Aiming Low is Harder Induction for Lower Bounds in Probabilistic - - PowerPoint PPT Presentation

▶
aiming low is harder
SMART_READER_LITE
LIVE PREVIEW

Aiming Low is Harder Induction for Lower Bounds in Probabilistic - - PowerPoint PPT Presentation

Apr 01, 2023 246 likes •1.39k views

Aiming Low is Harder Induction for Lower Bounds in Probabilistic Program Verification Marcel Hark Benjamin Kaminski Jrgen Giesl Joost-Pieter Katoen POPL 2020 Aiming Low is Harder Hark , Kaminski, Giesl, Katoen 1/25/20 1

slide-1
SLIDE 1

Aiming Low is Harder

Induction for Lower Bounds in Probabilistic Program Verification Marcel Hark Benjamin Kaminski Jürgen Giesl Joost-Pieter Katoen

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 1

slide-2
SLIDE 2

Motivation Setting the stage

  • Expected outcome of probabilistic programs P w.r.t. expectation f : Σ → R∞

≥0.

Expectation ↔ Random Variable. → Weakest preexpectation of f : wp P (f ) : Σ → R∞

≥0 (total correctness).

→ Quantitative version of Dijkstra’s wp-calculus: [Kozen 81, McIver,Morgan 96]. → Bottleneck: wp while ( ϕ ) { C } (f ) (loop invariants).

f = [x = 10]: wp P (f ) Probability that x is 10 after termination. f = x2 + y2: wp P (f ) Expected outcome of x2 + y2 after termination.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 2

slide-3
SLIDE 3

Motivation Setting the stage

  • Expected outcome of probabilistic programs P w.r.t. expectation f : Σ → R∞

≥0.

Expectation ↔ Random Variable. → Weakest preexpectation of f : wp P (f ) : Σ → R∞

≥0 (total correctness).

→ Quantitative version of Dijkstra’s wp-calculus: [Kozen 81, McIver,Morgan 96]. → Bottleneck: wp while ( ϕ ) { C } (f ) (loop invariants).

f = [x = 10]: wp P (f ) Probability that x is 10 after termination. f = x2 + y2: wp P (f ) Expected outcome of x2 + y2 after termination.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 2

slide-4
SLIDE 4

Motivation Setting the stage

  • Expected outcome of probabilistic programs P w.r.t. expectation f : Σ → R∞

≥0.

Expectation ↔ Random Variable. → Weakest preexpectation of f : wp P (f ) : Σ → R∞

≥0 (total correctness).

→ Quantitative version of Dijkstra’s wp-calculus: [Kozen 81, McIver,Morgan 96]. → Bottleneck: wp while ( ϕ ) { C } (f ) (loop invariants).

f = [x = 10]: wp P (f ) Probability that x is 10 after termination. f = x2 + y2: wp P (f ) Expected outcome of x2 + y2 after termination.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 2

slide-5
SLIDE 5

Motivation Setting the stage

  • Expected outcome of probabilistic programs P w.r.t. expectation f : Σ → R∞

≥0.

Expectation ↔ Random Variable. → Weakest preexpectation of f : wp P (f ) : Σ → R∞

≥0 (total correctness).

→ Quantitative version of Dijkstra’s wp-calculus: [Kozen 81, McIver,Morgan 96]. → Bottleneck: wp while ( ϕ ) { C } (f ) (loop invariants).

s

  • ...

f (τ1) f (τ2) f (τ3)

wp P (f ) (s) =Exp

  • P

f = [x = 10]: wp P (f ) Probability that x is 10 after termination. f = x2 + y2: wp P (f ) Expected outcome of x2 + y2 after termination.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 2

slide-6
SLIDE 6

Motivation Setting the stage

  • Expected outcome of probabilistic programs P w.r.t. expectation f : Σ → R∞

≥0.

Expectation ↔ Random Variable. → Weakest preexpectation of f : wp P (f ) : Σ → R∞

≥0 (total correctness).

→ Quantitative version of Dijkstra’s wp-calculus: [Kozen 81, McIver,Morgan 96]. → Bottleneck: wp while ( ϕ ) { C } (f ) (loop invariants).

s

  • ...

f (τ1) f (τ2) f (τ3)

wp P (f ) (s) =Exp

  • P

f = [x = 10]: wp P (f ) Probability that x is 10 after termination. f = x2 + y2: wp P (f ) Expected outcome of x2 + y2 after termination.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 2

slide-7
SLIDE 7

Motivation Setting the stage

  • Expected outcome of probabilistic programs P w.r.t. expectation f : Σ → R∞

≥0.

Expectation ↔ Random Variable. → Weakest preexpectation of f : wp P (f ) : Σ → R∞

≥0 (total correctness).

→ Quantitative version of Dijkstra’s wp-calculus: [Kozen 81, McIver,Morgan 96]. → Bottleneck: wp while ( ϕ ) { C } (f ) (loop invariants).

s

  • ...

f (τ1) f (τ2) f (τ3)

wp P (f ) (s) =Exp

  • P

f = [x = 10]: wp P (f ) Probability that x is 10 after termination. f = x2 + y2: wp P (f ) Expected outcome of x2 + y2 after termination.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 2

slide-8
SLIDE 8

Motivation Setting the stage

  • Expected outcome of probabilistic programs P w.r.t. expectation f : Σ → R∞

≥0.

Expectation ↔ Random Variable. → Weakest preexpectation of f : wp P (f ) : Σ → R∞

≥0 (total correctness).

→ Quantitative version of Dijkstra’s wp-calculus: [Kozen 81, McIver,Morgan 96]. → Bottleneck: wp while ( ϕ ) { C } (f ) (loop invariants).

s

  • ...

f (τ1) f (τ2) f (τ3)

wp P (f ) (s) =Exp

  • P

f = [x = 10]: wp P (f ) Probability that x is 10 after termination. f = x2 + y2: wp P (f ) Expected outcome of x2 + y2 after termination.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 2

slide-9
SLIDE 9

Motivation Setting the stage

  • Expected outcome of probabilistic programs P w.r.t. expectation f : Σ → R∞

≥0.

Expectation ↔ Random Variable. → Weakest preexpectation of f : wp P (f ) : Σ → R∞

≥0 (total correctness).

→ Quantitative version of Dijkstra’s wp-calculus: [Kozen 81, McIver,Morgan 96]. → Bottleneck: wp while ( ϕ ) { C } (f ) (loop invariants).

s

  • ...

f (τ1) f (τ2) f (τ3)

wp P (f ) (s) =Exp

  • P

f = [x = 10]: wp P (f ) Probability that x is 10 after termination. f = x2 + y2: wp P (f ) Expected outcome of x2 + y2 after termination.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 2

slide-10
SLIDE 10

Motivation Setting the stage

  • Expected outcome of probabilistic programs P w.r.t. expectation f : Σ → R∞

≥0.

Expectation ↔ Random Variable. → Weakest preexpectation of f : wp P (f ) : Σ → R∞

≥0 (total correctness).

→ Quantitative version of Dijkstra’s wp-calculus: [Kozen 81, McIver,Morgan 96]. → Bottleneck: wp while ( ϕ ) { C } (f ) (loop invariants).

s

  • ...

f (τ1) f (τ2) f (τ3)

wp P (f ) (s) =Exp

  • P

f = [x = 10]: wp P (f ) Probability that x is 10 after termination. f = x2 + y2: wp P (f ) Expected outcome of x2 + y2 after termination.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 2

slide-11
SLIDE 11

Motivation Setting the stage

  • Expected outcome of probabilistic programs P w.r.t. expectation f : Σ → R∞

≥0.

Expectation ↔ Random Variable. → Weakest preexpectation of f : wp P (f ) : Σ → R∞

≥0 (total correctness).

→ Quantitative version of Dijkstra’s wp-calculus: [Kozen 81, McIver,Morgan 96]. → Bottleneck: wp while ( ϕ ) { C } (f ) (loop invariants).

s

  • ...

f (τ1) f (τ2) f (τ3)

wp P (f ) (s) =Exp

  • P

f = [x = 10]: wp P (f ) Probability that x is 10 after termination. f = x2 + y2: wp P (f ) Expected outcome of x2 + y2 after termination.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 2

slide-12
SLIDE 12

Motivation Setting the stage

  • Expected outcome of probabilistic programs P w.r.t. expectation f : Σ → R∞

≥0.

Expectation ↔ Random Variable. → Weakest preexpectation of f : wp P (f ) : Σ → R∞

≥0 (total correctness).

→ Quantitative version of Dijkstra’s wp-calculus: [Kozen 81, McIver,Morgan 96]. → Bottleneck: wp while ( ϕ ) { C } (f ) (loop invariants).

s

  • ...

f (τ1) f (τ2) f (τ3)

wp P (f ) (s) =Exp

  • P

f = [x = 10]: wp P (f ) Probability that x is 10 after termination. f = x2 + y2: wp P (f ) Expected outcome of x2 + y2 after termination.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 2

slide-13
SLIDE 13

Motivation Setting the stage

  • Expected outcome of probabilistic programs P w.r.t. expectation f : Σ → R∞

≥0.

Expectation ↔ Random Variable. → Weakest preexpectation of f : wp P (f ) : Σ → R∞

≥0 (total correctness).

→ Quantitative version of Dijkstra’s wp-calculus: [Kozen 81, McIver,Morgan 96]. → Bottleneck: wp while ( ϕ ) { C } (f ) (loop invariants).

s

  • ...

f (τ1) f (τ2) f (τ3)

wp P (f ) (s) =Exp

  • P

f = [x = 10]: wp P (f ) Probability that x is 10 after termination. f = x2 + y2: wp P (f ) Expected outcome of x2 + y2 after termination.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 2

slide-14
SLIDE 14

Motivation Setting the stage while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} lfp Φf

lfp λE. [a = 1] · f + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • f

x

lfp λE. [a = 1] · x + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • → Initial value of x is unknown.
  • lfp Φx = limn→ω Φn

x(0) (incomputable).

→ We need bounds on least fixed points.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 3

slide-15
SLIDE 15

Motivation Setting the stage while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} lfp Φf

lfp λE. [a = 1] · f + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • f

x

lfp λE. [a = 1] · x + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • → Initial value of x is unknown.
  • lfp Φx = limn→ω Φn

x(0) (incomputable).

→ We need bounds on least fixed points.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 3

slide-16
SLIDE 16

Motivation Setting the stage while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} lfp Φf

lfp λE. [a = 1] · f + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • f

x

lfp λE. [a = 1] · x + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • → Initial value of x is unknown.
  • lfp Φx = limn→ω Φn

x(0) (incomputable).

→ We need bounds on least fixed points.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 3

slide-17
SLIDE 17

Motivation Setting the stage while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} lfp Φf

lfp λE. [a = 1] · f + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • f

x

lfp λE. [a = 1] · x + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • → Initial value of x is unknown.
  • lfp Φx = limn→ω Φn

x(0) (incomputable).

→ We need bounds on least fixed points.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 3

slide-18
SLIDE 18

Motivation Setting the stage while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} lfp Φf

lfp λE. [a = 1] · f + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • f

x

lfp λE. [a = 1] · x + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • → Initial value of x is unknown.
  • lfp Φx = limn→ω Φn

x(0) (incomputable).

→ We need bounds on least fixed points.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 3

slide-19
SLIDE 19

Motivation Setting the stage while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} lfp Φf

lfp λE. [a = 1] · f + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • f

x

lfp λE. [a = 1] · x + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • → Initial value of x is unknown.
  • lfp Φx = limn→ω Φn

x(0) (incomputable).

→ We need bounds on least fixed points.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 3

slide-20
SLIDE 20

Motivation Setting the stage while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} lfp Φf

lfp λE. [a = 1] · f + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • f

x

lfp λE. [a = 1] · x + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • → Initial value of x is unknown.
  • lfp Φx = limn→ω Φn

x(0) (incomputable).

→ We need bounds on least fixed points.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 3

slide-21
SLIDE 21

Motivation Setting the stage while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} lfp Φf

lfp λE. [a = 1] · f + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • f

x

lfp λE. [a = 1] · x + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • → Initial value of x is unknown.
  • lfp Φx = limn→ω Φn

x(0) (incomputable).

→ We need bounds on least fixed points.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 3

slide-22
SLIDE 22

Motivation Setting the stage while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} lfp Φf

lfp λE. [a = 1] · f + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • f

x

lfp λE. [a = 1] · x + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • → Initial value of x is unknown.
  • lfp Φx = limn→ω Φn

x(0) (incomputable).

→ We need bounds on least fixed points.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 3

slide-23
SLIDE 23

Motivation Setting the stage while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} lfp Φf

lfp λE. [a = 1] · f + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • f

x

lfp λE. [a = 1] · x + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • → Initial value of x is unknown.
  • lfp Φx = limn→ω Φn

x(0) (incomputable).

→ We need bounds on least fixed points.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 3

slide-24
SLIDE 24

Motivation Setting the stage while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} lfp Φf

lfp λE. [a = 1] · f + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • f

x

lfp λE. [a = 1] · x + [a = 1] · 1

2 · (E[a/0] + E[x/x + 1])

  • → Initial value of x is unknown.
  • lfp Φx = limn→ω Φn

x(0) (incomputable).

→ We need bounds on least fixed points.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 3

slide-25
SLIDE 25

Motivation Outline Motivation Upper Bounds [Park] Lower Bounds Conclusion

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 4

slide-26
SLIDE 26

Upper Bounds [Park] Outline Motivation Upper Bounds [Park] Lower Bounds Conclusion

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 5

slide-27
SLIDE 27

Upper Bounds [Park] Park Induction while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} Φx(E) = [a = 1] · x + [a = 1] · 1

2 · (E [a/0] + E [x/x + 1])

E ≥ Φx(E)

= ⇒

E ≥ lfp Φx (Superinvariant). E

:= x + [a = 1] (Intuitive guess) Φx(E) = E → E is an upper bound on lfp Φx.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 6

slide-28
SLIDE 28

Upper Bounds [Park] Park Induction while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} Φx(E) = [a = 1] · x + [a = 1] · 1

2 · (E [a/0] + E [x/x + 1])

E ≥ Φx(E)

= ⇒

E ≥ lfp Φx (Superinvariant). E

:= x + [a = 1] (Intuitive guess) Φx(E) = E → E is an upper bound on lfp Φx.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 6

slide-29
SLIDE 29

Upper Bounds [Park] Park Induction while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} Φx(E) = [a = 1] · x + [a = 1] · 1

2 · (E [a/0] + E [x/x + 1])

E ≥ Φx(E)

= ⇒

E ≥ lfp Φx (Superinvariant). E

:= x + [a = 1] (Intuitive guess) Φx(E) = E → E is an upper bound on lfp Φx.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 6

slide-30
SLIDE 30

Upper Bounds [Park] Park Induction while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} Φx(E) = [a = 1] · x + [a = 1] · 1

2 · (E [a/0] + E [x/x + 1])

E ≥ Φx(E)

= ⇒

E ≥ lfp Φx (Superinvariant). E

:= x + [a = 1] (Intuitive guess) Φx(E) = E → E is an upper bound on lfp Φx.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 6

slide-31
SLIDE 31

Upper Bounds [Park] Park Induction while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} Φx(E) = [a = 1] · x + [a = 1] · 1

2 · (E [a/0] + E [x/x + 1])

E ≥ Φx(E)

= ⇒

E ≥ lfp Φx (Superinvariant). E

:= x + [a = 1] (Intuitive guess) Φx(E) = E → E is an upper bound on lfp Φx.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 6

slide-32
SLIDE 32

Upper Bounds [Park] Park Induction while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} Φx(E) = [a = 1] · x + [a = 1] · 1

2 · (E [a/0] + E [x/x + 1])

E ≥ Φx(E)

= ⇒

E ≥ lfp Φx (Superinvariant). E

:= x + [a = 1] (Intuitive guess) Φx(E) = E → E is an upper bound on lfp Φx.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 6

slide-33
SLIDE 33

Upper Bounds [Park] Upper Bounds

  • Rule for upper bounds Φf (E) ≥ E is simple.

(Inductive)

  • Not a surprise, bound a least fixed point from above.

→ Enough to bound any fixed point from above.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 7

slide-34
SLIDE 34

Upper Bounds [Park] Upper Bounds

  • Rule for upper bounds Φf (E) ≥ E is simple.

(Inductive)

  • Not a surprise, bound a least fixed point from above.

→ Enough to bound any fixed point from above.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 7

slide-35
SLIDE 35

Upper Bounds [Park] Upper Bounds

  • Rule for upper bounds Φf (E) ≥ E is simple.

(Inductive)

  • Not a surprise, bound a least fixed point from above.

→ Enough to bound any fixed point from above.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 7

slide-36
SLIDE 36

Upper Bounds [Park] Upper Bounds

  • Rule for upper bounds Φf (E) ≥ E is simple.

(Inductive)

  • Not a surprise, bound a least fixed point from above.

→ Enough to bound any fixed point from above.

E

Φx(E) lfp Φx

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 7

slide-37
SLIDE 37

Upper Bounds [Park] Upper Bounds

  • Rule for upper bounds Φf (E) ≥ E is simple.

(Inductive)

  • Not a surprise, bound a least fixed point from above.

→ Enough to bound any fixed point from above.

E

Φ2

x(E)

lfp Φx

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 7

slide-38
SLIDE 38

Upper Bounds [Park] Upper Bounds

  • Rule for upper bounds Φf (E) ≥ E is simple.

(Inductive)

  • Not a surprise, bound a least fixed point from above.

→ Enough to bound any fixed point from above.

E

Φω

x (E)

lfp Φx

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 7

slide-39
SLIDE 39

Upper Bounds [Park] Upper Bounds

  • Rule for upper bounds Φf (E) ≥ E is simple.

(Inductive)

  • Not a surprise, bound a least fixed point from above.

→ Enough to bound any fixed point from above.

E

Φω

x (E)

lfp Φx

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 7

slide-40
SLIDE 40

Upper Bounds [Park] Upper Bounds

  • Rule for upper bounds Φf (E) ≥ E is simple.

(Inductive)

  • Not a surprise, bound a least fixed point from above.

→ Enough to bound any fixed point from above.

E

Φω

x (E)

lfp Φx

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 7

slide-41
SLIDE 41

Upper Bounds [Park] Upper Bounds

No information on quality of the bound. → We also need lower bounds.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 8

slide-42
SLIDE 42

Upper Bounds [Park] Upper Bounds

No information on quality of the bound. → We also need lower bounds.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 8

slide-43
SLIDE 43

Upper Bounds [Park] Upper Bounds

No information on quality of the bound. → We also need lower bounds.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 8

slide-44
SLIDE 44

Lower Bounds Outline Motivation Upper Bounds [Park] Lower Bounds Conclusion

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 9

slide-45
SLIDE 45

Lower Bounds Subinvariants

E ≥ Φx(E)

= ⇒

E ≥ lfp Φx (Superinvariant). E ≤ Φx(E)

= ⇒

E ≤ lfp Φx (Subinvariant) ???.

Not absurd: Sound for deterministic programs. [Frohn et al. 16]

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 10

slide-46
SLIDE 46

Lower Bounds Subinvariants

E ≥ Φx(E)

= ⇒

E ≥ lfp Φx (Superinvariant). E ≤ Φx(E)

= ⇒

E ≤ lfp Φx (Subinvariant) ???.

Not absurd: Sound for deterministic programs. [Frohn et al. 16]

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 10

slide-47
SLIDE 47

Lower Bounds Subinvariants

E ≥ Φx(E)

= ⇒

E ≥ lfp Φx (Superinvariant). E ≤ Φx(E)

= ⇒

E ≤ lfp Φx (Subinvariant) ???.

Not absurd: Sound for deterministic programs. [Frohn et al. 16]

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 10

slide-48
SLIDE 48

Lower Bounds Subinvariants

E ≥ Φx(E)

= ⇒

E ≥ lfp Φx (Superinvariant). E ≤ Φx(E)

= ⇒

E ≤ lfp Φx (Subinvariant) ???.

Not absurd: Sound for deterministic programs. [Frohn et al. 16]

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 10

slide-49
SLIDE 49

Lower Bounds

E ≤ Φx(E)

= ⇒

E ≤ lfp Φx

Subinvariants while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} Φx(E) = [a = 1] · x + [a = 1] · 1

2 · (E [a/0] + E [x/x + 1]).

E ′ := x + [a = 1] · (1 + 2x)

→ E ′ ≤ Φx(E ′), so E ′ is a lower bound ??? → E ′ ≤ Φx(E ′), so E ′ is a lower bound

  • Already seen upper bound by superinvariant E = x + [a = 1].

E′≤E.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 11

slide-50
SLIDE 50

Lower Bounds

E ≤ Φx(E)

= ⇒

E ≤ lfp Φx

Subinvariants while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} Φx(E) = [a = 1] · x + [a = 1] · 1

2 · (E [a/0] + E [x/x + 1]).

E ′ := x + [a = 1] · (1 + 2x)

→ E ′ ≤ Φx(E ′), so E ′ is a lower bound ??? → E ′ ≤ Φx(E ′), so E ′ is a lower bound

  • Already seen upper bound by superinvariant E = x + [a = 1].

E′≤E.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 11

slide-51
SLIDE 51

Lower Bounds

E ≤ Φx(E)

= ⇒

E ≤ lfp Φx

Subinvariants while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} Φx(E) = [a = 1] · x + [a = 1] · 1

2 · (E [a/0] + E [x/x + 1]).

E ′ := x + [a = 1] · (1 + 2x)

→ E ′ ≤ Φx(E ′), so E ′ is a lower bound ??? → E ′ ≤ Φx(E ′), so E ′ is a lower bound

  • Already seen upper bound by superinvariant E = x + [a = 1].

E′≤E.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 11

slide-52
SLIDE 52

Lower Bounds

E ≤ Φx(E)

= ⇒

E ≤ lfp Φx

Subinvariants while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} Φx(E) = [a = 1] · x + [a = 1] · 1

2 · (E [a/0] + E [x/x + 1]).

E ′ := x + [a = 1] · (1 + 2x)

→ E ′ ≤ Φx(E ′), so E ′ is a lower bound ??? → E ′ ≤ Φx(E ′), so E ′ is a lower bound

  • Already seen upper bound by superinvariant E = x + [a = 1].

E′≤E.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 11

slide-53
SLIDE 53

Lower Bounds

E ≤ Φx(E)

= ⇒

E ≤ lfp Φx

Subinvariants while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} Φx(E) = [a = 1] · x + [a = 1] · 1

2 · (E [a/0] + E [x/x + 1]).

E ′ := x + [a = 1] · (1 + 2x)

→ E ′ ≤ Φx(E ′), so E ′ is a lower bound ??? → E ′ ≤ Φx(E ′), so E ′ is a lower bound

  • Already seen upper bound by superinvariant E = x + [a = 1].

E′≤E.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 11

slide-54
SLIDE 54

Lower Bounds

E ≤ Φx(E)

= ⇒

E ≤ lfp Φx

Subinvariants while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

} Φx(E) = [a = 1] · x + [a = 1] · 1

2 · (E [a/0] + E [x/x + 1]).

E ′ := x + [a = 1] · (1 + 2x)

→ E ′ ≤ Φx(E ′), so E ′ is a lower bound ??? → E ′ ≤ Φx(E ′), so E ′ is a lower bound

  • Already seen upper bound by superinvariant E = x + [a = 1].

E′≤E.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 11

slide-55
SLIDE 55

Lower Bounds

E ≤ Φx(E)

= ⇒

E ≤ lfp Φx

Subinvariants

→ Subinvariants are i.g. not sound for lower bounds. → Additional requirements to extract lower bound.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 12

slide-56
SLIDE 56

Lower Bounds

E ≤ Φx(E)

= ⇒

E ≤ lfp Φx

Subinvariants

→ Subinvariants are i.g. not sound for lower bounds. → Additional requirements to extract lower bound.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 12

slide-57
SLIDE 57

Lower Bounds

E ≤ Φx(E)

= ⇒

E ≤ lfp Φx

Subinvariants

→ Subinvariants are i.g. not sound for lower bounds. → Additional requirements to extract lower bound.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 12

slide-58
SLIDE 58

Lower Bounds

E ≤ Φx(E)

= ⇒

E ≤ lfp Φx

Subinvariants

→ Subinvariants are i.g. not sound for lower bounds. → Additional requirements to extract lower bound.

Φω

x (E)

E

lfp Φx

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 12

slide-59
SLIDE 59

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

additional requirements easily checkable

= ⇒ E ≤ lfp Φf . Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

  • 1. Expected finite number of loop iterations.
  • 2. Expected change is bounded by constant.

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 13

slide-60
SLIDE 60

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

additional requirements easily checkable

= ⇒ E ≤ lfp Φf . Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

  • 1. Expected finite number of loop iterations.
  • 2. Expected change is bounded by constant.

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 13

slide-61
SLIDE 61

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

additional requirements easily checkable

= ⇒ E ≤ lfp Φf . Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

  • 1. Expected finite number of loop iterations.
  • 2. Expected change is bounded by constant.

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 13

slide-62
SLIDE 62

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

additional requirements easily checkable

= ⇒ E ≤ lfp Φf . Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

  • 1. Expected finite number of loop iterations.
  • 2. Expected change is bounded by constant.

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 13

slide-63
SLIDE 63

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

additional requirements easily checkable

= ⇒ E ≤ lfp Φf . Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

  • 1. Expected finite number of loop iterations.
  • 2. Expected change is bounded by constant.

E(s)

  • ...

E(τ1) E(τ2) E(τ3)

Exp

  • C

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 13

slide-64
SLIDE 64

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

additional requirements easily checkable

= ⇒ E ≤ lfp Φf . Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

  • 1. Expected finite number of loop iterations.
  • 2. Expected change is bounded by constant.

E(s)

  • ...

E(τ1) E(τ2) E(τ3)

Exp

  • C

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 13

slide-65
SLIDE 65

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

additional requirements easily checkable

= ⇒ E ≤ lfp Φf . Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

  • 1. Expected finite number of loop iterations.
  • 2. Expected change is bounded by constant.

E(s)

  • ...

E(τ1) E(τ2) E(τ3)

Exp

  • C

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 13

slide-66
SLIDE 66

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

additional requirements easily checkable

= ⇒ E ≤ lfp Φf . Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

  • 1. Expected finite number of loop iterations.
  • 2. Expected change is bounded by constant.

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ lfp Φf .

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 13

slide-67
SLIDE 67

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ).

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-68
SLIDE 68

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ).

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-69
SLIDE 69

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-70
SLIDE 70

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-71
SLIDE 71

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-72
SLIDE 72

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-73
SLIDE 73

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-74
SLIDE 74

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-75
SLIDE 75

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-76
SLIDE 76

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-77
SLIDE 77

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-78
SLIDE 78

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-79
SLIDE 79

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-80
SLIDE 80

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-81
SLIDE 81

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-82
SLIDE 82

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-83
SLIDE 83

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-84
SLIDE 84

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-85
SLIDE 85

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-86
SLIDE 86

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-87
SLIDE 87

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-88
SLIDE 88

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-89
SLIDE 89

Lower Bounds wp while ( ϕ ) { C } (f ) Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). Our Rule

E ≤ Φf (E)

∧

  • 1. Exp (T ¬ϕ) < ∞
  • 2. λs. [ϕ] wp C (|E − E(s)|) ≤ K for

K ∈ R≥0

= ⇒ E ≤ wp loop (f ). while ( a = 1 ) { { a := 0 }

1

2

{ x := x + 1 }

}

E

= x + [a = 1]

E ′ = x + [a = 1] · (1 + 2x)

λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E − E(s)|) (s)

=

1 2 · |x + [0 = 1] − (x + [a = 1])| + 1 2 · |x + 1 + [a = 1] − (x + [a = 1])|

=

1 2 · |− [a = 1]| + 1 2 · |1|

≤ 1 = K (constant) λs. [a = 1] · wp

  • { a := 0 }

1

2

{ x := x + 1 }

  • (|E ′ − E ′(s)|) (s)

≥ [a = 1] · (1 + 2x) Expected finite looping time: Exp

  • T (a=1) ≤ 2 · [a = 1] < ∞.

→ E is a lower bound. → E = wp

  • while ( a = 1 )

{ a := 0 } 1

2

{ x := x + 1 }

  • (x).

→ Rule is not applicable! → Good, since E ′ is not a lower bound. → Easily checkable.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 14

slide-90
SLIDE 90

Lower Bounds wp while ( ϕ ) { C } (f ) Contribution

To best of our knowledge: → First inductive rule for lower bounds. → No reasoning about limits of sequences.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 15

slide-91
SLIDE 91

Lower Bounds wp while ( ϕ ) { C } (f ) Contribution

To best of our knowledge: → First inductive rule for lower bounds. → No reasoning about limits of sequences.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 15

slide-92
SLIDE 92

Lower Bounds wp while ( ϕ ) { C } (f ) Contribution

To best of our knowledge: → First inductive rule for lower bounds. → No reasoning about limits of sequences.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 15

slide-93
SLIDE 93

Lower Bounds wp while ( ϕ ) { C } (f ) Lower Bounds for Expected Runtimes

  • Similar rule for expected runtimes (ert [Kaminski et al. 16]).
  • Only side condition: λs. [ϕ] wp C (|T − T(s)|) ≤ K for K ∈ R≥0.

Coupon Collector:

T = [0 < x ≤ N] · N · Hx + [N < x] · (N · HN + N − x) T[x/N] N · HN = N · (1 + 1

2 + · · · + 1 N) is lower bound.

Lower bound is strict but asymptotically optimal. HN appears in real world algorithm-analysis!

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 16

slide-94
SLIDE 94

Lower Bounds wp while ( ϕ ) { C } (f ) Lower Bounds for Expected Runtimes

  • Similar rule for expected runtimes (ert [Kaminski et al. 16]).
  • Only side condition: λs. [ϕ] wp C (|T − T(s)|) ≤ K for K ∈ R≥0.

Coupon Collector:

T = [0 < x ≤ N] · N · Hx + [N < x] · (N · HN + N − x) T[x/N] N · HN = N · (1 + 1

2 + · · · + 1 N) is lower bound.

Lower bound is strict but asymptotically optimal. HN appears in real world algorithm-analysis!

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 16

slide-95
SLIDE 95

Lower Bounds wp while ( ϕ ) { C } (f ) Lower Bounds for Expected Runtimes

  • Similar rule for expected runtimes (ert [Kaminski et al. 16]).
  • Only side condition: λs. [ϕ] wp C (|T − T(s)|) ≤ K for K ∈ R≥0.

Coupon Collector:

T = [0 < x ≤ N] · N · Hx + [N < x] · (N · HN + N − x) T[x/N] N · HN = N · (1 + 1

2 + · · · + 1 N) is lower bound.

Lower bound is strict but asymptotically optimal. HN appears in real world algorithm-analysis!

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 16

slide-96
SLIDE 96

Lower Bounds wp while ( ϕ ) { C } (f ) Lower Bounds for Expected Runtimes

  • Similar rule for expected runtimes (ert [Kaminski et al. 16]).
  • Only side condition: λs. [ϕ] wp C (|T − T(s)|) ≤ K for K ∈ R≥0.

Coupon Collector:

T = [0 < x ≤ N] · N · Hx + [N < x] · (N · HN + N − x) T[x/N] N · HN = N · (1 + 1

2 + · · · + 1 N) is lower bound.

Lower bound is strict but asymptotically optimal. HN appears in real world algorithm-analysis!

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 16

slide-97
SLIDE 97

Lower Bounds wp while ( ϕ ) { C } (f ) Lower Bounds for Expected Runtimes

  • Similar rule for expected runtimes (ert [Kaminski et al. 16]).
  • Only side condition: λs. [ϕ] wp C (|T − T(s)|) ≤ K for K ∈ R≥0.

Coupon Collector:

x := N

while ( 0 < x ) {

i := N + 1

while ( x < i ) {

i := Unif[1..N]

}

x := x − 1

}

T = [0 < x ≤ N] · N · Hx + [N < x] · (N · HN + N − x) T[x/N] N · HN = N · (1 + 1

2 + · · · + 1 N) is lower bound.

Lower bound is strict but asymptotically optimal. HN appears in real world algorithm-analysis!

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 16

slide-98
SLIDE 98

Lower Bounds wp while ( ϕ ) { C } (f ) Lower Bounds for Expected Runtimes

  • Similar rule for expected runtimes (ert [Kaminski et al. 16]).
  • Only side condition: λs. [ϕ] wp C (|T − T(s)|) ≤ K for K ∈ R≥0.

Coupon Collector:

x := N

while ( 0 < x ) {

i := N + 1

while ( x < i ) {

i := Unif[1..N]

}

x := x − 1

}

T = [0 < x ≤ N] · N · Hx + [N < x] · (N · HN + N − x) T[x/N] N · HN = N · (1 + 1

2 + · · · + 1 N) is lower bound.

Lower bound is strict but asymptotically optimal. HN appears in real world algorithm-analysis!

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 16

slide-99
SLIDE 99

Lower Bounds wp while ( ϕ ) { C } (f ) Lower Bounds for Expected Runtimes

  • Similar rule for expected runtimes (ert [Kaminski et al. 16]).
  • Only side condition: λs. [ϕ] wp C (|T − T(s)|) ≤ K for K ∈ R≥0.

Coupon Collector:

x := N

while ( 0 < x ) {

i := N + 1

while ( x < i ) {

i := Unif[1..N]

}

x := x − 1

}

T = [0 < x ≤ N] · N · Hx + [N < x] · (N · HN + N − x) T[x/N] N · HN = N · (1 + 1

2 + · · · + 1 N) is lower bound.

Lower bound is strict but asymptotically optimal. HN appears in real world algorithm-analysis!

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 16

slide-100
SLIDE 100

Lower Bounds wp while ( ϕ ) { C } (f ) Lower Bounds for Expected Runtimes

  • Similar rule for expected runtimes (ert [Kaminski et al. 16]).
  • Only side condition: λs. [ϕ] wp C (|T − T(s)|) ≤ K for K ∈ R≥0.

Coupon Collector:

x := N

while ( 0 < x ) {

i := N + 1

while ( x < i ) {

i := Unif[1..N]

}

x := x − 1

}

T = [0 < x ≤ N] · N · Hx + [N < x] · (N · HN + N − x) T[x/N] N · HN = N · (1 + 1

2 + · · · + 1 N) is lower bound.

Lower bound is strict but asymptotically optimal. HN appears in real world algorithm-analysis!

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 16

slide-101
SLIDE 101

Lower Bounds wp while ( ϕ ) { C } (f ) Lower Bounds for Expected Runtimes

  • Similar rule for expected runtimes (ert [Kaminski et al. 16]).
  • Only side condition: λs. [ϕ] wp C (|T − T(s)|) ≤ K for K ∈ R≥0.

Coupon Collector:

x := N

while ( 0 < x ) {

i := N + 1

while ( x < i ) {

i := Unif[1..N]

}

x := x − 1

}

T = [0 < x ≤ N] · N · Hx + [N < x] · (N · HN + N − x) T[x/N] N · HN = N · (1 + 1

2 + · · · + 1 N) is lower bound.

Lower bound is strict but asymptotically optimal. HN appears in real world algorithm-analysis!

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 16

slide-102
SLIDE 102

Lower Bounds wp while ( ϕ ) { C } (f ) Lower Bounds for Expected Runtimes

  • Similar rule for expected runtimes (ert [Kaminski et al. 16]).
  • Only side condition: λs. [ϕ] wp C (|T − T(s)|) ≤ K for K ∈ R≥0.

Coupon Collector:

x := N

while ( 0 < x ) {

i := N + 1

while ( x < i ) {

i := Unif[1..N]

}

x := x − 1

}

T = [0 < x ≤ N] · N · Hx + [N < x] · (N · HN + N − x) T[x/N] N · HN = N · (1 + 1

2 + · · · + 1 N) is lower bound.

Lower bound is strict but asymptotically optimal. HN appears in real world algorithm-analysis!

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 16

slide-103
SLIDE 103

Conclusion Outline Motivation Upper Bounds [Park] Lower Bounds Conclusion

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 17

slide-104
SLIDE 104

Conclusion Summary

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 18

slide-105
SLIDE 105

Conclusion Summary

  • Inductive rule for deriving lower bounds on (unbounded) postexpectations.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 18

slide-106
SLIDE 106

Conclusion Summary

  • Inductive rule for deriving lower bounds on (unbounded) postexpectations.
  • Inductive rule for deriving lower bounds on expected runtimes.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 18

slide-107
SLIDE 107

Conclusion Summary

  • Inductive rule for deriving lower bounds on (unbounded) postexpectations.
  • Inductive rule for deriving lower bounds on expected runtimes.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 18

slide-108
SLIDE 108

Conclusion Summary

  • Inductive rule for deriving lower bounds on (unbounded) postexpectations.
  • Inductive rule for deriving lower bounds on expected runtimes.

Future Work

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 18

slide-109
SLIDE 109

Conclusion Summary

  • Inductive rule for deriving lower bounds on (unbounded) postexpectations.
  • Inductive rule for deriving lower bounds on expected runtimes.

Future Work

  • Generalization to mixed sign expectations.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 18

slide-110
SLIDE 110

Conclusion Summary

  • Inductive rule for deriving lower bounds on (unbounded) postexpectations.
  • Inductive rule for deriving lower bounds on expected runtimes.

Future Work

  • Generalization to mixed sign expectations.
  • Automation.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 18

slide-111
SLIDE 111

Conclusion Summary

  • Inductive rule for deriving lower bounds on (unbounded) postexpectations.
  • Inductive rule for deriving lower bounds on expected runtimes.

Future Work

  • Generalization to mixed sign expectations.
  • Automation.

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 18

slide-112
SLIDE 112

Conclusion Summary

  • Inductive rule for deriving lower bounds on (unbounded) postexpectations.
  • Inductive rule for deriving lower bounds on expected runtimes.

Future Work

  • Generalization to mixed sign expectations.
  • Automation.

Thank you

POPL 2020– Aiming Low is Harder – Hark, Kaminski, Giesl, Katoen – 1/25/20 – 18