An Axiomatic Basis for of axioms it is possible to deduce such simple theorems as:

x=x+yXO
Computer Programming
y <r :J r +y X q = (1' - y) + y X (1 + q)
C. A. R. HOARE The proof of the second of these is:
The Queen' e University of Belfast, * N oriherti Ireland A5 (1' - y) +y X (1 + q)
(1' - y) + (y X 1 +y X q)
In this paper an attempt is made to explore the logical founda- A9 (1' - y) + (y +y X q)
tions of computer programming by use of techniques which
were first applied in the study of geometry and have later
A3 ((1' - y) + y) + y X q

been extended to other branches of mathematics. This in- A6 = r +y X q provided y <r

volves the elucidation of sets of axioms and rules of inference
which can be used in proofs of the properties of computer The axioms Al to A9 are, of course, true of the tradi-
programs. Examples are given of such axioms and rules, and tional infinite set of integers in mathematics. However,
a formal proof of a simple theorem is displayed. Finally, it is they are also true of the finite sets of "integers" which are
argued that important advantages, both theoretical and prac- manipulated by computers provided that they are con-
tical, may follow from a pursuance of these topics. fined to nonnegative numbers. Their truth is independent
KEY WORDS AND PHRASES: axiomatic method, theory of programming'
of the size of the set; furthermore, it is largely independent
proofs of programs, formal language definition, programming language of the choice of technique applied in the event of "over-
design, machine-independent programming, program documentation flow"; for example:
CR CATEGORY: 4.0, 4.21, 4.22, 5.20, 5.21,5.23, 5.24 (1) Strict interpretation: the result of an overflowing
operation does not exist; when overflow occurs the offend-
. '
mg program never completes its operation. Note that in
this case, the equalities of Al to A9 are strict, in the sense
that both sides exist or fail to exist together.
(2) Firm boundary: the result of an overflowing opera-
tion is taken as the maximum value represented.
(3) Modulo arithmetic: the result of an overflowing
1. Introduction operation is computed modulo the size of the set of integers
Computer programming is an exact science in that all represented.
the properties of a program and all the consequences of These three techniques are illustrated in Table II by
executing it in any given environment can, in principle, addition and multiplication tables for a trivially small
be found out from the text of the program itself by means model in which 0, 1, 2, and 3 are the only integers repre-
of purely deductive reasoning. Deductive reasoning in- sented.
volves the application of valid rules of inference to sets of . It is. interesting to note that the different systems satisfy-
valid axioms. It is therefore desirable and interesting to mg axioms Al to A9 may be rigorously distinguished from
elucidate the axioms and rules of inference which underlie each other by choosing a particular one of a set of mutually
our reasoning about computer programs. The exact choice exclusive supplementary axioms. For example, infinite
of axioms will to some extent depend on the choice of arithmetic satisfies the axiom:
programming language. For illustrative purposes, this
paper is confined to a very simple language, which is effec-
AIOI -,3xVy (y < x),
tively a subset of all current procedure-oriented languages. where all finite arithmeties satisfy:

2. Computer Arithmetic (x < max)

The first requirement in valid reasoning about a pro- where "max" denotes the largest integer represented.
gram is to know the properties of the elementary operations Similarly, the three treatments of overflow may be
which it invokes, for example, addition and multiplication distinguished by a choice of one of the following axioms
of integers. Unfortunately, in several respects computer relating to the value of max + 1:
arithmetic is not the same as the arithmetic familiar to Al l , -, 3x (x = max + 1) (strict interpretation)
mathematicians, and it is necessary to exercise some care
in selecting an appropriate set of axioms. For example, the Alln max +1 = max (firm boundary)
axioms displayed in Table I are rather a small selection
of axioms relevant to integers. From this incomplete set
AllM max +1 = 0 (modulo arithmetic)

Having selected one of these axioms, it is possible to

* Department of Computer Science use it in deducing the properties of programs; however,
576 Communications of the ACM Volume 12 / Number 10 / October, 1969
 of mathematical logic to express these assertions, and the
TABLE I
familiar rules of operator precedence have been used
Al x+ y = y+ x addition is commutative wherever possible to improve legibility.
A2 x X y = y X x multiplication is commut- In many cases, the validity of the results of a program
ative (or part of a program) will depend on the values taken
A3 (x +
y) z = x +
(y z) + + addition is associative
by the variables before that program is initiated. These
A4 (x X y) X z = x X (y X z) mul tiplication is associa-
tive initial preconditions of successful use can be specified by
A5 x X (y + z) = x X y + x X z multiplication distrib- the same type of general assertion as is used to describe
utes through addition the results obtained on termination. To state the required
A6 y <: x ~ (x - y) + y = x addition cancels subtrac- connection between a precondition (P), a program (Q)
tion
and a description of the result of its execution (R), we
A7 x + 0 = x
A8 xXO=O
introduce a new notation:
A9 x X 1 = x P{Q}R.
This may be interpreted "If the assertion P is true before
initiation of a program Q, then the assertion R will be
true on its completion." If there are no preconditions im-
1
TABLE II posed, we write true {Q}R.
The treatment given below is essentially due to Floyd
1. Strict Interpretation
[8] but is applied to texts rather than flowcharts.
+ 0 1 2 3 X 0 2 3
3.1. AXIOM OF ASSIGNMENT
0 0 1 2 3 0 0 0 0 0
1 2 3 1 0 1 2 3
Assignment is undoubtedly the most characteristic fea-
* ture of programming a digital computer, and one that
2 2 3 2 0 2 * *
* *
3 3 * * * 3 0 3
* * most clearly distinguishes it from other branches of mathe-
* nonexistent matics. It is surprising therefore that the axiom governing
our reasoning about assignment is quite as simple as any
2. Firm Boundary
to be found in elementary logic.
+ 0 1 2 3 X I 0 1 2 3
Consider the assignment statement:
0 0 1 2 3 0 0 0 0 0
1 1 2 3 3 1 0 1 2 3
x:= f
2 2 3 3 3 2 0 2 3 3 where
3 3 3 3 3 3 0 3 3 3 x is an identifier for a simple variable;
3. Modulo Arithmetic f is an expression of a programming language without
+ 0 1 2 3 X 0 2 3 side effects, but possibly containing x.
N ow any assertion P (x) which is to be true of (the value
0 0 1 2 3 0 0 0 0 0
1 1 2 3 0 1 0 1 2 3 of) x after the assignment is made must also have been
2 2 3 0 1 2 0 2 0 2 true of (the value of) the expression f, taken before the
3 3 0 1 2 3 0 3 2 1 assignment is made, i.e. with the old value of x. Thus
if P (x) is to be true after the assignment, then P (f) must
be true before the assignment. This fact may be expressed
more formally:
these properties will not necessarily obtain, unless the DO Axiom of Assignment
program is executed on an implementation which satisfies r-Po{x := f} P
the chosen axiom. where
x is a variable identifier;
3. Program Execution f is an expression;
As mentioned above, the purpose of this study is to Po is obtained from P by substituting f for all occur-
provide a logical basis for proofs of the properties of a rences of x.
program. One of the most important properties of a pro- It may be noticed that DO is not really an axiom at all,
gram is whether or not it carries out its intended function. but rather an axiom schema, describing an infinite set of
The intended function of a program, or part of a program, axioms which share a common pattern. This pattern is
can be specified by making general assertions about the described in purely syntactic terms, and it is easy to
values which the relevant variables will take after execution check whether any finite text conforms to the pattern,
of the program. These assertions will usually not ascribe thereby qualifying as an axiom, which may validly appear
particular values to each variable, but will rather specify in any line of a proof.
certain general properties of the values and the relation- 1 If this can be proved in our formal system, we use the familiar
ships holding between them. We use the normal notations logical symbol for theoremhood: W {Q} R

Volume 12 / Number 10 / October, 1969 Communications of the ACM 577

 3.2. RULES OF CONSEQUENCE no iterations). Furthermore, it is known that the con-
In addition to axioms, a deductive science requires at trolling condition B is false when the iteration finally
least one rule of inference, which permits the deduction of terminates. A slightly more powerful formulation is pos-
new theorems from one or more axioms or theorems al- sible in light of the fact that B may be assumed to be true
ready proved. A rule of inference takes the form "If X r on initiation of S:
and rY then rZ", i.e. if assertions of the form X and Y D3 Rule of Iteration
have been proved as theorems, then Z also is thereby
proved as a theorem. The simplest example of an inference If rP!\ B{S}P then rP{while B do S} ,B !\ P
rule states that if the execution of a program Q en- 3.5. EXAMPLE
sures the truth of the assertion R, then it also ensures the The axioms quoted above are sufficient to construct the
truth of every assertion logically implied by R. Also, if proof of properties of simple programs, for example, a
P is known to be a precondition for a program Q to pro- routine intended to find the quotient q and remainder r
duce result R, then so is any other assertion which logically obtained on dividing x by y. All variables are assumed to
implies P. These rules may be expressed more formally: range over a set of nonnegative integers conforming to the
Dl Rules of Consequence axioms listed in Table I. For simplicity we use the trivial
but inefficient method of successive subtraction. The pro-
If rP{Q}R and f-R ~ S then f-P{Q}S
If r-P{Q}R and rS ~ P then rS{Q}R
posed program is:
((r := x; q:= 0); while
3.3. RULE OF COMPOSITION
A program generally consists of a sequence of statements
y -< r do (r := r - y; q:= 1 + q))
which are executed one after another. The statements may An important property of this program is that when it
be separated by a semicolon or equivalent symbol denoting terminates, we can recover the numerator x by adding to
the remainder r the product of the divisor y and the quo-
procedural composition: (QI; Q2; ... ; Qn). In order to
avoid the awkwardness of dots, it is possible to deal ini-
tient q (i.e. x = r + y X q). Furthermore, the remainder
is less than the divisor. These properties may be expressed
tially with only two statements (QI; Q2), since longer se-
formally:
quences can be reconstructed by nesting, thus (QI; (Q2;
( .. · (Q.n-l ; Qn) ... ))). The removal of the brackets of true {Q} I Y -< r !\ x = r + y Xq
this nest may be regarded as convention based on the where Q stands for the program displayed above. This
associativity of the" ;-operator", in the same way as brack- expresses a necessary (but not sufficient) condition for
ets are removed from an arithmetic expression (tl + (~ + the "correctness" of the program.
( . .. (tn-l + tn) . . . ) ) ). A formal proof of this theorem is given in Table III.
The inference rule associated with composition states Like all formal proofs, it is excessively tedious, and it
that if the proven result of the first part of a program is would be fairly easy to introduce notational conventions
identical with the precondition under which the second part which would significantly shorten it. An even more power-
of the program produces its intended result, then the whole ful method of reducing the tedium of formal proofs is to
program will produce the intended result, provided that the derive general rules for proof construction out of the simple
precondition of the first part is satisfied. rules accepted as postulates. These general rules would be
In more formal terms: shown to be valid by demonstrating how every theorem
D2 Rule of Composition proved with their assistance could equally well (if more
If r-P{QI}RI and rRI{Q2}R then rP{ (QI; Q2)}R tediously) have been proved without. Once a powerful set
of supplementary rules has been developed, a "formal
3.4. RULE OF ITERATION proof" reduces to little more than an informal indication
The essential feature of a stored program computer is of how a formal proof could be constructed.
the ability to execute some portion of program (S) re-
peatedly until a condition (B) goes false. A simple way of 4. General Reservations
expressing such an iteration is to adapt the ALGOL 60 The axioms and rules of inference quoted in this paper
while notation: have implicitly assumed the absence of side effects of the
while B do S evaluation of expressions and conditions. In proving prop-
In executing this statement, a computer first tests the con- erties of programs expressed in a language permitting side
dition B. If this is false, S is omitted, and execution of the effects, it would be necessary to prove their absence in
loop is complete. Otherwise, S is executed and B is tested each case before applying the appropriate proof technique.
again. This action is repeated until B is found to be false. If the main purpose of a high level programming language
The reasoning which leads to a formulation of an inference is to assist in the construction and verification of correct
rule for iteration is as follows. Suppose P to be an assertion programs, it is doubtful whether the use of functional
which is always true on completion of S, provided that it is notation to call procedures with side effects is a genuine
also true on initiation. Then obviously P will still be true advantage.
after any number of iterations of the statement S (even Another deficiency in the axioms and rules quoted above
Volume 12 / Number 10 / October, 1969 Communications of the ACM 579
is that they give no basis for a proof that a program suc- abandon execution of the program as a result of violation
cessfully terminates. Failure to terminate may be due to an of an implementation limit.
infinite loop; or it may be due to violation of an imple- Finally it is necessary to list some of the areas which have
mentation-defined limit, for example, the range of numeric not been covered: for example, real arithmetic, bit and
operands, the size of storage, or an operating system time character manipulation, complex arithmetic, fractional
limit. Thus the notation "P{Q}R" should be interpreted arithmetic, arrays, records, overlay definition, files, input/
"provided that the program successfully terminates, the output, declarations, subroutines, parameters, recursion,
properties of its results are described by R." It is fairly and parallel execution. Even the characterization of integer
easy to adapt the axioms so that they cannot be used to arithmetic is far from complete. There does not appear to
predict the "results" of nonterminating programs; but the be any great difficulty in dealing with these points, pro-
actual use of the axioms would now depend on knowledge vided that the programming language is kept simple.
of many implementation-dependent features, for example, Areas which do present real difficulty are labels and jumps,
the size and speed of the computer, the range of numbers, pointers, and name parameters. Proofs of programs which
and the choice of overflow technique. Apart from proofs of made use of these features are likely to be elaborate, and
the avoidance of infinite loops, it is probably better to it is not surprising that this should be reflected in the
prove the "conditional" correctness of a program and rely complexity of the underlying axioms.
on an implementation to give a warning if it has had to
5. Proofs of Program Correctness
The most important property of a program is whether it
accomplishes the intentions of its user. If these intentions
can be described rigorously by making assertions about the
values of variables at the end (or at intermediate points) of
the execution of the program, then the techniques described
TABLE III in this paper may be used to prove the correctness of the
program, provided that the implementation of the pro-
Line
gramming language conforms to the axioms and rules which

578 Communications of the ACM Volume 12 / Number 10 / October, 1969

number Formal proof Justification
have been used in the proof. This fact itself might also be
1 true ~x = x + y X 0 Lemma 1
established by deductive reasoning, using an axiom set
2 x = z + y X O{r := x}x = r + y X 0 DO
which describes the logical properties of the hardware
3 z = r + y X 0 {q := O} x = r + y X q DO
circuits. When the correctness of a program, its compiler,
4 true {r : = x} z = r +
y X 0 D1 (1,2)
and the hardware of the computer have all been established
5 true {r : = z ; q: = O} x = r + y X q D2 (4, 3)
with mathematical certainty, it will be possible to place
6 x=r+yXql\y<;r-::Jx=
(r-y) + y X (1+q) Lemma 2
great reliance on the results of the program, and predict
7 x = (r-y) + y X (l+q){r := r-y}x =
their properties with a confidence limited only by the
reliability of the electronics.
r +y
X (l+q) DO
The practice of supplying proofs for nontrivial programs
8 x =r + y X (l+q){q := l+q}x =
r+yXq
DO will not become widespread until considerably more power-
9 z = (r-y) + y X (l+q){r := r-y; ful proof techniques become available, and even then will
D2 (7, 8)
+ not be easy. But the practical advantages of program prov-
q l+q} x = r
:= y X q
+ D1 (6,9) ing will eventually outweigh the difficulties, in view of the
10 z = r y X q 1\ y <; r {r := r-y;
q := l+q} x = r y X q + increasing costs of programming error. At present, the
11 x = r + y X q {while y<;r do
method which a programmer uses to convince himself of
(r := r-y; q:= l+q)}
the correctness of his program is to try it out in particular
-,y <; r 1\ z = r +
y X q D3 (10) cases and to modify it if the results produced do not cor-
12 true {((r : = z ; q: = 0); while y <r do
respond to his intentions. After he has found a reasonably
(r := r+ u; q:= l+q))} -,y < r 1\ z = wide variety of example cases on which the program seems
r +y X q D2 (5, 11)
to work, he believes that it will always work. The time
spent in this program testing is often more than half the
NOTES time spent on the entire programming project; and with a
1. The left hand column is used to number the lines, and the realistic costing of machine time, two thirds (or more) of
right hand column to justify each line, by appealing to an axiom,
a lemma or a rule of inference applied to one or two previous
the cost of the project is involved in removing errors during
lines, indicated in brackets. Neither of these columns is part this phase.
of the formal proof. For example, line 2 is an instance of the The cost of removing errors discovered after a program
axiom of assignment (DO); line 12 is obtained from lines 5 and 11 has gone into use is often greater, particularly in the case
by application of the rule of composition (D2). of items of computer manufacturer's software for which a
2. Lemma 1 may be proved from axioms A7 and A8.
3. Lemma 2 follows directly from the theorem proved in Sec. 2.
large part of the expense is borne by the user. And finally,
the cost of error in certain types of program may be almost

Volume 12 / Number 10 / October, 1969 Communications of the ACM 579

incalculable-a lost spacecraft, a collapsed building, a lead to solution of three of the most pressing problems in
crashed aeroplane, or a world war. Thus the practice of software and programming, namely, reliability, documen-
program proving is not only a theoretical pursuit, followed tation, and compatibility. However, program proving, cer-
in the interests of academic respectability, but a serious tainly at present, will be difficult even for programmers of
recommendation for the reduction of the costs associated high caliber; and may be applicable only to quite simple
with programming error. program designs. As in other areas, reliability can be pur-
The practice of proving programs is likely to alleviate chased only at the price of simplicity.
some of the other problems which afflict the computing
6. Formal Language Definition
world. For example, there is the problem of program docu-
mentation, which is essential, firstly, to inform a potential A high level programming language, such as ALGOL,
user of a subroutine how to use it and what it accomplishes, FORTRAN, or COBOL, is usually intended to be implemented
and secondly, to assist in further development when it on a variety of computers of differing size, configuration,
becomes necessary to update a program to meet changing and design. It has been found a serious problem to define
circumstances or to improve it in the light of increased these languages with sufficient rigour to ensure compat-
knowledge. The most rigorous method of formulating the ibility among all implementors. Since the purpose of com-
purpose of a subroutine, as well as the conditions of its patibility is to facilitate interchange of programs ex-
proper use, is to make assertions about the values of vari- pressed in the language, one way to achieve this would be to
ables before and after its execution. The proof of the cor- insist that all implementations of the language shall "sat-
rectness of these assertions can then be used as a lemma in isfy" the axioms and rules of inference which underlie
the proof of any program which calls the subroutine. Thus, proofs of the properties of programs expressed in the
in a large program, the structure of the whole can be clearly language, so that all predictions based on these proofs will
mirrored in the structure of its proof. Furthermore, when be fulfilled, except in the event of hardware failure. In
it becomes necessary to modify a program, it will always be effect, this is equivalent to accepting the axioms and rules
valid to replace any subroutine by another which satisfies of inference as the ultimately definitive specification of the
the same criterion of correctness. Finally, when examining meaning of the language.
the detail of the algorithm, it seems probable that the proof Apart from giving an immediate and possibly even
will be helpful in explaining not only what is happening provable criterion for the correctness of an implementation,
but why. the axiomatic technique for the definition of programming
Another problem which can be solved, insofar as it is language semantics appears to be like the formal syntax of
soluble, by the practice of program proofs is that of trans- the ALGOL 60 report, in that it is sufficiently simple to be
ferring programs from one design of computer to another. understood both by the implementor and by the reasonably
Even when written in a so-called machine-independent sophisticated user of the language. It is only by bridging
programming language, many large programs inadvert- this widening communication gap in a single document
ently take advantage of some machine-dependent prop- (perhaps even provably consistent) that the maximum
erty of a particular implementation, and unpleasant and advantage can be obtained from a formal language def-
expensive surprises can result when attempting to transfer inition.
it to another machine. However, presence of a machine- Another of the great advantages of using an axiomatic
dependent feature will always be revealed in advance by approach is that axioms offer a simple and flexible tech-
the failure of an attempt to prove the program from ma- nique for leaving certain aspects of a language undefined,
chine-independent axioms. The programmer will then have for example, range of integers, accuracy of floating point,
the choice of formulating his algorithm in a machine- and choice of overflow technique. This is absolutely es-
independent fashion, possibly with the help of environment sential for standardization purposes, since otherwise the
enquiries; or if this involves too much effort or inefficiency, language will be impossible to implement efficiently on
he can deliberately construct a machine-dependent pro- differing hardware designs. Thus a programming language
gram, and rely for his proof on some machine-dependent standard should consist of a set of axioms of universal
axiom, for example, one of the versions of All (Section 2). applicability, together with a choice from a set of supple-
In the latter case, the axiom must be explicitly quoted as mentary axioms describing the range of choices facing an
one of the preconditions of successful use of the program. implementor. An example of the use of axioms for this
The program can still, with complete confidence, be trans- purpose was given in Section 2.
ferred to any other machine which happens to satisfy the Another of the objectives of formal language definition is
same machine-dependent axiom; but if it becomes neces- to assist in the design of better programming languages. The
sary to transfer it to an implementation which does not, regularity, clarity, and ease of implementation of the
then all the places where changes are required [will be ALGOL 60 syntax may at least in part be due to the use of
clearly annotated by the fact that the proof at that point an elegant formal technique for its definition. The use of
appeals to the truth of the offending machine-dependent axioms may lead to similar advantages in the area of
aXIOm. "semantics," since it seems likely that a language which can
Thus the practice of proving programs would seem to (Continued on p. 583)

580 Communications of the ACM Volume 12 / Number 10 / October, 1969

c. A. R. HOARE-cont'd from page 580 language undefined; (2) a comprehensive evaluation of
the possible benefits to be gained by adopting this approach
be described by a few "self-evident" axioms from which both for program proving and for formal language defini-
proofs will be relatively easy to construct will be preferable tion.
to a language with many obscure axioms which are dif- However, the formal material presented here has only
ficult to apply in proofs. Furthermore, axioms enable the an expository status and represents only a minute propor-
language designer to express his general intentions quite tion of what remains to be done. Itis hoped that many of
simply and directly, without the mass of detail which the fascinating problems involved will be taken up by
usually accompanies algorithmic descriptions. Finally, ax- others.
ioms can be formulated in a manner largely independent
of each other, so that the designer can work freely on one RECEIVED NOVEMBER, 1968; REVISED MAY, 1969
axiom or group of axioms without fear of unexpected in- REFERENCES
teraction effects with other parts of the language.
1. YANOV, Yu 1. Logical operator schemes. Kybernetika 1, (1958).
Acknowledgments. Many axiomatic treatments of com- 2. IGARASHI, S. An axiomatic approach to equivalence problems
puter programming [1, 2, 3] tackle the problem of proving of algorithms with applications. Ph.D. Thesis 1964. Rep.
the equivalence, rather than the correctness, of algorithms. Compt. Centre, U. Tokyo, 1968, pp. 1-101.
3. DE BAKKER, J. W. Axiomatics of simple assignment statements.
Other approaches [4, 5J take recursive functions rather M.R. 94, Mathematisch Centrum, Amsterdam, June 1968.
than programs as a starting point for the theory. The 4. MCCARTHY,J. Towards a mathematical theory of computation.
suggestion to use axioms for defining the primitive opera- Proc. IFIP Congo 1962, North Holland Pub. Co., Amsterdam,
tions of a computer appears in [6, 7J. The importance of 1963.
program proofs is clearly emphasized in [9J, and an in- 5. BURSTALL, R. Proving properties of programs by structural in-
duction. Experimental Programming Reports: No. 17 DMIP,
formal technique for providing them is described. The Edinburgh, Feb. 1968.
suggestion that the specification of proof techniques pro- 6. VAN WIJNGAARDEN, A. Numerical analysis as an independent
vides an adequate formal definition of a programming science. BIT 6 (1966), 66-81.
language first appears in [8J.The formal treatment of pro- 7. LASKI, J. Sets and other types. ALGOL Bull. 27,1968.
gram execution presented in this paper is clearly derived 8. FLOYD, R. W. Assigning meanings to programs. Proc. Amer.
Math. Soc. Symposia in Applied Mathematics, Vol. 19, pp.
from Floyd. The main contributions of the author appear 19-31.
to be: (1) a suggestion that axioms may provide a simple 9. NAUR, P. Proof of algorithms by general snapshots. BIT 6
solution to the problem of leaving certain aspects of a (1966), 310-316.

Volume 12 / Number 10 / October, 1969 Communications of the ACM 583