22C:111
Example Axiomatic Program Proof
page 1 of 2
The Fibonacci numbers are a sequence of integers defined recursively by
fib(0) = 0, fib(1) = 1, and
fib(N) = fib(N-1)+fib(N-2), for N>1.
The naturally corresponding recursive program (in any language) for this
definition is clearly correct but so
highly
inefficient that it is of no practical
use, even for small (e.g., two digit) arguments. We prove that the following
iterative program fragment in Louden's Sample language is correct (its
performance is clearly directly proportional to the size of the argument N).
{ N≥0 }
NEW:= 1; OLD:= 0; I:= 0;
{ P
P}
while N-I do
I:= I+1; NEW:= NEW+OLD;
OLD:= NEW-OLD od
{ OLD = fib(N) }
Proof (read ˙æ as “it is provable that”)
Step 0: discover the loop invariant P
P
Informally the idea of the loop is that as I is incremented, the variables NEW
and OLD are revised to maintain the value of fib(I) and fib(I+!). We also include
a technical condition relating I and N that’s needed in the last step.
Take P
P ≡ (0£I£N Ÿ NEW=fib(I+1) Ÿ OLD=fib(I))
Step 1: Show ˙æ { N≥0 } NEW:=1; OLD:=0; I:=0 { P
P }
Exercise — takes several steps using ASN and SEQ.
Step 2: Show ˙æ { P
P } while … { OLD=fib(N) } (i.e., prove the post-condition)
This step is established through several intermediate steps.
Step 2A: Find Q
Q1 and Q
Q2 to show (i.e., P
P is a loop invariant)
˙æ { P
P Ÿ N-I>0 }
I:=I+1;
{ Q
Q1 } NEW:= NEW+OLD;
{ Q
Q2 } OLD:= NEW-OLD
{ P
P }
