COMP SCI 3EA3 Specifications and Correctness Duration of Examination: 50 minutes

Transcription

1 Best of luck! McMaster University Department of Computing and Software Musa Al-hassy CONTENTS CompSci 3EA3 January 30, 2018 iday Class COMP SCI 3EA3 Specifications and Correctness Duration of Examination: 50 minutes This examination booklet includes 12 pages (including this cover sheet); it consists of 6 questions. You are responsible for ensuring that your copy of the paper is complete. Bring any discrepancy to the attention of your invigilator. Special Instructions: Make sure your name and student number are on all sheets. Do not separate the pages of this examination booklet. This is a closed book examination. No books, notes, texts, calculator or academic aids of any kind are permitted. Answer the questions in the space provided. Read each question completely and carefully before answering it. Give reasons for your answers. You are always allowed to introduce auxiliary definitions and prove auxiliary theorems. In doubt, document! Each question is worth 10 points; the bonus question is worth another 5 points. With the exception of question 5, each question constains 3 subquestions. Answer two and only two subquestions; if you answer all three, only the first two will be marked. This includes the bonus section as well. The word implementation is to be interpreted as the providing of a direct and explicit description, rather than an indirect one such as by universal characterisations or other indirect specifications. Contents Good Luck! 1 Order Theory Binary Operators 2 2 The Curry-Howard Correspondence 4 3 Free Types Pointers 6 4 Logic Quantifiers 9 5 Frama-C Selection Sort 10 6 Bonus Fundamentals 11 Page 1 of 12

2 1 ORDER THEORY BINARY OPERATORS 1 Order Theory Binary Operators Let - - : T T T be a binary operator on some ambient type T. What does it mean for this operator to be associative, idempotent, and symmetric? For the type N, give two distinct implementations of such an operator. That is, Provide explicit definitions of two operators - 1 -, : N N N. Briefly and informally justify why they are each associative, idempotent, and symmetric. Finally, show that the operators are actually different from one another.

3 1 ORDER THEORY BINARY OPERATORS Orders from such operators Assuming is an associative, idempotent, and symmetric operator, induce a binary relation by the axiom x, y x y x y = x This is an order relation. Prove one, and only one, of the properties required for it to be an order.

4 2 THE CURRY-HOWARD CORRESPONDENCE 2 The Curry-Howard Correspondence Provide an explanation of this idea. Provide a program to prove ( X : N N : N X N -1 is divisible by X-1) The phrase a is divisible by b means that there is a number m such that a = b m. Informally argue the correctness of your program.

5 2 THE CURRY-HOWARD CORRESPONDENCE Provide a program to prove the existence of discrete logarithms That is, provide an ACSL annotated program implementing the function lg - : N N N specified by a, b, k : N k lg a b a k b

6 3 FREE TYPES POINTERS 3 Free Types Pointers One way to reason about pointers of type T is by the free type definition Pointer T = Null Valid T State the induction axiom for this type. Setup for the next two subquestions We can define a general way to work on pointers by the an operation ( p, d ) which takes a pointer p and dereferences it if possible, otherwise returns a default value d. ( _,_ ) : Pointer T T T ( Null, d ) = d ( Valid t, d ) = t

7 3 FREE TYPES POINTERS Pointer Modification The pointer eliminator operation is natural in that for any arbitrary transformation f : T T, we have f ( p, d ) = ( modify f p, f d ) Where modify f lifts functions on values to be functions on pointers. Using this naturality equation as a specification of modify, declare its type and provide an implementation.

8 3 FREE TYPES POINTERS Identity is a form of elimination The eliminator operation suffices as a general scheme to define operations on pointers. Using induction on pointers, prove that the identity function the do-nothing method on pointers can be defined this way as well. In-particular, p : Pointer T ( Valid p, Null ) = p

9 4 LOGIC QUANTIFIERS 4 Logic Quantifiers Explain the idea that a loop implements a finite quantification State the One-point Rule and Split-off Term Law State the Empty Range and Range Split Axioms

10 5 FRAMA-C SELECTION SORT 5 Frama-C Selection Sort Fill in the missing parts of the following specification with the appropriate statements to ensure the resulting fragment can be verified by Frama-C. This is one of the simplest approaches to sorting: Find the smallest element in the list of N elements. Place this element at the front of the list. Now repeat this process on the remaining list of N-1 elements. With each pass, one more element is placed in its correct position in the list, and the unsorted list shrinks by one. After N-1 passess, the list must be sorted. The first N-1 elements are now in their correct position. There is only one element left in the list, and it too, must be in the correct position. Informally, the loop below works since A[0..head 1] Sorted and A[head] A[head + 1..N 1] /*@ requires \valid(a+(0..n-1)) && N >= assigns ensures \forall integer i; 0 <= i < N-1 ==> A[i] <= // No post-condition specifying preservation of contents! */ void SelectionSort(int A[], int N) { /*@ loop loop loop variant */ for(int head=0 ; head!= N; head++) { int imin = head; /*@ loop loop loop variant */ for(int j=head+1; j!= N; j++) imin = A[j] < A[imin]? j : imin; } } swap(a[head], A[imin]);

11 6 BONUS FUNDAMENTALS 6 Bonus Fundamentals Prove the weakening/strengthening rules: x x y y x y Hint: How is specified? Let A[0..N-1] be specified as a monotonic array on N whose elements are distinct, provide such an array explicitly for N = 5.

12 6 BONUS FUNDAMENTALS Who stole the flour? Recall the general setting from class, adapted from Smullyan s text, How about making us some nice tarts? the King of Hearts asked the Queen of Hearts one cool summer day. I can t! shouted the Queen. A necessary item has been stolen! Really! said the King. This is quite serious! Who stole it? How do you expect me to know who stole it? If I knew, I would have had it back long ago and the miscreant s head in the bargain! Well, the King had his soldiers scout around for the missing item, and it was found in the house of the March Hare, the Mad Hatter, and the Dormouse. All three were promptly arrested and tried. The puzzles are to deduce the criminal from what the defendants have to say and the findings of the investigations that found them. We begin my formalising the candidate of the crime, Declaration: R, H, M : B Explanation: R = the R abbit, the March Hare, stole the item Explanation: H = the H uman, the Mad Hatter, stole the item Explanation: M = the M ouse, the Dormouse, stole the item The defendants had the following to say: March Hare: The Hatter stole it. Mad Hatter: -said nothing - Dormouse : -said nothing - As subsequent investigation revealed, only one of the three had stolen the flour, and he was the only one of the three who told the truth. Calculate to find the criminal! An informal argument, rather than a calculation, results in half rather than full marks.