Program Correctness
 but first, a note on proving things equivalent... 
If you are asked to prove that 2 statements are equivalent,

P <--> Q

then you must either show they are identical (often hard), or you
must show both:

P --> Q  and  Q --> P

If you are asked to show that 3 statements P,Q,R are equivalent, you 
can get away with P --> Q, Q --> R, and R --> P.  Why is this all you need?
Ok, back to program correctness.

Program correctness has two goals:

  1. Prove (really, *prove*) that some small bit of code is correct
  2. Increase your confidence that a larger program is correct.

Mostly we focus on the first case, and talk about a few formal methods to demonstrate that a piece of code is correct. But good programmers learn to constantly think about each line of code; and what assumptions is may break or what property it may gauruntee.

These proofs become complicated very quickly, so we will only consider small problems. In real applications, formal proofs of program correctness are done (1) for very small pieces of very important code (such as network routers...), and (2) by automated program verification procedures. There is a lot of promise in (2), but it hasn't yet gotten to the point where you can verify your java code.

Preconditions and Postconditions
We will prove code correct with respect to pre-conditions and post-conditions. These are propositions which are defined based upon variables in the scope of the current function. For instance, a program segment may be: 

{x > 0, y > 0}
Abstractions of Code
The "Computer Science" Philosophy is that everything can be improved by modularizing and abstracting. By abstracting pieces of code, we can provide proof strategies for each type of programming construct. What are these constructs?
  1. Assignment
  2. Conditional
  3. Composition
  4. Loops
  5. Recursion
For each of these rules we describe how to prove {P} S {Q} 
    

  1. Assignment:  {P} x := 3 {Q}
Assume P', prove Q'
where P' is P with every instance of x replaced with 3
and   Q' is Q with every instance of x replaced with 3

{} x := y - 1

  2. Conditional:  {P} if A, S, else R, endif {Q}
Break into cases, and prove both:
case 1:  {P ^ A} S {Q}, 
case 2:  {P ^ B} R {Q}, 

example:

  3. Composition

  4. Loops

  5. Recursion
For each of these rules we describe how to prove {P} S {Q}