💻 computer science

Nonstandard Axiomatic Semantics

This paper demonstrates that axiomatic semantics based on Hoare logic admits nonstandard models similar to Skolem's, thereby failing to uniquely define operational semantics, and proposes enriching the system with additional proof obligations to resolve this ambiguity without affecting standard trace models.

Original authors: Patrick Cousot

Published 2026-08-25

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Patrick Cousot

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the world of computer science, there is a constant tension between how we describe what a program should do and how we prove that it actually does it. For decades, researchers have relied on a system called Hoare logic to verify software. This system works like a set of logical rules: if a program starts in a certain state, and we can prove it follows specific steps, then it must end in a desired state. It is a powerful tool for ensuring that code is free of errors, much like a mathematical proof ensures a theorem is true. However, just as mathematicians once discovered that their rules for counting numbers could accidentally describe strange, impossible worlds, computer scientists have found that the rules for verifying programs might also describe impossible ways for code to run. The question is whether the logic we use to trust our software is actually precise enough to rule out these impossible scenarios.

A researcher at New York University has recently shown that the standard rules for verifying programs are indeed too loose. They demonstrated that the logic used to prove programs correct allows for "nonstandard" models of execution. In simple terms, this means the rules allow for a program to run in ways that are mathematically possible within the logic but physically impossible in the real world. Imagine a program that counts up forever. The standard view is that it starts at zero and goes to one, two, three, and so on, never stopping. The logic, however, also permits a version of this program that has run for an infinite amount of time in the past before we even start watching it, or one that exists in a strange, extended timeline that doesn't match our normal understanding of time. The researcher proved that the current logic cannot tell the difference between the normal, expected behavior of a program and these bizarre, nonstandard behaviors. This is a significant problem because if the logic cannot distinguish between the real world and these impossible worlds, it does not uniquely define what a program actually does.

To understand why this happens, one must look at how loops in computer programs are verified. When a program repeats a block of code, such as a loop that runs while a condition is true, the logic requires a "loop invariant." This is a statement that remains true every time the loop repeats. The researcher showed that for many programs, you can invent a loop invariant that is true for the standard, normal execution of the code, but it is also true for these strange, nonstandard executions. For example, consider a program that counts up. The logic allows a proof that works for a count starting at zero and going up, but it also allows a proof that works for a count that has been running backward from negative infinity, or one that exists in a timeline with extra, invisible steps that humans cannot perceive. Because the logic treats these different timelines as valid, it fails to pin down a single, unique meaning for the program. The logic is ambiguous, much like an old definition of numbers that allowed for "ghost" numbers that behave like normal numbers but are not part of the standard counting sequence.

The paper does not just identify this ambiguity; it offers a way to fix it. The researcher proposes adding extra requirements to the verification process, inspired by methods used to prove that a program will eventually stop running. These new requirements act as a filter. They demand that the proof of a program's correctness must also show that the program's execution follows a specific, standard path through time. Specifically, the new rules require that if you were to count the steps of a loop, the count must follow the standard progression of numbers we use every day, without any hidden, infinite extensions. If a program's behavior relies on those strange, nonstandard timelines, the new rules will fail to prove it correct. This effectively forces the logic to ignore the impossible worlds and focus only on the standard, real-world executions that we care about.

Crucially, the researcher shows that for any program that behaves normally, these new requirements are automatically satisfied. This means that for the vast majority of software verification work that people do today, the existing proofs remain valid and unchanged. The new rules do not make the job of proving programs correct harder for standard cases; they simply close the back door that allowed the impossible cases to sneak in. The result is a more precise definition of what a program means. By adding these extra checks, the logic finally becomes a unique description of program behavior, ensuring that when we say a program is correct, we are talking about exactly one specific way it runs, not a collection of possible realities including some that defy our understanding of time and sequence.

This work connects a deep problem in the foundations of mathematics with the practical task of writing safe software. Just as mathematicians once refined their definition of numbers to exclude impossible variations, this research refines the definition of program execution. It ensures that the tools we use to verify the safety of critical systems are not just logically consistent, but also grounded in the single, standard reality of how computers actually operate. The solution is elegant because it does not require rewriting the entire system of program verification; it simply adds a guardrail that keeps the logic on the intended path, ensuring that our confidence in software is based on a unique and well-defined truth.

Technical Summary: Nonstandard Axiomatic Semantics

Problem Statement

The paper addresses a fundamental ambiguity in axiomatic semantics based on Hoare logic. Analogous to Skolem's nonstandard models of Peano arithmetic, the author demonstrates that Hoare logic admits nonstandard models of program execution. Specifically, the logic does not uniquely characterize the intended operational semantics (trace semantics) of programming languages up to isomorphism.

The core issue arises in the Rule of Iteration. While Hoare logic uses inductive invariants to reason about loops, the standard logic theory cannot distinguish between:

Standard traces: Finite executions and infinite executions indexed by standard natural numbers ( $\mathbb{N}$ ).
Nonstandard traces: Executions indexed by nonstandard natural numbers (e.g., Skolem models containing "infinite pasts" or "infinite futures" beyond the standard $\omega$ ).

Consequently, a Hoare logic proof valid for a standard trace model is also valid for nonstandard models where loops may have nonstandard lengths (e.g., starting in a nonstandard past or continuing into a nonstandard future). This implies that Hoare logic, as traditionally formulated, does not specify a unique, well-defined operational semantics.

Methodology

The author employs a comparative analysis between standard trace semantics and nonstandard trace semantics, utilizing concepts from abstract interpretation and fixpoint theory.

Formalizing Trace Semantics:
- Standard Semantics: Defined via least ($lfp$) and greatest ($gfp$) fixpoints on the lattice of finite ( $\Sigma^*$ ) and infinite ( $\Sigma^\infty$ ) traces indexed by $\mathbb{N}$ .
- Nonstandard Semantics: Extended to traces indexed by nonstandard sets such as $\mathbb{N} + \delta$ (forward nonstandard traces with an infinite future) and $\mathbb{N} - \delta$ (backward nonstandard traces with an infinite past), where $\delta > 0$ . These sets model Skolem-like structures.
Abstraction and Equivalence:
- The paper defines an abstraction function $\alpha_S$ mapping trace semantics to the set of valid Hoare triples.
- Theorem 1 proves that the set of valid Hoare triples for the standard semantics ( $H(L)$ ) is identical to the set of valid triples for the nonstandard semantics ( $\tilde{H}(L)$ ). This confirms that the standard Hoare proof rules are insufficient to rule out nonstandard interpretations.
Proposed Remedy (Standardisation):
To resolve this ambiguity, the author proposes enriching axiomatic semantics with additional proof obligations inspired by termination proof methods (specifically Knuth's method and ordinal variants).
- Preventing Nonstandard Forward Traces: The logic is extended to require the existence of an increasing function $K$ mapping trace positions to ordinals ( $\mathcal{O}$ ) such that the loop counter is bounded by the first infinite limit ordinal $\omega$ . Since nonstandard integer parts cannot be order-isomorphic to well-founded ordinals, this requirement eliminates nonstandard forward infinite traces.
- Preventing Nonstandard Backward Traces: A dual requirement is introduced for backward traces, requiring a decreasing function $K$ (antitone) that ensures backward traversal terminates within a standard bound.

Key Contributions

Identification of Nonstandard Models: The paper formally establishes that Hoare logic suffers from the same non-uniqueness problem as Peano arithmetic without Dedekind's categoricity condition. It shows that loop invariants in first-order logic cannot distinguish between standard and nonstandard trace models due to the compactness theorem.
Equivalence of Theories: It proves that the standard and nonstandard Hoare logic theories are identical ( $H(L) = \tilde{H}(L)$ ), meaning existing proofs do not inherently exclude nonstandard executions.
Standardisation via Ordinal Constraints: The paper proposes a method to restrict axiomatic semantics to standard models by adding proof obligations involving ordinal counters (bounded by $\omega$ for forward traces and requiring termination for backward traces).
Preservation of Standard Proofs: A crucial result is that these additional proof obligations are always satisfied by the standard trace semantics. Therefore, if one assumes the standard interpretation (as is implicit in most uses of Hoare logic), the existing Hoare proofs remain valid and unchanged. The new obligations serve to formally exclude nonstandard models without altering the practical verification of standard programs.

Results

Theoretical Equivalence: The set of Hoare triples valid for nonstandard trace models is exactly the same as for standard models.
Ambiguity Resolution: By imposing the ordinal bounding conditions (Equations 9 and 10), the axiomatic semantics is restricted to the standard model.
Applicability: The proposed standardisation is compatible with existing static analysis and typing algorithms that rely on Hoare logic, provided the underlying assumption of standard semantics is made explicit or the new obligations are verified (which is trivial for standard models).
Limitations: The paper notes that in Abstract Hoare Logics, where the concrete domain is replaced by an abstract domain that may not be expressive enough to define the required ordinal functions, the standardisation methods might not be directly applicable.

Significance

The paper argues that the common assertion that "axiomatic semantics defines a program's meaning by its effects on logical assertions" is technically flawed because the defined meaning is not unique up to isomorphism. The significance lies in:

Clarifying the Foundations: It highlights that Hoare logic, like Peano arithmetic, requires a "categoricity" condition (in this case, standardisation via ordinal bounds) to ensure a unique operational interpretation.
Formalizing Implicit Assumptions: It makes explicit the implicit hypothesis that Hoare logic is interpreted over standard computation models.
Bridging Logic and Semantics: It demonstrates how termination proof techniques (using ordinals) can be integrated into axiomatic semantics to eliminate nonstandard interpretations, thereby aligning axiomatic semantics more rigorously with operational trace semantics.

The author concludes that while Hoare logic proofs need not be changed for standard models, the theoretical framework must acknowledge and formally exclude nonstandard models to claim a unique definition of program semantics.