0

A very simple multiplication code:

method Product1 (m: nat, n: nat) returns (res:nat) 
ensures res == m * n;      
{  
    var m1: nat := 0; 
    var n1: nat := 0; 
    res := 0; 
    while (m1 < m)    
    { 
        n1 := 0; 
        while (n1 < n)  
        { 
            res := res + 1;
            n1 := n1 + 1; 
        } 
        m1 := m1 + 1; 
    } 
}

When I verify it with dafny, it says:

    Description                                        Line Column
1   A postcondition might not hold on this return path. 8   4
2   This is the postcondition that might not hold.      2   16

I get it says under some conditions, res != m*n, but I can't figure it out.

Richard Yang
  • 131
  • 1
  • 2
  • 5
  • Also, please don't ask people to count line numbers. Add comments to the offending lines. – candied_orange Sep 14 '16 at 01:52
  • The postcondition message does not mean that ```res != m*n```, rather it means that Dafny cannot prove that ```res == m*n``` in all cases. That is why it says "might" not hold. – lexicalscope Sep 20 '16 at 13:11

2 Answers2

3

Updated!

Tried dafny in the online website, looks like it is bug?

method Test(m: nat) returns (r: nat) 
{
  var m1: nat := 0;
  while (m1 < m) {
    m1 := m1 + 1;
  }
  assert m == m1; // fail assert
}

more try:

method Test(m: nat) returns (r: nat) 
{
  var m1: nat := 0;
  while (m1 < m) {
    assert m1 < m;
    m1 := m1 + 1;
  }
  assert !(m1 < m);   // pass
  assert m1 == m || m1 > m;  // pass
  assert m1 == m;  // fail
}

After some deep understand, I know that it should use Loop Invariants for dafny to address this question.

My modified code:

method Product1 (m: nat, n: nat) returns (res:nat) 
ensures res == m * n;      
{  
    var m1: nat := 0; 
    var n1: nat := 0; 
    res := 0; 
    while (m1 < m)
    invariant 0 <= m1 <= m
    invariant res == m1 * n
    { 
        var temp: nat := res; 
        n1 := 0; 
        while (n1 < n)
        invariant 0 <= n1 <= n
        invariant res == temp+n1   
        { 
            res := res + 1;
            n1 := n1 + 1; 
        } 
        m1 := m1 + 1; 
    }
    assert m1 == m;  // success
}

Then remove the tmp var:

method Product1 (m: nat, n: nat) returns (res:nat) 
ensures res == m * n;      
{  
    var m1: nat := 0; 
    var n1: nat := 0; 
    res := 0; 
    while (m1 < m)
    invariant 0 <= m1 <= m
    invariant res == m1 * n
    {
        n1 := 0; 
        while (n1 < n)
        invariant 0 <= n1 <= n
        invariant res == n1 + m1*n  
        { 
            res := res + 1;
            n1 := n1 + 1; 
        } 
        m1 := m1 + 1; 
    }
    assert m1 == m;  // success
}
Gohan
  • 2,422
  • 2
  • 26
  • 45
0

Your loops don't have any loop invariants. At a minimum, you'll need invariants on both loops. Otherwise, Dafny won't be able to figure out what holds after the loops...

redjamjar
  • 535
  • 2
  • 11