3.1 Logic of local states

For our analysis of the structural features of Hoare logics, the distinction between program variables $\mathbf{PVar}$ and array variables $\mathbf{AVar}$ is irrelevant; thus, we work, from now on, only with the set $\mathbf{Var}\triangleq\mathbf{PVar}\uplus\mathbf{AVar}$ where we refer to the elements of $\mathbf{Var}$ also simply as “program variables.”

Contexts and Local States: Any program c will at most change the values of the program variables in the finite set $pvr(c)\subseteq\mathbf{Var}$ of all program variables appearing in c. ^{Footnote 1} Program c may, however, be part of different bigger programs $c';$ thus, we should consider any finite set $\gamma\subseteq\mathbf{Var}$ with $pvr(c)\subseteq\gamma$ as a potential context of c. Therefore, we transform the infinite set $\mathbf{Var}$ of program variables into the partial order category ^{Footnote 2} $\mathsf{Cont}$ with ${|{\mathsf{Cont}}|}\triangleq\wp_{fin}(\mathbf{Var})$ , that is, the set of all finite contexts, and with morphisms all inclusion functions $in_{\gamma,\gamma'}:\gamma\hookrightarrow\gamma'$ corresponding to inclusions $\gamma\subseteq\gamma'$ .

The semantics of a context $\gamma\in{|{\mathsf{Cont}}|}=\wp_{fin}(\mathbf{Var})$ is the corresponding set of local states $\Sigma_{\gamma}\triangleq(\gamma\to\mathbb{D})$ , that is, of all type compatible functions ${\sigma}:\gamma\to\mathbb{D}$ where $\mathbb{D}\triangleq\mathbb{Z}\uplus(\mathbb{Z}\to\mathbb{Z})$ . Any inclusion function $in_{\gamma,\gamma'}:\gamma\hookrightarrow\gamma'$ induces a reduction map $p_{\gamma',\gamma}:\Sigma_{\gamma'}\to\Sigma_{\gamma}$ given by precomposition:

(2) \begin{equation} p_{\gamma',\gamma}({\sigma}')\triangleq in_{\gamma,\gamma'};\;{\sigma}'\quad \mbox{for all local states} \;\;{\sigma}'\in\Sigma_{\gamma'}=(\gamma'\to\mathbb{D}).\end{equation}

The assignments $\gamma\mapsto\Sigma_{\gamma}$ and $in_{\gamma,\gamma'}\mapsto p_{\gamma',\gamma}$ define a functor $\mathtt{st}:\mathsf{Cont}^{op}\to\mathsf{Set}$ .

Extended Contexts and Local State Assertions: In Hoare logic, assertions are used to describe properties of states. Assertions are built upon expressions which, in turn, are built upon program variables and logical variables. Only logical variables are quantified in assertions and the semantics of expressions and assertions depends only on program variables and free logical variables.

An assertion contains, besides finitely many program variables, only finitely many logical variables. Thus, we will work, besides contexts $\gamma\in\wp_{fin}(\mathbf{Var})$ , also with finite sets $\delta\in\wp_{fin}(\mathbf{LVar})$ of (free) logical variables and use the term “(variable) declaration” for those finite sets of logical variables (see Examples 1, 2, 3). Indeed, modern implementations of tools built on top of Hoare logic are based on finite contexts of program and logical variables (see Bubel and HÄhnle Reference Bubel and Hähnle2016; Leino Reference Leino2010; Martini Reference Martini2020; Pierce et al. Reference Pierce, de Amorim, Casinghino, Gaboardi, Greenberg, Hriţcu, Sjöberg, Tolmach and Yorgey2018a).

In such a way, we can extend the category $\mathsf{Cont}$ to a category ${\overline{\mathsf{Cont}}}$ with objects ${|{{\overline{\mathsf{Cont}}}}|}\triangleq\wp_{fin}(\mathbf{Var})\times\wp_{fin}(\mathbf{LVar})$ pairs of finite sets of local variables, also called “extended contexts,” and morphisms given by pairs of inclusion functions $\;(in_{\gamma,\gamma'},in_{\delta,\delta'}):(\gamma,\delta)\to(\gamma',\delta')$ .

The semantics of a declaration $\delta\in\wp_{fin}(\mathbf{LVar})$ is the set of local environments $\varGamma_{\delta}\triangleq(\delta\to\mathbb{Z})$ , that is, of all functions ${\alpha}:\delta\to\mathbb{Z}$ . Analogously to contexts, any inclusion function $in_{\delta,\delta'}:\delta\hookrightarrow\delta'$ between declarations induces a reduction map $p_{\delta',\delta}:\varGamma_{\delta'}\to\varGamma_{\delta}$ given by precomposition:

(3) \begin{equation} p_{\delta',\delta}({\alpha}')\triangleq in_{\delta,\delta'};\;{\alpha}'\quad \mbox{for all local environments} \;\;{\alpha}'\in\varGamma_{\delta'}=(\delta'\to\mathbb{Z}).\end{equation}

We can extend the functor $\mathtt{st}:\mathsf{Cont}^{op}\to\mathsf{Set}$ to a functor ${\overline{\mathtt{st}}}:{\overline{\mathsf{Cont}}}^{op}\to\mathsf{Set}$ that assigns to each “extended context” $\lambda=(\gamma,\delta)$ the corresponding set $\varLambda_{\lambda}\triangleq\Sigma_{\gamma}\times\varGamma_{\delta}$ of “extended local states” and to each pair $in_{\lambda,\lambda'}\triangleq (in_{\gamma,\gamma'},in_{\delta,\delta'}):\lambda\to\lambda'$ of inclusion functions the product $p_{\lambda',\lambda}\triangleq p_{\gamma',\gamma}\times p_{\delta',\delta} :\varLambda_{\lambda'}\to\varLambda_{\lambda}$ of reduction maps.

Local State Assertions: We consider for any extended context $\lambda=(\gamma,\delta)\in{|{{\overline{\mathsf{Cont}}}}|}=\wp_{fin}(\mathbf{Var})\times\wp_{fin}(\mathbf{LVar})$ the corresponding set of local state assertions:

(4) \begin{equation} \mathtt{assn}(\lambda)=\mathtt{assn}(\gamma,\delta)\triangleq\{P\in\mathbf{Assn}\mid pvr(P)\subseteq\gamma, flv(P)\subseteq\delta\},\end{equation}

where flv(P) is the set of all free logical variables appearing in P. For any morphism $in_{\lambda,\lambda'}= (in_{\gamma,\gamma'},in_{\delta,\delta'}):\lambda\to\lambda'$ in ${\overline{\mathsf{Cont}}}$ , we do have $\mathtt{assn}(\lambda)\subseteq\mathtt{assn}(\lambda')$ since $pvr(P)\subseteq\gamma$ entails $pvr(P)\subseteq\gamma'$ and $flv(P)\subseteq\delta$ entails $flv(P)\subseteq\delta'$ , respectively. That is, we obtain an inclusion function $\mathtt{assn}(in_{\lambda,\lambda'}):\mathtt{assn}(\lambda)\hookrightarrow\mathtt{assn}(\lambda')$ . The assignments $\lambda\mapsto\mathtt{assn}(\lambda)$ and $in_{\lambda,\lambda'}\mapsto\mathtt{assn}(in_{\lambda,\lambda'})$ define obviously a functor $\mathtt{assn}:{\overline{\mathsf{Cont}}}\to\mathsf{Set}$ .

Satisfaction Relation: The usual inductive definition of the infinite version of satisfaction of assertions can be easily modified for local state assertions. We get, in such a way, a ${|{{\overline{\mathsf{Cont}}}}|}$ -indexed family of satisfaction relations between extended local states, on one side, and local state assertions, on the other side:

\begin{equation*} \models_{\lambda} \,\subseteq\, \varLambda_{\lambda}\times \mathtt{assn}(\lambda)\quad \mbox{with}\; \lambda\in{|{{\overline{\mathsf{Cont}}}}|}=\wp_{fin}(\mathbf{Var})\times\wp_{fin}(\mathbf{LVar}).\end{equation*}

Moreover, satisfaction is compatible w.r.t. morphisms in ${\overline{\mathsf{Cont}}}$ :

Proposition 2 (Satisfaction Condition) For any morphism $in_{\lambda,\lambda'} = (in_{\gamma,\gamma'},in_{\delta,\delta'}) :\lambda\to\lambda'$ in ${\overline{\mathsf{Cont}}}$ , any extended local state $({\sigma}',{\alpha}')\in\varLambda_{\lambda'} $ and any local state assertion $P\in\mathtt{assn}(\lambda)$ we have

\begin{equation*} p_{\lambda',\lambda}({\sigma}',{\alpha}')=(p_{\gamma',\gamma}({\sigma}'),p_{\delta',\delta}({\alpha}'))\; \models_{\lambda}\; P \quad \mbox{iff}\quad ({\sigma}',{\alpha}')\; \models_{\lambda'}\; \mathtt{assn}(in_{\lambda,\lambda'})(P)=P. \end{equation*}

As shown in Wolter et al. (Reference Wolter, Martini and Haeusler2012), this allows us to define the semantics of assertions based on the contravariant power set construction.

Semantics of Local State Assertions: Any subset of $\varLambda_{\lambda}=\Sigma_{\gamma}\times\varGamma_{\delta}$ describes a certain property of extended local states and therefore we consider the elements of $\wp(\varLambda_{\lambda})$ also as “state predicates.”

A local state assertion $P\in \mathtt{assn}(\lambda)$ can be seen as the syntactic representation of a certain state predicate, namely of its semantics, that is, the set of all extended local states satisfying P:

(5) \begin{equation} \mathtt{sem}_{\lambda}(P)\triangleq\{({\sigma},{\alpha}) \in \varLambda_{\lambda} \mid ({\sigma},{\alpha}) \models_{\lambda} P\}\in\wp(\varLambda_{\lambda})\end{equation}

For all objects $\lambda$ in ${\overline{\mathsf{Cont}}}$ , this defines a function $\mathtt{sem}_{\lambda}:\mathtt{assn}(\lambda)\to \wp(\varLambda_{\lambda})$ . To answer the question if this family of functions constitutes a relevant natural transformation from local state assertions to semantics, we construct first the target of this natural transformation: Composing the functor ${\overline{\mathtt{st}}}^{op}:{\overline{\mathsf{Cont}}}\to\mathsf{Set}^{op}$ with the contravariant power set functor $\mathtt{P}:\mathsf{Set}^{op}\to\mathsf{Pre}$ , where $\mathsf{Pre}$ is the category of preorders and monotone functions, we obtain a functor $\mathtt{pred}:{\overline{\mathsf{Cont}}}\to\mathsf{Pre}$ with $\;\mathtt{pred}(\lambda)\triangleq (\wp(\varLambda_{\lambda}),\subseteq)$ for all objects $\lambda=(\gamma,\delta)\in{|{{\overline{\mathsf{Cont}}}}|}$ and with

\begin{equation*}\mathtt{pred}(in_{\lambda,\lambda'})\triangleq p_{\lambda',\lambda}^{-1}:(\wp(\varLambda_{\lambda}),\subseteq)\longrightarrow(\wp(\varLambda_{\lambda'},\subseteq)\,)\end{equation*}

for all morphisms $in_{\lambda,\lambda'}:\lambda\to\lambda'$ in ${\overline{\mathsf{Cont}}}$ , that is, for all state predicates $\mathcal{P}\subseteq\varLambda_{\lambda}$ we have

(6) \begin{equation} p_{\lambda',\lambda}^{-1}(\mathcal{P})= \{({\sigma}',{\alpha}') \in \varLambda_{\lambda'}\mid p_{\lambda',\lambda}({\sigma}',{\alpha}')=(p_{\gamma',\gamma}({\sigma}'), p_{\delta',\delta}({\alpha}')) \in \mathcal{P}\}.\end{equation}

Since the formation of inverse images is monotone w.r.t. set inclusions, we obtain indeed a functor from ${\overline{\mathsf{Cont}}}$ into $\mathsf{Pre}$ . Note that the preorders $\mathtt{pred}(\lambda)=(\wp(\varLambda_{\lambda}),\subseteq)$ are even partial orders.

Second, we can borrow the order relation in $(\wp(\varLambda_{\lambda}),\subseteq)$ , to define semantic entailment.

Semantic Entailment: For any local state assertions $P,Q\in \mathtt{assn}(\lambda)$ we define

(7) \begin{equation} P \Vdash_{\lambda} Q \quad \mbox{iff} \quad \mathtt{sem}_{\lambda}(P)\subseteq \mathtt{sem}_{\lambda}(Q).\end{equation}

In categorical terms, we extend the set $\mathtt{assn}(\lambda)$ to a preorder $\mathtt{ent}(\lambda)\triangleq(\mathtt{assn}(\lambda),\Vdash_{\lambda})$ in such a way that the function $\mathtt{sem}_{\lambda}:\mathtt{assn}(\lambda)\to \wp(\varLambda_{\lambda})$ turns into a morphism $\mathtt{sem}_{\lambda}:\mathtt{ent}(\lambda)\to\mathtt{pred}(\lambda)$ in the category $\mathsf{Pre}$ that not only preserves but also reflects order, that is, $\mathtt{sem}_{\lambda}$ is a full functor.

$ P\wedge Q\, \Vdash_{\lambda} R\, \quad \mbox{iff}\quad P\, \Vdash_{\lambda} (Q\to R).$

Proposition 2 entails, that for any morphism $in_{\lambda,\lambda'}:\lambda\to\lambda'$ in ${\overline{\mathsf{Cont}}}$ the corresponding inclusion function $\mathtt{assn}(in_{\lambda,\lambda'}): \mathtt{assn}(\lambda)\hookrightarrow\mathtt{assn}(\lambda')$ is monotone w.r.t. semantic entailment, that is, for all assertions $P,Q\in\mathtt{assn}(\lambda) $ we have that $P\Vdash_{\lambda} Q$ , that is, $\mathtt{sem}_{\lambda}(P)\subseteq \mathtt{sem}_{\lambda}(Q)$ , implies $P\Vdash_{\lambda'} Q$ , that is, $\mathtt{sem}_{\lambda'}(P)\subseteq \mathtt{sem}_{\lambda'}(Q)$ . This means that the inclusion function $\mathtt{assn}(in_{\lambda,\lambda'}): \mathtt{assn}(\lambda)\hookrightarrow\mathtt{assn}(\lambda')$ establishes, actually, a morphism $\mathtt{ent}(in_{\lambda,\lambda'})\triangleq \mathtt{assn}(in_{\lambda,\lambda'}): \mathtt{ent}(\lambda)\to\mathtt{ent}(\lambda')$ in the category $\mathsf{Pre}$ . In such a way, the functor $\mathtt{assn}:{\overline{\mathsf{Cont}}}\to\mathsf{Set}$ lifts up to a functor $\mathtt{ent}:{\overline{\mathsf{Cont}}}\to\mathsf{Pre}$ such that the composition of $\mathtt{ent}$ with the forgetful functor $\mathtt{carr}:\mathsf{Pre}\to\mathsf{Set}$ , assigning to each preorder its carrier set, equals $\mathtt{assn}$ .

Finally, Proposition 2 ensures also that the morphisms $\;\mathtt{sem}_{\lambda}:\mathtt{ent}(\lambda) \to(\wp(\varLambda_{\lambda}),\subseteq)$ constitute a natural transformation $\;\mathtt{sem}:\mathtt{ent}\Rightarrow\mathtt{pred}:{\overline{\mathsf{Cont}}}\to\mathsf{Pre}$ as stated in the following proposition (compare Lemma 3.7 in Wolter et al. Reference Wolter, Martini and Haeusler2012):

Proposition 3. The morphisms $\;\mathtt{sem}_{\lambda}:\mathtt{ent}(\lambda) \to\mathtt{pred}(\lambda)$ in $\mathsf{Pre}$ with $\lambda\in{|{{\overline{\mathsf{Cont}}}}|}$ constitute a natural transformation $\;\mathtt{sem}:\mathtt{ent}\Rightarrow\mathtt{pred}:{\overline{\mathsf{Cont}}}\to\mathsf{Pre}$ .

3.2 Local programs and state transition semantics

Programs are defined prior to and independent of logical variables and the semantics of programs are partial state transition maps between corresponding sets of states (see Definition 1). In this subsection, we develop a local finitary version of the state transition semantics of programs.

Local Programs – Syntax: “Local programs” are programs in a context; that is, for each context $\gamma$ we consider the corresponding set $\mathtt{prg}(\gamma)\triangleq\{c\in\textbf{Prg}\mid pvr(c)\subseteq\gamma \}$ of programs in context $\gamma$ . Our while-programs are sequential, that is, for any two local programs $c_1,c_2\in \mathtt{prg}(\gamma)$ there is a unique local program $c_1;\;c_2\in\mathtt{prg}(\gamma)$ and the concatenation operator $\_\,;\_$ is, in addition, assumed to be associative. Adding to $\mathtt{prg}(\gamma)$ an “empty program” ${\varepsilon}$ such that $c;\;{\varepsilon}={\varepsilon};\;c=c$ for all $c\in\mathtt{prg}(\gamma)$ , we upgrade $\mathtt{prg}(\gamma)$ to a monoid. We consider monoids as categories with exactly one object. In abuse of notation, we denote the syntactic category with the only object $\gamma$ and the set of morphisms $\mathtt{prg}(\gamma)$ , where composition is sequential concatenation of programs, also by $\mathtt{prg}(\gamma)$ . For any inclusion function $in_{\gamma,\gamma'}:\gamma\hookrightarrow\gamma',$ we get obviously an inclusion functor $\mathtt{prg}_{\gamma,\gamma'}:\mathtt{prg}(\gamma)\hookrightarrow\mathtt{prg}(\gamma')$ thus the assignments $\gamma\mapsto\mathtt{prg}(\gamma)$ and $in_{\gamma,\gamma'}\mapsto \mathtt{prg}_{\gamma,\gamma'}$ define a functor $\mathtt{prg}:\mathsf{Cont}\to\mathsf{Mon}$ .

Transitions of Local States: The semantics of a local program $c\in\mathtt{prg}(\gamma)$ is a partial function from the corresponding set $\Sigma_{\gamma}$ of local states into itself. To define this semantics precisely and in a well-structured way, we present, first, a brief account of those partial state transition maps.

We denote by $\mathsf{Par}$ the category of all sets and partial functions between sets. ^{Footnote 3} For any context $\gamma,$ we consider the monoid $\mathtt{pf}(\gamma)$ of local state transition maps with object $\Sigma_{\gamma}$ and the whole hom-set as morphisms. “ ${\mathtt{pf}}$ ” stands for “partial function.”

For any inclusion function $in_{\gamma,\gamma'}:\gamma\hookrightarrow\gamma',$ we can define a function that lifts any local state transition map to a local state transition map . The construction goes like this: we define the domain of definition $\mathrm{DD}({\tau'})\triangleq p_{\gamma',\gamma}^{-1}(\mathrm{DD}({\tau}))$ using the corresponding reduction map $p_{\gamma',\gamma}:\Sigma_{\gamma'}\to\Sigma_{\gamma}$ , defined in (2). Now we set for all $({\sigma}':\gamma'\to\mathbb{D})\in\mathrm{DD}({\tau'})\subseteq\Sigma_{\gamma'}$

(8)

Thus, we obtain, especially, $\tau';\;p_{\gamma',\gamma}= p_{\gamma',\gamma};\;\tau$ in $\mathsf{Par}$ . This ensures $\mathtt{pf}_{\gamma,\gamma'}(\tau_1;\;\tau_2)=\mathtt{pf}_{\gamma,\gamma'}(\tau_1);\;\mathtt{pf}_{\gamma,\gamma'}(\tau_2)$ for all . Moreover, the definition entails $\mathtt{pf}_{\gamma,\gamma'}(id_{\Sigma_{\gamma}})=id_{\Sigma_{\gamma'}}$ thus the function establishes a functor $\mathtt{pf}_{\gamma,\gamma'}:\mathtt{pf}(\gamma)\to\mathtt{pf}(\gamma')$ between the monoids $\mathtt{pf}(\gamma)$ and $\mathtt{pf}(\gamma^{\prime})$ .

We do have $\mathtt{pf}_{\gamma,\gamma}=id_{\mathtt{pf}(\gamma),}$ and for any inclusions $\gamma\subseteq\gamma'\subseteq\gamma'',$ we obtain $\mathtt{pf}_{\gamma,\gamma'};\;\mathtt{pf}_{\gamma',\gamma''}=\mathtt{pf}_{\gamma,\gamma''}$ since the formation of inverse images is compositional and since $\gamma''\setminus\gamma=(\gamma''\setminus\gamma')\cup (\gamma'\setminus\gamma)$ . In such a way, the assignments $\gamma\mapsto\mathtt{pf}(\gamma)$ and $in_{\gamma,\gamma'}\mapsto\mathtt{pf}_{\gamma,\gamma'}$ define a functor $\mathtt{pf}:\mathsf{Cont}\to\mathsf{Mon}$ .

Local Programs – State Transition Semantics: The state transition semantics of local programs is simply defined by restricting the global state transition semantics from Definition 1 to local programs and local states, respectively. We show that such a restriction of the

global semantics can be constructed in a way that we obtain a family $\mathtt{tr}_{\gamma}:\mathtt{prg}(\gamma)\to\mathtt{pf}(\gamma)$ , $\gamma\in{|{\mathsf{Cont}}|}$ of functors between monoids establishing a natural transformation $\mathtt{tr}:\mathtt{prg}\Rightarrow\mathtt{pf}$ . This natural transformation represents the state transition semantics of local programs.

First, we show that for any context $\gamma$ the global state transition semantics of programs restricts to a functorial state transition semantics for the corresponding local states: Analogously to (2), the inclusion function $in_{\gamma}:\gamma\hookrightarrow\mathbf{Var}$ induces a reduction map $p_{\gamma}:{\Sigma}\to\Sigma_{\gamma}$ with $p_{\gamma}({\varrho})\triangleq in_{\gamma};\;{\varrho}$ for all global states ${\varrho}\in{\Sigma}=(\mathbf{Var}\to\mathbb{D})$ . $p_{\gamma}:{\Sigma}\to\Sigma_{\gamma}$ is surjective since $\mathbb{D}$ is not empty. By means of $p_{\gamma,}$ we can restrict now for any local program $c\in\mathtt{prg}(\gamma)$ the partial function to a partial function : We define $\mathrm{DD}({\mathtt{tr}_{\gamma}(c)})\triangleq p_{\gamma}(\mathrm{DD}({[\![ c ]\!]}));$ thus, there exists for any local state ${\sigma}\in\mathrm{DD}({\mathtt{tr}_{\gamma}(c)})$ a global state ${\varrho}\in\mathrm{DD}({[\![ c ]\!]})$ with $p_{\gamma}({\varrho})={\sigma}$ and we can set $\mathtt{tr}_{\gamma}(c)({\sigma})\triangleq p_{\gamma}([\![ c ]\!]({\varrho}))$ . Why does this work?

Any program c changes at most the values for the program variables in pvr(c), that is, for any global state ${\varrho}\in\mathrm{DD}({[\![ c ]\!]})$ and any program variable $x\notin pvr(c)$ we have $[\![ c ]\!]({\varrho})(x)={\varrho}(x)$ . We defined $c\in\mathtt{prg}(\gamma)$ iff $prv(c)\subseteq\gamma$ , thus for any global states ${\varrho},{\varrho}'\in{\Sigma}$ it holds that ${\varrho}\in\mathrm{DD}({[\![ c ]\!]})$ and $p_{\gamma}({\varrho})=p_{\gamma}({\varrho}')$ implies ${\varrho}'\in\mathrm{DD}({[\![ c ]\!]})$ and $p_{\gamma}([\![ c ]\!]({\varrho}))=p_{\gamma}([\![ c ]\!]({\varrho}'))$ . This ensures that the definition of $\mathtt{tr}_{\gamma}(c)$ is independent of representatives as well as that the square (1) in the diagram above is a pullback in $\mathsf{Set}$ , that is, we have $[\![ c ]\!];\;p_{\gamma}=p_{\gamma};\;\mathtt{tr}_{\gamma}(c)$ in $\mathsf{Par}$ .

For any local programs $c_1,c_2\in\mathtt{prg}(\gamma)$ the compositionality $[\![ {c_1;\;c_2}]\!]=[\![ {c_1}]\!];\;[\![ {c_2}]\!]$ of global state transition semantics gives us compositionality $\mathtt{tr}_{\gamma}(c_1;\;c_2)=\mathtt{tr}_{\gamma}(c_1);\mathtt{tr}_{\gamma}(c_2)$ of the corresponding local state transition semantics at hand. Moreover, we set $\mathtt{tr}_{\gamma}({\varepsilon})\triangleq id_{\Sigma_{\gamma}}$ for the empty program ${\varepsilon}\in\mathtt{prg}(\gamma)$ . This ensures that the function establishes indeed a functor $\mathtt{tr}_{\gamma}:\mathtt{prg}(\gamma)\to\mathtt{pf}(\gamma)$ from the monoid $\mathtt{prg}(\gamma)$ into the monoid .

Second, we validate that the family $\mathtt{tr}_{\gamma}:\mathtt{prg}(\gamma)\to\mathtt{pf}(\gamma)$ , $\gamma\in{|{\mathsf{Cont}}|}$ of functors provides a natural transformation $\mathtt{tr}:\mathtt{prg}\Rightarrow\mathtt{pf}$ : For any morphism $in_{\gamma,\gamma'}:\gamma\to\gamma'$ in $\mathsf{Cont}$ we have the inclusion functor $\mathtt{prg}(in_{\gamma,\gamma'})=\mathtt{prg}_{\gamma,\gamma'}: \mathtt{prg}(\gamma)\hookrightarrow\mathtt{prg}(\gamma')$ and the functor $\mathtt{pf}(in_{\gamma,\gamma'})= \mathtt{pf}_{\gamma,\gamma'}:\mathtt{pf}(\gamma)\to\mathtt{pf}(\gamma')$ . To validate the naturality condition we show that

(9)

for each local program $c\in\mathtt{prg}(\gamma)\subseteq\mathtt{prg}(\gamma')$ .

Due to (8), we have $\mathtt{pf}_{\gamma,\gamma'}(\mathtt{tr}_{\gamma}(c));\;p_{\gamma',\gamma}= p_{\gamma',\gamma};\;\mathtt{tr}_{\gamma}(c)$ in $\mathsf{Par}$ . Since $p_{\gamma}=p_{\gamma'};\;p_{\gamma',\gamma}$ , the definition of the functors $\mathtt{tr}_{\_}$ entails $p_{\gamma'};\;\mathtt{tr}_{\gamma'}(c);\;p_{\gamma',\gamma}= p_{\gamma'};\;p_{\gamma',\gamma};\;\mathtt{tr}_{\gamma}(c)= p_{\gamma'};\;\mathtt{pf}_{\gamma,\gamma'}(\mathtt{tr}_{\gamma}(c));\;p_{\gamma',\gamma}$ and thus $\mathtt{tr}_{\gamma'}(c);\;p_{\gamma',\gamma}= p_{\gamma',\gamma};\;\mathtt{tr}_{\gamma}(c)= \mathtt{pf}_{\gamma,\gamma'}(\mathtt{tr}_{\gamma}(c));\;p_{\gamma',\gamma}$ in $\mathsf{Par}$ since $p_{\gamma'}$ is surjective, that is, epic, in $\mathsf{Par}$ . From the last equation we can conclude $\mathrm{DD}({\mathtt{tr}_{\gamma'}(c)})=\mathrm{DD}({\mathtt{pf}_{\gamma,\gamma'}(\mathtt{tr}_{\gamma}(c))})$ and that $\mathtt{tr}_{\gamma'}(c)({\sigma}')(x)= \mathtt{tr}_{\gamma}(c)(p_{\gamma',\gamma}({\sigma}'))(x)= \mathtt{pf}_{\gamma,\gamma'}(\mathtt{tr}_{\gamma}(c))({\sigma}')(x)$ for all ${\sigma}'\in\mathrm{DD}({\mathtt{tr}_{\gamma'}(c)})$ and all $x\in\gamma$ . For all $x\in\gamma'\setminus\gamma$ and thus also $x\notin pvr(c)$ , we have $\mathtt{tr}_{\gamma'}(c)({\sigma}')(x)={\sigma}'(x)= \mathtt{pf}_{\gamma,\gamma'}(\mathtt{tr}_{\gamma}(c))({\sigma}')(x)$ due to the properties of $[\![ c ]\!]$ , mentioned above, the definition of $\mathtt{tr}_{\gamma'}$ and the definition of $\mathtt{pf}_{\gamma,\gamma'}(\mathtt{tr}_{\gamma}(c))$ .

3.3 State transition maps as predicate transformers

Hoare triples are a logical means to describe and reason about the semantics of programs thereby relying on a corresponding logic of states. We consider here “local partial correctness assertions” $\lambda:{\{{P}\}\;{c}\;\{{Q}\}}$ and “local total correctness assertions” $\lambda:{[P]\;c\;[Q]}$ for extended contexts $\lambda=(\gamma,\delta)$ such that $c\in\mathtt{prg}(\gamma)$ and $P,Q\in\mathtt{assn}(\lambda)$ .

A correctness assertion is an assertion about the state transition semantics of the local program $c\in\mathtt{prg}(\gamma)$ and is represented by a pair of local state assertions – a precondition P describing properties of the “input states” ${\sigma}\in\Sigma_{\gamma}$ and a postcondition Q describing properties of the corresponding “output states” $\mathtt{tr}_{\gamma}(c)({\sigma})\in\Sigma_{\gamma}$ .

One can observe, however, that correctness assertions can be defined and investigated independent of programs namely as assertions about arbitrary state transition maps . Following this observation, we develop in this subsection a local version of the predicate transformer semantics, as introduced in Dijkstra (Reference Dijkstra1975), not only for programs but for arbitrary state transition maps. We consider as well total as partial correctness semantics and show that any of these semantics is equivalent to the state transition semantics.

Correctness Assertions: To underline the implicational “nature” of correctness assertions, we adapt an arrow notation for correctness assertions about arbitrary state transition maps.

1. (1). We say that a state transition map satisfies the implication $P\Rightarrow Q$ in the sense of “total correctness,” written $\tau\models_{\lambda} (TC,P\Rightarrow Q)$ , iff for all $({\sigma},{\alpha})\in\varLambda_{\lambda}=\Sigma_{\gamma}\times\varGamma_{\delta}$ we have that $({\sigma},{\alpha})\models_{\lambda}P$ implies ${\sigma}\in\mathrm{DD}({\tau})$ and $(\tau({\sigma}),{\alpha})\models_{\lambda}Q$ .

2. (2). Correspondingly, we say that a state transition map satisfies the implication $P\Rightarrow Q$ in the sense of “partial correctness,” written $\tau\models_{\lambda} (PC,P\Rightarrow Q)$ , iff for all $({\sigma},{\alpha})\in\varLambda_{\lambda}$ we have that $({\sigma},{\alpha})\models_{\lambda}P$ implies $(\tau({\sigma}),{\alpha})\models_{\lambda}Q$ or ${\sigma}\notin\mathrm{DD}({\tau})$ .

An essential observation is that, in both cases, the satisfaction statement for the precondition and the postcondition, respectively, refers to the same local environment ${\alpha}$ . This means that a correctness assertion can be seen as an implication with implicitly universally quantified free logical variables. On the other side, this gives us a hint how to extend state transition maps, in a reasonable way, to local environments: For any state transition map and any extended context $\lambda=(\gamma,\delta),$ we obtain an extended state transition map with

(10) \begin{equation} \mathrm{DD}({{\overline{\tau}}_{\delta}})\triangleq\mathrm{DD}({\tau})\times\varGamma_{\delta} \quad\mbox{and} \quad {\overline{\tau}}_{\delta}({\sigma},{\alpha})\triangleq (\tau({\sigma}),{\alpha}) \;\mbox{for all} \; ({\sigma},{\alpha})\in\mathrm{DD}({{\overline{\tau}}_{\delta}}).\end{equation}

Following Djikstra’s idea of “programs as predicate transformers,” we can give now an equivalent formulation of correctness assertions based on the semantics of assertions and the formation of inverse images. ^{Footnote 4}

1. (1). $\tau\models_{\lambda} (TC,P\Rightarrow Q)$ iff $\mathtt{sem}_{\lambda}(P)\subseteq\; (\tau\times id_{\varGamma_{\delta}})^{-1}(\mathtt{sem}_{\lambda}(Q))$ .

2. (2). $\tau\models_{\lambda} (PC,P\Rightarrow Q)$ iff $\mathtt{sem}_{\lambda}(P)\subseteq\; (\tau\times id_{\varGamma_{\delta}})^{-1}(\mathtt{sem}_{\lambda}(Q))\cup (\varLambda_{\lambda}\setminus(\mathrm{DD}({\tau})\times\varGamma_{\delta}))$ .

In Theorem 1, the state transition map $\tau$ serves as a predicate transformer in the sense that the formation of inverse images transforms the state predicate $\mathtt{sem}_{\lambda}(Q)$ into the state predicate ${\overline{\tau}}_{\delta}^{-1}(\mathtt{sem}_{\lambda}(Q))$ or ${\overline{\tau}}_{\delta}^{-1}(\mathtt{sem}_{\lambda}(Q))\cup \varLambda_{\lambda}\setminus\mathrm{DD}({{\overline{\tau}}})$ , respectively. In this subsection, we develop a full categorical account of these two kinds of predicate transformer semantics of state transition maps.

Extended State Transition Maps: To be able to relate and combine the logic of local states with the semantics of local programs, it is necessary to lift up the state transition semantics, developed in Subsection 3.2 for plain contexts, to extended contexts:

The functor ${\overline{\mathtt{prg}}}:{\overline{\mathsf{Cont}}}\to\mathsf{Mon}$ is simply defined by ${\overline{\mathtt{prg}}}(\lambda)\triangleq\mathtt{prg}(\gamma)=\{c\in\textbf{Prg}\mid pvr(c)\subseteq\gamma \}$ for all extended contexts $\lambda=(\gamma,\delta)\in{|{{\overline{\mathsf{Cont}}}}|}$ and by assigning to each morphism $in_{\lambda,\lambda'} = (in_{\gamma,\gamma'},in_{\delta,\delta'}) :\lambda\to\lambda'$ in ${\overline{\mathsf{Cont}}}$ the inclusion functor ${\overline{\mathtt{prg}}}_{\lambda,\lambda'}=\mathtt{prg}_{\gamma,\gamma'}:{\overline{\mathtt{prg}}}(\lambda)\hookrightarrow{\overline{\mathtt{prg}}}(\lambda')$ .

The definition of extended state transition maps in (10) is the key ingredient to lift up the functor $\mathtt{pf}:\mathsf{Cont}\to\mathsf{Mon}$ to a functor ${\overline{\mathtt{pf}}}:{\overline{\mathsf{Cont}}}\to\mathsf{Mon}$ : Let be given an extended context $\lambda=(\gamma,\delta)$ . It is easy to verify that we have $(\overline{\tau;\;\tau'})_{\delta}={\overline{\tau}}_{\delta};\;\overline{\tau'}_{\delta}$ for arbitrary state transition maps thus we can choose ${\overline{\mathtt{pf}}}(\lambda)$ to be the submonoid of given by all extended state transition maps with . Note, that $\mathtt{pf}(\gamma)$ and ${\overline{\mathtt{pf}}}(\lambda)$ are isomorphic, that is, for each declaration $\delta$ we produce a “copy” of $\mathtt{pf}(\gamma)$ ! For any morphism $in_{\lambda,\lambda'}= (in_{\gamma,\gamma'},in_{\delta,\delta'}):\lambda\to\lambda'$ in ${\overline{\mathsf{Cont}}}$ , we can extend the functor $\mathtt{pf}_{\gamma,\gamma'}:\mathtt{pf}(\gamma)\to\mathtt{pf}(\gamma')$ to a functor ${\overline{\mathtt{pf}}}_{\lambda,\lambda'}:{\overline{\mathtt{pf}}}(\lambda)\to{\overline{\mathtt{pf}}}(\lambda')$ assigning to any extended state transition map in ${\overline{\mathtt{pf}}}(\lambda)$ the extended state transition map in ${\overline{\mathtt{pf}}}(\lambda')$ . Our construction transforms equation (8)

$\mathtt{pf}_{\gamma,\gamma'}(\tau);p_{\gamma',\gamma}= p_{\gamma',\gamma};\tau\,$ in $\mathsf{Par}$ into the equation

(11) \begin{equation} {\overline{\mathtt{pf}}}_{\lambda,\lambda'}({\overline{\tau}}_{\delta});\;p_{\lambda',\lambda}= p_{\lambda',\lambda};\;{\overline{\tau}}_{\delta} \end{equation}

in $\mathsf{Par}$ for the product $p_{\lambda',\lambda}= p_{\gamma',\gamma}\times p_{\delta',\delta} :\varLambda_{\lambda'}\to\varLambda_{\lambda}$ of reduction maps.

This ensures that we have indeed defined a functor ${\overline{\mathtt{pf}}}_{\lambda,\lambda'}:{\overline{\mathtt{pf}}}(\lambda)\to{\overline{\mathtt{pf}}}(\lambda')$ between the monoids ${\overline{\mathtt{pf}}}(\lambda)$ and ${\overline{\mathtt{pf}}}(\lambda')$ . Moreover, it can be shown, analogously to Subsection 3.2, that ${\overline{\mathtt{pf}}}_{\lambda,\lambda}=id_{{\overline{\mathtt{pf}}}(\lambda)}$ and that ${\overline{\mathtt{pf}}}_{\lambda,\lambda'};\;{\overline{\mathtt{pf}}}_{\lambda',\lambda''}={\overline{\mathtt{pf}}}_{\lambda,\lambda''}$ for any inclusions $\lambda\subseteq\lambda'\subseteq\lambda'';$ thus, the assignments $\lambda\mapsto{\overline{\mathtt{pf}}}(\lambda)$ and $in_{\lambda,\lambda'}\mapsto{\overline{\mathtt{pf}}}_{\lambda,\lambda'}$ define indeed a functor ${\overline{\mathtt{pf}}}:{\overline{\mathsf{Cont}}}\to\mathsf{Mon}$ .

Finally, we can extend the functor $\mathtt{tr}_{\gamma}:\mathtt{prg}(\gamma)\to\mathtt{pf}(\gamma)$ between the monoids $\mathtt{prg}(\gamma)$ and to a functor ${\overline{\mathtt{tr}}}_{\lambda}:{\overline{\mathtt{prg}}}(\lambda)\to{\overline{\mathtt{pf}}}(\lambda)$ between the monoids ${\overline{\mathtt{prg}}}(\lambda)$ and . We simply set ${\overline{\mathtt{tr}}}_{\lambda}(c)\triangleq\overline{\mathtt{tr}_{\gamma}(c)}_{\delta}=\mathtt{tr}_{\gamma}(c)\times id_{\varGamma_{\delta}}$ for each $c\in{\overline{\mathtt{prg}}}(\lambda)=\mathtt{prg}(\gamma)$ . Functoriality of ${\overline{\mathtt{tr}}}_{\lambda}$ is ensured by the functoriality of $\mathtt{tr}_{\gamma}$ and the equation $\overline{\tau;\;\tau'}_{\delta}={\overline{\tau}}_{\delta};\;\overline{\tau'}_{\delta}$ for arbitrary state transition maps . Moreover, equation (9) guarantees that the family ${\overline{\mathtt{tr}}}_{\lambda}:{\overline{\mathtt{prg}}}(\lambda)\to{\overline{\mathtt{pf}}}(\lambda)$ , $\lambda\in{|{{\overline{\mathsf{Cont}}}}|}$ of functors provides a natural transformation ${\overline{\mathtt{tr}}}:{\overline{\mathtt{prg}}}\Rightarrow{\overline{\mathtt{pf}}}$ .

Two contravariant Power Set Functors: To find an adequate formalization of the two kinds of predicate transformations, appearing in Theorem 1, we take a closer look at the inverse image construction for partial functions. We consider $\mathsf{Set}$ as a subcategory of $\mathsf{Par}$ !

The contravariant power set functor $\mathtt{P}:\mathsf{Set}^{op}\to\mathsf{Pre}$ , assigning to each set A the partial order $(\wp(A),\subseteq)$ and to each function $f:A\to B$ the inverse image functor $f^{-1}:(\wp(B),\subseteq)\to(\wp(A),\subseteq)$ with $f^{-1}(B')\triangleq\{a\in A\mid f(a)\in B'\}$ for all subsets $B'\subseteq B$ , can be extended in two different ways to a contravariant power set functor from $\mathsf{Par}$ into $\mathsf{Pre}$ .

The “standard” functor $\mathtt{P}:\mathsf{Par}^{op}\to\mathsf{Pre}$ is related to total correctness and assigns to each set A the partial order $(\wp(A),\subseteq)$ and to each partial function the inverse image functor $f^{-1}:(\wp(B),\subseteq)\to(\wp(A),\subseteq)$ with $f^{-1}(B')\triangleq\{a\in A\mid a\in\mathrm{DD}(f), f(a)\in B'\}$ for all subsets $B'\subseteq B$ .

The “non-standard” functor $\mathtt{P_\mathrm{DD}}:\mathsf{Par}^{op}\to\mathsf{Pre}$ is, in turn, related to partial correctness and assigns to each set A the partial order $(\wp(A),\subseteq)$ and to each partial function the modified inverse image functor $f^{-1}_\mathrm{DD}:(\wp(B),\subseteq)\to(\wp(A),\subseteq)$ with $f^{-1}_\mathrm{DD}(B')\triangleq f^{-1}(B')\cup (A\setminus\mathrm{DD}(f))$ for all subsets $B'\subseteq B$ .

From State Transition Maps to Predicate Transformers: Both functors $\mathtt{P}:\mathsf{Par}^{op}\to\mathsf{Pre}$ and $\mathtt{P_\mathrm{DD}}:\mathsf{Par}^{op}\to\mathsf{Pre}$ are embeddings, that is, injective on objects and on morphisms.

For each extended context $\lambda$ in ${\overline{\mathsf{Cont}}}$ , the image $\mathtt{if}(\lambda)\triangleq\mathtt{P}^{op}({\overline{\mathtt{pf}}}(\lambda))$ of the submonoid ${\overline{\mathtt{pf}}}(\lambda)$ of w.r.t. $\mathtt{P}^{op}:\mathsf{Par}\to\mathsf{Pre}^{op}$ becomes therefore a submonoid of $\mathsf{Pre}((\wp(\varLambda_{\lambda}),\subseteq),(\wp(\varLambda_{\lambda}),\subseteq))^{op}$ and we get an isomorphism $\mathtt{tc}_{\lambda}:{\overline{\mathtt{pf}}}(\lambda)\to\mathtt{if}(\lambda)$ in $\mathsf{Mon}$ with $\mathtt{tc}_{\lambda}({\overline{\tau}}_{\delta})\triangleq{\overline{\tau}}_{\delta}^{-1}:(\wp(\varLambda_{\lambda}),\subseteq)\to(\wp(\varLambda_{\lambda}),\subseteq)$ for each morphism in ${\overline{\mathtt{pf}}}(\lambda)$ . “ ${\mathtt{if}}$ ” and “ ${\mathtt{tc}}$ ” stand for “inverse image function” and “total correctness,” respectively. For any morphism

$in_{\lambda,\lambda'}:\lambda\to\lambda'$ in ${\overline{\mathsf{Cont}}}$ , we can define a functor $\mathtt{if}_{\lambda,\lambda'}\triangleq\mathtt{tc}_{\lambda}^{-1};\;{\overline{\mathtt{pf}}}_{\lambda,\lambda'};\;\mathtt{tc}_{\lambda'}:\mathtt{if}(\lambda)\to\mathtt{if}(\lambda')$ . ${\overline{\mathtt{pf}}}:{\overline{\mathsf{Cont}}}\to\mathsf{Mon}$ is a functor; thus, this definition ensures that the assignments $\lambda\mapsto\mathtt{if}(\lambda)$ and $in_{\lambda,\lambda'}\mapsto\mathtt{if}_{\lambda,\lambda'}$ constitute a functor $\mathtt{if}:{\overline{\mathsf{Cont}}}\to\mathsf{Mon}$ and that, in addition, the isomorphisms $\mathtt{tc}_{\lambda}:{\overline{\mathtt{pf}}}(\lambda)\to\mathtt{if}(\lambda)$ in $\mathsf{Mon}$ establish a natural isomorphism $\mathtt{tc}:{\overline{\mathtt{pf}}}\Rightarrow\mathtt{if}$ .

For each extended context $\lambda=(\gamma,\delta),$ the monoid $\mathtt{if}(\lambda)$ is constituted by all inverse image functors of the form ${\overline{\tau}}_{\delta}^{-1}=(\tau\times id_{\varGamma_{\delta}})^{-1}:(\wp(\varLambda_{\lambda}),\subseteq)\to(\wp(\varLambda_{\lambda}),\subseteq)$ , $\varLambda_{\lambda}=\Sigma_{\gamma}\times\varGamma_{\delta}$ (interpreted as morphisms in the opposite direction) with a partial function, that is, with $\tau$ ranging over all morphisms in $\mathtt{pf}(\gamma)=\mathsf{Par}(\Sigma_{\gamma},\Sigma_{\gamma})$ and thus ranging over all morphisms in ${\overline{\mathtt{pf}}}(\lambda)\subseteq\mathsf{Par}(\varLambda_{\lambda},\varLambda_{\lambda})$ . The functor $\mathtt{if}_{\lambda,\lambda'}:\mathtt{if}(\lambda)\to\mathtt{if}(\lambda')$ assigns to $\mathtt{tc}_{\lambda}({\overline{\tau}}_{\delta})={\overline{\tau}}_{\delta}^{-1}$ the inverse image functor $\mathtt{if}_{\lambda,\lambda'}({\overline{\tau}}_{\delta}^{-1})= \mathtt{tc}_{\lambda'}({\overline{\mathtt{pf}}}_{\lambda,\lambda'}({\overline{\tau}}_{\delta}))= ({\overline{\mathtt{pf}}}_{\lambda,\lambda'}({\overline{\tau}}_{\delta}))^{-1}:(\wp(\varLambda_{\lambda'}),\subseteq)\to(\wp(\varLambda_{\lambda'}),\subseteq)$

while the equation (11) in $\mathsf{Par}$ is transformed into an equation in $\mathsf{Pre}$ :

(12) \begin{equation} p_{\lambda',\lambda}^{-1};\;\mathtt{if}_{\lambda,\lambda'}({\overline{\tau}}_{\delta})= {\overline{\tau}}_{\delta}^{-1};\;p_{\lambda',\lambda}^{-1} \end{equation}

Completely analogously, we can use the embedding $\mathtt{P_\mathrm{DD}}^{op}:\mathsf{Par}\to\mathsf{Pre}^{op}$ to construct for each extended context $\lambda$ in ${\overline{\mathsf{Cont}}}$ the image $\mathtt{if^\mathrm{DD}}(\lambda)\triangleq\mathtt{P_\mathrm{DD}}^{op}({\overline{\mathtt{pf}}}(\lambda))$ of the submonoid ${\overline{\mathtt{pf}}}(\lambda)$ of $\mathsf{Par}(\varLambda_{\lambda},\varLambda_{\lambda})$ and obtain a submonoid of $\mathsf{Pre}((\wp(\varLambda_{\lambda}),\subseteq),(\wp(\varLambda_{\lambda}),\subseteq))^{op}$ . We get an isomorphism $\mathtt{pc}_{\lambda}:{\overline{\mathtt{pf}}}(\lambda)\to\mathtt{if^\mathrm{DD}}(\lambda)$ in $\mathsf{Mon}$ with $\mathtt{pc}_{\lambda}({\overline{\tau}}_{\delta})\triangleq({\overline{\tau}}_{\delta})_\mathrm{DD}^{-1}:(\wp(\varLambda_{\lambda}),\subseteq)\to(\wp(\varLambda_{\lambda}),\subseteq)$ for each morphism in ${\overline{\mathtt{pf}}}(\lambda)$ . “ ${\mathtt{pc}}$ ” stands for “partial correctness.” For any morphism $in_{\lambda,\lambda'}:\lambda\to\lambda'$ in ${\overline{\mathsf{Cont}}}$ , we can define a functor $\mathtt{if^\mathrm{DD}}_{\lambda,\lambda'}\triangleq\mathtt{pc}_{\lambda}^{-1};\;{\overline{\mathtt{pf}}}_{\lambda,\lambda'};\;\mathtt{pc}_{\lambda'}:\mathtt{if}(\lambda)\to\mathtt{if}(\lambda')$ .

${\overline{\mathtt{pf}}}:{\overline{\mathsf{Cont}}}\to\mathsf{Mon}$ is a functor thus the assignments $\lambda\mapsto\mathtt{if}(\lambda)$ and $in_{\lambda,\lambda'}\mapsto\mathtt{if}_{\lambda,\lambda'}$ constitute a functor $\mathtt{if^\mathrm{DD}}:{\overline{\mathsf{Cont}}}\to\mathsf{Mon}$ and, in addition, the isomorphisms $\mathtt{pc}_{\lambda}:{\overline{\mathtt{pf}}}(\lambda)\to\mathtt{if^\mathrm{DD}}(\lambda)$ in $\mathsf{Mon}$ establish a natural isomorphism $\mathtt{pc}:{\overline{\mathtt{pf}}}\Rightarrow\mathtt{if^\mathrm{DD}}$ .

We fix the above discussion in the following theorem.

Semantic Equivalences: Based on two different extensions $\mathtt{P}:\mathsf{Par}^{op}\to\mathsf{Pre}$ and $\mathtt{P_\mathrm{DD}}:\mathsf{Par}^{op}\to\mathsf{Pre}$ of the contravariant power set functor $\mathtt{P}:\mathsf{Set}^{op}\to\mathsf{Pre}$ to the category $\mathsf{Par}$ , we presented two distinct predicate transformer semantics for partial functions – the total correctness semantics $\mathtt{tc}:{\overline{\mathtt{pf}}}\Rightarrow\mathtt{if}$ , converting partial functions into inverse image functors, and the partial correctness semantics $\mathtt{pc}:{\overline{\mathtt{pf}}}\Rightarrow\mathtt{if^\mathrm{DD}}$ , converting partial functions into modified inverse image functors.

Since both natural transformations $\mathtt{tc}$ and $\mathtt{pc}$ are natural isomorphisms, we have, especially, shown in such a way that the total correctness semantics and the partial correctness semantics are equivalent from a structural point of view.

Therefore, it will be sufficient to concentrate our further investigations of the structural features of Hoare logics on one of these semantics. We will focus on total correctness since partial correctness has been discussed in Wolter et al. (Reference Wolter, Martini and Haeusler2020).

3.4 Weakest precondition semantics of local programs

We are well prepared now to come back to the set-theoretic characterizations of correctness

assertions in Theorem 1. We can define a predicate transformer semantics $\mathtt{wp}\triangleq{\overline{\mathtt{tr}}};\;\mathtt{tc}:{\overline{\mathtt{prg}}}\Rightarrow\mathtt{if}\,$ of programs by composing the state transition semantics ${\overline{\mathtt{tr}}}:{\overline{\mathtt{prg}}}\Rightarrow{\overline{\mathtt{pf}}}\,$ of programs with the total correctness semantics $\mathtt{tc}:{\overline{\mathtt{pf}}}\Rightarrow\mathtt{if}\,$ of partial functions. “ ${\mathtt{wp}}$ ” stands for “weakest preconditions” a term we discuss later in this subsection.

Diagram (13) visualizes the definition of the “weakest precondition semantics” $\mathtt{wp}={\overline{\mathtt{tr}}};\;\mathtt{tc}\,$ of programs and summarizes our efforts to develop indexed semantics of local programs:

(13)

We defined the state transition semantics , $\Sigma_{\gamma}=(\gamma\to\mathbb{D})$ of a local program $c\in\mathtt{prg}(\gamma)=\{c\in\textbf{Prg}\mid pvr(c)\subseteq\gamma \}$ as a restriction of the corresponding state transition map for global states. For any inclusion function $in_{\gamma,\gamma'}:\gamma\to\gamma'$ we have $\mathtt{prg}(\gamma)\subseteq\mathtt{prg}(\gamma')$ and simply extends $\mathtt{tr}_{\gamma}(c)$ by the identity on $\Sigma_{\gamma'\setminus\gamma}$ . We get $\mathtt{pf}_{\gamma,\gamma'}(\mathtt{tr}_{\gamma}(c))=\mathtt{tr}_{\gamma'}(c)$ since $\mathtt{tr}_{\gamma}(c)$ and $\mathtt{tr}_{\gamma'}(c)$ are both restriction of the same partial map and since $[\![ c ]\!]({\varrho})(x)={\varrho}(x)$ for any global state ${\varrho}\in\mathrm{DD}({[\![ c ]\!]})$ and any program variable $x\notin pvr(c)$ . For the same reason, we obtained also the equation $\mathtt{tr}_{\gamma'}(c);\;p_{\gamma',\gamma}=p_{\gamma',\gamma};\;\mathtt{tr}_{\gamma}(c)$ in the category $\mathsf{Par}$ for the reduction map $p_{\gamma',\gamma}:\Sigma_{\gamma'}\to\Sigma_{\gamma}$ induced by precomposition with $in_{\gamma,\gamma'}:\gamma\to\gamma'$ .

To be able to reason about the semantics of local programs, we had to lift up the state transition semantics to extended contexts $\lambda=(\gamma,\delta)$ , corresponding sets $\varLambda_{\lambda}=\Sigma_{\gamma}\times\varGamma_{\delta}$ of “extended local states” and thus to pairs $in_{\lambda,\lambda'}= (in_{\gamma,\gamma'},in_{\delta,\delta'}):\lambda\to\lambda'$ of inclusion functions and products $p_{\lambda',\lambda}= p_{\gamma',\gamma}\times p_{\delta',\delta} :\varLambda_{\lambda'}\to\varLambda_{\lambda}$ of reduction maps. Guided by Theorem 1, this extension was done by simply adjoining identity maps. For each local program $c\in{\overline{\mathtt{prg}}}(\lambda)\triangleq\mathtt{prg}(\gamma)$ we set and thus ${\overline{\mathtt{pf}}}_{\lambda,\lambda'}({\overline{\mathtt{tr}}}_{\lambda}(c)) =\mathtt{tr}_{\gamma'}(c)\times id_{\varGamma_{\delta'}}={\overline{\mathtt{tr}}}_{\lambda'}(c)$ and, moreover, ${\overline{\mathtt{tr}}}_{\lambda'}(c);\;p_{\lambda',\lambda}=p_{\lambda',\lambda};\;{\overline{\mathtt{tr}}}_{\lambda}(c)$ in $\mathsf{Par}$ .

Finally, we transformed the extended state transition semantics into the predicate transformer semantics $\mathtt{wp}$ by means of the “standard” contravariant power set functor $\mathtt{P}:\mathsf{Par}^{op}\to\mathsf{Pre}$ . We set $\mathtt{wp}_{\lambda}(c)\triangleq\mathtt{tc}_{\lambda}({\overline{\mathtt{tr}}}_{\lambda}(c))={\overline{\mathtt{tr}}}_{\lambda}(c)^{-1} $ , and get $\mathtt{if}_{\lambda,\lambda'}(\mathtt{wp}_{\lambda}(c)) =\mathtt{if}_{\lambda,\lambda'}(\mathtt{tc}_{\lambda}({\overline{\mathtt{tr}}}_{\lambda}(c)))=\mathtt{tc}_{\lambda'}({\overline{\mathtt{pf}}}_{\lambda,\lambda'}({\overline{\mathtt{tr}}}_{\lambda}(c)))=\mathtt{tc}_{\lambda'}({\overline{\mathtt{tr}}}_{\lambda'}(c))$ and the equation $p_{\lambda',\lambda}^{-1};\;\mathtt{wp}_{\lambda'}(c)= \mathtt{wp}_{\lambda}(c);\;p_{\lambda',\lambda}^{-1}$ in $\mathsf{Pre}$ .

Besides the predicate transformer semantics $\mathtt{wp}={\overline{\mathtt{tr}}};\;\mathtt{tc}:{\overline{\mathtt{prg}}}\Rightarrow\mathtt{if}$ , we can also define a “weakest liberal precondition semantics” $\mathtt{wlp}\triangleq{\overline{\mathtt{tr}}};\;\mathtt{pc}:{\overline{\mathtt{prg}}}\Rightarrow\mathtt{if}\,$ of programs by composing the state transition semantics ${\overline{\mathtt{tr}}}:{\overline{\mathtt{prg}}}\Rightarrow{\overline{\mathtt{pf}}}\,$ of programs with the partial correctness semantics $\mathtt{pc}:{\overline{\mathtt{pf}}}\Rightarrow\mathtt{if}\,$ of partial functions instead.

As discussed at the end of Subsection 3.3, $\mathtt{tc}$ and $\mathtt{pc}$ are natural isomorphisms; thus, the weakest precondition semantics and the weakest liberal precondition semantics of local programs are structural equivalent and we will focus on the weakest precondition semantics.

Weakest Preconditions: The notion of “weakest preconditions” has been introduced in Dijkstra (Reference Dijkstra1975) and reflects the equivalences in Theorem 1. The weakest precondition of a local program $c\in{\overline{\mathtt{prg}}}(\lambda)$ with respect to a state predicate $\mathcal{Q}\subseteq\varLambda_{\lambda}$ is the state predicate $\mathtt{wp}_{\lambda}(c)(\mathcal{Q})=(\mathtt{tr}_{\gamma}(c)\times id_{\varGamma_{\delta}})^{-1}(\mathcal{Q})\subseteq\varLambda_{\lambda}$ . Correspondingly, the weakest liberal precondition is the state predicate $\mathtt{wlp}_{\lambda}(c)(\mathcal{Q})=(\mathtt{tr}_{\gamma}(c)\times id_{\varGamma_{\delta}})^{-1}(\mathcal{Q}) \cup(\mathrm{DD}({\mathtt{tr}_{\gamma}(c)})\times\varGamma_{\delta})\subseteq\varLambda_{\lambda}$ .

For a program c and an assertion Q, we consider the weakest precondition $\mathtt{wp}_{\lambda}(c)(\mathtt{sem}_{\lambda}(Q))$ and the weakest liberal precondition $\mathtt{wlp}_{\lambda}(c)(\mathtt{sem}_{\lambda}(Q))$ where $\lambda=(pvr(c)\cup pvr(Q),flv(Q))$ .

An important and non-trivial result concerning Hoare logic is that the Hoare Proof Calculus, presented at the end of Section 2, is complete (compare Cook Reference Cook1978 and Apt et al. Reference Apt, de Boer and Olderog2009). This completeness result is based on another non-trivial result stating that our language of expressions is expressive enough, in the sense, that we can represent weakest preconditions syntactically (see Theorem 3.4 in Apt et al. Reference Apt, de Boer and Olderog2009): There exist assertions $wp(c,Q),wlp(c,Q)\in\mathtt{assn}(\lambda)$ such that $\mathtt{sem}_{\lambda}(wp(c,Q))=\mathtt{wp}_{\lambda}(c)(\mathtt{sem}_{\lambda}(Q))$ and $\mathtt{sem}_{\lambda}(wlp(c,Q))=\mathtt{wlp}_{\lambda}(c)(\mathtt{sem}_{\lambda}(Q))$ , respectively.

$\mathtt{sem}$ is a natural transformation; thus, the equations $p_{\lambda',\lambda}^{-1};\;\mathtt{wp}_{\lambda'}(c)= \mathtt{wp}_{\lambda}(c);\;p_{\lambda',\lambda}^{-1}$ and $p_{\lambda',\lambda}^{-1};\;\mathtt{wlp}_{\lambda'}(c)= \mathtt{wlp}_{\lambda}(c);\;p_{\lambda',\lambda}^{-1}$ ensure that syntactic weakest preconditions are context independent: It holds that $\mathtt{sem}_{\lambda'}(wp(c,Q))=\mathtt{wp}_{\lambda'}(c)(\mathtt{sem}_{\lambda'}(Q))$ and $\mathtt{sem}_{\lambda'}(wlp(c,Q))=\mathtt{wlp}_{\lambda'}(c)(\mathtt{sem}_{\lambda'}(Q))$ , respectively, for any morphism $in_{\lambda,\lambda'}:\lambda\to\lambda'$ in ${\overline{\mathsf{Cont}}}$ .

The context independence of syntactic weakest preconditions ensures also that they are monoton w.r.t. semantic entailment, that is, $P\Vdash_{\lambda} Q$ implies $wp(c,P)\Vdash_{\lambda'}wp(c,Q)$ for all inclusion functions $in_{\lambda,\lambda'}:\lambda\to\lambda'$ and all programs $c:\lambda'\to\lambda'$ : $P\Vdash_{\lambda} Q$ is defined in (7) by the inclusion $\mathtt{sem}_{\lambda}(P)\subseteq \mathtt{sem}_{\lambda}(Q)$ . Proposition 2 ensures that this inclusion entails the inclusion $\mathtt{sem}_{\lambda'}(P)\subseteq \mathtt{sem}_{\lambda'}(Q);$ thus, we obtain also the inclusion $\mathtt{wp}_{\lambda'}(c)(\mathtt{sem}_{\lambda'}(P))\subseteq\mathtt{wp}_{\lambda'}(c)(\mathtt{sem}_{\lambda'}(Q))$ and thus $\mathtt{sem}_{\lambda'}(wlp(c,P))\subseteq\mathtt{sem}_{\lambda'}(wlp(c,Q))$ due to context independence. The last inclusion, however, means nothing but $wp(c,P)\Vdash_{\lambda'}wp(c,Q)$ according to (7).

To denote the correctness of local programs, we go back to the traditional Hoare triples: A local total correctness assertion $\lambda:{[P]\;c\;[Q]}$ is valid, written $\models_{\lambda}{[P]\;c\;[Q]}$ , if, and only if, $\mathtt{tr}_{\gamma}(c)\models_{\lambda} (TC,P\Rightarrow Q)$ and, analogously, a local partial correctness assertion $\lambda:{\{{P}\}\;{c}\;\{{Q}\}}$ is valid, written $\models_{\lambda}{\{{P}\}\;{c}\;\{{Q}\}}$ , if, and only if, $\mathtt{tr}_{\gamma}(c)\models_{\lambda} (PC,P\Rightarrow Q)$ .

Instantiating Theorem 1 by the state transition semantics $\mathtt{tr}_{\gamma}(c)$ of programs, we can summarize that correctness assertions can be equivalently expressed by means of semantic weakest preconditions while the existence of corresponding syntactic weakest preconditions gives us, finally, an equivalent formulation of correctness by means of semantic entailment at hand.

1. (1). $\models_{\lambda}{[P]\;c\;[Q]}$ iff $\mathtt{sem}_{\lambda}(P)\subseteq\;\mathtt{wp}_{\lambda}(c)(\mathtt{sem}_{\lambda}(Q))$ iff $P\Vdash_{\lambda} wp(c,Q)$ .

2. (2). $\models_{\lambda}{\{{P}\}\;{c}\;\{{Q}\}}$ iff $\mathtt{sem}_{\lambda}(P)\subseteq\;\mathtt{wlp}_{\lambda}(c)(\mathtt{sem}_{\lambda}(Q))$ iff $P\Vdash_{\lambda} wlp(c,Q)$ .

Syntactic weakest preconditions are assertions and thus only uniquely determined up to logical equivalence, that is, up to isomorphisms in $\mathtt{ent}(\lambda)=(\mathtt{assn}(\lambda),\Vdash_{\lambda})$ . An indexed account of the structural features of syntactic weakest preconditions and of a deduction calculus for Hoare triples would have to relay therefore on pseudo functors. We consider this as not quite adequate and prefer to develop directly a fibered account in the next section.

4.1 Fibrations for the logic of local states

The Grothendieck construction (see Barr and Wells Reference Barr and Wells1990) is the main technique to transform an indexed category into a fibered category (fibration). There are different variants of the Grothendieck construction, and we do not include a general definition of the different variants needed here. We describe, however, in detail all the fibered structures obtained by transforming the indexed structures in Section 3.

The indexed version of the logic of local states is manifested by the natural transformation $\;\mathtt{sem}:\mathtt{ent}\Rightarrow\mathtt{pred}:{\overline{\mathsf{Cont}}}\to\mathsf{Pre}$ . Transforming, first, the functor (indexed category) $\mathtt{ent}:{\overline{\mathsf{Cont}}}\to\mathsf{Pre},$ we get a fibered category of state assertions and semantic entailments:

• objects: all pairs $(\lambda.Q)$ of an extended context $\lambda\in{|{{\overline{\mathsf{Cont}}}}|}$ and an assertion $Q\in\mathtt{assn}(\lambda)$ .

• morphisms: from $(\lambda'.P)$ to $(\lambda.Q)$ are all pairs $(in_{\lambda,\lambda'},\Vdash_{\lambda'})$ with $in_{\lambda,\lambda'}:\lambda\to\lambda'$ a morphism in ${\overline{\mathsf{Cont}}}$ and $\,P\Vdash_{\lambda'} Q=\mathtt{ent}(in_{\lambda,\lambda'})(Q)\,$ a morphism in $\,\mathtt{ent}(\lambda')=(\mathtt{assn}(\lambda'),\Vdash_{\lambda'})$ .

• identities: the identity on $(\lambda.Q)$ is $(id_\lambda,=)$ where $id_\lambda=in_{\lambda,\lambda}$ .

• composition: the composition of two morphisms $(in_{\lambda',\lambda''},\Vdash_{\lambda''}):(\lambda''.R)\to(\lambda'.P)$ and $(in_{\lambda,\lambda'},\Vdash_{\lambda'}):(\lambda'.P)\to(\lambda.Q)$ is the morphism $(in_{\lambda,\lambda''},\Vdash_{\lambda''}):(\lambda''.R)\to(\lambda.Q)$ where $in_{\lambda,\lambda''}=in_{\lambda,\lambda'};\;in_{\lambda',\lambda''}$ . Composition is well-defined due to the monotonicity of context extensions w.r.t. semantic entailment and the associativity of semantic entailment, that is, since $\mathtt{ent}$ is a functor and since the $\mathtt{ent}(\lambda)=(\mathtt{assn}(\lambda),\Vdash_{\lambda})$ are preorder categories.

  

We obtain a projection functor $\varPi_{\mathsf{Ent}}:\mathsf{Ent}\to{\overline{\mathsf{Cont}}}^{op}$ with $\varPi_{\mathsf{Ent}}(\lambda.Q)\triangleq\lambda$ and $\varPi_{\mathsf{Ent}}((in_{\lambda,\lambda'},\Vdash_{\lambda'}): (\lambda'.P)\to(\lambda.Q))\triangleq(in_{\lambda,\lambda'}:\lambda\to\lambda')$ with fibers $\varPi_{\mathsf{Ent}}^{-1}(id_{\lambda}) \simeq\mathtt{ent}(\lambda)$ .

The diagram in Definition 5 (and the diagrams in the following Definitions 6, 7, 8 and 9) visualizes the corresponding Grothendieck construction of morphisms (dashed arrows) and should help the reader to validate the well-definedness of the composition of those morphisms.

The general properties of Grothendieck constructions provide:

Given $in_{\lambda,\lambda'}^{op}:\lambda'\to\lambda$ in ${\overline{\mathsf{Cont}}}^{op}$ and $Q\in\mathtt{assn}(\lambda)$ the standard choice for a corresponding Cartesian arrow is $(in_{\lambda,\lambda'},\Vdash_{\lambda'}):(\lambda',Q)\to(\lambda,Q)$ .

Transforming, second, the functor (indexed category) $\mathtt{pred}:{\overline{\mathsf{Cont}}}\to\mathsf{Pre},$ we get a fibered category of state predicates and inclusions of state predicates:

• objects: all pairs $(\lambda.\mathcal{Q})$ of an extended context $\lambda\in{|{{\overline{\mathsf{Cont}}}}|}$ and a state predicate $\mathcal{Q}\in\wp(\varLambda_{\lambda})$ .

• morphisms: from $(\lambda'.\mathcal{P})$ to $(\lambda.\mathcal{Q})$ are all pairs $(in_{\lambda,\lambda'},\subseteq)$ with $in_{\lambda,\lambda'}:\lambda\to\lambda'$ a morphism in ${\overline{\mathsf{Cont}}}$ and $\,\mathcal{P}\subseteq p_{\lambda',\lambda}^{-1}(\mathcal{Q})\,$ a morphism in $\,\mathtt{pred}(\lambda')=(\wp(\varLambda_{\lambda'}),\subseteq)$ .

• identities: the identity on $(\lambda.\mathcal{P})$ is $(id_\lambda,=)$ .

• composition: the composition of two morphisms $(in_{\lambda',\lambda''},\subseteq):(\lambda''.\mathcal{R})\to(\lambda'.\mathcal{P})$ and ${(in_{\lambda,\lambda'},\subseteq):}(\lambda'.\mathcal{P})\to(\lambda.\mathcal{Q})$ is the morphism $(in_{\lambda,\lambda''},\subseteq):(\lambda''.\mathcal{R})\to(\lambda.\mathcal{Q})$ where $in_{\lambda,\lambda''}=in_{\lambda,\lambda'};\;in_{\lambda',\lambda''}$ . Composition is well-defined since $\mathtt{pred}$ is a functor, that is, we have $p_{\lambda',\lambda}^{-1};\;p_{\lambda'',\lambda'}^{-1}=p_{\lambda'',\lambda}^{-1}\,$ , and since the $\,\mathtt{pred}(\lambda)=(\wp(\varLambda_{\lambda}),\subseteq)$ are partial order categories.

  

We obtain a projection functor $\varPi_{\mathsf{Pred}}:\mathsf{Pred}\to{\overline{\mathsf{Cont}}}^{op}$ with $\varPi_{\mathsf{Pred}}(\lambda.\mathcal{Q})\triangleq\lambda$ and $\varPi_{\mathsf{Pred}}((in_{\lambda,\lambda'},\subseteq):$ $ (\lambda'.\mathcal{P})\to(\lambda.\mathcal{Q}))\triangleq(in_{\lambda,\lambda'}:\lambda\to\lambda')$ with fibers $\varPi_{\mathsf{Pred}}^{-1}(id_\lambda)\simeq(\wp(\varLambda_{\lambda}),\subseteq)$ .

The general properties of Grothendieck constructions provide:

Finally, the Grothendieck construction transforms the natural transformation (indexed functor) $\mathtt{sem}:\mathtt{ent}\Rightarrow\mathtt{pred}$ into a functor $\mathtt{Sem}:\mathsf{Ent}\to\mathsf{Pred}$ such that $\mathtt{Sem};\;\varPi_{\mathsf{Pred}}=\varPi_{\mathsf{Ent}}$ . $\mathtt{Sem}$ assigns to each local state assertion $(\lambda.Q)$ its local semantics $(\lambda.\mathtt{sem}_{\lambda}(Q))$ and to each entailment $(in_{\lambda,\lambda'},\Vdash_{\lambda'}):(\lambda'.P)\to(\lambda.Q)$ , that is, $\,P\Vdash_{\lambda'} Q\,$ the corresponding semantic inclusion $(in_{\lambda,\lambda'},\subseteq): (\lambda'.\mathtt{sem}_{\lambda'}(P))\to(\lambda.\mathtt{sem}_{\lambda}(Q))$ , that is, $\mathtt{sem}_{\lambda'}(P)\subseteq p_{\lambda',\lambda}^{-1}(\mathtt{sem}_{\lambda}(Q))$ .

The way “semantic” entailment is defined in (7) exactly by inclusions of state predicates becomes manifested by the fact that the functor $\mathtt{Sem}:\mathsf{Ent}\to\mathsf{Pred}$ is full.

Remark 6 (Commutative Diagrams) The reader should be aware that the diagrams we use to visualize the construction of a fibration and to validate its well-definedness turn into

commutative diagrams in the resulting fibration. In case of the construction of $\mathsf{Pred}$ in Definition 6, for example, we obtain the commutative diagram above in $\mathsf{Pred}$ . The vertical arrows are Cartesian arrows, and the diagram shows also that each morphism $(in_{\lambda,\lambda'},\subseteq):(\lambda'.\mathcal{P})\to(\lambda.Q)$ can be factorized into the composition $(in_{\lambda,\lambda'},\subseteq)=(id_{\lambda '},\subseteq);\;(in_{\lambda,\lambda'},=)$ of a morphism in the fiber $\varPi_{\mathsf{Pred}}^{-1}(id_{\lambda'})\simeq\mathtt{pred}(\lambda')$ and a Cartesian arrow.

4.2 Fibrations for local programs and weakest precondition semantics

The functor ${\overline{\mathtt{prg}}}:{\overline{\mathsf{Cont}}}\to\mathsf{Mon}$ can be transformed into a category $\mathsf{Prg}$ of local programs.

• objects: ${|{\mathsf{Prg}}|}\triangleq{|{{\overline{\mathsf{Cont}}}}|}$ is the set of all extended contexts $\lambda=(\gamma,\delta)$ .

• morphisms: from $\lambda$ to $\lambda'$ are all pairs $(in_{\lambda,\lambda'},c):\lambda\to\lambda'$ with $in_{\lambda,\lambda'}:\lambda\to\lambda'$ a morphism in ${\overline{\mathsf{Cont}}}$ and $c\in{\overline{\mathtt{prg}}}(\lambda')=\mathtt{prg}(\gamma')$ .

• identities: the identity on $\lambda$ is $(id_\lambda,{\varepsilon})=(in_{\lambda,\lambda},{\varepsilon})$ where ${\varepsilon}$ is the empty program.

• composition: the composition of two morphisms $(in_{\lambda,\lambda'},c_2):\lambda\to\lambda'$ and $(in_{\lambda',\lambda''},c_1):\lambda'\to\lambda''$ is the morphism $(in_{\lambda,\lambda''},c_1;\;c_2):\lambda\to\lambda''$ where $in_{\lambda,\lambda''}=in_{\lambda,\lambda'};\;in_{\lambda',\lambda''}$ .

  

Moreover, we obtain a projection functor $\varPi_{\mathsf{Prg}}:\mathsf{Prg}\to{\overline{\mathsf{Cont}}}$ with $\varPi_{\mathsf{Prg}}(\lambda)\triangleq\lambda$ and $\varPi_{\mathsf{Prg}}((in_{\lambda,\lambda'},c): \lambda\to\lambda')\triangleq(in_{\lambda,\lambda'}:\lambda\to\lambda')$ with fibers $\varPi_{\mathsf{Prg}}^{-1}(id_\lambda)\simeq\mathtt{prg}(\lambda)^{op}$ .

The functor $\varPi_{\mathsf{Prg}}:\mathsf{Prg}\to{\overline{\mathsf{Cont}}}$ is an opfibration thus the opposite functor $\varPi_{\mathsf{Prg}}^{op}:\mathsf{Prg}^{op}\to{\overline{\mathsf{Cont}}}^{op}$ becomes a fibration. On the other side, the identity on ${|{\mathsf{Prg}}|}\triangleq{|{{\overline{\mathsf{Cont}}}}|}$ extends to an embedding $\mathtt{E}_{cont}:{\overline{\mathsf{Cont}}}\to\mathsf{Prg}$ , such that $\mathtt{E}_{cont};\;\varPi_{\mathsf{Prg}}=id_{{\overline{\mathsf{Cont}}}}$ , mapping $in_{\lambda,\lambda'}$ to $(in_{\lambda,\lambda'},{\varepsilon})$ .

Based on the results in Subsection 3.4, we can transform the weakest precondition natural transformation $\mathtt{wp}={\overline{\mathtt{tr}}};\;\mathtt{tc}:{\overline{\mathtt{prg}}}\Rightarrow\mathtt{if}$ into to a functor $\mathtt{Wp}:\mathsf{Prg}\to\mathsf{Pre}$ . Note that this is not one of the traditional Grothendieck constructions. $\mathtt{Wp}$ assigns to each object $\lambda$ in $\mathsf{Prg}$ the preorder category $ \mathtt{Wp}(\lambda)\triangleq(\wp(\varLambda_{\lambda}),\subseteq)$ and to each morphism $(in_{\lambda,\lambda'},c):\lambda\to\lambda'$ in $\mathsf{Prg}$ the functor

\begin{equation*}\mathtt{Wp}(in_{\lambda,\lambda'},c)\triangleq (p_{\lambda',\lambda}^{-1};\;\mathtt{wp}_{\lambda'}(c):(\wp(\varLambda_{\lambda}),\subseteq)\longrightarrow(\wp(\varLambda_{\lambda'}),\subseteq)\,).\end{equation*}

$\mathtt{Wp}$ preserves identities $\mathtt{Wp}(id_{\lambda},{\varepsilon})=p_{\lambda,\lambda}^{-1};\;\mathtt{wp}_{\lambda}({\varepsilon})=id_{(\wp(\varLambda_{\lambda}),\subseteq)};\;id_{(\wp(\varLambda_{\lambda}),\subseteq)}=id_{(\wp(\varLambda_{\lambda}),\subseteq)}$ and is also compatible with composition $\mathtt{Wp}((in_{\lambda,\lambda'},c_2);\;(in_{\lambda',\lambda''},c_1))=\mathtt{Wp}(in_{\lambda,\lambda''},c_1;\;c_2)=p_{\lambda'',\lambda}^{-1};\;\mathtt{wp}_{\lambda}(c_1;\;c_2)=(p_{\lambda',\lambda}^{-1};\;\mathtt{wp}_{\lambda}(c_2));\;(p_{\lambda'',\lambda'}^{-1};\;\mathtt{wp}_{\lambda}(c1))=\mathtt{Wp}(in_{\lambda,\lambda''},c_2);\;\mathtt{Wp}(in_{\lambda,\lambda''},c_1)$ since $\mathtt{wp}_{\lambda}$ is a monoid morphism from ${\overline{\mathtt{prg}}}(\lambda)$ into a submonoid of $\mathsf{Pre}((\wp(\varLambda_{\lambda}),\subseteq),(\wp(\varLambda_{\lambda}),\subseteq))^{op}$ , that is, $\mathtt{wp}_{\lambda}(c_1;\;c_2)=\mathtt{wp}_{\lambda}(c_2);\;\mathtt{wp}_{\lambda}(c_1)$ , and due to the results in Subsection 3.4 (see diagram (13)).

Note that the functor property of $\mathtt{Wp}$ entails that the syntactic weakest preconditions $wp(c_1,wp(c_2,Q))$ and $wp(c_1;\;c_2,Q)$ are logical equivalent. This equivalence is important for the discussion in Section 4.3.

Applying now to $\mathtt{Wp}:\mathsf{Prg}\to\mathsf{Pre}$ the appropriate variant of the traditional Grothendieck construction, we get the category $\mathsf{Wp}$ of semantic weakest preconditions.

• objects: ${|{\mathsf{Wp}}|}\triangleq{|{\mathsf{Pred}}|}$ is the set of all pairs $(\lambda.\mathcal{Q})$ of an extended context $\lambda\in{|{{\overline{\mathsf{Cont}}}}|}$ and a state predicate $\mathcal{Q}\in\wp(\varLambda_{\lambda})$ .

• morphisms: from $(\lambda'.\mathcal{P})$ to $(\lambda.\mathcal{Q})$ are all pairs $((in_{\lambda,\lambda'},c),\subseteq)$ with $(in_{\lambda,\lambda'},c):\lambda\to\lambda'$ a morphism in $\mathsf{Prg}$ and $\,\mathcal{P}\subseteq \mathtt{Wp}(in_{\lambda,\lambda'},c)(\mathcal{Q})=\mathtt{wp}_{\lambda'}(c)(p_{\lambda',\lambda}^{-1}(\mathcal{Q}))\,$ a morphism in $\,\mathtt{Wp}(\lambda')=(\wp(\varLambda_{\lambda'}),\subseteq)$ .

• identities: the identity on $(\lambda.\mathcal{P})$ is $((id_\lambda,{\varepsilon}),=)$ .

• composition: the composition of two morphisms $((in_{\lambda',\lambda''},c_1),\subseteq):(\lambda''.\mathcal{R})\to(\lambda'.\mathcal{P})$ and $((in_{\lambda,\lambda'},c_2),\subseteq):(\lambda'.\mathcal{P})\to(\lambda.\mathcal{Q})$ is the morphism $((in_{\lambda,\lambda''},c_1;\;c_2),\subseteq):(\lambda''.\mathcal{R})\to(\lambda.\mathcal{Q})$ . Composition is well-defined since $\mathtt{Wp}$ is a functor, that is, we have $\mathtt{Wp}(in_{\lambda,\lambda'},c_2);\;\mathtt{Wp}(in_{\lambda',\lambda''},c_1) =\mathtt{Wp}(in_{\lambda,\lambda''},c_1;\;c_2)\,$ , and since the $\,\mathtt{Wp}(\lambda)=(\wp(\varLambda_{\lambda}),\subseteq)$ are partial order categories.

  

The assignments $\varPi_{\mathsf{Wp}}(\lambda.\mathcal{Q})\triangleq\lambda$ and $\varPi_{\mathsf{Wp}}(((in_{\lambda,\lambda'},c),\subseteq): (\lambda'.\mathcal{P})\to(\lambda.\mathcal{Q}))\triangleq((in_{\lambda,\lambda'},c):\lambda\to\lambda')$ define a projection functor $\varPi_{\mathsf{Wp}}:\mathsf{Wp}\to\mathsf{Prg}^{op}$ with fibers $\varPi_{\mathsf{Wp}}^{-1}((id_\lambda,{\varepsilon}))\simeq(\wp(\varLambda_{\lambda}),\subseteq)$ .

The general properties of Grothendieck constructions provide:

Theorem 6 (Conservative Extension) The identity on ${|{\mathsf{Wp}}|}\triangleq{|{\mathsf{Pred}}|}$ extends to an embedding

$\mathtt{E}_{pred}:\mathsf{Pred}\to\mathsf{Wp}$ mapping $(in_{\lambda,\lambda'},\subseteq):(\lambda'.\mathcal{P})\to(\lambda.\mathcal{Q})$ to $((in_{\lambda,\lambda'},{\varepsilon}),\subseteq):(\lambda'.\mathcal{P})\to(\lambda.\mathcal{Q})$ . The resulting square commutes, that is, we have $\mathtt{E}_{pred};\;\varPi_{\mathsf{Wp}}=\varPi_{\mathsf{Pred}};\;\mathtt{E}_{cont}^{op}$ . Moreover, it is a pullback square since $\mathtt{E}_{pred}$ establishes isomorphisms between the fibers $\varPi_{\mathsf{Pred}}^{-1}(id_\lambda)\simeq(\wp(\varLambda_{\lambda}),\subseteq)$ and $\varPi_{\mathsf{Wp}}^{-1}(\mathtt{E}_{cont}^{op}(id_\lambda)) =\varPi_{\mathsf{Wp}}^{-1}((id_\lambda,{\varepsilon}))$ . Note that the pullback property means that the semantic fibration $\varPi_{\mathsf{Wp}}:\mathsf{Wp}\to\mathsf{Prg}^{op}$ is a “conservative extension” of the semantic fibration $\varPi_{\mathsf{Pred}}:\mathsf{Pred}\to{\overline{\mathsf{Cont}}}^{op}$ , in the sense, that no new relations between local state predicates are introduced. The semantics of states is unchanged.

4.3 Fibration for Hoare logic

The continuous lines in the diagram below show what we have gained so far in the fibered setting:

The right face represents the logic of local states where entailment between local state assertions is defined semantically by inclusions between corresponding local state predicates. The logic of local states comprises as well all general first-order logic assertions as the theory of the data types of our language of expressions. The back face shows the extension of the category of local state predicates by semantic weakest preconditions for local programs.

The task of a Hoare proof calculus is nothing but to generate the missing category $\mathsf{TC}$ of total correctness assertions about local programs by extending, step by step, the category $\mathsf{Ent}$ of local state assertions. In parallel, three new functors should be constructed connecting the new category $\mathsf{TC}$ to the framework, developed so far. The natural requirements for a Hoare proof calculus can be reflected, in terms of fibrations, by the following objectives:

1. (1). Soundness: The existence of a functor $\mathtt{TSem}:\mathsf{TC}\to\mathsf{Wp}$ such that $\varPi_{\mathsf{TC}}=\mathtt{TSem};\;\varPi_{\mathsf{Wp}}$ , means that the calculus is sound. If $\mathtt{TSem}$ is, in addition, full, the calculus is also complete.

2. (2). Conservative extension: The functor $\mathtt{E}_{ent}:\mathsf{Ent}\to\mathsf{TC}$ should be an embedding such that the top and the front face commute, that is, $\mathtt{E}_{ent};\;\mathtt{TSem}=\mathtt{Sem};\;\mathtt{E}_{pred}$ and $\mathtt{E}_{ent};\;\varPi_{\mathsf{TC}}=\varPi_{\mathsf{Ent}};\;\mathtt{E}_{cont}^op$ . In addition, the front square should be a pullback square. Note that due to pullback decomposition, this implies that also the top square becomes a pullback.

3. (3). Fibration: Requiring that the resulting functor $\varPi_{\mathsf{TC}}:\mathsf{TC}\to\mathsf{Prg}^{op}$ is a fibration, we enforce the application of deduction rules until $\mathsf{TC}$ comprises all deducible correctness assertions.

The existence of syntactic weakest preconditions allows us, due to Corollary 1, to describe the category $\mathsf{TC}$ of total correctness assertions independent of a concrete deduction calculus. Analogously to the construction of $\mathsf{Wp}$ , we need, however, some preparations. For any morphism $(in_{\lambda,\lambda'},c):\lambda\to\lambda'$ in $\mathsf{Prg}$ , we consider the function $wp(in_{\lambda,\lambda'},c):\mathtt{assn}(\lambda)\to\mathtt{assn}(\lambda')$ with $wp(in_{\lambda,\lambda'},c)(P)\triangleq wp(c,P)$ for all $P\in\mathtt{assn}(\lambda)$ . $wp({\varepsilon},Q)$ and $Q\,$ are logically equivalent thus we can assume w.l.o.g. that $wp({\varepsilon},Q)=Q\,$ thus $wp(in_{\lambda,\lambda'},{\varepsilon})$ becomes an inclusion function. As discussed in Subsection 3.4, syntactic weakest preconditions are context independent, and, in addition, they are monotone, that is, $P\Vdash_{\lambda} Q$ implies $wp(c,P)\Vdash_{\lambda'}wp(c,Q)$ for all inclusion functions $in_{\lambda,\lambda'}:\lambda\to\lambda'$ and all programs $c:\lambda'\to\lambda'$ . This means that the function $wp(in_{\lambda,\lambda'},c):\mathtt{assn}(\lambda)\to\mathtt{assn}(\lambda')$ defines, actually, a functor from $(\mathtt{assn}(\lambda),\Vdash_{\lambda})$ into $(\mathtt{assn}(\lambda'),\Vdash_{\lambda'})$ . Moreover, we have that $wp(c_1,wp(c_2,Q))$ and $wp(c_1;\;c_2,Q)$ are logical equivalent, that is, isomorphic in $(\mathtt{assn}(\lambda),\Vdash_{\lambda})$ , for arbitrary programs $c_1,c_2:\lambda\to\lambda$ and arbitrary local state assertions $Q\in\mathtt{assn}(\lambda)$ .

• objects: ${|{\mathsf{TC}}|}\triangleq{|{\mathsf{Ent}}|}$ is the set of all pairs $(\lambda.Q)$ of an extended context $\lambda\in{|{{\overline{\mathsf{Cont}}}}|}$ and a local state assertion $Q\in\mathtt{assn}(\lambda)$ .

• morphisms: a morphism $((in_{\lambda,\lambda'},c),\Vdash_{\lambda'}):(\lambda'.P)\to(\lambda.Q)$ is given by a morphism $(in_{\lambda,\lambda'},c):\lambda\to\lambda'$ in $\mathsf{Prg}$ such that the condition $\,P\Vdash_{\lambda'}wp(c,Q)$ is satisfied.

• identities: the identity on $(\lambda.P)$ is $((id_\lambda,{\varepsilon}),\Vdash_{\lambda})$ with the logical equivalence $P\Vdash_{\lambda}wp({\varepsilon},P)$ .

• composition: the composition of two morphisms $((in_{\lambda',\lambda''},c_1),\Vdash_{\lambda''}):(\lambda''.R)\to(\lambda'.P)$ and $((in_{\lambda,\lambda'},c_2),\Vdash_{\lambda'}):(\lambda'.P)\to(\lambda.Q)$ is the morphism $((in_{\lambda,\lambda''},c_1;\;c_2),\Vdash_{\lambda''}):(\lambda''.R)\to(\lambda.Q)$ . Composition is well-defined since both functors $wp(in_{\lambda,\lambda'},c_2);\;wp(in_{\lambda',\lambda''},c_1)$ and $wp(in_{\lambda,\lambda''},c_1;\;c_2)\,$ are natural isomorphic, and since the $\,\mathtt{ent}(\lambda)=(\mathtt{assn}(\lambda),\Vdash_{\lambda})$ are preorder categories.

  

The assignments $\varPi_{\mathsf{TC}}(\lambda.Q)\triangleq\lambda$ and $\varPi_{\mathsf{TC}}(((in_{\lambda,\lambda'},c),\Vdash_{\lambda'}): (\lambda'.P)\to(\lambda.Q))\triangleq((in_{\lambda,\lambda'},c):\lambda\to\lambda')$ define a projection functor $\varPi_{\mathsf{TC}}:\mathsf{TC}\to\mathsf{Prg}^{op}$ with fibers $\varPi_{\mathsf{TC}}^{-1}((id_\lambda,{\varepsilon}))\simeq\mathtt{ent}(\lambda) $ .

We discuss now if our three objectives for a Hoare proof calculus are indeed satisfied:

Soundness: We can define a functor $\mathtt{TSem}:\mathsf{TC}\to\mathsf{Wp}$ assigning to any object $(\lambda.Q)$ in $\mathsf{TC}$ the object $(\lambda.\mathtt{sem}_{\lambda}(Q))$ in $\mathsf{Wp}$ and to any morphism $((in_{\lambda,\lambda'},c),\Vdash_{\lambda'}):(\lambda'.P)\to(\lambda.Q)$ in $\mathsf{TC}$ with $\,P\Vdash_{\lambda'}wp(c,Q)$ the morphism $((in_{\lambda,\lambda'},c),\subseteq):(\lambda'.\mathtt{sem}_{\lambda'}(P))\to(\lambda.\mathtt{sem}_{\lambda}(Q))$ in $\mathsf{Wp}$ with $\mathtt{sem}_{\lambda'}(P)\subseteq\mathtt{wp}_{\lambda'}(c)(p_{\lambda',\lambda}^{-1}(\mathtt{sem}_{\lambda}(Q)))$ . Due to Proposition 3 as well as the definition and context independence of syntactic weakest preconditions, we have $\mathtt{wp}_{\lambda'}(c)(p_{\lambda',\lambda}^{-1}(\mathtt{sem}_{\lambda}(Q))) =\mathtt{wp}_{\lambda'}(c)(\mathtt{sem}_{\lambda'}(Q))=\mathtt{sem}_{\lambda'}(wp(c,Q));$ thus, the assignments are well-defined. The functor property can be shown straightforwardly and the required commutativity $\varPi_{\mathsf{TC}}=\mathtt{TSem};\;\varPi_{\mathsf{Wp}}$ is simply ensured by definition.

Conservative extension: Analogously to Theorem 6, the identity on ${|{\mathsf{TC}}|}\triangleq{|{\mathsf{Ent}}|}$ extends to an embedding $\mathtt{E}_{ent}:\mathsf{Ent}\to\mathsf{TC}$ mapping $(in_{\lambda,\lambda'},\Vdash_{\lambda'}):(\lambda'.P)\to(\lambda.Q)$ to $((in_{\lambda,\lambda'},{\varepsilon}),\Vdash_{\lambda'}):(\lambda'.P)\to(\lambda.Q)$ . $P\Vdash_{\lambda'}Q$ implies $P\Vdash_{\lambda'}wp({\varepsilon},Q)=Q$ , thus the embedding is well-defined. The resulting front square commutes, that is, we have $\mathtt{E}_{ent};\;\varPi_{\mathsf{TC}}=\varPi_{\mathsf{Ent}};\;\mathtt{E}_{cont}^{op}$ . Moreover, it is a pullback square since $\mathtt{E}_{ent}$ establishes isomorphisms between the fibers $\varPi_{\mathsf{Ent}}^{-1}(id_\lambda)\simeq\mathtt{ent}_{\lambda}$ and $\varPi_{\mathsf{TC}}^{-1}(\mathtt{E}_{cont}^{op}(id_\lambda)) =\varPi_{\mathsf{TC}}^{-1}((id_\lambda,{\varepsilon}))$ .

We know that $\mathtt{wp}_{\lambda'}({\varepsilon})$ is the identity on $(\wp(\varLambda_{\lambda'}),\subseteq);$ thus, the commutativity $\mathtt{Sem};\;\mathtt{E}_{pred}=\mathtt{E}_{ent};\;\mathtt{TSem}$ of the top square, and thus also its pullback property, can be easily shown.

Fibration: The functor $\varPi_{\mathsf{TC}}:\mathsf{TC}\to\mathsf{Prg}^{op}$ is a fibration since the equivalence of $wp(c_1,wp(c_2,Q))$ and $wp(c_1;\;c_2,Q)$ ensures that the morphism $((in_{\lambda,\lambda'},c),\Vdash_{\lambda'}):(\lambda'.wp(c,Q))\to(\lambda.Q)$ in $\mathsf{TC}$ is a Cartesian arrow for all morphisms $(in_{\lambda,\lambda'},c)^{op}:\lambda'\to\lambda$ in $\mathsf{Prg}^{op}$ and all objects $(\lambda.Q)$ in $\mathsf{TC}$ .

Instantiating Remark 6, we realize, first, that any morphism $(in_{\lambda,\lambda'},c):\lambda\to\lambda'$ in $\mathsf{Prg}$ can be factorized into the composition $(in_{\lambda,\lambda'},c)=(id_{\lambda},c);\;(in_{\lambda,\lambda'},{\varepsilon})$ of a morphism $(in_{\lambda,\lambda'},{\varepsilon}):\lambda\to\lambda'$ , originating from ${\overline{\mathsf{Cont}}}$ , and a new kind of morphism $(id_{\lambda},c):\lambda\to\lambda$ introducing programs. Second, we see that any morphism $((in_{\lambda,\lambda'},c),\Vdash_{\lambda'}):(\lambda'.P)\to(\lambda.Q)$ in $\mathsf{TC}$ can, correspondingly, be factorized $((in_{\lambda,\lambda'},c),\Vdash_{\lambda'})= ((in_{\lambda,\lambda'},{\varepsilon}),\Vdash_{\lambda'});\;((id_{\lambda},c),\Vdash_{\lambda})$ into a morphism $((in_{\lambda,\lambda'},{\varepsilon}),\Vdash_{\lambda'}):(\lambda',P)\to(\lambda,wp(c,Q))$ originating from $\mathsf{Ent}$ and a Cartesian arrow $((id_{\lambda},c),\Vdash_{\lambda}):(\lambda.wp(c,Q))\to(\lambda.Q)$ characterizing the program c (see the diagram above).

That is, to describe the extension of the category $\mathsf{Ent}$ to the category $\mathsf{TC}$ we need only the new arrows $((id_{\lambda},c),\Vdash_{\lambda}):(\lambda.wp(c,Q))\to(\lambda.Q)$ . Generating these special kind of Cartesian arrows is the essential task of a Hoare proof calculus. More precisely, a Hoare proof calculus does nothing but to extend the category $\mathsf{Ent}$ by new morphisms utilizing two procedures:

1. (1). Construction of Cartesian arrows: Generate the Cartesian arrow $((id_{\lambda},c),\Vdash_{\lambda}):(\lambda.wp(c,Q))\to(\lambda.Q)$ for any object $(\lambda.Q)$ in ${|{\mathsf{Ent}}|}={|{\mathsf{TC}}|}$ and any “program” morphism $(id_{\lambda},c):\lambda\to\lambda$ in $\mathsf{Prg}$ . These are the rules $\mathsf{Skip}$ , $\mathsf{Assn}$ , $\mathsf{AAssn}$ , $\mathsf{IfE}$ , $\mathsf{PWh}$ and $\mathsf{TWh}$ .

2. (2). Composition: Close everything w.r.t. composition

   1. a. by composing new morphisms in $\mathsf{TC}$ with new morphisms in $\mathsf{TC}$ (rule $\mathsf{Comp}$ ) and

   2. b. by pre- and post-composing new morphisms in $\mathsf{TC}$ with given morphisms from $\mathsf{Ent}$ (rules $\mathsf{Stren}$ and $\mathsf{Weakn}$ ).

In summary: Our discussion shows that we reached indeed all three objectives for the Hoare logic of total correctness assertions. As shown in Subsection 3.3, total correctness semantics and partial correctness semantics are structurally equivalent; thus, a corresponding variant of a categorical account of Hoare logic for partial correctness assertions and weakest liberal preconditions can be developed straightforwardly in a completely analogous way.