More on Correctness
Prime Factorization
Problem: Write a program that computes all the prime factors of a given number
Solution (Idea):

•	Factors are less than or equal to the given number

•	Starting from the smallest prime (2), check whether all prime numbers less than the given number is a factor

•	For every factor, compute its multiplicity also
Program prime_factor
    implicit none
integer::  i, m, n

read *, n

i = 2; m = n ! n is the number to be factorized
outer : do
          if ( i*i > m) exit
              inner : do
                  if ( modulo(m,i) /= 0) exit
                  m = m/i
                  print *, i
              end do inner
          i = i+1
end do outer
if ( m > 1)  print *, m
end program prime_factor
Correctness of the solution
•	Study the program

•	It may print the same number more than once. Why?

•	No check for primality is made!

•	Is the program correct?

•	How do you check this?

•	Test the program. How?

•	Run the program for some inputs
Program Testing
•	This is the standard approach used to ensure the correctness
•	various issues to be addressed
–	What inputs should be given?
•	Give inputs that test `corner cases', `boundary conditions', `representative inputs', eg. 
–	 1, 2 (corner cases), 
–	7, 53, 81, 224 (representative cases)

•	 Choose inputs that exercise all the `paths' in the program

–	What outputs are expected?
•	Independent computation of outputs necessary

–	How many inputs should be given?
•	As much to gain confidence
Program Verification
•	Program Testing is good for detecting bugs in the final implementations

•	It is a bit ad hoc and not recommended for ensuring correctness of algorithms or high level programs

•	It can not ensure correctness - `it can reveal presence of bugs never their absence’

•	A more rigorous approach is Formal Verification (FV)

•	FV proves the correctness mathematically 

•	In general difficult and followed very little in practice
Correctness of the solution
•	FV requires a very precise definition of correctness
•	What is the definition of correctness?
       When input constraints are satisfied the program     
       terminates producing output with the desired   
       properties
•	In this example:
–	Input constraint: The number (n>0)
–	Output property:
•	Any number printed is a prime factor (safety)
•	All prime factors are printed (liveness)

•	Correctness demands that these two properties should hold for any number
Loop Invariance
•	For proving these properties, identify loop invariants:

–	a loop invariant is a property relating the values of variables such that if it is true before an iteration starts then it is true at end of iteration

•	property preserved under iterations

•	loop invariant, if it holds before the start of the loop then it will hold at the end

•	How?  Proof by induction on the number of iterations
Prime Factorization
•	a loop invariant for outer loop
–	none of j , 1 < j < i, is a factor of m
–	product of all numbers printed and m is n

•	This is true at start of iteration

•	To prove that it is indeed an invariant,
–	let m = l and i = k at the start of an iteration.
–	Then l not divisible by any j, 1 < j < k
Proof
At the end of this iteration,
 
–	value of i = k+1.  k is not a factor of the new value of m, since in the iteration m is divided by k as many times as possible
	
–		None of j, 1 < j < k continue to be a factor of new value of m (why?)

–		every time k is printed, m is divided by k and hence product of m and all numbers printed is n

–		Hence the loop invariant holds at end of iteration
 Proof of Safety Property
To prove that any number printed is a prime factor

Proof:
Case1: k is printed in the inner loop
     Then k divides m but no number < k divides m. So k is prime.  Loop invariant implies that m is a factor and hence k is a factor

Case2: m is printed
	At end of loop, value of m is either 1 or a prime

	Loop invariant ensures that at end of loop, product of printed numbers and m is n

	since m is printed, it is prime.
Proof of Liveness Property
To prove that all prime factors are printed

–	Any prime factor p of n has the property:
	     	either p*p <= n or p has multiplicity 1

–	The loops checks all numbers i s.t i*i <= n, whether it is factor

–	Both the loops terminate (why?)

–	The prime factor p s.t. p*p > n, if it exists is m when the outer loop terminates
Formal Verification
•	More rigorous, proves the correctness
•	Does not run the program for particular inputs
•	More time consuming but should be done for increased confidence
•	Many applications required more confidence
•	Safety-critical applications 
–	Aircraft control, nuclear plant control, Missile avionics, patient monitoring systems, etc

•	CFDVS at IIT Bombay

•	Lesson for you: Write loop invariants
			     Prove that the loop terminates