1. Axiomatic Semantics
Dr. M Al-Mulhem
ICS

2. References
“Concepts in Programming Languages” by J. Mitchel [textbook] Chapter 4
“Programming Languages: Principles and Paradigms” by Allan Tucker and R. Noonan, Chapter 3
“Concepts of Programming Languages” by R. Sebesta, 6th Edition, Chapter 3.
Dr. M Al-Mulhem
ICS

3. Axiomatic Semantics Based on formal logic (predicate calculus)
Original purpose: proof correctness of programs.
The logical expressions are called assertions.
An assertion before a statement (a precondition) describes the constraints on the program variables at that point in the program.
An assertion following a statement (a postcondition) describes the new constraints on those variables after execution of the statement.
Dr. M Al-Mulhem
ICS

4. Example
We examine assertions from the point of view that preconditions are computed from given postconditions.
Assume all variables are integer.
Postconditions and preconditions are presented in braces.
A simple example:
sum = 2 * x + 1 {sum > 1}
The postcondition is {sum > 1}
One possible precondition is {x > 10}
Dr. M Al-Mulhem
ICS

5. Weakest precondition { x > 10 } { x > 50 } { x > 100 }
A weakest precondition is the least restrictive precondition that will guarantee the postcondition.
For example, in the above statement and postcondition,
{ x > 10 }
{ x > 50 }
{ x > 100 }
Are all valid precondition.
The weakest precondition of all preconditions in this case is { x > 10 }
Dr. M Al-Mulhem
ICS

6. Correctness proofs
If the Weakest precondition can be computed from the given postconditions for each statement of a language, then correctness proofs can be constructed for programs in that language as follows:
The proof is begun by using the desired result of the program’s execution as the postcondition of the last statement of the program.
This postcondition, along with the last statement, is used to compute the weakest precondition for the last statement.
This precondition is then used as the postcondition for the second last statement.
This process continues until the beginning of the program is reached.
Dr. M Al-Mulhem
ICS

7. Correctness proofs
At that point, the precondition of the first statement states the condition under which the program will compute the desired results.
If this condition is implied by the input specification of the program, the program has been verified to be correct.
To use axiomatic semantics for correctness proofs or for formal semantic specifications, either an axiom or an inference rule must be available for each kind of statement in the language.
An axiom is a true logical statement.
An inference rule is a method of inferring the truth of an assertion based on other assertions.
Dr. M Al-Mulhem
ICS

8. Axiomatic Semantics: Assignment statement
Let x = E be a general assignment statement and Q be the postcondition.
Then its weakest precondition P, is defined by the axiom
P = Qx→E
P is computed as Q with all instances of x replaced by E.
Dr. M Al-Mulhem
ICS

9. Example a = b / 2 - 1 { a < 10} b / 2 - 1 < 10 b < 22
For example, consider the following statement and postcondition.
a = b / { a < 10}
The weakest precondition is computed by subsituting b/2-1 in the postcondition
b / < 10
b < 22
Dr. M Al-Mulhem
ICS

10. Notations for axiomatic semantics
The usual notations are:
{P} S {Q}
Where P is the precondition, Q is the postcondition and S is the statement.
For the assignment statement, the notation is
{Qx→E} x = E {Q}
Dr. M Al-Mulhem
ICS

11. Example Compute the precondition for the assignment statement
x = 2 * y { x > 25 }
The weakest precondition is computed as
2 * y -3 > 25
y > 14
Dr. M Al-Mulhem
ICS

12. Example x = x + y - 3 {x > 10} x + y - 3 > 10 y > 13 – x
What about if the left side of the assignment appears in the right side of the assignment?
x = x + y {x > 10}
The weakest precondition is
x + y > 10
y > 13 – x
Has no effect on the process of computing the precondition.
Dr. M Al-Mulhem
ICS

13. Axiomatic Semantics: Sequences
The precondition for a sequence of statements cannot be described by an axiom, because the precondition depends on the particular kind of statements in the sequence.
The precondition can only be described with an inference rule.
Let S1 and S2 be adjacent statements.
Assume that S1 and S2 have the following pre/postconditions:
{P1} S1 {P2}
{P2} S2 {P3}
The inference rule for such two-statement sequence is
The axiomatic semantics of the sequence S1; S2 is
Dr. M Al-Mulhem
ICS

14. Axiomatic Semantics: Sequences
The above inference rule states that to get the sequence precondition, the precondition of the second statement is computed.
This new assertion is used as the postcondition of the first statement , which can then be used to compute the precondition of the first statement.
This precondition can be used as the precondition for the whole sequence.
Dr. M Al-Mulhem
ICS

15. Example x1 = E1 x2 = E2 {P3x2→E2} x2 = E2 {P3}
Assume we have the following sequence of statements:
x1 = E1
x2 = E2
Then we have
{P3x2→E2} x2 = E2 {P3}
{P3x2→E2}x1→E1 x1 = E1 {P3x2→E2 }
Therefore, the precondition for the sequence x1=E1; x2=E2 with postcondition P3 is {P3x2→E2}x1→E1
Dr. M Al-Mulhem
ICS

16. Example y = 3 * x + 1; x = y + 3; {x < 10} y < 7
Consider the following sequence and postcondition:
y = 3 * x + 1;
x = y + 3;
{x < 10}
The precondition for the last assignment statement is
y < 7
Which is used as the postcondition for the first statement.
The precondition for the first statement and the sequence can be now computed.
3 * x + 1 < 7
x < 2
Dr. M Al-Mulhem
ICS

17. Axiomatic Semantics: Selection
The general form of the selection statement is
If B then S1 elese S2
The inference rule is
This rule indicates that selection statements must be proven for both when the condition expression is true and when it is false.
The first logical statement above the line represents the then clause; the second represents the else clause.
We need a precondition P that can be used in the precondition of both the then and else clauses.
Dr. M Al-Mulhem
ICS

18. Example Consider the following selection statement: if ( x > 0 )
y = y - 1
else y = y + 1
Suppose the postcondition, Q for the selection statement is {y>0}
We can then use the axiom for assignment on the then clause.
y = y - 1 { y > 0} This produces {y -1 > 0} or {y > 1}.
It can be used as the P part of the precondition of the then clause
Now, Apply the same axiom for the else clause
y = y + 1 { y > 0} which produces y = y { y > 0} or { y > -1}
Because {y > 1} → {y > -1}
The rule uses {y > 1} for the precondition of the whole selection statement.
Dr. M Al-Mulhem
ICS