More on Correctness

Prime Factorization Problem: Write a program that computes all the prime factors of a given number Solution (Idea): Factors are less than or equal to the given number Starting from the smallest prime (2), check whether all prime numbers less than the given number is a factor For every factor, compute its multiplicity also

Program prime_factor implicit none integer:: i, m, n read *, n i = 2; m = n ! n is the number to be factorized outer : do if ( i*i > m) exit inner : do if ( modulo(m,i) /= 0) exit m = m/i print *, i end do inner i = i+1 end do outer if ( m > 1) print *, m end program prime_factor

Correctness of the solution Study the program It may print the same number more than once. Why? No check for primality is made! Is the program correct? How do you check this? Test the program. How? Run the program for some inputs

Program Testing This is the standard approach used to ensure the correctness various issues to be addressed –What inputs should be given? Give inputs that test `corner cases', `boundary conditions', `representative inputs', eg. – 1, 2 (corner cases), –7, 53, 81, 224 (representative cases) Choose inputs that exercise all the `paths' in the program –What outputs are expected? Independent computation of outputs necessary –How many inputs should be given? As much to gain confidence

Program Verification Program Testing is good for detecting bugs in the final implementations It is a bit ad hoc and not recommended for ensuring correctness of algorithms or high level programs It can not ensure correctness - `it can reveal presence of bugs never their absence’ A more rigorous approach is Formal Verification (FV) FV proves the correctness mathematically In general difficult and followed very little in practice

Correctness of the solution FV requires a very precise definition of correctness What is the definition of correctness? When input constraints are satisfied the program terminates producing output with the desired properties In this example: –Input constraint: The number (n>0) –Output property: Any number printed is a prime factor (safety) All prime factors are printed (liveness) Correctness demands that these two properties should hold for any number

Loop Invariance For proving these properties, identify loop invariants: –a loop invariant is a property relating the values of variables such that if it is true before an iteration starts then it is true at end of iteration property preserved under iterations loop invariant, if it holds before the start of the loop then it will hold at the end How? Proof by induction on the number of iterations

Prime Factorization a loop invariant for outer loop –none of j, 1 < j < i, is a factor of m –product of all numbers printed and m is n This is true at start of iteration To prove that it is indeed an invariant, –let m = l and i = k at the start of an iteration. –Then l not divisible by any j, 1 < j < k

Proof At the end of this iteration, –value of i = k+1. k is not a factor of the new value of m, since in the iteration m is divided by k as many times as possible –None of j, 1 < j < k continue to be a factor of new value of m (why?) –every time k is printed, m is divided by k and hence product of m and all numbers printed is n –Hence the loop invariant holds at end of iteration

Proof of Safety Property To prove that any number printed is a prime factor Proof: Case1: k is printed in the inner loop Then k divides m but no number < k divides m. So k is prime. Loop invariant implies that m is a factor and hence k is a factor Case2: m is printed At end of loop, value of m is either 1 or a prime Loop invariant ensures that at end of loop, product of printed numbers and m is n since m is printed, it is prime.

Proof of Liveness Property To prove that all prime factors are printed –Any prime factor p of n has the property: either p*p <= n or p has multiplicity 1 –The loops checks all numbers i s.t i*i <= n, whether it is factor –Both the loops terminate (why?) –The prime factor p s.t. p*p > n, if it exists is m when the outer loop terminates

Formal Verification More rigorous, proves the correctness Does not run the program for particular inputs More time consuming but should be done for increased confidence Many applications required more confidence Safety-critical applications –Aircraft control, nuclear plant control, Missile avionics, patient monitoring systems, etc CFDVS at IIT Bombay Lesson for you: Write loop invariants Prove that the loop terminates