Functional Correctness of C Implementations of Dijkstra’s, Kruskal’s, and Prim’s Algorithms

Abstract

We develop machine-checked verifications of the full functional correctness of C implementations of the eponymous graph algorithms of Dijkstra, Kruskal, and Prim. We extend Wang et al.’s CertiGraph platform to reason about labels on edges, undirected graphs, and common spatial representations of edge-labeled graphs such as adjacency matrices and edge lists. We certify binary heaps, including Floyd’s bottom-up heap construction, heapsort, and increase/decrease priority.Our verifications uncover subtle overflows implicit in standard textbook code, including a nontrivial bound on edge weights necessary to execute Dijkstra’s algorithm; we show that the intuitive guess fails and provide a workable refinement. We observe that the common notion that Prim’s algorithm requires a connected graph is wrong: we verify that a standard textbook implementation of Prim’s algorithm can compute minimum spanning forests without finding components first. Our verification of Kruskal’s algorithm reasons about two graphs simultaneously: the undirected graph undergoing MSF construction, and the directed graph representing the forest inside union-find. Our binary heap verification exposes precise bounds for the heap to operate correctly, avoids a subtle overflow error, and shows how to recycle keys to avoid overflow.

Unveiling the Strength of Digital Objects: The Impact of the Digital Object Concept on Technology Acceptance

“…If we are able to complete a proof of full functional correctness using the approaches in [Möller and Höfner, 2019] and also provide enough additional functionality to form a library, we plan to make our code available as a crate through the new Alire (Ada LIbrary REpository) distribution system. Completing this proof will show that a full functional correctness proof of Prim's algorithm is possible with more-automated tools such as Why3, contrary to Mohan et al's prediction that such tools would not be able to prove full functional correctness as easily as their work with VST [Mohan et al, 2021].…”

“…Another effort has succeeded in a proof of full functional correctness of an executable implementation of Prim's algorithm written in verifiable C using Coq: CompCert and the Verified Software Toolchain (VST) separation logic deductive verifier [Mohan et al, 2021]. Mohan demonstrates that Prim's algorithm works on disconnected graphs (thus finding a minimal spanning forest (MSF) rather than a MST) and predicts that more-automated tools such as Why3 would not be able to prove full functional correctness as easily as their work with VST.…”

Coq’s vibrant ecosystem for verification engineering (invited talk)

“…But we still want to do this within the context of separation logic, so we can use logics such as VST and Iris to handle other aspects of the program that naturally want separation. CertiGraph has been successfully used atop VST-Floyd to prove the correctness of a generational copying garbage collector [47] and Dijkstra's, Kruskal's, and Prim's algorithms [40].…”