Lecture Notes on Invariants for While Loops and Arbitrary Loops

The previous lecture provided axioms for compositional reasoning about deterministic sequential programs. All the axioms compositionally reduce the truth of a postcondition of a more complex program to a logical combination of postconditions of simpler programs. All axioms? Well, all the axioms but one: those about loops. But putting loops aside for the moment, these axioms completely tell us what we need to do to understand a program. All we need to do is to identify the top-level operator of the program and apply the corresponding axiom from its left hand side to its structurally simpler right hand side, which will eventually reduce the property of a program to first-order logic with arithmetic but without programs. This process is completely systematic. So except for the (nontrivial) fact that we will have to hope that an SMT solver will be able to handle the remaining arithmetic, our “only” problem is what we could possibly to with a loop. The unwinding axioms from the previous lecture were only partially helpful, which is why this lecture investigates more comprehensive reasoning techniques for loops. We follow an entirely systematic approach [Pla17, Chapter 7] to understanding loop invariants, an induction technique for loops, which is of central significance for program verification. We will also experience our share of the important phenomenon of loop invariant search.