Behind Clint and Hoare’s goto Proof Rule

This paper takes a new look at Clint and Hoare’s proof rule for goto statements, published almost fifty years ago, and discloses several new findings unnoticed before. We start out to propose that the rule take small changes, so it becomes more manageable. As we explore further, we have discovered a simple total correctness rule for goto statements, which uses the variant function to argue about termination just like we do for loops. We further extend the idea and have obtained general proof rules, applicable to multiple labels, for both partial and total correctness of goto statements. Those rules, although complex in appearance, are easy to use in practice. We have successfully applied them to prove programs that current published rules failed to.