Laboratoire

de

l'Informatique

du

Parall?lisme

Ecole

Normale

Sup?rieure

de

Lyon

Unit

de

recherche

associ?e

au

CNRS

n

Formal

validation

of

data-parallel

programs

a

two-component

assertional

proof

system

for

a

simple

language

Luc

Boug?e

David

Cachera

Yann

Le

Guyadec

Gil

Utard

Bernard

Virot

October

Research

Report

No

Ecole

Normale

Sup?rieure

de

Lyon

Adresse

lectronique

lip@lip.ens-lyon.fr

T?l?phone

-LRB-

-RRB-

T?l?copieur

-LRB-

-RRB-

All?e

d'Italie

Lyon

Cedex

France

Formal

validation

of

data-parallel

programs

a

two-component

assertional

proof

system

for

a

simple

language

Luc

Boug?e

David

Cachera

Yann

Le

Guyadec

Gil

Utard

Bernard

Virot

October

Abstract

We

present

a

proof

system

for

a

simple

data-parallel

kernel

language

called

L

This

proof

system

is

based

on

a

two-component

assertion

language

We

define

a

weakest

preconditions

calculus

and

analyse

its

definability

properties

This

calculus

is

used

to

prove

the

completeness

of

the

proof

system

We

also

present

a

two-phase

proof

methodology

yielding

proofs

similar

to

those

for

scalar

languages

We

finally

discuss

other

approaches

R?esum?e

Nous

pr?esentons

un

syst?eme

de

preuve

pour

un

langage

data-parall

ele

simple

le

langage

L.

Ce

syst?eme

de

preuve

est

fond?e

sur

un

langage

d'assertions

a

deux

composantes

Nous

d?efinissons

un

calcul

des

plus

faibles

pr?econditions

et

analysons

ses

propri?et?es

de

d?efinissabilit?e

Nous

utilisons

ce

calcul

pour

prouver

la

compl?etude

du

syst?eme

de

preuve

Nous

pr?esentons

egalement

une

m?ethodologie

de

preuve

en

deux

phases

Les

preuves

obtenues

sont

semblables

a

celles

donn?ees

pour

les

langages

scalaires

Nous

discutons

finalement

d'autres

approches

Mots-cl

es

Programmation

parall?ele

sp?ecification

et

validation

de

programmes

s?emantique

des

langages

de

programmation

langages

data-parall

eles

syst?eme

de

preuve

logique

de

Hoare

plus

faibles

pr?econditions

Formal

validation

of

data-parallel

programs

a

two-component

assertional

proof

system

for

a

simple

language

Luc

Boug?e?y

David

Cacheray

Yann

Le

Guyadecz

Gil

Utardy

Bernard

Virotx

October

Introduction

Data-parallel

languages

have

recently

emerged

as

a

major

tool

for

large

scale

parallel

programming

An

impressive

effort

is

currently

being

put

on

developing

efficient

compilers

for

High

Performance

Fortran

-LRB-

HPF

-RRB-

A

data-parallel

extension

of

C

primarily

influenced

by

Thinking

Machine

's

C

is

currently

under

standardization

Our

goal

is

to

provide

all

these

new

developments

with

the

necessary

semantic

bases

These

bases

are

crucial

to

design

safe

and

optimized

compilers

and

programming

environments

including

parallelizing

data-distributing

and

debugging

tools

They

are

also

the

way

to

safe

programming

techniques

so

as

to

avoid

the

common

waste

of

time

and

money

spent

in

debugging

Existing

data-parallel

languages

such

as

HPF

C

HyperC

or

MPL

include

a

similar

core

of

data-parallel

control

structures

In

previous

papers

we

have

shown

that

it

is

possible

to

define

a

simple

but

representative

data-parallel

kernel

language

-LRB-

the

L

language

-RRB-

and

to

give

it

a

formal

operational

-LSB-

-RSB-

and

denotational

semantics

-LSB-

-RSB-

In

this

paper

we

define

a

proof

system

for

this

language

in

the

style

of

the

usual

Hoare

's

logic

approach

-LSB-

-RSB-

The

originality

of

our

approach

lies

in

the

treatment

of

the

extent

of

parallelism

that

is

the

subset

of

currently

active

indices

at

which

a

vector

instruction

is

to

be

applied

Previous

approaches

led

to

manipulate

lists

of

indices

explicitly

-LSB-

-RSB-

or

to

consider

context

expressions

as

assertions

modifiers

-LSB-

-RSB-

In

contrast

our

proof

system

for

L

describes

the

activity

context

by

a

vector

boolean

expression

distinct

from

the

usual

predicates

on

program

variables

The

use

of

such

two-component

assertions

is

particularly

well-suited

to

an

intuitive

understanding

of

the

assertions

and

to

a

readable

proof

by

annotations

method

In

section

we

give

a

description

of

the

L

language

together

with

its

natural

semantics

Section

describes

a

sound

proof

system

based

on

our

two-component

assertions

Section

deals

with

the

definition

of

a

weakest

preconditions

calculus

and

with

the

associated

definability

question

This

weakest

preconditions

calculus

is

the

key

to

establish

the

completeness

of

our

proof

system

Authors

contact

Luc

Boug?e

-LRB-

Luc.Bouge@lip.ens-lyon.fr

-RRB-

This

work

has

been

partly

supported

by

the

French

CNRS

Coordinated

Research

Programs

on

Parallelism

and

PRS

the

French

PRC/MRE

Research

Contract

ParaDigme

Department

of

Defense

DRET

contract

and

INRIA

Project

ReMaP

yLIP

ENS

Lyon

All?ee

d'Italie

Lyon

Cedex

France

xLIFO

Univ.

Orl?eans

Rue

L?eonard

de

Vinci

BP

Orl?eans

Cedex

France

zVALORIA

rue

Montaigne

BP

Vannes

France

which

is

treated

in

Section

A

two-phase

proof

methodology

yielding

readable

and

structured

proofs

is

described

in

Section

As

a

conclusion

we

present

a

discussion

and

some

perspectives

A

simple

data-parallel

language

and

its

semantics

The

L

language

In

the

data-parallel

programming

model

the

basic

objects

are

arrays

with

parallel

access

also

called

vectors

Two

kinds

of

actions

can

be

applied

to

these

objects

componentwise

operations

or

global

rearrangements

A

program

is

a

sequential

composition

of

such

actions

Each

action

is

associated

with

the

set

of

array

indices

at

which

it

is

applied

An

index

at

which

an

action

is

applied

is

said

to

be

active

Other

indices

are

said

to

be

idle

The

set

of

active

indices

is

called

the

activity

context

or

the

extent

of

parallelism

following

the

term

coined

for

the

Actus

language

-LSB-

-RSB-

It

can

be

seen

as

a

boolean

array

where

true

denotes

activity

and

false

idleness

Observe

that

all

usual

data-parallel

languages

such

as

Actus

C

MPL

or

HPF

are

deterministic

Though

they

specify

parllel

accesses

to

data

whose

scheduling

may

be

non-deterministic

the

resulting

semantics

is

deterministic

The

only

exception

we

are

aware

of

is

a

rather

special

use

of

the

send

operator

in

C

where

the

user

may

require

a

non-deterministic

combining

operator

and

some

special

issues

connected

with

parameter

passing

in

idle

contexts

However

we

are

not

concerned

with

this

level

of

detail

in

this

paper

and

we

consider

only

deterministic

data-parallel

constructs

The

L

language

is

designed

as

a

common

kernel

of

data-parallel

languages

like

C

-LSB-

-RSB-

HyperC

-LSB-

-RSB-

or

MPL

-LSB-

-RSB-

We

do

not

consider

the

scalar

part

of

these

languages

mainly

imported

from

the

C

language

Also

for

simplicity

we

only

consider

integer

and

boolean

values

here

As

far

as

this

paper

is

concerned

we

can

assume

that

scalar

values

are

replicated

at

all

locations

so

that

we

can

identify

a

scalar

variable

with

a

vector

whose

all

components

share

this

common

value

Also

for

the

sake

of

simplicity

we

consider

in

this

paper

that

all

parallel

arrays

share

a

unique

geometry

This

is

reminiscent

of

the

MPL

language

where

the

common

geometry

of

the

plural

variables

is

the

physical

geometry

of

the

underlying

architecture

Multiple

geometries

as

allowed

by

the

shapes

of

C

or

the

collections

of

HyperC

could

easily

be

handled

at

the

price

of

extra

notation

and

case

analysis

This

unique

geometry

is

captured

here

through

a

finite

domain

of

indices

D

equipped

with

a

set

of

geometric

operators

such

as

shift

rotate

etc.

For

instance

in

MPL

D

would

be

a

square

-LSB-

-RSB-

-LSB-

-RSB-

and

the

associated

geometric

operators

would

be

toroidal

translations

along

the

axes

The

precise

structure

of

the

geometric

domain

D

and

the

detailed

definition

of

the

geometric

operators

are

of

little

relevance

here

In

the

examples

of

this

paper

a

one-dimensional

or

two-dimensional

domain

will

be

assumed

The

only

important

point

is

that

we

assume

the

existence

of

two

conversion

functions

x

itos

-LRB-

u

-RRB-

maps

an

index

u

into

a

scalar

value

x

u

stoi

-LRB-

x

-RRB-

maps

a

scalar

value

into

an

index

value

These

functions

are

reminiscent

of

the

pcoord

functions

of

C

or

the

iproc

function

of

MPL

The

only

hypothesis

is

that

-LRB-

stoi

ffi

itos

-RRB-

is

the

identity

function

on

indices

u

stoi

-LRB-

itos

-LRB-

u

-RRB-

-RRB-

If

D

is

-LSB-

N

-RSB-

then

think

of

itos

as

embedding

-LSB-

N

-RSB-

into

the

integers

and

stoi

as

the

mod

-LRB-

N

-RRB-

operator

All

the

variables

of

L

are

parallel

and

all

the

objects

are

vectors

of

scalars

with

one

component

at

each

index

As

a

convention

the

parallel

objects

are

denoted

with

uppercase

initial

letters

X

Y

etc.

Indices

are

denoted

u

v

etc.

The

component

of

a

parallel

object

X

located

at

index

u

is

denoted

X

ju

A

vector

expression

E

can

be

of

the

following

forms

A

vector

variable

X

A

vector

constant

of

integer

or

boolean

type

Constant

denotes

the

vector

whose

all

components

have

value

True

and

False

denote

the

vectors

whose

all

components

are

respectively

true

and

false

Constant

expression

This

denotes

the

vector

whose

value

at

index

u

is

itos

-LRB-

u

-RRB-

this

is

the

iproc

of

MPL

the

operator

of

C

A

componentwise

combination

of

vector

expressions

for

instance

X

Y

All

usual

scalar

operators

are

overloaded

with

their

respective

vector

extension

It

will

prove

useful

to

define

an

additional

type

of

vector

expressions

conditional

vector

expressions

-LRB-

C?E

F

-RRB-

denotes

the

vector

whose

component

at

index

u

is

Eju

if

boolean

vector

expression

C

is

true

at

index

u

and

F

ju

otherwise

A

fetch

expression

EjA

Consider

a

fixed

index

u.

Vector

expression

A

is

evaluated

then

vector

expression

E

then

the

result

is

rearranged

so

that

the

value

at

index

u

is

fetched

at

the

index

which

is

the

value

of

A

at

u

-LRB-

converted

through

function

stoi

-RRB-

-LRB-

EjA

-RRB-

ju

Ejstoi

-LRB-

Aju

-RRB-

In

particular

EjThis

is

merely

E

In

MPL

this

is

denoted

router

-LSB-

A

-RSB-

E

In

C

and

HyperC

this

is

denoted

-LSB-

A

-RSB-

E

As

an

example

consider

a

typical

fragment

of

a

one-dimensional

convolution

code

-LRB-

X

X

jThis

X

jThis

-RRB-

Note

that

strictly

speaking

the

of

This

is

not

the

same

as

the

outer

as

it

acts

on

the

index

domain

D

But

there

is

no

real

reason

to

stress

this

difference

any

longer

and

we

will

identify

both

operators

in

most

cases

Note

also

that

all

constructs

in

L

including

communications

-LRB-

fetch

-RRB-

are

deterministic

We

can

now

list

the

instructions

of

L.

Assignment

X

E

At

each

active

index

u

component

X

ju

is

updated

with

the

local

value

of

vector

expression

E.

Observe

that

E

may

be

a

fetch

expression

in

which

case

we

obtain

a

get

communication

get

E

from

A

into

X

is

the

same

as

X

EjA

Observe

also

that

we

can

not

express

send

communications

in

this

model

Sequencing

S

T

On

the

termination

of

the

last

action

of

S

the

execution

of

the

actions

of

T

starts

Iteration

loop

B

do

S

end

The

actions

of

S

are

repeatedly

executed

with

the

current

extent

of

parallelism

until

boolean

vector

expression

B

evaluates

to

false

at

each

currently

active

index

Observe

that

the

activity

context

is

not

modified

on

executing

the

body

in

contrast

with

the

parallel

while

of

MPL

and

the

whilesomewhere

of

C

These

constructs

can

be

expressed

in

L

by

a

where

nested

in

a

loop

Our

form

is

therefore

more

general

Conditioning

where

B

do

S

end

The

active

indices

where

boolean

vector

expression

B

evaluates

to

false

become

idle

during

the

execution

of

S

The

other

ones

remain

active

The

initial

activity

context

is

restored

on

the

termination

of

S

The

L

language

is

quite

simple

but

it

is

sufficient

to

express

usual

data-parallel

algorithms

Consider

for

instance

a

scan

that

is

a

prefixed

sum

using

a

classical

logarithmic

method

-LSB-

-RSB-

The

domain

is

D

-LSB-

N

-RSB-

Initially

the

component

at

index

u

u

N

holds

an

initial

value

V

ju

and

we

compute

S

such

that

Sju

Pk

u

k

V

jk

The

program

in

MPL-like

syntax

is

displayed

below

The

XnetW

-LSB-

i

-RSB-

construct

expresses

a

fetch

of

indices

at

distance

i

towards

low

indices

S

V

i

while

-LRB-

i

N

-RRB-

do

-LCB-

scalar

while

if

-LRB-

iproc

i

-RRB-

plural

if

S

XnetW

-LSB-

i

-RSB-

S

i

-RCB-

Its

translation

in

L

is

displayed

in

Figure

As

L

has

no

scalar

variables

we

translate

the

MPL

scalar

variable

i

into

a

vector

variable

I

whose

all

components

hold

the

common

value

i

The

execution

trace

shows

the

different

values

of

the

vector

S

during

the

computation

surrounded

by

its

input

and

output

value

Crossed

values

represent

inactive

components

during

computation

Arrows

represent

fetched

values

S

V

I

loop

I

N

do

where

This

I

do

S

S

SjThis?I

end

I

I

end

I

I

I

Figure

The

scan

L-program

and

an

execution

trace

instance

A

natural

semantics

for

L

We

describe

the

semantics

of

L

in

the

style

of

the

natural

semantics

by

induction

on

the

syntax

of

L

programs

An

environment

oe

is

a

function

from

identifiers

to

vector

values

The

set

of

environments

is

denoted

by

Env

For

convenience

we

extend

the

environment

functions

to

the

parallel

expressions

oe

-LRB-

E

-RRB-

denotes

the

value

obtained

by

evaluating

parallel

expression

E

in

environment

oe

Here

are

the

most

interesting

rules

oe

-LRB-

This

-RRB-

ju

itos

-LRB-

u

-RRB-

oe

-LRB-

E

F

-RRB-

ju

oe

-LRB-

E

-RRB-

ju

oe

-LRB-

F

-RRB-

ju

oe

-LRB-

C?E

F

-RRB-

ju

-LRB-

oe

-LRB-

E

-RRB-

ju

if

oe

-LRB-

C

-RRB-

ju

is

true

oe

-LRB-

F

-RRB-

ju

otherwise

oe

-LRB-

EjA

-RRB-

ju

oe

-LRB-

E

-RRB-

jstoi

-LRB-

oe

-LRB-

A

-RRB-

ju

-RRB-

Let

oe

be

an

environment

X

a

vector

variable

and

V

a

vector

value

We

denote

by

oe

-LSB-

X

V

-RSB-

the

new

environment

where

-LRB-

X

-RRB-

V

and

-LRB-

Y

-RRB-

oe

-LRB-

Y

-RRB-

for

all

Y

X

A

context

c

is

a

boolean

vector

It

specifies

the

activity

at

each

index

We

distinguish

a

particular

context

denoted

by

True

where

all

components

have

the

boolean

value

true

For

convenience

we

define

the

activity

predicate

activec

activec

-LRB-

u

-RRB-

cju

A

state

s

is

a

pair

-LRB-

oe

c

-RRB-

made

of

an

environment

oe

and

a

context

c

We

distinguish

an

additional

special

state

to

denote

non-termination

The

semantics

-LSB-

-LSB-

S

-RSB-

-RSB-

of

a

program

S

is

a

strict

function

from

states

to

states

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

-RRB-

We

extend

function

-LSB-

-LSB-

S

-RSB-

-RSB-

to

sets

of

states

as

usual

Observe

there

would

not

be

difficult

to

extend

this

work

to

non-deterministic

programs

by

defining

-LSB-

-LSB-

S

-RSB-

-RSB-

to

be

a

function

from

states

to

sets

of

states

As

we

are

only

concerned

with

deterministic

data-parallel

languages

we

will

disregard

this

extension

in

this

paper

Assignment

At

each

active

index

the

component

of

the

parallel

variable

is

updated

with

the

new

value

-LSB-

-LSB-

X

E

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

with

oe

-LSB-

X

V

-RSB-

where

V

ju

oe

-LRB-

E

-RRB-

ju

if

activec

-LRB-

u

-RRB-

and

V

ju

oe

-LRB-

X

-RRB-

ju

otherwise

The

activity

context

is

preserved

Sequencing

Sequential

composition

is

functional

composition

-LSB-

-LSB-

S

T

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LSB-

-LSB-

T

-RSB-

-RSB-

-LRB-

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-RRB-

Iteration

Iteration

is

expressed

by

classical

loop

unfolding

It

terminates

when

the

boolean

expression

B

evaluates

to

false

at

each

active

index

We

have

the

relation

-LSB-

-LSB-

loop

B

do

S

end

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LSB-

-LSB-

loop

B

do

S

end

-RSB-

-RSB-

-LRB-

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-RRB-

if

-LRB-

activec

-LRB-

u

-RRB-

oe

-LRB-

B

-RRB-

ju

-RRB-

-LRB-

oe

c

-RRB-

otherwise

If

the

unfolding

does

not

terminates

then

we

take

the

usual

convention

-LSB-

-LSB-

loop

B

do

S

end

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

To

see

that

this

is

well-defined

we

can

proceed

exactly

as

in

the

usual

case

Define

OEk

-LRB-

oe

c

-RRB-

to

be

the

final

state

of

loop

B

do

S

end

after

evaluating

at

most

k

times

the

test

We

have

-LRB-

oe

c

-RRB-

and

OEk

-LRB-

oe

c

-RRB-

-LRB-

OEk

-LRB-

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-RRB-

if

-LRB-

activec

-LRB-

u

-RRB-

oe

-LRB-

B

-RRB-

ju

-RRB-

-LRB-

oe

c

-RRB-

otherwise

It

is

easy

to

show

that

if

OEk

-LRB-

oe

c

-RRB-

then

OEk

-LRB-

oe

c

-RRB-

OEk

-LRB-

oe

c

-RRB-

Then

we

can

define

-LSB-

-LSB-

loop

B

do

S

end

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

G

k

OEk

-LRB-

oe

c

-RRB-

where

Fk

denotes

the

least

upper

bound

for

the

flat

partial

order

-LRB-

x

x

y

-RRB-

which

clearly

satisfies

the

relation

above

Conditioning

The

denotation

of

a

where

construct

is

the

denotation

of

its

body

with

a

new

context

The

new

context

is

the

conjunction

of

the

previous

one

with

the

value

of

the

conditioning

expression

B.

-LSB-

-LSB-

where

B

do

S

end

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

with

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

oe

-LRB-

B

-RRB-

-RRB-

-LRB-

-RRB-

The

value

of

is

ignored

here

where

do

where

do

end

where

do

end

end

f

trueg

where

do

f

where

do

f

end

where

do

f

end

end

Figure

A

typical

L

program

and

its

annotation

by

two-component

assertions

Remark

In

this

language

the

activity

context

is

preserved

by

terminating

executions

for

any

program

S

such

that

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

-RRB-

we

have

c

It

is

no

longer

true

for

the

extended

version

of

L

defined

in

-LSB-

-RSB-

which

includes

a

data-parallel

break-like

construct

A

two-component

assertional

proof

system

for

L

programs

Two-component

assertion

language

We

define

a

proof

system

for

the

partial

correctness

of

L

programs

in

the

lines

of

-LSB-

-RSB-

A

specification

is

denoted

by

a

formula

fPreg

S

fPostg

where

S

is

the

program

text

and

Pre

and

Post

are

logical

assertions

on

variables

of

S

This

formula

means

that

if

precondition

Pre

is

satisfied

in

the

initial

state

of

program

S

and

if

S

terminates

then

postcondition

Post

is

satisfied

in

the

final

state

A

proof

system

gives

a

formal

method

to

derive

such

specification

formulas

by

syntax-directed

induction

on

programs

Axioms

correspond

to

statements

and

inference

rules

to

control

structures

Then

proving

that

a

program

meets

its

specification

is

equivalent

to

derive

the

specification

formula

fPreg

S

fPostg

in

the

proof

system

A

crucial

property

of

axiomatic

semantics

in

the

usual

sequential

case

is

compositionality

To

achieve

this

goal

the

assertion

language

has

to

include

sufficient

information

on

variable

values

Similarly

our

assertion

language

has

to

include

some

information

about

the

current

activity

context

as

well

as

variable

values

We

therefore

define

two-component

assertions

fP

Cg

where

P

is

a

predicate

on

the

vector

variables

of

the

program

and

C

is

a

boolean

vector

expression

which

evaluates

into

the

current

activity

context

Consider

a

typical

L

program

and

its

annotation

whose

are

shown

in

Figure

Assertion

f

trueg

means

that

all

indices

are

active

Assertion

f

means

that

the

active

indices

are

precisely

indices

u

those

such

that

is

true

We

will

show

in

this

paper

that

such

an

annotation

is

always

valid

if

no

variable

of

the

context

expressions

Bi

are

modified

by

the

program

The

proof

of

a

data-parallel

program

with

our

method

can

thus

be

factorized

into

two

parts

partially

annotate

with

context

expressions

complete

annotation

with

predicate

Part

is

mostly

straightforward

up

to

variable

conflicts

Part

is

somehow

similar

to

proofs

of

sequential

programs

The

structure

of

predicates

on

vector

variables

has

to

be

made

precise

here

An

index

expression

is

an

index

variable

-LRB-

u

v

etc

-RRB-

an

index

constant

-LRB-

etc

if

a

onedimensional

domain

is

assumed

for

instance

-RRB-

a

combination

of

index

expressions

with

a

geometric

operator

-LRB-

u

u

in

the

one-dimensional

case

-RRB-

or

the

function

stoi

applied

to

some

scalar

expression

A

scalar

expression

is

a

scalar

variable

-LRB-

x

y

:-RRB-

a

scalar

constant

-LRB-

true

false

etc.

-RRB-

a

combination

of

scalar

expressions

with

some

scalar

operator

or

a

vector

expression

of

the

programming

language

subscripted

by

an

index

expression

Eju

or

the

function

itos

applied

to

some

index

expression

A

formula

is

a

scalar

expression

of

boolean

type

the

combination

of

formulas

with

logical

operators

or

a

formula

quantified

on

a

scalar

variable

or

an

index

variable

-LRB-

in

this

last

case

the

quantification

implicitely

ranges

on

index

domain

D

-RRB-

A

-LRB-

vector

-RRB-

predicate

is

a

formula

which

is

closed

with

respect

to

all

index

and

scalar

variables

External

universal

quantification

is

implicit

For

instance

the

following

are

vector

predicates

X

ju

All

components

of

X

have

value

X

ju

X

jv

All

components

of

X

are

equal

X

ju

Y

ju

X

and

Y

have

the

same

value

at

each

index

even

-LRB-

u

-RRB-

-RRB-

-LRB-

X

ju

X

ju

-RRB-

At

all

even

indices

the

right

component

is

the

same

as

the

local

one

X

ju

i

X

is

a

constant

vector

Observe

there

is

no

quantification

on

vector

variables

in

vector

predicates

Observe

also

that

X

Y

is

not

a

predicate

but

a

boolean

vector

expression

defined

pointwise

The

equality

predicate

is

X

ju

Y

ju

which

we

denote

by

X

Y

Because

a

vector

predicate

is

a

formula

closed

with

respect

to

index

and

scalar

variables

we

can

define

its

truth

value

with

respect

to

an

environment

in

the

usual

way

Observe

that

scalar

variables

range

over

integers

or

boolean

whereas

index

variables

range

over

D

If

predicate

P

is

true

in

environment

oe

then

we

write

oe

j

P

We

are

now

in

position

to

define

the

validity

of

an

assertion

in

a

program

state

Definition

-LRB-

Satisfiability

-RRB-

Let

-LRB-

oe

c

-RRB-

be

a

state

fP

Cg

an

assertion

We

say

that

state

-LRB-

oe

c

-RRB-

satisfies

assertion

fP

Cg

and

write

-LRB-

oe

c

-RRB-

j

fP

Cg

if

oe

j

P

and

oe

-LRB-

C

-RRB-

c.

By

convention

satisfies

any

assertion

The

set

of

states

satisfying

fP

Cg

is

denoted

by

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

Consider

two

assertions

fP

Cg

and

fQ

Dg

We

say

that

fP

Cg

-RRB-

fQ

Dg

if

for

a

state

-LRB-

oe

c

-RRB-

fQ

Dg

holds

as

soon

as

fP

Cg

holds

if

oe

j

P

then

oe

j

Q

if

oe

j

P

and

oe

-LRB-

C

-RRB-

c

then

oe

-LRB-

D

-RRB-

c.

Definition

-LRB-

Assertion

implication

-RRB-

Let

fP

Cg

and

fQ

Dg

be

two

assertions

We

say

that

assertion

fP

Cg

implies

assertion

fQ

Dg

w.r.t.

context

written

fP

Cg

-RRB-

fQ

Dg

if

for

any

environment

oe

oe

j

P

-RRB-

Q

and

oe

j

P

-RRB-

-LRB-

Cju

Dju

-RRB-

Proposition

Let

fP

Cg

and

fQ

Dg

be

two

assertions

Then

fP

Cg

-RRB-

fQ

Dg

iff

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

-LSB-

-LSB-

fQ

Dg

-RSB-

-RSB-

We

introduce

a

substitution

mechanism

for

vector

variables

Let

P

be

a

predicate

or

any

vector

expression

X

a

vector

variable

and

E

a

vector

expression

P

-LSB-

E

X

-RSB-

denotes

the

predicate

or

expression

obtained

by

substituting

all

the

occurrences

of

X

in

P

with

E.

Note

that

all

vector

variables

are

free

by

definition

of

our

assertion

language

The

key

result

is

that

the

usual

substitution

lemma

-LSB-

-RSB-

extends

to

this

new

setting

Lemma

Let

P

be

a

predicate

on

vector

variables

X

a

vector

variable

and

E

a

vector

expression

oe

j

P

-LSB-

E

X

-RSB-

iff

oe

-LSB-

X

oe

-LRB-

E

-RRB-

-RSB-

j

P

Proof

This

is

easily

proved

by

induction

on

the

structure

of

vector

predicates

and

vector

expressions

The

crucial

point

is

that

we

only

consider

here

the

substitution

of

a

vector

X

as

a

whole

in

contrast

with

-LSB-

-RSB-

where

the

substitution

of

a

particular

component

X

-LSB-

u

-RSB-

is

supported

Proof

system

We

can

define

the

validity

of

a

specification

of

a

L

program

with

respect

to

its

natural

semantics

Because

satisfies

any

assertion

our

definition

of

validity

is

relative

to

partial

correctness

i.e.

we

are

not

concerned

by

the

proof

of

the

program

termination

Definition

-LRB-

Validity

-RRB-

Let

S

be

a

L

program

fP

Cg

and

fQ

Dg

two

assertions

We

say

that

specification

fP

Cg

S

fQ

Dg

is

valid

denoted

by

j

fP

Cg

S

fQ

Dg

if

for

any

state

-LRB-

oe

c

-RRB-

-LRB-

oe

c

-RRB-

j

fP

Cg

-RRB-

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

j

fQ

Dg

Our

goal

is

to

catch

valid

formulas

through

a

finite

set

of

simple

axioms

Unfortunatly

this

turns

out

to

be

more

difficult

than

in

the

usual

case

Consider

the

assignment

command

x

e

of

usual

sequential

languages

The

associated

backward

axiom

is

fP

-LSB-

e

x

-RSB-

g

x

e

fPg

A

direct

generalization

to

the

L

language

should

be

fP

-LSB-

-LRB-

C?E

X

-RRB-

X

-RSB-

Cg

X

E

fP

Cg

In

effect

the

local

assignment

X

ju

Eju

is

carried

out

only

at

the

active

indices

that

is

the

indices

where

C

evaluates

to

true

Thus

the

former

value

of

X

ju

to

require

is

Eju

where

Cju

is

true

and

X

ju

unchanged

otherwise

This

is

exactly

-LRB-

C?E

X

-RRB-

ju

according

to

our

definition

Unfortunately

this

generalization

is

not

correct

in

all

cases

The

specification

ftrue

Y

X

ftrue

Y

is

valid

Yet

ftrue

X

X

ftrue

X

is

not

valid

the

-LRB-

unchanged

-RRB-

activity

context

is

no

longer

described

by

the

boolean

expression

X

after

the

assignment

X

as

variable

X

has

been

modified

Validity

is

guaranted

only

if

the

variables

of

the

current

context

expression

C

are

not

modified

by

executing

the

assignment

X

E.

Following

the

notation

of

-LSB-

-RSB-

let

Change

-LRB-

S

-RRB-

be

the

set

of

variables

appearing

on

the

left

of

assignments

in

program

S.

Only

these

variables

can

have

their

values

changed

by

executing

S.

Let

Var

-LRB-

C

-RRB-

be

the

set

of

variables

appearing

in

expression

C

The

value

of

C

depends

on

these

variables

only

We

describe

below

a

restricted

proof

system

where

we

always

assume

that

context

expressions

are

not

modified

by

program

bodies

Change

-LRB-

S

-RRB-

Var

-LRB-

C

-RRB-

Rule

-LRB-

Assignment

X

E

-RRB-

We

extend

the

usual

backwards

axiom

by

taking

into

consideration

that

vector

variable

X

is

modified

only

at

the

active

indices

X

Var

-LRB-

C

-RRB-

fP

-LSB-

-LRB-

C?E

X

-RRB-

X

-RSB-

Cg

X

E

fP

Cg

For

instance

consider

postcondition

-LRB-

Y

ju

X

ju

-RRB-

Y

vectors

X

and

Y

have

all

their

components

equal

and

the

active

indices

are

precisely

those

such

that

the

component

of

Y

has

value

The

following

specification

is

valid

-LRB-

Y

ju

-LRB-

-LRB-

Y

ju

-RRB-

X

ju

-RRB-

Y

X

-LRB-

Y

ju

X

ju

-RRB-

Y

It

boils

down

to

-LRB-

Y

ju

-RRB-

Y

ju

-RRB-

-LRB-

Y

ju

-RRB-

Y

ju

X

ju

-RRB-

Y

X

-LRB-

Y

ju

X

ju

-RRB-

Y

that

is

-LRB-

Y

ju

-RRB-

-LRB-

Y

ju

X

ju

-RRB-

Y

X

-LRB-

Y

ju

X

ju

-RRB-

Y

Rule

-LRB-

Sequencing

S

T

-RRB-

It

is

a

straightforward

generalization

of

the

usual

case

fP

Cg

S

fR

Cg

fR

Cg

T

fQ

Cg

fP

Cg

S

T

fQ

Cg

Rule

-LRB-

Iteration

loop

B

do

S

end

-RRB-

The

usual

loop

invariant

assertion

has

here

to

be

invariant

with

respect

to

both

the

variable

values

and

the

activity

context

fI

-LRB-

Cju

Bju

-RRB-

Cg

S

fI

Cg

fI

Cg

loop

B

do

S

end

fI

-LRB-

Cju

-RRB-

Bju

-RRB-

Cg

Rule

-LRB-

Conditioning

where

B

do

S

end

-RRB-

Following

the

semantics

the

context

part

is

the

conjunction

of

the

previous

context

expression

and

the

condition

of

the

conditioning

construct

fP

-LRB-

C

B

-RRB-

g

S

fQ

Dg

Change

-LRB-

S

-RRB-

Var

-LRB-

C

-RRB-

fP

Cg

where

B

do

S

end

fQ

Cg

Consider

for

instance

the

following

valid

specification

X

ju

X

X

X

X

ju

X

The

rule

above

applies

and

yields

X

ju

Trueg

where

X

do

X

X

end

X

ju

Trueg

Observe

that

the

resulting

activity

context

expression

D

is

ignored

very

much

like

the

resulting

activity

context

in

the

natural

semantics

-LRB-

Section

-RRB-

and

that

we

do

not

need

to

assume

Change

-LRB-

S

-RRB-

Var

-LRB-

B

-RRB-

Rule

-LRB-

Consequence

rule

-RRB-

Following

Definition

we

can

state

the

consequence

rule

fP

Cg

-RRB-

S

-RRB-

fQ

Dg

fP

Cg

S

fQ

Dg

This

rule

allows

us

to

strengthen

preconditions

and

to

weaken

postconditions

of

specifications

Proposition

-LRB-

Soundness

-RRB-

This

proof

system

is

sound

if

fP

Cg

S

fQ

Dg

then

j

fP

Cg

S

fQ

Dg

Example

Let

us

prove

the

correctness

of

the

small

program

given

on

section

S

V

I

loop

I

N

do

where

This

I

do

S

S

SjThis?I

end

I

I

end

To

find

an

invariant

assertion

we

express

that

only

those

components

whose

index

u

is

larger

than

scalar

value

i

can

fetch

additional

values

Sju?i

The

other

components

already

hold

the

result

Let

us

define

the

following

vector

predicate

Const

expresses

that

vector

I

is

a

constant

vector

whose

value

is

i

Inv

expresses

that

the

partial

sum

is

already

computed

from

index

to

i

The

predicate

part

of

the

invariant

assertion

is

Const

Inv

For

the

sake

of

conciseness

V

jvu

denotes

Pk

v

k

u

V

jk

i

denotes

I

and

we

drop

all

stoi/itos

conversions

for

simplicity

Const

-LRB-

I

ju

i

-RRB-

Inv

-LRB-

u

i

-RRB-

Sju

V

-RRB-

-LRB-

i

u

N

-RRB-

Sju

V

juu?i

-RRB-

Pred

Const

Inv

The

sketch

of

the

partial

correctness

proof

is

expressed

by

the

program

annotated

with

assertions

shown

on

Figure

For

the

sake

of

conciseness

we

have

written

i

instead

of

The

steps

of

the

proof

derivation

are

to

check

the

correctness

of

invariant

assertion

fPred

Trueg

-LRB-

b

-RRB-

-RRB-

-LRB-

c

-RRB-

and

that

it

implies

the

final

specification

-LRB-

j

-RRB-

-RRB-

-LRB-

k

-RRB-

In

assertion

-LRB-

e

-RRB-

note

how

context

expression

This

I

is

generated

by

the

conditioning

expression

of

the

enclosing

where

block

Assertion

-LRB-

e

-RRB-

is

obtained

from

assertion

-LRB-

f

-RRB-

by

substituting

S

with

-LRB-

This

I

-LRB-

S

SjThis?I

-RRB-

S

-RRB-

That

is

Su

is

substituted

with

Sju

Sju?i

if

u

i

The

new

boundary

i

-LRB-

that

is

I

-RRB-

substituted

in

the

invariant

comes

from

the

assignment

statement

for

counter

I

in

context

True

Nota

We

write

i

for

I

as

Const

expresses

that

I

is

a

constant

vector

We

drop

all

stoi/itos

conversions

-LRB-

a

-RRB-

ftrue

Trueg

S

V

I

-LRB-

b

-RRB-

fPred

Trueg

loop

I

N

do

-LRB-

c

-RRB-

fPred

i

N

Trueg

-LRB-

d

-RRB-

fConst

-LRB-

u

i

-RRB-

Sju

V

-RRB-

-LRB-

i

u

i

-RRB-

Sju

Sju?i

V

-RRB-

-LRB-

i

u

N

-RRB-

Sju

Sju?i

V

juu?i

-RRB-

Trueg

where

This

I

do

-LRB-

e

-RRB-

fConst

-LRB-

u

i

-RRB-

Sju

V

-RRB-

-LRB-

i

u

i

-RRB-

Sju

Sju?i

V

-RRB-

-LRB-

i

u

N

-RRB-

Sju

Sju?i

V

juu?i

-RRB-

This

Ig

S

S

SjThis?I

-LRB-

f

-RRB-

fConst

-LRB-

u

i

-RRB-

Sju

V

-RRB-

-LRB-

i

u

N

-RRB-

Sju

V

juu?i

-RRB-

This

Ig

end

-LRB-

g

-RRB-

fConst

-LRB-

u

i

-RRB-

Sju

V

-RRB-

-LRB-

i

u

N

-RRB-

Sju

V

juu?i

-RRB-

Trueg

I

I

-LRB-

h

-RRB-

fConst

-LRB-

u

i

-RRB-

Sju

V

-RRB-

-LRB-

i

u

N

-RRB-

Sju

V

juu?i

-RRB-

Trueg

-LRB-

i

-RRB-

fPred

Trueg

end

-LRB-

j

-RRB-

fPred

i

N

Trueg

-LRB-

k

-RRB-

u

N

-RRB-

Sju

V

Trueg

Figure

The

annotated

scan

program

Weakest

preconditions

of

L

programs

The

weakest

liberal

precondition

of

S

with

respect

to

a

set

of

states

E

wlp

-LRB-

S

E

-RRB-

is

the

set

of

all

the

states

s

such

that

whenever

S

is

activated

in

s

and

properly

terminates

the

resulting

state

is

in

E

In

contrast

the

weakest

strict

precondition

of

S

with

respect

to

E

-LRB-

or

weakest

precondition

for

short

when

no

confusion

may

arise

-RRB-

wp

-LRB-

S

E

-RRB-

is

the

set

of

all

the

states

s

such

that

whenever

S

is

activated

in

s

it

is

guaranteed

to

terminate

and

the

final

state

is

in

E

For

the

sake

of

conciseness

we

define

the

convergence

predicate

conv

-LRB-

S

s

-RRB-

by

conv

-LRB-

S

s

-RRB-

s

-RRB-

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

s

-RRB-

Definition

-LRB-

Weakest

preconditions

-RRB-

Let

E

be

a

set

of

states

S

a

L-program

We

define

the

weakest

liberal

preconditions

as

wlp

-LRB-

S

E

-RRB-

fs

j

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

s

-RRB-

E

-LSB-

f?gg

and

the

weakest

-LRB-

strict

-RRB-

preconditions

as

wp

-LRB-

S

E

-RRB-

wlp

-LRB-

S

E

-RRB-

fs

j

conv

-LRB-

S

s

-RRB-

g

Lemma

-LRB-

Consequence

Lemma

-RRB-

j

fP

Cg

S

fQ

Dg

iff

fP

Cg

-RRB-

wlp

-LRB-

S

fQ

Dg

-RRB-

Proof

Assume

j

fP

Cg

S

fQ

Dg

Then

for

all

-LRB-

oe

c

-RRB-

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

we

have

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

j

fQ

Dg

Thus

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

wlp

-LRB-

S

fQ

Dg

-RRB-

hence

fP

Cg

-RRB-

wlp

-LRB-

S

fQ

Dg

-RRB-

Conversely

if

fP

Cg

-RRB-

wp

-LRB-

S

fQ

Dg

-RRB-

then

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

wlp

-LRB-

S

fQ

Dg

-RRB-

Consider

-LRB-

oe

c

-RRB-

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

By

hypothesis

-LRB-

oe

c

-RRB-

wlp

-LRB-

S

fQ

Dg

-RRB-

Thus

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

j

fQ

Dg

The

definability

problem

We

restrict

our

study

of

the

weakest

preconditions

to

those

subsets

of

states

which

can

be

described

by

some

assertion

In

classical

Hoare

's

logic

the

Definability

Property

states

that

the

weakest

preconditions

of

a

program

with

respect

to

a

set

of

states

described

by

some

assertion

can

itself

be

described

by

some

assertion

In

our

framework

the

Definability

Problem

can

be

stated

as

follows

Given

a

program

S

and

an

assertion

fQ

Dg

does

there

exist

any

assertion

fP

Cg

such

that

wlp

-LRB-

S

fQ

Dg

-RRB-

fP

Cg

-LRB-

resp

wp

-LRB-

S

fQ

Dg

-RRB-

fP

Cg

-RRB-

If

so

can

it

be

expressed

from

S

Q

D

It

can

be

shown

-LSB-

-RSB-

that

this

properties

holds

for

the

classical

Hoare

's

logic

under

some

assumptions

on

the

expressivity

of

the

assertion

language

In

our

setting

the

form

of

the

assertions

introduces

a

limitation

on

their

expressive

power

as

made

precise

by

the

following

fact

Fact

-LRB-

Restricted

expressive

power

of

assertions

-RRB-

Let

fP

Cg

be

an

assertion

For

any

environment

oe

there

exists

at

most

one

activity

context

c

such

that

-LRB-

oe

c

-RRB-

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

namely

c

oe

-LRB-

C

-RRB-

An

easy

consequence

is

that

the

weakest

liberal

preconditions

of

some

L

programs

can

not

be

defined

by

any

assertion

This

is

a

major

difference

with

the

usual

case

Consider

for

instance

S

loop

True

do

X

X

end

Consider

postcondition

ftrue

Trueg

This

postcondition

is

satisfied

either

if

S

terminates

with

context

True

or

if

S

diverges

The

former

can

not

occur

because

of

the

semantics

of

the

loop

construct

The

latter

occurs

if

and

only

if

there

is

at

least

one

active

index

that

is

context

c

may

satisfy

the

condition

cju

true

We

have

thus

wlp

-LRB-

S

ftrue

Trueg

-RRB-

f

-LRB-

oe

c

-RRB-

j

cju

trueg

-LSB-

f?g

As

two

different

activity

contexts

c

may

produce

a

divergence

for

the

same

environment

oe

this

set

of

states

can

not

be

defined

by

any

assertion

by

the

fact

above

In

contrast

the

weakest

strict

preconditions

exclude

divergence

and

one

can

check

that

wp

-LRB-

S

ftrue

Trueg

-RRB-

f?g

Now

the

set

of

states

f?g

can

be

for

instance

defined

as

-LSB-

-LSB-

ffalse

Falseg

-RSB-

-RSB-

Unfortunately

the

definability

property

does

not

hold

for

the

weakest

preconditions

either

Let

S

X

X

Consider

wp

-LRB-

S

fQ

Dg

-RRB-

with

Q

-LRB-

X

ju

-RRB-

-LRB-

X

ju

-RRB-

and

D

-LRB-

X

-RRB-

Let

oe

be

an

initial

state

such

that

oe

-LRB-

X

-RRB-

ju

Let

be

the

corresponding

final

state

If

all

indices

are

active

then

the

assignment

occurs

everywhere

and

-LRB-

X

-RRB-

ju

Thus

D

evaluates

to

True

in

and

the

final

state

satisfies

fQ

Dg

If

all

indices

are

idle

then

nothing

changes

-LRB-

X

-RRB-

ju

Thus

D

evaluates

to

False

in

and

the

final

state

satisfies

fQ

Dg

too

We

thus

have

-LRB-

oe

True

-RRB-

wp

-LRB-

S

fQ

Dg

-RRB-

and

-LRB-

oe

False

-RRB-

wp

-LRB-

S

fQ

Dg

-RRB-

If

wp

-LRB-

S

fQ

Dg

-RRB-

was

described

by

some

assertion

fP

Cg

then

oe

-LRB-

C

-RRB-

should

be

equal

both

to

True

and

to

False

This

is

thus

impossible

However

we

shall

see

that

a

suitable

restriction

on

the

syntax

of

context

expressions

yields

the

definability

property

for

weakest

preconditions

Discussion

These

preliminary

remarks

show

that

our

choice

of

two-component

assertions

fP

Cg

leads

to

difficulties

when

the

variables

of

C

are

modified

by

the

program

wlp

-LRB-

X

X

fQ

X

-RRB-

with

Q

-LRB-

X

ju

-RRB-

-LRB-

X

ju

-RRB-

is

not

definable

whereas

wlp

-LRB-

Y

Y

fQ

X

-RRB-

is

definable

as

shown

later

Two

alternatives

can

be

considered

here

Change

the

assertion

language

to

support

more

general

dependencies

between

oe

and

c

In

our

setting

we

consider

explicit

functional

dependencies

only

-LRB-

oe

c

-RRB-

j

fP

Cg

iff

oe

j

P

and

c

oe

-LRB-

c

-RRB-

A

possible

extension

would

be

to

consider

implicit

logical

dependency

introduce

a

new

name

say

-RSB-

to

follow

the

Actus

terminology

to

denote

the

current

context

as

a

value

in

the

environment

We

then

can

consider

generalized

assertions

of

the

form

P

-LRB-

-RSB-

-RRB-

with

-LRB-

oe

c

-RRB-

j

P

-LRB-

-RSB-

-RRB-

iff

oe

-LSB-

-RSB-

c

-RSB-

j

P

-LRB-

-RSB-

-RRB-

This

supports

sets

of

context

take

for

instance

P

-LRB-

-RSB-

-RRB-

-LRB-

-RSB-

ju

true

-RRB-

-LRB-

-RSB-

ju

false

-RRB-

A

two

component

assertion

fP

Cg

is

nothing

more

than

the

special

case

P

-LRB-

-RSB-

-RRB-

P

-LRB-

-RSB-

ju

Cju

-RRB-

This

direction

is

sketched

in

Section

but

it

does

not

support

a

simple

two-phase

methodology

any

more

Keep

this

assertion

language

and

improve

the

proof

system

to

circumvent

this

lack

of

definability

This

is

done

in

Section

using

an

additional

rule

to

handle

hidden

variables

in

assertions

In

this

paper

we

describe

the

second

alternative

We

show

in

Section

that

it

actually

leads

to

a

two-phase

proof

methodology

where

context

expression

and

predicate

are

handled

separately

Definability

of

the

weakest

strict

preconditions

of

linear

programs

For

now

on

we

restrict

ourselves

to

the

most

basic

case

which

consists

in

L

programs

without

loops

and

context

expression

not

modified

by

programs

The

extension

to

the

general

case

is

discussed

in

the

end

of

this

section

The

following

notion

will

be

useful

in

this

section

Definition

-LRB-

Linear

L

programs

-RRB-

A

L

program

S

is

linear

if

it

is

made

of

assignments

sequencing

and

conditioning

only

Note

that

a

linear

program

may

not

diverge

and

that

its

weakest

liberal

preconditions

are

thus

identical

to

its

weakest

strict

preconditions

We

can

thus

safely

drop

the

distinction

Definition

-LRB-

Plain

specification

-RRB-

A

pair

-LRB-

S

fQ

Dg

-RRB-

is

said

to

be

plain

if

we

have

Var

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

A

specification

formula

fP

Cg

S

fQ

Dg

is

said

to

be

plain

if

-LRB-

S

fQ

Dg

-RRB-

is

plain

We

call

the

weakest

preconditions

of

a

plain

pair

-LRB-

S

fQ

Dg

-RRB-

a

plain

weakest

precondition

Weakest

preconditions

of

basic

constructs

Let

us

first

consider

the

weakest

precondition

of

assignment

and

sequential

composition

Proposition

-LRB-

Assignment

-RRB-

If

X

Var

-LRB-

D

-RRB-

then

wp

-LRB-

X

E

fQ

Dg

-RRB-

fQ

-LSB-

-LRB-

D?E

X

-RRB-

X

-RSB-

Dg

Proof

Let

-LRB-

oe

c

-RRB-

wlp

-LRB-

X

E

fQ

Dg

-RRB-

Assume

-LSB-

-LSB-

X

E

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

Then

-LRB-

c

-RRB-

-LSB-

-LSB-

fQ

Dg

-RSB-

-RSB-

As

X

Var

-LRB-

D

-RRB-

we

have

oe

-LRB-

D

-RRB-

-LRB-

D

-RRB-

c.

By

definition

oe

-LSB-

X

oe

-LRB-

D?E

X

-RRB-

-RSB-

j

Q.

By

the

Substitution

Lemma

we

deduce

oe

j

Q

-LSB-

-LRB-

D?E

X

-RRB-

X

-RSB-

Conversely

let

-LRB-

oe

c

-RRB-

-LSB-

-LSB-

fQ

-LSB-

-LRB-

D?E

X

-RRB-

X

-RSB-

Dg

-RSB-

-RSB-

By

definition

we

have

oe

j

Q

-LSB-

-LRB-

D?E

X

-RRB-

X

-RSB-

and

oe

-LRB-

D

-RRB-

c.

Let

-LRB-

c

-RRB-

-LSB-

-LSB-

X

E

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

By

definition

oe

-LSB-

X

oe

-LRB-

D?E

X

-RRB-

-RSB-

By

the

Substitution

Lemma

as

oe

j

Q

-LSB-

-LRB-

D?E

X

-RRB-

X

-RSB-

we

deduce

j

Q

As

above

-LRB-

D

-RRB-

oe

-LRB-

D

-RRB-

c

and

-LRB-

c

-RRB-

-LSB-

-LSB-

fQ

Dg

-RSB-

-RSB-

Proposition

-LRB-

Sequential

composition

-RRB-

wp

-LRB-

S

T

fQ

Dg

-RRB-

wp

-LRB-

S

wp

-LRB-

T

fQ

Dg

-RRB-

-RRB-

Proof

By

definition

wp

-LRB-

S

T

fQ

Dg

-RRB-

fs

j

-LSB-

-LSB-

S

T

-RSB-

-RSB-

-LRB-

s

-RRB-

-LSB-

-LSB-

fQ

Dg

-RSB-

-RSB-

g

fs

j

-LSB-

-LSB-

T

-RSB-

-RSB-

-LRB-

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

s

-RRB-

-RRB-

-LSB-

-LSB-

fQ

Dg

-RSB-

-RSB-

g

fs

j

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

s

-RRB-

j

-LSB-

-LSB-

T

-RSB-

-RSB-

-LRB-

-RRB-

-LSB-

-LSB-

fQ

Dg

-RSB-

-RSB-

gg

fs

j

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

s

-RRB-

wp

-LRB-

T

fQ

Dg

-RRB-

g

wp

-LRB-

S

wp

-LRB-

T

fQ

Dg

-RRB-

-RRB-

Weakest

preconditions

of

a

conditioning

construct

We

now

turn

to

the

conditioning

construct

We

start

with

the

easy

case

where

the

conditioned

body

does

not

modify

the

assertions

Proposition

Assume

-LRB-

S

fQ

D

Bg

-RRB-

is

plain

If

wp

-LRB-

S

fQ

D

Bg

-RRB-

fP

Cg

then

wp

-LRB-

where

B

do

S

end

fQ

Dg

-RRB-

fP

Dg

The

proof

uses

an

additional

technical

lemma

It

expresses

that

the

activity

context

is

left

unchanged

by

a

program

It

may

thus

be

captured

by

the

same

boolean

vector

expression

as

soon

as

its

variables

are

not

changed

by

the

program

Lemma

Let

-LRB-

S

fQ

Dg

-RRB-

be

plain

Assume

j

fP

Cg

S

fQ

Dg

and

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

conv

-LRB-

S

s

-RRB-

Then

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

-LSB-

-LSB-

fP

Dg

-RSB-

-RSB-

In

particular

we

have

j

fP

Dg

S

fQ

Dg

and

-LSB-

-LSB-

fP

Dg

-RSB-

-RSB-

conv

-LRB-

S

s

-RRB-

Proof

Assume

oe

j

P

Let

c

oe

-LRB-

C

-RRB-

and

oe

-LRB-

D

-RRB-

By

hypothesis

we

have

conv

-LRB-

S

-LRB-

oe

c

-RRB-

-RRB-

and

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

-LSB-

-LSB-

fQ

Dg

-RSB-

-RSB-

We

deduce

-LRB-

D

-RRB-

c

Since

Var

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

we

have

oe

-LRB-

D

-RRB-

-LRB-

D

-RRB-

c

too

We

deduce

fP

Cg

fP

Dg

and

thus

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

-LSB-

-LSB-

fP

Dg

-RSB-

-RSB-

Without

the

above

assumption

of

convergence

this

lemma

is

not

true

Consider

for

instance

S

loop

X

do

Y

Y

end

We

have

j

X

ju

X

g

S

X

ju

X

g

but

X

ju

X

g

S

X

ju

X

g

As

an

important

consequence

of

the

preceding

lemma

we

obtain

the

following

result

Lemma

-LRB-

Extension

Lemma

-RRB-

Assume

-LRB-

S

fQ

Dg

-RRB-

is

plain

If

wp

-LRB-

S

fQ

Dg

-RRB-

fP

Cg

then

wp

-LRB-

S

fQ

Dg

-RRB-

fP

Dg

We

can

now

give

the

proof

of

Proposition

Proof

Let

-LRB-

oe

c

-RRB-

wp

-LRB-

where

B

do

S

end

fQ

Dg

-RRB-

By

definition

-LSB-

-LSB-

where

B

do

S

end

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

-LSB-

-LSB-

fQ

Dg

-RSB-

-RSB-

with

such

that

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

oe

-LRB-

B

-RRB-

-RRB-

As

-LRB-

Var

-LRB-

D

-RRB-

-LSB-

Var

-LRB-

B

-RRB-

-RRB-

Change

-LRB-

S

-RRB-

we

have

-LRB-

D

-RRB-

oe

-LRB-

D

-RRB-

c

and

-LRB-

B

-RRB-

oe

-LRB-

B

-RRB-

Thus

c

oe

-LRB-

B

-RRB-

-LRB-

D

B

-RRB-

and

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

-LSB-

-LSB-

fQ

D

Bg

-RSB-

-RSB-

By

assumption

we

have

-LRB-

oe

c

oe

-LRB-

B

-RRB-

-RRB-

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

and

oe

j

P

Thus

-LRB-

oe

c

-RRB-

-LSB-

-LSB-

fP

Dg

-RSB-

-RSB-

as

wanted

Conversely

let

-LRB-

oe

c

-RRB-

-LSB-

-LSB-

fP

Dg

-RSB-

-RSB-

Observe

first

that

by

Lemma

wp

-LRB-

S

fQ

D

Bg

-RRB-

fP

Cg

fP

D

Bg

Thus

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

oe

-LRB-

B

-RRB-

-RRB-

-LRB-

-RRB-

fQ

D

Bg

and

j

Q.

Thus

-LSB-

-LSB-

where

B

do

S

end

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

As

Var

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

-LRB-

D

-RRB-

oe

-LRB-

D

-RRB-

c

and

we

have

-LRB-

c

-RRB-

-LSB-

-LSB-

fQ

Dg

-RSB-

-RSB-

as

wanted

To

remove

the

restriction

on

variables

in

expression

B

let

us

consider

cases

where

Var

-LRB-

B

-RRB-

Change

-LRB-

S

-RRB-

We

can

then

introduce

a

new

variable

Tmp

and

transform

program

where

B

do

S

end

into

Tmp

B

where

Tmp

do

S

end

Assume

wp

-LRB-

S

fQ

D

Tmpg

-RRB-

fP

Cg

Then

using

the

preceding

results

we

can

see

that

wp

-LRB-

Tmp

B

where

Tmp

do

S

end

fQ

Dg

-RRB-

fP

-LSB-

-LRB-

D?B

Tmp

-RRB-

Tmp

-RSB-

Dg

This

transformation

can

in

fact

be

encapsulated

in

a

single

rule

for

wp

Proposition

Assume

-LRB-

S

fQ

Dg

-RRB-

is

plain

and

let

Tmp

be

a

-LRB-

new

-RRB-

variable

such

that

Tmp

-LRB-

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

S

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

-RRB-

If

wp

-LRB-

S

fQ

D

Tmpg

-RRB-

fP

Cg

then

wp

-LRB-

where

B

do

S

end

fQ

Dg

-RRB-

fP

-LSB-

B

Tmp

-RSB-

Dg

Proof

Let

-LRB-

oe

c

-RRB-

wp

-LRB-

where

B

do

S

end

fQ

Dg

-RRB-

By

definition

-LSB-

-LSB-

where

B

do

S

end

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

-LSB-

-LSB-

fQ

Dg

-RSB-

-RSB-

with

such

that

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

oe

-LRB-

B

-RRB-

-RRB-

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

We

have

j

Q

and

-LRB-

D

-RRB-

c

As

Var

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

oe

-LRB-

D

-RRB-

-LRB-

D

-RRB-

c.

Let

oe

-LSB-

Tmp

oe

-LRB-

B

-RRB-

-RSB-

and

-LSB-

Tmp

oe

-LRB-

B

-RRB-

-RSB-

By

definition

we

have

-LRB-

Tmp

-RRB-

oe

-LRB-

B

-RRB-

-LRB-

Tmp

-RRB-

As

Tmp

Var

-LRB-

D

-RRB-

-LRB-

D

-RRB-

oe

-LRB-

D

-RRB-

c

and

-LRB-

D

-RRB-

-LRB-

D

-RRB-

c

As

Tmp

Var

-LRB-

Q

-RRB-

and

j

Q

j

Q

too

As

Tmp

Var

-LRB-

S

-RRB-

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

-LRB-

-LRB-

D

Tmp

-RRB-

-RRB-

As

-LRB-

-LRB-

D

Tmp

-RRB-

-RRB-

-LSB-

-LSB-

fQ

D

Tmpg

-RSB-

-RSB-

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

Thus

j

P

By

the

Substitution

Lemma

oe

j

P

-LSB-

B

Tmp

-RSB-

and

-LRB-

oe

c

-RRB-

fP

-LSB-

B

Tmp

-RSB-

Dg

Conversely

let

-LRB-

oe

c

-RRB-

-LSB-

-LSB-

fP

-LSB-

B

Tmp

-RSB-

Dg

-RSB-

-RSB-

Let

oe

-LSB-

Tmp

oe

-LRB-

B

-RRB-

-RSB-

By

the

Substitution

Lemma

j

P

Also

as

Tmp

does

not

appear

in

D

-LRB-

D

-RRB-

oe

-LRB-

D

-RRB-

c.

Thus

-LRB-

c

-LRB-

Tmp

-RRB-

-RRB-

j

fP

D

Tmpg

By

Lemma

we

have

wp

-LRB-

S

fQ

D

Tmpg

-RRB-

fP

Cg

fP

D

Tmpg

Thus

there

exists

some

such

that

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

c

-LRB-

Tmp

-RRB-

-RRB-

-LRB-

c

-LRB-

Tmp

-RRB-

-RRB-

j

fQ

D

Tmpg

In

particular

j

Q

As

Tmp

does

not

appear

in

S

we

have

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

oe

-LRB-

B

-RRB-

-RRB-

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

too

with

-LSB-

Tmp

oe

-LRB-

Tmp

-RRB-

-RSB-

As

j

Q

and

Tmp

does

not

appear

in

Q

we

have

j

Q

as

well

By

the

semantics

of

the

conditioning

construct

we

deduce

finally

-LSB-

-LSB-

where

B

do

S

end

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

fQ

Dg

as

wanted

Theorem

-LRB-

Plain

WP

for

linear

L-programs

are

definable

-RRB-

Let

S

be

a

linear

L

program

-LRB-

that

is

without

loop

construct

-RRB-

and

let

-LRB-

S

fQ

Dg

-RRB-

be

plain

Then

there

exists

a

predicate

P

such

that

wp

-LRB-

S

fQ

Dg

-RRB-

fP

Dg

Proof

By

induction

on

the

structure

of

S

The

case

of

assignment

and

sequential

composition

are

trivial

Let

S

where

B

do

T

end

Let

Tmp

be

a

new

variable

not

in

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

-LSB-

Var

-LRB-

S

-RRB-

By

induction

hypothesis

there

exists

an

assertion

fP

Cg

such

that

wp

-LRB-

T

fQ

D

Tmpg

-RRB-

fP

Cg

By

Proposition

we

have

wp

-LRB-

S

fQ

Dg

-RRB-

fP

-LSB-

B

Tmp

-RSB-

Dg

The

example

at

the

end

of

section

shows

that

the

theorem

is

no

longer

true

if

the

restriction

Var

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

is

removed

In

this

case

the

set

wp

-LRB-

S

fQ

Dg

-RRB-

can

not

be

defined

by

any

assertion

fP

Cg

in

general

Yet

we

can

obtain

a

weaker

result

as

follows

Let

-RSB-

be

a

new

variable

We

can

observe

that

-LRB-

oe

c

-RRB-

-LSB-

-LSB-

fQ

Dg

-RSB-

-RSB-

iff

-LRB-

oe

-LSB-

-RSB-

c

-RSB-

c

-RRB-

-LSB-

-LSB-

fQ

-RSB-

D

Dg

-RSB-

-RSB-

Note

then

that

-LSB-

-LSB-

fQ

-RSB-

D

Dg

-RSB-

-RSB-

-LSB-

-LSB-

fQ

-RSB-

D

-RSB-

g

-RSB-

-RSB-

As

-RSB-

is

a

new

variable

we

are

able

to

apply

the

previous

theorem

to

wp

-LRB-

S

fQ

-RSB-

D

-RSB-

g

-RRB-

It

yields

some

assertion

fP

Cg

which

defines

this

set

-LRB-

observe

-RSB-

may

occur

in

P

-RRB-

By

the

Extension

Lemma

it

is

described

by

fP

-RSB-

g

as

well

Theorem

Let

fQ

Dg

be

an

assertion

and

S

be

a

linear

L

program

Let

-RSB-

be

a

new

variable

not

in

Var

-LRB-

D

-RRB-

-LSB-

Var

-LRB-

S

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

Then

there

exists

a

predicate

P

such

that

wp

-LRB-

S

fQ

Dg

-RRB-

f

-LRB-

oe

c

-RRB-

j

oe

-LSB-

-RSB-

c

-RSB-

j

Pg

Proof

Let

fP

-RSB-

g

wp

-LRB-

S

fQ

-RSB-

D

-RSB-

g

-RRB-

Consider

a

state

-LRB-

oe

c

-RRB-

such

that

oe

-LSB-

-RSB-

c

-RSB-

j

P

Let

oe

-LSB-

-RSB-

c

-RSB-

Then

j

P

Also

-LRB-

-RSB-

-RRB-

c.

Thus

-LRB-

c

-RRB-

fP

-RSB-

g.

Let

-LRB-

c

-RRB-

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

c

-RRB-

We

have

-LRB-

c

-RRB-

fQ

-RSB-

D

-RSB-

g

It

is

then

routine

to

show

that

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

fQ

Dg

The

converse

proof

is

of

the

same

vein

It

is

interesting

to

notice

that

Theorem

is

a

special

case

of

Theorem

Actually

assume

that

Var

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

Consider

wp

-LRB-

S

fQ

Dg

-RRB-

and

apply

Theorem

We

have

wp

-LRB-

S

fQ

Dg

-RRB-

f

-LRB-

oe

c

-RRB-

j

oe

-LSB-

-RSB-

c

-RSB-

j

Pg

where

-RSB-

is

a

new

variable

As

Var

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

oe

-LRB-

D

-RRB-

c

This

set

of

states

is

thus

equal

to

f

-LRB-

oe

c

-RRB-

j

oe

-LSB-

-RSB-

oe

-LRB-

D

-RRB-

-RSB-

j

P

oe

-LRB-

D

-RRB-

cg

that

is

f

-LRB-

oe

c

-RRB-

j

oe

j

P

-LSB-

D

-RSB-

oe

-LRB-

D

-RRB-

cg

that

is

precisely

-LSB-

-LSB-

fP

-LSB-

D

-RSB-

Dg

-RSB-

-RSB-

as

announced

in

Theorem

Definability

of

weakest

liberal

preconditions

Except

for

the

where

construct

the

basic

definability

properties

of

weakest

strict

preconditions

for

assignment

and

sequencing

still

hold

for

the

weakest

liberal

preconditions

with

similar

proofs

We

concentrate

here

on

the

case

of

the

conditioning

construct

and

we

show

that

no

result

analogous

to

Theorem

may

be

expected

Of

course

this

only

concerns

non-linear

programs

With

the

two-component

assertional

proof

system

the

data-parallel

case

turns

out

to

be

much

more

complex

than

the

usual

sequential

one

The

difficulty

to

be

addressed

is

the

following

In

presence

of

divergence

we

can

not

infer

the

initial

activity

contexts

from

postassertions

We

could

expect

a

property

of

the

form

If

fP

C

Bg

wlp

-LRB-

S

fQ

D

Bg

-RRB-

then

fP

Cg

wlp

-LRB-

where

B

do

S

end

fQ

Dg

-RRB-

An

easy

partial

result

is

given

by

the

proof

rule

for

the

where

construct

Proposition

Assume

change

-LRB-

S

-RRB-

var

-LRB-

C

-RRB-

If

fP

C

Bg

wlp

-LRB-

S

fQ

D

Bg

-RRB-

then

fP

Cg

wlp

-LRB-

where

B

do

S

end

fQ

Cg

-RRB-

Unfortunately

the

preceding

proposition

does

not

hold

if

we

replace

inclusions

by

equalities

as

shown

by

the

following

example

Consider

the

following

program

S

over

a

one-dimensional

domain

D

-LSB-

M

-RSB-

Intuitively

the

value

of

X

ju

is

initially

set

to

false

at

each

active

index

Then

the

values

of

X

X

etc.

are

repeatedly

fetched

until

value

false

is

found

Remember

that

we

assume

that

function

stoi

is

defined

everywhere

so

that

fetching

makes

sense

for

any

address

-LRB-

think

for

instance

of

some

cyclic

numbering

scheme

as

in

MPL

-RRB-

X

False

where

This

do

N

X

True

loop

X

jN

do

N

N

end

end

Define

P

-LRB-

X

ju

true

-RRB-

and

C

-LRB-

This

-RRB-

Fact

S

diverges

from

-LRB-

oe

c

-RRB-

iff

-LRB-

oe

c

-RRB-

fP

Cg

Proof

S

diverges

iff

index

is

active

on

entering

the

loop

and

no

X

ju

is

spotted

to

be

false

Because

of

the

initial

assignment

X

False

X

ju

is

false

iff

index

u

is

initially

active

Thus

all

indices

u

have

to

be

idle

initially

for

divergence

to

occur

That

is

the

initial

context

is

described

by

This

Also

each

X

ju

has

to

be

true

initially

-LRB-

except

for

u

-RRB-

The

first

crucial

observation

is

now

that

the

value

of

C

does

not

depend

on

the

environment

Fact

wlp

-LRB-

S

ftrue

Cg

-RRB-

ftrue

Cg

Proof

Assume

-LRB-

oe

c

-RRB-

ftrue

Cg

If

S

diverges

from

this

state

then

we

are

done

If

S

converges

then

the

final

context

is

the

same

as

the

initial

one

and

we

are

done

again

Conversely

let

s

such

that

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

s

-RRB-

ftrue

Cg

If

S

diverges

from

this

state

then

s

fP

Cg

ftrue

Cg

If

it

converges

then

its

context

is

still

described

by

C

as

C

does

not

depend

on

the

environment

The

second

crucial

observation

is

that

the

context

described

by

C

is

not

identically

active

Fact

wlp

-LRB-

where

C

do

S

end

ftrue

Trueg

-RRB-

is

not

definable

by

any

assertion

Proof

Fix

an

environment

oe

j

P

Then

both

-LRB-

oe

True

-RRB-

and

-LRB-

oe

oe

-LRB-

C

-RRB-

-RRB-

belong

to

wlp

-LRB-

where

C

do

S

end

ftrue

Trueg

-RRB-

As

oe

-LRB-

C

-RRB-

True

this

set

can

not

be

described

by

any

assertion

as

remarked

in

Section

Yet

the

definability

property

holds

for

the

weakest

liberal

preconditions

of

the

where

construct

modulo

the

set

of

divergent

states

Proposition

Assume

Var

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

and

let

Tmp

be

a

-LRB-

new

-RRB-

variable

such

that

Tmp

-LRB-

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

S

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

-RRB-

If

wp

-LRB-

S

fQ

D

Tmpg

-RRB-

fP

D

Tmpg

wlp

-LRB-

S

fQ

D

Tmpg

-RRB-

then

wp

-LRB-

where

B

do

S

end

fQ

Dg

-RRB-

fP

-LSB-

B

Tmp

-RSB-

Dg

wlp

-LRB-

where

B

do

S

end

fQ

Dg

-RRB-

Proof

The

first

inclusion

is

a

part

of

Proposition

The

proof

of

the

second

inclusion

is

very

similar

to

the

corresponding

proof

for

the

weakest

preconditions

Consider

a

state

-LRB-

oe

c

-RRB-

j

fP

-LSB-

B

Tmp

-RSB-

Dg

Let

oe

-LSB-

Tmp

oe

-LRB-

B

-RRB-

-RSB-

By

the

Substitution

Lemma

j

P

If

S

diverges

from

the

state

-LRB-

oe

c

oe

-LRB-

B

-RRB-

-RRB-

then

the

result

trivially

holds

Otherwise

let

c

oe

-LRB-

B

-RRB-

There

exists

an

environment

such

that

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

-RRB-

-LRB-

-RRB-

As

Tmp

does

not

appear

in

S

we

have

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

-RRB-

-LRB-

-RRB-

too

with

-LSB-

Tmp

oe

-LRB-

Tmp

-RRB-

-RSB-

By

definition

we

have

oe

-LRB-

B

-RRB-

-LRB-

Tmp

-RRB-

As

Tmp

does

not

appear

in

D

-LRB-

D

-RRB-

oe

-LRB-

D

-RRB-

c.

Thus

-LRB-

-RRB-

j

fP

D

Tmpg

We

deduce

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

-RRB-

j

fQ

D

Tmpg

In

particular

j

Q

As

Tmp

does

not

appear

in

Q

j

Q

as

well

As

Var

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

-LRB-

D

-RRB-

oe

-LRB-

D

-RRB-

c.

By

the

semantics

of

the

conditioning

construct

we

finally

have

-LSB-

-LSB-

where

B

do

S

end

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

j

fQ

Dg

Discussion

extending

the

assertion

language

So

far

we

have

shown

that

plain

weakest

preconditions

of

linear

programs

are

always

definable

by

some

two-component

assertion

but

that

weakest

liberal

preconditions

of

non-linear

program

are

not

in

general

The

two-component

assertion

language

is

not

expressive

enough

to

denote

its

own

weakest

preconditions

In

Theorem

we

have

shown

an

alternative

to

the

description

of

weakest

preconditions

By

the

introduction

of

some

auxiliary

variable

Aux

which

denotes

the

context

we

can

find

a

predicate

P

which

denotes

the

weakest

preconditions

In

-LSB-

-RSB-

it

is

shown

this

theorem

is

true

in

all

cases

including

weakest

liberal

preconditions

of

non-linear

programs

-LRB-

this

uses

a

G?odel

encoding

of

computations

very

much

as

in

the

completeness

proof

of

the

classical

Hoare

's

logic

in

-LSB-

-RSB-

-RRB-

Going

back

to

the

counterexamples

of

Section

reconsider

the

first

program

S

loop

True

do

X

X

end

we

have

wlp

-LRB-

S

ftrue

Trueg

-RRB-

f

-LRB-

oe

c

-RRB-

j

oe

-LSB-

Aux

c

-RSB-

j

Auxju

trueg

For

the

second

program

let

S

X

X

Q

-LRB-

X

ju

-RRB-

-LRB-

X

ju

-RRB-

D

-LRB-

X

-RRB-

We

have

wlp

-LRB-

S

fQ

Dg

-RRB-

f

-LRB-

oe

c

-RRB-

j

oe

-LSB-

Aux

c

-RSB-

j

Q

-LSB-

-LRB-

Auxju

true

-RRB-

-LRB-

Auxju

false

-RRB-

-RSB-

g

Moreover

we

have

a

logical

link

between

valid

specifications

and

weakest

preconditions

denoted

by

a

predicate

with

some

auxiliary

variable

It

is

stated

in

the

following

property

-LRB-

-LSB-

-RSB-

-RRB-

which

generalizes

Consequence

Lemma

Proposition

Let

S

be

a

L-program

fQ

Dg

be

an

assertion

Let

W

be

a

predicate

and

Aux

be

a

new

variable

not

in

Var

-LRB-

S

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

Var

-LRB-

D

-RRB-

such

that

wlp

-LRB-

S

fQ

Dg

-RRB-

f

-LRB-

oe

c

-RRB-

j

oe

-LSB-

Aux

c

-RSB-

j

Wg

For

any

assertion

fP

Cg

such

that

j

fP

Cg

S

fQ

Dg

we

have

j

-LSB-

P

-LRB-

Cju

Auxju

-RRB-

-RSB-

-RRB-

W

Completeness

of

the

proof

system

We

now

want

to

establish

the

completeness

for

our

proof

system

If

a

specification

fP

Cg

S

fQ

Dg

can

be

derived

in

this

proof

system

we

write

fP

Cg

S

fQ

Dg

We

restrict

ourself

to

linear

L-programs

It

is

well-known

that

proving

completeness

in

presence

of

a

loop

requires

some

complex

machinery

invariant

predicates

variant

expressions

etc.

-LRB-

see

-LSB-

-RSB-

for

instance

-RRB-

which

would

obscure

the

main

line

of

our

work

at

this

point

The

proof

of

the

completeness

is

constructed

in

an

incremental

way

We

start

from

a

basic

case

completeness

for

a

restricted

form

of

specification

-LRB-

restrictions

on

the

program

and

on

the

assertions

-RRB-

We

introduce

auxiliary

variables

and

a

rule

to

handle

them

which

allow

us

to

remove

step

by

step

all

restrictions

The

following

notion

is

the

restricted

form

of

programs

we

first

consider

Definition

-LRB-

Regular

program

-RRB-

A

program

P

is

regular

if

for

any

subprogram

of

P

of

the

form

where

B

do

S

we

have

Var

-LRB-

B

-RRB-

Change

-LRB-

S

-RRB-

The

results

of

the

previous

section

can

be

restated

as

follows

As

we

assume

the

specifications

to

be

plain

and

the

programs

to

be

regular

we

call

it

restricted

definability

Proposition

-LRB-

Restricted

definability

of

WP

for

regular

programs

-RRB-

Let

S

be

a

regular

linear

L

program

and

let

-LRB-

S

fQ

Dg

-RRB-

be

plain

Then

there

exists

an

assertion

fP

Cg

such

that

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

wp

-LRB-

S

fQ

Dg

-RRB-

In

particular

j

fP

Cg

S

fQ

Dg

We

aim

at

proving

the

following

theorem

Theorem

-LRB-

Restr

completeness

plain

specif.

reg.

lin

programs

-RRB-

Let

fP

Cg

S

fQ

Dg

be

a

plain

specification

where

S

is

a

regular

linear

program

If

j

fP

Cg

S

fQ

Dg

then

fP

Cg

S

fQ

Dg

Proof

The

proof

of

this

theorem

follows

the

lines

of

-LSB-

-RSB-

It

uses

the

weakest

preconditions

calculus

For

any

regular

linear

program

S

and

any

plain

pair

-LRB-

S

fQ

Dg

-RRB-

there

exists

some

assertion

fP

such

that

-LSB-

-LSB-

fP

-RSB-

-RSB-

wp

-LRB-

S

fQ

Dg

-RRB-

Using

the

Consequence

Rule

it

suffices

to

demonstrate

that

fwp

-LRB-

S

fQ

Dg

-RRB-

g

S

fQ

Dg

The

proof

is

by

induction

on

the

structure

of

the

regular

linear

program

S

using

the

definability

properties

of

Section

The

cases

of

the

assignment

and

sequencing

constructs

are

straightforward

Let

us

consider

in

more

detail

the

case

of

the

conditioning

construct

with

S

where

B

do

T

end

As

S

is

regular

by

hypothesis

we

have

Change

-LRB-

T

-RRB-

Var

-LRB-

B

-RRB-

As

the

specification

is

plain

we

have

Change

-LRB-

S

-RRB-

Var

-LRB-

D

-RRB-

As

Change

-LRB-

T

-RRB-

Change

-LRB-

S

-RRB-

we

also

have

Change

-LRB-

T

-RRB-

Var

-LRB-

D

-RRB-

The

Definability

Property

yields

an

assertion

fP

Cg

such

that

fP

Cg

wp

-LRB-

T

fQ

D

Bg

-RRB-

By

the

Extension

Lemma

we

get

wp

-LRB-

T

fQ

;D

Bg

-RRB-

fP

D

Bg

Program

T

is

regular

and

linear

as

S

is

so

Specification

fP

D

Bg

T

fQ

D

Bg

is

plain

Thus

the

induction

hypothesis

yields

fP

D

Bg

T

fQ

D

Bg

As

-LRB-

Var

-LRB-

B

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

-RRB-

Change

-LRB-

T

-RRB-

the

where

Rule

of

the

proof

system

applies

and

we

get

fP

Dg

where

B

do

T

end

fQ

Dg

Furthermore

the

Definability

Property

gives

wp

-LRB-

where

B

do

T

end

fQ

Dg

-RRB-

fP

Dg

Hence

the

desired

result

fwp

-LRB-

where

B

do

T

end

fQ

Dg

-RRB-

g

where

B

do

T

end

fQ

Dg

Consider

now

a

plain

specification

j

fP

Cg

S

fQ

Dg

with

S

being

a

regular

linear

program

By

the

Definability

Property

there

exists

some

assertion

fP

such

that

fP

wp

-LRB-

S

fQ

Dg

-RRB-

By

the

above

result

we

know

that

fP

S

fQ

Dg

By

Consequence

Lemma

we

get

that

fP

Cg

-RRB-

fP

We

can

thus

apply

the

Consequence

Rule

of

the

proof

system

It

yields

fP

Cg

S

fQ

Dg

as

wanted

This

demonstrates

the

completeness

of

the

proof

system

for

plain

specifications

and

regular

linear

programs

Extending

the

proof

of

completeness

to

non-regular

linear

programs

In

the

presence

of

non-regular

programs

we

are

no

longer

able

to

find

any

assertion

that

expresses

the

weakest

preconditions

Thus

we

first

have

to

transform

a

non-regular

program

into

a

regular

one

This

can

be

done

by

introducing

an

auxiliary

variable

which

stores

the

value

of

the

vector

boolean

expression

program

where

B

do

S

end

is

transformed

into

Tmp

B

where

Tmp

do

S

end

Using

such

a

variable

can

be

interpreted

as

keeping

track

of

the

nested

activity

context

in

a

stack

Each

new

variable

Tmp

is

a

frame

of

the

stack

But

instead

of

transforming

programs

in

order

to

be

able

to

prove

them

we

claim

that

it

is

possible

to

encapsulate

this

transformation

into

the

proof

system

itself

The

notion

corresponding

to

the

syntactic

auxiliary

variable

is

that

of

a

semantic

hidden

variable

in

assertions

Rule

-LRB-

Elimination

of

hidden

variables

-RRB-

Let

E

be

any

vector

expression

fP

Cg

S

fQ

Dg

Tmp

V

ar

-LRB-

S

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

fP

-LSB-

E

Tmp

-RSB-

C

-LSB-

E

Tmp

-RSB-

g

S

fQ

Dg

We

denote

by

fP

Cg

S

fQ

Dg

that

a

specification

formula

is

derivable

in

the

proof

system

augmented

with

this

new

rule

The

soundness

of

the

extended

proof

system

is

expressed

by

the

following

proposition

Theorem

-LRB-

Soundness

of

-RRB-

The

proof

system

is

sound

if

fPg

S

fQg

then

j

fPg

S

fQg

Proof

As

is

an

extension

of

with

the

Elimination

Rule

it

suffices

to

check

the

following

fact

Let

us

consider

Tmp

V

ar

-LRB-

S

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

and

E

an

expression

If

j

fP

Cg

S

fQ

Dg

then

j

fP

-LSB-

E

Tmp

-RSB-

C

-LSB-

E

Tmp

-RSB-

g

S

fQ

Dg

Assume

j

fP

Cg

S

fQ

Dg

Let

us

consider

-LRB-

oe

c

-RRB-

j

fP

-LSB-

E

Tmp

-RSB-

C

-LSB-

E

Tmp

-RSB-

g

In

particular

oe

j

P

-LSB-

E

Tmp

-RSB-

Let

oe

-LSB-

Tmp

oe

-LRB-

E

-RRB-

-RSB-

By

the

Substitution

Lemma

j

P

Moreover

-LRB-

C

-RRB-

oe

-LRB-

C

-LSB-

E

Tmp

-RSB-

-RRB-

c.

Thus

-LRB-

c

-RRB-

j

fP

Cg

By

hypothesis

we

have

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

c

-RRB-

-LRB-

c

-RRB-

with

-LRB-

c

-RRB-

j

fQ

Dg

Finally

let

-LRB-

c

-RRB-

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

As

Tmp

Var

-LRB-

S

-RRB-

we

have

-LSB-

Tmp

oe

-LRB-

E

-RRB-

-RSB-

What

is

more

j

Q

and

Tmp

Var

-LRB-

Q

-RRB-

so

j

Q

and

-LRB-

D

-RRB-

c

with

Tmp

Var

-LRB-

D

-RRB-

so

-LRB-

D

-RRB-

c.

Thus

we

have

-LRB-

c

-RRB-

j

fQ

Dg

Thus

j

fP

-LSB-

E

Tmp

-RSB-

C

-LSB-

E

Tmp

-RSB-

g

S

fQ

Dg

We

now

want

to

establish

the

following

completeness

theorem

Theorem

-LRB-

Restricted

completeness

plain

specif.

linear

program

-RRB-

Let

fP

Cg

S

fQ

Dg

be

a

plain

specification

with

S

a

linear

program

If

j

fP

Cg

S

fQ

Dg

then

fP

Cg

S

fQ

Dg

Note

that

Proposition

already

used

new

hidden

variables

to

guarantee

the

definability

of

the

weakest

preconditions

of

any

plain

specification

as

expressed

in

Theorem

We

can

now

prove

Completeness

Theorem

for

non-regular

programs

Proof

The

proof

is

similar

to

that

of

the

Completeness

Theorem

for

regular

programs

It

uses

a

structural

induction

on

S

The

only

new

case

to

consider

is

S

where

B

do

T

end

with

Var

-LRB-

B

-RRB-

Change

-LRB-

S

-RRB-

Pick

up

a

new

variable

Tmp

such

that

Tmp

Var

-LRB-

S

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

Such

a

variable

exists

because

the

expressions

from

the

program

and

from

the

assertion

language

are

finite

terms

By

Theorem

we

know

there

exists

some

assertion

fP

Cg

wp

-LRB-

T

fQ

D

Tmpg

-RRB-

We

have

Var

-LRB-

D

Tmp

-RRB-

Change

-LRB-

S

-RRB-

by

the

choice

of

Tmp

Thus

wp

-LRB-

T

fQ

;D

Tmpg

-RRB-

fP

D

Tmpg

by

the

Extension

Lemma

By

the

induction

hypothesis

we

have

fP

D

Tmpg

T

fQ

D

Tmpg

We

also

have

fP

B

Tmp

;D

Bg

-RRB-

fP

D

Tmpg

We

can

thus

apply

the

Consequence

Rule

This

yields

fP

B

Tmp

;D

Bg

T

fQ

D

Tmpg

Then

we

apply

the

where

Rule

and

we

get

fP

B

Tmp

Dg

where

B

do

T

fQ

Dg

Thanks

to

the

Consequence

Rule

this

rewrites

into

fP

-LSB-

B

Tmp

-RSB-

B

Tmp

Dg

where

B

do

T

fQ

Dg

Finally

applying

the

Elimination

Rule

with

E

B

yields

fP

-LSB-

B

Tmp

-RSB-

Dg

where

B

do

T

fQ

Dg

According

to

Proposition

wp

-LRB-

S

fQ

Dg

-RRB-

fP

-LSB-

B

Tmp

-RSB-

Dg

Thus

wp

-LRB-

S

fQ

Dg

-RRB-

S

fQ

Dg

As

before

we

conclude

the

proof

with

Lemma

the

Consequence

Rule

and

the

Definability

Property

Extending

the

proof

of

completeness

to

non-plain

specifications

We

now

focus

on

general

specifications

where

Var

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

may

be

not

empty

Surprisingly

enough

the

Elimination

Rule

is

sufficient

to

prove

the

completeness

in

this

case

and

there

is

no

need

of

any

other

additional

rule

Theorem

-LRB-

Completeness

linear

programs

-RRB-

Let

S

be

a

linear

program

If

j

fP

Cg

S

fQ

Dg

then

fP

Cg

S

fQ

Dg

Proof

Assume

j

fP

Cg

S

fQ

Dg

As

expressions

of

the

assertion

language

are

finite

terms

there

exists

a

new

hidden

variable

Tmp

such

that

Tmp

Var

-LRB-

S

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

Let

us

show

that

j

fP

Tmp

C

Cg

S

fQ

Tmp

D

Tmpg

Let

-LRB-

oe

c

-RRB-

be

in

-LSB-

-LSB-

fP

Tmp

C

Cg

-RSB-

-RSB-

We

have

in

particular

-LRB-

oe

c

-RRB-

j

fP

Cg

By

hypothesis

we

thus

get

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

j

fQ

Dg

Furthermore

we

have

oe

-LRB-

Tmp

-RRB-

oe

-LRB-

C

-RRB-

c

As

Tmp

Var

-LRB-

S

-RRB-

we

have

-LRB-

Tmp

-RRB-

oe

-LRB-

Tmp

-RRB-

c

and

-LRB-

c

-RRB-

j

fQ

Dg

gives

-LRB-

D

-RRB-

c

We

conclude

that

-LRB-

c

-RRB-

j

fQ

Tmp

D

Tmpg

As

Tmp

Var

-LRB-

S

-RRB-

we

are

in

the

case

of

a

plain

specification

so

the

Completeness

Theorem

applies

and

yields

fP

Tmp

C

Cg

S

fQ

Tmp

D

Tmpg

As

fQ

Tmp

D

Tmpg

-RRB-

fQ

Dg

we

can

apply

the

Consequence

Rule

It

yields

fP

Tmp

C

Cg

S

fQ

Dg

Applying

then

the

Elimination

Rule

with

E

C

yields

fP

C

C

Cg

S

fQ

Dg

Finally

as

fP

Cg

-RRB-

fP

C

C

Cg

we

deduce

by

another

application

of

the

Consequence

Rule

that

fP

Cg

S

fQ

Dg

A

two-phase

proof

methodology

for

L

programs

A

crucial

step

remains

to

be

made

for

a

practical

application

of

our

results

Quoting

Apt

and

Olderog

's

seminal

book

-LSB-

Section

-RSB-

Formal

proofs

are

tedious

to

follow

We

are

not

accustomed

to

following

a

line

of

reasoning

presented

in

small

formal

steps

-LSB-

-RSB-

A

possible

strategy

lies

in

the

facts

that

-LSB-

programs

-RSB-

are

structured

The

proof

rules

follow

the

syntax

of

the

program

so

the

structure

of

the

program

can

be

used

to

structure

the

correctness

proof

We

can

simply

present

the

proof

by

giving

a

program

with

assertions

interleaved

at

appropriate

places

-LSB-

-RSB-

This

type

of

proof

is

more

simple

to

study

and

analyse

than

the

one

we

used

so

far

Introduced

by

Gries

and

Owicki

it

is

called

a

Proof

Outline

The

presentation

of

Apt

and

Olderog

focuses

on

control-parallel

programs

that

is

sequential

processes

composed

with

the

k

operator

We

show

here

that

the

approach

of

Gries

and

Owicki

can

be

adapted

as

well

to

data-parallel

L

programs

giving

birth

to

a

notion

of

data-parallel

annotations

We

present

a

simple

proof

method

that

allows

after

a

first

step

that

slightly

transforms

the

program

to

handle

it

as

an

usual

scalar

program

The

first

step

consists

in

a

labeling

of

the

program

that

expresses

the

depth

of

conditioning

constructs

In

other

words

a

subprogram

labeled

by

i

is

executed

within

the

scope

of

i

where

constructs

This

labeling

follows

the

syntax

of

the

program

labels

are

increased

on

entering

the

body

of

a

new

conditioning

construct

Context

expressions

are

saved

here

in

a

series

of

auxiliary

variables

This

allows

us

to

alleviate

any

restriction

on

context

expressions

of

conditioning

constructs

The

second

step

consists

in

a

proof

method

similar

to

that

used

in

the

scalar

case

interleaving

assertions

and

program

constructs

First

step

syntactic

labeling

In

this

step

we

associate

to

each

subprogram

of

the

considered

program

an

integer

label

that

counts

the

number

of

nesting

where

constructs

Counting

starts

at

for

the

whole

program

Consider

for

instance

the

program

where

X

do

X

X

where

X

do

X

X

end

end

We

want

to

get

the

following

labeling

-LRB-

-RRB-

where

X

do

-LRB-

-RRB-

X

X

-LRB-

-RRB-

where

X

do

-LRB-

-RRB-

X

X

end

end

In

order

to

store

context

expressions

we

distinguish

particular

auxiliary

variables

that

do

not

appear

in

programs

Definition

Variables

fTmpi

j

i

Ng

are

such

that

for

any

program

S

and

for

any

index

i

Tmpi

Var

-LRB-

S

-RRB-

They

are

called

auxiliary

variables

The

conditioning

construct

can

be

seen

as

a

stack

mechanism

entering

a

where

construct

is

the

same

as

pushing

a

value

on

a

context

stack

while

exiting

this

construct

corresponds

to

a

pop

The

label

is

namely

the

height

of

the

stack

At

a

given

point

the

current

context

is

corresponding

to

the

conjunction

of

all

the

stack

's

values

Each

auxiliary

variable

is

used

to

store

one

frame

of

the

context

stack

Thanks

to

this

storage

the

variables

appearing

in

context

expressions

may

be

modified

We

thus

can

alleviate

restrictions

on

context

expressions

of

conditioning

constructs

For

a

subprogram

at

depth

i

the

current

context

is

the

current

value

of

Tmpi

To

get

a

clearer

presentation

of

this

fact

we

add

annotations

of

the

form

-LSB-

Tmpi

B

-RSB-

to

each

where

construct

The

previous

example

is

recast

into

-LRB-

-RRB-

where

X

do

-LSB-

X

-RSB-

-LRB-

-RRB-

X

X

-LRB-

-RRB-

where

X

do

-LSB-

X

-RSB-

-LRB-

-RRB-

X

X

end

end

Labeling

is

thus

made

by

induction

on

the

program

's

syntactic

structure

running

over

the

program

's

syntactic

tree

in

a

depth-first

manner

For

the

entire

program

counting

starts

at

for

the

labels

and

at

for

the

auxiliary

variables

denoting

the

initial

context

the

program

is

executed

in

If

T

is

a

labeled

subprogram

of

a

program

S

we

denote

by

Lab

-LRB-

T

-RRB-

the

label

associated

to

T

Second

step

proof

outline

As

we

use

labeled

programs

and

auxiliary

variables

to

store

contexts

we

know

the

expression

denoting

the

current

context

at

each

place

in

the

program

We

can

then

drop

context

expressions

out

of

assertions

and

proceed

exactly

the

same

way

as

in

the

scalar

case

with

backward

substitutions

The

only

differences

are

that

expressions

in

substitutions

are

conditioned

by

a

conjunction

of

Tmpk

and

that

the

data-parallel

where

construct

adds

a

new

substitution

The

rules

for

inserting

assertions

in

proof

outlines

are

given

on

Figure

Contiguity

between

two

assertions

refers

to

the

use

of

the

Consequence

Rule

If

S

is

a

labeled

subprogram

we

denote

by

S

a

proof

outline

obtained

from

S

by

insertion

of

assertions

Let

us

explain

intuitively

the

need

of

restrictions

of

the

form

i

Tmpj

Var

-LRB-

Q

-RRB-

In

the

rule

for

the

conditioning

construct

we

substitute

Tmpi

with

B

We

thus

need

that

Tmpi

Var

-LRB-

Q

-RRB-

to

respect

the

conditions

of

the

Substitution

Rule

But

as

the

postcondition

-LRB-

Q

-RRB-

is

the

same

for

S

and

for

where

B

do

S

end

we

need

this

condition

to

be

satisfied

for

every

nesting

depth

greater

than

Lab

-LRB-

S

-RRB-

A

simple

example

We

go

back

to

our

previous

example

We

want

to

prove

the

two

following

specifications

i

Tmpj

Var

-LRB-

Q

-RRB-

fQ

-LSB-

i

k

Tmpk?E

X

X

-RSB-

g

-LRB-

i

-RRB-

X

E

fQg

fPg

S

fRg

fRg

T

fQg

Lab

-LRB-

S

-RRB-

Tmpj

Var

-LRB-

R

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

fPg

S

fRg

T

fQg

P

-RRB-

P

fP

g

S

-RRB-

Q

Lab

-LRB-

S

-RRB-

Tmpj

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

-RRB-

fPgfP

g

S

fPg

S

fQg

Lab

-LRB-

S

-RRB-

i

i

Tmpj

Var

-LRB-

Q

-RRB-

fP

-LSB-

B

Tmpi

-RSB-

g

-LRB-

i

-RRB-

where

B

do

-LSB-

Tmpi

B

-RSB-

fPg

S

fQg

end

fQg

fPg

S

fQg

fPg

S

fQg

where

S

is

obtained

from

S

by

deleting

any

assertion

Figure

Rules

for

annotation

f

-LRB-

X

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-RRB-

ju

-LRB-

-RRB-

where

X

do

-LSB-

X

-RSB-

f

-LRB-

-LRB-

X

-RRB-

-LRB-

X

-RRB-

-LRB-

X

-RRB-

-RRB-

ju

-LRB-

-RRB-

X

X

f

-LRB-

X

X

X

-RRB-

ju

-LRB-

-RRB-

where

X

do

-LSB-

X

-RSB-

f

-LRB-

X

-RRB-

ju

-LRB-

-RRB-

X

X

fX

ju

end

fX

ju

end

fX

ju

Figure

The

program

annotated

with

its

proof

outline

fX

ju

Trueg

where

X

do

X

X

where

X

do

X

X

end

end

fX

ju

Trueg

fX

ju

Trueg

where

X

do

X

X

where

X

do

X

X

end

end

fX

ju

Trueg

These

specifications

mean

that

if

the

initial

value

of

X

at

index

u

is

then

its

final

value

after

execution

of

the

program

will

be

at

the

same

index

and

if

it

is

then

the

final

value

will

be

The

proofs

are

simply

done

by

establishing

the

following

proof

outline

the

result

of

the

first

step

has

already

been

given

as

example

in

the

previous

section

First

proof

If

we

denote

by

P

the

first

assertion

of

this

proof

outline

we

only

have

to

prove

that

X

ju

True

-RRB-

P

In

other

words

we

prove

that

X

ju

-RRB-

P

-LSB-

True

-RSB-

The

predicate

P

-LSB-

True

-RSB-

is

equivalent

to

-LRB-

X

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-RRB-

ju

Let

us

consider

an

index

u

such

that

X

ju

Then

the

boolean

expression

-LRB-

X

-RRB-

ju

is

true

As

X

-LRB-

-LRB-

X

X

X

-RRB-

-RRB-

ju

is

also

true

Conditional

expression

-LRB-

X

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-RRB-

ju

thus

simplifies

into

-LRB-

X

X

X

-RRB-

which

in

turn

simplifies

into

X

Assertion

P

-LSB-

True

-RSB-

thus

simplifies

into

X

which

is

true

Second

proof

As

no

simplification

using

the

value

of

X

occurs

in

the

first

proof

outline

the

second

is

almost

the

same

we

just

replace

the

value

by

the

value

Then

if

we

denote

by

P

the

assertion

obtained

by

substituting

by

in

P

we

just

have

to

check

that

X

ju

-RRB-

P

-LSB-

True

-RSB-

Let

us

consider

an

index

u

such

that

X

ju

Then

the

boolean

expression

-LRB-

X

-RRB-

ju

is

true

But

this

time

as

X

-LRB-

-LRB-

X

X

X

-RRB-

-RRB-

ju

is

false

Conditional

expression

-LRB-

X

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-RRB-

ju

thus

simplifies

into

-LRB-

X

X

X

-RRB-

ju

which

in

turn

simplifies

into

X

Assertion

P

-LSB-

True

-RSB-

thus

simplifies

into

X

which

is

true

Conclusion

and

related

works

We

have

defined

a

proof

system

for

a

small

data-parallel

language

called

L

which

is

designed

to

be

a

common

kernel

of

real

data-parallel

languages

Our

proof

system

is

charaterized

by

a

two-component

assertion

language

where

the

current

extent

of

parallelism

is

explicitly

described

We

have

studied

its

expressivity

and

we

have

established

completeness

of

our

proof

system

We

have

shown

our

proof

system

is

well

suited

for

a

two-phase

proof

methodology

the

first

step

is

a

syntactic

labeling

related

to

the

extent

of

parallelism

and

the

second

step

is

a

proof

similar

to

the

scalar

case

Our

proof

method

for

data-parallel

programs

inherits

both

from

proof

methods

for

parallel

programs

and

proof

methods

for

scalar

programs

a

two-phase

proof

methodology

from

the

former

and

a

backward

methodology

derived

from

a

preconditions

calculus

from

the

latter

As

they

can

provide

an

a

priori

description

of

the

extent

of

parallelism

two-component

assertions

yield

a

useful

intuitive

support

to

design

proofs

However

several

drawbacks

arise

with

this

structured

approach

The

assertion

language

suffers

from

a

restricted

expressive

power

as

it

is

not

closed

under

classical

propositional

operations

The

Definability

Property

does

not

hold

for

weakest

liberal

preconditions

To

tackle

the

Definibility

Property

problem

it

is

possible

to

use

a

different

approach

In

this

new

approach

the

assertion

language

manipulates

both

program

variables

and

a

distinguished

context

variable

describing

the

extent

of

parallelism

within

vector

predicates

Assertions

are

usual

predicates

and

constraints

on

context

are

directly

handled

by

assertions

By

translating

the

conditional

constructs

into

unconditioned

assignment

-LRB-

introduced

in

-LSB-

-RSB-

-RRB-

to

a

distinguished

context

variable

-LRB-

called

to

follow

Narayana

and

Clint

's

notation

-LSB-

-RSB-

-RRB-

it

is

possible

to

avoid

the

complex

manipulations

of

the

extent

of

parallelism

induced

by

the

where

construct

This

technique

leads

to

a

very

simple

sequential-like

proof

system

-LSB-

-RSB-

The

resulting

proof

system

is

well-suited

for

-LRB-

semi

-RRB-

automatic

verification

of

programs

following

the

method

of

verification

conditions

proposed

by

Gordon

-LSB-

-RSB-

In

Section

we

have

presented

an

extended

notion

of

assertion

where

an

additional

variable

Aux

is

used

to

denote

context

We

have

shown

that

wlp

-LRB-

S

fQ

Dg

-RRB-

can

always

be

defined

by

such

an

assertion

Moreover

it

is

shown

in

-LSB-

-RSB-

that

the

whole

approach

can

be

reworked

out

with

this

new

notion

of

assertion

yielding

a

simpler

proof

of

completeness

In

fact

this

result

illustrates

a

well-known

drawback

of

axiomatic

semantics

this

kind

of

semantics

is

not

well

suited

to

denote

control

flow

properties

of

programs

For

instance

Owicki

and

Gries

introduce

auxiliary

variables

to

catch

control

flow

information

in

the

proof

of

parallel

programs

-LSB-

-RSB-

This

can

not

be

avoided

to

prove

properties

like

mutual

exclusion

In

our

work

the

proof

systems

for

data-parallel

languages

are

quite

similar

to

those

used

in

the

case

of

scalar

languages

they

have

the

same

structure

and

respect

some

crucial

properties

such

as

compositionality

Yet

the

parallel

world

induces

additional

complexity

introducing

auxiliary

variables

is

necessary

to

catch

information

about

the

control

flow

In

the

data-parallel

case

the

control

flow

is

expressed

by

the

evolution

of

the

extent

of

parallelism

It

is

possible

to

extend

this

work

to

other

data-parallel

languages

An

extension

of

the

L

language

is

described

in

-LSB-

-RSB-

It

defines

a

data-parallel

escape

construct

This

new

construct

extends

data-parallel

break

and

continue

constructs

found

in

real

languages

like

HyperC

-LSB-

-RSB-

or

MPL

-LSB-

-RSB-

The

natural

semantics

handles

the

activity

by

a

multi-context

mechanism

In

-LSB-

-RSB-

the

two-component

assertion

language

is

extended

to

handle

multi-context

which

leads

to

a

similar

proof

system

for

L-programs

with

escape

constructs

It

would

also

be

possible

to

extend

this

work

to

data-parallel

languages

that

take

into

account

notions

of

alignment

and

of

mapping

of

the

data

We

are

currently

working

in

this

direction

Acknowledgments

We

wish

to

thank

Joaquim

Gabarr?o

and

Alan

Stewart

for

their

useful

comments

on

this

work

References

-LSB-

-RSB-

K.R.

Apt

and

E.-R

Olderog

Verification

of

Sequential

and

Concurrent

Programs

Text

and

Monographs

in

Computer

Science

Springer

Verlag

-LSB-

-RSB-

L.

Boug?e

and

G.

Utard

Escape

constructs

in

data-parallel

languages

semantics

and

proof

system

Technical

Report

-LCB-

LIP

ENS

Lyon

-LSB-

-RSB-

L.

Boug?e

Y.

Le

Guyadec

G.

Utard

and

B.

Virot

A

proof

system

for

a

simple

data-parallel

programming

language

In

C.

Girault

editor

Proc

of

IFIP

WG

Applications

in

Parallel

and

Distributed

Computing

Caracas

Venezuela

April

North-Holland

-LSB-

-RSB-

L.

Boug?e

and

J.-L

Levaire

Control

structures

for

data-parallel

SIMD

languages

semantics

and

implementation

Future

Generation

Computer

Systems

-LCB-

-LSB-

-RSB-

D.

Cachera

Two

completeness

results

about

a

proof

system

for

simple

data-parallel

language

Technical

Report

-LCB-

LIP

ENS

Lyon

-LSB-

-RSB-

D.

Cachera

and

G.

Utard

Proving

data-parallel

programs

a

unifying

approach

Parallel

Processing

Letters

to

appear

-LSB-

-RSB-

M.

Clint

and

K.T.

Narayana

On

the

completeness

of

a

proof

system

for

a

synchronous

parallel

programming

langage

In

Third

Conf

Found

Softw

Techn

and

Theor

Comp

Science

Bangalore

India

December

-LSB-

-RSB-

J.

Gabarr?o

and

R.

Gavald?a

An

approach

to

correctness

of

data

parallel

algorithms

Journal

of

Parallel

and

Distributed

Computing

-LRB-

-RRB-

-LCB-

August

-LSB-

-RSB-

M.J.C.

Gordon

Programming

Language

Theory

and

its

Implementation

Prentice

Hall

International

-LSB-

-RSB-

Y.

Le

Guyadec

and

B.

Virot

Sequential-like

proofs

of

data-parallel

programs

Parallel

Processing

Letters

to

appear

-LSB-

-RSB-

W.D.

Hillis

and

G.L.

Steele

Jr.

Data

parallel

algorithms

Comm

of

the

ACM

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

C.A.R.

Hoare

An

axiomatic

basis

for

computer

programming

Comm

of

the

ACM

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

MasPar

Computer

Corporation

Sunnyvale

CA

Maspar

Parallel

Application

Language

Reference

Manual

-LSB-

-RSB-

S.

Owicki

and

D.

Gries

Verifying

Properties

of

Parallel

Programs

An

Axiomatic

Approach

Comm

of

the

ACM

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

N.

Paris

HyperC

specification

document

Technical

Report

-LCB-

HyperParallel

Technologies

-LSB-

-RSB-

R.

H.

Perrot

A

language

for

array

and

vector

processors

ACM

Transactions

on

Programming

Languages

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

A.

Stewart

Reasoning

about

data-parallel

array

assignment

Journal

of

Parallel

and

Distributed

Computing

-LCB-

-LSB-

-RSB-

A.

Stewart

An

axiomatic

treatment

of

SIMD

assignment

BIT

-LCB-

-LSB-

-RSB-

Thinking

Machine

Corporation

Cambridge

MA

C

programming

guide

-LSB-

-RSB-

G.

Utard

Semantics

of

data-parallel

languages

Applications

to

validation

and

compilation

PhD

thesis

Ecole

Normale

Sup?erieure

de

Lyon

specifying and verifying and reasoning about programs