Choices of Proof Rules

We have roved the soundness and completeness of Hoare logic, if its underlying assertion derivation logic is sound and complete. Now it is time to ask: is the set of Hoare logic proof rules our unique choice? For example, can we choose the forward assignment rule instead of the backward one? Are other useful proof rules better candidates? In order to answer these questions, the key point is whether other proof rules also preserves Hoare triples' validity. We will show some preservation proof and demonstrate the relation between these candidates and our Hoare logic. We assume that the underlying FOL is sound and complete.

A sound and complete FOL has some basic properties.

Soundness of the forward assignment rule

We need some additional properties about syntactic substitution in our proof.

The soundness proof is straightforwad.

Soundness of sequential composition's associativity

We first prove that (c₁;;c₂);;c₃ is equivalent with c₁;;(c₂;;c₃) via the denotational semantics.

Based on this, we can prove its Hoare logic counterpart sound.

Deriving single-sided consequence rules

Recall that if a proof rule can be derived from primary rules, it is called a derived rule. For example, we can derive the single side consequence rule from the two sided version. Remark: TrivialFOL is implicitly claimed as the underlying logic for assertion derivation here. Coq does this automatically because FirstOrderLogic is a type class and TrivialFOL is one of its instances. Coq does such auto filling for all type classes' instances.

Here, we use the fact that the underlying FOL is TrivialFOL.

Deriving the forward assignment rule

Now we try to derive the forward assigement rule from our Hoare logic. Our proof needs the following program state construction.

The following statement reminds us that we are proving things about a logic but not proving things using a Hoare logic. When we use a Hoare logic to prove program correctness, we simply use Coq variables to represent logical variables and use Coq's integer terms to represent integer constants. Now, we established a formal definition of syntax trees with all of these features. Thus, we need to add extra assumptions like "x does not freely occur in P" to ensure that the existentially quantified variable x only appears in the scope of that existential quantifier.

In short, the forward assignment rule can be derived by a combination of the backward assignment rule and the consequence rule. To complete the proof, we need to prove this assertion derivation.

After these lines of transformation, we only need to prove that: as long as P is satisfied, is satisfied.

This simpl unfolds the semantic definition of EXISTS, AND and equality in the assertion language.

Again, in order to prove that P[X ⟼ x] is satisfied, we only need to prove that P is satisfied on a modified program state.

Now, we want to prove the conclusion from H₀. This is easy since we know that x does not freely occur in P and two interpretations in H₀ and the conclusion only differ in x's value.

Now the equation's right hand side is the denotation of E [X ⟼ x], it is equivalent with E's denotation on a modified program state. This property is described by aexp_sub_spec.

Then, the residue proof goal is trivial.

Inversion of Sequence Rule

When we derive hoare_consequence_pre, we actually prove such a meta theorem: In other words, we prove that if there is a proof tree for the former Hoare triple, we can always construct another proof tree for the latter one. Here is a brief illustration:

    Assumption:

      *- - - - - - - - −∗
      |                 |
      | Some Proof Tree |
      |                 |
      *- - - - - - - - −∗
       {{ P' }}  c  {{ Q }}           P'  ⊢ P


    Conclusion:

    *- - - - - - - - - - - - - - - - - - - - - - - - - - - - −∗
    |                                                         |
    |  *- - - - - - - - −∗           New Proof Tree           |
    |  |                 |                                    |
    |  | Some Proof Tree |                                    |
    |  |                 |                                    |
    |  *- - - - - - - - −∗                       -----------  |
    |   {{ P' }}  c  {{ Q }}            P'  ⊢ P       Q  ⊢ Q    |
    | ------------------------------------------------------  |
    |                    {{ P }}  c  {{ Q }}                      |
    |                                                         |
    *- - - - - - - - - - - - - - - - - - - - - - - - - - - - −∗

Beside such proof tree construction, we can say something more.

This lemma says, if  {{ P }}  c₁;; c₂  {{ R }}  is provable, then we can always find a middle condition Q. It is worth noticing that the proof tree for  {{ P }}  c₁;; c₂  {{ R }}  does not necessarily have the following form:

    *- - - - - - - - - - - - - - - - - - - - - - - - - - - - −∗
    |                                                         |
    |  *- - - - - - - - −∗         *- - - - - - - - −∗        |
    |  |                 |         |                 |        |
    |  | Some Proof Tree |         | Some Proof Tree |        |
    |  |                 |         |                 |        |
    |  *- - - - - - - - −∗         *- - - - - - - - −∗        |
    |   {{ P }}  c1  {{ Q }}             {{ Q }}  c2  {{ R }}         |
    | ------------------------------------------------------  |
    |                {{ P }}  c1;; c2  {{ Q }}                    |
    |                                                         |
    *- - - - - - - - - - - - - - - - - - - - - - - - - - - - −∗

because the last step in the proof might not be hoare_seq. It can also be hoare_consequence. This lemma says: even if the last step in the proof is not hoare_seq, we can always find such an assertion Q and reconstruct proof trees for  {{ P }}  c₁  {{ Q }}  and  {{ Q }}  c₂  {{ R }}  .

Associativity

The following lemma is more interesting. It says: we can always rebuild a proof tree for  {{ P }}  (c₁ ;; c₂) ;; c₃  {{ Q }}  if we discover the internal structure of a  {{ P }}  c₁ ;; c₂ ;; c₃  {{ Q }}  's proof tree (and vise versa).

If And Sequence

Very similarly, we can prove the following facts about Hoare logic proof trees for if-commands.

Hoare Logic's Completeness and Weakest Precondition

A Hoare logic is complete if all valid Hoare triples are provable.

The general idea of proving Hoare logic completeness is to prove those Hoare triples with weakest preconditions are provable. Specifically, an assertion P is called the weakest precondition of c and Q if Hoare triple is valid and for any other P', if  {{P'}}  c  {{Q}}  is valid, then P'  ⊢ P) . If the logic for assertion derivation is sound and complete, it is equivalent to say: for any interpretation (st, La) , if (st, La) ⊨ P' , then (st, La) ⊨ P .

Although this definition above is very natural, we can actually be more specific on what this weakest precondition should be.

This definition says: a beginning state st satisfies P if and only if all possible ending states of executing c will satisfy Q. This definition directly defines what interpreations satisfy P. Of course, it is consistent will our previous definition.

Hoare logic's completeness proof needs two important lemmas:

• expressiveness: for any c and Q, there is an assertion to express the weakest precondition of c and Q;
• if P expresses the weakest precondition of c and Q, then  {{ P }}  c  {{ Q }}  is provable.

Here are their formal statement.

We leave expressiveness' proof in additional reading material. We only prove that if all weakest preconditions exist, then the triples with weakest preconditions are provable.

Establishing Triples With Weakest Precondtions

In this part, we prove that if P is c and Q's weakest precondition, then the Hoare triple is provable. Noticing that the assertion P is not necessarily the weakest precondition constructed by the expressiveness lemma, we argue about all possible triples such that wp P c Q holds. Again, we prove this lemma by induction over the syntax tree of c.

If c = Skip

If P is a weakest precondition of c and Q, we know that P is actually equivalent with Q. Thus, P IMPLY Q is a valid first order proposition. By the assertion derivation logic's completeness, we know that P  ⊢ Q which is immediately followed by  ⊢  {{ P }}  c  {{ Q }}  according to the consequence rule.

If c = X ::= E

The proof is similar.

If c = c₁ ;; c₂

The proof is similar.

If c = If b Then c₁ Else c₂ EndIf

The proof is similar.

If c = While b Do c₁ EndWhile

This is the only interesting case! Suppose wp P c Q. We know: Now, consider the weakest precondition of c₁ and P. We claim that P AND [[ b ]] is stronger than weakest preconditions of c₁ and P. For fixed st and La, if then for any st' Since b is true on st, we know that for any st' and st'', This is equivalent to say: for any st', By the fact that wp P c Q, we conclude that for any st', Now, suppose P' is a weakest precondtion of c and P (by expressiveness lemma, it must exist). What we just proved means that (P AND [[ b ]]) IMPLY P' is a valid assertion. By the first order logic's completeness, By induction hypothesis: Then by the consequence rule: Thus, At the same time, due to wp P c Q, it is obvious that if (st, La) ⊨ P AND NOT [[ b ]] on some interpretation (st, La), then (st, La) ⊨ Q. In other words, (P AND NOT [[ b ]]) IMPLY Q is valid. Thus, So, This proves that all triples with weakest preconditions are provable.