Basics of Formal Methods: Propositions

1
Basics of Formal Methods Propositions
Predicates

• Use logical operators (e.g. ? ?)
• Give examples of predicates
• Use universal existential quantifiers
• Write specifications using arrays

2
Propositions

• A proposition is either true or false
• 2 is even
• 5 gt 6 23 2 3
• A logical expression
• No variables so it has a constant value
• Can use logical operators
• AND, OR, NOT, Implication, iff (if and only if)
• Determine values of complex expressions
• Truth tables
• Boolean algebra rules for simplification

3
Implication (? gt)
Defined to be true here

• Corresponds to implies
• If it is raining, I take my umbrella
• It is raining ? I take my umbrella
• Only false if p is true and q is false
• it is raining and I dont take my umbrella

4
Bi-implication (? ltgt)

• Corresponds to if only if
• I see Alex Ferguson if only if I see Man Us
  boss
• I see Alex Ferguson ? I see Man Us boss
• Only false if p and q are unequal
• p ? q is equal to p ? q AND q ? p

5
Precedence

• not, and, or, gt and ltgt
• ! p q r gt s
• ( ((! p) q) r ) gt s
• If in doubt, use brackets
• Associativity
• gt is right associative
• p gt q gt r means p gt (q gt r)
• Other operators are associative
• (p q) r equals p (q r)

Dont use anything as complex as this. Too hard
to understand!
6
Predicates

• To write specifications
• Need expressions involving variables
• Need to be able to handle arrays/sequences
• Short expression handling repeated data
• Examples
• x gt y
• x gt 0 AND x lt 100
• Not constant
• Value of expression depends on variables
• Use the same operators as prepositions

x y are free variables
7
Example Specification

• int max (int x, int y)
• requires true
• ensures xgty \resultx xlty \resulty
• Explain this specification
• What is \result?
• What is the signature?
• What does the pre-condition mean?
• What is the purpose of a post-condition?
• What must an implementation do?
• Is the specification complete?

8
Max for Arrays
A very inflexible max function

• int max (int arr)
• requires arr.length 3
• ensures arr0 gt arr1 arr0 gt arr2
• \result arr0 // similarly for
  other elements
• Bad news with three elements
• Disastrous with 100
• Need new notation
• Quantifiers
• ?x 0..9 x2 lt 100 ?x 0..4 x2 lt 10
• ? x 0..3 x2 x

Can replace x by another variable without
changing the meaning
x is a bound variable
9
Quantifiers 1

• Syntax Universal Quantifier (?)
• ?bound variable type specification predicate
• ?apositive a gt 0
• ?bound variable ? set predicate
• ?a ? 1..3 a gt 0
• JML Syntax
• (\forall int a a gt 0)
• (\forall int a a gt 1 a lt 3 a gt 0)

The brackets are necessary
10
Quantifiers 2

• Syntax Existential Quantifiers
• ? there is and ?! there is exactly one
• ? a ? 0..2 a2 a
• ? a int a2 a
• ?! a ? 0..2 a2 a
• Evaluate the above predicates
• JML Syntax
• (\exists int a a gt 0 a lt 2 aa a)
• (\exists int a aa a)
• No direct equivalent of E!

11
Max for Arrays 2

• int max (int arr)
• requires true
• ensures (\forall int i 0lti iltarr.length()
  \result ? arri)
• What does this mean?
• Is it a correct specification for max?

int max (int arr) requires true ensures
(\forall int i 0lti iltarr.length() \result
gt arri) (\exists int i 0lti
iltarr.length() \result arri)
problems?
int max (int arr) requires arr.length()gt0 ensur
es (\forall int i 0lti iltarr.length()
\result gt arri) (\exists int
i 0lti iltarr.length() \result arri)
12
What if the range of ? is empty?

• ?x 0..2 x2 lt 5
• 0 lt 5 AND 1 lt 5 AND 4 lt 5
• Quantified expression is true if
• For every value of x in the range, x2 lt 5
• i.e no value in the range makes x2 lt 5 false
• ?x 0..-1 x2 lt 5
• True
• no value of x in the range makes x2 lt 5 false (as
  there are no values in the range)
• ?x 0..-1 x2 gt 5
• True
• No value in range makes x2 gt 5 false

13
What if the range of ? is empty?

• ?x 1..3 x2 gt 2
• 1 gt 2 OR 4 gt 2 OR 9 gt 2
• Quantified expression is true if
• a value of x in the range makes x2gt2 true
• ?x 0..-1 x2 gt 2
• False
• since no value of x in the range makes x2 gt 2
  true (as there are no values in the range)
• ?x 0..-1 x2 lt 5

14
Bound and Free Variables

• ?x 0..2 ?y 0..1 yx2 lt z
• Is the expressions value the same, if
• You replace
• x with a
• y with a
• z with a
• x with y
• y with x
• Which variables are free, which bound?
• Give a rule for replacing variables

Replace bound variables with any variable except
a free variable or an in-scope bound variable.
15
Simplifications

• ? i ? N ? (? j ? N ? predicate ( i, j ))
• can be simplified to
• ? i ? N, j ? N ? predicate ( i, j )
• or
• ? i, j ? N ? predicate ( i, j )

16
Combinations of Quantifiers

• Are these two the same?
• ?i ? N ? ? j ? N ? predicate ( i, j ))
• ?j ? N ? ? i ? N ? predicate ( i, j ))
• Consider using lt as the predicate

17
? - summation

• ? - sum expressions over a variable range
• Range of i is 0..3
• Value is 0 1 4 9 14
• If range is empty, value is 0
• JML
• (\sum int i 0lti ilt3 i i)

18
? - product

• ? - multiply expressions over a range
• Value is 1 4 9 36
• JML
• (\product int i 0lti ilt3 i i)

19
Conditional Expression

• ltconditiongt ? ltexpressiongt ltexpressiongt
• This is an expression not a statement
• It has a value
• What does the following put in m?
• m a gt b ? a b
• There must be a then-part an else-part
• Like C
• max (agtb? a b)

20
Example
\result (\sum int i 0lti iltarr.length()
arrit ? 1 0)
The post condition must constrain the result So
r must appear in it
Its supposed to count the number of occurrences
of t in the array. Whats the error?

• Explain the following
• Are they correct?
• //_at_ requires true
• //_at_ ensures ?(\sum int i 0lti iltarr.length()
  arrit ? 1 0)
• int c (int arr, int t)
• //_at_ requires true
• //_at_ ensures \result (\forall int i
  iltarr.length() 0lti
• c(arr1,arr1i) c(arr2, arr1i)
  arr1.length() arr2.length())
• boolean perm (int arr1, int arr2)
• // assume c returns the number of occurrences of
  a value in an array

Do the arrays contain the same number of each
character?
21
Summary

• a ? b
• Evaluates to true if b isnt false when a is true
• a ? b
• Evaluates to true if both have same truth value
• ? - like an extended AND true if all true
• ? - like an extended OR true if one true
• Predicates
• Complex logical expressions
• Use variables quantifiers
• Useful for specifications involving arrays