Weakest Precondition Semantics Research Articles

Sound refactorings

Refactoring consists in restructuring an object-oriented program without changing its behaviour. In this paper, we present refactorings as transformation rules for programs written in a refinement language inspired on Java that allows reasoning about object-oriented programs and specifications. A set of programming laws is available for the imperative constructs of this language as well as for its object-oriented features; soundness of the laws is proved against a weakest precondition semantics. The proof that the refactoring rules preserve behaviour (semantics) is accomplished by the application of these programming laws and data simulation. As illustration of our approach to refactoring, we use our rules to restructure a program to be in accordance with a design pattern.

Quantum weakest preconditions

We develop a notion of predicate transformer and, in particular, the weakest precondition, appropriate for quantum computation. We show that there is a Stone-type duality between the usual state-transformer semantics and the weakest precondition semantics. Rather than trying to reduce quantum computation to probabilistic programming, we develop a notion that is directly taken from concepts used in quantum computation. The proof that weakest preconditions exist for completely positive maps follows immediately from the Kraus representation theorem. As an example, we give the semantics of Selinger's language in terms of our weakest preconditions. We also cover some specific situations and exhibit an interesting link with stabilisers.

Probabilistic guarded commands mechanized in HOL

The probabilistic guarded-command language ( pGCL) contains both demonic and probabilistic non-determinism, which makes it suitable for reasoning about distributed random algorithms. Proofs are based on weakest precondition semantics, using an underlying logic of real- (rather than Boolean-)valued functions. We present a mechanization of the quantitative logic for pGCL using the HOL theorem prover, including a proof that all pGCL commands satisfy the new condition sublinearity, the quantitative generalization of conjunctivity for standard GCL. The mechanized theory also supports the creation of an automatic proof tool which takes as input an annotated pGCL program and its partial correctness specification, and derives from that a sufficient set of verification conditions. This is employed to verify the partial correctness of the probabilistic voting stage in Rabin's mutual-exclusion algorithm.

Probabilistic Guarded Commands Mechanized in HOL

The probabilistic guarded-command language pGCL [Carroll Morgan, Annabelle McIver. pGCL: formal reasoning for random algorithms. South African Computer Journal (1999)] contains both demonic and probabilistic nondeterminism, which makes it suitable for reasoning about distributed random algorithms [Carroll Morgan. Proof rules for probabilistic loops. In Proceedings of the BCS-FACS 7th Refinement Workshop. He Jifeng, John Cooke and Peter Wallis (eds). Springer Verlag Workshops in Computing, 1996]. Proofs are based on weakest precondition semantics, using an underlying logic of real- (rather than Boolean-) valued functions.We present a mechanization of the quantitative logic for pGCL [Carroll Morgan, Annabelle McIver, and Karen Seidel, Probabilistic predicate transformers. ACM Transactions on Programming Languages and Systems, 18(3): 325–353, May 1996] using the HOL theorem prover [M.J.C. Gordon and T.F. Melham. Introduction to HOL (A theorem-proving environment for higher order logic). Cambridge University Press, 1993], including a proof that all pGCL commands satisfy the new condition sublinearity, the quantitative generalization of conjunctivity for standard GCL [E.W. Dijkstra. A Discipline of Programming. Prentice Hall, 1976].The mechanized theory also supports the creation of an automatic proof tool which takes as input an annotated pGCL program and its partial correctness specification, and derives from that a sufficient set of verification conditions. This is employed to verify the partial correctness of the probabilistic voting stage in Rabin's mutual-exclusion algorithm [Eyal Kushilevitz and Michael O. Rabin. Randomized mutual exclusion algorithms revisited. In Maurice Herlihy, editor, Proceedings of the 11th Annual Symposium on Principles of Distributed Computing, pages 275–283, Vancouver, BC, Canada, August 1992. ACM Press].

Compositionality in the puzzle of semantics

In this paper we study the connection between the structure of relational abstract domains for program analysis and compositionality of the underlying semantics. Both can be systematically designed as solution of the same abstract domain equation involving the same domain refinement: the reduced power operation. We prove that most well-known compositional semantics of imperative programs, such as the standard denotational and weakest precondition semantics can be systematically derived as solutions of simple abstract domain equations. This provides an equational presentation of both semantics and abstract domains for program analysis in a unique formal setting. Moreover both finite and transfinite compositional semantics share the same structure, and this allows us to provide consistent models for program manipulation.

A Weakest Precondition Semantics for Z

The lack of a method for developing programs from Z specifications is a widely recognized difficulty. In response to this problem, different approaches to the integration of Z with a refinement calculus have been proposed. These programming techniques are promising, but as far as we know, have not been formalized. Since they are based on refinement calculi formalized in terms of weakest preconditions, the definition of a weakest precondition semantics for Z is a significant contribution to the solution of this problem. In this paper, we actually construct a weakest precondition semantics from a relational semantics proposed by the Z standards panel. The construction provides reassurance as to the adequacy of the resulting semantics definition and additionally establishes an isomorphism between weakest preconditions and relations. Compositional formulations for the weakest precondition of some schema calculus expressions are provided.

Calculating with procedure calls

Although various proof rules for procedure calls in weakest precondition semantics have been proposed over the years [3, chapter 12] [4] [1], none of these is particularly suitable for calculational program construction. The problem is that they tend to yield a precondition that is tortuously expressed. For instance, let a procedure for finding the integer square root of a parameter y be specified, using a specification variable m , by the precondition

Software fault trees and weakest preconditions: a comparison and analysis

Software development in safety-critical systems demands techniques which provide both the precision of formal methods and the practicality of tried and trusted engineering methods, giving a measure of rigour as required by the application. In particular, reasoning about system behaviour in the presence of failures requires a realistic use of formal methods. We show how to capture the semantics implied by software fault trees using a form of weakest precondition programming in modelling the failure properties of different software expressions as an example. Leveson et al. [1] have used software fault trees to produce ‘failure templates’ at the statement level for the Ada programming language. These templates are concerned solely with logical program errors and not with compiler errors, control errors, memory errors etc. which could be captured by a system-wide view of the software. Furthermore, the notion of software fault tree ‘failure templates’ is confusing for safety engineers used to normal fault tree analysis; the trees are motivated by failures, rather than by working back from system hazards, and thus are much more akin to failure modes and effects analysis. We propose a more traditional view in the application of fault trees to software expressions, which leads to a difference in their expression in weakest precondition semantics.

Combining angels, demons and miracles in program specifications

The complete lattice of monotonic predicate transformers is interpreted as a command language with a weakest precondition semantics. This command lattice contains Dijkstra's guarded commands as well as miracles. It also permits unbounded nondeterminism and angelic nondeterminism. The language is divided into sublanguages using criteria of demonic and angelic nondeterminism, termination and absence of miracles. We investigate dualities between the sublanguages and how they can be generated from simple primitive commands. The notions of total correctness and refinement are generalized to the command lattice.

Refinement concepts formalised in higher order logic

Abstract A theory of commands with weakest precondition semantics is formalised using the HOL proof assistant system. The concept of refinement between commands is formalised, a number of refinement rules are proved and it is shown how the formalisation can be used for proving refinements of actual program texts correct.

Calculating with pointers

This note presents a calculational method for dealing with pointers in weakest precondition semantics. It aims at facilitating the verification of program fragments that use pointers, without recourse to operational reasoning. It is true that the unrestricted use of pointers may be considered somewhat oldfashioned. There is a growing consensus (to which the present author subscribes) that the derivation of correct programs is much to be preferred over any a posteriori verification. Types such as lists and trees have mathematical properties that are simpler than those of pointers, hence are more useful in program derivation. Recent publications concerning pointers typically propose schemes for their abolition [6, 7]. Nevertheless the study of pointers retains some importance, because the more abstract types are usually implemented by means of pointers and one wishes to prove the correctness of such an implementation. Moreover, there exist algorithms that exploit the aliasing effect provided by pointers for efficiency reasons [3].

The specification statement

Dijkstra's programming language is extended by specification statements , which specify parts of a program “yet to be developed.” A weakest precondition semantics is given for these statements so that the extended language has a meaning as precise as the original. The goal is to improve the development of programs, making it closer to manipulations within a single calculus. The extension does this by providing one semantic framework for specifications and programs alike: Developments begin with a program (a single specification statement) and end with a program (in the executable language). And the notion of refinement or satisfaction , which normally relates a specification to its possible implementations, is automatically generalized to act between specifications and between programs as well. A surprising consequence of the extension is the appearance of miracles : program fragments that do not satisfy Dijkstra's Law of the Excluded Miracle . Uses for them are suggested.

A generalized message-passing mechanism for communicating sequential processes

Bidirectional message-passing (bi-io), a novel symmetric communication mechanism for concurrent processes, is introduced and developed. The mechanism is symmetric in the sense that, in one atomic action, a message is transmitted in each direction between two processes. For some applications (tree structure, systolic arrays) this method is shown to have several advantages over conventional synchronization and communication primitives (mainly conciseness of programs, absence of certain types of deadlock). The mechanism is rigorously defined with a CSP-like syntax and a weakest-precondition semantics. Two systolic arrays are developed using bidirectional message-passing: a matrix-vector multiplier and a palindrome recognizer. >

Countable nondeterminism and random assignment

Four semantics for a small programming language involving unbounded (but countable) nondeterminism are provided. These comprise an operational semantics, two state transformation semantics based on the Egli-Milner and Smyth orders, respectively, and a weakest precondition semantics. Their equivalence is proved. A Hoare-like proof system for total correctness is also introduced and its soundness and completeness in an appropriate sense are shown. Finally, the recursion theoretic complexity of the notions introduced is studied. Admission of countable nondeterminism results in a lack of continuity of various semantic functions, and this is shown to be necessary for any semantics satisfying appropriate conditions. In proofs of total correctness, one resorts to the use of (countable) ordinals, and it is shown that all recursive ordinals are needed.

Flow graph machine models in microcode synthesis

Retargetability of microcode compilers is currently a major issue in microprogramming. We address the issue of local code generation from machine-independent specifications using weakest precondition semantics. The micromachine model used is a flow graph which is an abstract representation of the data paths of the machine. Examples of code generated by a prototype implementation are provided as an illustration of the method.

A Cook's Tour of Countable Nondeterminism

<p>We provide four semantics for a small programming language involving unbounded (but countable) nondeterminism. These comprise an operational one, two denotational ones based on the Egli-Milner and Smyth orders, respectively, and a weakest precondition semantics. Their equivalence is proved. We also introduce a Hoare-like proof system for total correctness and show its soundness and completeness in an appropriate sense. Admission of countable nondeterminism results in a lack of continuity of various semantic functions; moreover some of the partial orders considered are in general not cpo's and in proofs of total correctness one has to resort to the use of (countable) ordinals. Proofs will appear in the full version of the paper.</p>