Question

在没有后置条件的情况下，达夫尼似乎并没有证明两种方法的等效性。这是预期的吗？

function method pipeline_func(x: int): int{
    x * 2
}

function method program_func(x: int): int {
    x + x
}

method pipeline_with_ensures (x: int) returns (x': int) 
    ensures x' == x*2
{
    x' := x*2;
}

method program_with_ensures (x: int) returns (x': int) 
    ensures x' == x+x
{
    x' := x + x;
}

method pipeline(x: int) returns (x': int)
{
    x' := x * 2;
}

method program(x: int) returns (x': int)
{
    x' := x + x;
}

method Main(x: int) {
    // Simple functions can be directly called from expressions and can easily 
    // be asserted as below.
    assert pipeline_func(x) == program_func(x);

    // Methods needs to be assigned to a variables to be used in another
    // expression.
    var a := pipeline_with_ensures(x);
    var b := program_with_ensures(x);

    // With ensures in both program_with_ensures and pipeline_with_ensures 
    // Dafny can verify a equals to b. Similarly functions and methods could be 
    // asserted together. 
    assert a == b;
    assert a == pipeline_func(x);
    assert b == program_func(x);
    assert a == program_func(x);
    assert b == pipeline_func(x);

    var c := pipeline(x);
    var d := program(x);

    // However, without ensures clause, Dafny can't verify that pipeline and
    // pipeline_with_ensures actually compute the same thing. 
    assert a == c;

    assert c == d;
}

我在达夫尼有两种方法，我所掌握的信息不多他们的职位条件。这里的上下文是我正在使用程序综合工具开发一个编译器，并且我想正式验证我的编译程序对于任何任意输入都计算出与规范相同的值。我的规范以类似C的语言编写，如下所示。

#define ECN_THRESH 20

int counter   = ECN_THRESH;
int last_time = 0;

struct Packet {
  int bytes;
  int time;
  int mark;
};

void func(struct Packet p) {
  // Decrement counter according to drain rate
  counter = counter - (p.time - last_time);
  if (counter < 0) counter = 0;

  // Increment counter
  counter += p.bytes;

  // If we are above the ECN_THRESH, mark
  if (counter > ECN_THRESH) p.mark = 1;

  // Store last time
  last_time = p.time;
}

Answer 1

这是预期的。 Dafny会“一次”执行一种验证，并且永远不会“查看”另一种方法的代码。

有关更多信息，请参见FAQ section和Guide的断言部分（搜索“忘记”以进入相关部分）。

达夫尼无法证明方法的等效性

1 个答案: