2

Every formulation of the strongest postcondition predicate transformer I have seen presents the assignment rule as follows:

sp(X:=E, P) = ∃v. (X=E[v/X] ∧ P[v/X])

I am wondering, why is the existential (and thus the existentially quantified variable "v") necessary in the above rule? It seems to me the strongest postconditions predicate transformer is almost identical to symbolic evaluation, in that you maintain a state (a mapping from variables to values) and a path condition (a predicate that must be true at a particular point in the program). Yet, symbolic evaluation does not rely on an existential quantifier.

So, I think I must be missing something here. Any help is appreciated!

user3712482
  • 103
  • 1
  • 8

1 Answers1

1

I will give some intuitive description, since you have some knowledge in symbolic evaluation

If you have an arbitrary map to variables, you can not say anything about future state changes in the program before looking at them during the analysis.

Symbolical evaluation remembers each chosen path[as state space seperation], so it does not need to be contained in the evaluation formula to solve.

Here however you argue about every possible path and thus need an arbitrary formula to describe the behavior.

Assuming you would keep the variable in the formula, then you would argue about only 1 path of the possible runs. If you know that your variable does not induce other paths, then you can simplify this behavior.

Having however weakest liberal precondition, you know from which possible path you start and wrap all paths together to proof properties about your system.

Jay-Pi
  • 343
  • 3
  • 13