An Early Program Proof by Alan Turing F
Total Page:16
File Type:pdf, Size:1020Kb
An Early Program Proof by Alan Turing F. L. MORRIS AND C. B. JONES The paper reproduces, with typographical corrections and comments, a 7 949 paper by Alan Turing that foreshadows much subsequent work in program proving. Categories and Subject Descriptors: 0.2.4 [Software Engineeringj- correctness proofs; F.3.1 [Logics and Meanings of Programs]-assertions; K.2 [History of Computing]-software General Terms: Verification Additional Key Words and Phrases: A. M. Turing Introduction The standard references for work on program proofs b) have been omitted in the commentary, and ten attribute the early statement of direction to John other identifiers are written incorrectly. It would ap- McCarthy (e.g., McCarthy 1963); the first workable pear to be worth correcting these errors and com- methods to Peter Naur (1966) and Robert Floyd menting on the proof from the viewpoint of subse- (1967); and the provision of more formal systems to quent work on program proofs. C. A. R. Hoare (1969) and Edsger Dijkstra (1976). The Turing delivered this paper in June 1949, at the early papers of some of the computing pioneers, how- inaugural conference of the EDSAC, the computer at ever, show an awareness of the need for proofs of Cambridge University built under the direction of program correctness and even present workable meth- Maurice V. Wilkes. Turing had been writing programs ods (e.g., Goldstine and von Neumann 1947; Turing for an electronic computer since the end of 1945-at 1949). first for the proposed ACE, the computer project at the The 1949 paper by Alan M. Turing is remarkable National Physical Laboratory, but since October in many respects. The three (foolscap) pages of text 1948 for the Manchester prototype computer, of which contain an excellent motivation by analogy, a proof of he was deputy director. The references in his paper to a program with two nested loops, and an indication of 240 are reflections of the 40-bit “lines” of the Man- a general proof method very like that of Floyd. Unfor- chester machine storage system. tunately, the paper is made extremely difficult to read The following is the text of Turing’s 1949 paper, by the large number of transcription errors. For ex- corrected to the best of our ability to what we believe ample, all instances of the factorial sign (Turing used Turing intended. We have made no changes in spell- ing, punctuation, or grammar. 0 1984 by the American Federation of Information Processing Turing Text Societies, Inc. Permission to copy without fee all or part of this material is granted provided that the copies are not made or distrib- Friday, 24th June [I9491 uted for direct commercial advantage, the AFIPS copyright notice and the title of the publication and its date appear, and notice is Checking a large routine by Dr A. Turing. given that the copying is by permission of the American Federation How can one check a routine in the sense of making sure of Information Processing Societies, Inc. To copy otherwise, or to that it is right? republish, requires specific permission. Authors’ Addresses: F. L. Morris, School of Computer and Infor- In order that the man who checks may not have too mation Science, 313 Link Hall, Syracuse University, Syracuse, NY difficult a task the programmer should make a number of 13210. C. B. Jones, Department of Computer Science, The Univer- definite assertions which can be checked individually, and sity, Manchester MI3 9PL, England. from which the correctness of the whole programme easily 0 1984 AFIPS 0164-l 239/84/020139-l 43$01 .OO/OO follows. Annals of the History of Computing, Volume 6, Number 2, April 1984 l 1% F. L. Morris & C. B. Jones - Turing Proof Considerthe analogy of checking an addition. If it is given Each “box” of the flow diagram represents a straight as: sequenceof instructions without changes of control. The 1374 following convention is used: 5906 (i) a dashed letter indicates the value at the end of the 6719 processrepresented by the box: 4337 (ii) an undashed letter represents the initial value of a 7768 quantity. 26104 One cannot equate similar letters appearing in different one must check the whole at one sitting, because of the boxes, but it is intended that the following identifications carries. But if the totals for the various columns are given, be valid throughout as below: s content of line 27 of store 1374 F ” ” ‘I 28 ” ” 5906 n ” ” ” 29 ” ” 6719 u ” ” ” 30 ” ” 4337 u ” ” ” 31 ” ” 7768 It is also intended that u be .@ or something of the sort 3974 e.g. it might be (s + l)F or s but not e.g. s2+ F2. 2213 In order to assist the checker, the programmer should 26104 make assertionsabout the various states that the machine the checker’s work is much easier being split up into the can reach. These assertionsmay be tabulated as in Fig. 2. checking of the various assertions 3 + 9 + 7 + 3 + 7 = 29 Assertions are only made for the states when certain partic- etc. and the small addition ular quantities are in control, corresponding to the ringed 3974 letters in the flow diagram. One column of the table is used 2213 for each such situation of the control. Other quantities are 26104 also needed to specify the condition of the machine com- pletely: in our caseit is sufficient to give F and s. The upper This principle can be applied to the processof checking a part of the table gives the various contents of the store lines large routine but we will illustrate the method by means of in the various conditions of the machine, and restrictions a small routine uiz. one to obtain @ without the use of a on the quantities s, r (which we may call inductive variables). multiplier, multiplication being carried out by repeated ad- The lower part tells us which of the conditions will be the dition. next to occur. At a typical moment of the processwe have recorded k The checker has to verify that the columns corresponding and $F for someF, s. We can changeq to (s + l)k by addition to the initial condition and the stoppedcondition agree with of F. When s = F + 1 we can change F to r + 1 by a transfer. the claims that are made for the routine as a whole. In this Unfortunately there is no coding system sufficiently gener- casethe claim is that if we start with control in condition A ally known to justify giving the routine for this processin and with n in line 29 we shall find a quantity in line 31 full, but the flow diagram given in Fig. 1 will be sufficient when the machine stops which is b (provided this is less for illustration. than 240,but this condition has been ignored). He has also to verify that each of the assertions in the lower half of the table is correct. In doing this the columns may be taken in any order and quite independently. Thus F. L. Morris was graduated in mathematics from for column B the checker would argue: “From the flow Harvard College in 1964 and received the Ph.D. in diagram we see that after B the box u’ = u applies. From computer science from Stanford University in 1972. the upper part of the column for B we have u = b. Hence u’ = k i.e. the entry for u i.e. for line 31 in C should be Lr. He has been employed at the universities of Essex and The other entries are the sameas in B.” Edinburgh, and since 1975 has taught at Syracuse Finally the checker has to verify that the processcomes University. The collaboration with C. B. Jones reported to an end. Here again he should be assistedby the program- here was done while visiting the Programming mer giving a further definite assertion to be verified. This may take the form of a quantity which is assertedto decrease Research Group, Oxford, during 1980- 198 1. continually and vanish when the machine stops.To the pure C. B. Jones began his career working on standard mathematician it is natural to*give an ordinal number. In commercial computing projects. A period in this problem the ordinal might be (n - r)u2 + (r - s)w + k. A lesshighbrow form of the samething would be to give the operations research was followed by a change to integer 280(n - F) + Z4’(r - s) + k. Taking the latter case “systems programming. ” In IBM’s Product Test Group and the step from B to C there would be a decreasefrom the realization dawned that quality could only be 2’“(n - F) + 240(r - s) + 5 to 280(n - r) + 240(r - s) + 4. In achieved in design. The first step toward “formal the step from F to B there is a decreasefrom 2”(n - r) + methods” came with an assignment to the IBM Vienna 240(r - s) + 1 to 2’O(n - r - 1) + 240(r + 1 - s) + 5. In the course of checking that the process comesto an Laboratory in 1968. A sabbatical in Oxford from end the time involved may also be estimated by arranging 1979-1981 led to the current position of professor of that the decreasingquantity representsan upper bound to computing science at Manchester University. the time till the machine stops. 140 * Annals of the HIstory of Computing, Volume 6, Number 2, April 1984 F. L. Morris & C. B. Jones * Turing Proof 0D STOP I---+ 0A 0E 0G - , r’=l I \ v’=u +-- TESTr-n + s’=l : :- l/‘=u+v : s’=s+l u’ = 1 \, /.