%%% This is the scribe notes template for CS611
%%% There are several comments preceded by CS611: and boxed in %%%%'s 
%%% which indicate where macros should be altered to set up the header
%%% for the paper.  Your Notes should go at the comment SCRIBE NOTES GO HERE!.

%%% In the various .sty files that accompany this .tex file you will    
%%% find LaTeX macros that make it easier to typeset inference rules    
%%% and programming language constructs.  You must make sure that the   
%%% file proof.sty is in a path searched by LaTeX when you try to       
%%% use this file.  Take a look to see what macros are available--it    
%%% will save you time and make the notes look better.  Feel free to    
%%% extend the set of macros--post them to the newsgroup and contact    
%%% the course staff if you come up with some good ones so they can be  
%%% added to the template.                                              

%%% This template includes examples of how to use some of the macros
%%% to give you an idea of how they work.  (Delete the examples when
%%% you do your scribing.)

\documentclass{article} \usepackage{611-lecture} \usepackage{611}
\usepackage{amsthm, amsmath, amssymb, amsfonts}

\theoremstyle{definition}
\newtheorem*{defn}{Definition}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% CS611: Please fill in these macros as appropriate:
\lecture{15}                  %% Lecture number
\title{Axiomatics Semantics II and Hoare Logic}		   %% Title of lecture
\author{Bryant Adams, Mia Minnes}       %% name of scribe
\lecturer{Michael Clarkson}
\date{30 September, 2005}     %% Date of lecture, e.g., 1 January 2001
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% See 611.sty for a variety of macros that will be helpful in
% typesetting the lecture. Here are a few of particular interest:
%
% "x"	 	x in keyword font (e.g., "if", "#t")
% _x_	 	x in italics
% \nm{n}   	n in slanted font (used for abbreviations)
%          	(if x is more than a single character, use \Tr{x}{y})

\begin{document}

\maketitle

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% CS611: SCRIBE NOTES GO HERE!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


\section{Axiomatic Semantics II}
\subsection{Refinement}
\begin{defn}
For programs "S" and "T", we say that  "S" {\bf refines} "T" iff the set of possible outcomes of "S" is a (not necessarily strict) subset of the set of possible outcomes of "T".
\end{defn}

\noindent Consider, for example
\begin{eqnarray*}
"S" : & \qquad & "if" \: x=1 \to y := 1 \: \square \:  x \neq 1 \to "skip" \: "fi" \\
"T" : & \qquad & "if" \: x=1 \to y:=1 \: \square \: x =1 \to y:=2 \: \square \: x \neq 1 \to "skip" \: "fi"
\end{eqnarray*}
Then the possible outcomes of "S" are $\{ (x=1, y=1), (x \neq 1, y= ?) \}$, and the possible outcomes of "T" are $\{ (x=1, y=1), (x=1, y=2), (x \neq 1, y=?) \}$.  Hence, "S" refines "T".

\noindent Note that the definition of refinement is non-trivial only in the case of languages with non-deterministic choice.  Otherwise, each program has exactly one possible outcome.

\subsection{Weakest Liberal Preconditions}
Recall that the weakest precondition for "DO" was not computationally tractable.  But, we're often interested in computing preconditions in order to verify program correctness.  

\begin{defn}
"Q" is a {\bf liberal precondition} for program "S" with postcondition "R" if when "Q" is satisfied before execution, "S" terminating implies that "R" holds after execution.
\end{defn}

\begin{defn}
The {\bf weakest liberal precondition} (wlp) is the weakest condition which guarantees that the postcondition is met if the program terminates (so the program is allowed to not terminate).  More formally, $"Q" = wlp."S"."R"$ if and only if "Q" is a liberal precondition and for all liberal preconditions "Q'",  $"Q'" \implies  "Q"$.
\end{defn}

\noindent In fact, we won't be able to give an easily computable definition for the wlp of "DO".  But, we can find some liberal precondition (that won't necessarily be the weakest).  In other words, we will find "Q" such that $"Q" \implies wlp."S"."R"$.

\noindent Recall that "DO" loops are defined as
\begin{eqnarray*}
D &::=& "DO" B_{1} \to S_{1} \square \cdots \square B_{n} \to S_{n} "OD" \\
"BB" &\definedas & \exists i : B_{i}\\
"IF" & \definedas & "IF" B_{1} \to S_{1} \square \cdots \square B_{n} \to S_{n} "FI" \qquad \text{corresponding to "DO"}
\end{eqnarray*}
We say that $wlp."DO"."R" \leftarrow "Q"$ if the following conditions are met for any "P":
\begin{enumerate}
\item $"Q" \implies "P"$
\item $"P" \wedge "BB" \implies wlp."IF"."P"$
\item $"P" \wedge \neg "BB" \implies "R"$.
\end{enumerate}

\noindent The "P" in the definition above is a {\bf loop invariant}: it holds before and after the execution of the loop.  This is the definition of loop invariants.  Note that this definition allows the invariant not to hold somewhere inside iterations of the loop, so long as once the loop iteration is complete, the invariant holds again.

\noindent Let's look at an example of an invariant.  Consider the program which for some function $f: "Int" \to "Bool"$ finds the least $x$ such that $f.x$ (assume that $\exists x: f.x$ so program will terminate).  Define the program as:
\begin{eqnarray*}
&x :=& 0 ; \\
&"DO"&  \neg f.x \to x:= x+1; "OD"
\end{eqnarray*}
An appropriate postcondition to capture what we want the program to do is
\[
"R" : \qquad \qquad f.x \wedge (\forall i | 0 \leq i \lt x : \neg f.i )
\]
(read as \textquotedblleft $f$ holds of $x$ and for all numbers smaller than $x$, $f$ doesn't hold of them\textquotedblright).  One method of finding a good precondition is by looking at ways of weakening the postcondition (i.e.\ allowing more states to satisfy the predicate).  For example, in this case, we can eliminate the conjunct asserting that we've already found a good $x$.  This yields the precondition
\[
"P" : \qquad \qquad \forall i | 0 \leq i \lt x : \neg f.i
\]
Using the definition of $wlp$ we can check that "P" itself is a liberal precondition for this program.

\noindent We can also define $wlp$'s for the rest of the GCL syntax:
\begin{itemize}
\item As before, $wlp."skip"."R" = "R"$, $wlp."x:=e"."R" = "R"_{"e"}^{x}$, $wlp."S_{1}; S_{2}"."R" = wlp."S_{1}".(wlp."S_{2}"."R")$
\item $wlp."IF"."R" = (\forall i: B_{i} \implies wlp."S_{i}"."R")$ \qquad \qquad (Note that we no longer require "BB".)
\item $wlp$ for "DO" is above.
\end{itemize}

\section{Hoare Logic}
As we saw in the section above, calculating preconditions by hand is hard and not always tractable.  We will now define a logic which allows us to reason about when assertions hold and therefore (hopefully) bypass most of these kinds of computations.

\noindent There are two kinds of approaches to program verification:
\begin{itemize}
\item Partial correctness: check if program is correct when it terminates (for example $wlp$ and the Hoare logic we'll define shortly)
\item Total correctness: ensure both that the program terminates and that it is correct (for example, $wp$).  
\end{itemize}

\subsection{Language and Semantics}
\noindent To define Hoare logic, we need to define the language of the formula, i.e\ what are well-formed formulas in the logic.  The formulas will be {\bf Hoare triples}, and will look like:
\[
\{ "Q" \} "S" \{ "R" \}.
\]
Informally, when we write a Hoare triple we will want to mean \textquotedblleft if "Q" holds before execution of "S" then if "S" terminates, "R" holds after execution\textquotedblright.  Formally, we introduce the validity symbol $\vDash$ and define:
\[
\vDash \{ "Q" \} "S" \{ "R"\} \qquad \qquad \iff \qquad \qquad "Q" \implies wlp."S"."R"
\]

\noindent Comment: The definition above of the meaning of Hoare triples is only one of many possible definitions.  The definition of Hoare triples depends on the semantics of the programming language being analyzed.

\noindent We have yet to formalize what predicates can be.  Assume that there is some set $Pred$ such that $"Q", "R" \in Pred$ and that we also have a semantics on this set, i.e.\ a way of determining whether "Q", "R" hold.  More notation:
\[
I\SB {"Q"} \qquad \qquad \equiv \qquad \qquad \vDash_{I} "Q".
\]
which (in words) says that \textquotedblleft "Q" has meaning $\SB{"Q"}$ according to $I$ is equivalent to "Q" being valid in interpretation $I$ \textquotedblright.   One catch - whether a predicate holds or not may depend on the value of variables (i.e.\ on the store).  So, we say that $\vDash_{I} "Q"$ if $\forall \sigma. \sigma \vDash_{I} "Q"$, or $\forall \sigma. I \SB{"Q"} \sigma$.
Now we can write the semantics of Hoare triples more formally:
\[
\vDash_{I} \{ "Q" \} "S" \{ "R"\} \qquad \definedas \qquad \vDash_{I} "Q" \implies wlp."S"."R" \qquad \equiv \qquad \forall \sigma. \left( \sigma \vDash_{I} "Q" \implies \sigma \vDash_{I} wlp."S"."R" \right)
\]
and in words: \textquotedblleft a Hoare triple condition is valid if for every state, if the state satisfies "Q" then it also satisfies the weakest liberal precondition of "S" and "R" \textquotedblright.

\subsection{Proof rules}
Let $\vdash$ be the symbol for {\bf provability} and we'd like to ask when we can write $\vdash \{ "Q" \} "S" \{ "R" \}$, i.e.\ when we can say that the Hoare triple is provable.  We need to start with a set of axioms and a set of rules of inferences.  Note that these axioms and rules of inference depend on which language we are verifying.  

\noindent For IMP: We give rule schema (recall that these are valid for any instantiation of the meta-variables).  
\begin{enumerate}
\item (Axiom) \Rule{}{\vdash \{"Q"\} "skip" \{ "Q" \}}
\item (Axiom) \Rule{}{\vdash \{"Q"_{"e"}^{x} \} \, x:="e" \, \{ "Q" \}}
\item (Rule - for sequences ) \Rule{\vdash \{ "Q" \} "S_{1}" \{ "T" \} \qquad \vdash \{"T" \} "S_{2}" \{ "R"\}}{ \vdash \{ "Q" \} "S_{1}" ; "S_{2}" \{ "R" \}}
\item (Rule - for "if" statements) \Rule{\vdash \{ "Q" \wedge "B" \} "S_{1}" \{ "R" \} \qquad \vdash \{"Q" \wedge \neg"B" \} "S_{2}" \{ "R"\}}{ \vdash \{ "Q" \} "if" \, "B" \, "then" \, "S_{1}" \, "else" \, "S_{2}" \{ "R" \}}
\item (Rule - establishes loop invariants) \Rule{\vdash \{ "P" \wedge "B" \} "S" \{ "P" \}}{\vdash \{ "P"\} "while" \, "B" \, "do" \, "S" \{ "P" \wedge \neg "B" \}}
\item (Rule of consequence - uses semantics of predicates) \Rule{\vDash_{I} "Q" \implies "Q'" \qquad \vdash \{ "Q'" \} "S" \{ "R' "\}  \qquad \vDash_{I} "R'" \implies "R" }{\vdash \{ "Q" \} "S" \{ "R" \}}
\end{enumerate}

\noindent Note the parallels between the above proof rules and the definitions of $wlp$.  This will be the reason for the following observations.

\noindent Two fundamental properties of a logic are
\begin{enumerate}
\item Soundness: The proof system never lets you derive formulas that are false.
\[
\vdash \{ "Q" \} "S" \{ "R" \}  \implies \vDash  \{ "Q" \} "S" \{ "R" \} 
\]
\item Completeness: There are no true formulas which are not provable.
\[
\vDash  \{ "Q" \} "S" \{ "R" \}  \implies \vdash  \{ "Q" \} "S" \{ "R" \} 
\]
\end{enumerate}

\noindent Hoare logic as presented is sound but not complete.  However, it is relatively complete given an oracle for the semantics of predicates (in particular, the oracle answers the question \textquotedblleft Does "P" imply "Q" \textquotedblright for predicates), if the predicate language is expressive (i.e.\ if it is possible to write any precondition as a predicate).  For more on this, see Winskel.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\end{document}
