Partial correctness

The data in Figure 4.3 show that Baeyer s theory is only partially correct. Cyclopropane and cyclobutane are indeed strained, just as predicted, but cyclopentane is more strained than predicted, and cyclohexane is strain-free. Cycloalkanes of intermediate size have only modest strain, and rings of 14 carbons or more are strain-free. Why is Baeyer s theory wrong ... 

It is probably true that many of the descriptions of physical and solid state reaction mechanisms now existing in the literature are only partially correct. It would appear that part of the frontier of knowledge for Chemistry of The Solid State wiU lie in measurement of physical and chemical properties of inorgcuiic compounds as a function of purity. 

In a recent study, serum ascorbate concentrations were significantly reduced in a group of elderly diabetic patients (w = 40, mean age 69 years) in comparison with an age-matched group of non-diabetic controls ( = 22, mean age 71 years), and this reduction was more pronounced in those patients with microangiopathy (Sinclair et al., 1991). Diabetic patients were shown to have a high serum dehydroascorbate/ascorbate ratio indicative of increased oxidative stress. Ascorbate deficiency was partially corrected by vitamin C supplementation, 1 g daily by mouth, but the obvious disturbance in ascorbate metabolism in the diabetic patients was accentuated, since serum ascorbate concentrations fell (after the initial rise) despite continued vitamin C supplementation (Fig. 12.3). 

Mathematically it would make no sense to define an absolute concept of correctness. We define only a relative concept. The definition of partial correctness is designed to capture the idea that a program viien fed with a proper input or inputs -an input vector satisfying some input criterion - will give, if and when it halts, an output or outputs fulfilling some designated criterion. 

DEFINITION Program (P,I) is partially correct with respect to input criterion A(X) and output criterion B(X,Z) if for all a in Dn, whenever A(a) = TRUE... 

Partial correctness is analogous to weak equivalence in that it is a sort of fail-safe condition. If A(a) = FALSE the input criterion is invalid and a presumably never occurs as input and so we make no claims as to the behavior of program (P,I) with "bad" input. If (P,I,a) does not halt there is no output and this is also regarded as a don t-care situation. There are fairly realistic situations where we would be perfectly satisfied with this sort of "correctness" -for example, in data security or protection systems. We presume - or have enpirical evidence - that the system does not fail often or catastrophically and wish to know that when it is working and output is given (of whatever kind, for the output could be just internal transfer of data) then the result is "good" or, more likely, nothing "bad" happens. 

Statements of either partial or of total correctness can be rendered meaningless by choice of A or B. For example, any program that always loops is partially correct for any A and B while any program is partially correct for B if B is defined as TRUE everywhere, and any program is totally correct with respect to A and B if A is defined as FALSE everywhere. 

However, what we can say is that if (P,I) is partially correct with respect to A and B, then some choice of inductive assertions will work - there are inductive assertions (but we may of course not be able to find them) which assigned to the A, make V X V Y W(P,A,B,I) true. 

Under this definition, Aj. is partial computable, if A is, but not necessarily computable and of course if we had a handy way of expressing and computing this sort of A we could easily verify cur program ad hoc.) So let us assume that (P,I) is partially correct with respect to A and B and see what this means. 

Of course we are usually interested in verifying not just partial correctness but also total correctness. We can do so using a variant of the previous methods, using now a formula 3 X V f [A(X) a W(P,A,N0T B,D]. ... 

Send verification conditions into a THEOREM PROVER. If all conditions are proven correct, print "PARTIALLY CORRECT WITH RESPECT TO A AND B ". If any verification condition is either proven incorrect by the THEOREM PROVER or else is rejected or not handled by the THEOREM PROVER, return to either 2) or 3), calling for new input. 

A variant of the method discussed in this chapter has been proposed by C. A. R. Hoare using a set of axioms and rules of inference to establish partial correctness of programs. The method of Hoare appears more flexible in that axioms and rules can be introduced to cover various constructs of particular programming languages and their implementations, but also appears, at least to this author, even more cumbersome and unwieldy than the Floyd-Manna-King approach when applied to simple flowchart-like programs. The formal mathematical justification for both approaches is the same. Basically, the approach used to date employs "forward substitution" from hypothesis assertion to conclusion assertion while the Hoare... 

What does all this mean in a practical way Certainly we have no intention of writing programs for all partially computable functions indeed time and space considerations do not allow execution of all partially computable functions. The functions actually computed form a very small subset of the primitive recursive functions. We do not know, however, whether they fall into a class for which partial correctness is partially decidable one suspects not. In any case, since we obtain our undecidability results for programs with very simple structure, there can be nothing in the structure of "real" programs which will allow us by and of itself to conclude that the properties of interest are at least partially decidable. 

First we discuss a version of the verification procedure which provides a sufficient condition for partial correctness - if the procedure gives a positive answer, then tie program is indeed partially correct for the given input and output criteria. However, the condition is not necessary - the program can be partially correct yet no choice of inductive assertions will make the procedure "work". This leads us to the complete procedure, which is rather more complex and lengthy. 

After all this has been done, we apply the usual verification procedure to the main program and to each procedure body - constructing verification conditions and sending them to a THEOREM PROVER just as before. We claim that if all the verification conditions hold for the main program and all procedures, then the whole program is partially correct for A and B. ... 

Unfortunately this procedure will not work even in sane very simple cases where partial correctness is transparent. Consider the very trivial program ... 

Now we have a method that is both necessary and sufficient to demonstrate partial correctness. We have already seen that if these verification conditions all hold, then the program is indeed partially correct for the given criteria. The arguments used in Chapter V can be adapted to show that if partial correctness holds, then some choice of inductive assertions will make the verification conditions true. 

We take a somewhat different approach in Chapter V in discussing partial correctness for arbitrary programs. From a program scheme P one constructs a quantifier-free wff W(P,A,B) which contains besides the predicate and function letters of P, special predicate letters A and B plus others A, ...,A. ... 

---