Dafny cannot prove function-method equivalence, with High-Order-Polymorphic Recursive vs Linear Iterative

Question

This message is going to be a bit long, but that is because I want to explain it as best as possible.

In Dafny, I had the next problem: Given an array, count the number of segments of length k in which this happens; the number of positives in the left-half of the segment is bigger or equal to the right-half.

As an example (imagine segments can only be even, so that there is no discussion about what a half is):

k=2 ---> count(array[-4,-2,2,1],k) ---> 2, as [-4,-2] fulfills and also [2,1]
k=4 ---> count(array[-4,-2,2,1],k) ---> 0, as [-4,-2,2,1] does not fulfil.
k=6 ---> count(array[-4,-2,2,1],k) ---> 0, as there are not length 6 segments.

I have implemented this in two ways: one with a function, using high-order and polymorphism (but it is not linear) and the second one with an iterative implementation which does it linearly.

The function works this way:

1. We define a Count function, which counts a property on an array.
2. We define a way of, given an array, producing all the segments of the given length.
3. We define a predicate that, using Count, tells us if the property is fulfilled.

function method CountAux<T>(P: T -> bool, sequ: seq<T>, i: int): int 
//the warning just warns about how it is implemented, as when it warns about the triggers' choice
  requires 0 <= i <= |sequ|
  decreases |sequ| - i //necessary to prove termination
  ensures CountAux(P,sequ,i)>=0; //trivial
{
  if i == |sequ| then 0
  else (if P(sequ[i]) then 1 else 0) + CountAux(P, sequ, i+1)
}

function method Count<T>(P: T -> bool, sequ: seq<T>): int
  ensures CountAux(P, sequ, 0)>=0; //trivial
{
  CountAux(P, sequ, 0)
}

function method produce_segments (sequ:seq<int>, seg_length:int) : seq<seq<int>>
  requires |sequ| >= seg_length >= 0
   decreases sequ 
  {
    if |sequ| == 0 then [] //if the list is empty
    else if |sequ|-1 < seg_length then [sequ[0..seg_length]] //if the list cannot have any more segments
    else [sequ[0..seg_length]]+produce_segments(sequ[1..],seg_length)
  }

function method segment_LeftMoreSegmentRight (sequ:seq<int>) : bool
  {
    if (Count(x => x >= 0, sequ[0..|sequ|/2])) >= (Count(x => x >= 0, sequ[|sequ|/2..|sequ|])) then true
    else false
  }

Now, the method works this way:

1. We initialize an array of length k where we have counted all the positives at the left and in the right.
2. Now, from k on, on each iteration, we will increment, decrement or leave the same number of positives on each side: for instance, if v[i]>=0 then we add 1 to the number of positives on the right (and, obviously, we decrement this number in v[i-k/2] if it was positive).
3. To count that, we define a predicate that tells us if the number of positives on the right is higher or equal than on the left.

//returns if the number of positives left is higher than the right or not
function method segmentL_isMore_right (pos_left:int,pos_right:int) : bool
  {
    if pos_left>=pos_right then true
    else false
  }
 
 method initialize(sequ:seq<int>, seg_length:int) returns (sequ_new:seq<int>,pos_left: int,pos_right:int)
  requires |sequ| >= seg_length >= 0
{
  var length := |sequ|;
  var pos_left_local := 0;
  var pos_right_local :=0;
  var i:=0;
  while i<(length/2) 
  {
    if sequ[i]>=1 {pos_left_local:=pos_left_local+1;}
    i:=i+1;
  }
  while i<(length) 
  {
    if sequ[i]>=1 {pos_right_local:=pos_right_local+1;}
    i:=i+1;
  }
  
  return sequ[0..],pos_left_local,pos_right_local;
}

//Linear implementation

method Count_linear(sequ:seq<int>, seg_length:int) returns (num_segmts: int)
  requires |sequ| >= seg_length >= 0
  ensures num_segmts == Count(segment_LeftMoreSegmentRight, produce_segments(sequ,seg_length));
{
  var num_segmts_local := 0;
  var new_seq, pos_left_local, pos_right_local := initialize(sequ,seg_length);
  var i:=seg_length+1;
  while i<|sequ| 
    decreases |sequ|-i
  {
    if (sequ[i] >=0) {pos_right_local:=pos_right_local+1;}
    if (sequ[i-seg_length]>=0) {pos_left_local:=pos_left_local+1;}
    if (sequ[i-seg_length]/2>=0) 
        {
        pos_right_local:=pos_right_local-1;
        pos_left_local:=pos_left_local+1;
        }
    i:=i+1;
    if segmentL_isMore_right (pos_left_local,pos_right_local) 
      {
        num_segmts_local:=num_segmts_local+1;
      }
  }
  return num_segmts_local;
}


\\if want to prove it:
method Main()
{
  var aseq := [1,2,3,4,5,6,7,8,9,10];
  var seg2_leftRight := Count(segment_LeftMoreSegmentRight, produce_segments(aseq,4)); //high order and polymorphic
}

Now, the key is that ensures num_segmts == Count(segment_LeftMoreSegmentRight, produce_segments(sequ,seg_length)); does not verify. Obviously, I will have to prove some properties with lemmas about Count or Count_linear, but do not know where to start with this problem.

Any help? I hope I have explained the problem as best as possible.

Answer 1

I am making this an answer just so I can get nice code formatting.

Your Count_linear has a bug.

  var aseq := [1,2,3,4,5,6,7,8,9,10];
  var slow := Count(segment_LeftMoreSegmentRight, produce_segments(aseq,4)); //high order and polymorphic
  var fast := Count_linear(aseq, 4);
  print slow, "\n";
  print fast, "\n";

prints

7
5