1. Hoare’s Correctness Triplets Dijkstra’s Predicate Transformers
Axiomatic Semantics
Hoare’s Correctness Triplets
Dijkstra’s Predicate Transformers
Calculating with programs : Reasoning reduced to symbol manipulation.
Helps determine precise Boundary conditions. Formalizing intuitions.
Other approaches:
Denotational Semantics: Real meaning in terms of functions on N.
Equivalence: f(x) = f(x) f(x) = if f(x) ==1 then 0 else 1
unsatisfiable (“non-sense”)
f(x) = f(x) f(x) = if f(x) ==1 then 1 else f(x)
multiple solutions (“no information”)
McCarthy’s 91-function
Operational Semantics: Abstract interpreter based

2. gcd-lcm algorithm w/ invariant
{PRE: (x = n) and (y = m)}
u := x; v := y;
while {INV: 2*m*n = x*v + y*u} (x <> y) do
if x > y then
x := x - y; u := u + v
else
y := y - x; v := v + u fi od
{POST:(x = gcd(m, n)) and (lcm(m, n) = (u+v) div 2)}
cs784(tk/pm)

3. Goal of a program = IO Relation
Problem Specification
Properties satisfied by the input and expected of the output (usually described using “assertions”).
E.g., Sorting problem
Input : Sequence of numbers
Output: Permutation of input that is ordered.
View Point
All other properties are ignored.
Timing behavior
Resource consumption …
cs784(tk/pm)

4. ax·i·om n.1. A self-evident or universally recognized truth; a maxim
2. An established rule, principle, or law.
3. A self-evident principle or one that is accepted as true without proof as the basis for argument; a postulate.
From a dictionary
cs784(tk/pm)

5. Axiomatic Semantics
Capture the semantics of the elements of the PL as axioms
Capture the semantics of composition as a rule of inference.
Apply the standard rules/logic of inference.
Consider termination separately.
cs784(tk/pm)

6. States and Assertions States: Variables mapped to Values
Includes all variables
Files etc. are considered “global” variables.
No notion of value-undefined variables
At a given moment in execution
An assertion is a logic formula involving program variables, arithmetic/boolean operations, etc.
All assertions are attached to a control point.
Assertions: States mapped to Boolean
Boolean connectives: and, or, not, implies, …
For-all, There-exists
Special predicates defined just for use in assertions (not for use in the program).
cs784(tk/pm)

7. Hoare’s Logic Hoare Triplets: {P} S {Q}
P, pre-condition assertion; S, statements of a PL; Q, post-condition assertion
If S begins executing in a state satisfying P, upon completion of S, the resulting state satisfies Q.
{P} S {Q} has no relevance if S is begun otherwise.
A Hoare triplet is either true or false. Never undefined.
The entire {P}S{Q} is considered true if the resulting state satisfies Q if and when S terminates.
If not, the entire {P}S{Q} is false.
cs784(tk/pm)

8. Hoare Triplet Examples
true triplets
{x = 11 } x := 0 { x = 0 }
we can give a weaker precondition
{x = 0 } x := x + 1 { x = 1 }
{y = 0} if x <> y then x:= y fi { x = 0 }
{false } x := 0 { x = 111 }
correct because “we cannot begin”
no state satisfies false
post condition can be any thing you dream
{true} while true do od {x = 0}
true is the weakest of all predicates
correct because control never reaches post
{false} while true do od {x = 0}
false is the strongest of all predicates
false triplet
{true} if x < 0 then x:= -x fi { x > 0 }
1. False = empty set of states.
Precondition unsatisfiable, so Hoare triple trivially valid.
2. Strong precondition
4. Nontermination.
5. Multipath program : Else null statement;
6. Partially correct because the
IF-part of definition not met, so there
are no guarantees from THEN.
7. Modify the precondition to get a valid triple.
Material Implication :
IF sun rises in the west THEN there will be snow in July in Mexico City.
cs784(tk/pm)

9. Weaker/Stronger
An assertion R is said to be weaker than assertion P if
the truth of P implies the truth of R
written: P→R
equivalently
not P or R.
For arbitrary A, B we have: A and B → B
This general idea is from Propositional Calculus
n > 0 is of course weaker than n = 1, but this follows from Number Theory.
cs784(tk/pm)

10. Weaker/Stronger Q’ stronger P’ weaker Q’  Q P  P’ States States P’ Q
The program transforms a state into another state. (point to point map)
Assertions characterize a collection of states.
cs784(tk/pm)

11. Partial vs Total Correctness
Are P and S such that termination is guaranteed?
S is partially correct for P and Q iff whenever the execution terminates, the resulting state satisfies Q.
S is totally correct for P and Q iff the execution is guaranteed to terminate, and the resulting state satisfies Q.
Logical Implication :
IF false THEN (1 = 2) is valid.
cs784(tk/pm)

12. Hoare Triplet Examples
Totally correct (hence, partially correct)
{x = 11} x := 0 {x = 0}
{x = 0} x := x + 1 {x = 1}
{y = 0}if x <> y then x:= y fi {x = 0}
{false} while true do S od {x = 0}
{false} x := 0 {x = 111}
Not totally correct, but partially correct
{true} while true do S od {x = 0}
Not partially correct
{true} if x < 0 then x:= -x fi {x > 0}
False = empty set of states. Precondition unsatisfiable, so Hoare triple trivially valid.
1a. Unecessarily Strong precondition
1d and 2. Nontermination.
3. Multipath program : Else null statement;
6. Partially correct because the
IF-part of definition not met, so there
are no guarantees from THEN.
7. Modify the precondition to get a valid triple.
Material Implication :
IF sun rises in the west THEN there will be snow in July in Mexico City.
cs784(tk/pm)

13. Assignment axiom {Q(e)} x := e {Q(x)} Q(x) has free occurrences of x.
Q(e): every free x in Q replaced with e
Assumption: e has no side effects.
Caveats
If x is not a “whole” variable (e.g., a[2]), we need to work harder.
PL is assumed to not facilitate aliasing.
cs784(tk/pm)

14. Inference Rules Rules are written as Can also be stated as:
Hypotheses: H1, H2, H Conclusion: C1
Can also be stated as:
H1 and H2 and H3 implies C1
Given H1, H2, and H3, we can conclude C1.
cs784(tk/pm)

15. Soundness and Completeness
Soundness is about “validity”
Completeness is about “deducibililty”
Ideally in a formal system, we should have both.
Godel’s Incompleteness Theorem:
Cannot have both
Inference Rules ought to be sound
What we proved/ inferred/ deduced is valid
Examples of Unsound Rules
A and B and C  not B
x > y implies x > y+1 (in the context of numbers)
All the rules we present from now on are sound
cs784(tk/pm)

16. Rule of Consequence Suppose: {P’} S {Q’}, P=>P’, Q’=>Q
Conclude: {P} S {Q}
Replace
precondition by a stronger one
postcondition by a weaker one
cs784(tk/pm)

17. Statement Composition Rule
{P} S1 {R}, {R} S2 {Q} {P} S1;S2 {Q} Using Rule of Consequence {P} S1 {R1}, R1  R2, {R2} S2 {Q} {P} S1;S2 {Q}
Reasoning turned into symbol manipulation : Substitution.
Confusing with constructs such as: {??} x == x++ * 5 { x = y }
cs784(tk/pm)

18. if-then-else-fi Hoare’s Triplets
{P and B} S1 {Q}
{P and not B} S2 {Q}
{P} if B then S1 else S2 fi {Q}
We assumed that B is side-effect free
Execution of B does not alter state
cs784(tk/pm)

19. Invariants
An invariant is an assertion whose truth-value does not change
Recall: All assertions are attached to a control point.
An Example: x > y
The values of x and y may or may not change each time control reaches that point.
But suppose the > relationship remains true.
Then x > y is an invariant
Focus on what is essential for the problem at hand rather than the weakest conditiion.
Invariant = truth preserved.
cs784(tk/pm)

20. Loop Invariants Semantics of while-loop {I and B} S {I}
{I} while B do S od {I and not B}
Termination of while-loop is not included in the above.
We assumed that B is side-effect free.
cs784(tk/pm)

21. Data Invariants Well-defined OOP classes
Public methods ought to have a pre- and post-conditions defined
There is a common portion across all public methods
That common portion is known as the data invariant of the class.
cs784(tk/pm)

22. while-loop: Hoare’s Approach
Wish to prove: {P} while B do S od {Q}
Given: P, B, S and Q
Not given: a loop invariant I
The I is expected to be true just before testing B
To prove {P} while B do S od {Q}, discover a strong enough loop invariant I so that
P => I
{I and B} S {I}
I and not B => Q
We used the Rule of Consequence twice
Focus on what is essential for the problem at hand rather than the weakest conditiion.
Invariant = truth preserved.
cs784(tk/pm)

23. A while-loop example { n > 0 and x = 1 and y = 1}
while (n > y) do y := y + 1; x := x*y od
{x = n!}
Choosing invariant requires insight and is goal driven.
Invariant must hold in the loop. So cannot have (n = y) or (x = n!) etc
n > 0 implies n >= 1 because n is of type natural-number
cs784(tk/pm)

24. while-loop: Choose the Invariant
Invariant I should be such that
I and not B  Q
I and not (n > y)  (x = n!)
Choose (n ≥ y and x = y!) as our I
Precondition  Invariant
n > 0 and x=1 and y=1  n ≥ 1 and 1=1!
Choosing invariant requires insight and is goal driven.
Invariant must hold in the loop. So cannot have (n = y) or (x = n!) etc
n > 0 implies n >= 1 because n is of type natural-number
cs784(tk/pm)

25. while-loop: Verify Invariant
I === n ≥ y and x = y!
Verify: {I and n > y} y:= y + 1; x:=x*y {I}
{I and n > y} y:= y + 1 {n ≥ y and x*y = y!}
{I and n > y} y:= y + 1 {n ≥ y and x= (y-1)!}
(I and n > y)  (n ≥ y+1 and x= (y+1-1)!)
(I and n > y)  (n > y and x= y!)
(n ≥ y and x = y! and n > y)  (n > y and x= y!)
QED
Hoare’s triplets, but also using wp().
cs784(tk/pm)

26. while-loop: I and not B  Q
I === n ≥ y and x = y!
n ≥ y and x = y! and not (n > y)  x = n!
n = y and x = y!  x = n!
QED
Hoare’s triplets, but also using wp().
cs784(tk/pm)

27. while-loop: Termination
Termination is not part of Hoare’s Triplets
General technique:
Find a quantity that decreases in every iteration.
And, has a lower bound
The quantity may or may not be computed by the algorithm
For our example: Consider n – y
values of y: 1, 2, …, n-1, n
values of n - y: n-1, n-2, …, 1, 0
Hoare’s triplets, but also using wp().
cs784(tk/pm)

28. Weakest Preconditions
We want to determine minimally what must be true immediately before executing S so that
assertion Q is true after S terminates.
S is guaranteed to terminate
The Weakest-Precondition of S is a mathematical function mapping any post condition Q to the "weakest" precondition Pw.
Pw is a condition on the initial state ensuring that execution of S terminates in a final state satisfying R.
Among all such conditions Pw is the weakest
wp(S, Q) = Pw
cs784(tk/pm)

29. Dijkstra’s wp(S, Q) Let Pw = wp(S, Q)
Def of wp(S, Q): Weakest precondition such that if S is started in a state satisfying Pw, S is guaranteed to terminate and Q holds in the resulting state.
Consider all predicates Pi so that {Pi}S{Q}.
Discard any Pi that does not guarantee termination of S.
Among the Pi remaining, choose the weakest. This is Pw.
{P} S {Q} versus P => wp(S, Q)
{Pw} S {Q} is true.
But, the semantics of {Pw} S {Q} does not include termination.
If P => wp(S, Q) then {P}S{Q} also, and furthermore S terminates.
cs784(tk/pm)

30. Properties of wp Law of the Excluded Miracle wp(S, false) = false
Distributivity of Conjunction wp(S, P and Q) = wp(S,P) and wp(S,Q)
Law of Monotonicity (Q→R) → (wp(S,Q)→wp(S,R))
Distributivity of Disjunction wp(S,P) or wp(S, Q) → wp(S,P or Q)
cs784(tk/pm)

31. Predicate Transformers
Assignment
wp(x := e, Q(x)) = Q(e)
Composition
wp(S1;S2, Q) = wp(S1, wp(S2,Q))
For programs without loops (and recursion), Hoare’s and Dijkstra’s approach converge.
Hoare’s approach generates triples while Dijkstra’s approach tries to capture the semantics
Unaddressed Questions: Why weakest precondition rather than strongest post-condition?
Expressiveness in FOL for while?
Application: Distributed computing program proofs.
cs784(tk/pm)

32. A Correctness Proof {x=0 and y=0} x:=x+1;y:=y+1 {x = y}
wp(x:=x+1;y:=y+1, x = y)
wp(x:=x+1, wp(y:=y+1, x = y))
=== wp(x:=x+1, x = y+1)
=== x+1 = y+1
=== x = y
x = 0 and y = 0  x = y
use a better example
=== at the meta level, = part of assertion language syntax
cs784(tk/pm)

33. if-then-else-fi in Dijkstra’s wp
wp(if B then S1 else S2 fi, Q)
=== (B  wp(S1,Q)) and (not B  wp(S2,Q))
=== (B and wp(S1,Q)) or (not B and wp(S2,Q))
cs784(tk/pm)

34. wp-semantics of while-loops
DO == while B do S od
IF == if B then S fi
Let k stand for the number of iterations of S
Clearly, k >= 0
If k > 0, while B do S od is the same as:
if B then S fi; while B do S od
cs784(tk/pm)

35. while-loop: wp Approach
wp(DO, Q)
= P0 or there-exists k > 0: Pk
States satisfying Pi cause i-iterations of while-loop before halting in a state in Q.
Pi defined inductively
P0 = not B and Q …
cs784(tk/pm)

36. wp(DO, Q) There exists a k, k ≥ 0, such that H(k, Q)
H is defined as follows
H(0, Q) = not B and Q
H(k, Q) = H(0, Q) or wp(IF, H(k-1, Q))
cs784(tk/pm)

37. Example (same as before)
{ n>0 and x=1 and y=1} while (n > y) do y := y + 1; x := x*y od {x = n!}
cs784(tk/pm)

38. Example: while-loop correctness
Pre === n>0 and x=1 and y=1
P0 === y >= n and x = n!
Pk === B and wp(S, Pk-1)
P1 === y > n and y+1>=n and x*(y+1) = n!
Pk === y=n-k and x=(n-k)!
Weakest Precondition:
W === there exists k >= 0 such that P0 or Pk
Verification :
For k = n-1: Pre => W
cs784(tk/pm)

39. Induction Proof Hypothesis : Pk = (y=n-k and x=(n-k)!)
Pk+1 = B and wp(S,Pk)
= y<n and (y+1 = n-k) and (x*(y+1)=(n-k)!)
= y<n and (y = n-k-1) and (x = (n-k-1)!)
= y<n and (y = n- k+1) and (x = (n- k+1)!)
= (y = n - k+1) and (x = (n - k+1)!)
Examples of Valid preconditions:
{ n = 4 and y = 2 and x = 2 } (k = 2)
{ n = 5 and x = 5! and y = 6} (no iteration)
cs784(tk/pm)

40. Detailed Work wp(y:=y+1;x:=x*y, x=y!and n>=y)
= wp(y:=y+1, x*y=y! and n>=y)
= wp(y:=y+1, x=(y-1)! and n>=y)
= x=(y+1-1)! and n>=y+1)
= x=y! and n>y
cs784(tk/pm)

41. gcd-lcm algorithm w/ invariant
{PRE: (x = n) and (y = m)}
u := x; v := y;
while {INV: 2*m*n = x*v + y*u} (x <> y) do
if x > y then
x := x - y; u := u + v
else
y := y - x; v := v + u fi od
{POST:(x = gcd(m, n)) and (lcm(m, n) = (u+v) div 2)}
cs784(tk/pm)

42. gcd-lcm algorithm proof
PRE implies Loop Invariant
(x = n) and (y = m) implies 2*m*n = x*v + y*u
{Invariant and B} Loop-Body {Invariant}
{2*n*m = x*v + y*u and x <> y} loop-body {2*n*m = x*v + y*u}
Invariant and not B implies POST
2*n*m = x*v + y*u and x == y implies (x = gcd(n,m)) and (lcm(n,m) = (u+v) div 2)
cs784(tk/pm)

43. gcd-lcm algorithm proof
Invariant and not B implies POST
2*m*n = x*v + y*u and x == y implies (x = gcd(m, n)) and (lcm(m, n) = (u+v) div 2)
Simplifying
2*m*n = x*(u + v) and x == y implies (x = gcd(m, n)) and (lcm(m, n) = (u+v) div 2)
cs784(tk/pm)

44. gcd-lcm algorithm proof
Simplifying
2*m*n = x*(u + v) and x == y implies (x = gcd(m, n)) and (x*lcm(m, n) = m*n)
cs784(tk/pm)

45. Some Properties of lcm-gcd
gcd() and lcm() are symmetric
gcd(m, n) = gcd(n, m)
lcm(m, n) = lcm(n, m)
gcd(m, n) = gcd(m + k*n, n)
where k is a natural number.
gcd(m, n) * lcm(m, n) = m * n
cs784(tk/pm)