Example: systematic construction of an integer square
root program
W. Drabent
13 May 2004
We want to construct a program computing the integer square root of a
non-negative integer n. In other words, the program has to be totally correct
w.r.t. precondition P = n ≥ 0 and postcondition Q = (x2 ≤ n < (x + 1)2 ).
(The latter also says that x will contain the result). My intuition tells me
that we should try to use a loop. So a skeleton of our program is
{ P } ?? ; while b do ?? { ⇓ Q }.
(I will not write ⇓ below, but remember – we are dealing with total correctness).
The most important thing in a loop is its invariant. A typical way of
obtaining a loop invariant is to weaken the postcondition. It should be easy
to obtain the invariant from the precondition and the postcondition from the
invariant. In the previous example we constructed the invariant by removing
n < (x + 1)2 from Q. Here we introduce a new variable y and take
I = ( x2 ≤ n < y 2 ∧ 0 ≤ x < y, )
as the invariant.1 The intuition behind I is that the number we are going
to compute is somewhere between x and y.
It is good to remember the proof rule for while which we use:
{b ∧ I ∧ t=z } S {⇓I ∧ t<z }
{ I } while b do S { ⇓ ¬b ∧ I }
if I ⇒ t ≥ 0
(where t – the bound function – is an integer expression and z is a variable
that does not appear in P, b, t or S).
Q, I and the proof rule for while suggest the choice of b, as it is necessary
that ¬b ∧ I implies Q. We achieve this by taking
b = (y 6= x+1).
P does non imply I, so the loop requires initialization. We are looking
for a statement S0 satisfying { P } S0 { I }. It is easy to check that S0 =
(x := 0; y := n+1) does the work.
1
Strictly speaking, I is not weaker than Q (in other words, Q does not imply I). We
first strengthened Q by introducing y, obtaining Q1 = (x2 ≤ n < y 2 ∧ y = x + 1). This
implies 0 ≤ x < y, so Q1 is equivalent to Q1 ∧ 0 ≤ x < y. Then we weakened the last
formula by removing y = x + 1.
1
This is the current version of our program
{ P }(x := 0; y := n+1); { I } while b do
(1)
({ b| ∧ I {z
∧ t = z} } S { I ∧ t < z }) { Q }.
P0
Now we are looking for a suitable bound function t. It should be ≥ 0 and
it should decrease at each repetition of the loop. Our intention is that the
loop shrinks the interval [x..y) containing the solution until the solution is
found. So a good candidate for t is the size of this interval:
t = y − x.
Note that the invariant indeed implies t ≥ 0.
It remains to construct the loop body S satisfying the stated pre- and
postcondition. S has to decrease t. We want to be efficient, so we use binary
search. The future solution is somewhere between x and y. We halve the
interval [x..y) and choose that half that preserves the invariant (in other
words, contains the solution).
As there are two cases, S is likely to be a conditional statement. Halving
will be done by setting either x or y to the midpoint (x+y)÷2 (where ÷ is
the integer division, e.g. 7 ÷ 2 = 3). We abbreviate (x+y)÷2 by A. Together
we have
S = if b0 then y := A else x
{z A}
| :=
| {z }
S2
S1
The postcondition for both S1 and S2 is I ∧ t<z. The axiom [ass] gives
2
{x
≤ n < A2 ∧ 0 ≤{zx < A ∧ A−x < z} } y := A { I ∧ t<z }
|
(2)
R1
2
2
{ A ≤ n < y ∧ 0 ≤ A < y ∧ y−A < z } x := A { I ∧ t<z }
|
{z
}
R2
(3)
We want to apply the rule [if], but this requires the preconditions to be of
the form b0 ∧ R and ¬b0 ∧ R. So we are looking for such conditions implying,
respectively, R1 and R2 . A good candidate for b0 is n < A2 , as n < A2 occurs
in R1 and A2 ≤ n occurs in R2 ). Taking b0 = n < A2 and
R = x2 ≤ n < y 2 ∧ 0 ≤ x < A < y ∧ A−x < z ∧ y−A < z
we see that indeed b0 ∧ R implies R1 and ¬b0 ∧ R implies R2 .
From (2), (3) by rule [cons] we obtain
{ b0 ∧ R } y := A { I ∧ t<z }
{ ¬b0 ∧ R } x := A { I ∧ t<z }
2
(4)
(5)
and then
{ R } S { I ∧ t<z }
We are almost ready, but the required precondition for S is P0 (see (1)). We
will show that P0 implies R, then applying [cons] gives
{ P0 } S { I ∧ t<z }
and completes the construction of the program (1) and proof of its correctness.
Back to the unproven implication P0 ⇒ R. Remember that
P0 = y 6= x+1 ∧ x2 ≤ n < y 2 ∧ 0 ≤ x < y ∧ y−x = z.
Compare this with R. You see that it remains to show that P0 implies
x < A < y and A−x < z ∧ y−A < z. (This says that both parts [x..A) and
[A..y), into which we divide the interval [x..y), are smaller than [x..y), whose
length is z. This sounds obvious but, for instance, if y = x + 1 then A = x).
From x < y and y 6= x+1 we have x+2 ≤ y. This implies2 x < A < y.
From this and y − x = z we obtain3 the required inequalities.
END OF THE PROOF & CONSTRUCTION
Our work can be summarized in the following proof outline.
{n ≥ 0}
x := 0; y := n+1;
{ invariant: I }
{ boundfunction: y − x }
while y 6= x + 1 do ( { b ∧ I ∧ y−x = z }
|
{z
b
}
{ x2 ≤ n < (x + 1)2 }
|
{z
P0
}
{R}
if n < A2 then { n<A2 ∧ R }
{ R1 }
y := A
else { ¬(n<A2 ) ∧ R }
{ R2 }
x := A
{ I ∧ y−x < z } )
2
How? x + x + 2 ≤ x + y, hence x + 1 ≤ (x + y) ÷ 2 = A. Similarly, x + y ≤ y − 2 + y,
hence A ≤ y − 1.
3
How? From A < y we have A − x < y − x = z. From x < A we have y − A < y − x = z.
3