Assertions 101

An assertion is an expression on program process state that evaluates to true or false. Without side effects. Simple assertions are made up of Boolean expressions. Deeper assertions use First or Higher Order Logics. These notes are about using assertions in Java, C++, [TBD Scala and Python].

1. Assertions are expressions yielding true/false on a process state.
2. We should really say process state.
3. So, what is a state?

1. An assertion is an expression on a program state that we expect to evaluate to true. Without side effects.
2. Assertions are predicates written using the syntax of the host programming language. All the variables are those of a program. We are allowed to write side-effect free boolean functions to deal with for-all and there-exists quantifiers.
3. Simple assertions are made up of Boolean expressions.
4. Deeper assertions use First or Higher Order Logics.
5. An assertion is placed at a control point.

1. {P} S {Q} is known as the Floyd-Hoare Triplet, named after Turing Award winners Robert Floyd and Tony Hoare.
2. P and Q are assertions. S is a block of code.

1. Every loop has an assertion placed within the loop. It is called a loop invariant.
2. For while-loops, the traditional location for the loop invariant is just-left-of the Boolean expression.
3. Invariant means that the relationship given remains true every time control hits the location. Not that nothing changes. E.g., x > y + 2 can be an invariant, even though both x and y change.

1. Every class has an assertion that describes the relationships among its data members and public methods. This called the class invariant.
2. Quick Example: See Small Set example.

1. Ex: Assertions for sorting:

   {n >= 0}  sorting-alg {sorted(a[0..n-1]) and perm(a, a')} 
   
   

2. Assertions, with Tiny Examples
3. Practical-Advice on Writing Assertions
4. The 3n+1 Termination Problem
5. Assertions in Java
6. Assertions in C++

1. Consider {pre P:: x is an integer} S {post Q:: x is a prime number}.
   1. Assume that this code S is part of a program that also uses an integer variable named y.
   2. The obligations of S are clear. At the end of it, the value that x has must be a prime number.
2. But what about y? If the value of y was y0 before S, can we expect that y is equal to y0 after S? The pre- and post- were silent on y. So is S free to do what ever to y?
3. Suppose S was x := exp. Do not jump to the conclusion that after all this is an assignment to x, therefore y could not change.
4. From now on, our expectation is this: If we have a sequence of statements S, and its P and Q are silent with respect to (wrt) y, then y must remain as it was before/after S.

1. There is an implicit for all in the assertions. E.g., when we write n >= 0 in the entry assertions, it includes for all n that you may give so that n >=0. The n that is bound here is taken in all subsequent assertions – in loop invariants and in the exit assertion.

1. This question is important when we have threads/ processes.
2. Consider the S and Q as above. Instantaneouly after S finished, Q is true. Are we expecting that Q will remain true, say for another 60 secs?
3. Consider S; S2. Let e1 = ending time of S, let b2= beginning time stamp of S2. Recall that in all modern PLs, we must not assume that b2 == e1 + delta. Clearly, delta cannot be negative. We cannot say that for some d, delta < d.
4. Concurrency literature talks about "interference". Without interference, we expect the post condition Q to hold good at least until S2 starts. In the presence of interference, we must not expect this.

1. Gries, David, The Science of Programming, Springer, 2012 [shouldn't this be 1981?]. Highy Recommended.
2. Alagic, Suad, and Michael A. Arbib. The Design of Well-Structured and Correct Programs. Springer Science & Business Media, 2013. Highy Recommended.