## Auxiliary Variables and Recursive Procedures (1997)

Venue: | In TAPSOFT '97, volume 1214 of LNCS |

Citations: | 19 - 0 self |

### BibTeX

@INPROCEEDINGS{Schreiber97auxiliaryvariables,

author = {Thomas Schreiber},

title = {Auxiliary Variables and Recursive Procedures},

booktitle = {In TAPSOFT '97, volume 1214 of LNCS},

year = {1997},

pages = {697--711},

publisher = {Springer-Verlag}

}

### Years of Citing Articles

### OpenURL

### Abstract

Much research in axiomatic semantics suffers from a lack of formality. In particular, most proposed verification calculi for imperative programs dealing with recursive procedures are known to be unsound or incomplete. Focussing on total correctness, we present a new consequence rule which yields a sound and complete Hoare-style calculus in the presence of parameterless recursive procedures. Both, the standard consequence and an improved rule of adaptation are instances of our new rule. This work has been developed under the auspices of the computer-aided proof system Lego. The rigorous treatment of auxiliary variables has been crucial for establishing our results. A comparison with VDM reinforces our view that auxiliary variables deserve to be treated seriously.

### Citations

1361 | An axiomatic basis for computer programming
- Hoare
- 1969
(Show Context)
Citation Context ...perational semantics presentation is in general not suOEciently abstract. It is advisable to establish a set of axioms and rules for deriving correctness judgements. Based on work of Floyd [8], Hoare =-=[12] propose-=-d a veri��cation calculus (originally for partial correctness) now referred to as Hoare logic. The following presentation contains a re��ned loop rule due to Harel [11] which leads to total co... |

563 |
Assigning meanings to programs
- Floyd
- 1967
(Show Context)
Citation Context ...cause the operational semantics presentation is in general not suOEciently abstract. It is advisable to establish a set of axioms and rules for deriving correctness judgements. Based on work of Floyd =-=[8], Hoare -=-[12] proposed a veri��cation calculus (originally for partial correctness) now referred to as Hoare logic. The following presentation contains a re��ned loop rule due to Harel [11] which leads... |

116 | Soundness and Completeness of an Axiom System for Program Verification
- Cook
- 1978
(Show Context)
Citation Context ...eness result. In particular, one cannot expect to achieve completeness for the larger class of correctness formulae S sat Spec. To factor out problems concerning the underlying logical language, Cook =-=[5] pro-=-posed that one investigates relative completeness: One should only consider suOEciently expressive logical languages. Furthermore, in de��ning a formal system for ` S sat Spec, one may assume that... |

83 |
Procedures and parameters: An axiomatic approach
- Hoare
- 1971
(Show Context)
Citation Context ...t maximal [7] i.e., the preconditionsp should be the weakest possible satisfying j= Hoare fpg S fqg in the light of j= Hoare fp 1 g s fq 1 g. Catering for auxiliary variables at the meta level, Hoare =-=[13] has propose-=-d p , oe: \Sigma \Delta 9z 1 \Delta p 1 (oe)s8�� : \Sigma \Delta q 1 (�� ) ) q(�� ) (25) where z 1 is a list of all (auxiliary) variables free in p 1 , q 1 , but not in q . However, while ... |

72 |
Methods and logics for proving programs
- Cousot
- 1990
(Show Context)
Citation Context ...ants. Most published veri��cation calculi for imperative programs dealing with recursive procedures are known to be either unsound or incomplete, despite authors backing up their claims with iproo=-=fsj [6]-=-. No such proof attempts would have been accepted by a mechanical proof checker. Furthermore, we believe that in most cases, correct soundness and completeness proofs require little overhead when bein... |

66 | Ten years of Hoare’s logic, a survey, part I
- Apt
- 1981
(Show Context)
Citation Context ...uction to developing imperative programs from input/output speci��cations. 2 Thomas Schreiber Section 4 considers recursive procedures. Parameter passing is an orthogonal problem which, following =-=Apt [3]-=-, we omit in this paper. We motivate a new consequence rule leading to an improved Hoare logic calculus for imperative programs with recursive procedures. A comparison with VDM reinforces our view tha... |

58 | Mechanising Programming Logics in Higher Order Logic
- Gordon
- 1988
(Show Context)
Citation Context ...ore formal notation, closer to the actual Lego scripts, to resolve ambiguities arising from informal presentations. For the reader familiar with standard techniques for mechanising programming logics =-=[9, 18]-=-, the presentation of this paper is self-contained and provides suOEcient information to exploit our work in other modern computer-aided proof systems such as Coq, HOL, Isabelle or PVS. 2 Design Crite... |

20 |
First-Order Dynamic Logic, volume 68
- Harel
- 1979
(Show Context)
Citation Context ...ork of Floyd [8], Hoare [12] proposed a veri��cation calculus (originally for partial correctness) now referred to as Hoare logic. The following presentation contains a re��ned loop rule due t=-=o Harel [11]-=- which leads to total correctness. 2 In classical systems i.e., in which the axiom of excluded middle holds, the distinction between the types bool and Prop is not required. Auxiliary Variables and Re... |

18 |
Proving total correctness of recursive procedures
- America, Boer
- 1990
(Show Context)
Citation Context ...ploying Hoare logic is derivable whenever a proof relying on the low-level operational semantics exists. The structure of the proof follows the completeness proof for a more elaborate set of rules in =-=[2]-=-. The central theorem directly relates the descriptive power of operational semantics and Hoare logic: Theorem 4.11 (Most general formula). For any program S , in Hoare logic, we can derive ` Hoare fp... |

5 |
A system of proof rules for the correctness of iterative programs – some notational and organisational suggestions. Unpublished
- Aczel
- 1982
(Show Context)
Citation Context ... \Gamma `VDM fp 1 g S fq 1 g \Gamma `VDM fpg S fqg provided 8oe; �� : \Sigma \Delta p(oe) ) (p 1 (oe)s(q 1 (oe)(�� ) ) q(oe)(�� ))) . An equivalent consequence rule for VDM has been propos=-=ed by Aczel [1]-=-. We were able to show that this rule plays a similar role in VDM to our new consequence rule in Hoare logic. More precisely, in Lego, we have shown that simply adding Soko#owski's procedure call rule... |

1 |
Meertens. Completeness with ��nite systems of intermediate assertions for recursive program schemes
- Apt, Lambert
- 1980
(Show Context)
Citation Context ...s require little overhead when being done on a machine provided the area is formally understood. Previously, auxiliary variables in Hoare logic have been given insuOEcient attention. Apt and Meertens =-=[4] hav-=-e proposed a method for formally integrating auxiliary variables in assertions. We extend this idea to Hoare logic. In the following section, we present design criteria for veri��cation calculi. H... |

1 |
The Science of Computer Programming, chapter 16
- Gries
- 1981
(Show Context)
Citation Context ...cation ` Hoare fpg S fqg. To obtain completeness, we must be able to equivalently transform assertions or, in particular in the case of loops, weaken the precondition and strengthen the postcondition =-=[10]. Adding the-=- consequence rule ` Hoare fp 1 g S fq 1 g ` Hoare fpg S fqg provided 8oe; �� : \Sigma \Delta p(oe) ) p 1 (oe)sq 1 (�� ) ) q(�� ) (6) leads to a complete system while retaining soundness: L... |