Title: Basics of Formal Methods: Propositions
1Basics of Formal Methods Propositions
Predicates
- Use logical operators (e.g. ? ?)
- Give examples of predicates
- Use universal existential quantifiers
- Write specifications using arrays
2Propositions
- A proposition is either true or false
- 2 is even
- 5 gt 6 23 2 3
- A logical expression
- No variables so it has a constant value
- Can use logical operators
- AND, OR, NOT, Implication, iff (if and only if)
- Determine values of complex expressions
- Truth tables
- Boolean algebra rules for simplification
3Implication (? gt)
Defined to be true here
- Corresponds to implies
- If it is raining, I take my umbrella
- It is raining ? I take my umbrella
- Only false if p is true and q is false
- it is raining and I dont take my umbrella
4Bi-implication (? ltgt)
- Corresponds to if only if
- I see Alex Ferguson if only if I see Man Us
boss - I see Alex Ferguson ? I see Man Us boss
- Only false if p and q are unequal
- p ? q is equal to p ? q AND q ? p
5Precedence
- not, and, or, gt and ltgt
- ! p q r gt s
- ( ((! p) q) r ) gt s
- If in doubt, use brackets
- Associativity
- gt is right associative
- p gt q gt r means p gt (q gt r)
- Other operators are associative
- (p q) r equals p (q r)
Dont use anything as complex as this. Too hard
to understand!
6Predicates
- To write specifications
- Need expressions involving variables
- Need to be able to handle arrays/sequences
- Short expression handling repeated data
- Examples
- x gt y
- x gt 0 AND x lt 100
- Not constant
- Value of expression depends on variables
- Use the same operators as prepositions
x y are free variables
7Example Specification
- int max (int x, int y)
- requires true
- ensures xgty \resultx xlty \resulty
- Explain this specification
- What is \result?
- What is the signature?
- What does the pre-condition mean?
- What is the purpose of a post-condition?
- What must an implementation do?
- Is the specification complete?
8Max for Arrays
A very inflexible max function
- int max (int arr)
- requires arr.length 3
- ensures arr0 gt arr1 arr0 gt arr2
- \result arr0 // similarly for
other elements - Bad news with three elements
- Disastrous with 100
- Need new notation
- Quantifiers
- ?x 0..9 x2 lt 100 ?x 0..4 x2 lt 10
- ? x 0..3 x2 x
Can replace x by another variable without
changing the meaning
x is a bound variable
9Quantifiers 1
- Syntax Universal Quantifier (?)
- ?bound variable type specification predicate
- ?apositive a gt 0
- ?bound variable ? set predicate
- ?a ? 1..3 a gt 0
- JML Syntax
- (\forall int a a gt 0)
- (\forall int a a gt 1 a lt 3 a gt 0)
The brackets are necessary
10Quantifiers 2
- Syntax Existential Quantifiers
- ? there is and ?! there is exactly one
- ? a ? 0..2 a2 a
- ? a int a2 a
- ?! a ? 0..2 a2 a
- Evaluate the above predicates
- JML Syntax
- (\exists int a a gt 0 a lt 2 aa a)
- (\exists int a aa a)
- No direct equivalent of E!
11Max for Arrays 2
- int max (int arr)
- requires true
- ensures (\forall int i 0lti iltarr.length()
\result ? arri) - What does this mean?
- Is it a correct specification for max?
int max (int arr) requires true ensures
(\forall int i 0lti iltarr.length() \result
gt arri) (\exists int i 0lti
iltarr.length() \result arri)
problems?
int max (int arr) requires arr.length()gt0 ensur
es (\forall int i 0lti iltarr.length()
\result gt arri) (\exists int
i 0lti iltarr.length() \result arri)
12What if the range of ? is empty?
- ?x 0..2 x2 lt 5
- 0 lt 5 AND 1 lt 5 AND 4 lt 5
- Quantified expression is true if
- For every value of x in the range, x2 lt 5
- i.e no value in the range makes x2 lt 5 false
- ?x 0..-1 x2 lt 5
- True
- no value of x in the range makes x2 lt 5 false (as
there are no values in the range) - ?x 0..-1 x2 gt 5
- True
- No value in range makes x2 gt 5 false
13What if the range of ? is empty?
- ?x 1..3 x2 gt 2
- 1 gt 2 OR 4 gt 2 OR 9 gt 2
- Quantified expression is true if
- a value of x in the range makes x2gt2 true
- ?x 0..-1 x2 gt 2
- False
- since no value of x in the range makes x2 gt 2
true (as there are no values in the range) - ?x 0..-1 x2 lt 5
14Bound and Free Variables
- ?x 0..2 ?y 0..1 yx2 lt z
- Is the expressions value the same, if
- You replace
- x with a
- y with a
- z with a
- x with y
- y with x
- Which variables are free, which bound?
- Give a rule for replacing variables
Replace bound variables with any variable except
a free variable or an in-scope bound variable.
15Simplifications
- ? i ? N ? (? j ? N ? predicate ( i, j ))
- can be simplified to
- ? i ? N, j ? N ? predicate ( i, j )
- or
- ? i, j ? N ? predicate ( i, j )
16Combinations of Quantifiers
- Are these two the same?
- ?i ? N ? ? j ? N ? predicate ( i, j ))
- ?j ? N ? ? i ? N ? predicate ( i, j ))
- Consider using lt as the predicate
17? - summation
- ? - sum expressions over a variable range
- Range of i is 0..3
- Value is 0 1 4 9 14
- If range is empty, value is 0
- JML
- (\sum int i 0lti ilt3 i i)
18? - product
- ? - multiply expressions over a range
- Value is 1 4 9 36
- JML
- (\product int i 0lti ilt3 i i)
19Conditional Expression
- ltconditiongt ? ltexpressiongt ltexpressiongt
- This is an expression not a statement
- It has a value
- What does the following put in m?
- m a gt b ? a b
- There must be a then-part an else-part
- Like C
- max (agtb? a b)
20Example
\result (\sum int i 0lti iltarr.length()
arrit ? 1 0)
The post condition must constrain the result So
r must appear in it
Its supposed to count the number of occurrences
of t in the array. Whats the error?
- Explain the following
- Are they correct?
- //_at_ requires true
- //_at_ ensures ?(\sum int i 0lti iltarr.length()
arrit ? 1 0) - int c (int arr, int t)
- //_at_ requires true
- //_at_ ensures \result (\forall int i
iltarr.length() 0lti - c(arr1,arr1i) c(arr2, arr1i)
arr1.length() arr2.length()) - boolean perm (int arr1, int arr2)
- // assume c returns the number of occurrences of
a value in an array
Do the arrays contain the same number of each
character?
21Summary
- a ? b
- Evaluates to true if b isnt false when a is true
- a ? b
- Evaluates to true if both have same truth value
- ? - like an extended AND true if all true
- ? - like an extended OR true if one true
- Predicates
- Complex logical expressions
- Use variables quantifiers
- Useful for specifications involving arrays