Axiomatic Semantics
Axiomatic Semantics
Assertions:
The logical expressions used in axiomatic semantics are called
predicates, or assertions. An assertion immediately preceding a
program statement describes the constraints on the program variables
at that point in the program.
An assertion immediately following a statement describes the new
constraints on those variables (and possibly others) after execution of
the statement. These assertions are called the precondition and
postcondition, respectively, of the statement. For two adjacent
statements, the postcondition of the first serves as the precondition of
the second. Developing an axiomatic description or proof of a given
program requires that every statement in the program has both a
precondition and a postcondition.
In the following sections, we examine assertions from the point of
view that preconditions for statements are computed from given
postconditions, although it is possible to consider these in the opposite
sense. We assume all variables are integer type. As a simple example,
consider the following assignment statement and postcondition:
sum = 2 * x + 1 {sum > 1}
Weakest Preconditions
The weakest precondition is the least restrictive precondition that will
guarantee the validity of the associated postcondition. For example, in
the statement and postcondition given in Section 3.5.3.1, {x > 10}, {x
> 50}, and {x > 1000} are all valid preconditions. The weakest of all
preconditions in this case is {x > 0}.
Assignment Statements
The precondition and postcondition of an assignment statement
together define precisely its meaning. To define the meaning of an
assignment statement, given a postcondition, there must be a way to
compute its precondition from that postcondition.
Let x = E be a general assignment statement and Q be its
postcondition.
Then, its precondition, P, is defined by the axiom
P = QxSE
which means that P is computed as Q with all instances of x replaced
by E. For example, if we have the assignment statement and
postcondition
a = b / 2 - 1 {a < 10}
the weakest precondition is computed by substituting b / 2 - 1 for a in
the postcondition {a < 10}, as follows:
b / 2 - 1 < 10
b < 22
Thus, the weakest precondition for the given assignment statement
and postcondition is {b < 22}