Proving the correctness of a flight-director program for an airborne minicomputer
Program verification procedures are described and used to determine the correctness of a program written for an airborne computer. The basic method relies on the inductive assertion method of Floyd (1967), modified and extended for application to a machine-language situation. Correctness considerations in the flight director program include self-modification, system correctness, executable instructions, overflow, approximate calculations with fractional quantities, and fixed point scaling. An example proof of correctness, which proceeds by proving the correctness of a certain subroutine, is provided.