SE 504 (Formal Methods and Models)
Irrelevant Array Element Axiom

An important axiom pertaining to array element evaluation is as follows:

Provided that R does not depend upon the contents of array b and that every expression F occurring in P as a subscript of b (i.e., in a subexpression of the form b.F) satisfies [R ⇒ F ≠ k], we have

[(*i | R : P)(b := b(k:E)) = (*i | R : P)]

where * is any quantifier.

Intuitively, this says that if b.k is not needed to evaluate (*i | R : P), then replacing every occurrence of b in P by b(k:E) (or vice versa) will have no effect upon the result of such evaluation.

To illustrate, suppose we have the expression

G: (+i | 0≤i<n : b.i)

It is clear that the value of this expression depends upon each of b.0, b.1, ..., b.(n-1), but not upon b.n. Hence, it should be clear that the expression

G': (+i | 0≤i<n : b.i)(b := b(n:27))

obtained by replacing every occurrence of b in G by b(n:27)) has the same value as G in all states.

To apply the axiom formally, we instantiate it using R := 0≤i<n, P := b.i, k := n, E := 27, i := i, b := b, and * := +, from which we obtain:

Provided that 0≤i<n does not depend upon the contents of elements of array b and that every expression F occurring in b.i as a subscript of b (i.e., in a subexpression of the form b.F) satisfies [0≤i<n ⇒ F ≠ n], we have

[(*i | 0≤i<n : b.i)(b := b(n:27)) = (*i | 0≤i<n : b.i)]

Clearly, 0≤i<n does not depend upon the contents of b. Furthermore, as the only expression that occurs as a subscript of b in b.i is i, we need only verify, in addition, that [0≤i<n ⇒ i≠n]. This clearly holds. Hence, the two premises of the axiom hold, which means that, according to the axiom, so does its conclusion (which is [G' = G]).

For an application of this axiom in the context of developing a program, see the solution to the Prefix Sums problem.