Weakest Precondition Reasoning for Expected RunTimes of - - PowerPoint PPT Presentation

▶
weakest precondition reasoning for expected run times of
SMART_READER_LITE
LIVE PREVIEW

Weakest Precondition Reasoning for Expected RunTimes of - - PowerPoint PPT Presentation

Jan 15, 2024 157 likes •1.3k views

Weakest Precondition Reasoning for Expected RunTimes of Probabilistic Programs Benjamin Kaminski Joost-Pieter Katoen Christoph Matheja Federico Olmedo 25th European Symposium on Programming 19th edition of the European Joint Conferences on

slide-1
SLIDE 1

Weakest Precondition Reasoning for Expected Run–Times of Probabilistic Programs

Benjamin Kaminski Joost-Pieter Katoen Christoph Matheja Federico Olmedo 25th European Symposium on Programming

19th edition of the European Joint Conferences on Theory & Practice of Software

April 4, 2016, Eindhoven, Netherlands

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 1

slide-2
SLIDE 2

Motivation Probabilistic Programs

Probabilistic Programs

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 2

slide-3
SLIDE 3

Motivation Probabilistic Programs

Probabilistic Programs

Introduce randomization into computation

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 2

slide-4
SLIDE 4

Motivation Probabilistic Programs

Probabilistic Programs

Introduce randomization into computation Significant speed–up in solving difficult problems at cost of tolerating incorrect results with low probability

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 2

slide-5
SLIDE 5

Motivation Probabilistic Programs

Probabilistic Programs

Introduce randomization into computation Significant speed–up in solving difficult problems at cost of tolerating incorrect results with low probability Solution to problems where deterministic techniques fail:

E.g. symmetry breaking in Dining Philosophers, Leader Election, Ethernet’s randomized exponential backoff

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 2

slide-6
SLIDE 6

Motivation Probabilistic Programs

Probabilistic Programs

Introduce randomization into computation Significant speed–up in solving difficult problems at cost of tolerating incorrect results with low probability Solution to problems where deterministic techniques fail:

E.g. symmetry breaking in Dining Philosophers, Leader Election, Ethernet’s randomized exponential backoff

Randomization of some sort occurs almost in any technique related used in cryptography and security

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 2

slide-7
SLIDE 7

Motivation Probabilistic Programs

Probabilistic Programs

Introduce randomization into computation Significant speed–up in solving difficult problems at cost of tolerating incorrect results with low probability Solution to problems where deterministic techniques fail:

E.g. symmetry breaking in Dining Philosophers, Leader Election, Ethernet’s randomized exponential backoff

Randomization of some sort occurs almost in any technique related used in cryptography and security Model probability distributions in machine learning

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 2

slide-8
SLIDE 8

Motivation Probabilistic Programs

Syntax of Probabilistic Programs

C − → skip

  • x := E
  • C; C
  • {C} {C}
  • if (ξ) {C} else {C}
  • while (ξ) {C}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 3

slide-9
SLIDE 9

Motivation Probabilistic Programs

Syntax of Probabilistic Programs

C − → skip

  • x := E
  • C; C
  • {C} {C}
  • if (ξ) {C} else {C}
  • while (ξ) {C}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 3

slide-10
SLIDE 10

Motivation Probabilistic Programs

Syntax of Probabilistic Programs

C − → skip

  • x := E
  • C; C
  • {C} {C}
  • if (ξ) {C} else {C}
  • while (ξ) {C}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 3

slide-11
SLIDE 11

Motivation Probabilistic Programs

Syntax of Probabilistic Programs

C − → skip

  • x := E
  • C; C
  • {C} {C}
  • if (ξ) {C} else {C}
  • while (ξ) {C}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 3

slide-12
SLIDE 12

Motivation Probabilistic Programs

Syntax of Probabilistic Programs

C − → skip

  • x := E
  • C; C
  • {C} {C}
  • if (ξ) {C} else {C}
  • while (ξ) {C}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 3

slide-13
SLIDE 13

Motivation Probabilistic Programs

Syntax of Probabilistic Programs

C − → skip

  • x := E
  • C; C
  • {C} {C}
  • if (ξ) {C} else {C}
  • while (ξ) {C}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 3

slide-14
SLIDE 14

Motivation Probabilistic Programs

Syntax of Probabilistic Programs

C − → skip

  • x := E
  • C; C
  • {C} {C}
  • if (ξ) {C} else {C}
  • while (ξ) {C}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 3

slide-15
SLIDE 15

Motivation Probabilistic Programs

Syntax of Probabilistic Programs

C − → skip

  • x := E
  • C; C
  • {C} {C}
  • if (ξ) {C} else {C}
  • while (ξ) {C}

What is probabilistic about that language?

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 3

slide-16
SLIDE 16

Motivation Probabilistic Programs

Syntax of Probabilistic Programs

C − → skip

  • x := E
  • C; C
  • {C} {C}
  • if (ξ) {C} else {C}
  • while (ξ) {C}

What is probabilistic about that language? Probabilistic guards ξ : Σ → D({true, false}):

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 3

slide-17
SLIDE 17

Motivation Probabilistic Programs

Syntax of Probabilistic Programs

C − → skip

  • x := E
  • C; C
  • {C} {C}
  • if (ξ) {C} else {C}
  • while (ξ) {C}

What is probabilistic about that language? Probabilistic guards ξ : Σ → D({true, false}):

ξ : true(σ) = 1 − ξ : false(σ) is the probability of ξ evaluating to true

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 3

slide-18
SLIDE 18

Motivation Probabilistic Programs

Syntax of Probabilistic Programs

C − → skip

  • x := E
  • C; C
  • {C} {C}
  • if (ξ) {C} else {C}
  • while (ξ) {C}

What is probabilistic about that language? Probabilistic guards ξ : Σ → D({true, false}):

ξ : true(σ) = 1 − ξ : false(σ) is the probability of ξ evaluating to true E.g.

2 3true + 1 3false

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 3

slide-19
SLIDE 19

Motivation Probabilistic Programs

Syntax of Probabilistic Programs

C − → skip

  • x := E
  • C; C
  • {C} {C}
  • if (ξ) {C} else {C}
  • while (ξ) {C}

What is probabilistic about that language? Probabilistic guards ξ : Σ → D({true, false}):

ξ : true(σ) = 1 − ξ : false(σ) is the probability of ξ evaluating to true E.g.

2 3true + 1 3false, 1 2x > y + 1 2x ≥ y

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 3

slide-20
SLIDE 20

Motivation Probabilistic Programs

Probabilistic Programs

What does a probabilistic program C do?

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 4

slide-21
SLIDE 21

Motivation Probabilistic Programs

Probabilistic Programs

What does a probabilistic program C do? Run program C on initial state σ

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 4

slide-22
SLIDE 22

Motivation Probabilistic Programs

Probabilistic Programs

What does a probabilistic program C do? Run program C on initial state σ Obtain final set of distributions µ over terminal states

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 4

slide-23
SLIDE 23

Motivation Probabilistic Programs

Probabilistic Programs

What does a probabilistic program C do? Run program C on initial state σ Obtain final set of (sub–)distributions µ over terminal states

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 4

slide-24
SLIDE 24

Motivation Probabilistic Programs

Probabilistic Programs

What does a probabilistic program C do? Run program C on initial state σ Obtain final set of (sub–)distributions µ over terminal states What is the run–time of C on input σ?

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 4

slide-25
SLIDE 25

Motivation Probabilistic Programs

Probabilistic Programs

What does a probabilistic program C do? Run program C on initial state σ Obtain final set of (sub–)distributions µ over terminal states What is the run–time of C on input σ? Behavior of C not entirely determined by σ

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 4

slide-26
SLIDE 26

Motivation Probabilistic Programs

Probabilistic Programs

What does a probabilistic program C do? Run program C on initial state σ Obtain final set of (sub–)distributions µ over terminal states What is the run–time of C on input σ? Behavior of C not entirely determined by σ Probabilistic nature of C influences its run–time

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 4

slide-27
SLIDE 27

Motivation Probabilistic Programs

Probabilistic Programs

What does a probabilistic program C do? Run program C on initial state σ Obtain final set of (sub–)distributions µ over terminal states What is the run–time of C on input σ? Behavior of C not entirely determined by σ Probabilistic nature of C influences its run–time

Better Question: What is the expected run–time (ERT) of C on input σ?

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 4

slide-28
SLIDE 28

Motivation Expected Run–Times

Expected Run–Time Phenomena

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 5

slide-29
SLIDE 29

Motivation Expected Run–Times

Expected Run–Time Phenomena

ERT of C can be finite even if C admits infinite computations

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 5

slide-30
SLIDE 30

Motivation Expected Run–Times

Expected Run–Time Phenomena

ERT of C can be finite even if C admits infinite computations x := 1; while (1/2) {x := 2 · x}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 5

slide-31
SLIDE 31

Motivation Expected Run–Times

Expected Run–Time Phenomena

ERT of C can be finite even if C admits infinite computations x := 1; while (1/2) {x := 2 · x}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 5

slide-32
SLIDE 32

Motivation Expected Run–Times

Expected Run–Time Phenomena

ERT of C can be finite even if C admits infinite computations Positive almost–sure termination: x := 1; while (1/2) {x := 2 · x}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 5

slide-33
SLIDE 33

Motivation Expected Run–Times

Expected Run–Time Phenomena

ERT of C can be finite even if C admits infinite computations Positive almost–sure termination:

ERT of C is finite

x := 1; while (1/2) {x := 2 · x}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 5

slide-34
SLIDE 34

Motivation Expected Run–Times

Expected Run–Time Phenomena

ERT of C can be finite even if C admits infinite computations Positive almost–sure termination:

ERT of C is finite

x := 1; while (1/2) {x := 2 · x}; while (x > 0) {x := x − 1}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 5

slide-35
SLIDE 35

Motivation Expected Run–Times

Expected Run–Time Phenomena

ERT of C can be finite even if C admits infinite computations Positive almost–sure termination:

ERT of C is finite Positively almost–surely terminating programs are not closed under sequential composition

x := 1; while (1/2) {x := 2 · x}; while (x > 0) {x := x − 1}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 5

slide-36
SLIDE 36

Motivation Expected Run–Times

Expected Run–Time Phenomena

ERT of C can be finite even if C admits infinite computations Positive almost–sure termination:

ERT of C is finite Positively almost–surely terminating programs are not closed under sequential composition Reasoning about positive almost–sure termination is computationally very difficult:

x := 1; while (1/2) {x := 2 · x}; while (x > 0) {x := x − 1}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 5

slide-37
SLIDE 37

Motivation Expected Run–Times

Expected Run–Time Phenomena

ERT of C can be finite even if C admits infinite computations Positive almost–sure termination:

ERT of C is finite Positively almost–surely terminating programs are not closed under sequential composition Reasoning about positive almost–sure termination is computationally very difficult:

Strictly more difficult than the termination problem for non–probabilistic programs [MFCS 2015]

x := 1; while (1/2) {x := 2 · x}; while (x > 0) {x := x − 1}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 5

slide-38
SLIDE 38

Motivation Expected Run–Times

Expected Run–Time Phenomena

ERT of C can be finite even if C admits infinite computations Positive almost–sure termination:

ERT of C is finite Positively almost–surely terminating programs are not closed under sequential composition Reasoning about positive almost–sure termination is computationally very difficult:

Strictly more difficult than the termination problem for non–probabilistic programs [MFCS 2015]

ERT of C can be infinite, even if C terminates almost–surely1 x := 1; while (1/2) {x := 2 · x}; while (x > 0) {x := x − 1}

1i.e. with probability 1 Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 5

slide-39
SLIDE 39

Motivation Expected Run–Times

Expected Run–Times

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 6

slide-40
SLIDE 40

Motivation Expected Run–Times

Expected Run–Times

ERT if C terminates almost–surely on σ:

∞

  • i=1

i · Pr “C terminates after i steps on input σ”

  • Kaminski, Katoen, Matheja, Olmedo

Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 6

slide-41
SLIDE 41

Motivation Expected Run–Times

Expected Run–Times

ERT if C terminates almost–surely on σ:

∞

  • i=1

i · Pr “C terminates after i steps on input σ”

  • ERT if C does not terminate almost–surely on σ:

∞

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 6

slide-42
SLIDE 42

Motivation Expected Run–Times

Expected Run–Times

ERT if C terminates almost–surely on σ:

∞

  • i=1

i · Pr “C terminates after i steps on input σ”

  • ERT if C does not terminate almost–surely on σ:

∞ In general: ERT of C is a function t: Σ → R∞

≥0

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 6

slide-43
SLIDE 43

Motivation Expected Run–Times

Expected Run–Times

ERT if C terminates almost–surely on σ:

∞

  • i=1

i · Pr “C terminates after i steps on input σ”

  • ERT if C does not terminate almost–surely on σ:

∞ In general: ERT of C is a function t: Σ → R∞

≥0

Call such a t a run–time.

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 6

slide-44
SLIDE 44

Motivation Expected Run–Times

Expected Run–Times

ERT if C terminates almost–surely on σ:

∞

  • i=1

i · Pr “C terminates after i steps on input σ”

  • ERT if C does not terminate almost–surely on σ:

∞ In general: ERT of C is a function t: Σ → R∞

≥0

Call such a t a run–time. Denote set of run–times by T.

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 6

slide-45
SLIDE 45

Motivation Expected Run–Times

Expected Run–Times

ERT if C terminates almost–surely on σ:

∞

  • i=1

i · Pr “C terminates after i steps on input σ”

  • ERT if C does not terminate almost–surely on σ:

∞ In general: ERT of C is a function t: Σ → R∞

≥0

Call such a t a run–time. Denote set of run–times by T. Complete partial order on T: t1 t2 iff ∀ σ ∈ Σ: t1(σ) ≤ t2(σ)

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 6

slide-46
SLIDE 46

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Weakest Precondition Reasoning for Expected Run–Times

The ert Transformer

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 7

slide-47
SLIDE 47

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Weakest Precondition Reasoning for Expected Run–Times

The ert Transformer

Use a continuation passing style ERT transformer ert[C]: T → T.

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 7

slide-48
SLIDE 48

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Weakest Precondition Reasoning for Expected Run–Times

The ert Transformer

Use a continuation passing style ERT transformer ert[C]: T → T. C

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 7

slide-49
SLIDE 49

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Weakest Precondition Reasoning for Expected Run–Times

The ert Transformer

Use a continuation passing style ERT transformer ert[C]: T → T. C t

time needed after executing C

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 7

slide-50
SLIDE 50

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Weakest Precondition Reasoning for Expected Run–Times

The ert Transformer

Use a continuation passing style ERT transformer ert[C]: T → T. C t

time needed after executing C

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 7

slide-51
SLIDE 51

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Weakest Precondition Reasoning for Expected Run–Times

The ert Transformer

Use a continuation passing style ERT transformer ert[C]: T → T. C t ert [C] (t)

time needed after executing C expected time needed before executing C

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 7

slide-52
SLIDE 52

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Weakest Precondition Reasoning for Expected Run–Times

The ert Transformer

Use a continuation passing style ERT transformer ert[C]: T → T. C t ert [C] (t)

time needed after executing C expected time needed before executing C

ERT in Terms of ert

ert [C] (0) (σ) = “ERT of C on input σ”

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 7

slide-53
SLIDE 53

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Rules for the ert Transformer

C ert [C] (t) skip 1 + t

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 8

slide-54
SLIDE 54

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Rules for the ert Transformer

C ert [C] (t) skip 1 + t x := E 1 + t [x/E]

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 8

slide-55
SLIDE 55

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Rules for the ert Transformer

C ert [C] (t) skip 1 + t x := E 1 + t [x/E]

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 8

slide-56
SLIDE 56

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Rules for the ert Transformer

C ert [C] (t) skip 1 + t x := E 1 + t [x/E] C1; C2 ert [C1] (ert [C2] (t))

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 8

slide-57
SLIDE 57

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Rules for the ert Transformer

C ert [C] (t) skip 1 + t x := E 1 + t [x/E] C1; C2 ert [C1] (ert [C2] (t)) {C1} {C2} max{ert [C1] (t) , ert [C2] (t)}

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 8

slide-58
SLIDE 58

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Rules for the ert Transformer

C ert [C] (t) skip 1 + t x := E 1 + t [x/E] C1; C2 ert [C1] (ert [C2] (t)) {C1} {C2} max{ert [C1] (t) , ert [C2] (t)} if (ξ) {C1} else {C2} 1 + ξ : true · ert [C1] (t) + ξ : false · ert [C2] (t)

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 8

slide-59
SLIDE 59

Weakest Precondition Reasoning for Expected Run–Times The ert Transformer

Rules for the ert Transformer

C ert [C] (t) skip 1 + t x := E 1 + t [x/E] C1; C2 ert [C1] (ert [C2] (t)) {C1} {C2} max{ert [C1] (t) , ert [C2] (t)} if (ξ) {C1} else {C2} 1 + ξ : true · ert [C1] (t) + ξ : false · ert [C2] (t) while (ξ) {C′} lfp X • 1 + ξ : false · t + ξ : true · ert [C′] (X)

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 8

slide-60
SLIDE 60

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Upper Bounds for ert of Loops

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 9

slide-61
SLIDE 61

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Upper Bounds for ert of Loops

Recall the definition of ert [while (ξ) {C}] (t): lfp X• 1 + ξ : false · t + ξ : true · ert [C] (X)

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 9

slide-62
SLIDE 62

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Upper Bounds for ert of Loops

Recall the definition of ert [while (ξ) {C}] (t): lfp X• 1 + ξ : false · t + ξ : true · ert [C] (X)

  • =: F(X)

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 9

slide-63
SLIDE 63

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Upper Bounds for ert of Loops

Recall the definition of ert [while (ξ) {C}] (t): lfp X• 1 + ξ : false · t + ξ : true · ert [C] (X)

  • =: F(X)

Theorem: Upper Bounds from Upper Invariants

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 9

slide-64
SLIDE 64

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Upper Bounds for ert of Loops

Recall the definition of ert [while (ξ) {C}] (t): lfp X• 1 + ξ : false · t + ξ : true · ert [C] (X)

  • =: F(X)

Theorem: Upper Bounds from Upper Invariants

If I ∈ T is an upper invariant of while (ξ) {C}, i.e. if F(I) I

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 9

slide-65
SLIDE 65

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Upper Bounds for ert of Loops

Recall the definition of ert [while (ξ) {C}] (t): lfp X• 1 + ξ : false · t + ξ : true · ert [C] (X)

  • =: F(X)

Theorem: Upper Bounds from Upper Invariants

If I ∈ T is an upper invariant of while (ξ) {C}, i.e. if F(I) I then ert [while (ξ) {C}] (t) I .

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 9

slide-66
SLIDE 66

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Lower Bounds for ert of Loops

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 10

slide-67
SLIDE 67

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Lower Bounds for ert of Loops

Reasoning on lower bounds is more involved: Find an argument for being below a least fixed point

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 10

slide-68
SLIDE 68

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Lower Bounds for ert of Loops

Reasoning on lower bounds is more involved: Find an argument for being below a least fixed point

Theorem: Lower Bounds from Lower ω–Invariants

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 10

slide-69
SLIDE 69

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Lower Bounds for ert of Loops

Reasoning on lower bounds is more involved: Find an argument for being below a least fixed point

Theorem: Lower Bounds from Lower ω–Invariants

If {In}n∈N ⊆ T is a lower ω–invariant, i.e. if I0 F(0), and In+1 F(In)

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 10

slide-70
SLIDE 70

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Lower Bounds for ert of Loops

Reasoning on lower bounds is more involved: Find an argument for being below a least fixed point

Theorem: Lower Bounds from Lower ω–Invariants

If {In}n∈N ⊆ T is a lower ω–invariant, i.e. if I0 F(0), and In+1 F(In) then sup

n∈N

In ert [while (ξ) {C}] (t) .

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 10

slide-71
SLIDE 71

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Theorem: Completeness of Proof Rules

The presented proof rules are complete

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 11

slide-72
SLIDE 72

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Theorem: Completeness of Proof Rules

The presented proof rules are complete, since I = lfp F is an upper invariant

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 11

slide-73
SLIDE 73

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Theorem: Completeness of Proof Rules

The presented proof rules are complete, since I = lfp F is an upper invariant and a lower ω–invariant is given by In = F ◦ · · · ◦ F

  • n times

(0) .

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 11

slide-74
SLIDE 74

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Theorem: Completeness of Proof Rules

The presented proof rules are complete, since I = lfp F is an upper invariant and a lower ω–invariant is given by In = F ◦ · · · ◦ F

  • n times

(0) .

Theorem: Bound Refinement

If I is an upper bound and F(I) I, then F(I) is also an upper bound.

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 11

slide-75
SLIDE 75

Weakest Precondition Reasoning for Expected Run–Times Reasoning about ert

Theorem: Completeness of Proof Rules

The presented proof rules are complete, since I = lfp F is an upper invariant and a lower ω–invariant is given by In = F ◦ · · · ◦ F

  • n times

(0) .

Theorem: Bound Refinement

If I is an upper bound and F(I) I, then F(I) is also an upper

  • bound. Dually for lower bounds.

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 11

slide-76
SLIDE 76

Weakest Precondition Reasoning for Expected Run–Times Correspondence to Other Run–Time Models

Is the ert Calculus a Reasonable Run–Time Model?

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 12

slide-77
SLIDE 77

Weakest Precondition Reasoning for Expected Run–Times Correspondence to Other Run–Time Models

Is the ert Calculus a Reasonable Run–Time Model?

Correspondence to an operational semantics:

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 12

slide-78
SLIDE 78

Weakest Precondition Reasoning for Expected Run–Times Correspondence to Other Run–Time Models

Is the ert Calculus a Reasonable Run–Time Model?

Correspondence to an operational semantics:

Operational model defined in terms of a reward MDP ` a la [QEST 2012] and [MFPS 2015]

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 12

slide-79
SLIDE 79

Weakest Precondition Reasoning for Expected Run–Times Correspondence to Other Run–Time Models

Is the ert Calculus a Reasonable Run–Time Model?

Correspondence to an operational semantics:

Operational model defined in terms of a reward MDP ` a la [QEST 2012] and [MFPS 2015] ert coincides with expected reward in the operational MDP

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 12

slide-80
SLIDE 80

Weakest Precondition Reasoning for Expected Run–Times Correspondence to Other Run–Time Models

Is the ert Calculus a Reasonable Run–Time Model?

Correspondence to an operational semantics:

Operational model defined in terms of a reward MDP ` a la [QEST 2012] and [MFPS 2015] ert coincides with expected reward in the operational MDP Enables bounded model checking of expected run–times

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 12

slide-81
SLIDE 81

Weakest Precondition Reasoning for Expected Run–Times Correspondence to Other Run–Time Models

Is the ert Calculus a Reasonable Run–Time Model?

Correspondence to an operational semantics:

Operational model defined in terms of a reward MDP ` a la [QEST 2012] and [MFPS 2015] ert coincides with expected reward in the operational MDP Enables bounded model checking of expected run–times

Nielson’s Hoare–style logic for reasoning about run–time

  • rders of magnitude of deterministic programs:

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 12

slide-82
SLIDE 82

Weakest Precondition Reasoning for Expected Run–Times Correspondence to Other Run–Time Models

Is the ert Calculus a Reasonable Run–Time Model?

Correspondence to an operational semantics:

Operational model defined in terms of a reward MDP ` a la [QEST 2012] and [MFPS 2015] ert coincides with expected reward in the operational MDP Enables bounded model checking of expected run–times

Nielson’s Hoare–style logic for reasoning about run–time

  • rders of magnitude of deterministic programs:

Nielson’s logic relies on introducing additional logical variables

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 12

slide-83
SLIDE 83

Weakest Precondition Reasoning for Expected Run–Times Correspondence to Other Run–Time Models

Is the ert Calculus a Reasonable Run–Time Model?

Correspondence to an operational semantics:

Operational model defined in terms of a reward MDP ` a la [QEST 2012] and [MFPS 2015] ert coincides with expected reward in the operational MDP Enables bounded model checking of expected run–times

Nielson’s Hoare–style logic for reasoning about run–time

  • rders of magnitude of deterministic programs:

Nielson’s logic relies on introducing additional logical variables ert is sound and complete with respect to Nielson’s logic

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 12

slide-84
SLIDE 84

Weakest Precondition Reasoning for Expected Run–Times Correspondence to Other Run–Time Models

Is the ert Calculus a Reasonable Run–Time Model?

Correspondence to an operational semantics:

Operational model defined in terms of a reward MDP ` a la [QEST 2012] and [MFPS 2015] ert coincides with expected reward in the operational MDP Enables bounded model checking of expected run–times

Nielson’s Hoare–style logic for reasoning about run–time

  • rders of magnitude of deterministic programs:

Nielson’s logic relies on introducing additional logical variables ert is sound and complete with respect to Nielson’s logic ert calculus is arguably easier to apply — no additional variables!

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 12

slide-85
SLIDE 85

Weakest Precondition Reasoning for Expected Run–Times Case Study

Case Study: The Coupon Collector’s Problem

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 13

slide-86
SLIDE 86

Weakest Precondition Reasoning for Expected Run–Times Case Study

Case Study: The Coupon Collector’s Problem

The coupon collector is a well–known problem

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 13

slide-87
SLIDE 87

Weakest Precondition Reasoning for Expected Run–Times Case Study

Case Study: The Coupon Collector’s Problem

The coupon collector is a well–known problem

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 13

slide-88
SLIDE 88

Weakest Precondition Reasoning for Expected Run–Times Case Study

Case Study: The Coupon Collector’s Problem

The coupon collector is a well–known problem

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 13

slide-89
SLIDE 89

Weakest Precondition Reasoning for Expected Run–Times Case Study

Case Study: The Coupon Collector’s Problem

The coupon collector is a well–known problem

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 13

slide-90
SLIDE 90

Weakest Precondition Reasoning for Expected Run–Times Case Study

Case Study: The Coupon Collector’s Problem

The coupon collector is a well–known problem We model it by the following algorithm: cp := [0, . . . , 0]; i := 1; x := N; while (x > 0) { while (cp[i] = 0) { i :≈ Unif[1 . . . N] }; cp[i] := 1; x := x − 1 }

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 13

slide-91
SLIDE 91

Weakest Precondition Reasoning for Expected Run–Times Case Study

Case Study: The Coupon Collector’s Problem

The coupon collector is a well–known problem We model it by the following algorithm: cp := [0, . . . , 0]; i := 1; x := N; while (x > 0) { while (cp[i] = 0) { i :≈ Unif[1 . . . N] }; cp[i] := 1; x := x − 1 } Using ert, we can analyze the ERT of the above algorithm directly on the source code given above:

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 13

slide-92
SLIDE 92

Weakest Precondition Reasoning for Expected Run–Times Case Study

Case Study: The Coupon Collector’s Problem

The coupon collector is a well–known problem We model it by the following algorithm: cp := [0, . . . , 0]; i := 1; x := N; while (x > 0) { while (cp[i] = 0) { i :≈ Unif[1 . . . N] }; cp[i] := 1; x := x − 1 } Using ert, we can analyze the ERT of the above algorithm directly on the source code given above: ert [coup. coll.] (0) = 4 + [N > 0] · 2N · (2 + HN−1)

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 13

slide-93
SLIDE 93

Weakest Precondition Reasoning for Expected Run–Times Case Study

Case Study: The Coupon Collector’s Problem

The coupon collector is a well–known problem We model it by the following algorithm: cp := [0, . . . , 0]; i := 1; x := N; while (x > 0) { while (cp[i] = 0) { i :≈ Unif[1 . . . N] }; cp[i] := 1; x := x − 1 } Using ert, we can analyze the ERT of the above algorithm directly on the source code given above: ert [coup. coll.] (0) = 4 + [N > 0] · 2N · (2 + HN−1) Harmonic number HN−1 is in Θ(log N)

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 13

slide-94
SLIDE 94

Weakest Precondition Reasoning for Expected Run–Times Case Study

Case Study: The Coupon Collector’s Problem

The coupon collector is a well–known problem We model it by the following algorithm: cp := [0, . . . , 0]; i := 1; x := N; while (x > 0) { while (cp[i] = 0) { i :≈ Unif[1 . . . N] }; cp[i] := 1; x := x − 1 } Using ert, we can analyze the ERT of the above algorithm directly on the source code given above: ert [coup. coll.] (0) = 4 + [N > 0] · 2N · (2 + HN−1) Harmonic number HN−1 is in Θ(log N) Coupon collector program runs in Θ(N · log N) for N > 0

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 13

slide-95
SLIDE 95

Het Einde Summary

Summary

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 14

slide-96
SLIDE 96

Het Einde Summary

Summary

ert is an easy to understand weakest–precondition–style calculus for reasoning about ERT of probabilistic programs

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 14

slide-97
SLIDE 97

Het Einde Summary

Summary

ert is an easy to understand weakest–precondition–style calculus for reasoning about ERT of probabilistic programs ert is sound and complete for reasoning about expected run–times and positive almost–sure termination

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 14

slide-98
SLIDE 98

Het Einde Summary

Summary

ert is an easy to understand weakest–precondition–style calculus for reasoning about ERT of probabilistic programs ert is sound and complete for reasoning about expected run–times and positive almost–sure termination ert comes with proof rules for reasoning about loops

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 14

slide-99
SLIDE 99

Het Einde Summary

Summary

ert is an easy to understand weakest–precondition–style calculus for reasoning about ERT of probabilistic programs ert is sound and complete for reasoning about expected run–times and positive almost–sure termination ert comes with proof rules for reasoning about loops ert is a powerful alternative to ranking super–martingales

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 14

slide-100
SLIDE 100

Het Einde Summary

Summary

ert is an easy to understand weakest–precondition–style calculus for reasoning about ERT of probabilistic programs ert is sound and complete for reasoning about expected run–times and positive almost–sure termination ert comes with proof rules for reasoning about loops ert is a powerful alternative to ranking super–martingales ert is applicable to tricky real–world examples which are difficult to reason about by formal verification techniques

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 14

slide-101
SLIDE 101

Het Einde Summary

Summary

ert is an easy to understand weakest–precondition–style calculus for reasoning about ERT of probabilistic programs ert is sound and complete for reasoning about expected run–times and positive almost–sure termination ert comes with proof rules for reasoning about loops ert is a powerful alternative to ranking super–martingales ert is applicable to tricky real–world examples which are difficult to reason about by formal verification techniques

λ → ∀ =

I s a b e l l e

β α H O L

ert is Isabelle/HOL certified (courtesy of Johannes H¨

  • lzl, TUM)

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 14

slide-102
SLIDE 102

Het Einde Summary

Summary

ert is an easy to understand weakest–precondition–style calculus for reasoning about ERT of probabilistic programs ert is sound and complete for reasoning about expected run–times and positive almost–sure termination ert comes with proof rules for reasoning about loops ert is a powerful alternative to ranking super–martingales ert is applicable to tricky real–world examples which are difficult to reason about by formal verification techniques

λ → ∀ =

I s a b e l l e

β α H O L

ert is Isabelle/HOL certified (courtesy of Johannes H¨

  • lzl, TUM)

Future work: recursion, conditioning, run–time variance

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 14

slide-103
SLIDE 103

Het Einde Summary

Summary

ert is an easy to understand weakest–precondition–style calculus for reasoning about ERT of probabilistic programs ert is sound and complete for reasoning about expected run–times and positive almost–sure termination ert comes with proof rules for reasoning about loops ert is a powerful alternative to ranking super–martingales ert is applicable to tricky real–world examples which are difficult to reason about by formal verification techniques

λ → ∀ =

I s a b e l l e

β α H O L

ert is Isabelle/HOL certified (courtesy of Johannes H¨

  • lzl, TUM)

Future work: recursion, conditioning, run–time variance Thank you for your kind attention!

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 14

slide-104
SLIDE 104

Het Einde Summary

Backup Slides: The Actual Rule for Assignments

C ert [C] (t) x :≈ µ 1 + λσ• Eµ(σ) (λv. t [x/v] (σ))

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 15

slide-105
SLIDE 105

Het Einde Summary

Backup Slides: ert Calculations and Proof Rule Application

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 16

slide-106
SLIDE 106

Het Einde Summary

Backup Slides: Operational RMDP

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 17

slide-107
SLIDE 107

Het Einde Summary

Backup Slides: Park’s Lemma

∞ gfp F lfp F

  • Kaminski, Katoen, Matheja, Olmedo

Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 18

slide-108
SLIDE 108

Het Einde Summary

Backup Slides: Park’s Lemma

∞ gfp F lfp F

  • I

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 18

slide-109
SLIDE 109

Het Einde Summary

Backup Slides: Park’s Lemma

∞ gfp F lfp F

  • I

F(I)

≤

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 18

slide-110
SLIDE 110

Het Einde Summary

Backup Slides: Park’s Lemma

F(I) ≤ I implies lfp F ≤ I ∞ gfp F lfp F

  • I

F(I)

≤

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 18

slide-111
SLIDE 111

Het Einde Summary

Backup Slides: Park’s Lemma

F(I) ≤ I implies lfp F ≤ I ∞ gfp F lfp F

  • I

F(I)

≤

I

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 18

slide-112
SLIDE 112

Het Einde Summary

Backup Slides: Park’s Lemma

F(I) ≤ I implies lfp F ≤ I ∞ gfp F lfp F

  • I

F(I)

≤

I F(I)

≤

Kaminski, Katoen, Matheja, Olmedo Weakest Precondition Reasoning for Expected Run–Times 4.4.2016 18