Weakest Precondition

A Hoare logic is complete if all valid Hoare triples are provable.

The general idea of proving Hoare logic completeness is to prove those Hoare triples with weakest preconditions are provable. Specifically, an assertion P is called the weakest precondition of c and Q if Hoare triple is valid and for any other P', if {{P'}} c {{Q}} is valid, then is valid. Again, remember that an assertion is called valid if it is satisfied on all interpreations.

Although this definition above is very natural, we can actually be more specific on what this weakest precondition should be.

This definition says: a beginning state st satisfies P if and only if all possible ending states of executing c will satisfy Q. This definition directly defines what interpreations satisfy P. Of course, it is consistent will our previous definition.

Hoare logic's completeness proof needs two important lemmas:

• expressiveness: for any c and Q, there is an assertion to express the weakest precondition of c and Q;
• if P expresses the weakest precondition of c and Q, then {{ P }} c {{ Q }} is provable.

Here are their formal statement.

We show that, if there two properties hold, the Hoare logic is complete given the fact that the assertion derivation logic itself is complete.

First, by expressiveness, there is an assertion P which can express c and Q's weakest precondition.

Next, by the fact that all triples with weakest preconditions are provable, we know that {{ P }} c {{ Q }} is provable.

Now, by the definition of "weakest_pre", we know that P' is semantically stronger than P.

Since we assume that the first order logic T is complete, we know that P' ⊢ P from the fact that P' IMPLY P is valid.

In the end, we complete our Hoare logic proof using the consequence rule.

Proof of Expressiveness

We prove this lemma by induction over the syntax tree of c.

If c = Skip

We are going to prove that: for any assertion Q, there is another assertion P such that P is c and Q's weakest precondition. Let P be Q. Then for given st and La, it is obvious that is equivalent to since c = Skip and P = Q.

If c = X ::= E

The conclusion can be easily proved if we let P be

If c = c₁ ;; c₂

IH₁: for any assertion Q, there is another assertion P such that wp P c₁ Q. IH2: for any assertion Q, there is another assertion P such that wp P c₂ Q. We are going to prove that: for any assertion Q, there is another assertion P such that wp P c Q. For a fixed postcondition Q of c, let Q₀ be c₂ and Q's weakest precondition and let P be c₁ and Q₀'s weakest precondition (they must exist according to IH). And we know that for any st and La, Combining them together, we have Thus, wp P (c₁;;c₂) Q.

If c = If b Then c₁ Else c₂ EndIf

IH₁: for any assertion Q, there is another assertion P such that wp P c₁ Q. IH2: for any assertion Q, there is another assertion P such that wp P c₂ Q. We are going to prove that: for any assertion Q, there is another assertion P such that wp P c Q. For a fixed postcondition Q of c, let P₁ be c₁ and Q's weakest precondition and let P₂ be c₂ and Q's weakest precondition (they must exist according to IH). And we know that for any st and La, Let P be P₁ AND [[b]] OR P₂ AND NOT [[b]] . Now, given an interpretation (st, La), it satisfies P if and only if one of the following is true: According to how P₁ and P₂ are introduced, we know P is a weakest precondition of c and Q, i.e. wp P c Q.

If c = While b Do c₁ EndWhile

This is the most difficult case. We want to find a weakest precondition of c and Q, with the help from induction hypothesis (IH) is: for any assertion Q', there is another assertion P' such that wp P' c₁ Q'. By the definition of wp, we want to find an assertion P such that: We know that only finite program variables can be mentioned in Q and c. Suppose they are X₁, X₂, ..., Xm. Then we can restate the criterion above — P should be (informally): In this informal statement, we use x(i,1), x(i,2), ..., x(i,m) to represent all program variables' values after i iterations. Property (1) says that (st, La) agree with the description of x(0,1), x(0,2), ..., x(0,m). Property (2.1) says that the loop condition is true after the first i iterations. Property (2.2) says: if the loop body of i+1th iteration terminates, its ending state is the one described by x(i+1,1), ..., x(i+1,m). Eventually, property (2.3) says: if the loop body of i+1th iteration will terminate. Noticing that this is almost an assertion, except for one thing — the dynamic sized quantification over integers xs. This problem can be solved by Godel's beta predicate.

Godel Beta Predicate

The Godel beta predicate Beta(a,b,i,x) is defined as: According to The Chinese remainder theorem, for any natural number n and natural number sequence x(0), x(1), ..., x(n), there always exist a and b such that for any 0 ≤ i ≤ n, That means, any quantification over sequences can be represented by a combination of a fixed number of normal quantification and the Godel beta predicate. For example, the following two statement are equivalent: and Using this method, we can easily state loops' weakest preconditions in our assertion language. This proves the expressiveness lemma.

Triples With Weakest Precondtions

In this part, we prove that if P is c and Q's weakest precondition, then the Hoare triple is provable. Noticing that the assertion P is not necessarily the weakest precondition constructed by the expressiveness lemma, we argue about all possible triples such that wp P c Q holds. Again, we prove this lemma by induction over the syntax tree of c.

If c = Skip

If P is a weakest precondition of c and Q, we know that P is actually equivalent with Q. Thus, P IMPLY Q is a valid first order proposition. By the assertion derivation logic's completeness, we know that P ⊢ Q which is immediately followed by ⊢ {{ P }} c {{ Q }} according to the consequence rule.

If c = X ::= E

The proof is similar.

If c = c₁ ;; c₂

The proof is similar.

If c = If b Then c₁ Else c₂ EndIf

The proof is similar.

If c = While b Do c₁ EndWhile

This is the only interesting case! Suppose wp P c Q. We know: Now, consider the weakest precondition of c₁ and P. We claim that P AND [[ b ]] is stronger than weakest preconditions of c₁ and P. For fixed st and La, if then for any st' Since b is true on st, we know that for any st' and st'', This is equivalent to say: for any st', By the fact that wp P c Q, we conclude that for any st', Now, suppose P' is a weakest precondtion of c and P (by expressiveness lemma, it must exist). What we just proved means that (P AND [[ b ]]) IMPLY P' is a valid assertion. By the first order logic's completeness, By induction hypothesis: Then by the consequence rule: Thus, At the same time, due to wp P c Q, it is obvious that if (st, La) ⊨ P AND NOT [[ b ]] on some interpretation (st, La), then (st, La) ⊨ Q. In other words, (P AND NOT [[ b ]]) IMPLY Q is valid. Thus, So, This proves that all triples with weakest preconditions are provable.