lecture_2: THEORY BEGIN % % Exercise 1 % % The PVS prelude includes the following definitions: % % expt(r, n): RECURSIVE real = % IF n = 0 THEN 1 % ELSE r * expt(r, n-1) % ENDIF % MEASURE n; % % ^(r: real, i:{i:int | r /= 0 OR i >= 0}): real % = IF i >= 0 THEN expt(r, i) ELSE 1/expt(r, -i) ENDIF % Ex Ponent Facto(rial) % { 1 , if n = 0 % n! = { % { n * (n - 1)! , otherwise factorial(n : nat): RECURSIVE posnat = IF n = 0 THEN 1 ELSE n * factorial(n - 1) ENDIF MEASURE n % discharge factorial_TCC1 with (grind-reals) % From the prelude, we have: % % gt_times_gt_pos1: LEMMA % x >= py AND z > nnw IMPLIES x * z > py * nnw % % This lemma may be used in a proof of the following. % You will have to provide explicit instantiations. % Consider the following substitutions*: % nnw <- exp2(j!1) % py <- 2 % x <- (j!1 + 1) % z <- factorial(j!1) % *use j!1 for _nat, ja!1 for _above3 % You may also need to rewrite with the following two prelude results % at an appropriate proof step. % expt_x1: LEMMA x^1 = x % expt_plus: LEMMA n0x^(i + j) = n0x^i * n0x^j m,n : VAR nat factorial_gt_expt2_nat: LEMMA % DO NOT USE (induct-and-simplify "n"). n > 3 IMPLIES factorial(n) > 2 ^ n x: var above(3) factorial_gt_expt2_above3: LEMMA % DO NOT USE (induct-and-simplify "x"). factorial(x) > 2 ^ x % % Exercise 2 % % Ackermann ack(m,n) : RECURSIVE nat = IF m = 0 THEN n+1 ELSIF n = 0 THEN ack(m-1,1) ELSE ack(m-1,ack(m,n-1)) ENDIF MEASURE lex2(m,n) % Hint: You may need two inductions ack_simple_property : THEOREM FORALL(m,n): ack(m,n) > m+n % % Exercise 3 % % Example of for loops IMPORTING MyNAS, structures@for_iterate % /* Pre: nas is non empty */ % ac = nas[1] % for (int i=1; i < n; i++) { % /* Inv: ac = max(ac[1..i]) */ % ac = max(ac,nas[i+1]); % } % /* Post: ac = max(nas[1..n]) */ fastest(nas:(nonemptynas?)) : Aircraft % = ... % Hint: You may need the following invariant % LAMBDA(i:upto(nas`n-1),ac:Aircraft): % FORALL (k:subrange(1,i+1)): ac`gs >= nas`seq(k)`gs fastest_correct : THEOREM FORALL (nas:(nonemptynas?),i:subrange(1,nas`n)): fastest(nas)`gs >= nas`seq(i)`gs % Example inductive definitions % Sample inductive definitions, use M-x ppe to see automatically % generated induction schemas even(n:nat): INDUCTIVE bool = n = 0 OR (n > 1 AND even(n - 2)) odd(n:nat): INDUCTIVE bool = n = 1 OR (n > 1 AND odd(n - 2)) % use (rule-induct "even") even_odd: LEMMA even(n) => odd(n + 1) % use (rule-induct "odd") odd_even: LEMMA odd(n) => even(n + 1) % use (induct-and-simplify "n") % then use the preceding two lemmas even_or_odd: LEMMA even(n) OR odd(n) % % Exercise 4 % %% PVS DOES NOT (DIRECTLY) SUPPORT MUTUAL RECURSION % my_even?(n) : INDUCTIVE bool = % n = 0 OR n > 0 AND my_odd?(n-1) % % my_odd?(n) : INDUCTIVE bool = % n = 1 OR n > 1 AND my_even?(n-1) %% Mutual recursion can be simulated using regular recursion even_f?(fodd:[nat->bool],n) : bool = n = 0 OR n > 0 AND fodd(n-1) my_odd?(n) : INDUCTIVE bool = n = 1 OR n > 1 AND even_f?(my_odd?,n-1) my_even?(n) : bool = even_f?(my_odd?,n) % Hint: Use induction on "n" and lemmas even_odd and odd_even my_even_my_odd : THEOREM my_even?(n) = even(n) AND my_odd?(n) = odd(n) % % Exercise 5 % Tree : DATATYPE BEGIN nulltree : nulltree? constree(val:nat,left:Tree,right:Tree) : constree? END Tree height(t:Tree) : RECURSIVE nat = CASES t OF nulltree : 0 ELSE 1+max(height(left(t)),height(right(t))) ENDCASES MEASURE t BY << monotonetree?(t:Tree): INDUCTIVE bool = nulltree?(t) OR (constree?(left(t)) IMPLIES val(t) > val(left(t))) AND (constree?(right(t)) IMPLIES val(t) > val(right(t))) AND monotonetree?(left(t)) AND monotonetree?(right(t)) consotonetree?(t:Tree): MACRO bool = constree?(t) AND monotonetree?(t) height_monotone: THEOREM FORALL (t:(consotonetree?)): height(t) <= val(t)+1 % % More Exercises % f: VAR [nat -> nat] % Fun with summation sum(n): RECURSIVE nat = IF n = 0 THEN 0 ELSE n + sum(n - 1) ENDIF MEASURE n closed_form: THEOREM sum(n) = (n * (n + 1)) / 2 sum(n, f) : RECURSIVE nat = IF n = 0 THEN f(0) ELSE f(n) + sum(n - 1, f) ENDIF MEASURE n % Reminder: id is the identity function, id(x) = x closed_form2: THEOREM sum(n, id) = (n * (n + 1)) / 2 square(n: nat) : nat = n * n cube(n: nat) : nat = n*n*n sum_of_squares: LEMMA sum(n, square) = (n * (n + 1) * (2 * n + 1)) / 6 sum_of_cubes: LEMMA % hint: try (rewrite "closed_form") when you get stuck. sum(n, cube) = square(sum(n)) times_distributes_over_sum: LEMMA m * sum(n, f) = sum(n, (LAMBDA (n1 : nat) : m * f(n1))) expt2(n) : nat = 2 ^ n sum_expt2: LEMMA % use (induct-and-simplify\$ "n") to illustrate strategy sum(n, expt2) = 2 ^ (n + 1) - 1 % % Functional equivalence of algorithms % % A Tail of Two Fibonacci's % i, j, k: VAR nat % ith Fibonacci fib(i): RECURSIVE nat = IF i = 0 THEN 1 ELSIF i = 1 THEN 1 ELSE (fib(i - 1) + fib(i - 2)) ENDIF MEASURE i % tail recursive definition of Fibonacci tfib(i, j, k): RECURSIVE nat = IF i = 0 THEN j ELSE tfib(i - 1, k, j + k) ENDIF MEASURE i % Reminder: (induct-and-simplify "i") occasionally takes you down an % unfortunate path. In this case, it is better to simply use (induct "i"), % and manually control the expansion of "tfib" fib_tfib: LEMMA tfib(i + 2, j, k) = tfib(i + 1, j, k) + tfib(i, j, k) % Reminder: The proof of tfib_fib requires strong induction. % The first step is (induct "i" :name "NAT_induction") tfib_fib: THEOREM fib(i) = tfib(i, 1, 1) END lecture_2