Termination Analysis Math Foundations of Computer Science.
-
Upload
ezra-daniels -
Category
Documents
-
view
232 -
download
1
Transcript of Termination Analysis Math Foundations of Computer Science.
Termination Analysis
Math Foundations of Computer Science
Topics
Definitional principle Soundness and termination Proving termination and measure
functions Well ordering and natural numbers Induction and termination Recursively defined data structures Undecidability of termination
Definitional Axiom(defunc f (x1 . . . xn)
:input-contract ic
:output-contract oc
body)
If the function f is admissible Add definitional axiom for f: ic [(f x1 . . . xn) =
body]Add contract theorem for f: ic oc
Definitional Principle(defunc f (x1 . . . xn)
:input-contract ic
:output-contract oc
body)The function f is admissible
f is a new function (no other axioms about f)xi’s are distinctbody is a term, possibly using f, but with no free
variables other than xi’s f is terminatingic oc is a theorembody contracts hold under assumption of ic
Soundness and Global Variables
(defunc f (x)
:input-contract t
:output-contract t
y)
The definitional axiom for f leads to unsound logic Substituting ((x 0) (y nil)) we get (f 0) = nilSubstituting ((x 0) (y t)) we get (f 0) = tWhich implies t = nil.
Soundness and Termination(defunc f(x)
:input-contract (natp x)
:output-contract (natp (f x))
(+ 1 (f x)))
The definitional axiom for f leads to unsound logic (natp x) x x+1 [property of natural numbers] (natp (f x)) (f x) (+ 1 (f x)) [instantiate above] (natp x) (f x) (+ 1 (f x)) [from ic oc] (natp x) (f x) = (+ 1 (f x)) [from def axiom] (natp x) nil [from p p = nil]
How do we Prove Termination
For recursive functions show that the “size” of the inputs get smaller and eventually must hit a base case
Size is defined to be a function to the natural numbers
Use the well ordering principle of the natural numbers to conclude that the number of recursive calls can not be infinite
Well Ordering of Natural Numbers
Any decreasing sequence of natural numbers is finite. I.E. it terminates
This implies that any non-empty set of natural numbers has a minimum element
Induction works as long as we have termination
sum
(defunc sum (n)
:input-contract (natp n)
:output-contract (integerp (sum n))
(if (equal n 0)
0
(+ n (sum (- n 1)))))
The input to the recursive call (- n 1) is smaller than the input to sum and the decreasing sequence of natural numbers n, n-1, n-2,... must terminate (equal 0) after a finite number of steps
If (integerp n) this would not be guaranteed
app
(defunc app (a b)
:input-contract (and (listp a) (listp b))
:output-contract (and (listp (app a b))
(if (endp a)
b
(cons (first a) (app (rest a) b))))
This is a terminating function. Define the size of l to be (len l). (len l) is a natural number (len (rest l)) < (len l) Implies len must eventually equal zero, i.e. l = nil
Measure Functions
Technically we measure size with a measure function
A measure function m for the function f m is an admissible function defined over the
parameters of f m has the same input contract as f The output contract for m is (natp (m … )) For every recursive call, m applied to the
arguments decreases, under the conditions that led to the recursive call.
Example Measure function(defunc app (a b)
:input-contract (and (listp a) (listp b))
:output-contract (and (listp (app a b))
(if (endp a)
b
(cons (first a) (app (rest a) b))))
(defunc m (x y)
:input-contract (and (listp x) (listp y))
:output-contract (natp (m x y))
(len x))
(< (m (rest x) y) (m x y)) since (< (len (rest x)) (len x))
Induction Depends on Termination
Show that the induction scheme for a non-terminating function can lead to unsoundness even when the definitional axiom does not
Alternative proof for the induction principle that shows “termination” front and center
General Induction Scheme
(defunc foo (x1 . . . xn)
:input-contract ic
:output-contract oc
(cond (t1 c1)
(t2 c2)
. . .
(tm cm)
(t cm+1)))
None of the ci’s should have ifs in them
If ci has a recursive call to foo, it is called a recursive case otherwise a base case.
General Induction Scheme Case1 = t1
Case2 = t2 t1
… Casei = ti t1 ti-1
… Casem+1 = t t1 tm
If ci is a recursive case with Ri calls to foo with the jth call, 1 j Ri, obtained by the substitution (foo x1 . . . xn)|sij
General Induction Scheme
To prove prove the followingic
[ic Casei] For all ci’s that are base cases
[ic Casei 1 i Ri |sij] For all ci’s that are recursive cases
Induction Scheme for Non-terminating Function
(defunc f (x)
:input-contract t
:output-contract t
(f x))
The definitional axiom, i.e. (f x) = (f x) is ok The induction scheme for f is unsound
(not t) nil t t t
Using this scheme we can derive for any In particular, we can derive nil
Induction Scheme over Naturals
Every terminating function gives rise to an induction scheme1. (not (natp n)) ⇒ 2. (natp n) (equal n 0) ∧ ⇒ 3. (natp n) (not (equal n 0)) ∧ ∧ |((n n-1)) ⇒
(1) and (2) are base cases and (3) is the induction hypothesis
More powerful than case analysis since you can use assume the induction hypothesis
Proof by Contradiction
Assume the conclusion is false and show that that leads to a contradiction.
1 n 1 n F
Proof. A B C A C B (show this is valid) Apply to (1 n) T
Why does Induction Work?
Suppose we prove the three cases in the induction scheme but is not valid.
Let S be the set of ACL2 objects for which is false. By (1) and (2), S is a set of natural numbers not equal to 0.
Since S is a set of natural numbers it has a smallest element s 0 for which |((n s)).
This implies by (3) that |((n s-1)) is false and s-1 S which is a contradiction
Non-terminating Function
(defunc f (x)
:input-contract t
:output-contract f
(f x))
The induction scheme associated with f leads to unsoundness (i.e. we can derive nil)
Termination for Recursively Defined Data Structures
For recursively defined data structures like lists, trees, expression trees, etc. we can use the number of constructors for the size Number of cons’s for lists Number of nodes for trees Number of +’s, -’s, *’s and /’s for expression
trees
23
Boolean Expressions
BExpr :=Constant: T|F [t | nil]Variable [symbol]Negation: BExpr [(not BExpr)]And: BExpr BExpr [(and BExpr BExpr)Or: BExpr Bexpr [(or BExpr BExpr)]
Predicate(defunc booleanexprp (expr):input-contract t:output-contract (booleanp (booleanexprp expr)) (cond ( (is-constant expr) t ) ( (is-variable expr) t ) ( (is-not expr) (booleanexprp (op1 expr)) ) ( (is-or expr) (and (booleanexprp (op1 expr)) (booleanexprp (op2 expr))) ) ( (is-and expr) (and (booleanexprp (op1 expr)) (booleanexprp (op2 expr))) ) ( t nil) ))
Evaluation(defunc bool-eval (expr env) :input-contract (and (booleanexprp expr) (environmentp env) (all-variables-defined expr env)) :output-contract (booleanp (bool-eval expr env))
(cond ( (is-constant expr) expr ) ( (is-variable expr) (lookup expr env) ) ( (is-not expr) (not (bool-eval (op1 expr) env)) ) ( (is-or expr) (or (bool-eval (op1 expr) env) (bool-eval (op2 expr) env)) ) ( (is-and expr) (and (bool-eval (op1 expr) env) (bool-eval (op2 expr) env)) ) ))
Measure Function(defun m (expr env) :input-contract (and (booleanexprp expr) (environmentp env) (all-variables-defined expr env)) :output-contract (natp (m expr env))
(cond
( (is-constant expr) 0 )
( (is-variable expr) 0 )
( (is-not expr) (+ 1 (m (op expr) env)) )
( (is-or expr) (+ 1 (m (op1 expr) env) (m (op2 expr) env)) )
( (is-and expr) (+ 1 (m (op1 expr) env) (m (op2 expr) env)) )
))
Halting Problem
We can prove that many functions terminate
In general determining if an arbitrary function will terminate is undecidable
What about the following function?(defun 3np1 (n)
(cond
((equal n 1) 1 )
((evenp n) (3np1 (/ n 2)) )
((oddp n) (3np1 (+ (* 3 n) 1)) )
))