We examine the question of whether history variables are necessary in formal proofs of correctness for coroutines. History variables are special variables which are added to a program to facilitate its proof by recording the execution history of the program. Such variables were first used by Clint in his paper "Program Proving: Coroutines." They have also been used by Owicki and Howard (concurrent program) and by Apt (sequential programs). We argue that recording the entire history of a computation in a single set of variables is inconvenient and leads to extremely complicated proofs. We propose a modification of Clint's axiom system and a strategy for constructing proofs which eliminates the need for history variables in verifying simple coroutines. Examples are given to illustrate this technique of verifying coroutines and our axiom system is shown to be sound and relatively complete with respect to an operational semantics for coroutines. Finally, we discuss extensions of the coroutine concept for which history variables do appear to be needed; we also discuss the question of whether history variables are necessary in verifying concurrent programs.
[1]
Robert W. Floyd,et al.
Assigning meaning to programs
,
1967
.
[2]
Edmund M. Clarke.
Program invariants as fixed points
,
1977,
18th Annual Symposium on Foundations of Computer Science (sfcs 1977).
[3]
John H. Howard.
Proving monitors
,
1976,
CACM.
[4]
Susan S. Owicki,et al.
A consistent and complete deductive system for the verification of parallel programs
,
1976,
STOC '76.
[5]
Edmund M. Clarke.
Programming language constructs for which it is impossible to obtain good hoare-like axiom systems
,
1977,
POPL '77.
[6]
Zohar Manna,et al.
Formalization of Properties of Functional Programs
,
1970,
JACM.
[7]
J. W. de Bakker,et al.
On the Completeness of the Inductive Assertion Method
,
1975,
J. Comput. Syst. Sci..
[8]
Jan A. Bergstra,et al.
Recursive Assertions are not enough - or are they?
,
1979,
Theor. Comput. Sci..