CS476 Homework #5, Due 11am on 12/1
Note: Answers to the exercises listed below should be handed to the instructor in formatted form. Furthemore,
the code for the examples should also be emailed to the instructor.
1. The following two exercises use the latest version (with support for this Java subset) of the ITP download-
able from the course web site, which has an extension of the list of commands of the ITP specifically de-
signed to support Hoare logic reasoning in our programming language. This latest version should only be
used for verifying Java programs. For all other purposes, for example to verify inductive properties of a
functional module, you should still use the previous version of the ITP that you have used before. For any
questions/problems that you may have using this experimental version of the Java-ITP tool you can consult
First unpack the downloaded file with ’tar xvfz homework-cs476.tar.gz’
The way this extension works is as follows:
•start the latest version of Maude
•load into Maude the functional module defining the semantics of our language, java-es-flat.maude, (for
speed reason we use the flattened version).
•define a program (BlockStatements)foo in a module foo.maude importing java-es-flat.maude by
declaring a constant foo and giving an equation defining the constant as the corresponding program text.
Also declare a constant foo-init which contains all declarations necessary for your program and make
sure there are no (”Java”) declarations in your program foo. The module foo.maude should also contain
all auxiliary functions needed in a proof of correctness of program foo. (Note that in the two excercises
below this has already been done for you, in the files div2.maude and sumn.maude.)
•load foo.maude (The above mentioned file instead)
•then load the included version of itp-tool.maude
•then, to prove a Hoare triple
{P}foo {Q}
you give a javax command, or a javax-inv command which also needs an invariant.
In the homework this command has already been spelled out for you in ”sumn.itp” whereas in ”div2.itp” the
invariant is missing. Before loading ”div2.itp” you need to enter your own invariant in the marked place. Then
you can interact with the ITP tool to discharge the created first-order goals.
Note that you can write your solution (i.e. the commands you used to discharge a goal) directly below the
javax-inv command and then in one shot load the module which will create the goal and discharge it.
Here is the sumn.maude module, that you can download es explained above:
fmod SUMN-JAVAX is
including JAVAX .
op sum : Int -> Int .
var N : Int .
ceq sum(N) = 0 if N <= 0 .
ceq sum(N) = N + sum(N - 1) if 0 < N .
op sumn : -> BlockStatements .
1
