Let’s verify this with Why3

Abstract

We present solutions to the three challenges of the VerifyThis competition held at the 18th FM symposium in August 2012. These solutions use the Why3 environment for deductive program verification.

Appendix: Relevant theories from the Why3 standard library

In this Appendix, we provide details on relevant parts of the Why3 standard library, notably those used in the first challenge. The full contents of that library is available online at http://why3.lri.fr/stdlib-0.81/.

Fig. 22

Theory of polymorphic, purely applicative maps

1.1 A.1 Library map

In Why3, arrays are modeled as references to purely applicative maps. Such maps are specified in the theory presented in Fig. 22. These maps are parametric in both the type of their indexes and of their values, so the Why3 type for such maps is a polymorphic type . The main functions operating on maps are and , that, respectively, modify a map at a given index (purely applicatively, that is by returning a new map) and read a map at a given index. Both functions are axiomatized by and . This is the classical theory of arrays in the context of satisfiability modulo theories. The additional operation returns a constant map.

Fig. 23

Theory of sorted maps

Fig. 24

Theory of map permutations (excerpt)

Fig. 25

Theory of injective and surjective maps

Theory (Fig. 23) specifies what it means for a map to be sorted in increasing order. This notion is restricted to maps indexed by integers. The theory is written with a type parameter and a predicate parameter , so that it can be reused, by cloning it, for an arbitrary order relation.

Fig. 26

Module (excerpt)

Theory (Fig. 24) specifies what it means for two maps to be permutations of each other, that is, to contain the same elements with the same number of occurrences. This is restricted to maps indexed by integers. Predicate ( $m_1\, m_2\, l\, u$) holds when map segments $m_1[l\ldots u-1]$ and $m_2[l\ldots u-1]$ are permutations of each other. This is defined as the smallest equivalence relation containing transpositions of elements.

Theory (Fig. 25) defines several notions for maps on the domain $0\ldots n-1$ for some integer $n$: being injective, being a surjection into $0\ldots n-1$, and ranging into $0\ldots n-1$. Lemma is the classical mathematical result, more or less equivalent to the pigeon-hole principle, saying that any injection that ranges into $0\ldots n-1$ is also surjective. This result is used to prove the first challenge. This is not the first time we had to use such a result to prove a program: we already used it to prove the challenge Sparse Arrays from the VACID-0 benchmarks [12].

1.2 A.2 Module Array

Figure 26 contains an excerpt of the Why3 module that defines arrays. This module is discussed in Sect. 2.2. The full contents of that library is available online at http://why3.lri.fr/stdlib-0.81/array.mlw.html.