An Axiomatic Basis for of axioms it is possible to deduce such simple theorems as: Computer Programming x=x+yXO y<r ~r +y X q = (r- y) +y X (1 +q) The proof of the second of these is: C. A. R. HOARE The Queen's University of Belfast,* Northern Ireland A5 (r--y) + y X (l+q) = (r--y)+ (yXl+yXq) In this paper an attempt is made to explore the logical founda- A9 = (r-- y) + (y +y X q) tions of computer programming by use of techniques which were first applied in the study of geometry and have later A3 = ((r--y)+y)+yXq been extended to other branches of mathematics. This in- A6 = r + y X q providedy < r volves the elucidation of sets of axioms and rules of inference The axioms A1 to A9 are, of course, true of the tradi- which can be used in proofs of the properties of computer tional infinite set of integers in mathematics. However, programs. Examples are given of such axioms and rules, and they are also true of the finite sets of "integers" which are a formal proof of a simple theorem is displayed. Finally, it is argued that important advantages, both theoretical and prac- manipulated by computers provided that they are con- fined to nonnegative numbers. Their truth is independent tical, may follow from a pursuance of these topics. of the size of the set; furthermore, it is largely independent KEY WORDS AND PHRASES: axiomatic method, theory of programming' of the choice of technique applied in the event of "over- proofs of programs, formal language definition, programming language flow"; for example: design, machine-independentprogramming, program documentation CR CATEGORY: 4.0, 4.21,4.22, 5.20, 5.21,5.23, 5.24 (1) Strict interpretation: the result of an overflowing operation does not exist; when overflow occurs, the offend- ing program never completes its operation. Note that in this case, the equalities of A1 to A9 are strict, in the sense that both sides exist or fail to exist together. (2) Firm boundary: the result of an overflowing opera- tion is taken as the maximum value represented. (3) Modulo arithmetic: the result of an overflowing 1. Introduction operation is computed modulo the size of the set of integers represented. Computer programming is an exact science in that all These three techniques are illustrated in Table II by the properties of a program and all the consequences of addition and multiplication tables for a trivially small executing it in any given environment can, in principle, model in which 0, 1, 2, and 3 are the only integers repre- be found out from the text of the program itself by means sented. of purely deductive reasoning. Deductive reasoning in- It is interesting to note that the different systems satisfy- volves the application of valid rules of inference to sets of ing axioms A1 to A9 may be rigorously distinguished from valid axioms. It is therefore desirable and interesting to each other by choosing a particular one of a set of mutually elucidate the axioms and rules of inference which underlie exclusive supplementary axioms. For example, infinite our reasoning about computer programs. The exact choice arithmetic satisfies the axiom: of axioms will to some extent depend on the choice of programming language. For illustrative purposes, this A10z ~3xVy (y < x), paper is confined to a very simple language, which is effec- where all finite arithmetics satisfy: tively a subset of all eurrent procedure-oriented languages. A10~ Vx (x < max) 2. Computer Arithmetic where "max" denotes the largest integer represented. The first requirement in valid reasoning about a pro- Similarly, the three treatments of overflow may be gram is to know the properties of the elementary operations distinguished by a choice of one of the following aMoms which it invokes, for example, addition and multiplication relating to the value of max + 1: of integers. Unfortunately, in several respects computer arithmetic is not the same as the arithmetic familiar to Alls ~ 3x (x = max + 1) (strict interpretation) mathematicians, and it is necessary to exercise some care in selecting an appropriate set of axioms. For example, the All, max + 1 = max (firm boundary) axioms displayed in Table I are rather a small selection AllM max + 1 = 0 (modulo arithmetic) of axioms relevant to integers. From this incomplete set Having selected one of these axioms, it is possible to * Depurtment of Computer Science use it in deducing the properties of programs; however, 576 Communications of the ACM Volume 12 / Number 10 / October, 1969 of mathematical logic to express these assertions, and the TABLE I familiar rules of operator precedence have been used A1 x+y=y+x addition is commutative wherever possible to improve legibility. A2 xXy=yXx multiplication is commut- In many cases, the validity of the results of a program ative (or part of a program) will depend on the values taken A3 (x + y) + z = x+ (y + z) addition is associative by the variables before that program is initiated. These A4 (xX y) X z = x X (yX z) multiplication is associa- tive initial preconditions of successful use can be specified by A5 xX (y+z) = xX y+xX z multiplication distrib- the same type of general assertion as is used to describe utes through addition the results obtained on termination. To state the required A6 y<xD (x-- y)+y = x addition cancels subtrac- connection between a precondition (P), a program (Q) tion and a description of the result of its execution (R), we A7 x+0 = x A8 xX0=0 introduce a new notation: A9 xXl=x P{Q}R. This may be interpreted "If the assertion P is true before initiation of a program Q, then the assertion R will be true on its completion." If there are no preconditions im- TABLE II posed, we write true {Q}R) The treatment given below is essentially due to Floyd 1. StrictInterpretation [8] but is applied to texts rather than flowcharts. + 01 23 x 012 3.1. Axiom OF ASSIGNMENT 0 0 1 2 3 0 000 Assignment is undoubtedly the most characteristic fea- 1 123 * 1 012 2 2 3 * * 2 02* ture of programming a digital computer, and one that 3 3 * * * 3 03* most clearly distinguishes it from other branches of mathe- • nonexistent matics. It is surprising therefore that the axiom governing our reasoning about assignment is quite as simple as any 2. FirmBoundary to be found in elementary logic. + 123 × 0123 Consider the assignment statement: 123 0 0000 233 1 0123 x:=f 333 2 0233 where 333 3 0333 x is an identifier for a simple variable; 3. Modulo Arithmetic f is an expression of a programming language without + 012 3 X 0 1 2 side effects, but possibly containing x. Now any assertion P (x) which is to be true of (the value 0 0 1 2 3 0 000 1 123 0 1 0 1 2 of) x after the assignment is made must also have been 2 230 1 2 020 true of (the value of) the expression f, taken before the 3 3 0 1 2 3 0 3 2 assignment is made, i.e. with the old value of x. Thus if P (x) is to be true after the assignment, then P (f) must be true before the assignment. This fact may be expressed more formally: these properties will not necessarily obtMn, unless the DO Axiom of Assignment program is executed on an implementation which satisfies -P0 {x := f} P the chosen axiom. where x is a variable identifier; 3. Program Execution f is an expression; As mentioned above, the purpose of this study is to P0 is obtained from P by substituting f for all occur- provide a logical basis for proofs of the properties of a rences of x. program. One of the most important properties of a pro- It may be noticed that DO is not really an axiom at all, gram is whether or not it carries out its intended function. but rather an axiom schema, describing an infinite set of The intended function of a program, or part of a program, axioms which share a common pattern. This pattern is can be specified by making general assertions about the described in purely syntactic terms, and it is easy to values which the relevant variables will take after execution cheek whether any finite text conforms to the pattern, of the program. These assertions will usually not ascribe thereby qualifying as an axiom, which may validly appear particular values to each variable, but will rather specify in any line of a proof. certain general properties of the values and the relation- 1 If this can be proved in our formal system, we use the familiar ships holding between them. We use the normal notations logical symbol for theoremhood: [-P {Q} R Volume 12 / Number 10 / October, 1969 Communications of the ACM 577 3.2. RULES OF CONSEQUENCE no iterations). Furthermore, it is known that the con- In addition to axioms, a deductive science requires at trolling condition B is false when the iteration finally least one rule of inference, which permits the deduction of terminates. A slightly more powerful formulation is pos- new theorems from one or more axioms or theorems al- sible in light of the fact that B may be assumed to be true ready proved. A rule of inference takes the form "If ~-X on initiation of S: and ~- Y then ~-Z", i.e. if assertions of the form X and Y D3 Rule of Iteration have been proved as theorems, then Z also is thereby If ~P A B{S}P then ~-P{while B do S} ~B A P proved as a theorem.