Temporal preconditions of recursive procedures

Abstract

The meaning of an imperative program is defined to be the precondition of the executions as a function of proposed behaviour. In the case of Dijkstra's weakest precondition, the proposed behaviour is termination in a state with a given postcondition. For the temporal predicate transformers of Lukkien, the proposed behaviour is specified in terms of predicates on the intermediate states. For example, for a command c and predicates p, q and r, the predicate wto.p.q.c.r is the precondition such that, for every execution sequence of c, a state in which p holds is eventually followed by a state in which q holds or by termination in a state in which r holds.

We present these precondition functions for a language with operators for sequential composition, unbounded demonic choice and recursive procedures. Recursion is interpreted by means of extreme fixpoints. The treatment of “eventually” is a straightforward generalization of the ordinary wp-calculus. For the treatment of “leads-to”, the new concept of accumulator turns out to be useful. The proofs of Lukkien's healthiness laws lead to insights in fixpoint induction. Some of the laws require the recursion to be guarded. It is shown that unfolding of the declaration preserves the semantics.