model_correctness

std.sets.model_correctness · Level L2

Correctness of a finite computational model (S, Init, Step, Halt), possibly nondeterministic, against a postcondition Post: the states reachable from Init (a halting state is an end, its outgoing steps cut); the stuck states, reachable, not halting, with no successor, which are not halts; partial correctness, every reachable halting state satisfies Post; termination, no execution runs forever (no reachable cycle) or gets stuck; and total correctness, both. Every execution is covered, as nondeterminism requires: one successful path proves nothing.

partial ∧ terminates

Signature

model_correctness(Step: f64[n, n], Init: f64[n], Halt: f64[n], Post: f64[n]) → f64[n], f64[n], f64[], f64[], f64[]

Structure

The function as NOVA stores it: one box per input, operation and output, and arrows that carry values. A double border marks another library function this one runs — called once, or by Scan once per element; select it to open that function.

input
operation
constant
call
output

Verification

Signature proven by NOVA’s shape solver, for every size.
Equal to the reference search from Init, then a cycle search from every reachable state in exact rational arithmetic, on all 40 test cases.
All 432 float64 results are exact: the error is zero.
Interpreter and NumPy backend return bit-identical results.
At float32 too: the 40 test cases rounded to float32, and 40 of them exact, with zero error.

Accuracy in detail

correctly rounded (the float64 nearest the exact value): 100%
bit-equal to the NumPy formula in float64: 100%
largest error, in units in the last place: 0

Identity

Calls

reachability

Called by

—

sha256:b253ee10e378a20f9208bc0ef5b75a4c666c767438d81ce3b8c1e1525b84f955

The semantic hash of the graph. It changes when the program changes, and never when only its documentation does.

Control handle

Symbol: Ω:std.sets.model_correctness · Ω:model_correctness
Pins: sha256:cbc9c1fcdc270cc55fe4753c54583f7d1aece24a7452150a72fb3b5410d9827ethis graph and the 2 it reaches through calls
Evidence: sha256:f638a18341be3d4fe3232480a49b89207228aa51f28b00cdf904abc4e403ad32the hash of its verification record
Needs: no capability: a pure function

Through NOVA’s control layer, the symbol launches this function only while the program still matches what it pins: a change to this graph, or to any graph it reaches, needs a migration first.