-----------------------------------------------------------------------------
-- |
-- Module    : Documentation.SBV.Examples.WeakestPreconditions.IntSqrt
-- Copyright : (c) Levent Erkok
-- License   : BSD3
-- Maintainer: erkokl@gmail.com
-- Stability : experimental
--
-- Proof of correctness of an imperative integer square-root algorithm, using
-- weakest preconditions. The algorithm computes the floor of the square-root
-- of a given non-negative integer by keeping a running some of all odd numbers
-- starting from 1. Recall that @1+3+5+...+(2n+1) = (n+1)^2@, thus we can
-- stop the counting when we exceed the input number.
-----------------------------------------------------------------------------

{-# LANGUAGE DeriveAnyClass        #-}
{-# LANGUAGE DeriveGeneric         #-}
{-# LANGUAGE DeriveTraversable     #-}
{-# LANGUAGE FlexibleInstances     #-}
{-# LANGUAGE MultiParamTypeClasses #-}
{-# LANGUAGE NamedFieldPuns        #-}

{-# OPTIONS_GHC -Wall -Werror #-}

module Documentation.SBV.Examples.WeakestPreconditions.IntSqrt where

import Data.SBV
import Data.SBV.Control

import Data.SBV.Tools.WeakestPreconditions

import GHC.Generics (Generic)

import Prelude hiding (sqrt)

-- * Program state

-- | The state for the division program, parameterized over a base type @a@.
data SqrtS a = SqrtS { forall a. SqrtS a -> a
x    :: a   -- ^ The input
                     , forall a. SqrtS a -> a
sqrt :: a   -- ^ The floor of the square root
                     , forall a. SqrtS a -> a
i    :: a   -- ^ Successive squares, as the sum of j's
                     , forall a. SqrtS a -> a
j    :: a   -- ^ Successive odds
                     }
                     deriving (Int -> SqrtS a -> ShowS
forall a. Show a => Int -> SqrtS a -> ShowS
forall a. Show a => [SqrtS a] -> ShowS
forall a. Show a => SqrtS a -> String
forall a.
(Int -> a -> ShowS) -> (a -> String) -> ([a] -> ShowS) -> Show a
showList :: [SqrtS a] -> ShowS
$cshowList :: forall a. Show a => [SqrtS a] -> ShowS
show :: SqrtS a -> String
$cshow :: forall a. Show a => SqrtS a -> String
showsPrec :: Int -> SqrtS a -> ShowS
$cshowsPrec :: forall a. Show a => Int -> SqrtS a -> ShowS
Show, forall a.
(forall x. a -> Rep a x) -> (forall x. Rep a x -> a) -> Generic a
forall a x. Rep (SqrtS a) x -> SqrtS a
forall a x. SqrtS a -> Rep (SqrtS a) x
$cto :: forall a x. Rep (SqrtS a) x -> SqrtS a
$cfrom :: forall a x. SqrtS a -> Rep (SqrtS a) x
Generic, forall a.
Mergeable a =>
Bool -> SBool -> SqrtS a -> SqrtS a -> SqrtS a
forall a b.
(Mergeable a, Ord b, SymVal b, Num b) =>
[SqrtS a] -> SqrtS a -> SBV b -> SqrtS a
forall a.
(Bool -> SBool -> a -> a -> a)
-> (forall b. (Ord b, SymVal b, Num b) => [a] -> a -> SBV b -> a)
-> Mergeable a
select :: forall b.
(Ord b, SymVal b, Num b) =>
[SqrtS a] -> SqrtS a -> SBV b -> SqrtS a
$cselect :: forall a b.
(Mergeable a, Ord b, SymVal b, Num b) =>
[SqrtS a] -> SqrtS a -> SBV b -> SqrtS a
symbolicMerge :: Bool -> SBool -> SqrtS a -> SqrtS a -> SqrtS a
$csymbolicMerge :: forall a.
Mergeable a =>
Bool -> SBool -> SqrtS a -> SqrtS a -> SqrtS a
Mergeable, forall a b. a -> SqrtS b -> SqrtS a
forall a b. (a -> b) -> SqrtS a -> SqrtS b
forall (f :: * -> *).
(forall a b. (a -> b) -> f a -> f b)
-> (forall a b. a -> f b -> f a) -> Functor f
<$ :: forall a b. a -> SqrtS b -> SqrtS a
$c<$ :: forall a b. a -> SqrtS b -> SqrtS a
fmap :: forall a b. (a -> b) -> SqrtS a -> SqrtS b
$cfmap :: forall a b. (a -> b) -> SqrtS a -> SqrtS b
Functor, forall a. Eq a => a -> SqrtS a -> Bool
forall a. Num a => SqrtS a -> a
forall a. Ord a => SqrtS a -> a
forall m. Monoid m => SqrtS m -> m
forall a. SqrtS a -> Bool
forall a. SqrtS a -> Int
forall a. SqrtS a -> [a]
forall a. (a -> a -> a) -> SqrtS a -> a
forall m a. Monoid m => (a -> m) -> SqrtS a -> m
forall b a. (b -> a -> b) -> b -> SqrtS a -> b
forall a b. (a -> b -> b) -> b -> SqrtS a -> b
forall (t :: * -> *).
(forall m. Monoid m => t m -> m)
-> (forall m a. Monoid m => (a -> m) -> t a -> m)
-> (forall m a. Monoid m => (a -> m) -> t a -> m)
-> (forall a b. (a -> b -> b) -> b -> t a -> b)
-> (forall a b. (a -> b -> b) -> b -> t a -> b)
-> (forall b a. (b -> a -> b) -> b -> t a -> b)
-> (forall b a. (b -> a -> b) -> b -> t a -> b)
-> (forall a. (a -> a -> a) -> t a -> a)
-> (forall a. (a -> a -> a) -> t a -> a)
-> (forall a. t a -> [a])
-> (forall a. t a -> Bool)
-> (forall a. t a -> Int)
-> (forall a. Eq a => a -> t a -> Bool)
-> (forall a. Ord a => t a -> a)
-> (forall a. Ord a => t a -> a)
-> (forall a. Num a => t a -> a)
-> (forall a. Num a => t a -> a)
-> Foldable t
product :: forall a. Num a => SqrtS a -> a
$cproduct :: forall a. Num a => SqrtS a -> a
sum :: forall a. Num a => SqrtS a -> a
$csum :: forall a. Num a => SqrtS a -> a
minimum :: forall a. Ord a => SqrtS a -> a
$cminimum :: forall a. Ord a => SqrtS a -> a
maximum :: forall a. Ord a => SqrtS a -> a
$cmaximum :: forall a. Ord a => SqrtS a -> a
elem :: forall a. Eq a => a -> SqrtS a -> Bool
$celem :: forall a. Eq a => a -> SqrtS a -> Bool
length :: forall a. SqrtS a -> Int
$clength :: forall a. SqrtS a -> Int
null :: forall a. SqrtS a -> Bool
$cnull :: forall a. SqrtS a -> Bool
toList :: forall a. SqrtS a -> [a]
$ctoList :: forall a. SqrtS a -> [a]
foldl1 :: forall a. (a -> a -> a) -> SqrtS a -> a
$cfoldl1 :: forall a. (a -> a -> a) -> SqrtS a -> a
foldr1 :: forall a. (a -> a -> a) -> SqrtS a -> a
$cfoldr1 :: forall a. (a -> a -> a) -> SqrtS a -> a
foldl' :: forall b a. (b -> a -> b) -> b -> SqrtS a -> b
$cfoldl' :: forall b a. (b -> a -> b) -> b -> SqrtS a -> b
foldl :: forall b a. (b -> a -> b) -> b -> SqrtS a -> b
$cfoldl :: forall b a. (b -> a -> b) -> b -> SqrtS a -> b
foldr' :: forall a b. (a -> b -> b) -> b -> SqrtS a -> b
$cfoldr' :: forall a b. (a -> b -> b) -> b -> SqrtS a -> b
foldr :: forall a b. (a -> b -> b) -> b -> SqrtS a -> b
$cfoldr :: forall a b. (a -> b -> b) -> b -> SqrtS a -> b
foldMap' :: forall m a. Monoid m => (a -> m) -> SqrtS a -> m
$cfoldMap' :: forall m a. Monoid m => (a -> m) -> SqrtS a -> m
foldMap :: forall m a. Monoid m => (a -> m) -> SqrtS a -> m
$cfoldMap :: forall m a. Monoid m => (a -> m) -> SqrtS a -> m
fold :: forall m. Monoid m => SqrtS m -> m
$cfold :: forall m. Monoid m => SqrtS m -> m
Foldable, Functor SqrtS
Foldable SqrtS
forall (t :: * -> *).
Functor t
-> Foldable t
-> (forall (f :: * -> *) a b.
    Applicative f =>
    (a -> f b) -> t a -> f (t b))
-> (forall (f :: * -> *) a. Applicative f => t (f a) -> f (t a))
-> (forall (m :: * -> *) a b.
    Monad m =>
    (a -> m b) -> t a -> m (t b))
-> (forall (m :: * -> *) a. Monad m => t (m a) -> m (t a))
-> Traversable t
forall (m :: * -> *) a. Monad m => SqrtS (m a) -> m (SqrtS a)
forall (f :: * -> *) a. Applicative f => SqrtS (f a) -> f (SqrtS a)
forall (m :: * -> *) a b.
Monad m =>
(a -> m b) -> SqrtS a -> m (SqrtS b)
forall (f :: * -> *) a b.
Applicative f =>
(a -> f b) -> SqrtS a -> f (SqrtS b)
sequence :: forall (m :: * -> *) a. Monad m => SqrtS (m a) -> m (SqrtS a)
$csequence :: forall (m :: * -> *) a. Monad m => SqrtS (m a) -> m (SqrtS a)
mapM :: forall (m :: * -> *) a b.
Monad m =>
(a -> m b) -> SqrtS a -> m (SqrtS b)
$cmapM :: forall (m :: * -> *) a b.
Monad m =>
(a -> m b) -> SqrtS a -> m (SqrtS b)
sequenceA :: forall (f :: * -> *) a. Applicative f => SqrtS (f a) -> f (SqrtS a)
$csequenceA :: forall (f :: * -> *) a. Applicative f => SqrtS (f a) -> f (SqrtS a)
traverse :: forall (f :: * -> *) a b.
Applicative f =>
(a -> f b) -> SqrtS a -> f (SqrtS b)
$ctraverse :: forall (f :: * -> *) a b.
Applicative f =>
(a -> f b) -> SqrtS a -> f (SqrtS b)
Traversable)

-- | Show instance for 'SqrtS'. The above deriving clause would work just as well,
-- but we want it to be a little prettier here, and hence the @OVERLAPS@ directive.
instance {-# OVERLAPS #-} (SymVal a, Show a) => Show (SqrtS (SBV a)) where
   show :: SqrtS (SBV a) -> String
show (SqrtS SBV a
x SBV a
sqrt SBV a
i SBV a
j) = String
"{x = " forall a. [a] -> [a] -> [a]
++ forall {a}. (Show a, SymVal a) => SBV a -> String
sh SBV a
x forall a. [a] -> [a] -> [a]
++ String
", sqrt = " forall a. [a] -> [a] -> [a]
++ forall {a}. (Show a, SymVal a) => SBV a -> String
sh SBV a
sqrt forall a. [a] -> [a] -> [a]
++ String
", i = " forall a. [a] -> [a] -> [a]
++ forall {a}. (Show a, SymVal a) => SBV a -> String
sh SBV a
i forall a. [a] -> [a] -> [a]
++ String
", j = " forall a. [a] -> [a] -> [a]
++ forall {a}. (Show a, SymVal a) => SBV a -> String
sh SBV a
j forall a. [a] -> [a] -> [a]
++ String
"}"
     where sh :: SBV a -> String
sh SBV a
v = forall b a. b -> (a -> b) -> Maybe a -> b
maybe String
"<symbolic>" forall a. Show a => a -> String
show (forall a. SymVal a => SBV a -> Maybe a
unliteral SBV a
v)

-- | 'Fresh' instance for the program state
instance SymVal a => Fresh IO (SqrtS (SBV a)) where
  fresh :: QueryT IO (SqrtS (SBV a))
fresh = forall a. a -> a -> a -> a -> SqrtS a
SqrtS forall (f :: * -> *) a b. Functor f => (a -> b) -> f a -> f b
<$> forall a. SymVal a => Query (SBV a)
freshVar_  forall (f :: * -> *) a b. Applicative f => f (a -> b) -> f a -> f b
<*> forall a. SymVal a => Query (SBV a)
freshVar_ forall (f :: * -> *) a b. Applicative f => f (a -> b) -> f a -> f b
<*> forall a. SymVal a => Query (SBV a)
freshVar_ forall (f :: * -> *) a b. Applicative f => f (a -> b) -> f a -> f b
<*> forall a. SymVal a => Query (SBV a)
freshVar_

-- | Helper type synonym
type S = SqrtS SInteger

-- * The algorithm

-- | The imperative square-root algorithm, assuming non-negative @x@
--
-- @
--    sqrt = 0                  -- set sqrt to 0
--    i    = 1                  -- set i to 1, sum of j's so far
--    j    = 1                  -- set j to be the first odd number i
--    while i <= x              -- while the sum hasn't exceeded x yet
--      sqrt = sqrt + 1              -- increase the sqrt
--      j    = j + 2                 -- next odd number
--      i    = i + j                 -- running sum of j's
-- @
--
-- Note that we need to explicitly annotate each loop with its invariant and the termination
-- measure. For convenience, we take those two as parameters for simplicity.
algorithm :: Invariant S -> Maybe (Measure S) -> Stmt S
algorithm :: Invariant S -> Maybe (Measure S) -> Stmt S
algorithm Invariant S
inv Maybe (Measure S)
msr = forall st. [Stmt st] -> Stmt st
Seq [ forall st. String -> (st -> SBool) -> Stmt st
assert String
"x >= 0" forall a b. (a -> b) -> a -> b
$ \SqrtS{SInteger
x :: SInteger
x :: forall a. SqrtS a -> a
x} -> SInteger
x forall a. OrdSymbolic a => a -> a -> SBool
.>= SInteger
0
                        , forall st. (st -> st) -> Stmt st
Assign forall a b. (a -> b) -> a -> b
$ \S
st -> S
st{sqrt :: SInteger
sqrt = SInteger
0, i :: SInteger
i = SInteger
1, j :: SInteger
j = SInteger
1}
                        , forall st.
String
-> Invariant st
-> Maybe (Measure st)
-> Invariant st
-> Stmt st
-> Stmt st
While String
"i <= x"
                                Invariant S
inv
                                Maybe (Measure S)
msr
                                (\SqrtS{SInteger
x :: SInteger
x :: forall a. SqrtS a -> a
x, SInteger
i :: SInteger
i :: forall a. SqrtS a -> a
i} -> SInteger
i forall a. OrdSymbolic a => a -> a -> SBool
.<= SInteger
x)
                                forall a b. (a -> b) -> a -> b
$ forall st. [Stmt st] -> Stmt st
Seq [ forall st. (st -> st) -> Stmt st
Assign forall a b. (a -> b) -> a -> b
$ \st :: S
st@SqrtS{SInteger
sqrt :: SInteger
sqrt :: forall a. SqrtS a -> a
sqrt} -> S
st{sqrt :: SInteger
sqrt = SInteger
sqrt forall a. Num a => a -> a -> a
+ SInteger
1}
                                      , forall st. (st -> st) -> Stmt st
Assign forall a b. (a -> b) -> a -> b
$ \st :: S
st@SqrtS{SInteger
j :: SInteger
j :: forall a. SqrtS a -> a
j}    -> S
st{j :: SInteger
j    = SInteger
j forall a. Num a => a -> a -> a
+ SInteger
2}
                                      , forall st. (st -> st) -> Stmt st
Assign forall a b. (a -> b) -> a -> b
$ \st :: S
st@SqrtS{SInteger
i :: SInteger
i :: forall a. SqrtS a -> a
i, SInteger
j :: SInteger
j :: forall a. SqrtS a -> a
j} -> S
st{i :: SInteger
i    = SInteger
i forall a. Num a => a -> a -> a
+ SInteger
j}
                                      ]
                        ]

-- | Precondition for our program: @x@ must be non-negative. Note that there is an explicit
-- call to 'Data.SBV.Tools.WeakestPreconditions.abort' in our program to protect against this case, so if we do not have this
-- precondition, all programs will fail.
pre :: S -> SBool
pre :: Invariant S
pre SqrtS{SInteger
x :: SInteger
x :: forall a. SqrtS a -> a
x} = SInteger
x forall a. OrdSymbolic a => a -> a -> SBool
.>= SInteger
0

-- | Postcondition for our program: The @sqrt@ squared must be less than or equal to @x@, and
-- @sqrt+1@ squared must strictly exceed @x@.
post :: S -> SBool
post :: Invariant S
post SqrtS{SInteger
x :: SInteger
x :: forall a. SqrtS a -> a
x, SInteger
sqrt :: SInteger
sqrt :: forall a. SqrtS a -> a
sqrt} = forall {a}. Num a => a -> a
sq SInteger
sqrt forall a. OrdSymbolic a => a -> a -> SBool
.<= SInteger
x SBool -> SBool -> SBool
.&& forall {a}. Num a => a -> a
sq (SInteger
sqrtforall a. Num a => a -> a -> a
+SInteger
1) forall a. OrdSymbolic a => a -> a -> SBool
.> SInteger
x
  where sq :: a -> a
sq a
n = a
n forall a. Num a => a -> a -> a
* a
n

-- | Stability condition: Program must leave @x@ unchanged.
noChange :: Stable S
noChange :: Stable S
noChange = [forall a st.
EqSymbolic a =>
String -> (st -> a) -> st -> st -> (String, SBool)
stable String
"x" forall a. SqrtS a -> a
x]

-- | A program is the algorithm, together with its pre- and post-conditions.
imperativeSqrt :: Invariant S -> Maybe (Measure S) -> Program S
imperativeSqrt :: Invariant S -> Maybe (Measure S) -> Program S
imperativeSqrt Invariant S
inv Maybe (Measure S)
msr = Program { setup :: Symbolic ()
setup         = forall (m :: * -> *) a. Monad m => a -> m a
return ()
                                 , precondition :: Invariant S
precondition  = Invariant S
pre
                                 , program :: Stmt S
program       = Invariant S -> Maybe (Measure S) -> Stmt S
algorithm Invariant S
inv Maybe (Measure S)
msr
                                 , postcondition :: Invariant S
postcondition = Invariant S
post
                                 , stability :: Stable S
stability     = Stable S
noChange
                                 }

-- * Correctness

-- | The invariant is that at each iteration of the loop @sqrt@ remains below or equal
-- to the actual square-root, and @i@ tracks the square of the next value. We also
-- have that @j@ is the @sqrt@'th odd value. Coming up with this invariant is not for
-- the faint of heart, for details I would strongly recommend looking at Manna's seminal
-- /Mathematical Theory of Computation/ book (chapter 3). The @j .> 0@ part is needed
-- to establish the termination.
invariant :: Invariant S
invariant :: Invariant S
invariant SqrtS{SInteger
x :: SInteger
x :: forall a. SqrtS a -> a
x, SInteger
sqrt :: SInteger
sqrt :: forall a. SqrtS a -> a
sqrt, SInteger
i :: SInteger
i :: forall a. SqrtS a -> a
i, SInteger
j :: SInteger
j :: forall a. SqrtS a -> a
j} = SInteger
j forall a. OrdSymbolic a => a -> a -> SBool
.> SInteger
0 SBool -> SBool -> SBool
.&& forall {a}. Num a => a -> a
sq SInteger
sqrt forall a. OrdSymbolic a => a -> a -> SBool
.<= SInteger
x SBool -> SBool -> SBool
.&& SInteger
i forall a. EqSymbolic a => a -> a -> SBool
.== forall {a}. Num a => a -> a
sq (SInteger
sqrt forall a. Num a => a -> a -> a
+ SInteger
1) SBool -> SBool -> SBool
.&& SInteger
j forall a. EqSymbolic a => a -> a -> SBool
.== SInteger
2forall a. Num a => a -> a -> a
*SInteger
sqrt forall a. Num a => a -> a -> a
+ SInteger
1
  where sq :: a -> a
sq a
n = a
n forall a. Num a => a -> a -> a
* a
n

-- | The measure. In each iteration @i@ strictly increases, thus reducing the differential @x - i@
measure :: Measure S
measure :: Measure S
measure SqrtS{SInteger
x :: SInteger
x :: forall a. SqrtS a -> a
x, SInteger
i :: SInteger
i :: forall a. SqrtS a -> a
i} = [SInteger
x forall a. Num a => a -> a -> a
- SInteger
i]

-- | Check that the program terminates and the post condition holds. We have:
--
-- >>> correctness
-- Total correctness is established.
-- Q.E.D.
correctness :: IO ()
correctness :: IO ()
correctness = forall a. Show a => a -> IO ()
print forall (m :: * -> *) a b. Monad m => (a -> m b) -> m a -> m b
=<< forall st res.
(Show res, Mergeable st, Queriable IO st res) =>
WPConfig -> Program st -> IO (ProofResult res)
wpProveWith WPConfig
defaultWPCfg{wpVerbose :: Bool
wpVerbose=Bool
True} (Invariant S -> Maybe (Measure S) -> Program S
imperativeSqrt Invariant S
invariant (forall a. a -> Maybe a
Just Measure S
measure))