In 1980 Tony Hoare received the ACM Turing Award “for his fundamental contributions to the definition and design of programming languages”. This article examines the achievements that led to this award.

Abstract We present a history of Hoare’s logic.

We provide an in-depth study of the knowledge-theoretic aspects of communication in so-called gossip protocols. Pairs of agents communicate by means of calls in order to spread information—so-called secrets—within the group. Depending on the nature of such calls knowledge spreads in different ways within the group. Systematizing existing literature, we identify 18 different types of communication, and model their epistemic effects through corresponding indistinguishability relations. We then provide a classification of these relations and show its usefulness for an epistemic analysis in presence of different communication types. Finally, we explain how to formalise the assumption that the agents have common knowledge of a distributed epistemic gossip protocol.

Gossip protocols aim at arriving, by means of point-to-point or group communications, at a situation in which all the agents know each other secrets. Distributed epistemic gossip protocols use as guards formulas from a simple epistemic logic and as statements calls between the agents. They are natural examples of knowledge based programs.We prove here that these protocols are implementable, that their partial correctness is decidable and that termination and two forms of fair termination of these protocols are decidable, as well. To establish these results we show that the definition of semantics and of truth of the underlying logic are decidable.

Gossip protocols deal with a group of communicating agents, each holding a private information, and aim at arriving at a situation in which all the agents know each other secrets. Distributed epistemic gossip protocols are particularly simple distributed programs that use formulas from an epistemic logic. Recently, the implementability of these distributed protocols was established (which means that the evaluation of these formulas is decidable), and the problems of their partial correctness and termination were shown to be decidable, but their exact computational complexity was left open. We show that for any monotonic type of calls the implementability of a distributed epistemic gossip protocol is a P^{NP}_{||}-complete problem, while the problems of its partial correctness and termination are in coNP^{NP}.

The book under review is a translation of the book that appeared first in French, in 2007.The fact that it was translated only 8 years later does not take anything away from its relevance.Still, as mentioned at the end, some small additions could have been made to make it more up to date.The subject of the book is a historical account of the developments in logic, and (using Dijkstra's terminology) computing science, interpreted as the science of computing, culminating with a presentation and justification of the computerassisted proofs.In the process some small incursions in the history of mathematics are made and philosophical issues related to computing are discussed.This is an interesting story, spanning more than 2500 years, and the author tells it well.The book is meant for a 'general reader', which means that no mathematical notation and concepts beyond, say, primary school are assumed.Adopting such restrictions makes the task of writing such book quite a challenge, but the reward is that it can be read by a wide audience.Chapter 1 of the book starts with a short reference to the Babylonian times with an example of the problem of dividing 1,152,000 measures of grain by 7, that was found on an ancient tablet dating from about 2500 BC.Such specific problems were generalised by the Greeks to questions requiring reasoning instead of just computing.As an example the problem of establishing the irrationality of √ 2 is given.Then the Aristotle logic of syllogisms and the improvement upon it by the Stoics are discussed and Euclid's Elements are mentioned.The author notes that Euclid's approach was based on an axiomatic method, yet in spite of it Greeks never applied logic to mathematics (in their case geometry and number theory).The explanation is of course, that their logic was just too simplistic.The other reason, mentioned only in the next chapter, is that it was only thanks to Descartes (and Fermat) that geometric problems could be expressed in a logical form, as formulas of the theory of real numbers.The side effect of this separation between logic and mathematics was that computing fell in-between and was not further investigated, in particular not by means of reasoning.Chapter 2 provides a minimalistic crash course in the history of computing by discussing in turn a couple of seminal points: the contributions of Thales, Euclid's algorithm, positional notation, and calculus.One specific contribution that could have been mentioned here was Heron's method of computing a good approximation of the square root, as it can be viewed as the starting point of numerical analysis.

One of the natural objectives of the field of the social networks is to predict agents' behaviour. To better understand the spread of various products through a social network (Apt and Markakis (2011, Lecture Notes in Computer Science, pp. 212–223)) introduced a threshold model, in which the nodes influenced by their neighbours can adopt one out of several alternatives. To analyse the consequences of such product adoption we associate here with each such social network a natural strategic game between the agents. In these games the payoff of each player weakly increases when more players choose his strategy, which is exactly opposite to the congestion games. The possibility of not choosing any product results in two special types of (pure) Nash equilibria. We show that such games may have no Nash equilibrium and that determining an existence of a Nash equilibrium, also of a special type, is NP-complete. This implies the same result for a more general class of games, namely polymatrix games. The situation changes when the underlying graph of the social network is a directed acyclic graph, a simple cycle, or, more generally, has no source nodes. For these three classes we determine the complexity of an existence of (a special type of) Nash equilibria. We also clarify for these categories of games the status and the complexity of the finite best response property and the finite improvement property (FIP). Further, we introduce a new property of the uniform FIP which is satisfied when the underlying graph is a simple cycle, but determining it is co-NP-hard in the general case and also when the underlying graph has no source nodes. The latter complexity results also hold for the property of being a weakly acyclic game.

We introduce a new threshold model of social networks, in which the nodes influenced by their neighbours can adopt one out of several alternatives. We characterize social networks for which adoption of a product by the whole network is possible (respectively necessary) and the ones for which a unique outcome is guaranteed. These characterizations directly yield polynomial time algorithms that allow us to determine whether a given social network satisfies one of the above properties. We also study algorithmic questions for networks without unique outcomes. We show that the problem of determining whether a final network exists in which all nodes adopted some product is NP-complete. In turn, we also resolve the complexity of the problems of determining whether a given node adopts some (respectively, a given) product in some (respectively, all) network(s). Further, we show that the problem of computing the minimum possible spread of a product is NP-hard to approximate with an approximation ratio better than Ω(n), in contrast to the maximum spread, which is efficiently computable. Finally, we clarify that some of the above problems can be solved in polynomial time when there are only two products.

We introduce a new measure of the discrepancy in strategic games between the social welfare in a Nash equilibrium and in a social optimum, that we call selfishness level. It is the smallest fraction of the social welfare that needs to be offered to each player to achieve that a social optimum is realized in a pure Nash equilibrium. The selfishness level is unrelated to the price of stability and the price of anarchy and is invariant under positive linear transformations of the payoff functions. Also, it naturally applies to other solution concepts and other forms of games. We study the selfishness level of several well-known strategic games. This allows us to quantify the implicit tension within a game between players' individual interests and the impact of their decisions on the society as a whole. Our analyses reveal that the selfishness level often provides a deeper understanding of the characteristics of the underlying game that influence the players' willingness to cooperate. In particular, the selfishness level of finite ordinal potential games is finite, while that of weakly acyclic games can be infinite. We derive explicit bounds on the selfishness level of fair cost sharing games and linear congestion games, which depend on specific parameters of the underlying game but are independent of the number of players. Further, we show that the selfishness level of the $n$-players Prisoner's Dilemma is c/(b(n-1)-c), where b and c are the benefit and cost for cooperation, respectively, that of the n-players public goods game is (1-c/n)/(c-1), where c is the public good multiplier, and that of the Traveler's Dilemma game is (b-1)/2, where b is the bonus. Finally, the selfishness level of Cournot competition (an example of an infinite ordinal potential game), Tragedy of the Commons, and Bertrand competition is infinite.

The family of Groves mechanisms, which includes the well-known VCG mechanism (also known as the Clarke mechanism), is a family of efficient and strategy-proof mechanisms. Unfortunately, the Groves mechanisms are generally not budget balanced. That is, under such mechanisms, payments may flow into or out of the system of the agents, resulting in deficits or reduced utilities for the agents. We consider the following problem: within the family of Groves mechanisms, we want to identify mechanisms that give the agents the highest utilities, under the constraint that these mechanisms must never incur deficits. We adopt a prior-free approach. We introduce two general measures for comparing mechanisms in prior-free settings. We say that a non-deficit Groves mechanism M individually dominates another non-deficit Groves mechanism M' if for every type profile, every agent's utility under M is no less than that under M', and this holds with strict inequality for at least one type profile and one agent. We say that a non-deficit Groves mechanism M collectively dominates another non-deficit Groves mechanism M' if for every type profile, the agents' total utility under M is no less than that under M', and this holds with strict inequality for at least one type profile. The above definitions induce two partial orders on non-deficit Groves mechanisms. We study the maximal elements corresponding to these two partial orders, which we call the individually undominated mechanisms and the collectively undominated mechanisms, respectively.

We consider a framework in which a group of agents communicates by means of emails, with the possibility of replies, forwards and blind carbon copies (BCC). We study the epistemic consequences of such email exchanges by introducing an appropriate epistemic language and semantics. This allows us to find out what agents learn from the emails they receive and to determine when a group of agents acquires common knowledge of the fact that an email was sent. We also show that in our framework from the epistemic point of view the BCC feature of emails cannot be simulated using messages without BCC recipients.

We consider two simple variants of a framework for reasoning about knowledge amongst communicating groups of players. Our goal is to clarify the resulting epistemic issues. In particular, we investigate what is the impact of common knowledge of the underlying hypergraph connecting the players, and under what conditions common knowledge distributes over disjunction. We also obtain two versions of the classic result that common knowledge cannot be achieved in the absence of a simultaneous event (here a message sent to the whole group).

We provide here an epistemic analysis of arbitrary strategic games based on the possibility correspondences. Such an analysis calls for the use of transfinite iterations of the corresponding operators. Our approach is based on Tarski's Fixpoint Theorem and applies both to the notions of rationalizability and the iterated elimination of strictly dominated strategies.

We consider qualitative simulation involving a finite set of qualitative relations in presence of complete knowledge about their interrelationship. We show how it can be naturally captured by means of constraints expressed in temporal logic and constraint satisfaction problems. The constraints relate at each stage the past of a simulation with its future. The benefit of this approach is that it readily leads to an implementation based on constraint technology that can be used to generate simulations and to answer queries about them.

No abstract available.

We study here schedulers for a class of rules that naturally arise in the context of rule-based constraint programming. We systematically derive a scheduler for them from a generic iteration algorithm of Apt (2000). We apply this study to so-called membership rules of Apt and Monfroy (2001). This leads to an implementation that yields a considerably better performance for these rules than their execution as standard CHR rules. Finally, we show how redundant rules can be identified and how appropriately reduced sets of rules can be computed.

Abstract. Edsger Wybe Dijkstra was born in Rotterdam on 11 May 1930. His mother was a mathematician and father a chemist. In 1956 he graduated from the University of Leiden in mathematics and theoretical physics. In 1959 he received his PhD from the University of Amsterdam for his thesis entitled ‘Communication with an Automatic Computer’, devoted to a description of the assembly language designed for the first commercial computer developed in the Netherlands, the X1. It also dealt with the concept of an interrupt, a novelty at that time. His PhD thesis supervisor was Aad van Wijngaarden.

We study here a natural situation when constraint programming can be entirely reduced to rule-based programming. To this end we explain first how one can compute on constraint satisfaction problems using rules represented by simple first-order formulas. Then we consider constraint satisfaction problems that are based on predefined, explicitly given constraints. To solve them we first derive rules from these explicitly given constraints and limit the computation process to a repeated application of these rules, combined with labeling. We consider two types of rule here. The first type, that we call equality rules, leads to a new notion of local consistency, called rule consistency that turns out to be weaker than arc consistency for constraints of arbitrary arity (called hyper-arc consistency in Marriott & Stuckey (1998)). For Boolean constraints rule consistency coincides with the closure under the well-known propagation rules for Boolean constraints. The second type of rules, that we call membership rules, yields a rule-based characterization of arc consistency. To show feasibility of this rule-based approach to constraint programming, we show how both types of rules can be automatically generated, as CHR rules of Frühwirth (1995). This yields an implementation of this approach to programming by means of constraint logic programming. We illustrate the usefulness of this approach to constraint programming by discussing various examples, including Boolean constraints, two typical examples of many valued logics, constraints dealing with Waltz's language for describing polyhedral scenes, and Allen's qualitative approach to temporal logic.

Constraing propagation algorithms form an important part of most of the constraint programming systems. We provide here a simple, yet very general framework that allows us to explain several constraint propagation algorithms in a systematic way. In this framework we proceed in two steps. First, we introduce a generic iteration algorithm on partial orderings and prove its correctness in an abstract setting. Then we instantiate this algorithm with specific partial orderings and functions to obtain specific constraint propagation algorithms. In particular, using the notions commutativity and semi-commutativity, we show that the AC-3, PC-2, DAC, and DPC algorithms for achieving (directional) arc consistency and (directional) path consistency are instances of a single generic algorithm. The work reported here extends and simplifies that of Apt [1999a].

We provide here a proof theoretic account of constraint programming that attempts to capture the essential ingredients of this programming style. We exemplify it by presenting proof rules for linear constraints over interval domains, and illustrate t

We describe here an implemented small programming language, called Alma-O, that augments the expressive power of imperative programming by a limited number of features inspired by the logic programming paradigm. These additions encourage declarative programming and make it a more attractive vehicle for problems that involve search. We illustrate the use of Alma-O by presenting solutions to a number of classical problems, including α-β search, STRIPS planning, knapsack, and Eight Queens. These solutions are substantially simpler than their counterparts written in the imperative or in the logic programming style and can be used for different purposes without any modification. We also discuss here the implementation of Alma-O and an operational, executable, semantics of a large subset of the language.

We augment the expressive power of imperative programming in order to make it a more attractive vehicle for problems that involve search. The proposed additions are limited yet powerful and are inspired by the logic programming paradigm. We illustrate their use by presenting solutions to a number of classical problems, including the straight search problem, the knapsack problem, and the 8 queens problem. These solutions are substantially simpler than their counterparts written in the conventional way and can be used for different purposes without any modification.The proposed language is an intermediate stage on the road towards a realization of a strongly typed constraint programming language that combines the advantages of the logic programming and imperative programming.

We show here that meta-variables of Prolog admit a simple declarative interpretation. This allows us to extend the usual theory of SLD-resolution to the case of logic programs with meta-variables, and to establish soundness and strong completeness of

Abstract We provide here a systematic comparative study of the relative strength and expressive power of a number of methods for program analysis of Prolog. Among others we show that these methods can be arranged in the following hierarchy: mode analysis ⇒ type analysis ⇒ monotonic properties ⇒ nonmonotonic run-time properties. We also discuss a method allowing us to prove global run-time properties.

In most PROLOG implementations, for efficiency occur-check is omitted from the unification algorithm. This paper provides natural syntactic conditions that allow the occur-check to be safely omitted. The established results apply to most well-known PROLOG programs, including those that use difference lists, and seem to explain why this omission does not lead in practice to any complications. When applying these results to general programs, we show their usefulness for proving absence of floundering. Finally, we propose a program transformation that transforms every program into a program for which only the calls to the built-in unification predicate need to be resolved by a unification algorithm with the occur-check.

Program transformations are proposed as a means of providing fair parallelism semantics for parallel programs with shared variables. The transformations are developed in two steps. First, abstract schedulers that implement the various fairness policies are introduced. These schedulers use random assignments z := ? to represent the unbounded nondeterminism induced by fairness. Concrete schedulers are derived by suitably refining the ?. The transformations are then obtained by embedding the abstract schedulers into the parallel programs. This embedding is proved correct on the basis of a simple transition semantics. Since the parallel structure of the original program is preserved, the transformations also provide a basis for syntax-directed proofs of total correctness under the fairness assumption. These proofs make use of infinite ordinals.

We study here declarative and dynamic aspectS of nonmonotonic reasoning in the context of deductive databases.More precisely, we consider here maintenance of a special class of indefinite deductive databases, called stratified databases, introduced in Apt, Blair and Walker [ABW] and Van Gelder [VG] in which recursion "through" negation is disallowed.A stratified database has a natural model associated with it which is selected as its intended meaning.The maintenance problem for these databases is complicated because insertions can lead to deletions and vice versa.To solve this problem we make use of the ideas present in the works of Doyle [DJ and de Kleer [dK] on belief revision systems.We offer here a number of solutions which differ in the amount of static and dynamic information used and the form of support introduced.We also discuss the implementation issues and the trade-offs involved.

The relations among various languages and models for distributed computation and various possible definitions of fairness are considered. Natural semantic criteria are presented which an acceptable notion of fairness should satisfy. These are then used to demonstrate differences among the basic models, the added power of the fairness notion, and the sensitivity of the fairness notion to irrelevant semantic interleavings of independent operations. These results are used to show that from the considerable variety of commonly used possibilities, only strong process fairness is appropriate for CSP if these criteria are adopted. We also show that under these criteria, none of the commonly used notions of fairness are fully acceptable for a model with an n-way synchronization mechanism. Finally, the notion of fairness most often mentioned for Ada is shown to be fully acceptable.

Four semantics for a small programming language involving unbounded (but countable) nondeterminism are provided. These comprise an operational semantics, two state transformation semantics based on the Egli-Milner and Smyth orders, respectively, and a weakest precondition semantics. Their equivalence is proved. A Hoare-like proof system for total correctness is also introduced and its soundness and completeness in an appropriate sense are shown. Finally, the recursion theoretic complexity of the notions introduced is studied. Admission of countable nondeterminism results in a lack of continuity of various semantic functions, and this is shown to be necessary for any semantics satisfying appropriate conditions. In proofs of total correctness, one resorts to the use of (countable) ordinals, and it is shown that all recursive ordinals are needed.

The problem of correctness of the solutions to the distributed termination problem of Francez [7] is addressed. Correctness criteria are formalized in the customary framework for program correctness. A very simple proof method is proposed and applied to show correctness of a solution to the problem. It allows us to reason about liveness properties of temporal logic (see, e.g., Manna and Pnueli [12]) using a new notion of weak total correctness .

How the distributed termination convention of CSP repetitive commands can be modeled using other CSP constructs is shown.The presented transformation suggests a simple implementation of this convention.We argue that this convention should be used as a compiler option.

In a previous paper a proof system dealing with partial correctness of communicating sequential processes was introduced.Soundness and relative completeness of this system are proved here.It is also m&cated in what way the semantics and the proof system can be extended to deal with the total correctness of the programs Categories and SubJect Descriptors: F. ILogics and Meanings of Programs]

Horn clauses of first-order predicate logic can be regarded as a high-level programming language when SLD-resoluUon, a special-purpose resolution theorem prover, is used as interpreter.Consequently, the semantics of Horn clauses can be studied both by model-theoreuc and fixpomt methods (in the sense of Scott).This posslbihty is exploited here by identifying the least (greatest) fixpomt with a least (greatest) model Successful termination of SLD-resolution is characterized by least fixpomts A semantic characterization of t'mlte failure of SLD-resoluuon is given, which coincides with the greatest fixpomt only for a special case of clauses.It is shown that nondetermmistlc flowchart schemata of bounded nondeterminaey are modeled by this special case; the connection between finite fadure and greatest fixpomt is then used to give a semantic characterization of termmauon, blocking, and nontermination of such flowchart schemata Categories and Subject Descriptors" F 3 1 ILogics and Meanings of Programs]' Speofymg and Verifying and Reasoning about Programs--logics of programs, F 4.1 [Mathematlcal Logic and Formal Languagesl Mathematical Logic--logic programming, 1 2 3 [Artificial Intelligencel.Deduction and Theorem Proving-logic programming

A survey of various results concerning Hoare's approach to proving partial and total correctness of programs is presented.Emphasis is placed on the soundness and completeness issues.Various proof systems for while programs, recursive procedures, local variable declarations, and procedures with parameters, together with the corresponding soundness, completeness, and incompleteness results, are discussed.

It is proved that in the general case of arbitrary context-free schemes a program is (partially) correct with respect to given initial and final assertions if and only if a suitable finite system of intermediate assertions can be found. Assertions are allowed from the extended state space $\mathcal {V} \times \mathcal {V}$. This result contrasts with the results of [2], where it is proved that if assertions are taken from the original state space $\mathcal {V}$, then in the general case an infinite system of intermediate assertions is needed. The extension of the state space allows a unification in the relational framework of [2], of the (essence of the) results of [2], and of [4], [5] and [6], and provides a semantic counterpart of the use of auxiliary variables.

An axiomatic proof system is presented for proving partial correctness and absence of deadlock (and failure) of communicating sequential processes. The key (meta) rule introduces cooperation between proofs, a new concept needed to deal with proofs about synchronization by message passing. CSP's new convention for distributed termination of loops is dealt with. Applications of the method involve correctness proofs for two algorithms, one for distributed partitioning of sets, the other for distributed computation of the greatest common divisor of n numbers.

This paper is devoted to the study of the infinitistic rules of proof i.e. those which admit an infinite number of premises. The best known of these rules is the ω-rule. Some properties of the ω-rule and its connection with the ω-models on the basis of the ω-completeness theorem gave impulse to the development of the theory of models for admissible fragments of the language . On the other hand the study of representability in second order arithmetic with the ω-rule added revealed for the first time an analogy between the notions of re-cursivity and hyperarithmeticity which had an important influence on the further development of generalized recursion theory. The consideration of the subject of infinitistic rules in complete generality seems to be reasonable for several reasons. It is not completely clear which properties of the ω-rule were essential for the development of the above-mentioned topics. It is also worthwhile to examine the proof power of infinitistic rules of proof and what distinguishes them from finitistic rules of proof. What seemed to us the appropriate point of view on this problem was the examination of the connection between the semantics and the syntax of the first order language equipped with an additional rule of proof.