specification and verification in introductory computer science
Download
Skip this Video
Download Presentation
Specification and Verification in Introductory Computer Science

Loading in 2 Seconds...

play fullscreen
1 / 38

Specification and Verification in Introductory Computer Science - PowerPoint PPT Presentation


  • 117 Views
  • Uploaded on

Specification and Verification in Introductory Computer Science. Frank Pfenning Carnegie Mellon University MSR-CMU Center for Computational Thinking May 14, 2012 www.cs.cmu.edu /~fp/courses/ 15122 c0.typesafety.net

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about ' Specification and Verification in Introductory Computer Science' - sonel


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
specification and verification in introductory computer science

Specification and Verification in Introductory Computer Science

Frank Pfenning

Carnegie Mellon University

MSR-CMU Center for Computational Thinking

May 14, 2012

www.cs.cmu.edu/~fp/courses/15122

c0.typesafety.net

Principal Contributors: Rob Arnold, Tom Cortina, Ian Gillis, Jason Koenig, William Lovas, Karl Naden, Rob Simmons, JakobUecker

MSR Collaborators: RustanLeino, NikolajBjørner

MS Guest Speaker: Jason Yang (Windows team)

MSR Inspiration: Manuvir Das, Peter Lee

outline
Outline
  • Background and guiding principles
  • Role in the curriculum
  • Learning goals
  • C0 Language
  • (Lecture sample)
  • Research plans

MSR-CMU Center for Computational Thinking

background
Background
  • 15-122 Principles of Imperative Computation
  • Part of a major core CS curriculum revision
    • 15-110/112 Principles of Computing/Programming
    • 15-150 Principles of Functional Programming
    • 15-210 Parallel & Sequential Data Structs. & Algs.
    • 15-214 Software System Construction
  • Still under development
    • Pilot in Fall 2010, every semester since then
    • Now taught ~630 students, majors & non-majors
    • Adoption at Tübingen, Germany, Spring 2012

MSR-CMU Center for Computational Thinking

core curriculum chart
Core Curriculum Chart

15-110 Principles

of Computing

15-112 Fundamentals

of Programming

21-127 Concepts

of Modern Math

15-122 Principles of

Imperative Computation

15-150 Principles of

Functional Programming

15-213 Computer

Systems

15-210 Seq. & Par.

Data Structs. & Algs.

15-251 Great Ideas

of Theoretical CS

15-214 Software

System Construction

MSR-CMU Center for Computational Thinking

guiding principles
Guiding Principles
  • Computational thinking and programming must go hand-in-hand
  • Algorithm and data structure design, analysis, and implementation is an intellectual activity
  • We build abstractions from an understanding of the concrete
  • Rigorous types, invariants, specifications, interfaces are crucial

MSR-CMU Center for Computational Thinking

role in the new curriculum
Role in the New Curriculum
  • Precondition: some programming experience
    • Self-taught or high-school programming or 15-112
    • Python and Java most common
    • Broad rather than deep; diverse
  • Postcondition: preparation for 15-2xx courses
    • 15-210: Par. & Seq. Data Structs. & Algs.
    • 15-213: Computer Systems
    • 15-214: Software System Construction

MSR-CMU Center for Computational Thinking

learning goals
Learning Goals
  • Computational thinking
  • Programming skills
  • Specific data structures and algorithms
  • Application contexts

MSR-CMU Center for Computational Thinking

computational thinking
Computational Thinking
  • Algorithmic concepts vs. code
  • Abstraction and interfaces
  • Specification vs. implementation
  • Pre- and post-conditions, loop invariants
  • Data structure invariants
  • Logical and operational reasoning
  • Asymptotic complexity and practical efficiency
  • Programs as data
  • Exploiting randomness

MSR-CMU Center for Computational Thinking

programming skills
Programming Skills
  • Deliberate programming
  • Understand static and dynamic semantics
  • Develop, test, debug, rewrite, refine
  • Invariants, specifications
  • Using and designing APIs
  • Use and implement data structures
    • Emphasis on mutable state (“RAM model”)
  • Render algorithms into correct code
    • Emphasis on imperative programming

MSR-CMU Center for Computational Thinking

some algorithmic concepts
Some Algorithmic Concepts
  • Asymptotic analysis
    • Sequential computation
    • Time and space
    • Worst-case vs. average-case
    • Amortized analysis
    • Common classes: O(n), O(n*log(n)), O(n2), O(2n)
  • Divide and conquer
  • Self-adjusting data structures
  • Randomness
  • Sharing

MSR-CMU Center for Computational Thinking

specific alg s and data struct s
Specific Alg’s and Data Struct’s
  • Binary search
  • Sorting (selection sort, mergesort)
  • Stacks and queues
  • Hash tables
  • Priority queues (heaps)
  • Binary search trees (red/black, randomized)
  • Tries
  • Binary decision diagrams (SAT, validity)
  • Graph traversal (depth-first, breadth-first)
  • Minimum spanning trees (Prim’s alg., Kruskal’s alg.)
  • Union-find

MSR-CMU Center for Computational Thinking

application contexts
Application Contexts
  • See algorithms in context of use
  • Engage students’ interest
  • Assignments (all written+programming)
    • Image manipulation
    • Text processing (Shakespeare word freq’s)
    • Grammars and parsing
    • Maze search
    • Huffman codes
    • Puzzle solving (Lights Out)
    • Implementing a virtual machine (C0VM)

MSR-CMU Center for Computational Thinking

language
Language
  • Weeks 1-10: Use C0, a small safe subset of C, with a layer to express contracts
    • Garbage collection (malloc/free)
    • Fixed range modular integer arithmetic
    • Language unambiguously defined
    • Contractsas boolean expressions
  • Weeks 11-14: Transition to C
    • Exploit positive habits, assertion macros
    • Pitfalls and idiosyncrasies of C

MSR-CMU Center for Computational Thinking

type structure
Type Structure
  • t = int | bool | structs | t* | t[]
  • Distinguish pointers and arrays
  • Distinguish ints and booleans
  • Structs and arrays live in memory; ints, bools, and pointers in variables
  • Strings and chars as abstract types

MSR-CMU Center for Computational Thinking

control structure
Control Structure
  • Variables and assignment
  • Separation of expressions and statements
  • Conditionals, while, and for loops
  • Functions
  • Other considerations
    • Minimal operator overloading
    • No implicit type conversions
    • Initialization

MSR-CMU Center for Computational Thinking

rationale for c0
Rationale for C0
  • Imperative implementations of simple algorithms are natural in this fragment
  • Simplicity permits effective analysis
    • Proving invariants, sound reasoning
  • Concentrate on principles first, C later
  • Industrial use of assertions (SAL, Spec#)
    • Guest lecture by J. Yang from MS Windows team

MSR-CMU Center for Computational Thinking

lecture example
Lecture Example
  • In actual lecture use blackboard, plus laptop for writing code
  • Recurring theme

Computational Thinking

Data Structures

and Algorithms

Programming

MSR-CMU Center for Computational Thinking

lecture 13 priority queues lecture 14 restoring invariants
Lecture 13: Priority QueuesLecture 14: Restoring Invariants

Restoring Invariants

Priority Queues

Heaps

Trees as Arrays

MSR-CMU Center for Computational Thinking

heap interface
Heap Interface

typedefstruct heap* heap;

boolheap_empty(heap H); /* is H empty? */

heap heap_new(int limit) /* create new heap */

//@requires limit > 0;

//@ensures heap_empty(\result);

;

void heap_insert(heap H, intx); /* insert x into H */

intheap_min(heap H) /* find minimum */

//@requires !heap_empty(H);

;

intheap_delmin(heap H) /* delete minimum */

//@requires !heap_empty(H);

;

MSR-CMU Center for Computational Thinking

checking heap invariants
Checking Heap Invariants

struct heap {

int limit;

int next;

int[] heap;

};

boolis_heap(heap H)

//@requires H != NULL && \length(H->heap) == H->limit;

{

if (!(1 <= H->next && H->next <= H->limit)) return false;

for (inti= 2; i < H->next; i++)

if (!(H->heap[i/2] <= H->heap[i])) return false;

return true;

}

MSR-CMU Center for Computational Thinking

heap insertion
Heap Insertion

void heap_insert(heap H, intx)

//@requires is_heap(H);

//@requires !heap_full(H);

//@ensures is_heap(H);

{

H->heap[H->next] = x;

H->next++;

sift_up(H, H->next-1);

}

MSR-CMU Center for Computational Thinking

preliminary course assessment
Preliminary Course Assessment
  • First four course instances successful
    • Covered envisioned material and more
    • Excellent exam and assignment performance
    • Lecture notes
    • Positive student feedback
  • Interesting programming assignments
    • Using our C0 compiler weeks 1-10, gcc thereafter
    • Linked with C/C++ libraries

MSR-CMU Center for Computational Thinking

some course tools
Some Course Tools
  • C0 to C compiler (cc0), front end v3
  • C0 interpreter and debugger (new Su 2012)
  • C0 tutorial
  • C0 language reference
  • Binaries for Windows, Linux, Mac OS X
  • C0VM for last assignment

MSR-CMU Center for Computational Thinking

contracts
Contracts
  • Currently, contracts are checked dynamically if compiled with cc0 -d
  • Contracts are enormously useful
    • Bridge the gap from algorithm to implementation
    • Express programmer intent precisely
    • Catch bugs during dynamic checking
    • Debugging aid (early failure, localization)
  • Not easy to learn effective use of contracts

MSR-CMU Center for Computational Thinking

exploiting contracts further
Exploiting Contracts Further
  • Ongoing research
  • Contracts could be even more useful
    • Static verification (MSR: Daphne, Boogie, Z3)
    • Counterexample, test generation (MSR: Pex)
    • Autograding of code and contracts
  • The educational setting creates unique challenges and opportunities
    • Explainable static analysis (null ptrs, array bounds)
    • Pedagogically sound design
    • Diversity of student programmers

MSR-CMU Center for Computational Thinking

summary
Summary
  • 15-122 Principles of Imperative Computation
  • Freshmen-level course emphasizing the interplay between computational thinking, algorithms, and programming in simple setting
  • C0, a small safe subset of C, with contracts
  • Contracts pervasive, checked only dynamically
  • Research question: can we use static analysis and theorem proving to aid in achievingstudent learning goals?
  • MSR collaborators: RustanLeino, NikolajBjørner
  • Visits: F. Pfenning, J. Yang, R. Leino,K. Naden, J. Koenig,

MSR-CMU Center for Computational Thinking

priority queues
Priority Queues
  • Generalizes stacks and queues
  • Abstract interface
    • Create a new priority queue
    • Insert an element
    • Remove a minimal element

MSR-CMU Center for Computational Thinking

heaps
Heaps
  • Alternative 1: unsorted array
    • Insert O(1), delete min O(n)
  • Alternative 2: sorted array
    • Insert O(n), delete min O(1)
  • Alternative 3: heap
    • Partially sorted!

MSR-CMU Center for Computational Thinking

heaps1
Heaps
  • A heap represents a priority queue as a binary tree with two invariants
  • Shape:
    • Tree is complete (missing nodes bottom-right)
  • Order:
    • Each interior node is greater-or-equal to its parent
    • OR: each node is less-or-equal to all its children
  • Guarantee a minimal element is at root!

MSR-CMU Center for Computational Thinking

shape invariant
Shape Invariant

1 node

2 nodes

3 nodes

4 nodes

6 nodes

7 nodes

5 nodes

MSR-CMU Center for Computational Thinking

inserting into heap
Inserting into Heap

2

2

4

4

3

3

  • By shape invariant, know where new element should go
  • Now have to restore ordering invariant

9

9

7

7

8

8

1

MSR-CMU Center for Computational Thinking

sifting up
Sifting Up

2

2

4

4

1

3

  • Order invariant satisfied, except between new node and its parent (“looking up”)
  • Swapping with parent will restore locally
  • Parent may now violate invariant

9

9

7

7

8

8

1

3

MSR-CMU Center for Computational Thinking

invariant restored
Invariant Restored

1

2

4

4

2

1

  • When reaching root (no parent!), ordering invariant restored everywhere
  • We have a valid heap!

9

9

7

7

8

8

3

3

MSR-CMU Center for Computational Thinking

analysis
Analysis
  • Insert requires O(log(n)) swaps in worst case
  • Logarithmic thinking: complete binary tree with n elements has 1+log(n) levels
  • Delete min also O(log(n)), omitted here

MSR-CMU Center for Computational Thinking

heaps as arrays
Heaps as Arrays

1

1

10

2

11

3

  • Exploit shape invariant
  • Binary numbering system for nodes, root is 1
  • Left child is n0 = 2*n; right child is n1 = 2*n+1
  • Parent is at n/2; 0 is unused

100

4

101

5

110

6

111

7

MSR-CMU Center for Computational Thinking

creating a heap
Creating a Heap

heap heap_new(int limit)

//@requires 1 <= limit;

//@ensures is_heap(\result) && heap_empty(\result);

{

heap H = alloc(struct heap);

H->limit = limit;

H->next = 1;

H->heap = alloc_array(int, limit);

return H;

}

  • Pre/postconditions are easy to specify and reason about
  • How to automate?

MSR-CMU Center for Computational Thinking

almost a heap
Almost a Heap

boolis_heap_except_up(heap H, intn)

//@requires H != NULL && \length(H->heap) == H->limit;

{ inti;

if (!(1 <= H->next && H->next <= H->limit)) return false;

for (i = 2; i < H->next; i++)

if (!(i == n || H->heap[i/2] <= H->heap[i]))

return false;

return true;

}

// is_heap_except_up(H, 1) == is_heap(H);

  • Captures permitted violation precisely
  • Observation at end for postcondition of sift_up

MSR-CMU Center for Computational Thinking

sifting up restoring invariant
Sifting Up / Restoring Invariant

void sift_up(heap H, intn)

//@requires 1 <= n && n < H->limit;

//@requires is_heap_except_up(H, n);

//@ensures is_heap(H);

{ inti = n;

while (i > 1)

//@loop_invariantis_heap_except_up(H, i);

{

if (H->heap[i/2] <= H->heap[i]) return;

swap(H->heap, i/2, i);

i = i/2;

}

//@assert i == 1;

//@assert is_heap_except_up(H, 1);

return;

}

MSR-CMU Center for Computational Thinking

ad