Verifikation reaktiver Systeme - Universität Kaiserslautern

230
To complete the proof of the parity checking device, the two parts of the
verification are finally combined:
(* goal is ‘‘!inp out. PARITY_IMP(inp,out) ==> !t. out t = PARITY t inp‘‘ *)
e(RW_TAC std_ss []);
e(MATCH_MP_TAC UNIQUELESS_LEMMA);
e(PROVE_TAC[PARITY_LEMMA]);
val PARITY_CORRECT = top_thm();
Certainly, this examples does not need a theorem prover in order to be verified.
Due to the small number of states and the lack of arithmetic components,
other verification methods would be more appropriate. But, it shows the basics
needed to do theorem proving, whereas the next example shows the power of
the theorem proving method.
3.2 Binary Greatest Common Divisor
The binary method to determine the greatest common divisor of two numbers
has been discovered by Roland Silver and John Terzian in 1962. They have
never published it, but soon, the method became well known in computer science
[8]. It only needs three operations: shifting, subtraction and testing whether a
number is odd or even. Other, more complicated operations (like division) are
not required. Therefore, it is primarily suited to binary arithmetic. It is based
on the following three facts:
– If u is even, and v is even: gcd(u, v) =2· gcd( u/2 ,v/2)
– If u is even, and v is odd: gcd(u, v) =gcd(u/2 ,v)
– If u is greater than v: gcd(u, v) =gcd(u − v, v)
Figure 4 shows a schematic that implements the algorithm: Initially, the
registers x and y store the input values. Like the Euclidean algorithm, the gcd
is calculated in several steps. In each step, one of the three facts mentioned
above are used. To verify this component, two things should be shown: First,
the result should be eventually computed, and this value should be really the
greatest common divisor of the inputs. While the first point is obvious (Consider
the sum u+v as variant.), the partial correctness can be shown using the following
invariant:
– Invariant: Letu and v be the numbers whose greatest common divisor is
calculated, and let x, y and k be the values of the respective registers. In
each step, gcd(u, v) =gcd(x, y) · 2 k holds.
(* BGCD_EVEN_EVEN |- !x y. EVEN x /\ EVEN y
==> (gcd x y = 2*gcd (x DIV 2) (y DIV 2)) *)
(* BGCD_EVEN_ODD |- !x y. EVEN x /\ ODD y
==> (gcd x y = gcd (x DIV 2) y) *)
(* BGCD_ODD_EVEN |- !x y. ODD x /\ EVEN y
==> (gcd x y = gcd x (y DIV 2)) *)