Proof outlines

							Proof outlines.        A way of representing correctness proofs.
Proof outline – a program annotated with the assertions used in its
correctness proof.
(We may omit some of them, but not the main pre- and postcondition
and the loop invariants in front of the loops).
Ex.:   {x = n}
       { INV [y→1] }
       y := 1;
       { invariant : INV }
       while ¬(x=1) do ( { ¬(x=1) ∧ INV }
                             { x − 1 > 0 ⇒ (y ∗ x ∗ (x−1)! = n! ∧ n ≥ x − 1) }
                             y := y ∗ x;
                             { INV [x → x−1] }
                             x := x−1 { IN V } )
       { ¬¬(x=1) ∧ INV } { y = n! ∧ n > 0 }

Where INV = (x > 0 ⇒ (y ∗ x! = n! ∧ n ≥ x))
              Proof outlines (definition)

         { P [x→a] } x := a { P }       { P } skip { P }

                  { P } S1 { Q } { Q } S2 { R }
                       { P } S1 { Q } S2 { R }

             { b ∧ P } S 1 { Q } { ¬b ∧ P } S 2 { Q }
{ P } if b then { b ∧ P } S 1 { Q } else { ¬b ∧ P } S 2 { Q } { Q }

                          {b ∧ P }S {P }
   { invariant : P } (while b do { b ∧ P }S{ P }) { ¬b ∧ P }

           { P ′ } S { Q′ }
                                    if P ⇒ P ′ and Q′ ⇒ Q
     { P } { P ′ } S { Q′ } { Q }

 Some assertions may be skipped, but not the main pre- and
    postcondition and the loop invariants (marked red).