Abstract
The “correct by construction” paradigm is an important component of modern Formal Methods, and here we use the probabilistic Guarded-Command Language pGCL to illustrate its application to probabilistic programming.
pGCL extends Dijkstra’s guarded-command language GCL with probabilistic choice, and is equipped with a correctness-preserving refinement relation \((\mathrel \sqsubseteq )\) that enables compact, abstract specifications of probabilistic properties to be transformed gradually to concrete, executable code by applying mathematical insights in a systematic and layered way.
Characteristically for correctness by construction, as far as possible the reasoning in each refinement-step layer does not depend on earlier layers, and does not affect later ones.
We demonstrate the technique by deriving a fair-coin implementation of any given discrete probability distribution. In the special case of simulating a fair die, our correct-by-construction algorithm turns out to be “within spitting distance” of Knuth and Yao’s optimal solution.
We are grateful for the support of the Australian Research Council.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
A game-show host, Monty Hall, exhibits three curtains, behind one of which sits a Cadillac; the other two curtains conceal goats. The contestant guesses which curtain hides the prize, and Monty then opens another, making sure however that it reveals a goat. The contestant is allowed to change his mind. Should he?
- 2.
If the program is a mathematical object, then as Andrew Vazonyi [14] pointed out: “I’m not interested in ad hoc solutions invented by clever people. I want a method that works for lots of problems... One that mere mortals can use. Which is what a correctness-by-construction method should be.”.
- 3.
Constructor \({\mathbb {P}}\) is “subsets of” and \(\mathbb {D}\) is “discrete distributions on”.
- 4.
See Sect. 3.5 for a further discussion of this.
- 5.
Kozen’s work did not restrict to discrete distributions; but that is all we need here.
- 6.
The expected value of the characteristic function
of an event
is equal to the probability that
itself holds. - 7.
Note that if
contains (
) somewhere, the above does not apply: Dijkstra semantics has no definition for (
). - 8.
This is particularly compelling when wp is Curried: sequential composition
is then the functional composition
. - 9.
This is not a novelty: demonic choice is usually treated that way in semantics—that’s why it’s called “demonic”.
- 10.
- 11.
We will sometimes include Dijkstra’s closing
. - 12.
As before, we usually use Dijkstra’s loop-closing
. - 13.
- 14.
Recall from Sect. 2.2 that \(\mathbb {D}\mathcal{X}\) is the set of discrete distributions over finite set \(\mathcal X\).
- 15.
Summing over all possible values e of
would give the same result, since the extra values have probability zero anyway. Some find this formulation more intuitive. - 16.
In probability theory this would be the cardinality of its support.
- 17.
And if an error was made in the
proofs, the “successful” path can be audited to see what the mistake was, why it was made, and how to fix it. - 18.
Applying
to a set means the sum of the
-probabilities of the elements of the set. - 19.
If for example C were much smaller, so that the dividing line went through D, the new distribution
would have support 4, the same as
itself. But
would then have support 1, strictly smaller. - 20.
The range
is inclusive-exclusive (as in Python). A similar coupling invariant applies to
and
. All three invariants are applied at once. - 21.
Note the necessity of keeping this as two steps: first data-refine, then (if you can) optimise algorithmically.
of an event
is equal to the probability that
itself holds.
contains (
) somewhere, the above does not apply: Dijkstra semantics has no definition for (
).
is then the functional composition
.
.
.
would give the same result, since the extra values have probability zero anyway. Some find this formulation more intuitive.
proofs, the “successful” path can be audited to see what the mistake was, why it was made, and how to fix it.
to a set means the sum of the
-probabilities of the elements of the set.
would have support 4, the same as
itself. But
would then have support 1, strictly smaller.
is inclusive-exclusive (as in Python). A similar coupling invariant applies to
and
. All three invariants are applied at once.References
Dijkstra, E.W.: On the reliability of programs (EWD303)
Dijkstra, E.W.: A Discipline of Programming. Prentice-Hall, Upper Saddle River (1976)
Floyd, R.W.: Assigning meanings to programs. In: Schwartz, J.T. (ed.) Mathematical Aspects of Computer Science. Proceedings of Symposium on Applied Mathematics, vol. 19, pp. 19–32. American Mathematical Society (1967)
Hoare, C.A.R.: An axiomatic basis for computer programming. Comm. ACM 12(10), 576–580 (1969)
Jones, C.B., Plotkin, G.: A probabilistic powerdomain of evaluations. In: Proceedings of the IEEE 4th Annual Symposium on Logic in Computer Science, Los Alamitos, CA, pp. 186–195. Computer Society Press (1989)
Knuth, D., Yao, A.: The complexity of nonuniform random number generation. In: Algorithms and Complexity: New Directions and Recent Results. Academic Press (1976)
Kozen, D.: Semantics of probabilistic programs. J. Comput. Syst. Sci. 22, 328–350 (1981)
Kozen, D.: A probabilistic PDL. In: Proceedings of the 15th ACM Symposium on Theory of Computing, pp. 291–297. ACM, New York (1983)
Leino, K.R.M.: Dafny: an automatic program verifier for functional correctness. In: Clarke, E.M., Voronkov, A. (eds.) LPAR 2010. LNCS (LNAI), vol. 6355, pp. 348–370. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-17511-4_20
McIver, A.K., Morgan, C.C.: Abstraction, Refinement and Proof for Probabilistic Systems. Monographs in Computer Science. Springer, New York (2005). https://doi.org/10.1007/b138392
McIver, A.K., Morgan, C.C., Kaminski, B.-L., Katoen, J.-P.: A new proof rule for almost-sure termination. Proc. ACM Program. Lang. 2(POPL), 1–28 (2017)
Morgan, C.C., McIver, A.K., Seidel, K.: Probabilistic predicate transformers. ACM Trans. Program. Lang. Syst. 18(3), 325–353 (1996)
Morgan, C.C.: Proof rules for probabilistic loops. In: Jifeng, H., Cooke, J., Wallis, P. (eds.) Proceedings of the BCS-FACS 7th Refinement Workshop, Workshops in Computing. Springer, Heidelberg (July 1996). http://www.bcs.org/upload/pdf/ewicrw96paper10.pdf
Vazsonyi, A.: Which Door has the Cadillac: Adventures of a Real-Life Mathematician. Writers Club Press (2002)
Wirth, N.: Program development by stepwise refinement. Commun. ACM 14(4), 221–227 (1971)
Author information
Authors and Affiliations
Corresponding authors
Editor information
Editors and Affiliations
A Program (14) implemented in Python
A Program (14) implemented in Python
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
McIver, A., Morgan, C. (2020). Correctness by Construction for Probabilistic Programs. In: Margaria, T., Steffen, B. (eds) Leveraging Applications of Formal Methods, Verification and Validation: Verification Principles. ISoLA 2020. Lecture Notes in Computer Science(), vol 12476. Springer, Cham. https://doi.org/10.1007/978-3-030-61362-4_12
Download citation
DOI: https://doi.org/10.1007/978-3-030-61362-4_12
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-61361-7
Online ISBN: 978-3-030-61362-4
eBook Packages: Computer ScienceComputer Science (R0)