\documentclass[letterpaper]{article}
\usepackage{hyperref} % to force pdflatex to export letterpaper size
\usepackage{611-lecture}
\usepackage{amsmath}
\newcommand{\nondet}{\left[\!\right]}

\lecture{13}
\title{Predicate transformers}
\lecturer{Michael Clarkson}
\author{Asif-ul Haque and Ryan Peterson}
\date{26 September 2005}


\begin{document}

\maketitle

So far we have focused on operational semantics, which are natural for
modeling computation or talking about how state changes from one step
of the computation to the next. Here we introduce axiomatic semantics,
which makes it possible to talk about a program's correctness and
prove that a program does what it is designed to do.

\section{Preconditions and postconditions}

Consider the following program "EXP", which computes $x^p$:
\[ \begin{array}{l}
\quad y = 1 \\
\WHILE~p \gt 0~\DO \\
\quad y = y \times x \\
\quad p = p - 1 \\
\end{array} \]
We can talk about the _preconditions_ and the _postconditions_ of
"EXP", or what must be true before and after the program
executes. Because of the goal-oriented nature of programming, the
program itself is more suitable for finding postconditions than
preconditions. In other words, the program and its initial values
imply its values after execution. Axiomatic semantics attempts to go
the other way: given a program and its postconditions, we would like to
derive its preconditions.

For example, one precondition is $p \ge 0$ because "EXP" will only
compute $x^p$ correctly if that holds. Note that $p \gt 0$ is also a
valid precondition---it too ensures that the program computes the
correct value. However, the latter precondition implies the former,
meaning the latter is _stronger_ and the former is _weaker_.
\[ \underbrace{p \gt 0}_{\mbox{stronger}} \implies \underbrace{p \ge
  0}_{\mbox{weaker}} \]
We would like to use the weaker precondition because it is less
restrictive in the possible starting value of $p$. This generalizes to
preconditions of all programs: we always want to find the _weakest
preconditions_ (abbreviated $wp$).

Let $wp.S.R$ denote the weakest precondition such that program $S$
establishes $R$ and $S$ terminates. As in the $\lambda$-calculus, the
dot represents function application, so $wp$ can be viewed as a
higher-order function that takes a program and postcondition
predicates and returns the weakest precondition predicates. Put
differently, if $Q = wp.S.R$,
\[ Q \mbox{ holds initially} \implies S \mbox{ terminates and } R
\mbox{ holds afterwards}. \]
To capture that $Q$ is the _weakest_ precondition, if $P$ is the set
of all preconditions of $S$,
\[ \forall Q' \in P,~Q' \implies Q. \]
$wp$ can also be viewed as taking a program and returning a function
that maps postconditions to preconditions. For this reason, axiomatic
semantics is also known as predicate-transformation semantics.

\section{Guarded Command Language}

Dijkstra introduced the Guarded Command Language (GCL) with the
grammar
\[
\begin{array}{lcl}
S &::=& \SKIP~|~x := E~|~S_1;~S_2~|~\IF~|~\DO \\[6pt]
\IF &::=& "if"~B_1 \rightarrow S_1 \nondet B_2 \rightarrow S_2 \nondet
\cdots \nondet B_n \rightarrow S_n~"fi" \\[6pt]
\DO &::=& "do"~B_1 \rightarrow S_1 \nondet B_2 \rightarrow S_2 \nondet
\cdots \nondet B_n \rightarrow S_n~"od" \\[6pt]
\end{array}
\]
Note the distinction between bar ($|$) and nondeterministic choice
($\nondet$). Each of the $B_i$s are called _guards_ because they guard
the corresponding statements. In \IF{} statements, at least one of the
guards is true and the others are false; it is an error if none of
the guards is true. To execute the \IF, exactly one of the true guards
is chosen nondeterministically and the corresponding statement is
executed. \DO{} works similarly except that after executing a
statement corresponding to a true guard, the guards are reexamined and
if there are any remaining true guards, one of them is chosen
nondeterministically and its statement is executed. This repeats until
all guards are false.

\section{Weakest preconditions in the GCL}

We now show how to determine the weakest preconditions for each part
of the GCL, as well as provide generic examples and special cases of
the $wp$ function.

\subsection*{SKIP statements}

Since \SKIP{} does not do anything, we have
\[ wp. \SKIP.R = R. \]
Examples:
\begin{itemize}
\item[] $wp. \SKIP.(x=1) = (x=1)$
\item[] $wp.\SKIP.\FALSE = \FALSE$
\end{itemize}

\subsection*{Assignment statements}

To determine what condition must be true for $R$ to hold after the the
execution of $x:=E$, we have to substitute $x$ for $E$ in $R$ and
solve. Therefore,
\[ wp.(x := E).R = R^x_E~(= R\{E/x\}). \]
Examples:
\begin{itemize}
\item[] $wp.(x := 1). (x = 1) = \TRUE.$ In words, $x=1$ is true after
  $x:=1$ no matter what holds before execution.
\item[] $wp. (y := 1). (x = 1) = (x = 1)$
\item[] $wp. (x := x + 1).(x = 2)$ \\[2pt]
\begin{tabular}{ll}
$\quad \Rightarrow (x = 2)^{x}_{x + 1}$ & by defn of assignment
  \\[2pt]
$\quad \Rightarrow x + 1 = 2$ & by substitution \\[2pt]
$\quad \Rightarrow  x = 1$ & by arithmetic \\[2pt]
\end{tabular}\\[2pt]
So $wp. (x := x + 1). (x = 2) = (x = 1).$
\end{itemize}

\subsection*{Sequences of statements}

To determine the weakest precondition for which $R$ holds after
executing $S_1;~S_2$ we first find the weakest precondition for which
$R$ holds after the execution of $S_2$ (i.e. $wp. S_2. R$) and
determine the weakest precondition such that $wp. S_2. R$ holds after
executing $S_1$.
\[ wp. (S_1;~S_2). R = wp. S_1. (wp. S_2. R) \]
Example:
\begin{itemize}
\item[] $wp.(x := 1;~y := 2).(x = 1 \wedge y = 2)$ \\[2pt]
\begin{tabular}{ll}
$\quad \Rightarrow wp. (x:=1). (wp.(y:=2). (x=1 \wedge y=2))$ & by
  defn of ; \\[2pt]
$\quad \Rightarrow wp. (x:=1).(x=1 \wedge 2=2)$ & by defn of
  assignment \\[2pt]
$\quad \Rightarrow (1=1 \wedge 2=2)$ & by defn of
  assignment \\[2pt]
$\quad \Rightarrow \TRUE$ & by predicate calculus \\[2pt]
\end{tabular} \\[2pt]
\end{itemize}

\subsection*{IF statements}

In an \IF{} statement, $B_i$ must be true for at least one $i$. Let
$BB = \exists k: B_k$ to express that condition. Since the $S_i$ for
which $B_i$ is true is chosen nondeterministically, the weakest
precondition of an \IF{} statement is the conjunction of all such
$wp. S_i.R$:
\[ wp. \IF. R = BB \wedge (\forall i: B_i \implies wp. S_i. R) \]
Example:
\begin{itemize}
\item[] Given the definition of "MAX" \\[4pt]
\begin{tabular}{l}
  "if" $x \ge y \rightarrow z := x$ \\
  $\nondet~y \ge x \rightarrow z := y$ \\
  "fi" \\
\end{tabular} \\[2pt]
prove that $z = x \nm{~max~} y$ after the execution of "MAX". \\
\begin{tabular}{ll} \\[2pt]
$wp. "MAX". (z = x \nm{~max~} y)$ & \\[2pt]
$\quad \Rightarrow (x \ge y \vee y \ge x) ~\wedge $ & \\[2pt]
$\qquad (x \ge y \implies (wp.z:= x).(z=x \nm{~max~} y)) ~\wedge $ &
  \\[2pt]
$\qquad (y \ge x \implies wp.(z:=y).(z=x \nm{~max~} y)) $ & by
  definition of \IF\\[2pt]
$\quad \Rightarrow (x \ge y \implies x = x \nm{~max~} y) ~\wedge $ &
  \\[2pt]
$\qquad (y \ge x \implies y = x \nm{~max~} y)$ & by predicate
  calculus, defn of assignment \\[2pt]
$\quad \Rightarrow \TRUE$ & by predicate calculus \\[2pt]
\end{tabular}
\end{itemize}

\subsection*{DO statements}

Since \DO{} has the complication that it may not terminate, it is
difficult to formalize its weakest precondition such that $R$
holds. We say
\[ wp.\DO.R = \exists k: H_k. R \]
where informally $H_k.R$ is the weakest precondition such that \DO{}
terminates in at most $k$ iterations, satisfying $R$. Therefore,
$H_0.R$ means $R$ holds and no guard condition is true. Formally,
\[ H_0.R=(R \wedge \neg BB) \]
for $BB$ as defined above for \IF{} statements. Inductively, we can
say
\[ H_k.R = H_0. R \vee wp. \IF. (H_{k-1}.R), \]
meaning either the loop terminates now and $R$ holds ($H_0.R$), or
an \IF{} is executed and the loop terminates in at most $k-1$
iterations and $R$ holds afterwards.

\end{document}
