Specification and verification in introductory computer science
This presentation is the property of its rightful owner.
Sponsored Links
1 / 38

Specification and Verification in Introductory Computer Science PowerPoint PPT Presentation


  • 98 Views
  • Uploaded on
  • Presentation posted in: General

Specification and Verification in Introductory Computer Science. Frank Pfenning Carnegie Mellon University MSR-CMU Center for Computational Thinking May 14, 2012 www.cs.cmu.edu /~fp/courses/ 15122 c0.typesafety.net

Download Presentation

Specification and Verification in Introductory Computer Science

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Specification and verification in introductory computer science

Specification and Verification in Introductory Computer Science

Frank Pfenning

Carnegie Mellon University

MSR-CMU Center for Computational Thinking

May 14, 2012

www.cs.cmu.edu/~fp/courses/15122

c0.typesafety.net

Principal Contributors: Rob Arnold, Tom Cortina, Ian Gillis, Jason Koenig, William Lovas, Karl Naden, Rob Simmons, JakobUecker

MSR Collaborators: RustanLeino, NikolajBjørner

MS Guest Speaker: Jason Yang (Windows team)

MSR Inspiration: Manuvir Das, Peter Lee


Outline

Outline

  • Background and guiding principles

  • Role in the curriculum

  • Learning goals

  • C0 Language

  • (Lecture sample)

  • Research plans

MSR-CMU Center for Computational Thinking


Background

Background

  • 15-122 Principles of Imperative Computation

  • Part of a major core CS curriculum revision

    • 15-110/112 Principles of Computing/Programming

    • 15-150 Principles of Functional Programming

    • 15-210 Parallel & Sequential Data Structs. & Algs.

    • 15-214 Software System Construction

  • Still under development

    • Pilot in Fall 2010, every semester since then

    • Now taught ~630 students, majors & non-majors

    • Adoption at Tübingen, Germany, Spring 2012

MSR-CMU Center for Computational Thinking


Core curriculum chart

Core Curriculum Chart

15-110 Principles

of Computing

15-112 Fundamentals

of Programming

21-127 Concepts

of Modern Math

15-122 Principles of

Imperative Computation

15-150 Principles of

Functional Programming

15-213 Computer

Systems

15-210 Seq. & Par.

Data Structs. & Algs.

15-251 Great Ideas

of Theoretical CS

15-214 Software

System Construction

MSR-CMU Center for Computational Thinking


Guiding principles

Guiding Principles

  • Computational thinking and programming must go hand-in-hand

  • Algorithm and data structure design, analysis, and implementation is an intellectual activity

  • We build abstractions from an understanding of the concrete

  • Rigorous types, invariants, specifications, interfaces are crucial

MSR-CMU Center for Computational Thinking


Role in the new curriculum

Role in the New Curriculum

  • Precondition: some programming experience

    • Self-taught or high-school programming or 15-112

    • Python and Java most common

    • Broad rather than deep; diverse

  • Postcondition: preparation for 15-2xx courses

    • 15-210: Par. & Seq. Data Structs. & Algs.

    • 15-213: Computer Systems

    • 15-214: Software System Construction

MSR-CMU Center for Computational Thinking


Learning goals

Learning Goals

  • Computational thinking

  • Programming skills

  • Specific data structures and algorithms

  • Application contexts

MSR-CMU Center for Computational Thinking


Computational thinking

Computational Thinking

  • Algorithmic concepts vs. code

  • Abstraction and interfaces

  • Specification vs. implementation

  • Pre- and post-conditions, loop invariants

  • Data structure invariants

  • Logical and operational reasoning

  • Asymptotic complexity and practical efficiency

  • Programs as data

  • Exploiting randomness

MSR-CMU Center for Computational Thinking


Programming skills

Programming Skills

  • Deliberate programming

  • Understand static and dynamic semantics

  • Develop, test, debug, rewrite, refine

  • Invariants, specifications

  • Using and designing APIs

  • Use and implement data structures

    • Emphasis on mutable state (“RAM model”)

  • Render algorithms into correct code

    • Emphasis on imperative programming

MSR-CMU Center for Computational Thinking


Some algorithmic concepts

Some Algorithmic Concepts

  • Asymptotic analysis

    • Sequential computation

    • Time and space

    • Worst-case vs. average-case

    • Amortized analysis

    • Common classes: O(n), O(n*log(n)), O(n2), O(2n)

  • Divide and conquer

  • Self-adjusting data structures

  • Randomness

  • Sharing

MSR-CMU Center for Computational Thinking


Specific alg s and data struct s

Specific Alg’s and Data Struct’s

  • Binary search

  • Sorting (selection sort, mergesort)

  • Stacks and queues

  • Hash tables

  • Priority queues (heaps)

  • Binary search trees (red/black, randomized)

  • Tries

  • Binary decision diagrams (SAT, validity)

  • Graph traversal (depth-first, breadth-first)

  • Minimum spanning trees (Prim’s alg., Kruskal’s alg.)

  • Union-find

MSR-CMU Center for Computational Thinking


Application contexts

Application Contexts

  • See algorithms in context of use

  • Engage students’ interest

  • Assignments (all written+programming)

    • Image manipulation

    • Text processing (Shakespeare word freq’s)

    • Grammars and parsing

    • Maze search

    • Huffman codes

    • Puzzle solving (Lights Out)

    • Implementing a virtual machine (C0VM)

MSR-CMU Center for Computational Thinking


Language

Language

  • Weeks 1-10: Use C0, a small safe subset of C, with a layer to express contracts

    • Garbage collection (malloc/free)

    • Fixed range modular integer arithmetic

    • Language unambiguously defined

    • Contractsas boolean expressions

  • Weeks 11-14: Transition to C

    • Exploit positive habits, assertion macros

    • Pitfalls and idiosyncrasies of C

MSR-CMU Center for Computational Thinking


Type structure

Type Structure

  • t = int | bool | structs | t* | t[]

  • Distinguish pointers and arrays

  • Distinguish ints and booleans

  • Structs and arrays live in memory; ints, bools, and pointers in variables

  • Strings and chars as abstract types

MSR-CMU Center for Computational Thinking


Control structure

Control Structure

  • Variables and assignment

  • Separation of expressions and statements

  • Conditionals, while, and for loops

  • Functions

  • Other considerations

    • Minimal operator overloading

    • No implicit type conversions

    • Initialization

MSR-CMU Center for Computational Thinking


Rationale for c0

Rationale for C0

  • Imperative implementations of simple algorithms are natural in this fragment

  • Simplicity permits effective analysis

    • Proving invariants, sound reasoning

  • Concentrate on principles first, C later

  • Industrial use of assertions (SAL, Spec#)

    • Guest lecture by J. Yang from MS Windows team

MSR-CMU Center for Computational Thinking


Lecture example

Lecture Example

  • In actual lecture use blackboard, plus laptop for writing code

  • Recurring theme

Computational Thinking

Data Structures

and Algorithms

Programming

MSR-CMU Center for Computational Thinking


Lecture 13 priority queues lecture 14 restoring invariants

Lecture 13: Priority QueuesLecture 14: Restoring Invariants

Restoring Invariants

Priority Queues

Heaps

Trees as Arrays

MSR-CMU Center for Computational Thinking


Heap interface

Heap Interface

typedefstruct heap* heap;

boolheap_empty(heap H); /* is H empty? */

heap heap_new(int limit) /* create new heap */

[email protected] limit > 0;

[email protected] heap_empty(\result);

;

void heap_insert(heap H, intx); /* insert x into H */

intheap_min(heap H) /* find minimum */

[email protected] !heap_empty(H);

;

intheap_delmin(heap H) /* delete minimum */

[email protected] !heap_empty(H);

;

MSR-CMU Center for Computational Thinking


Checking heap invariants

Checking Heap Invariants

struct heap {

int limit;

int next;

int[] heap;

};

boolis_heap(heap H)

[email protected] H != NULL && \length(H->heap) == H->limit;

{

if (!(1 <= H->next && H->next <= H->limit)) return false;

for (inti= 2; i < H->next; i++)

if (!(H->heap[i/2] <= H->heap[i])) return false;

return true;

}

MSR-CMU Center for Computational Thinking


Heap insertion

Heap Insertion

void heap_insert(heap H, intx)

[email protected] is_heap(H);

[email protected] !heap_full(H);

[email protected] is_heap(H);

{

H->heap[H->next] = x;

H->next++;

sift_up(H, H->next-1);

}

MSR-CMU Center for Computational Thinking


Preliminary course assessment

Preliminary Course Assessment

  • First four course instances successful

    • Covered envisioned material and more

    • Excellent exam and assignment performance

    • Lecture notes

    • Positive student feedback

  • Interesting programming assignments

    • Using our C0 compiler weeks 1-10, gcc thereafter

    • Linked with C/C++ libraries

MSR-CMU Center for Computational Thinking


Some course tools

Some Course Tools

  • C0 to C compiler (cc0), front end v3

  • C0 interpreter and debugger (new Su 2012)

  • C0 tutorial

  • C0 language reference

  • Binaries for Windows, Linux, Mac OS X

  • C0VM for last assignment

MSR-CMU Center for Computational Thinking


Contracts

Contracts

  • Currently, contracts are checked dynamically if compiled with cc0 -d

  • Contracts are enormously useful

    • Bridge the gap from algorithm to implementation

    • Express programmer intent precisely

    • Catch bugs during dynamic checking

    • Debugging aid (early failure, localization)

  • Not easy to learn effective use of contracts

MSR-CMU Center for Computational Thinking


Exploiting contracts further

Exploiting Contracts Further

  • Ongoing research

  • Contracts could be even more useful

    • Static verification (MSR: Daphne, Boogie, Z3)

    • Counterexample, test generation (MSR: Pex)

    • Autograding of code and contracts

  • The educational setting creates unique challenges and opportunities

    • Explainable static analysis (null ptrs, array bounds)

    • Pedagogically sound design

    • Diversity of student programmers

MSR-CMU Center for Computational Thinking


Summary

Summary

  • 15-122 Principles of Imperative Computation

  • Freshmen-level course emphasizing the interplay between computational thinking, algorithms, and programming in simple setting

  • C0, a small safe subset of C, with contracts

  • Contracts pervasive, checked only dynamically

  • Research question: can we use static analysis and theorem proving to aid in achievingstudent learning goals?

  • MSR collaborators: RustanLeino, NikolajBjørner

  • Visits: F. Pfenning, J. Yang, R. Leino,K. Naden, J. Koenig,

MSR-CMU Center for Computational Thinking


Priority queues

Priority Queues

  • Generalizes stacks and queues

  • Abstract interface

    • Create a new priority queue

    • Insert an element

    • Remove a minimal element

MSR-CMU Center for Computational Thinking


Heaps

Heaps

  • Alternative 1: unsorted array

    • Insert O(1), delete min O(n)

  • Alternative 2: sorted array

    • Insert O(n), delete min O(1)

  • Alternative 3: heap

    • Partially sorted!

MSR-CMU Center for Computational Thinking


Heaps1

Heaps

  • A heap represents a priority queue as a binary tree with two invariants

  • Shape:

    • Tree is complete (missing nodes bottom-right)

  • Order:

    • Each interior node is greater-or-equal to its parent

    • OR: each node is less-or-equal to all its children

  • Guarantee a minimal element is at root!

MSR-CMU Center for Computational Thinking


Shape invariant

Shape Invariant

1 node

2 nodes

3 nodes

4 nodes

6 nodes

7 nodes

5 nodes

MSR-CMU Center for Computational Thinking


Inserting into heap

Inserting into Heap

2

2

4

4

3

3

  • By shape invariant, know where new element should go

  • Now have to restore ordering invariant

9

9

7

7

8

8

1

MSR-CMU Center for Computational Thinking


Sifting up

Sifting Up

2

2

4

4

1

3

  • Order invariant satisfied, except between new node and its parent (“looking up”)

  • Swapping with parent will restore locally

  • Parent may now violate invariant

9

9

7

7

8

8

1

3

MSR-CMU Center for Computational Thinking


Invariant restored

Invariant Restored

1

2

4

4

2

1

  • When reaching root (no parent!), ordering invariant restored everywhere

  • We have a valid heap!

9

9

7

7

8

8

3

3

MSR-CMU Center for Computational Thinking


Analysis

Analysis

  • Insert requires O(log(n)) swaps in worst case

  • Logarithmic thinking: complete binary tree with n elements has 1+log(n) levels

  • Delete min also O(log(n)), omitted here

MSR-CMU Center for Computational Thinking


Heaps as arrays

Heaps as Arrays

1

1

10

2

11

3

  • Exploit shape invariant

  • Binary numbering system for nodes, root is 1

  • Left child is n0 = 2*n; right child is n1 = 2*n+1

  • Parent is at n/2; 0 is unused

100

4

101

5

110

6

111

7

MSR-CMU Center for Computational Thinking


Creating a heap

Creating a Heap

heap heap_new(int limit)

[email protected] 1 <= limit;

[email protected] is_heap(\result) && heap_empty(\result);

{

heap H = alloc(struct heap);

H->limit = limit;

H->next = 1;

H->heap = alloc_array(int, limit);

return H;

}

  • Pre/postconditions are easy to specify and reason about

  • How to automate?

MSR-CMU Center for Computational Thinking


Almost a heap

Almost a Heap

boolis_heap_except_up(heap H, intn)

[email protected] H != NULL && \length(H->heap) == H->limit;

{ inti;

if (!(1 <= H->next && H->next <= H->limit)) return false;

for (i = 2; i < H->next; i++)

if (!(i == n || H->heap[i/2] <= H->heap[i]))

return false;

return true;

}

// is_heap_except_up(H, 1) == is_heap(H);

  • Captures permitted violation precisely

  • Observation at end for postcondition of sift_up

MSR-CMU Center for Computational Thinking


Sifting up restoring invariant

Sifting Up / Restoring Invariant

void sift_up(heap H, intn)

[email protected] 1 <= n && n < H->limit;

[email protected] is_heap_except_up(H, n);

[email protected] is_heap(H);

{ inti = n;

while (i > 1)

[email protected]_invariantis_heap_except_up(H, i);

{

if (H->heap[i/2] <= H->heap[i]) return;

swap(H->heap, i/2, i);

i = i/2;

}

[email protected] i == 1;

[email protected] is_heap_except_up(H, 1);

return;

}

MSR-CMU Center for Computational Thinking


  • Login