1. More Mathematical Reasoning (Conditional Statements)
Murali Sitaraman
Clemson University

2. Is the code correct for the given spec?
Operation Do_Nothing (updates I: Integer);
ensures I = #I;
Code:
If (I < Max_Int()) then
Increment(I);
Decrement(I);
end;

3. These specs are the same…
Operation Do_Nothing (updates I: Integer);
ensures I = #I;
Operation Do_Nothing (restores I: Integer);

4. Establish the goals in state-oriented terms using a table
Cond Assume Confirm
If (I < Max_Int()) 1
Increment(I); 2
Decrement(I) 3
end;
I4 = I0

5. Establish the conditions
Cond Assume Confirm
If (I < Max_Int())
1 I0 < max_int
Increment(I);
2 I0 < max_int
Decrement(I)
3 I0 < max_int
end;
I4 = I0

6. Establish sub-goals for different conditions
Cond Assume Confirm
If (I < Max_Int)
1 I0 < max_int
Increment(I);
2 I0 < max_int
Decrement(I)
3 I0 < max_int
end;
not (I0 < max_int) I4 = I0 I4 = I0
I0 < max_int I4 = I3 I4 = I0

7. Fill in other assumptions and obligations as before…
Cond Assume Confirm
If (I < Max_Int)
1 I0 < max_int
Increment(I);
2 I0 < max_int
Decrement(I)
3 I0 < max_int
end;
not (I0 < max_int) I4 = I0 I4 = I0
I0 < max_int I4 = I3 I4 = I0

8. Prove the subgoal(s) 4.1 Case: not (I0 < max_int) Prove I4 = I0
True from the assumption
4.2 Case: (I0 < max_int)
Prove: I3 = I0 (assumption in state 4)
Prove: (I2 - 1) = I0 (assumption in st 3) …

9. Prove remaining assertions to be confirmed
For the condition (I0 < max_int), additional proofs are needed.
These proofs of assertions to be confirmed in states 1 and 2 left as exercises

10. More Mathematical Reasoning
Create this example using the web interface, generate VCs, and prove them
For recursive implementations
Recursive calls are handled just as any other call
Need to show termination using a programmer-supplied decreasing “metric”
For iterative implementations, invariants and decreasing metrics are used