and... p n p 1... p i-1 and p i+1... p n implies p i implies q implies q allows: a 1 and... a i and... a n implies

### Logistics. Software Testing. Logistics. Logistics. Plan for this week. Before we begin. Project. Final exam. Questions?

Logistics Project Part 3 (block) due Sunday, Oct 30 Feedback by Monday Logistics Project Part 4 (clock variant) due Sunday, Nov 13 th Individual submission Recommended: Submit by Nov 6 th Scoring Functionality

### Formal Engineering for Industrial Software Development

Shaoying Liu Formal Engineering for Industrial Software Development Using the SOFL Method With 90 Figures and 30 Tables Springer Contents Introduction 1 1.1 Software Life Cycle... 2 1.2 The Problem 4 1.3

### Software Testing & Verification 2013/2014 Universiteit Utrecht

Software Testing & Verification 2013/2014 Universiteit Utrecht 2nd Jul. 2014, 13:30-16:30, BBL 001 Lecturer: Wishnu Prasetya You are allowed to bring along the Appendix of the LN. Part I [3pt (6 0.5)]

### Introduction to Programming (in C++) Conclusions. Jordi Cortadella, Ricard Gavaldà, Fernando Orejas Dept. of Computer Science, UPC

Introduction to Programming (in C++) Conclusions Jordi Cortadella, Ricard Gavaldà, Fernando Orejas Dept. of Computer Science, UPC Why is programming hard? Part of the difficulty is that we have many requirements.

### Practice Questions. CS161 Computer Security, Fall 2008

Practice Questions CS161 Computer Security, Fall 2008 Name Email address Score % / 100 % Please do not forget to fill up your name, email in the box in the midterm exam you can skip this here. These practice

### Rigorous Software Engineering Hoare Logic and Design by Contracts

Rigorous Software Engineering Hoare Logic and Design by Contracts Simão Melo de Sousa RELEASE (UBI), LIACC (Porto) Computer Science Department University of Beira Interior, Portugal 2010-2011 S. Melo de

### CS 441 Discrete Mathematics for CS Lecture 5. Predicate logic. CS 441 Discrete mathematics for CS. Negation of quantifiers

CS 441 Discrete Mathematics for CS Lecture 5 Predicate logic Milos Hauskrecht milos@cs.pitt.edu 5329 Sennott Square Negation of quantifiers English statement: Nothing is perfect. Translation: x Perfect(x)

### Boolean Expressions, Conditions, Loops, and Enumerations. Precedence Rules (from highest to lowest priority)

Boolean Expressions, Conditions, Loops, and Enumerations Relational Operators == // true if two values are equivalent!= // true if two values are not equivalent < // true if left value is less than the

### The Foundations: Logic and Proofs. Chapter 1, Part III: Proofs

The Foundations: Logic and Proofs Chapter 1, Part III: Proofs Rules of Inference Section 1.6 Section Summary Valid Arguments Inference Rules for Propositional Logic Using Rules of Inference to Build Arguments

### Elementary Number Theory and Methods of Proof. CSE 215, Foundations of Computer Science Stony Brook University http://www.cs.stonybrook.

Elementary Number Theory and Methods of Proof CSE 215, Foundations of Computer Science Stony Brook University http://www.cs.stonybrook.edu/~cse215 1 Number theory Properties: 2 Properties of integers (whole

### Lecture 1. Basic Concepts of Set Theory, Functions and Relations

September 7, 2005 p. 1 Lecture 1. Basic Concepts of Set Theory, Functions and Relations 0. Preliminaries...1 1. Basic Concepts of Set Theory...1 1.1. Sets and elements...1 1.2. Specification of sets...2

### def: An axiom is a statement that is assumed to be true, or in the case of a mathematical system, is used to specify the system.

Section 1.5 Methods of Proof 1.5.1 1.5 METHODS OF PROOF Some forms of argument ( valid ) never lead from correct statements to an incorrect. Some other forms of argument ( fallacies ) can lead from true

### Constructing Contracts: Making Discrete Mathematics Relevant to Beginning Programmers

Constructing Contracts: Making Discrete Mathematics Relevant to Beginning Programmers TIMOTHY S. GEGG-HARRISON Winona State University Although computer scientists understand the importance of discrete

### Mathematical Induction. Mary Barnes Sue Gordon

Mathematics Learning Centre Mathematical Induction Mary Barnes Sue Gordon c 1987 University of Sydney Contents 1 Mathematical Induction 1 1.1 Why do we need proof by induction?.... 1 1. What is proof by

### Propositional Logic. Definition: A proposition or statement is a sentence which is either true or false.

Propositional Logic Definition: A proposition or statement is a sentence which is either true or false. Definition:If a proposition is true, then we say its truth value is true, and if a proposition is

Test Case Generation for Ultimately Periodic Paths Joint work with Saddek Bensalem Hongyang Qu Stavros Tripakis Lenore Zuck Accepted to HVC 2007 How to find the condition to execute a path? (weakest precondition

### Discrete Mathematics Lecture 3 Elementary Number Theory and Methods of Proof. Harper Langston New York University

Discrete Mathematics Lecture 3 Elementary Number Theory and Methods of Proof Harper Langston New York University Proof and Counterexample Discovery and proof Even and odd numbers number n from Z is called

### 3 Some Integer Functions

3 Some Integer Functions A Pair of Fundamental Integer Functions The integer function that is the heart of this section is the modulo function. However, before getting to it, let us look at some very simple

### INCIDENCE-BETWEENNESS GEOMETRY

INCIDENCE-BETWEENNESS GEOMETRY MATH 410, CSUSM. SPRING 2008. PROFESSOR AITKEN This document covers the geometry that can be developed with just the axioms related to incidence and betweenness. The full

### We now explore a third method of proof: proof by contradiction.

CHAPTER 6 Proof by Contradiction We now explore a third method of proof: proof by contradiction. This method is not limited to proving just conditional statements it can be used to prove any kind of statement

### Automated Theorem Proving - summary of lecture 1

Automated Theorem Proving - summary of lecture 1 1 Introduction Automated Theorem Proving (ATP) deals with the development of computer programs that show that some statement is a logical consequence of

### Discrete Mathematics and Probability Theory Fall 2009 Satish Rao, David Tse Note 2

CS 70 Discrete Mathematics and Probability Theory Fall 2009 Satish Rao, David Tse Note 2 Proofs Intuitively, the concept of proof should already be familiar We all like to assert things, and few of us

### Outline. 1 Denitions. 2 Principles. 4 Implementation and Evaluation. 5 Debugging. 6 References

Outline Computer Science 331 Introduction to Testing of Programs Mike Jacobson Department of Computer Science University of Calgary Lecture #3-4 1 Denitions 2 3 4 Implementation and Evaluation 5 Debugging

### A simple algorithm with no simple verication

A simple algorithm with no simple verication Laszlo Csirmaz Central European University Abstract The correctness of a simple sorting algorithm is resented, which algorithm is \evidently wrong" at the rst

### Software Testing. Quality & Testing. Software Testing

Software Testing Software Testing Error: mistake made by the programmer/developer Fault: a incorrect piece of code/document (i.e., bug) Failure: result of a fault Goal of software testing: Cause failures

### Chapter 2: Algorithm Discovery and Design. Invitation to Computer Science, C++ Version, Third Edition

Chapter 2: Algorithm Discovery and Design Invitation to Computer Science, C++ Version, Third Edition Objectives In this chapter, you will learn about: Representing algorithms Examples of algorithmic problem

### Binary Multiplication

Binary Multiplication Q: How do we multiply two numbers? eg. 12, 345 6, 789 111105 987600 8641500 + 74070000 83, 810, 205 10111 10101 10111 00000 1011100 0000000 + 101110000 111100011 Pad, multiply and

### Boolean Algebra Part 1

Boolean Algebra Part 1 Page 1 Boolean Algebra Objectives Understand Basic Boolean Algebra Relate Boolean Algebra to Logic Networks Prove Laws using Truth Tables Understand and Use First Basic Theorems

### Mathematical Induction

Mathematical Induction In logic, we often want to prove that every member of an infinite set has some feature. E.g., we would like to show: N 1 : is a number 1 : has the feature Φ ( x)(n 1 x! 1 x) How

### APPLICATIONS OF THE ORDER FUNCTION

APPLICATIONS OF THE ORDER FUNCTION LECTURE NOTES: MATH 432, CSUSM, SPRING 2009. PROF. WAYNE AITKEN In this lecture we will explore several applications of order functions including formulas for GCDs and

### A Static Analyzer for Large Safety-Critical Software. Considered Programs and Semantics. Automatic Program Verification by Abstract Interpretation

PLDI 03 A Static Analyzer for Large Safety-Critical Software B. Blanchet, P. Cousot, R. Cousot, J. Feret L. Mauborgne, A. Miné, D. Monniaux,. Rival CNRS École normale supérieure École polytechnique Paris

### FOUNDATIONS OF ALGEBRAIC GEOMETRY CLASS 22

FOUNDATIONS OF ALGEBRAIC GEOMETRY CLASS 22 RAVI VAKIL CONTENTS 1. Discrete valuation rings: Dimension 1 Noetherian regular local rings 1 Last day, we discussed the Zariski tangent space, and saw that it

### Lecture 3: Finding integer solutions to systems of linear equations

Lecture 3: Finding integer solutions to systems of linear equations Algorithmic Number Theory (Fall 2014) Rutgers University Swastik Kopparty Scribe: Abhishek Bhrushundi 1 Overview The goal of this lecture

### Mathematics for Computer Science/Software Engineering. Notes for the course MSM1F3 Dr. R. A. Wilson

Mathematics for Computer Science/Software Engineering Notes for the course MSM1F3 Dr. R. A. Wilson October 1996 Chapter 1 Logic Lecture no. 1. We introduce the concept of a proposition, which is a statement

### Functional Programming. Functional Programming Languages. Chapter 14. Introduction

Functional Programming Languages Chapter 14 Introduction Functional programming paradigm History Features and concepts Examples: Lisp ML 1 2 Functional Programming Functional Programming Languages The

### Induction. Margaret M. Fleck. 10 October These notes cover mathematical induction and recursive definition

Induction Margaret M. Fleck 10 October 011 These notes cover mathematical induction and recursive definition 1 Introduction to induction At the start of the term, we saw the following formula for computing

### Practice Problems on NIPA and Key Prices

Practice Problems on NIPA and Key Prices 1- What are the three approaches to measuring economic activity? Why do they give the same answer? The three approaches to national income accounting are the product

### Computational Models Lecture 8, Spring 2009

Slides modified by Benny Chor, based on original slides by Maurice Herlihy, Brown Univ. p. 1 Computational Models Lecture 8, Spring 2009 Encoding of TMs Universal Turing Machines The Halting/Acceptance

### Homework 5 Solutions

Homework 5 Solutions 4.2: 2: a. 321 = 256 + 64 + 1 = (01000001) 2 b. 1023 = 512 + 256 + 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = (1111111111) 2. Note that this is 1 less than the next power of 2, 1024, which

### Extended Static Checking for Java

Lukas TU München - Seminar Verification 14. Juli 2011 Outline 1 Motivation 2 ESC/Java example 3 ESC/JAVA architecture VC generator Simplify 4 JML + ESC/Java annotation language JML What ESC/Java checks

### CS 188: Artificial Intelligence. Probability recap

CS 188: Artificial Intelligence Bayes Nets Representation and Independence Pieter Abbeel UC Berkeley Many slides over this course adapted from Dan Klein, Stuart Russell, Andrew Moore Conditional probability

### MATHEMATICAL INDUCTION. Mathematical Induction. This is a powerful method to prove properties of positive integers.

MATHEMATICAL INDUCTION MIGUEL A LERMA (Last updated: February 8, 003) Mathematical Induction This is a powerful method to prove properties of positive integers Principle of Mathematical Induction Let P

### CHAPTER 3. Methods of Proofs. 1. Logical Arguments and Formal Proofs

CHAPTER 3 Methods of Proofs 1. Logical Arguments and Formal Proofs 1.1. Basic Terminology. An axiom is a statement that is given to be true. A rule of inference is a logical rule that is used to deduce

### CPSC 121: Models of Computation Assignment #4, due Wednesday, July 22nd, 2009 at 14:00

CPSC 2: Models of Computation ssignment #4, due Wednesday, July 22nd, 29 at 4: Submission Instructions Type or write your assignment on clean sheets of paper with question numbers prominently labeled.

### Math 55: Discrete Mathematics

Math 55: Discrete Mathematics UC Berkeley, Fall 2011 Homework # 1, due Wedneday, January 25 1.1.10 Let p and q be the propositions The election is decided and The votes have been counted, respectively.

### Fuzzy Implication Rules. Adnan Yazıcı Dept. of Computer Engineering, Middle East Technical University Ankara/Turkey

Fuzzy Implication Rules Adnan Yazıcı Dept. of Computer Engineering, Middle East Technical University Ankara/Turkey Fuzzy If-Then Rules Remember: The difference between the semantics of fuzzy mapping rules

### InvGen: An Efficient Invariant Generator

InvGen: An Efficient Invariant Generator Ashutosh Gupta and Andrey Rybalchenko Max Planck Institute for Software Systems (MPI-SWS) Abstract. In this paper we present InvGen, an automatic linear arithmetic

### 9.4. The Scalar Product. Introduction. Prerequisites. Learning Style. Learning Outcomes

The Scalar Product 9.4 Introduction There are two kinds of multiplication involving vectors. The first is known as the scalar product or dot product. This is so-called because when the scalar product of

### Formal Methods for Software Development

Formal Methods for Software Development Till Mossakowski, Lutz Schröder 03./08.11.2004 2 Monadic QuickCheck extension of QuickCheck for monadic (= imperative) programs specifications are equations between

### Announcements. CompSci 230 Discrete Math for Computer Science Sets. Introduction to Sets. Sets

CompSci 230 Discrete Math for Computer Science Sets September 12, 2013 Prof. Rodger Slides modified from Rosen 1 nnouncements Read for next time Chap. 2.3-2.6 Homework 2 due Tuesday Recitation 3 on Friday

### ASSEMBLY PROGRAMMING ON A VIRTUAL COMPUTER

ASSEMBLY PROGRAMMING ON A VIRTUAL COMPUTER Pierre A. von Kaenel Mathematics and Computer Science Department Skidmore College Saratoga Springs, NY 12866 (518) 580-5292 pvonk@skidmore.edu ABSTRACT This paper

### StaRVOOrS: A Tool for Combined Static and Runtime Verification of Java

StaRVOOrS: A Tool for Combined Static and Runtime Verification of Java Jesús Mauricio Chimento 1, Wolfgang Ahrendt 1, Gordon J. Pace 2, and Gerardo Schneider 3 1 Chalmers University of Technology, Sweden.

### Relational Database Design: FD s & BCNF

CS145 Lecture Notes #5 Relational Database Design: FD s & BCNF Motivation Automatic translation from E/R or ODL may not produce the best relational design possible Sometimes database designers like to

### Page 331, 38.4 Suppose a is a positive integer and p is a prime. Prove that p a if and only if the prime factorization of a contains p.

Page 331, 38.2 Assignment #11 Solutions Factor the following positive integers into primes. a. 25 = 5 2. b. 4200 = 2 3 3 5 2 7. c. 10 10 = 2 10 5 10. d. 19 = 19. e. 1 = 1. Page 331, 38.4 Suppose a is a

### Infer: An Automatic Program Verifier for Memory Safety of C Programs

Infer: An Automatic Program Verifier for Memory Safety of C Programs Cristiano Calcagno and Dino Distefano Monoidics Ltd, UK Abstract. Infer 1 is a new automatic program verification tool aimed at proving

### 6.080 / 6.089 Great Ideas in Theoretical Computer Science Spring 2008

MIT OpenCourseWare http://ocw.mit.edu 6.080 / 6.089 Great Ideas in Theoretical Computer Science Spring 2008 For information about citing these materials or our Terms of Use, visit: http://ocw.mit.edu/terms.

### PROPERTECHNIQUEOFSOFTWARE INSPECTIONUSING GUARDED COMMANDLANGUAGE

International Journal of Computer ScienceandCommunication Vol. 2, No. 1, January-June2011, pp. 153-157 PROPERTECHNIQUEOFSOFTWARE INSPECTIONUSING GUARDED COMMANDLANGUAGE Neeraj Kumar Singhania University,

### WHAT ARE MATHEMATICAL PROOFS AND WHY THEY ARE IMPORTANT?

WHAT ARE MATHEMATICAL PROOFS AND WHY THEY ARE IMPORTANT? introduction Many students seem to have trouble with the notion of a mathematical proof. People that come to a course like Math 216, who certainly

### Proof of Infinite Number of Fibonacci Primes. Stephen Marshall. 22 May Abstract

Proof of Infinite Number of Fibonacci Primes Stephen Marshall 22 May 2014 Abstract This paper presents a complete and exhaustive proof of that an infinite number of Fibonacci Primes exist. The approach

### CHAPTER 1. Logic, Proofs Propositions

CHAPTER 1 Logic, Proofs 1.1. Propositions A proposition is a declarative sentence that is either true or false (but not both). For instance, the following are propositions: Paris is in France (true), London

### Problem Solving Basics and Computer Programming

Problem Solving Basics and Computer Programming A programming language independent companion to Roberge/Bauer/Smith, "Engaged Learning for Programming in C++: A Laboratory Course", Jones and Bartlett Publishers,

### Module 10. Coding and Testing. Version 2 CSE IIT, Kharagpur

Module 10 Coding and Testing Lesson 23 Code Review Specific Instructional Objectives At the end of this lesson the student would be able to: Identify the necessity of coding standards. Differentiate between

### Pythagorean Triples. Chapter 2. a 2 + b 2 = c 2

Chapter Pythagorean Triples The Pythagorean Theorem, that beloved formula of all high school geometry students, says that the sum of the squares of the sides of a right triangle equals the square of the

### Chapter 15 Functional Programming Languages

Chapter 15 Functional Programming Languages Introduction - The design of the imperative languages is based directly on the von Neumann architecture Efficiency (at least at first) is the primary concern,

### What's Wrong With Formal Programming Methods? Eric C.R. Hehner

What's Wrong With Formal Programming Methods? Eric C.R. Hehner Department of Computer Science, University of Toronto, Toronto M5S 1A4 Canada The January 1991 issue of Computing Research News includes the

### What is a Loop? Pretest Loops in C++ Types of Loop Testing. Count-controlled loops. Loops can be...

What is a Loop? CSC Intermediate Programming Looping A loop is a repetition control structure It causes a single statement or a group of statements to be executed repeatedly It uses a condition to control

### Software Engineering

Software Engineering Lecture 04: The B Specification Method Peter Thiemann University of Freiburg, Germany SS 2013 Peter Thiemann (Univ. Freiburg) Software Engineering SWT 1 / 50 The B specification method

### WRITING PROOFS. Christopher Heil Georgia Institute of Technology

WRITING PROOFS Christopher Heil Georgia Institute of Technology A theorem is just a statement of fact A proof of the theorem is a logical explanation of why the theorem is true Many theorems have this

### CS510 Software Engineering

CS510 Software Engineering Propositional Logic Asst. Prof. Mathias Payer Department of Computer Science Purdue University TA: Scott A. Carr Slides inspired by Xiangyu Zhang http://nebelwelt.net/teaching/15-cs510-se

### Algorithm & Flowchart & Pseudo code. Staff Incharge: S.Sasirekha

Algorithm & Flowchart & Pseudo code Staff Incharge: S.Sasirekha Computer Programming and Languages Computers work on a set of instructions called computer program, which clearly specify the ways to carry

### Lecture 16 : Relations and Functions DRAFT

CS/Math 240: Introduction to Discrete Mathematics 3/29/2011 Lecture 16 : Relations and Functions Instructor: Dieter van Melkebeek Scribe: Dalibor Zelený DRAFT In Lecture 3, we described a correspondence

### Unit testing using Python nose

Unit testing using Python nose Luis Pedro Coelho On the web: http://luispedro.org On twitter: @luispedrocoelho European Molecular Biology Laboratory June 11, 2014 Luis Pedro Coelho (luis@luispedro.org)

### 4.1. Definitions. A set may be viewed as any well defined collection of objects, called elements or members of the set.

Section 4. Set Theory 4.1. Definitions A set may be viewed as any well defined collection of objects, called elements or members of the set. Sets are usually denoted with upper case letters, A, B, X, Y,

### Part I. The Picture class

CS 161 LAB 5 This lab will have two parts. In the first part, we will create a class to automate the drawing of the robot from the second lab. For the second part, we will begin a ClunkyCalculator class

### Mathematical Induction. Lecture 10-11

Mathematical Induction Lecture 10-11 Menu Mathematical Induction Strong Induction Recursive Definitions Structural Induction Climbing an Infinite Ladder Suppose we have an infinite ladder: 1. We can reach

### 2.1 Sets, power sets. Cartesian Products.

Lecture 8 2.1 Sets, power sets. Cartesian Products. Set is an unordered collection of objects. - used to group objects together, - often the objects with similar properties This description of a set (without

### What Is Recursion? Recursion. Binary search example postponed to end of lecture

Recursion Binary search example postponed to end of lecture What Is Recursion? Recursive call A method call in which the method being called is the same as the one making the call Direct recursion Recursion

### Introduction to Computers and Programming. Testing

Introduction to Computers and Programming Prof. I. K. Lundqvist Lecture 13 April 16 2004 Testing Goals of Testing Classification Test Coverage Test Technique Blackbox vs Whitebox Real bugs and software

### MAP-I Programa Doutoral em Informática. Rigorous Software Development

MAP-I Programa Doutoral em Informática Rigorous Software Development Unidade Curricular em Teoria e Fundamentos Theory and Foundations (UCTF) DI-UM, DCC-FCUP May, 2012 Abstract This text presents a UCTF

### CS 103X: Discrete Structures Homework Assignment 3 Solutions

CS 103X: Discrete Structures Homework Assignment 3 s Exercise 1 (20 points). On well-ordering and induction: (a) Prove the induction principle from the well-ordering principle. (b) Prove the well-ordering

### 1.2 Solving a System of Linear Equations

1.. SOLVING A SYSTEM OF LINEAR EQUATIONS 1. Solving a System of Linear Equations 1..1 Simple Systems - Basic De nitions As noticed above, the general form of a linear system of m equations in n variables

### Recursive void Methods. Chapter 11. A recursive method is a method that includes a call to itself Recursion is based on the general problem.

Chapter 11 Recursion Recursive void Methods A recursive method is a method that includes a call to itself Recursion is based on the general problem solving technique of breaking down a task into subtasks

### Logic in general. Inference rules and theorem proving

Logical Agents Knowledge-based agents Logic in general Propositional logic Inference rules and theorem proving First order logic Knowledge-based agents Inference engine Knowledge base Domain-independent

### Chapter 10, Functional Dependencies and Normalization for Relational Databases

Chapter 10, Functional Dependencies and Normalization for Relational Databases We need some formal measure of why the choice of attributes for a relation schema may be better than another. Functional dependencies

### KS3 Computing Group 1 Programme of Study 2015 2016 2 hours per week

1 07/09/15 2 14/09/15 3 21/09/15 4 28/09/15 Communication and Networks esafety Obtains content from the World Wide Web using a web browser. Understands the importance of communicating safely and respectfully

### Design by Contract beyond class modelling

Design by Contract beyond class modelling Introduction Design by Contract (DbC) or Programming by Contract is an approach to designing software. It says that designers should define precise and verifiable