Laboratoire

de

l'Informatique

du

Parall?lisme

Ecole

Normale

Sup?rieure

de

Lyon

Unit

de

recherche

associ?e

au

CNRS

n

Proofs

by

annotations

for

a

simple

data-parallel

language

Luc

Boug?e

David

Cachera

March

Research

Report

No

Ecole

Normale

Sup?rieure

de

Lyon

Adresse

lectronique

lip@lip.ens-lyon.fr

T?l?phone

-LRB-

-RRB-

T?l?copieur

-LRB-

-RRB-

All?e

d'Italie

Lyon

Cedex

France

Proofs

by

annotations

for

a

simple

data-parallel

language

Luc

Boug?e

David

Cachera

March

Abstract

We

present

a

proof

outline

generation

system

for

a

simple

data-parallel

kernel

language

called

L

We

show

that

proof

outlines

are

equivalent

to

the

sound

and

complete

Hoare

logic

defined

for

L

in

previous

papers

Proof

outlines

for

L

are

very

similar

to

those

for

usual

scalar-like

languages

In

particular

they

can

be

mechanically

generated

backwards

from

the

final

post-assertion

of

the

program

They

appear

thus

as

a

valuable

basis

to

implement

a

validation

assistance

tool

for

data-parallel

programming

R?esum?e

Nous

pr?esentons

un

syst?eme

pour

la

g?en?eration

de

sch?emas

de

preuve

par

annotations

proof

outlines

pour

un

petit

noyau

de

langage

a

parall?elisme

de

donn?ees

appel?e

L.

Nous

montrons

que

les

sch?emas

de

preuve

par

annotations

sont

equivalents

a

la

logique

de

Hoare

pour

le

langage

L

d?efinie

dans

les

articles

pr?ec?edents

La

manipulation

des

annotations

des

programmes

L

est

tr?es

semblable

a

celle

des

langages

scalaires

habituels

de

type

Pascal

En

particulier

les

annotations

peuvent

etre

g?en?er?ees

automatiquement

a

partir

de

la

post-condition

du

programme

Cette

m?ethode

constitue

donc

une

base

formelle

int?eressante

pour

l'impl

ementation

d'outils

d'aide

a

la

programmation

dataparall?ele

Mots-cl

es

Programmation

parall?ele

sp?ecification

et

validation

de

programmes

s?emantique

des

langages

de

programmation

langages

data-parall

eles

syst?eme

de

preuve

logique

de

Hoare

plus

faibles

pr?econditions

Proofs

by

annotations

for

a

simple

data-parallel

language

Luc

Boug?e?z

David

Cachera

April

Abstract

We

present

a

proof

outline

generation

system

for

a

simple

data-parallel

kernel

language

called

L

We

show

that

proof

outlines

are

equivalent

to

the

sound

and

complete

Hoare

logic

defined

for

L

in

previous

papers

Proof

outlines

for

L

are

very

similar

to

those

for

usual

scalarlike

languages

In

particular

they

can

be

mechanically

generated

backwards

from

the

final

post-assertion

of

the

program

They

appear

thus

as

a

valuable

basis

to

implement

a

validation

assistance

tool

for

data-parallel

programming

Contents

A

sound

and

complete

proof

system

for

a

small

data-parallel

language

The

L

language

Denotational

semantics

of

linear

L-programs

The

proof

system

Assertion

language

Proof

system

Weakest

preconditions

calculus

A

simple

two-pass

proof

method

First

step

syntactic

labeling

Second

step

proof

outline

A

small

example

Equivalence

of

Proof

Outlines

and

Discussion

LIP

ENS

Lyon

All?ee

d'Italie

F

-LCB-

Lyon

C?edex

France

zAuthors

contact

Luc

Boug?e

-LRB-

Luc.Bouge@lip.ens-lyon.fr

-RRB-

This

work

has

been

partly

supported

by

the

French

CNRS

Coordinated

Research

Program

on

Parallelism

Networks

and

Systems

PRS

Introduction

Data-parallel

languages

have

recently

emerged

as

a

major

tool

for

large

scale

parallel

programming

An

impressive

effort

is

currently

being

put

on

developing

efficient

compilers

for

High

Performance

Fortran

-LRB-

HPF

-RRB-

A

data-parallel

extension

of

C

primarily

influenced

by

Thinking

Machine

's

C

is

currently

under

standardization

Our

goal

is

to

provide

all

these

new

developments

with

the

necessary

semantic

bases

In

previous

papers

we

have

defined

a

simple

but

representative

data-parallel

kernel

language

-LSB-

-RSB-

and

we

have

described

a

natural

semantics

for

it

We

have

designed

a

sound

proof

system

based

on

an

adaptation

of

Hoare

logic

-LSB-

-RSB-

We

have

shown

it

gives

rise

to

a

Weakest

Precondition

calculus

-LSB-

-RSB-

which

can

be

used

to

prove

its

completeness

for

loop-free

programs

-LSB-

-RSB-

Yet

a

crucial

step

remains

to

be

done

for

a

practical

application

of

these

results

Quoting

Apt

and

Olderog

's

seminal

book

-LSB-

Section

-RSB-

Formal

proofs

are

tedious

to

follow

We

are

not

accustomed

to

following

a

line

of

reasoning

presented

in

small

formal

steps

-LSB-

-RSB-

A

possible

strategy

lies

in

the

facts

that

-LSB-

programs

-RSB-

are

structured

The

proof

rules

follow

the

syntax

of

the

program

so

the

structure

of

the

program

can

be

used

to

structure

the

correctness

proof

We

can

simply

present

the

proof

by

giving

a

program

with

assertions

interleaved

at

appropriate

places

-LSB-

-RSB-

This

type

of

proof

is

more

simple

to

study

and

analyse

than

the

one

we

used

so

far

Introduced

by

Gries

and

Owicki

it

is

called

a

Proof

Outline

The

presentation

of

Apt

and

Olderog

focuses

on

control-parallel

programs

that

is

sequential

processes

composed

with

the

k

operator

In

this

paper

we

show

that

the

approach

of

Gries

and

Owicki

can

be

adapted

as

well

to

data-parallel

L

programs

giving

birth

to

a

notion

of

data-parallel

annotations

For

the

sake

of

completeness

we

briefly

recall

in

Section

the

definition

of

the

L

language

its

logical

two-part

assertions

the

associated

Hoare

logic

and

the

Weakest

Precondition

calculus

Section

describes

the

formation

rules

for

the

Data-Parallel

Proof

Outlines

In

contrast

with

the

usual

scalar

case

they

are

generated

in

two

passes

Pass

labels

program

instruction

with

their

respective

extent

of

parallelism

-LRB-

to

be

called

activity

context

below

-RRB-

it

works

top-down

Pass

generates

the

intermediate

assertions

starting

from

the

final

post-condition

it

works

bottom-up

Section

describes

an

example

Section

proves

our

main

result

which

is

the

equivalence

between

this

notion

of

Data-Parallel

Proof

Outline

and

the

Hoare

logic

for

L.

A

sound

and

complete

proof

system

for

a

small

data-parallel

language

An

extensive

presentation

of

the

L

language

can

be

found

in

-LSB-

-RSB-

For

the

sake

of

completeness

we

briefly

recall

its

denotational

semantics

as

described

in

-LSB-

-RSB-

The

L

language

In

the

data-parallel

programming

model

the

basic

objects

are

arrays

with

parallel

access

Two

kinds

of

actions

can

be

applied

to

these

objects

component-wise

operations

or

global

rearrangements

A

program

is

a

sequential

composition

of

such

actions

Each

action

is

associated

with

the

set

of

array

indices

at

which

it

is

applied

An

index

at

which

an

action

is

applied

is

said

to

be

active

Other

indices

are

said

to

be

idle

The

set

of

active

indices

is

called

the

activity

context

or

the

extent

of

parallelism

It

can

be

seen

as

a

boolean

array

where

true

denotes

activity

and

false

idleness

The

L

language

is

designed

as

a

common

kernel

of

data-parallel

languages

like

C

-LSB-

-RSB-

HyperC

-LSB-

-RSB-

or

MPL

-LSB-

-RSB-

We

do

not

consider

the

scalar

part

of

these

languages

mainly

imported

from

the

C

language

For

the

sake

of

simplicity

we

consider

a

unique

geometry

of

arrays

arrays

of

dimension

one

also

called

vectors

Then

all

the

variables

of

L

are

parallel

and

all

the

objects

are

vectors

of

scalars

with

one

component

at

each

index

As

a

convention

the

parallel

objects

are

denoted

with

uppercase

letters

The

component

of

parallel

object

X

located

at

index

u

is

denoted

by

X

ju

The

legal

expressions

are

usual

pure

expressions

i.e.

expressions

without

side

effects

The

value

of

a

pure

expression

at

index

u

only

depends

on

the

values

of

the

variables

components

at

index

u

The

expressions

are

evaluated

by

applying

operators

component-wise

to

parallel

values

We

do

not

detail

the

syntax

and

semantics

of

such

expressions

any

further

We

introduce

a

special

vector

constant

called

This

The

value

of

its

component

at

each

index

u

is

the

value

u

itself

Thisju

u.

Note

that

This

is

a

pure

expression

and

that

all

constructs

defined

here

are

deterministic

The

L-instructions

are

the

following

Assignment

X

E

At

each

active

index

u

component

X

ju

is

updated

with

the

local

value

of

pure

expression

E.

Communication

get

X

from

A

into

Y

At

each

active

index

u

pure

expression

A

is

evaluated

to

an

index

v

then

component

Y

ju

is

updated

with

the

value

of

component

X

jv

We

always

assume

that

v

is

a

valid

index

Sequencing

S

T

On

the

termination

of

the

last

action

of

S

the

execution

of

the

actions

of

T

starts

Conditioning

where

B

do

S

end

The

active

indices

where

pure

boolean

expression

B

evaluates

to

false

become

idle

during

the

execution

of

S

The

other

ones

remain

active

The

initial

activity

context

is

restored

on

the

termination

of

S.

Iteration

loop

B

do

S

The

actions

of

S

are

repeatedly

executed

with

the

current

extent

of

parallelism

until

pure

boolean

expression

B

evaluates

to

false

at

each

currently

active

index

The

current

extent

of

parallelism

is

not

modified

In

the

following

we

restrict

ourselves

to

linear

programs

i.e.

programs

without

loops

Denotational

semantics

of

linear

L-programs

We

recall

the

semantics

of

L

defined

in

-LSB-

-RSB-

in

the

style

of

denotational

semantics

by

induction

on

the

syntax

of

L

An

environment

oe

is

a

function

from

identifiers

to

vector

values

The

set

of

environments

is

denoted

by

Env

For

convenience

we

extend

the

environment

functions

to

the

parallel

expressions

oe

-LRB-

E

-RRB-

denotes

the

value

obtained

by

evaluating

parallel

expression

E

in

environment

oe

We

do

not

detail

the

internals

of

expressions

any

further

Note

that

oe

-LRB-

This

-RRB-

ju

u

by

definition

Definition

-LRB-

Pure

expression

-RRB-

A

parallel

expression

E

is

pure

if

for

any

index

u

and

any

environments

oe

and

-LRB-

oe

-LRB-

X

-RRB-

ju

-LRB-

X

-RRB-

ju

-RRB-

-RRB-

-LRB-

oe

-LRB-

E

-RRB-

ju

-LRB-

E

-RRB-

ju

-RRB-

Let

oe

be

an

environment

X

a

vector

variable

and

V

a

vector

value

We

denote

by

oe

-LSB-

X

V

-RSB-

the

new

environment

where

-LRB-

X

-RRB-

V

and

-LRB-

Y

-RRB-

oe

-LRB-

Y

-RRB-

for

all

Y

X

A

context

c

is

a

boolean

vector

It

specifies

the

activity

at

each

index

The

set

of

contexts

is

denoted

by

Ctx

We

distinguish

a

particular

context

denoted

by

True

where

all

components

have

value

true

For

convenience

we

define

the

activity

predicate

Activec

Activec

-LRB-

u

-RRB-

cju

A

state

is

a

pair

made

of

an

environment

and

a

context

The

set

of

states

is

denoted

by

State

State

-LRB-

Env

Ctx

-RRB-

-LSB-

f?g

where

denotes

the

undefined

state

The

semantics

-LSB-

-LSB-

S

-RSB-

-RSB-

of

a

program

S

is

a

strict

function

from

State

to

State

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

-RRB-

and

-LSB-

-LSB-

S

-RSB-

-RSB-

is

extended

to

sets

of

states

as

usual

Assignment

At

each

active

index

the

component

of

the

parallel

variable

is

updated

with

the

new

value

-LSB-

-LSB-

X

E

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

with

oe

-LSB-

X

V

-RSB-

where

V

ju

oe

-LRB-

E

-RRB-

ju

if

Activec

-LRB-

u

-RRB-

and

V

ju

oe

-LRB-

X

-RRB-

ju

otherwise

The

activity

context

is

preserved

Communication

It

acts

very

much

as

an

assignment

except

that

the

assigned

value

is

the

value

of

another

component

-LSB-

-LSB-

get

X

from

A

into

Y

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

with

oe

-LSB-

Y

V

-RSB-

where

V

ju

oe

-LRB-

X

-RRB-

joe

-LRB-

A

-RRB-

ju

if

Activec

-LRB-

u

-RRB-

and

V

ju

oe

-LRB-

Y

-RRB-

ju

otherwise

Sequencing

Sequential

composition

is

functional

composition

-LSB-

-LSB-

S

T

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LSB-

-LSB-

T

-RSB-

-RSB-

-LRB-

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-RRB-

Conditioning

The

denotation

of

a

where

construct

is

the

denotation

of

its

body

with

a

new

context

The

new

context

is

the

conjunction

of

the

previous

one

with

the

value

of

the

pure

conditioning

expression

B.

-LSB-

-LSB-

where

B

do

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

with

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

oe

-LRB-

B

-RRB-

-RRB-

-LRB-

-RRB-

The

proof

system

Assertion

language

We

define

an

assertion

language

for

the

correctness

of

L

programs

in

the

lines

of

-LSB-

-RSB-

Such

a

specification

is

denoted

by

a

formula

fPg

S

fQg

where

S

is

the

program

text

and

P

and

Q

are

two

logical

assertions

on

the

variables

of

S

This

formula

means

that

if

precondition

P

is

satisfied

in

the

initial

state

of

program

S

and

if

S

terminates

then

postcondition

Q

is

satisfied

in

the

final

state

As

we

consider

here

only

linear

programs

S

will

always

terminate

A

proof

system

gives

a

formal

method

to

derive

such

specification

formulae

by

syntax-directed

induction

on

programs

We

recall

below

the

proof

system

described

in

-LSB-

-RSB-

As

in

the

usual

sequential

case

the

assertion

language

must

be

powerful

enough

to

express

properties

on

variable

values

Moreover

it

has

to

handle

the

evolution

of

the

activity

context

along

the

execution

An

assertion

shall

thus

be

broken

up

into

two

parts

fP

Cg

where

P

is

a

predicate

on

program

variables

and

C

a

pure

boolean

vector

expression

The

intuition

is

that

the

current

activity

context

is

exactly

the

value

of

C

in

the

current

state

as

expressed

in

the

definition

below

Definition

-LRB-

Satisfiability

-RRB-

Let

-LRB-

oe

c

-RRB-

be

a

state

and

fP

Cg

an

assertion

We

say

that

-LRB-

oe

c

-RRB-

satisfies

the

assertion

fP

Cg

denoted

by

-LRB-

oe

c

-RRB-

j

fP

Cg

if

oe

j

P

and

oe

-LRB-

C

-RRB-

c

The

set

of

states

satisfying

fP

Cg

is

denoted

by

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

When

no

confusion

may

arise

we

identify

fP

Cg

and

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

Definition

-LRB-

Assertion

implication

-RRB-

Let

fP

Cg

and

fQ

Dg

be

two

assertions

We

say

that

fP

Cg

implies

fQ

Dg

and

write

fP

Cg

-RRB-

fQ

Dg

iff

-LRB-

P

-RRB-

Q

-RRB-

and

-LRB-

P

-RRB-

-LRB-

Cju

Dju

-RRB-

Our

assertion

language

manipulates

two

kinds

of

variables

scalar

variables

and

vector

variables

As

a

convention

scalar

variables

are

denoted

with

a

lowercase

initial

letter

and

vector

ones

with

an

uppercase

one

We

have

a

similar

distinction

on

arithmetic

and

logical

expressions

As

usual

scalar

-LRB-

resp

vector

-RRB-

expressions

are

recursively

defined

with

usual

arithmetic

and

logical

connectives

Basic

scalar

-LRB-

resp

vector

-RRB-

expressions

are

scalar

-LRB-

resp.vector

-RRB-

variables

and

constants

Vector

expression

can

be

subscripted

If

the

subscript

expression

is

a

scalar

expression

then

we

have

a

scalar

expression

Otherwise

if

the

subscript

expression

is

a

vector

expression

then

we

have

another

vector

expression

The

meaning

of

a

vector

expression

is

obtained

by

component-wise

evaluation

We

introduce

a

scalar

conditional

expression

with

a

C-like

notation

c?e

f

Its

value

is

the

value

of

expression

e

if

c

is

true

and

f

otherwise

Similarly

the

value

of

a

conditional

vector

expression

denoted

by

C?E

F

is

a

vector

whose

component

at

index

u

is

Eju

if

Cju

is

true

and

F

ju

otherwise

Predicates

are

usual

first

order

formulae

They

are

recursively

defined

on

boolean

scalar

expressions

with

logical

connectives

and

existential

and

universal

quantifiers

on

scalar

variables

Note

that

we

do

not

consider

quantification

on

vector

variables

We

introduce

a

substitution

mechanism

for

vector

variables

Let

P

be

a

predicate

or

any

vector

expression

X

a

vector

variable

and

E

a

vector

expression

P

-LSB-

E

X

-RSB-

denotes

the

predicate

or

expression

obtained

by

substituting

all

the

occurrences

of

X

in

P

with

E.

Note

that

all

vector

variables

are

free

by

the

definition

of

our

assertion

language

The

usual

Substitution

Lemma

-LSB-

-RSB-

extends

to

this

new

setting

Lemma

-LRB-

Substitution

lemma

-RRB-

For

every

predicate

on

vector

variables

P

vector

expression

E

and

environment

oe

oe

j

P

-LSB-

E

X

-RSB-

iff

oe

-LSB-

X

oe

-LRB-

E

-RRB-

-RSB-

j

P

We

can

define

the

validity

of

a

specification

of

a

L

program

with

respect

to

its

denotational

semantics

Definition

-LRB-

Specification

validity

-RRB-

Let

S

be

a

L

program

fP

Cg

and

fQ

Dg

two

assertions

We

say

that

specification

fP

Cg

S

fQ

Dg

is

valid

denoted

by

j

fP

Cg

S

fQ

Dg

if

for

all

states

-LRB-

oe

c

-RRB-

-LRB-

-LRB-

oe

c

-RRB-

j

fP

Cg

-RRB-

-RRB-

-LRB-

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

j

fQ

Dg

-RRB-

Proof

system

We

recall

on

Figure

the

proof

system

defined

in

-LSB-

-RSB-

This

system

is

a

restricted

proof

system

in

the

sense

that

a

number

of

rules

only

manipulates

a

certain

kind

of

specification

formulae

precisely

these

formulae

fP

Cg

S

fQ

Dg

such

that

the

boolean

vector

expression

D

describing

the

final

activity

context

may

not

be

modified

by

the

program

S

More

formally

using

the

notations

of

-LSB-

-RSB-

we

define

the

following

sets

of

variables

Assignment

Rule

X

Var

-LRB-

D

-RRB-

fQ

-LSB-

-LRB-

D?E

X

-RRB-

X

-RSB-

Dg

X

E

fQ

Dg

Communication

Rule

Y

Var

-LRB-

D

-RRB-

fQ

-LSB-

-LRB-

D?X

jA

Y

-RRB-

Y

-RSB-

Dg

get

X

from

A

into

Y

fQ

Dg

Sequencing

Rule

fP

Cg

S

fR

Eg

fR

Eg

T

fQ

Dg

fP

Cg

S

T

fQ

Dg

Conditioning

Rule

fP

C

Bg

S

fQ

Dg

Change

-LRB-

S

-RRB-

Var

-LRB-

C

-RRB-

fP

Cg

where

B

do

S

end

fQ

Cg

Consequence

Rule

fP

Cg

-RRB-

fP

fP

S

-RRB-

fQ

Dg

fP

Cg

S

fQ

Dg

Substitution

Rule

fP

Cg

S

fQ

Dg

Tmp

V

ar

-LRB-

S

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

fP

-LSB-

E

Tmp

-RSB-

C

-LSB-

E

Tmp

-RSB-

g

S

fQ

Dg

Figure

The

proof

system

for

linear-L

Definition

Let

E

be

an

expression

Var

-LRB-

E

-RRB-

is

the

set

of

all

variables

appearing

in

E.

Expression

E

may

only

depend

on

the

values

of

these

variables

We

extend

this

definition

to

a

L-program

S

Var

-LRB-

S

-RRB-

is

the

set

of

all

variables

appearing

in

S.

Let

S

be

a

L-program

Change

-LRB-

S

-RRB-

is

the

set

of

program

variables

which

appear

on

the

lefthand

side

of

an

assignment

statement

or

as

the

target

of

a

communication

statement

Only

these

variables

may

be

modified

by

executing

S

A

sufficient

condition

to

guarantee

the

absence

of

interference

between

S

and

D

is

thus

Change

-LRB-

S

-RRB-

Var

-LRB-

D

-RRB-

The

proof

system

contains

a

particular

rule

called

the

Substitution

Rule

This

rule

is

used

to

handle

conditioning

constructs

where

the

variables

appearing

in

the

conditioning

expression

may

be

modified

by

the

body

of

the

construct

More

formally

if

we

consider

the

program

where

B

do

S

end

with

Var

-LRB-

B

-RRB-

Change

-LRB-

S

-RRB-

the

value

of

B

on

exiting

S

may

be

different

from

its

value

on

entering

this

body

This

fact

leads

us

to

introduce

hidden

variables

i.e.

variables

that

do

not

appear

in

programs

context

expressions

or

postconditions

These

variables

are

used

to

store

temporarily

the

initial

value

of

conditioning

expressions

and

as

they

do

not

appear

in

programs

these

value

remains

unchanged

during

the

execution

of

the

body

As

hidden

variables

are

in

a

way

new

variables

there

is

no

reason

why

they

should

appear

in

specifications

The

role

of

the

Substitution

Rule

is

namely

to

get

rid

of

them

eventually

If

a

specification

formula

fP

Cg

S

fQ

Dg

is

derivable

in

the

proof

system

then

we

write

fP

Cg

S

fQ

Dg

Theorem

-LRB-

Soundness

of

-LSB-

-RSB-

-RRB-

The

proof

system

is

sound

If

fP

Cg

S

fQ

Dg

then

j

fP

Cg

S

fQ

Dg

Construct

Conditions

Weakest

Precondition

Assignment

X

V

ar

-LRB-

D

-RRB-

WP

-LRB-

X

E

fQ

Dg

-RRB-

fQ

-LSB-

-LRB-

D?E

X

-RRB-

X

-RSB-

Dg

Communication

Y

V

ar

-LRB-

D

-RRB-

WP

-LRB-

get

X

from

A

into

Y

fQ

Dg

-RRB-

fQ

-LSB-

-LRB-

D?X

jA

Y

-RRB-

Y

-RSB-

Dg

Sequencing

WP

-LRB-

fQ

Dg

-RRB-

WP

-LRB-

WP

-LRB-

fQ

Dg

-RRB-

-RRB-

Conditioning

-LRB-

-RRB-

V

ar

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

V

ar

-LRB-

B

-RRB-

Change

-LRB-

S

-RRB-

WP

-LRB-

S

fQ

D

Bg

-RRB-

fP

Cg

WP

-LRB-

where

B

do

S

end

fQ

Dg

-RRB-

fP

Dg

Conditioning

-LRB-

-RRB-

V

ar

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

Tmp

Var

-LRB-

S

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

WP

-LRB-

S

fQ

D

Tmpg

-RRB-

fP

Cg

WP

-LRB-

where

B

do

S

end

fQ

Dg

-RRB-

fP

-LSB-

B

Tmp

-RSB-

Dg

Figure

Definability

properties

of

weakest

preconditions

for

linear

L-programs

Weakest

preconditions

calculus

A

weakest

preconditions

calculus

has

been

presented

in

-LSB-

-RSB-

and

has

been

used

to

prove

the

completeness

of

the

proof

system

in

-LSB-

-RSB-

We

briefly

recall

here

some

useful

definitions

and

results

Definition

-LRB-

Weakest

preconditions

-RRB-

Let

E

be

a

subset

of

State

S

a

linear

L-program

We

define

the

weakest

preconditions

as

WP

-LRB-

S

E

-RRB-

fs

State

j

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

s

-RRB-

Eg

Lemma

-LRB-

Consequence

Lemma

-RRB-

j

fP

Cg

S

fQ

Dg

iff

-LSB-

-LSB-

fP

Cg

-RSB-

-RSB-

WP

-LRB-

S

fQ

Dg

-RRB-

The

weakest

preconditions

defined

above

are

sets

of

states

As

such

they

can

not

be

explicitly

manipulated

in

the

proof

system

We

have

to

prove

that

these

particular

sets

of

states

can

actually

be

described

by

suitable

assertions

This

is

the

definability

problem

Definability

results

have

been

proved

in

-LSB-

-RSB-

They

are

listed

up

on

Figure

We

add

here

a

general

result

on

WP

that

will

help

us

in

the

next

section

if

we

use

the

Definability

Properties

to

construct

the

assertion

defining

a

weakest

precondition

the

variables

appearing

in

this

assertion

already

appear

in

the

program

the

postcondition

or

the

context

expression

In

other

words

and

more

intuitively

computing

a

WP

does

n't

generate

new

variables

This

fact

is

expressed

in

the

following

proposition

Proposition

Let

Z

be

a

variable

S

a

program

Q

an

assertion

and

D

a

boolean

expression

such

that

Var

-LRB-

D

-RRB-

Change

-LRB-

S

-RRB-

If

Z

Var

-LRB-

S

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

then

there

exists

some

assertion

fP

Cg

such

that

WP

-LRB-

S

fQ

Dg

-RRB-

fP

Cg

and

Z

Var

-LRB-

P

-RRB-

-LSB-

Var

-LRB-

C

-RRB-

Proof

This

result

is

a

consequence

of

the

definability

properties

and

is

established

by

induction

on

the

structure

of

S.

ffl

If

S

X

E

WP

-LRB-

S

fQ

Dg

-RRB-

fQ

-LSB-

-LRB-

D?E

X

-RRB-

X

-RSB-

Dg

As

Z

fXg

-LSB-

Var

-LRB-

E

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

Z

does

n't

appear

in

the

weakest

precondition

ffl

The

case

of

communication

is

similar

to

that

of

assignment

ffl

If

S

then

by

induction

hypothesis

Z

does

n't

appear

in

the

assertion

WP

-LRB-

fQ

Dg

-RRB-

As

WP

-LRB-

fQ

Dg

-RRB-

is

used

as

postcondition

for

a

second

use

of

the

induction

hypothesis

for

shows

that

Z

does

n't

appear

in

the

assertion

WP

-LRB-

S

fQ

Dg

-RRB-

ffl

If

S

where

B

do

T

end

we

have

two

cases

to

consider

-LCB-

If

Var

-LRB-

B

-RRB-

Change

-LRB-

S

-RRB-

we

apply

the

first

definability

property

for

conditioning

Let

us

assume

that

WP

-LRB-

T

fQ

D

Bg

-RRB-

fP

Cg

We

have

Z

Var

-LRB-

S

-RRB-

so

Z

Var

-LRB-

B

-RRB-

The

induction

hypothesis

thus

yields

Z

Var

-LRB-

P

-RRB-

so

Z

does

n't

appear

in

fP

Dg

which

is

the

precondition

for

S.

-LCB-

If

Var

-LRB-

B

-RRB-

Change

-LRB-

S

-RRB-

we

apply

the

second

definability

property

for

conditioning

Let

Tmp

be

a

variable

not

in

Var

-LRB-

T

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

D

-RRB-

and

let

fP

Cg

be

WP

-LRB-

T

fQ

D

Tmpg

-RRB-

If

Z

Tmp

then

as

WP

-LRB-

S

fQ

Dg

-RRB-

fP

-LSB-

B

Tmp

-RSB-

Dg

Z

is

substituted

by

B

in

the

weakest

precondition

so

it

does

n't

appear

in

it

any

more

If

Z

Tmp

then

by

induction

hypothesis

Z

Var

-LRB-

P

-RRB-

and

Z

Var

-LRB-

B

-RRB-

so

Z

Var

-LRB-

P

-LSB-

B

Tmp

-RSB-

-RRB-

Proof

of

Proposition

is

done

As

shown

in

-LSB-

-RSB-

the

use

of

WP

calculus

is

the

key

to

establish

the

completeness

of

the

proof

system

Theorem

-LRB-

Completeness

of

-LSB-

-RSB-

-RRB-

Let

fP

Cg

S

fQ

Dg

be

a

specification

If

j

fP

Cg

S

fQ

Dg

then

fP

Cg

S

fQ

Dg

A

simple

two-pass

proof

method

We

present

here

a

simple

proof

method

that

allows

after

a

first

step

that

slightly

transforms

the

program

to

handle

it

as

an

usual

scalar

program

The

first

step

consists

in

a

labeling

of

the

program

that

expresses

the

depth

of

conditioning

constructs

In

other

words

a

subprogram

labeled

by

i

is

executed

within

the

scope

of

i

where

constructs

This

labeling

follows

the

syntax

of

the

program

labels

are

increased

on

entering

the

body

of

a

new

conditioning

construct

Context

expressions

are

saved

here

in

a

series

of

auxiliary

variables

This

allows

us

to

alleviate

any

restriction

on

context

expressions

of

conditioning

constructs

The

second

step

consists

in

a

proof

method

similar

to

that

used

in

the

scalar

case

It

is

presented

here

in

the

form

of

a

proof

outline

As

introduced

by

Gries

and

Owicki

in

this

form

gives

a

more

convenient

presentation

of

the

proof

interleaving

assertions

and

program

constructs

-LSB-

-RSB-

In

this

section

we

give

the

formal

description

of

the

two

steps

and

then

prove

the

equivalence

between

this

proof

method

and

the

proof

system

First

step

syntactic

labeling

In

this

step

we

associate

to

each

subprogram

of

the

considered

program

an

integer

label

that

counts

the

number

of

nesting

where

constructs

Counting

starts

at

for

the

entire

program

Consider

for

instance

the

program

where

X

do

X

X

where

X

do

X

X

end

end

We

want

to

get

the

following

labeling

-LRB-

-RRB-

where

X

do

-LRB-

-RRB-

X

X

-LRB-

-RRB-

where

X

do

-LRB-

-RRB-

X

X

end

end

In

order

to

store

context

expressions

we

distinguish

particular

auxiliary

variables

that

do

not

appear

in

programs

Definition

Variables

fTmpi

j

i

Ng

are

such

that

for

any

program

S

and

for

any

index

i

Tmpi

Var

-LRB-

S

-RRB-

This

set

is

the

set

of

auxiliary

variables

The

conditioning

construct

can

be

seen

as

a

stack

mechanism

entering

a

where

construct

is

the

same

as

pushing

a

value

on

a

context

stack

while

exiting

this

construct

corresponds

to

a

pop

The

label

is

namely

the

height

of

the

stack

At

a

given

point

the

current

context

is

corresponding

to

the

conjunction

of

all

the

stack

's

values

Each

auxiliary

variable

is

used

to

store

one

cell

of

the

context

stack

Thanks

to

this

storage

the

variables

appearing

in

context

expressions

may

be

modified

We

thus

can

alleviate

restrictions

on

context

expressions

of

conditioning

constructs

For

a

subprogram

at

depth

i

the

current

context

is

the

current

value

of

Tmpi

To

get

a

clearer

presentation

of

this

fact

we

add

annotations

of

the

form

-LSB-

Tmpi

B

-RSB-

to

each

where

construct

The

previous

example

is

recast

into

-LRB-

-RRB-

where

X

do

-LSB-

X

-RSB-

-LRB-

-RRB-

X

X

-LRB-

-RRB-

where

X

do

-LSB-

X

-RSB-

-LRB-

-RRB-

X

X

end

end

We

now

give

a

formal

definition

of

program

labeling

It

is

made

by

induction

on

the

program

's

syntactic

structure

and

expressed

by

the

rules

listed

below

-LRB-

S

-RRB-

being

the

labeling

of

program

S.

-LRB-

X

E

i

-RRB-

-LRB-

i

-RRB-

X

E

-LRB-

get

X

from

A

into

Y

i

-RRB-

-LRB-

i

-RRB-

get

X

from

A

into

Y

-LRB-

S

T

i

-RRB-

-LRB-

S

i

-RRB-

-LRB-

T

i

-RRB-

-LRB-

where

B

do

S

end

i

-RRB-

-LRB-

i

-RRB-

where

B

do

-LSB-

Tmpi

B

-RSB-

-LRB-

S

i

-RRB-

end

Second

step

proof

outline

A

proof

outline

is

a

visual

and

convenient

way

to

present

a

proof

with

assertions

interleaved

in

the

text

of

the

program

at

appropriate

places

-LSB-

-RSB-

The

structure

of

the

proof

follows

the

structure

of

the

program

thus

giving

a

more

readable

presentation

As

we

use

labeled

programs

and

auxiliary

variables

to

store

contexts

we

know

at

each

place

in

the

program

the

expression

denoting

the

current

context

We

then

can

drop

context

expressions

out

of

assertions

and

proceed

exactly

the

same

way

as

in

the

scalar

case

with

backward

substitutions

The

only

differences

are

that

expressions

in

substitutions

are

conditioned

by

a

conjunction

of

Tmpk

and

that

the

data-parallel

where

construct

adds

a

new

substitution

The

rules

for

inserting

assertions

in

proof

outlines

are

given

below

Contiguity

between

two

assertions

refers

to

the

use

of

the

consequence

rule

If

S

is

a

labeled

subprogram

we

denote

by

S

a

proof

outline

obtained

from

S

by

insertion

of

assertions

and

by

Lab

-LRB-

S

-RRB-

the

label

associated

to

S.

Notice

that

as

labeling

starts

at

for

the

entire

program

thus

denotes

the

initial

context

in

which

S

is

executed

i

Tmpj

Var

-LRB-

Q

-RRB-

fQ

-LSB-

Vik

Tmpk?E

X

X

-RSB-

g

-LRB-

i

-RRB-

X

E

fQg

i

Tmpj

Var

-LRB-

Q

-RRB-

fQ

-LSB-

Vik

Tmpk?X

jA

Y

Y

-RSB-

g

-LRB-

i

-RRB-

get

X

from

A

into

Y

fQg

fPg

S

fRg

fRg

T

fQg

Lab

-LRB-

S

-RRB-

Tmpj

Var

-LRB-

R

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

fPg

S

fRg

T

fQg

P

-RRB-

P

fP

g

S

-RRB-

Q

Lab

-LRB-

S

-RRB-

Tmpj

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

-RRB-

fPgfP

g

S

fPg

S

fQg

Lab

-LRB-

S

-RRB-

i

i

Tmpj

Var

-LRB-

Q

-RRB-

fP

-LSB-

B

Tmpi

-RSB-

g

-LRB-

i

-RRB-

where

B

do

-LSB-

Tmpi

B

-RSB-

fPg

S

fQg

endfQg

fPg

S

fQg

fPg

S

fQg

where

S

is

obtained

from

S

by

deleting

any

assertion

Let

us

explain

intuitively

the

need

of

restrictions

of

the

form

i

Tmpj

Var

-LRB-

Q

-RRB-

In

the

rule

for

the

conditioning

construct

we

substitute

Tmpi

by

B

We

thus

need

that

Tmpi

Var

-LRB-

Q

-RRB-

to

respect

the

conditions

of

the

Substitution

Rule

But

as

the

postcondition

-LRB-

Q

-RRB-

is

the

same

for

S

and

for

where

B

do

S

end

we

need

that

condition

to

be

satisfied

for

every

nesting

depth

greater

than

Lab

-LRB-

S

-RRB-

A

small

example

We

go

back

in

this

section

to

our

previous

example

We

want

to

prove

the

two

following

specifications

fX

ju

Trueg

where

X

do

X

X

where

X

do

X

X

end

end

fX

ju

Trueg

fX

ju

Trueg

where

X

do

X

X

where

X

do

X

X

end

end

fX

ju

Trueg

The

proofs

are

simply

done

by

establishing

the

following

proof

outline

the

result

of

the

first

step

has

already

been

given

as

example

in

the

previous

section

First

proof

f

-LRB-

X

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-RRB-

ju

-LRB-

-RRB-

where

X

do

-LSB-

X

-RSB-

f

-LRB-

-LRB-

X

-RRB-

-LRB-

X

-RRB-

-LRB-

X

-RRB-

-RRB-

ju

-LRB-

-RRB-

X

X

f

-LRB-

X

X

X

-RRB-

ju

-LRB-

-RRB-

where

X

do

-LSB-

X

-RSB-

f

-LRB-

X

-RRB-

ju

-LRB-

-RRB-

X

X

fX

ju

end

fX

ju

end

fX

ju

If

we

denote

by

P

the

first

assertion

of

this

proof

outline

we

only

have

to

prove

that

X

ju

True

-RRB-

P

In

other

words

we

prove

that

X

ju

-RRB-

P

-LSB-

True

-RSB-

The

assertion

P

-LSB-

True

-RSB-

is

equivalent

to

f

-LRB-

X

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-RRB-

ju

Let

us

consider

an

index

u

such

that

X

ju

Then

the

boolean

expression

-LRB-

X

-RRB-

ju

is

true

As

X

-LRB-

-LRB-

X

X

X

-RRB-

-RRB-

ju

is

also

true

Conditional

expression

-LRB-

X

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-RRB-

ju

thus

simplifies

into

-LRB-

X

X

X

-RRB-

which

in

turn

simplifies

into

X

Assertion

P

-LSB-

True

-RSB-

thus

simplifies

into

X

which

is

true

Second

proof

As

no

simplification

using

the

value

of

X

occurs

in

the

first

proof

outline

the

second

is

almost

the

same

we

just

replace

the

value

by

the

value

Then

if

we

denote

by

P

the

assertion

obtained

by

substituting

by

in

P

we

just

have

to

check

that

X

ju

-RRB-

P

-LSB-

True

-RSB-

Let

us

consider

an

index

u

such

that

X

ju

Then

the

boolean

expression

-LRB-

X

-RRB-

ju

is

true

But

this

time

as

X

-LRB-

-LRB-

X

X

X

-RRB-

-RRB-

ju

is

false

Conditional

expression

-LRB-

X

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-LRB-

X

X

X

-RRB-

-RRB-

ju

thus

simplifies

into

-LRB-

X

X

X

-RRB-

ju

which

in

turn

simplifies

into

X

Assertion

P

-LSB-

True

-RSB-

thus

simplifies

into

X

which

is

true

Equivalence

of

Proof

Outlines

and

We

now

want

to

prove

that

the

method

defined

above

is

equivalent

to

the

proof

system

More

precisely

we

want

to

prove

the

following

theorem

Theorem

Let

fPg

-LRB-

-RRB-

S

fQg

be

a

formula

such

that

for

each

j

Tmpj

Var

-LRB-

Q

-RRB-

fPg

S

fQgis

a

proof

outline

for

S

m

fP

S

fQ

We

actually

prove

the

more

general

following

fact

Proposition

Let

S

be

a

subprogram

labeled

by

i

and

P

and

Q

assertions

such

that

i

Tmpj

Var

-LRB-

Q

-RRB-

Then

fPg

S

fQg

is

a

proof

outline

for

S

if

and

only

if

fP

Tmpig

S

fQ

Tmpig

We

begin

with

the

easiest

part

of

the

proof

if

there

exists

a

proof

outline

then

the

desired

specification

is

derivable

in

Proof

Let

S

be

a

subprogram

labeled

with

i

and

fPg

S

fQg

a

proof

outline

for

S

The

proof

is

by

induction

on

the

length

of

the

construction

made

to

obtain

the

proof

outline

We

have

six

cases

to

consider

corresponding

respectively

to

each

derivation

rule

for

proof

outlines

ffl

If

the

last

rule

applied

was

i

Tmpj

Var

-LRB-

Q

-RRB-

fQ

-LSB-

Vik

Tmpk?E

X

X

-RSB-

g

-LRB-

i

-RRB-

X

E

fQg

then

since

X

fTmpi

j

i

Ng

we

have

fP

Tmpig

S

fQ

Tmpig

ffl

The

second

case

dealing

with

the

communication

statement

is

handled

exactly

the

same

way

ffl

If

the

last

rule

applied

was

P

-RRB-

P

fP

g

S

-RRB-

Q

Lab

-LRB-

S

-RRB-

Tmpj

Var

-LRB-

Q

-RRB-

-LSB-

Var

-LRB-

-RRB-

fPgfP

g

S

then

by

induction

hypothesis

we

have

fP

Tmpig

S

Tmpig

so

the

consequence

rule

of

applies

and

gives

the

desired

result

ffl

If

the

last

rule

applied

was

the

rule

for

sequential

composition

then

there

exist

and

such

that

S

and

an

assertion

R

such

that

we

have

the

proof

outlines

fPg

S

fRg

and

fRg

S

fQg

Furthermore

we

know

that

and

are

labeled

by

the

same

value

i.

By

the

rule

for

sequential

composition

in

proof

outlines

we

have

i

Tmpj

Var

R.

By

induction

hypothesis

we

thus

have

fP

Tmpig

S

fR

Tmpig

and

fR

Tmpig

S

fQ

Tmpig

Then

the

Sequencing

Rule

of

applies

and

yields

fP

Tmpig

S

fQ

Tmpig

ffl

If

the

last

used

rule

was

fP

g

T

fQg

Lab

-LRB-

T

-RRB-

i

i

Tmpj

Var

-LRB-

Q

-RRB-

fP

-LSB-

B

Tmpi

-RSB-

g

-LRB-

i

-RRB-

where

B

do

-LSB-

Tmpi

B

-RSB-

T

endfQg

with

P

P

-LSB-

B

Tmpi

-RSB-

We

have

i

Tmpj

Var

-LRB-

Q

-RRB-

so

by

induction

hypothesis

fP

Tmpi

Tmpi

g

T

fQ

Tmpi

Tmpi

g

As

fP

Tmpi

B

Tmpi

Bg

-RRB-

fP

Tmpi

Tmpi

g

the

Consequence

Rule

yields

fP

Tmpi

B

Tmpi

Bg

T

fQ

Tmpi

Tmpi

g

The

where

Rule

applies

and

yields

fP

Tmpi

B

Tmpig

S

fQ

Tmpig

Finally

using

the

Substitution

Rule

with

B

Tmpi

yields

fP

Tmpig

S

fQ

Tmpig

ffl

The

last

case

-LRB-

elimination

of

assertions

in

the

proof

outline

-RRB-

is

straightforward

The

proof

of

the

first

part

of

Proposition

is

done

We

now

want

to

prove

second

part

of

Proposition

The

proof

uses

the

weakest

preconditions

and

needs

the

following

auxiliary

result

Proposition

Let

Q

be

an

assertion

such

that

Tmpi

Var

-LRB-

Q

-RRB-

If

WP

-LRB-

S

fQ

Tmpi

g

-RRB-

fP

Tmpi

g

then

WP

-LRB-

where

B

do

S

end

fQ

Tmpig

-RRB-

fP

-LSB-

B

Tmpi

-RSB-

Tmpig

Proof

Let

-LRB-

oe

c

-RRB-

WP

-LRB-

where

B

do

S

end

fQ

Tmpig

-RRB-

Let

-LRB-

c

-RRB-

be

-LSB-

-LSB-

where

B

do

S

end

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

We

have

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

oe

-LRB-

B

-RRB-

-RRB-

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

and

-LRB-

c

-RRB-

j

fQ

Tmpig

by

the

definition

of

WP

Let

oe

-LSB-

Tmpi

oe

-LRB-

B

-RRB-

-RSB-

and

-LSB-

Tmpi

oe

-LRB-

B

-RRB-

-RSB-

Since

Tmpi

is

an

auxiliary

variable

we

have

Tmpi

Var

-LRB-

S

-RRB-

and

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

and

as

Tmpi

Var

-LRB-

Q

-RRB-

-LRB-

c

-RRB-

j

fQ

Tmpig

Furthermore

-LRB-

Tmpi

-RRB-

oe

-LRB-

B

-RRB-

so

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

j

fQ

Tmpi

g

We

can

deduce

that

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

j

fP

Tmpi

g.

Thus

oe

j

P

-LSB-

B

Tmp

i

-RSB-

As

Tmpi

is

an

auxiliary

variable

we

have

Tmpi

Var

-LRB-

S

-RRB-

so

-LRB-

Tmpi

-RRB-

c

implies

oe

-LRB-

Tmpi

-RRB-

c

Conversely

let

-LRB-

oe

c

-RRB-

fP

-LSB-

B

Tmpi

-RSB-

Tmpig

and

oe

-LSB-

Tmpi

oe

-LRB-

B

-RRB-

-RSB-

We

have

-LSB-

-LSB-

where

B

do

S

end

-RSB-

-RSB-

-LRB-

oe

c

-RRB-

-LRB-

c

-RRB-

with

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

oe

c

oe

-LRB-

B

-RRB-

-RRB-

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

If

-LSB-

Tmpi

oe

-LRB-

B

-RRB-

-RSB-

we

also

have

-LSB-

-LSB-

where

B

do

S

end

-RSB-

-RSB-

-LRB-

c

-RRB-

-LRB-

c

-RRB-

with

-LSB-

-LSB-

S

-RSB-

-RSB-

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

As

-LRB-

oe

c

-RRB-

fP

-LSB-

B

Tmpi

-RSB-

Tmpig

j

P

and

as

Tmpi

Var

-LRB-

B

-RRB-

we

have

-LRB-

Tmpi

-RRB-

c

oe

-LRB-

B

-RRB-

By

hypothesis

we

have

thus

-LRB-

c

oe

-LRB-

B

-RRB-

-RRB-

j

fQ

Tmpi

g

As

Tmpi

Var

-LRB-

Q

-RRB-

we

conclude

that

j

Q

Furthermore

Tmpi

Var

-LRB-

S

-RRB-

so

-LRB-

Tmpi

-RRB-

oe

-LRB-

Tmpi

-RRB-

c

This

concludes

the

proof

of

proposition

We

can

now

prove

the

second

part

of

Proposition

Proof

Let

us

assume

that

fP

Tmpig

S

fQ

Tmpig

We

want

to

find

a

proof

outline

of

the

form

fPg

S

fQg

We

construct

this

outline

by

induction

on

the

structure

of

S.

ffl

If

S

X

E

by

the

soundness

of

the

proof

system

we

have

j

fP

Tmpig

S

fQ

Tmpig

By

the

definition

of

WP

we

have

fP

Tmpig

-RRB-

WP

-LRB-

S

fQ

Tmpig

-RRB-

where

WP

-LRB-

S

fQ

Tmpig

-RRB-

fQ

-LSB-

Tmpi?E

X

X

-RSB-

Tmpig

Then

fPg

fQ

-LSB-

Tmpi?E

X

X

-RSB-

g

S

fQg

is

a

proof

outline

for

S.

ffl

The

case

of

communication

statement

is

handled

the

same

way

ffl

If

S

Let

Tmpig

WP

-LRB-

fQ

Tmpig

-RRB-

and

Tmpig

WP

-LRB-

Tmpig

-RRB-

As

i

Tmpj

Var

-LRB-

S

-RRB-

-LSB-

Var

-LRB-

Q

-RRB-

Lemma

guarantees

that

i

Tmpj

Var

-LRB-

-RRB-

The

premises

of

the

rule

for

sequential

composition

are

thus

satisfied

By

the

soundness

of

we

have

j

fP

Tmpig

S

fQ

Tmpig

so

by

the

definition

of

WP

P

-RRB-

Then

fPg

fQg

is

a

proof

outline

for

S.

ffl

Consider

now

the

case

when

S

where

B

do

T

end

The

weakest

preconditions

calculus

enables

us

to

construct

a

proof

fP

Tmpi

g

T

fQ

Tmpi

g

where

fP

Tmpi

g

WP

-LRB-

T

fQ

Tmpi

g

-RRB-

By

induction

hypothesis

fP

g

T

fQg

is

a

proof

outline

for

T

But

Proposition

yields

WP

-LRB-

S

fQ

Tmpig

-RRB-

fP

-LSB-

B

Tmpi

-RSB-

Tmpig

Then

by

the

soundness

of

the

proof

system

we

have

j

fP

Tmpig

S

fQ

Tmpig

We

conclude

that

P

-RRB-

P

-LSB-

B

Tmpi

-RSB-

and

that

fPg

fP

-LSB-

B

Tmpi

-RSB-

g

where

B

do

-LSB-

Tmpi

B

-RSB-

fP

g

T

fQg

end

fQg

is

a

proof

outline

for

S.

Discussion

We

have

defined

a

notion

of

Proof

Outline

for

a

simple

data-parallel

kernel

language

Due

to

the

two-part

nature

of

the

program

assertions

it

works

in

two

passes

Pass

labels

labels

each

instruction

with

its

respective

extent

of

parallelism

top-down

Pass

generates

the

intermediate

annotations

bottom-up

starting

from

the

final

post-condition

Pass

amounts

to

a

simple

rewriting

It

could

easily

be

handled

by

some

advanced

text

editor

The

rewriting

process

is

slightly

more

complex

due

to

the

possible

conflict

between

the

vector

boolean

expressions

denoting

the

current

extent

of

parallelism

and

the

assignments

Fresh

temporary

variables

Tmpi

have

to

be

introduced

to

save

the

activity

contexts

Pass

is

very

similar

to

a

Proof

Annotation

generating

system

for

usual

scalar

Pascal-like

languages

The

only

difference

lies

in

the

slightly

more

complex

substitution

mechanism

This

similarity

confirms

that

validating

data-parallel

programs

is

of

the

same

level

of

complexity

as

validating

scalar

programs

This

is

in

strong

contrast

with

control-parallel

CSP-like

programs

In

this

respect

the

data-parallel

programming

model

appears

as

a

suitable

basis

for

large-scale

parallel

software

engineering

A

number

of

additional

remarks

can

be

made

ffl

Our

equivalence

result

could

probably

be

adapted

to

other

shapes

of

assertions

It

could

be

interesting

to

consider

for

instance

the

one-part

assertions

of

Le

Guyadec

and

Virot

-LSB-

-RSB-

where

the

current

extent

of

parallelism

is

kept

as

the

value

of

a

special

-RSB-

symbol

ffl

Our

two-pass

annotation

method

could

easily

be

carried

out

mechanically

and

integrated

in

some

design/validation

assistance

tool

The

main

difficulty

lies

in

keeping

the

assertions

simple

enough

to

be

understood

-LRB-

and

corrected

-RRB-

by

a

human

reader

The

complex

substitution

mechanism

generates

nested

conditional

expressions

which

should

be

simplified

on

the

fly

by

some

additional

tool

ffl

Consider

a

conditioned

statement

-LRB-

i

-RRB-

where

B

do

S

If

the

conditioned

body

S

does

not

interfere

with

the

expression

denoting

the

current

extent

of

parallelism

there

is

no

need

to

introduce

any

auxiliary

Tmpi

variable

One

can

as

well

use

the

conditioning

expression

B

directly

This

will

probably

result

in

simpler

assertions

Such

an

optimization

should

definitely

be

considered

in

designing

any

real

assistance

tool

ffl

Proof

outlines

can

also

be

used

for

automatic

program

documentation

An

interesting

application

would

be

to

generate

annotations

at

certain

hot

spots

in

the

program

only

focusing

on

a

set

of

crucial

program

variables

This

could

probably

serve

as

a

basis

for

an

interactive

tool

where

the

user

could

build

at

the

same

time

both

the

program

and

a

-LRB-

partial

-RRB-

proof

of

it

References

-LSB-

-RSB-

K.R.

Apt

and

E.-R

Olderog

Verification

of

Sequential

and

Concurrent

Programs

Text

and

Monographs

in

Computer

Science

Springer

Verlag

-LSB-

-RSB-

L.

Boug?e

Y.

Le

Guyadec

G.

Utard

and

B.

Virot

On

the

expressivity

of

a

weakest

preconditions

calculus

for

a

simple

data-parallel

programming

language

In

ConPar

-LCB-

VAPP

VI

Linz

Austria

September

-LSB-

-RSB-

L.

Boug?e

and

D.

Cachera

On

the

completeness

of

a

proof

system

for

a

simple

data-parallel

programming

language

Research

Report

-LCB-

LIP

ENS

Lyon

France

December

-LSB-

-RSB-

L.

Boug?e

Y.

Le

Guyadec

G.

Utard

and

B.

Virot

A

proof

system

for

a

simple

data-parallel

programming

language

In

C.

Girault

editor

Proc

of

Applications

in

Parallel

and

Distributed

Computing

Caracas

Venezuela

April

IFIP

WG

North-Holland

-LSB-

-RSB-

L.

Boug?e

and

J.-L

Levaire

Control

structures

for

data-parallel

SIMD

languages

semantics

and

implementation

Future

Generation

Computing

Systems

-LCB-

-LSB-

-RSB-

Y.

Le

Guyadec

B.

Virot

Axiomatic

semantics

of

conditioning

constructs

and

non-local

control

transfers

in

data-parallel

languages

Research

Report

-LCB-

LIFO

Orl?eans

France

-LSB-

-RSB-

MasPar

Computer

Corporation

Sunnyvale

CA

Maspar

Parallel

Application

Language

Reference

Manual

-LSB-

-RSB-

N.

Paris

HyperC

specification

document

Technical

Report

-LCB-

HyperParallel

Technologies

-LSB-

-RSB-

Thinking

Machine

Corporation

Cambridge

MA

C

programming

guide

hoare logic
proof system
weakest preconditions

specifying and verifying and reasoning about programs