Hoare assignment rule