Whj Wim Feijen

On computing a longest path in a tree

The primary purpose of this note is to present an exercise in proof design. For us, such a design consists in isolating the relevant concepts for the problem at hand, introducing special-purpose notation for them that is geared to manipulation and to crisp formal specification, and then solving the problem in a demand-driven way, while onthe-fly extracting from the calculation additional theory useful for solving the problem proper. The problem chosen is demonstrating the correctness of an algorithm for computing the longest path in a tree. Given a finite tree with all edges having positive length, we wish to compute a longest path. This can be done using a procedure invented by Edsger W. Dijkstra around 1960, which is as follows. Build a physical model of the tree by connecting each pair of adjacent nodes by a piece of string of the given edge length. Now pick up the physical tree at an arbitrary node U , l t the contraption hang down, and determine a deepest node X. Then pick up the tree at X and determine a deepest node Y . The claim is that the path between X andY is a longest path in the tree. We have never seen a formal proof of this claim, and the purpose of this note is to provide one.

In-situ inversion of a cyclic permutation

Abstract An algorithm is developed for the in-situ inversion of a cyclic permutation represented in an array. The emphasis is on the quo modo rather than the quod∗∗; we are interested in finding concepts and notations for dealing more effectively with formal developments and proofs of such algorithms, rather than in this particular algorithm itself.

Peterson's mutual exclusion algorithm revisited

This last technical chapter is not really about Peterson’s algorithm, although it may reinforce the beauty of that design. What this chapter really is about, is a serious and fundamental criticism that one may have of the method of multiprogramming proposed in this book. The method is invariably driven by the requirement of partial correctness, thereby largely neglecting the aspect of individual progress, or “liveness”. Of course, we do have some rules of thumb that prevent us from excluding progress beforehand, the most notable one being to choose the annotation and the induced guards as weak as possible. But how good is this? Is there a mathematical underpinning? The answer is simple: there isn’t!

An Elementary Derivation of the Alternating Bit Protocol

The famous alternating bit protocol is an algorithm for transmitting a sequence of data through a so-called faulty channel, i.e. a channel that can lose or duplicate injected data. The established literature provides a wealth of treatments and plenty of a-posteriori correctness proofs of the protocol; derivations of the algorithm, however, are very rare. The prime purpose of this note is to provide such a derivation from first principles, using the theory of Owicki and Gries as the only tool for reasoning about parallel programs.

A little exercise in deriving multiprograms

In this note we record an experiment in deriving multiprograms from their functional specifications, with the predicate calculus and the theory of Owicki and Gries as our only tools for reasoning. For the benefit of the experiment we have selected an example problem that is so simple that it need not divert our attention from the subject matter, which is the process of derivation.

Bulterman's reshuffling problem

(The sole purpose of this exercise is to give a development and a presentation of the solution of a programming problem, with some more emphasis on the presentation. At the end of the tsxt, when a program is shown, the reader should be convinced of the correctness of the design. Handles on the notations and techniques used can be obtained from [l] or [2] and from [3], if so desired.) Consider an array X(0 . . e N l), such that -N=R*M,RalandMal, R of its elements are red, the remaining N -R elements are blue. It is required to permute the array elements such that (a) the relatrve order of the blue elements remains unaltered, and (b) the red elements are moved to the positions r * M, 0 s r < R. The standard trick to trivialize the proof that the final value of X is a permutation of its original value is to Fticlc :a array alterations of the form X: swap(i, j), 0 s i <j C I% So, iiet us adopt the trick. T?rf the two remaining requirements (a) and (b), the first one seems to be the Lardest: incziutiously swapping of blue elements is likely to create irrevocable chaos. So, let us try to swap the blue elements with care: -swapping two distinct blue elements is so harmful to (a! that we simply disallow it; -swapping a red and a Hue element is at least suspect, unless ai1 elements ‘19 bctwees?’ are red, in which case we (had better) allow it. Thus, having covered all cases, w, 0 arrive at a regime in which swapping two Q

Programming, proving, and calculation

7 ~e~~~~ is ~~~stra~~ed to the two outer elements of a ,?on-empty ‘train o<f elements’, 8 9 elements of dre with t ossible exception of one element at an end, w Gch may be blue.