Strongly Connected Components in graphs, formal proof of Tarjan1972 algorithm

Transcription

1 Strongly Connected Components in graphs, formal proof of Tarjan972 algorithm Inria Sophia,

2 Plan motivation algorithm pre-/post-conditions imperative programs conclusion.. joint work (in progress) with Ran Chen 2

3 Motivation nice algorithms should have simple formal proofs to be fully published in articles or journals how to publish formal proofs? Coq proofs seem to me unreadable (by normal human) Why3 allows mix of automatic and interactive proofs first-order logic is easy to understand algorithms on graphs = a good testbed 3

4 A one-pass lineartime algorithm

5 The algorithm (/3) depth-first search algorithm with pushing non visited vertices into a working stack and computing oldest vertex reachable by at most a single «back-edge» when that oldest vertex is equal to currently visited vertex, a new strongly connected component is in the working stack on top of current vertex. then pop working stack until currently visited vertex

6 The algorithm (2/3) les valeurs successives de la pile sens croissant du rang

7 The algorithm (2/3) les valeurs successives de la pile sens croissant du rang

8 The algorithm (2/3) les valeurs successives de la pile sens croissant du rang

9 The algorithm (2/3) les valeurs successives de la pile sens croissant du rang 9

10 The algorithm (3/3) print each component on a line

11 Proof in algorithms book (/2) consider the spanning trees (forest) tree structure of strongly connected components 2-3 lemmas about ancestors in spanning trees LOWLINK(x) =min({num[x]} [ {num[y] x =),! y ^ x and y are in same connected component} )

12 Proof in algorithms book (2/2) give the program proof program that part of the proof is very informal 2

13 The algorithm (bis) les valeurs successives de la pile sens croissant du rang LOWLINK(x) =min({num[x]} [ {num[y] x =),! y ^ x and y are in same connected component} ) 3

14 The algorithm (ter) les valeurs successives de la pile sens croissant du rang LOWLINK(x) =min({rank[y] x =),! y ^ x and y are in same connected component} )

15 Our program (/3) a functional version with lists and finite sets the working stack is a list

16 Our program (/3) a functional version with lists and finite sets the working stack is a list s s 2 x s 6

17 Our program (2/3) blacks, grays are sets of vertices; sccs is a set of sets of vertices naming conventions: x, y, z for vertices; b for black sets; s for stacks; cc for connected components; sccs for sets of connected components 7

18 Our program (3/3) 8

19 Pre-/Post-conditions

20 Pre/Post-conditions (/3)

21 Pre/Post-conditions (2/3) stack s m y x x sccs sccs n blacks b m apple rank y stack m apple rank x stack

22 Pre/Post-conditions (3/3)

23 Graphs

24 Paths

25 Invariants (/) blacks \ grays = ; elements s = grays [ blacks (set of sccs) (set of sccs) blacks

26 Invariants (2/) s sccs cc cc2 increasing rank ccn blacks grays

27 Invariants (3/)

28 Invariants (/) s sccs cc cc2 increasing rank ccn blacks grays

29 Assertions

30 Assertions Coq proof: there exists x 0,y 0 and x 0,y 0 y 0 2 s3 =stack x 0 = x x 0 6= x with impossible because m apple rank y s < rank x s impossible because crossedge x 0 2 s2 ^ y 0 62 s2 ^ edge x 0 y 0 are in same strongly connected component as x y 0 2 sccs impossible because sccs disjoint from stack y 0 is white x 0 = x x 0 6= x impossible because successors are black impossible because no black to white

31 Pre/Post-conditions (/3)

32 Full proof full proof is at see the file why3session.html proof: 8 lines (38 lemmas) including the program texts. 82 proof obligations all proved automatically by Alt-Ergo (.30), CVC3 (2..), CVC (.), Eprover (.9), Spass (3.),Yices (.0.) except of manually checked by Coq (8.6) Coq proofs are 20 lines ( )

33 Towards imperative program

34 Assertions

35 Assertions

36 Assertions

37 Missing implementation of graphs vertices as integers in an array successors as lists for every vertex see

38 Conclusion

39 Conclusion readable proofs? simple algorithms should have simple proofs to be shown with a good formal precision compare with other proof systems (without automatic provers?) further algorithms (in next talks?) graphs represented with arrays + lists topological sort, articulation points, scck, ssct Why3 is a beautiful system but not so easy to use! 39