The Guarded Command Language (GCL) is a programming language defined by Edsger Dijkstra for predicate transformer semantics in EWD472.^[1] It combines programming concepts in a compact way. It makes it easier to develop a program and its proof hand-in-hand, with the proof ideas leading the way; moreover, parts of a program can actually be calculated.

An important property of GCL is nondeterminism. For example, in the if-statement, several alternatives may be true, and the choice of which to choose is done at runtime, when the if-statement is executed. This frees the programmer from having to make unnecessary choices and is an aid in the formal development of programs.

GCL includes the multiple assignment statement. For example, execution of the statement x, y:= y, x is done by first evaluating the righthand side values and then storing them in the lefthand variables. Thus, this statement swaps the values of x and y.

The following books discuss the development of programs using GCL:

• Dijkstra, Edsger W. (1976). A Discipline of Programming. Prentice Hall. ISBN 978-0132158718.
• Gries, D. (1981). The Science of Programming. Monographs in Computer Science (in English, Spanish, Japanese, Chinese, Italian, and Russian). New York: Springer Verlag. doi:10.1007/978-1-4612-5983-1. ISBN 978-0-387-96480-5. S2CID 37034126.
• Dijkstra, Edsger W.; Feijen, Wim H.J. (1988). A Method of Programming. Boston, MA: Addison-Wesley Longman Publishing Co., Inc. p. 200. ISBN 978-0-201-17536-3.
• Kaldewaij, Anne (1990). Programming: the derivation of algorithms. Prentice-Hall, Inc. ISBN 0132041081.
• Cohen, Edward (1990). David Gries (ed.). Programming in the 1990s: An introduction to the calculation of programs. Texts and Monographs in Computer Science. Springer Verlag. doi:10.1007/978-1-4613-9706-9. ISBN 978-1-4613-9706-9. S2CID 1509875.

Guarded command

The guarded command is the most important element of the guarded command language. In a guarded command, just as the name says, the command is "guarded". The guard is a proposition, which must be true before the statement is executed. At the start of that statement's execution, one may assume the guard to be true. Also, if the guard is false, the statement will not be executed. The use of guarded commands makes it easier to prove the program meets the specification. The statement is often another guarded command.

skip and abort

skip and abort are important statements in the guarded command language. abort is the undefined instruction: do anything. It does not even need to terminate. It is used to describe the program when formulating a proof, in which case the proof usually fails. skip is the empty instruction: do nothing. It is used in the program itself, when the syntax requires a statement but the state should not change.

skip

abort

Assignment

Assigns values to variables.

v := E

v0, v1, ..., vn := E0, E1, ..., En

Catenation

Statements are separated by one semicolon (;)

Selection: if

The selection (often called the "conditional statement" or "if statement") is a list of guarded commands, of which one is chosen to execute. If more than one guard is true, one statement whose guard is true is nondeterministically chosen to be executed. If no guard is true, the result is undefined. Because at least one of the guards must be true, the empty statement skip is often needed. The statement if fi has no guarded commands, so there is never a true guard. Hence, if fi is equivalent to abort.

if G0 → S0
 □ G1 → S1
...
 □ Gn → Sn
fi

if a < b then set c to True
else set c to False

if a < b → c := true
 □ a ≥ b → c := false
fi

if error is True then set x to 0

if error → x := 0
 □ ${\displaystyle \neg }$error → skip
fi

if a ≥ b → max := a
 □ b ≥ a → max := b
fi

Repetition: do

Execution of this repetition, or loop, is shown below.

do G0 → S0
 □ G1 → S1
...
 □ Gn → Sn
od

a, b := A, B;
do a < b → b := b - a
 □ b < a → a := a - b
od

a, b, x, y, u, v := A, B, 1, 0, 0, 1;
do b ≠ 0 →
   q, r := a div b, a mod b;
   a, b, x, y, u, v := b, r, u, v, x - q*u, y - q*v
od

do a>b → a, b := b, a
 □ b>c → b, c := c, b
 □ c>d → c, d := d, c
od

x, y = 1, 1;
do x≠n →
   if f(x) ≤ f(y) → x := x+1
    □ f(x) ≥ f(y) → y := x; x := x+1
   fi
od

Applications

PullDownGuard → y := 0
PullUpGuard → y := 1

References