Proof Pearl: The KeY to Correct and Stable Sorting

Abstract

We discuss a proof of the correctness of two sorting algorithms: Counting sort and Radix sort. The semi-automated proof is formalized in the state-of-the-art theorem prover KeY.

Lean Formalization of Insertion Sort Stability and Correctness

“…Gouw, Boer and Rot [8] used an auxiliary indexing variable while Sternagel [6] utilized a very similar idea of first associating indices with each sequence to be sorted and then introduced a key function to separate the indices from elements. Considering we are concerned with a declarative version of insertion sort, it is more convenient for us to use associated indices.…”

“…We therefore enhance the notion of what it means to be sorted, expressing stability along with the property of being sorted. It can be viewed as an extension of what Gouw, Boer and Rot [8] used, utilizing an index once equality is established. A very important thing to note here is that throughout the study, we will be using the definition under assignment α ← γ, for which the strict comparison operation with < is defined to compare second components; those represent indices.…”

“…In 2013, Sternagel [6] used a declarative Haskell implementation of merge sort (one supposedly used by GHC, a major compiler provider for the language in question) as basis for an implementation in Isabelle/HOL [7], which he then not only proved correct with regards to the expected sorting behaviour (to be discussed shortly), but also showed that the implementation he is using happens to be stable. Shortly thereafter, Gouw, Boer and Rot [8] formalized a Java implementation of counting sort and radix sort, utilizing KeY [9] to conduct proofs of correctness and stability. It is worth noting that stability of counting sort when used as a subroutine for radix sort is of paramount importance to achieve correct behaviour of radix sorting.…”

Verifying OpenJDK’s Sort Method for Generic Collections

“…12 The KeY proof targets the actual implementation in the OpenJDK standard library, rather than an idealized model of it. That implementation uses low-level bit-wise operations, abrupt termination of loops and arithmetic overflows.…”

“…The work presented here was motivated by our recent success to verify executable Java versions of counting sort and radix sort in KeY with manageable effort [12]. As a further challenge, we planned to verify a complicated sorting algorithm taken from the widely used OpenJDK core library.…”