1. Program verification: flowchart programs
(Book: chapter 7)

2. History Verification of flowchart programs: Floyd, 1967
Hoare’s logic: Hoare, 1969
Linear Temporal Logic: Pnueli, Krueger, 1977
Model Checking: Clarke & Emerson, 1981

3. Program Verification Predicate (first order) logic.
Partial correctness, Total correctness
Flowchart programs
Invariants, annotated programs
Well founded ordering (for termination)
Hoare’s logic

4. Predicate (first order logic)
Variables, functions, predicates
Terms
Formulas (assertions)

5. Signature Variables: v1, x, y18
Each variable represents a value of some given domain (int, real, string, …).
Function symbols: f(_,_), g2(_), h(_,_,_).
Each function has an arity (number of paramenters), a domain for each parameter, and a range.
f:int*int->int (e.g., addition), g:real->real (e.g., square root)
A constant is a predicate with arity 0.
Relation symbols: R(_,_), Q(_).
Each relation has an arity, and a domain for each parameter.
R : real*real (e.g., greater than).
Q : int (e.g., is a prime).

6. Terms Terms are objects that have values. Each variable is a term.
Applying a function with arity n to n terms results in a new term.
Examples: v1, 5.0, f(v1,5.0), g2(f(v1,5.0))
More familiar notation: sqr(v1+5.0)

7. Formulas Applying predicates to terms results in a formula.
R(v1,5.0), Q(x)
More familiar notation: v1>5.0
One can combine formulas with the boolean operators (and, or, not, implies).
R(v1,5.0)->Q(x)
x>1 -> x*x>x
One can apply existentail and universal quantification to formulas.
x Q(X) x1 R(x1,5.0) x y R(x,y)

8. A model, A proofs
A model gives a meaning (semantics) to a first order formula:
A relation for each relation symbol.
A function for each function symbol.
A value for each variable.
An important concept in first order logic is that of a proof. We assume the ability to prove that a formula holds for a given model.
Example proof rule (MP) : 

9. Flowchart programs Input variables: X=x1,x2,…,xl
Program variables: Y=y1,y2,…,ym
Output variables: Z=z1,z2,…,zn
start
Z=h(X,Y)
Y=f(X)
halt

10. Assignments and tests T F
Y=g(X,Y)
t(X,Y)

11. Initial condition
start
Initial condition: the values for the input variables for which the program must work.
x1>=0 /\ x2>0
(y1,y2)=(0,x1)
y2>=x2 F T
(y1,y2)=(y1+1,y2-x2)
(z1,z2)=(y1,y2)
halt

12. The input-output claim
start
The relation between the values of the input and the output variables at termination.
x1=z1*x2+z2 /\
0<=z2<x2
(y1,y2)=(0,x1)
y2>=x2 T F
(y1,y2)=(y1+1,y2-x2)
(z1,z2)=(y1,y2)
halt

13. Partial correctness, Termination, Total correctness
Partial correctness: if the initial condition holds and the program terminates then the input-output claim holds.
Termination: if the initial condition holds, the program terminates.
Total correctness: if the initial condition holds, the program terminates and the input-output claim holds.

14. Subtle point: The program is partially correct with respect to
start
halt
(y1,y2)=(0,x1)
y2>=x2
(y1,y2)=(y1+1,y2-x2)
(z1,z2)=(y1,y2) T F
The program is
partially correct with
respect to
x1>=0/\x2>=0
and totally correct
with respect to
x1>=0/\x2>0

15. Annotating a scheme
start A
Assign an assertion for each pair of nodes. The assertion expresses the relation between the variable when the program counter is located between these nodes.
(y1,y2)=(0,x1) B T F
y2>=x2 C D
(y1,y2)=(y1+1,y2-x2)
(z1,z2)=(y1,y2) E
halt

16. Invariants
Invariants are assertions that hold at each state throughout the execution of the program.
One can attach an assertion to a particular location in the code: e.g., at(B) (B). This is also an invariant; in other locations, at(B) does not hold hence the implication holds.
If there is an assertion attached to each location, (A), (B),  (C), (D), (E), then their disjunction is also an invariant: (A)\/(B)\/ (C)\/(D)\/(E) (since location is always at one of these locations).

17. Annotating a scheme with invariants
start A
A): x1>=0 /\ x2>=0
B): x1=y1*x2+y2 /\ y2>=0
C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2
D):x1=y1*x2+y2 /\ y2>=0 /\ y2<x2
E):x1=z1*x2+z2 /\
0<=z2<x2
Notice: (A) is the initial condition,  Eis the input-output condition.
(y1,y2)=(0,x1) B T F
y2>=x2 C D
(y1,y2)=(y1+1,y2-x2)
(z1,z2)=(y1,y2) E
A) Is the precondition of (y1,y2)=(0,x1) and B) is its postcondition
halt

18. Preliminary: Relativizing assertions
(B) : x1= y1 * x2 + y2 /\ y2 >= 0
Relativize B) w.r.t. the assignment, obtaining B) [Y\g(X,Y)]
(I.e., (B) expressed w.r.t. variables at A.)
 (B)A =x1=0 * x2 + x1 /\ x1>=0
Think about two sets of variables, before={x, y, z, …} after={x’,y’,z’…}.
Rewrite (B) using after, and the assignment as a relation between the set of variables. Then eliminate after by substitution.
Here: x1’=y1’ * x2’ + y2’ /\ y2’>=0 /\ x1’=x1 /\ x2’=x2 /\ y1’=0 /\ y2’=x1 now eliminate x1’, x2’, y1’, y2’. A
(y1,y2)=(0,x1)
Y=g(X,Y) B A
(y1,y2)=(0,x1) B

19. Preliminary: Relativizing assertions
(B)A
(y1,y2)=(0,x1)
Y=g(X,Y)
A): B
Y=g(X,Y) A
(B)
(y1,y2)=(0,x1) B

20. Verification conditions: assignment
A)  B)A where B)A = B)[Y\g(X,Y)]
A): x1>=0 /\ x2>=0
B): x1=y1*x2+y2 /\ y2>=0
B)A=
x1=0*x2+x1 /\ x1>=0 A
(y1,y2)=(0,x1)
Y=g(X,Y) B A
(y1,y2)=(0,x1) B

21. Second assignment C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2
B): x1=y1*x2+y2 /\ y2>=0
B)C: x1=(y1+1)*x2+y2-x2 /\ y2-x2>=0 C
(y1,y2)=(y1+1,y2-x2) B

22. Third assignment D):x1=y1*x2+y2 /\ y2>=0 /\ y2<x2
E):x1=z1*x2+z2 /\ 0<=z2<x2
E)D: x1=y1*x2+y2 /\ 0<=y2<x2 D
(z1,z2)=(y1,y2) E

23. Verification conditions: testsB T F
t(X,Y)
B) /\ t(X,Y)  C)
B) /\¬t(X,Y)  D)
B): x1=y1*x2+y2 /\y2>=0
C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2
D):x1=y1*x2+y2 /\ y2>=0 /\ y2<x2 C D B T F
y2>=x2 C D

24. Verification conditions: testsB T F
t(X,Y) C
C) D
t(X,Y)
¬t(X,Y)
B) B T F
y2>=x2 C D

25. Partial correctness proof: An induction on length of execution
Initially, states satisfy the initial conditions.
Then, passing from one set of states to another, we preserve the invariants at the appropriate location.
We prove: starting with a state satisfying the initial conditions, if are at a point in the execution, the invariant there holds.
Not a proof of termination!
A) no
B)
yes
start A
C)
(y1,y2)=(0,x1) B T F no
B)
y2>=x2 C D
yes
(y1,y2)=(y1+1,y2-x2)
(z1,z2)=(y1,y2) E
D)
halt

26. Exercise: prove partial correctness
start
(y1,y2)=(0,1)
Initial condition:
x>=0
Input-output claim:
z=x! F T
y1=x
(y1,y2)=(y1+1,(y1+1)*y2)
z=y2
halt

27. What have we achieved?
For each statement S that appears between points X and Y we showed that if the control is in X when (X) holds (the precondition of S) and S is executed, then (Y) (the postcondition of S) holds.
Initially, we know that (A) holds.
The above two conditions can be combined into an induction on the number of statements that were executed:
If after n steps we are at point X, then (X) holds. 15

28. Another example start (y1,y2,y3)=(0,0,1) A halt y2>x
(y1,y3)=(y1+1,y3+2)
z=y1 B C D F
true
false E
y2=y2+y3
(A) : x>=0
(F) : z^2<=x<(z+1)^2
z is the biggest number
that is not greater
than sqrt x. 16

29. Some insight start (y1,y2,y3)=(0,0,1) A halt y2>x
(y1,y3)=(y1+1,y3+2)
z=y1 B C D F
true
false E
y2=y2+y3
1+3+5+…+(2n+1)=(n+1)^2
y2 accumulates the
above sum, until
it is bigger than x.
y3 ranges over odd
numbers 1,3,5,…
y1 is n-1. 17

30. Invariants start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2)
z=y1 B C D F
true
false E
y2=y2+y3
It is sufficient to have one
invariant for every loop
(cycle in the program’s
graph).
We will have
(C)=y1^2<=x /\
y2=(y1+1)^2 /\
y3=2*y1+1 18

31. Obtaining (B) start (y1,y2,y3)=(0,0,1) A halt y2>x
(y1,y3)=(y1+1,y3+2)
z=y1 B C D F
true
false E
y2=y2+y3
By backwards substitution in (C).
(C)=y1^2<=x /\
y2=(y1+1)^2 /\
y3=2*y1+1
(B)=y1^2<=x /\
y2+y3=(y1+1)^2 /\ 19

32. Check assignment condition
start
(y1,y2,y3)=(0,0,1) A
halt
y2>x
(y1,y3)=(y1+1,y3+2)
z=y1 B C D F
true
false E
y2=y2+y3
(A)=x>=0
(B)=y1^2<=x /\
y2+y3=(y1+1)^2 /\
y3=2*y1+1
(B) relativized is
0^2<=x /\
0+1=(0+1)^2 /\
1=2*0+1
Simplified: x>=0 20

33. Obtaining (D) start (y1,y2,y3)=(0,0,1) A halt y2>x
(y1,y3)=(y1+1,y3+2)
z=y1 B C D F
true
false E
y2=y2+y3
By backwards substitution in
(B).
(B)=y1^2<=x /\
y2+y3=(y1+1)^2 /\
y3=2*y1+1
(D)=(y1+1)^2<=x /\
y2+y3+2=(y1+2)^2 /\
y3+2=2*(y1+1)+1 21

34. Checking start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2)
z=y1 B C D F
true
false E
y2=y2+y3
(C)=y1^2<=x /\
y2=(y1+1)^2 /\
y3=2*y1+1
(C)/\y2<=x)  (D)
(D)=(y1+1)^2<=x /\
y2+y3+2=(y1+2)^2 /\
y3+2=2*(y1+1)+1 22

35. y1^2<=x /\ y1^2<=x /\ y2=(y1+1)^2 /\ y2=(y1+1)^2 /\
y3=2*y1+1 /\y2<=x 
(y1+1)^2<=x /\
y2+y3+2=(y1+2)^2 /\
y3+2=2*(y1+1)+1
y1^2<=x /\
y2=(y1+1)^2 /\
y3=2*y1+1 /\y2<=x 
(y1+1)^2<=x /\
y2+y3+2=(y1+2)^2 /\
y3+2=2*(y1+1)+1
y1^2<=x /\
y2=(y1+1)^2 /\
y3=2*y1+1 /\y2<=x 
(y1+1)^2<=x /\
y2+y3+2=(y1+2)^2 /\
y3+2=2*(y1+1)+1 23

36. Not finished! start A (y1,y2,y3)=(0,0,1) Still needs to:
Calculate (E) by
substituting backwards
from (F).
Check that
(C)/\y2>x(E) B
y2=y2+y3 C
false
true
y2>x D E
(y1,y3)=(y1+1,y3+2)
z=y1 F
halt 24

37. Exercise: prove partial correctness. Initially: x1>0/\x2>0
Exercise: prove partial correctness. Initially: x1>0/\x2>0. At termination: z1=gcd(x1,x2).
start
(y1,y2)=(x1,x2)
y1=y2 F T
y1>y2 F T
z1=y1
y2=y2-y1
y1=y1-y2
halt

38. Annotation of program with invariants
gcd(y1,y2)=gcd(x1,x2)/\y1>0/\y2>0/\y1>y2
start
gcd(y1,y2)=gcd(x1,x2)/\y1>0/\y2>0/\y1<y2 A
x1>0 /\ x2>0
(y1,y2)=(x1,x2)
gcd(y1,y2)=gcd(x1,x2)/\y1>0/\y2>0 B
gcd(y1,y2)=gcd(x1,x2)/\y1>0/\y2>0/\y1y2
y1=y2 T F D G
y1=gcd(x1,x2) F T
y1>y2
z1=y1 E F
y2=y2-y1
y1=y1-y2 H
z1=gcd(x1,x2)
halt

39. Part 1 y1=y2 T F F T start y1>y2 z1=y1 y2=y2-y1 y1=y1-y2
(A)= x1>0 /\ x2>0
start
(B)=gcd(y1,y2)=gcd(x1,x2) /\y1>0/\y2>0 A
(B)’rel= gcd(x1,x2)=gcd(x1,x2)/\x1>0/\x2>0
(y1,y2)=(x1,x2)
(A) (B)’rel B
y1=y2 T F D G F T
y1>y2
z1=y1 E F
y2=y2-y1
y1=y1-y2 H
halt

40. Part 2a y1=y2 T F F T start y1>y2 z1=y1 y2=y2-y1 y1=y1-y2
(B)= gcd(y1,y2)=gcd(x1,x2)/\y1>0/\y2>0
start
(D)=gcd(y1,y2)=gcd(x1,x2)/\y1>0/\y2>0/\y1y2 A
(y1,y2)=(x1,x2)
(B)/\¬(y1=y2) (D) B
y1=y2 T F D G F T
y1>y2
z1=y1 E F
y2=y2-y1
y1=y1-y2 H
halt

41. Part 2b y1=y2 T F F T start y1>y2 z1=y1 y2=y2-y1 y1=y1-y2
(B)= gcd(y1,y2)=gcd(x1,x2)/\y1>0/\y2>0
start
(G)= y1=gcd(x1,x2) A
(B)/\(y1=y2) (G)
(y1,y2)=(x1,x2) B
y1=y2 T F D G F T
y1>y2
z1=y1 E F
y2=y2-y1
y1=y1-y2 H
halt

42. Part 3 y1=y2 T F F T start y1>y2 z1=y1 y2=y2-y1 y1=y1-y2
(F)=(gcd(y1,y2)=gcd(x1,x2) /\y1>0/\y2>0/\y1>y2
start
(D)/\(y1>y2) (F)
(E)=gcd(y1,y2)=gcd(x1,x2) /\y1>0/\y2>0/\y1<y2 A
(D)/\¬(y1>y2) (E)
(y1,y2)=(x1,x2) B
(D)= gcd(y1,y2)=gcd(x1,x2)/\y1>0/\y2>0/\y1y2
y1=y2 T F G D F T
y1>y2
z1=y1 E F
y2=y2-y1
y1=y1-y2 H
halt

43. Part 4 y1=y2 T F F T start y1>y2 z1=y1 y2=y2-y1 y1=y1-y2
(B)’rel1= gcd(y1,y2-y1)=gcd(x1,x2) /\y1>0/\y2-y1>0
(F)= gcd(y1,y2)=gcd(x1,x2) /\y1>0/\y2>0/\y1>y2
(B)’rel2= gcd(y1-y2,y2)=gcd(x1,x2) /\y1-y2>0/\y2>0
start
(E)= gcd(y1,y2)=gcd(x1,x2)/\y1>0/\y2>0/\y1<y2 A
x1>0 /\ x2>0
(y1,y2)=(x1,x2)
(B)= gcd(y1,y2)=gcd(x1,x2) /\y1>0/\y2>0 B
y1=y2 T F D G F T
y1>y2
z1=y1 E F
y2=y2-y1
y1=y1-y2 H
halt
(E) (B)’rel1
(F) (B)’rel2

44. Annotation of program with invariants
start
(H)’rel= y1=gcd(x1,x2) A
(y1,y2)=(x1,x2) B
(G)= y1=gcd(x1,x2)
y1=y2 T F D G F T
y1>y2
z1=y1 E F
(H)= z1=gcd(x1,x2)
y2=y2-y1
y1=y1-y2 H
halt
(G) (H)’rel2

45. Proving termination

46. Well-founded sets Partially ordered set (W,<):
If a<b and b<c then a<c (transitivity).
If a<b then not b<a (asymmetry).
Not a<a (irreflexivity).
Well-founded set (W,<):
Partially ordered.
No infinite decreasing chain a1>a2>a3>…

47. Examples for well founded sets
Natural numbers with the bigger than relation.
Finite sets with the set inclusion relation.
Strings with the substring relation.
Tuples with alphabetic order:
(a1,b1)>(a2,b2) iff a1>a2 or [a1=a2 and b1>b2].
(a1,b1,c1)>(a2,b2,c2) iff a1>a2 or [a1=a2 and b1>b2] or [a1=a2 and b1=b2 and c1>c2].

48. Why does the program terminate
start
y2 starts as x1.
Each time the loop is executed, y2 is decremented.
y2 is natural number
The loop cannot be entered again when y2<x2. A
(y1,y2)=(0,x1) B
y2>=x2 C
true
false D
(y1,y2)=(y1+1,y2-x2)
(z1,z2)=(y1,y2) E
halt

49. Proving termination Choose a well-founded set (W,<).
Attach a function u(N) to each point N.
Annotate the flowchart with invariants, and prove their consistency conditions.
Prove that j(N)  (u(N) in W).

50. How not to stay in a loop? Show that u(M)>=u(N)’rel.
At least once in each loop, show that u(M)>u(N). M S N M T N

51. How not to stay in a loop? M For stmt:
j(M)(u(M)>=u(N)’rel) Relativize since we need to compare values not syntactic expressions.
For test (true side):
(j(M)/\test)(u(M)>=u(N))
For test (false side):
(j(M)/\¬test)(u(M)>=u(L))
stmt N M
true
false
test N L

52. What did we achieve? There are finitely many control points.
The value of the function u cannot increase.
If we return to the same control point, the value of u must decrease (its a loop!).
The value of u can decrease only a finite number of times.

53. Why does the program terminate
start
u(A)=x1
u(B)=y2
u(C)=y2
u(D)=y2
u(E)=z2
W: naturals
> : greater than A
(y1,y2)=(0,x1) B
y2>=x2 C
true
false D
(y1,y2)=(y1+1,y2-x2)
(z1,z2)=(y1,y2) E
halt

54. Recall partial correctness annotation
start A
(y1,y2)=(0,x1)
j(A): x1>=0 /\ x2>=0
j(B): x1=y1*x2+y2 /\ y2>=0
j(C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2
j(D):x1=y1*x2+y2 /\ y2>=0 /\ y2<x2
j(E):x1=z1*x2+z2 /\
0<=z2<x2 B
true
false
y2>=x2 C D
(y1,y2)=(y1+1,y2-x2)
(z1,z2)=(y1,y2) E
halt

55. Strengthen for termination
start A
j(A): x1>=0 /\ x2>0
j(B): x1=y1*x2+y2 /\ y2>=0/\x2>0
j(C): x1=y1*x2+y2 /\ y2>=0/\y2>=x2/\x2>0
j(D):x1=y1*x2+y2 /\ y2>=0 /\ y2<x2/\x2>0
j(E):x1=z1*x2+z2 /\
0<=z2<x2
(y1,y2)=(0,x1) B
true
false
y2>=x2 C D
(y1,y2)=(y1+1,y2-x2)
(z1,z2)=(y1,y2) E
halt

56. Strengthen for termination
j(A): x1>=0 /\ x2>0 u(A)>=0
j(B): x1=y1*x2+y2 /\ y2>=0/\x2>0u(B)>=0
j(C): x1=y1*x2+y2 /\y2>=0 /\y2>=x2/\x2>0u(c)>=0
j(D):x1=y1*x2+y2 /\ y2>=0 /\ y2<x2/\x2>0u(D)>=0
j(E):x1=z1*x2+z2 /\
0<=z2<x2u(E)>=0
This proves that u(M) is natural for each point M.
u(A)=x1
u(B)=y2
u(C)=y2
u(D)=y2
u(E)=z2

57. We shall show: start halt (y1,y2)=(y1+1,y2-x2) (z1,z2)=(y1,y2)B D E
false
y2>=x2 C
true
u(A)=x1
u(B)=y2
u(C)=y2
u(D)=y2
u(E)=z2
j(A)u(A)>=u(B)’rel
j(B)u(B)>=u(C)
j(C)u(C)>u(B)’rel
j(B)u(B)>=u(D)
j(D)u(D)>=u(E)’rel

58. Proving decrement start halt (y1,y2)=(y1+1,y2-x2) (z1,z2)=(y1,y2)B D E
false
y2>=x2 C
true
j(C): x1=y1*x2+y2 /\ y2>=0 /\ y2>=x2/\x2>0
u(C)=y2
u(B)=y2
u(B)’rel=y2-x2
j(C)  y2>y2-x2
(notice that j(C)  x2>0)

59. Integer square prog. start (y1,y2,y3)=(0,0,1) A halt y2>x
(y1,y3)=(y1+1,y3+2)
z=y1 B C D F
true
false E
y2=y2+y3
j(C)=y1^2<=x /\
y2=(y1+1)^2 /\
y3=2*y1+1
j(B)=y1^2<=x /\
y2+y3=(y1+1)^2
/\y3=2*y1+1

60. start (y1,y2,y3)=(0,0,1) A halt y2>x (y1,y3)=(y1+1,y3+2) z=y1 B C DF
true
false E
y2=y2+y3
u(A)=x+1
u(B)=x-y2+1
u(C)=max(0,x-y2+1)
u(D)=x-y2+1
u(E)=u(F)=0
u(A)>=u(B)’rel
u(B)>u(C)’rel
u(C)>=u(D)
u(C)>=u(E)
u(D)>=u(B)’rel
Need some invariants,
i.e., y2<=x/\y3>0
at points B and D,
and y3>0 at point C.

61. Program Verification Using Hoare’s Logic
Hoare triple is of the form {Precondition} Prog-segment {Postcondition}
It expresses partial correctness: if the segment starts with a state satisfying the precondition and it terminates, the final state satisfies the postscondition.
The idea is that one can decompose the proof of the program into smaller and smaller segments, depending on its structure.

62. While programs Assignments y:=e Composition S1; S2
If-then-else if t then S1 else S2 fi
While while e do S od

63. Greatest common divisor
{x1>0/\x2>0}
y1:=x1;
y2:=x2;
while ¬(y1=y2) do
if y1>y2 then y1:=y1-y2
else y2:=y2-y1 fi od
{y1=gcd(x1,x2)}

64. Why it works? Suppose that y1,y2 are both positive integers.
If y1>y2 then gcd(y1,y2)=gcd(y1-y2,y2)
If y2>y1 then gcd(y1,y2)=gcd(y1,y2-y1)
If y1=y2 then gcd(y1,y2)=y1=y2

65. Assignment axiom {p[e/y] } y:=e {p} For example:
{y+5=10} y:=y+5 {y=10}
{y+y<z} x:=y {x+y<z}
{2*(y+5)>20} y:=2*(y+5) {y>20}
Justification: write p with y’ instead of y, and add the conjunct y’=e. Next, eliminate y’ by replacing y’ by e.

66. Why axiom works backwards?
{p} y:=t {?}
Strategy: write p and the conjunct y=t, where y’ replaces y in both p and t. Eliminate y’.
This y’ represents value of y before the assignment.
{y>5} y:=2*(y+5) {? }
{p} y:=t { $y’ (p[y’/y] /\ t[y’/y]=y) }
y’>5 /\ y=2*(y’+5)  y>20

67. Composition rule {p} S1 {r }, {r} S2 {q } {p} S1;S2 {q}
For example: if the antecedents are
1. {x+1=y+2} x:=x+1 {x=y+2}
2. {x=y+2} y:=y+2 {x=y}
Then the consequent is
{x+1=y+2} x:=x+1; y:=y+2 {x=y}

68. More examples {p} S1 {r}, {r} S2 {q} {p} S1;S2 {q}
{x1>0/\x2>0} y1:=x1 {gcd(x1,x2)=gcd(y1,x2)/\y1>0/\x2>0}
{gcd(x1,x2)=gcd(y1,x2)/\y1>0/\x2>0} y2:=x2
___{gcd(x1,x2)=gcd(y1,y2)/\y1>0/\y2>0}____
{x1>0/\x2>0} y1:=x1 ; y2:=x2
{gcd(x1,x2)=gcd(y1,y2)/\y1>0/\y2>0}

69. If-then-else rule {p/\t} S1 {q}, {p/\¬t} S2 {q}
{p} if t then S1 else S2 fi {q}
For example:
p is gcd(y1,y2)=gcd(x1,x2)
/\y1>0/\y2>0/\¬(y1=y2)
t is y1>y2
S1 is y1:=y1-y2
S2 is y2:=y2-y1
q is gcd(y1,y2)=gcd(x1,x2)/\y1>0/\y2>0

70. While rule {p/\t} S {p} {p} while t do S od {p/\¬t} Example:
p is {gcd(y1,y2)=gcd(x1,x2)/\y1>0/\y2>0}
t is ¬ (y1=y2)
S is if y1>y2 then y1:=y1-y2 else y2:=y2-y1 fi

71. Consequence rules Strengthen a precondition rp, {p } S {q }
{r } S {q }
Weaken a postcondition
{p } S {q }, qr
{p } S {r }

72. Use of first consequence rule
Want to prove
{x1>0/\x2>0} y1:=x1 {gcd(x1,x2)=gcd(y1,x2)/\y1>0/\x2>0}
By assignment rule:
{gcd(x1,x2)=gcd(x1,x2)/\x1>0/\x2>0} y1:=x1
{gcd(x1,x2)=gcd(y1,x2)/\y1>0/\x2>0}
x1>0/\x2>0 gcd(x1,x2)=gcd(x1,x2)/\x1>0/\x2>0

73. Combining program {x1>0 /\ x2>0} y1:=x1; y2:=x1;
{gcd(x1,x2)=gcd(y1,y2)/\y1>0/\y2>0}
while S do
if e then S1 else S2 fi od
{gcd(x1,x2)=gcd(y1,y2)/\y1>0/\y2>0/\y1=y2}
Combine the above using concatenation rule!

74. Not completely finished
{x1>0/\x2>0}
y1:=x1; y2:=x1;
while ¬(y1=y2) do
if e then S1 else S2 fi od
{gcd(x1,x2)=gcd(y1,y2)/\y1>0/\y2>0/\y1=y2}
But we wanted to prove:
{x1>0/\x1>0} Prog {y1=gcd(x1,x2)}

75. Use of second consequence rule
{x1>0/\x2>0} Prog
{gcd(x1,x2)=gcd(y1,y2)/\y1>0/\y2>0/\y1=y2}
And the implication
gcd(x1,x2)=gcd(y1,y2)/\y1>0/\y2>0/\y1=y2
y1=gcd(x1,x2)
Thus,
{x1>0/\x2>0} Prog {y1=gcd(x1,x2)}

76. Annotating a while program
while ¬(y1=y2) do
{gcd(x1,x2)=gcd(y1,y2)/\ y1>0/\y2>0/\¬(y1=y2)}
if y1>y2 then y1:=y1-y2
else y2:=y2-y1 fi od
{y1=gcd(x1,x2)}
{x1>0/\x2>0}
y1:=x1;
{gcd(x1,x2)=gcd(y1,x2)
/\y1>0/\x2>0}
y2:=x2;
{gcd(x1,x2)=gcd(y1,y2)
/\y1>0/\y2>0}

77. While rule
{p/\e} S {p}
{p} while e do S od {p/\¬e}

78. Consequence rules Strengthen a precondition rp, {p} S {q} {r} S {q}
Weaken a postcondition
{p} S {q}, qr
{p} S {r}

79. Soundness Hoare logic is sound in the sense that
everything that can be proved is correct!
This follows from the fact that each axiom
and proof rule preserves soundness.

80. Completeness A proof system is called complete if every
correct assertion can be proved.
Propositional logic is complete.
No deductive system for the standard arithmetic can be complete (Godel).

81. And for Hoare’s logic? Let S be a program and p its precondition.
Then {p} S {false} means that S never terminates when started from p. This is undecideable. Thus, Hoare’s logic cannot be complete.

82. Weakest prendition, Strongest postcondition
For an assertion p and code S, let post(p,S) be the strongest assertion such that {p}S{post(p,S) }
That is, if {p}S{q} then post(p,S)q.
For an assertion q and code S, let pre(S,q) be the weakest assertion such that {pre(S,q)}S{q}
That is, if {p}S{q} then ppre(S,q).

83. Relative completeness
Suppose that either
post(p,S) exists for each p, S, or
pre(S,q) exists for each S, q.
Some oracle decides on pure implications.
Then each correct Hoare triple can be proved.
What does that mean? The weakness of the
proof system stem from the weakness of the (FO) logic, not of Hoare’s proof system.

84. Extensions Many extensions for Hoare’s proof rules: Total correctness
Arrays
Subroutines
Concurrent programs
Fairness

85. Proof rule for total correctness Similar idea to Floyd’s termination: Well foundedness
{p/\t/\f=z} S {p/\f<z}, p(f>=0) {p} while t do S od {p/\¬t}
where
z - an int. variable, not appearing in p,t,e,S.
f - an int. expression.