Program Construction Calculating Implementations

from Specifications 1st Edition Roland Backhouse

pdf download

https://ebookname.com/product/program-construction-calculating-
implementations-from-specifications-1st-edition-roland-backhouse/

Get Instant Ebook Downloads – Browse at https://ebookname.com

Instant digital products (PDF, ePub, MOBI) available
Download now and explore formats that suit you...

Guide Specifications for Highway Construction 9th

Edition Aashto

https://ebookname.com/product/guide-specifications-for-highway-
construction-9th-edition-aashto/

The Kiln Book Materials Specifications Construction 3°

Edition Frederick L. Olsen

https://ebookname.com/product/the-kiln-book-materials-
specifications-construction-3-edition-frederick-l-olsen/

Calculating promises 1st Edition Roy Kreitner

https://ebookname.com/product/calculating-promises-1st-edition-
roy-kreitner/

Titans Fox vs Pitt Dick Leonard

https://ebookname.com/product/titans-fox-vs-pitt-dick-leonard/
Biochemistry and Genetics 2007 p 514 3rd Edition Golder
Wilson

https://ebookname.com/product/biochemistry-and-
genetics-2007-p-514-3rd-edition-golder-wilson/

MIMO OFDM for LTE WiFi and WiMAX Coherent versus Non
coherent and Cooperative Turbo Transceivers Wiley IEEE
1st Edition Lajos L Hanzo

https://ebookname.com/product/mimo-ofdm-for-lte-wifi-and-wimax-
coherent-versus-non-coherent-and-cooperative-turbo-transceivers-
wiley-ieee-1st-edition-lajos-l-hanzo/

Work Psychology Understanding Human Behaviour in the

Workplace 4th Edition Joanne Silvester

https://ebookname.com/product/work-psychology-understanding-
human-behaviour-in-the-workplace-4th-edition-joanne-silvester/

Mountains 1st Edition Peter Aleshire

https://ebookname.com/product/mountains-1st-edition-peter-
aleshire/

Handbook of Stress Trauma and the Family Routledge

Psychosocial Stress Series 1st Edition Don. R.
Catherall

https://ebookname.com/product/handbook-of-stress-trauma-and-the-
family-routledge-psychosocial-stress-series-1st-edition-don-r-
catherall/
Reverberation Chambers Theory and Applications to EMC
and Antenna Measurements 1st Edition Stephen J. Boyes

https://ebookname.com/product/reverberation-chambers-theory-and-
applications-to-emc-and-antenna-measurements-1st-edition-stephen-
j-boyes/
Program Construction
This page intentionally left blank
Calculating Implementations
from Specifications

Roland Backhouse
The University of Nottingham, UK

WILEY
 Copyright © 2003 John Wiley & Sons, Ltd
The Atrium, Southern Gate, Chichester,
West Sussex PO19 8SQ, England
National 01243 779777
International (+44) 1243 779777
Email (for orders and customer service enquiries): cs-books@wiley.co.uk
Visit our Home Page on http://www.wileyeurope.com or http://www.wiley.com
All Rights Reserved. No part of this publication may be reproduced, stored in a retrieval
system or transmitted in any form or by any means, electronic, mechanical, photocopying,
recording, scanning or otherwise, except under the terms of the Copyright, Designs and
Patents Act 1988 or under the terms of a licence issued by the Copyright Licensing Agency
Ltd, 90 Tottenham Court Road, London WIT 4LP, UK, without the permission in writing of
the Publisher, with the exception of any material supplied specifically for the purpose of
being entered and executed on a computer system, for exclusive use by the purchaser of the
publication. Requests to the Publisher should be addressed to the Permissions Department,
John Wiley & Sons, Ltd, The Atrium, Southern Gate, Chichester, West Sussex PO19 8SQ,
England, or emailed to permreq@wiley.co.uk, or faxed to (+44) 1243 770620.
Neither the authors nor John Wiley & Sons, Ltd accept any responsibility or liability for
loss or damage occasioned to any person or property through using the material, instruc-
tions, methods or ideas contained herein, or acting or refraining from acting as a result of
such use. The authors and publisher expressly disclaim all implied warranties, including
merchantability or fitness for any particular purpose. There will be no duty on the authors
or publisher to correct any errors or defects in the software.
Designations used by companies to distinguish their products are often claimed as trade-
marks. In all instances where John Wiley & Sons, Ltd is aware of a claim, the product names
appear in capital or all capital letters. Readers, however, should contact the appropriate
companies for more complete information regarding trademarks and registration.
This publication is designed to provide accurate and authoritative information in regard
to the subject matter covered. It is sold on the understanding that the Publisher is not
engaged in rendering professional services. If professional advice or other expert assis-
tance is required, the services of a competent professional should be sought.
Wiley also publishes its books in a variety of electronic formats. Some content that appears
in print may not be available in electronic books.

Library of Congress Cataloging-in-Publication Data

(to follow)

British Library Cataloguing in Publication Data

A catalogue record for this book is available from the British Library
0 470 84882 0

Typeset in 10/12.5pt Lucida Bright by T&T Productions Ltd, London.

Printed and bound in Great Britain by Biddies Ltd, Guildford and Kings Lynn.
This book is printed on acid-free paper responsibly manufactured from sustainable
forestry in which at least two trees are planted for each one used for paper production.
 Contents

Preface ix

1 A Science of Computing 1
1.1 Debugging 2
1.2 Testing a Correct Program 3
1.3 Testing an Incorrect Program 5
1.4 Correct by Construction 6

2 A Searching Problem and Its Solution 9

2.1 Problem Statement 9
2.2 Problem Solution 11
2.3 Proof of Correctness 12
2.4 What, Why and How 14
2.5 Exercises 15
2.6 Summary 21

3 Calculational Proof 23
3.1 The Nature of Proof 23
3.2 Construction versus Verification 26
3.3 Formatting Calculations 31
3.3.1 Basic Structure 31
3.3.2 Hints 32
3.3.3 Relations between Steps 34
3.3.4 'If and 'Only If 36
3.4 A Classic Example 37
3.5 Summary 39

4 Implementation Issues 41
4.1 Binary Search 41
4.1.1 Implementation 44
4.2 Verifying Correctness—A Taster 45
4.3 Summary 52

5 Calculational Logic: Part 1 53

5.1 Logical Connectives 54
5.2 Boolean Equality 56
5.3 Examples of the Associativity of Equivalence 59
5.4 Continued Equivalences 61
5.5 The Island of Knights and Knaves 63
vi Contents

5.6 Negation 65
5.7 Summary 68

6 Number Conversion 71
6.1 The Floor Function 71
6.2 Properties of Floor 73
6.3 Indirect Equality 75
6.4 Rounding Off 77
6.5 Summary 80

7 Calculational Logic: Part 2 83

7.1 Disjunction 83
7.2 Conjunction 85
7.3 Implication 88
7.3.1 Definitions and Basic Properties 89
7.3.2 Replacement Rules 90
7.4 Exercises: Logic Puzzles 93
7.5 Summary 96

8 Maximum and Minimum 97

8.1 Definition of Maximum 97
8.2 Using Indirect Equality 98
8.3 Exercises 101
8.4 Summary 103

9 The Assignment Statement 105

9.1 Hoare Triples 105
9.2 Ghost Variables 107
9.3 Hoare Triples as Program Specifications 109
9.4 Assignment Statements 112
9.5 The Assignment Axiom 113
9.6 Calculating Assignments 115
9.7 Complications 118
9.8 Summary 119

10 Sequential Composition and Conditional Statements 121

10.1 Sequential Composition 121
10.2 The skip Statement 123
10.3 Conditional Statements 124
10.4 Reasoning about Conditional Statements 126
10.5 Constructing Conditional Statements 130
10.6 Combining the Rules 132
10.7 Summary 136

11 Quantifiers 137
11.1 DotDotDot and Sigmas 137
11.2 Introducing Quantifier Notation 141
11.2.1 Summation 141
11.2.2 Free and Bound Variables 143
11.2.3 Properties of Summation 146
11.2.4 The Gauss Legend 151
11.2.5 Warning 152
Contents vii

1 1.3 Universal and Existential Quantification 153

11.3.1 Universal Quantification 154
11.3.2 Existential Quantification 155
11.3.3 De Morgan's Rules 156
1 1 .4 Quantifier Rules 156
11.4.1 The Notation 157
11.4.2 Free and Bound Variables 158
11.4.3 Dummies 158
11.4.4 Range Part 158
11.4.5 Trading 159
11.4.6 Term Part 159
1 1 .4. 7 DistributMty Properties 159
11.5 Summary 163

12 Inductive Proofs and Constructions 165

12.1 Patterns and Invariants 166
12.2 Mathematical Induction 170
12.3 Strong Induction 175
12.4 From Verification to Construction 179
12.5 Summary 182

13 Iteration 183
13.1 The do-od Statement 183
13.2 Constructing Loops 184
13.3 Basic Arithmetic Operations 187
13.3.1 Summing the Elements of an Array 187
13.3.2 Evaluating a Polynomial 188
13.3.3 Evaluation of Powers 191
13.4 Summary 195

14 Sorting and Searching Algorithms 197

14.1 The Dutch National Flag 197
14.1.1 Problem Statement 197
14.1.2 The Solution 199
14.1.3 Verifying the Solution 201
14.2 Finding the K Smallest Values 205
14.2.1 The Specification 206
14.2.2 The Algorithm 208
14.3 Summary 212

15 Remainder Computation 215

15.1 Formal Specification 215
15.2 Elementary Algorithm 217
15.3 The mod and div Functions 219
15.3.1 Basic Properties 221
15.3.2 Separating mod from 4- 223
15.3.3 Separating + from mod 224
15.3.4 Modular Arithmetic 224
15.4 Long Division 228
15.4.1 Implementing Long Division 229
15.4.2 Discarding Auxiliary Variables 233
15.5 On-line Remainder Computation 234
1 5.6 Casting Out Nines 238
15.7 Summary 239
viii Contents

16 Cyclic Codes 241

16.1 Codes and Codewords 241
16.2 Boolean Polynomials 243
16.3 Data and Generator Polynomials 246
16.4 Long Division 247
16.5 Hardware Implementations 249
16.6 Summary 253

Appendix 255

Solutions to Exercises 263

References 331

Glossary of Symbols 333

Index 335
 Preface

Programming is a highly skilled activity, and good programmers are few and far
between. In few other professions is the 90-10 rule (90% of the effort goes into
the last 10% of the work) so vitally important. Many programmers are able to
write programs that 'work' in most circumstances; few programmers know the
basic principles of program specification, let alone how to construct programs
that guarantee to meet their specifications in all circumstances.
It is no wonder. Many texts have been written that explain how to encode compu-
tational processes in some specific programming language (C, Java, Visual Basic,
or whatever), but few tackle the much harder problem of presenting the problem-
solving skills that are needed to formulate programming problems precisely and
concisely, and to convert those formulations into elegant implementations.
This book is about programming per se. It is about the most elementary princi-
ples of program construction—problem decomposition, invariant properties, and
guarantees of progress. It is intended to appeal to both novice programmers, who
wish to start on the right track, and to experienced programmers who wish to
properly master their craft.
Although the subject matter of the book is 'elementary', in the sense of foun-
dational, it is not 'easy'. Programming is challenging, and it is wrong to skirt the
issues or to wrap it up in a way that makes it seem otherwise. I have lectured
on this material for many years, mostly to undergraduates on computing science
degrees, and, occasionally, to professional programmers. Inevitably, it is the expe-
rienced programmers who appreciate its value the most. Novice programmers
have the additional hurdle of learning how to write code—too often in a highly
complex programming language. For them, the problem is the programming lan-
guage, whereas, of course, the programming language should not be a problem,
but part of the solution.
In order to present the real challenges of programming without obfuscation,
the book uses a very simple programming language, with just four programming
constructs—assignment, sequential composition, conditionals and loops. I have
omitted variable declarations, so that the focus of the book remains clear. Experts
will recognize the language as the Guarded Command Language, a simple, elegant
language designed by Dijkstra specifically for this purpose.
 Preface

The book is a major revision of my earlier book Program Construction and Ver-
ification, published in 1986. Some sections remain the same, but there is much
that is different. The main difference is reflected in the omission of 'verification'
in the title. The primary goal of the book is to show how programs are constructed
to meet their specifications, by means of simple, mathematical calculations. The
emphasis on construction is crucial; the fact that the calculations can be formally
verified is also important, but much less so. Unfortunately, however, the empha-
sis in many related texts is the reverse; the fundamental principles of program
construction are introduced as a mechanism for performing a post hoc validation
of the program's correctness, and their integral role in the activity of developing
programs is neglected. Even worse, automatic verification is often given as the pri-
mary justification for their use. I have no doubt that this misplaced emphasis on
verification rather than construction has, for long, stood in the way of the accep-
tance and active use of the principles by practising programmers. Quite rightly,
professional programmers will strive to ensure that their programs are correct by
construction; it is this endeavour that this text aims to support.
Another aspect of the text that has undergone major revision is the discus-
sion of logical reasoning. I now realize just how inadequate my own education
in logic has been. The traditional style of reasoning in mathematics is to verify
a conjecture by means of a sequence of true statements, each statement being a
self-evident truth or implied by earlier ones. Calculational logic, as presented in
this book, places equality of propositions at the forefront. Mathematical theorems
are derived (not verified) by a process of algebraic calculation, just as in school
algebra and in differential and integral calculus.
The basis for calculational logic was formulated by Dijkstra and Scholten, in
their 1990 book Predicate Calculus and Program Calculus. In my view, their work
has initiated a major revolution in the art of effective reasoning. As yet, however,
it is largely unknown in mathematical circles. Hopefully, this book will help to
foster the widespread acceptance and application of their ideas.

Intended Readership
The book has been written primarily for self-study. Many exercises have been sup-
plied, with complete solutions, interspersed throughout the text. Only by making a
serious attempt at the exercises can the material be properly mastered. My hope is
that readers will do the exercises as they read, rather than postponing them until
the chapter has been completed. Many of the exercises are quite challenging; the
solutions are there to be consulted, so that the reader can build up confidence
and experience in an effective, calculational style of reasoning.
I anticipate that all readers will have an elementary, operational understanding
of at least one programming language. (By this, I mean that they will know about
the store ('memory') of a computer, and how an assignment statement updates the
store. They will also know how conditional statements, sequences of statements,
Preface xi

and loops are executed.) Most benefit will be gained by studying the book simulta-
neously with, or shortly after, learning how to code in a conventional (preferably
simple!) programming language. In this way, it is possible to appreciate just how
easy it is to get things wrong, and to gain the satisfaction of being confident that
you are right.
The assumed mathematical knowledge is minimal. Only simple properties of
arithmetic (including inequalities between integers and reals) are required. How-
ever, my experience of where students have difficulty (apart from the intrinsic
difficulty of the subject matter) is primarily in the mathematical skill of alge-
braic manipulation. Allowing sufficient time in the curriculum for the students to
develop this skill, rather than trying to cram it into an already overfull syllabus,
is the best remedy.
Lots more examples and exercises could have been included in the book. I have
deliberately refrained from doing so in order to keep the book relatively short.
My plan is to publish additional supporting material from time to time, access to
which can be gained via the URL http://www.wiley.com/go/backhouse.

Acknowledgments
It is a pleasure to record my gratitude to some of the people who have helped in
the realization of this book, however indirect their help may have been.
First and foremost, I am indebted to my own teachers, without whom my own
work would not have been possible. It will soon become very evident to the reader
of the 'Bibliographic Remarks' who has influenced me the most. I am particularly
indebted to the late Edsger W. Dijkstra, whose writings have been a major inspi-
ration for many years. I have also learnt much from David Giles's books; David
also reviewed an early draft of this book, in exceptionally comprehensive and
helpful detail, for which I am very grateful. Thanks, too, to Tony Hoare, for his
support and encouragement; I am also grateful to him and the Queen's University
of Belfast for kind permission to reproduce a major part of his inaugural lecture.
I learnt a very great deal during the 13 years that I spent in the Netherlands,
about mathematical method, about teamwork, and about academic and scientific
values. Many thanks go to Henk Doornbos, Paul Hoogendijk, Ed Voermans and
Jaap van der Woude, whose loyalty and enthusiasm are unforgettable. Thanks,
also, to Doaitse Swierstra for his support and friendship in difficult times. Special
thanks must go to Netty van Gasteren, who tragically died only recently, from
whom I learnt more than I really appreciated at the time.
A number of people have helped directly by reading drafts of the text, pointing
out errors and making suggestions for improvements. Robert L. Baber and Tony
Seda both gave me extensive and very thoughtful reviews of an earlier draft. I hope
that I have done justice to their criticisms. Diethard Michaelis has also sent me
many invaluable comments and corrections.
xii Preface

The book was prepared using Math/pad, a system that aims to integrate the
process of doing mathematics and writing about it. Its use, in combination with
the TjX and KTgX systems, has been of immeasurable benefit to me. I am grateful
to Eindhoven University of Technology and the Dutch government for their gen-
erous support of the development and implementation of Math/pad. I am greatly
indebted to Richard Verhoeven, who not only implemented the system, working
many long hours in doing so, but who also has always been, and continues to be,
extremely helpful, willing and generous, giving of his time far beyond the call of
duty.
Thanks are also due to the staff of John Wiley & Sons, Ltd, for their friendly
and professional help in producing this book. Thanks also to Sam Clark, of
T&T Productions Ltd, for the cheerful and competent way he has assisted in trying
to make sure that everything is exactly right.
As always, my biggest thanks go to my wife, Hilary.
Roland Backhouse
January 2003
 1
A Science of
Computing

The hallmark of a science is the avoidance of error.

J. Robert Oppenheimer

The electronic, digital computer is a marvel of modern technology. Within a life-

time* it has developed from nothing to a tool whose use is so widespread that we
are often unaware that it is there. The first computers, built in the 1940s, were
monstrous. As recently as the 1960s and 1970s, it was common for new employ-
ees in a company to be shown 'the computer'—housed in a special-purpose, air-
conditioned room, to which admission was restricted to a select few. Nowadays,
computers are used in many household appliances, they are also used in cars,
trains and aircraft, and we even carry them around with us—laptops, palm-tops,
what would we do without them?
The developments in computer hardware have been truly phenomenal. But
developments in computer software have not kept pace. The programming lan-
guages that are in use today have changed little from the programming languages
that were developed in the 1950s, and programming remains a highly skilled activ-
ity. It is the nature of the task that is the problem. The hardware designer must
build a dumb machine, whose sole purpose is to slavishly execute the instructions
given to it by the programmer; the programmer has to design general-purpose sys-
tems and programs, at a level of detail at which they can be faithfully executed,
without error, by even the dumbest of machines.
 Chapter 1: A Science of Computing

1.1 Debugging
There is a story about the current state of computer software that is widely
reported on the Internet. The chief executive of a multi-billion dollar software
company compared the computer industry with the car industry.
'If the automobile industry had kept up with technology like the com-
puter industry has,'
he is reported to have said,
'we would all be driving $25 cars that get 1000 to the gallon'.
'That may be true,'

was the swift response of the president of one automobile company,

'but who would want to drive a car that crashes twice a day?'
This story is, most likely, just a joke1. But, like all good jokes, it succeeds because
it reflects profoundly on modern-day reality.
At the time of writing (December 2002), it is still the case that computer soft-
ware is liable to spontaneously 'crash', due to simple programming errors (or
'bugs' as they are called in the software industry). In contrast, the car indus-
try is often held up as an exemplar of excellence in standards of safety and
reliability.
Memories are short. Cars may be (relatively) safe and reliable today but, in the
1950s, as highlighted by Ralph Nader in his acclaimed book Unsafe At Any Speed,
cars were knowingly made and sold that were liable to spontaneous crashes, and
car manufacturers were guilty of deliberately undermining efforts to invest in
improved standards. ('Safety and sales strategies do not mix' was the argument
used at the time.)
The computer industry of today is very much like the car industry of the 1950s.
Computers are still relatively new, and the novelty factor has not worn off, so that
guarantees of reliability and fitness-for-purpose are, for many, a low priority. Few
programmers are trained in scientific methods of constructing programs and,
consequently, they waste substantial amounts of effort 'debugging' their pro-
grams, rarely with complete success. ('Debugging' is the process of repeatedly
testing, followed by patching, the program, in an attempt to remove discovered
errors.)
The need for alternative, mathematically rigorous, program construction tech-
niques was recognized in the late 1960s when the large computer manufactur-
ers first began to realize that the costs of producing computer software were
1
At least, I think it is. It may be true, but it is difficult to verify the authenticity of material on the
Internet. For this reason, names have been omitted in this account.
1.2 Testing a Correct Program 3

outstripping by far the costs of producing computer hardware. They spoke of

a 'software crisis'. The problems of producing reliable computer software were
aired at two conferences on Software Engineering, held in 1968 and 1969 and
sponsored by the NATO Science Committee. Typical of the sort of facts laid
bare at these conferences was the following statement by Hopkins of the IBM
Corporation.
We face a fantastic problem in big systems. For instance, in OS/3602
we have about 1000 errors per release.
Tellingly, he added:
Programmers call their errors 'bugs' to preserve their sanity; that num-
ber of 'mistakes' would not be psychologically acceptable.
The process of debugging has several drawbacks: it is useless as a methodology
for constructing programs, it can never be used to establish the correctness of a
correct program, and it cannot be relied upon to establish the incorrectness of an
incorrect program.
Let us look in detail at these drawbacks. Here are two examples, each illustrating
a different aspect.

1.2 Testing a Correct Program

One well-known method of computing n 2 , for some positive integer n, without
performing a multiplication is to sum the first n odd numbers. This is based on
the property that
n2 = 1+3 + 5 + . . . + ( 2 n - l ) .
Not so well known is that a similar method can be used to compute n3, n4, n5,
etc., without performing a multiplication. To see how this is done let us re-express
the computation of n2 as follows.
First, write down all the positive integers up to (and including) 2n - 1. For n - 6,
this means the numbers 1 through 11.
1 2 3 4 5 6 7 8 9 10 11
Cross out every second number:
1 3 5 7 9 1 1
Finally, add these together to form a running total:
1 4 9 16 25 36
3
To compute n , begin as before by writing down all the positive numbers, but
this time up to 3n - 2. For n = 6, this means the numbers I through 16.
2
At that time, OS/360 was a widely used operating system for IBM computers.
4 Chapter 1: A Science of Computing

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
Cross out every third number:
1 2 4 5 7 8 10 11 13 14 16
Add these together to form a running total:
1 3 7 12 19 27 37 48 61 75 91
Cross out every second number:
1 7 19 37 61 91
Finally, form a running total:
1 8 27 64 125 216
The general algorithm for computing nm is to write down all the positive
numbers up to mn-m+ 1. Then we iterate m-l times the process of cross-
ing out numbers followed by forming a running total. On the feth iteration every
(m-k+l)th number is crossed out. (In this way, the set of numbers crossed out
changes from every mth number on the first iteration to every second number on
the last iteration.)
Now, we can test this algorithm in two ways. We can extend one of the existing
tables to the right; for example, the table for n2 can be extended to calculate 72
and8 2 :
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
1 3 5 7 9 11 13 15
1 4 9 16 25 36 49 64
Alternatively, we can add new tables to the ones we already have; for example,
the table for 34:
1 2 3 4 5 6 7 8 9
1 2 3 5 6 7 9
1 3 6 11 17 24 33
1 3 11 17 33
1 4 15 32 65
1 15 65
1 16 81
We can continue this testing as much as we like (indeed, for ever and a day).
Each time we add more entries and verify the correct result, our confidence in the
algorithm grows. But, this process will never make us totally confident. Can we be
sure that it will correctly compute 215 or 612? On the evidence presented so far
would you be willing to gamble on its correctness?
Edsger W. Dijkstra, an eminent computer scientist, has summarized the flaw in
testing in a now-famous quotation.
Program testing can be used to show the presence of bugs, but never
to show their absence.
L3 Testing an Incorrect Program

Figure 1.1 Cutting the cake.

Exercise 1.1 (Cutting the cake). This exercise demonstrates the fallacy of using
'poor man's induction', i.e. extrapolating from a few cases to a more general claim.
Suppose n points are marked on the circumference of a circular cake and then
the cake is cut along the chords joining them. The points are chosen in such a
way that all intersection points of pairs of chords are distinct. The question is: in
how many portions does this cut the cake?
Figure 1.1 shows the case when n is 1, 2, 3 or 4.
Suppose n = 5. Determine the number of portions. On the basis of these five
cases make a conjecture about the number of portions for arbitrary n. Now, sup-
pose n - 0. Does this support or refute the conjecture? Next, suppose n = 6. Deter-
mine the number of portions. What do you discover? D

1.3 Testing an Incorrect Program

Testing cannot be used to establish the absence of errors in a program. Nor can
testing be relied upon to show the presence of errors.
I once had a very graphic illustration of this when I had to mark a programming
assignment. The problem the students had been set was to write a program that
would compare two strings for equality. One student's solution was to assign the
value true or false to a boolean equal as follows3:
equal := (stringl.length = string?,length);
if equal
then for i := 1 to string I.length
do equal := (stringl.char act er[i\ = string2.char act er[i})
The problem with this code is that it returns the value true whenever the two
strings have equal length and their last characters are identical. For example, the
two strings 'cat' and 'mat' would be declared equal because they both have length
three and end in't'.
The student was quite taken aback when I demonstrated the error. Indeed, upon
further questioning, it emerged that the program had been tested quite system-
3
The program is coded in Pascal. The characters of a string 5 are assumed to be stored in the
array s,character, indexed from 1 to s.length.
 Chapter 1: A Science of Computing

atically. First, it had been tested on several pairs of identical strings, and then on
several pairs of strings of unequal length. Both these tests had produced satis-
factory results. The final test had been to input several pairs of equal length but
unequal strings, such as 'cat' and 'dog', or 'house' and 'river'.
This final test is interesting because it is possible to use simple probability
theory to make a rough estimate of the chances of discovering the programming
error. The details are not relevant here. Suffice it to say that, assuming pairs of
words of equal length are generated with equal letter frequencies (that is, each
letter in the alphabet is chosen with a probability of 1/26), there is only a one
in three chance of discovering the error after ten tests; increasing the number
of tests to 20 would still only yield a one in two chance, and one would need to
perform over 50 tests to achieve a 90% chance of discovering the error. Finally,
and most importantly, there is no certainty that one would ever discover the error,
no matter how many tests have been performed.
So, you see that program testing is never-ending. We can never be sure that all
avenues have been tried; we can never be sure that there is not one more error
lurking unseen, just waiting for the most crucial opportunity to show itself.
(Needless to say, I observed the error by reading the code, not by testing. The
student was blameless. The error was the responsibility of the student's teacher
for having failed to teach proper design principles and suggesting that testing
was adequate.)

1.4 Correct by Construction

That debugging is not fail-safe is a drawback, but not its main limitation. The
main problem with debugging is that it is useless as the basis for program design,
of which fact even a small acquaintance with programming will convince you. An
alternative to debugging is the development of a science of programming. Such
a science should provide the techniques to enable the verification of a program
against its specification. But it should do more than that; it should provide a
discipline for the construction of programs that guarantees their correctness.
Of course, the science guarantees correctness only if it is used correctly, and
people will continue to make mistakes. So testing is still wise, and debugging
will occasionally be necessary. But now, rather than chance, it is our own skill in
applying the science on which we rely. The aim of this book is to impart that skill
and to enable you to take a pride in your programming ability.

Bibliographic Remarks
The Internet is awash with accounts of bugs and other programming errors that
have made headline news over the years. For a particularly tragic case, search on
the word Therac' for details of a software error that resulted in at least three
1.4 Correct by Construction

deaths by an overdose of radiation in 1986. Searching on 'Risks' (short for 'Forum

on Risks to the Public in Computers and Related Systems') yields details of many
other examples.
The summary of the state of the car industry in the 1950s (see Section 1.1) is
based on Unsafe At Any Speed by Nader (1965). The reports on the two NATO
Science Committee-sponsored conferences (Naur and Randell, 1969; Buxton and
Randell, 1970) are available on the Internet.
A very large part of the text has been directly influenced by the work of Edsger
W. Dijkstra. The quotation attributed to Dijkstra in Section 1.2 appears in Buxton
and Randell (1970), which is also the source of Hopkins's remarks.
I first saw the algorithm for computing the powers of n, discussed in Section 1.2,
in Polya (1954); it was originally discovered by Mossner (1951) and verified by
Perron (1951).
The case n = 0 in the cutting-the-cake problem (Exercise 1.1) was pointed out
to me by Diethard Michaelis. A formula giving the number of portions is quite
complicated. See Dijkstra (1990) for a derivation of the correct formula.
This page intentionally left blank
 2
A Searching
Problem and
Its Solution
Examples are better than precepts; let me get down to examples—I much
prefer examples to general talk.
G. Polya

This chapter is about the systematic development of a search algorithm and its
proof of correctness. The algorithm is presented in English rather than in a math-
ematical language so that you can begin to understand the process of algorithm
design without being distracted by perhaps unfamiliar notation. A disadvantage
is that the description is imprecise and relies on your good will in understanding
what is meant.

2.1 Problem Statement

The problem we consider is this. Suppose you are presented with a deck of cards,
as shown in Figure 2.1. On each card is printed the name of a student together with
personal details (date of birth, address, examination record, etc.). The cards are
all in alphabetical order (according to surname). Suppose you are also presented
with one additional card on which is printed the name of a student X, The task
is to describe a procedure for splitting the deck of cards into two parts in such
10 Chapter 2: A Searching Problem and Its Solution

Figure 2.1 Sorted deck of cards.

a way that (a) all of the cards in the first part precede X in alphabetical order,
and (b) none of the cards in the second part precedes X in alphabetical order.
Otherwise, the original deck should be left intact.
We call this a searching problem because we are effectively looking for the
position in the deck at which to insert the new card.
When presented with a problem like this, the first step is to ensure that you have
a clear understanding of the problem. For programming purposes, the demands
on clarity and unambiguity of the problem specification are much higher than
if the task is to be carried out manually by a colleague, when one can rely on
common sense and intelligence. We discuss program specification in detail later,
but for the purposes of this exposition we rely on goodwill in making sense of
some of the actions to be described.
One point needing clarification is that the process of splitting the original deck
may result in one of the parts being empty. For example, if the deck contains the
student surnames
Einstein
Newton
Russell
and the name X is Galileo, the deck should be split into the two parts consisting
of, first, the card belonging to Einstein and, second, the two cards belonging to
Newton and Russell. However, if the name is Turing, the first part consists of all
three cards in the original deck and the second part is empty.
The mathematical abstraction of regarding no cards as being nonetheless a deck
of cards is a useful one with the very practical effect of reducing the number of
cases one has to consider from three (X is at the beginning, X is in the middle, and
2.3 Problem Solution 11

X is at the end) to one. As a bonus, the original problem statement now applies
to an empty deck of cards, in which case the process of splitting the deck would
result in two parts, each of which is also empty.

2.2 Problem Solution

Here is an efficient algorithm to solve the problem. We maintain at all times three
decks of cards. The first of these, which we call the left deck, contains cards that
are all known to precede X in alphabetical order; the third deck, which we call
the right deck, contains cards that are all known to not precede X in alphabetical
order; finally, the second deck, which we call the middle deck, contains cards that
may or may not precede X in alphabetical order. All three decks are alphabetically
ordered and are such that recombining the left, middle and right decks, in that
order, returns the deck to its original form.
Initially, the left and right decks are both empty. The task is complete when
the middle deck is empty. We make progress to this state by repeatedly remov-
ing cards from the middle deck and adding them to either the left or right
deck.
In more detail, the procedure to be used is the following. Arrange space on
a table for the three decks of cards. Initially, the entire deck is placed face
up in the space reserved for the middle deck. The left and right decks are
empty. Subsequently, the following process is repeated until the middle deck is
empty.
Pick up the middle deck and split it in two. This splitting may take place in
an arbitrary fashion except that the deck containing the cards that are later in
alphabetical order should be non-empty. Call the two decks the lower and upper
decks, where the lower deck contains the cards that are earlier in alphabetical
order and the upper deck contains the cards that are later in alphabetical order.
Then, depending on the student name revealed at the start of the upper deck, do
one of two things.
(Rl) If the name precedes X in alphabetical order, place the entire lower deck
and the first card of the upper deck face down on the left deck and return
the remainder of the upper deck to the middle deck.
(R2) If the name does not precede X in alphabetical order, place the entire upper
deck face up on the right deck and return the lower deck to the middle deck.
When the middle deck is empty, the goal of splitting the deck in two will have
been achieved.
This completes the description of the algorithm. Let us now see what would
constitute a proof of correctness.
12 Chapter 2: A Searching Problem and Its Solution

2.3 Proof of Correctness

The first thing to be completely clear about is that 'correctness' as used in this
text is a relative notion. The word 'correct' sounds absolute—and that may be the
way you use it in everyday conversation—but it is being used here as a technical
term. When we refer to a program being 'correct', we mean relative to some given
specification. Generally, the specification of a programming problem consists of
a precondition, describing the properties of the input data, and a postcondition,
describing the desired effect of the computation. In our searching problem, the
precondition comprises a description of the given deck of cards and the informa-
tion it contains together with the important requirement that the names on the
cards be alphabetically ordered. The postcondition states that the given deck of
cards is to be split into two and details the properties required of the two parts.
In terms of the solution we have presented, these properties are:
(PI) every card in the left deck precedes X in alphabetical order;
(P2) none of the cards in the right deck precedes X in alphabetical order;
(P3) the original deck can be retrieved by recombining the left and right decks in
that order.
The proof of correctness hinges on two aspects of the repeated process, the
so-called bound function and the invariant.
In general, the bound function is an integer function of the data being manipu-
lated. It measures, in some sense, the 'size' of the problem remaining to be solved.
We use it to prove that the repeated process will always terminate, i.e. that the
program will not 'get into a loop' and repeat the same sequence of actions indef-
initely.
The invariant is a property of the data being manipulated that holds irrespective
of the number of repetitions that have been executed. We use the invariant to
establish so-called 'conditional correctness', meaning that the program meets its
specification under the assumption of (or 'conditional' on) a proof of termination.

(a) Proof of Termination. For the bound function, we take the number of cards
in the middle deck. To use it to prove that the process of repeatedly executing
(Rl) or (R2) will always terminate, we make two observations.
(Tl) There is a lower bound (zero) on the number of cards in the middle deck.
In this case, the lower bound is dictated by the physical characteristics of
a deck of cards. In general, we look to the condition for terminating the
repeated process to provide such a bound.
(T2) Every time the repeated part of the search process is executed, the number
of cards in the middle deck decreases by at least one. This is because we
have been careful to ensure that the inspected card is always removed from
the middle deck and added to either the left or right deck.
 Another Random Document on
Scribd Without Any Related Topics
 "Yes. Because her Uncle Denis was in my service. I adopted
Jenny, but told her that she was the child of a Mr. Kennedy and
Mona Bantry. She believed her father and mother were married, so
do not disturb that view of the case."

"Certainly not," said Tait emphatically. "It would be cruel to do so.

But here we are at Victoria. After seeing Mrs. Bezel at Hampstead
we can resume our conversation."

"If we do it will be from a different standpoint, I fancy," said

Larcher significantly, as the train stopped.

Tait's brougham was waiting for them at the station, and in this
they drove up to Hampstead. Leaving it in Fitzjohn's Avenue they
walked down Hunt Lane to Clarence Cottage. Mrs. Bezel occupied
her usual seat in the window, and caught sight of Claude as he
preceded his father and Tait up the path. A terrified expression
crossed her face, but she made no motion to forbid their entrance.
Yet a sense of coming evil struck at her heart, and it needed all her
self-control to prevent herself from fainting when they were shown
into the room.

"My dear mother," said Claude, kissing her, "you must be prepared
for unexpected news. I beg of you to control yourself for——"

He stopped short in astonishment. Mrs. Bezel was looking at

Captain Larcher with a bewildered air, and he gazed at her face with
an expression of amazement. She shrank back as he crossed the
room with rapidity, and bent over her.

"Mona Bantry!" he cried, "is it possible that you still live?"

 CHAPTER XLI.
AN EXPLANATION.

On hearing his father's exclamation Claude turned round with a

look of supreme astonishment. He could not understand the
meaning of that sudden exclamation.

"Father, you do not understand. This is your wife—my mother."

"Is it, indeed?" sneered Captain Larcher, who had recovered from
his momentary emotion. "Nothing of the sort, sir. This woman is
Mona Bantry, who was my wife's maid."

"Are you sure?" cried Tait, who was beginning to be bewildered

by these successive revelations.

"Sure, sir! as sure as I am of my own innocence. As sure as I am

George Larcher, this is the sister of Denis Bantry, who——"

"Denis!"

The interruption came from Mrs. Bezel. She had sat dumfounded
at the unexpected appearance of the man whom she had thought
dead, and she had said nothing while assertion and denial were
going on, but the mention of her brother's name stirred her dormant
faculties, and she sat up looking wildly around.

"Denis!" she cried, in a terrified tone. "Is Denis here?"

"Denis is down at Thorston," said Captain Larcher gruffly, "as you

no doubt knew well enough."

"I swear I did not. Francis told me Denis was in America."

 "Francis?" exclaimed Claude, forgetting to whom the name
belonged.

"Francis Hilliston."

"Ah!" said Captain Larcher, with a disdainful look round. "I might
have guessed as much. Off with the dead love, on with the living.
You have amended the proverb."

"I did not know Mark was dead, sir," exclaimed Mrs. Bezel
passionately. "Francis said that he had gone to America with Denis. I
thought he had done so to escape the consequences of his crime,
but——"

"Of his crime!" cried Claude. "He was the victim, poor soul, not
the murderer. It was Jeringham who was killed, not my father."

"Your father?" said Mrs. Bezel, looking steadily at Captain Larcher.

"Yes; it is my old master. So you are alive and he is dead. Why did
you kill him, sir?"

"I did not kill him," replied the captain quietly, "and as a counter
question, may I ask why you passed yourself off to Claude as my
wife?"

Mrs. Bezel burst into a wild laugh, and clapped her hands
together. Then she covered her face and commenced to weep, but in
a few moments the fit of hysteria passed away, and she became cool
and composed. Thrown off her balance for the time being, she had
now gathered her wits together, and was ready to fight. Her folly
and impulse had brought about this catastrophe, and it was her duty
to set it right again—if she could. But the upshot of the matter was
extremely doubtful.

On his part, Captain Larcher was relieved to find that Mrs. Bezel
proved to be Mona Bantry instead of his wife. Ever since the
communication made by Claude, he had suffered agonies at the
thought that his wife had been living all these years under the
protection of his false friend. Now that fear was set at rest once and
forever. Julia Larcher had really died, as Hilliston had asserted, and
the woman in Clarence Cottage, who had taken her name, was the
maid in place of the mistress. Out of all the trouble Larcher extracted
this morsel of comfort, his honor was unstained.

Meanwhile the three visitors sat waiting to hear what Mrs. Bezel
had to say. She saw that they expected a confession, and resolved
to disappoint them. Leaning backward among her cushions, she
closed her eyes, and played a waiting game. It proved successful,
for in two minutes or thereabouts Captain Larcher broke out. His
temper was none of the best, and recent events had not tended to
improve it."

"Well, madam," he said sharply, rapping his stick on the ground,

"I am waiting to hear what you have to say."

"I have nothing to say," said Mrs. Bezel quietly.

"Oh, yes, you have," began Tait. "As you set the ball——"

But at this moment he was interrupted by Larcher.

"I beg your pardon, Mr. Tait, but I will question this woman
myself. Pray do not speak, nor you, Claude, till I have done."

Both young men bowed their heads and acquiesced in silence.

After all, the captain was the proper person to examine Mona Bantry.
He knew more of the case than anyone else, and conversant as he
was with the events of that fatal night, he would know whether she
spoke truly or falsely. Mrs. Bezel looked uneasy on hearing his
resolution, but only compressed her lips tighter as though resolved
to let nothing escape her. But he was a match for her in obstinacy.

"Now then," said Larcher, turning to her, "relate your history from
the moment you left me alone with my wife twenty-five years ago at
The Laurels."

"It would not help you if I did."

"I'm not so sure of that. But I understand. You are afraid of

incriminating yourself."

"I!" exclaimed Mrs. Bezel indignantly. "What have I to do with the

matter. I know nothing of it. I left the house then and there, and
only heard of the tragedy while I was concealed at Horriston, more
than a week afterward."

"Why did you state to my son that Mrs. Larcher threatened me

with the dagger."

"So she did," said Mrs. Bezel coolly. "I saw her hand raised, I saw
the dagger in it."

"You saw the sheath of the dagger, you mean," retorted Larcher;
"it fell on the floor and was found there next day. But the weapon
with which the crime was committed was lost by my wife at the
ball."

"It may have been," said the woman indifferently. "I don't know
anything about it."

"Did not Jeringham show it to you when you joined him in the
garden?"

"I tell you I did not see him on that night. When you found out
my secret, I was afraid that you and the mistress would betray it to
my brother Denis, so I left the room and fled. I thought Jeringham
would join me at Horriston next day, but then I heard of your
supposed death, and that he had fled. Until this hour I did not know
that it was the other way round."

"Did not Hilliston tell you? He knew."

 "No, Captain Larcher, he did not," said Mrs. Bezel emphatically.
"He said that Jeringham had gone to America with my brother."

"Where did you go after leaving Horriston?"

"I came to London, and remained there till my baby was born."

"And then?"

"I found that my money had come to an end, and called at Mr.
Hilliston's office to ask him to help me."

"What right had you to expect help from him."

"I had no right, but that I knew he would assist me because of his
love."

"His love!" exclaimed Larcher sharply. "Did Hilliston love you?"

"Yes; I refused to have anything to do with him on account of

Jeringham. But he did love me. Oh, yes, I know you thought he was
in love with your wife, but such was not the case. He loved me, and
me only."

Larcher drew a long breath, and looked puzzled. He was relieved

to find that he had not been mistaken in Hilliston, after all, yet the
assertion of Mrs. Bezel only seemed to further complicate the case.
If Hilliston did not love Mrs. Larcher, what possible motive could he
have to kill Jeringham? The looks of Claude and Tait reflected his
perplexity; but dismissing this special point for the moment, he
pursued his examination.

"How did Hilliston receive you?"

Mrs. Bezel looked around with a bitter smile. Her meaning was
clear from the contemptuous expression on her face.
 "Can you not guess from what you see here?" she said quietly.
"Francis Hilliston bought me. He loved me well enough, but not
sufficiently to marry me. He did not ruin me, for I was already
ruined. I accepted his offer to come here and be his mistress. What
else could I do? I was alone in London. I was friendless. I believed
that my lover and my brother had fled to America. I could not return
to Horriston lest I might be involved in the tragedy at The Laurels. I
did what any other woman would have done, and made the best of
a bad business. I accepted the love and protection of Francis
Hilliston. The protection still continues, as you see—the love, that is
dead and done with."

"I see you are thinking of Louisa Sinclair," interposed Tait quietly.

"What do you know of Louisa Sinclair?" asked Mrs. Bezel, with a

violent start.

"Everything, thanks to you," answered Tait. "Your letter put the

clew into my head. I went to Horriston; I saw a portrait of Miss
Sinclair. I know that she went to America after the tragedy, and
returned as Mrs. Derrick, rich and beautiful, to marry Hilliston."

"Ah, you know that much. Yes! Louisa Sinclair is my rival! Ten
years ago she came back to England and wanted Francis to marry
her. I fell ill—I became paralyzed. He forgot me, he forgot my love,
and she became his wife. Oh, how I hate her! I hate him. It was on
that account that I wrote to you, Claude, to reveal all."

"You then acted out of revenge!"

"Yes, I did!" said Mrs. Bezel sullenly. "Look at me, a wreck; look at
her, his wife, rich and handsome and healthy."

"Not healthy, poor soul," said Claude. "She is ill with the
smallpox."
 "With the smallpox," echoed Mrs. Bezel joyfully. "I'm glad of it!
I'm glad of it! Her beauty will depart, as mine has done. Then
Francis may come back to me."

"You love him still?" asked Captain Larcher, in wonderment.

"Too well to ruin him. You want me to accuse him of the crime,
but I tell you he is innocent; he knows nothing."

"He was in the garden alone on that night. None other but he
——"

"He was not alone," cried Mrs. Bezel sharply. "Louisa Sinclair was
with him. Yes, she followed him from the ball because she was
jealous of me. In my flight I passed her at the gate. She had a cloak
over her dress, but I saw that it was the costume of Mary, Queen of
Scots."

"And you knew her by that?"

"Partly. My mistress told me that Miss Sinclair had a similar

costume to her own, for she was very angry about it. But I saw her
face as I fled. She may know who killed Jeringham. I do not.
Hilliston does not. Now, I have told you all. Go away and leave me. I
speak no more."

"First tell us why you declared yourself to be my mother?" said

Claude sharply.

"For safety. I regretted that I had told you; that I had forced
Hilliston into defending himself. I was afraid lest you should learn too
much and denounce me as the criminal. So long as you thought I
was your mother you would not dare to do so, and therefore I told
you I was Mrs. Larcher."

"One last word," said Captain Larcher, rising to his feet. "Your
child. What became of it?"
 "Hilliston took it away," said Mrs. Bezel, in a melancholy tone. "I
was ill at the time and he overcame my scruples. I don't know where
my child is. Often and often have I wanted to see her again, but
Francis has always refused. Oh, where can she be?"

"I can tell you."

"You?" cried Mrs. Bezel, starting up in amazement.

"Yes. Your daughter Jenny was brought by Hilliston to me. I

adopted her as my child, and she is now at Thorston with her Uncle
Denis—your brother."

Mrs. Bezel tried to speak, but could not. With a wild glance
around she heaved a long sigh and fainted. The joy of hearing that
her child was alive proved too much for her enfeebled frame.
 CHAPTER XLII.
THE TRAGEDY OF A WOMAN'S VANITY.

Meantime Hilliston, unaware of that fatal meeting with Mona

Bantry, which threatened to demoralize his plans, was devoting
himself to his unfortunate wife. She was very ill, and not expected to
recover, so feeling that he would soon lose her, the lawyer stayed
constantly by her side, and strove, though unsuccessfully, to
ameliorate her cruel sufferings. It was all the more credit to him that
he did so, as he had married her mainly for her money, and was still
in love with Mrs. Bezel. No doubt, remorse had something to do with
his present attitude.

The landlord of the Connaught Hotel had insisted upon Mrs.

Hilliston being removed when the first symptoms of disease showed
themselves. He declared that were it known that he had a smallpox
patient in his house, he would be ruined for the season, so Hilliston,
recognizing the truth of this assertion, took steps to isolate his wife,
as was necessary from the nature of her illness. Assisted by the
doctor, who attended to all details relative to the municipal
authorities, he hired a small house on the outskirts of Eastbourne,
and thither the wreck of what had once been a beautiful woman was
removed one evening. Nurses were hired from London, Hilliston sent
word to his partner that he would not return to business for some
weeks; and then began the slow martyrdom of the sickroom.

It was a fortnight since Mrs. Hilliston had been seized with the
disease, and now it had taken so favorable a turn that the doctor
held out great hopes that she would recover. But the beauty of
which she had been so proud was gone, and with it went the hopes
that she could still retain her husband by her side. Mrs. Hilliston
knew well enough that it was only her persistence which had made
Hilliston marry her, and now that she had lost her good looks—the
one hold she had on his lukewarm affection—she foresaw only too
clearly that he would neglect her in the future. Moreover, the
woman's vanity was so powerful that she could not accept calmly
the possibility of surviving, a scarred and maimed object, to face
looks of pity and of horror. She felt that she would rather die, and in
fact resolved to do so. Meanwhile she tossed and turned, and
moaned and wept on her sick bed; crying out against the stern Fate
which had dealt her such hard measure. Yet in her secret soul she
admitted that the punishment was just.

Hilliston was scarcely less unhappy than his wife. While her illness
was serious, he had thought of nothing but how to save her, but
now that a chance of recovery offered a respite from his arduous
attendance by the sick bed, he had time to turn his thoughts toward
the Horriston tragedy. He wondered that he had not heard from
Paynton relative to the interview with Claude, and, fearful lest some
untoward event had occurred to upset his plans, he wrote to Rose
Cottage asking for information. To-day he had received a reply, and
on reading it saw his worst fears realized.

"I know you now [wrote Captain Larcher briefly]. I have seen
Claude; I have seen Mona. Henceforth I look upon you as an enemy,
and I intend to take immediate steps to clear my name at your
expense."

There was no signature, but Hilliston was too well acquainted

with his friend's writing to have any doubt as to the genuineness of
the letter. The blow had fallen; Mona had betrayed him, and he sat
there helpless, with the letter in his hand, a spectacle of baffled
scheming, of unmasked villany.
 "To clear his name at my expense," muttered Hilliston to himself.
"What does he mean by that? He cannot have discovered—but no,
that is impossible. When they find out who picked up that dagger at
the ball, they may learn the truth, but not till then. I defy them all.
Larcher will remain Paynton till the end of his life. Mona! Ah, I shall
punish her when I return to town for her cruel treachery."

While he was thus thinking, a nurse entered the room to intimate

that Mrs. Hilliston would like to see him. The lawyer obeyed the
summons at once, placed Larcher's letter in his pocket, smoothed his
brow, and entered the sickroom. Signing to the nurse to go away,
Mrs. Hilliston waited till she was alone with her husband.

"Francis," she said in a low voice, stretching out her hand, "I wish
to speak to you—on that subject."

"I think it would be wise if you refrained from doing so," replied
Hilliston, knowing to what she alluded. "We understand one another
on that point; you can do no good by bringing it up again. Why
should you?"

"For Claude's sake," said Mrs. Hilliston feverishly. "You owe him
some reparation."

"I owe him none, Louisa. I have acted like a father to him, and he
has turned on me. I helped Larcher to hide himself when it was
dangerous for him to become known, and he tells me that I am his
enemy."

"Have you heard from him?"

"I received a curt note of three lines intimating that he was about
to assert his innocence, and clear his name at my expense."

"Francis," cried Mrs. Hilliston, in a tone of terror, "you are lost! If

all is known——"
 "All will not be known," replied Hilliston, patting her hand; "only
two people know the truth—you and I. We can keep our own
counsel."

"But that little man, Tait, is at Horriston."

"What of that?"

"He will see Belinda Pike there. You know how she hated me
because I loved you. She wanted to marry you herself. If he meets
Miss Pike she will speak against me."

"What of that?" said Hilliston soothingly. "You forget, my dear,

that your life is different now. No one can find Louisa Sinclair in
Louisa Hilliston. When you went to America you vanished and
returned as Mrs. Derrick, the rich widow. Belinda Pike can never
learn that. My dear, you distress yourself suddenly. We are perfectly
safe."

"But the garnet scarfpin," questioned Mrs. Hilliston feverishly.

"I am secure on that point. Larcher knew that I was in the garden
on that night, and may have thought I dropped it. He will not dare
to accuse me of the crime. If he did," continued Hilliston, his brow
growing black, "I could turn the tables on him in a manner he little
expects. There is more evidence against him than against me."

"But if they learn that I was with you on that night?"

"They will never learn. No one saw you there. If they did, what
does it matter? Louisa Sinclair is dead. You need have no fear of
being recognized. I'll answer for that."

"It does not matter to me if I am known or not," said Mrs.

Hilliston gloomily; "I have done with life."

"My dear, the doctor says you will recover."

 "I shall not recover," said the sick woman, with emphasis. "Oh, do
not deceive yourself, Francis! I shall never rise from this sick bed to
be an object of horror and pity to you."

"My dear——"

"You never loved me. You only married me out of pity. At

Horriston you refused to make me your wife, and it was only when I
returned from America a rich woman that you did so. Pity," she said,
with a scornful laugh, "no, not pity, but necessity. You would have
been ruined but for my money."

"I admit it, Louisa, and I am deeply grateful to you for the way in
which you have helped me. I can never repay you for saving my
name and credit."

"You can, Francis. Get me my dressing case."

"Louisa, you cannot——"

"I insist upon being obeyed," she said imperiously. "Get me my

dressing case."

With great reluctance he brought it from a distant table and

placed it on a chair by the bedside. In obedience to her directions he
opened it, and took therefrom a sealed envelope.

"In there," she said, as he held it in his hand, "is an account of all
I saw on that fatal night. You must send that letter to Captain
Larcher when I am dead."

"Louisa, do you wish to ruin me?"

"I wish to save you, Francis. Do not deceive yourself into a belief
that the investigation is at an end. Claude may cease to meddle with
the matter, for he is in love with Jenny, and will probably marry her,
for by this time, according to you, he knows who she is. But I am
afraid of Spenser Tait. He will hunt you down; he will urge Larcher to
find out the truth. If it comes to that, send them my account of the
matter."

"It will ruin me," he said again.

"It will save you," she repeated. "Do not be foolish, Francis. You
can read it before sending it away."

"But you?"

"I shall be dead. I feel sure I shall not live. Promise me that if the
worst comes you will send that letter."

"I promise," he said, sorely against his will, "but it will not be
sent: you will live."

"I don't think so, Francis. I know better than the doctor. Now kiss
me, my husband, and leave me to myself."

He did so in silence, and took up the dressing-case, whereupon

she stopped him. "Let it be," she said quietly: "some of your letters
are in it, and I wish to read them. Kiss me again."

Again he kissed her, and reluctantly left the room. So quiet and
self contained was she that he had no inkling of her intention. Had
he guessed her fatal resolve, little as was the love he bore her, he
would surely have striven to turn her from her purpose. But he
guessed nothing, and left her alone, with the devil tempting her.

Good-by, my husband!" she murmured, as the door closed, and

then burst into tears. He had gone, she would never see him again,
and she moaned over her lost beauty which failed to retain him by
her side. He was coldly polite; he was affectionate out of pity, but he
had no love for her, and she hungered for the want of it. Her life
passed before her, episode after episode, till it stopped short at the
spectacle of a closed door, and herself lying alone and deserted in
that sickroom.
 She wept and prayed, and then, with a firm hand, took out of her
dressing case a small vial filled with a dark brown liquid. Twice she
put it to her lips, and twice she hesitated; the third time she
accomplished her purpose. The thought of her lost beauty, of her
husband's neglect, of her childless home and wretched future, all
these nerved her, and she drank off the contents, then quickly
replaced the bottle in the dressing case.

When the nurse came in to see her patient, Mrs. Hilliston was
lying back with a quiet smile on her pale lips. She had found peace
at last.
 CHAPTER XLIII.
THE LAST APPEARANCE OF FRANCIS HILLISTON.

Unaware of the tragedy which had taken place at Eastbourne,

Captain Larcher was in London brooding over his wrongs, and
weaving schemes how to avenge himself on Hilliston. His eyes had
been opened by Tait with regard to the conduct of that gentleman,
and he now saw plainly that he had been Hilliston's dupe for all
these years. Indeed, he began to share Tait's opinion that the lawyer
was guilty, and was casting about in his own mind how to prove this,
when an announcement in the papers informed him of the death of
Mrs. Hilliston.

"The smallpox killed her, no doubt," said Tait, when he had

expressed his regrets.

"No!" remarked Claude, who had been looking over the general
news. "It was a case of suicide."

"Suicide!" exclaimed the hearers, in one breath.

"Yes, according to this paragraph. It appears that in some way or

another she became possessed of a bottle of laudanum while the
nurse was absent. The woman returned to find her patient dead.
Poor Mrs. Hilliston!" added Claude, folding up the paper with a sigh.
"How sorry I am to hear this."

"I wonder why she committed suicide?" said Tait meditatively.

"She looked too determined a woman to yield to such a weakness."

"No doubt she found out that her husband was guilty of the
crime," said Larcher grimly, "and so did not care to live longer with a
murderer."
 "You are wrong, father," observed Claude, looking up; "it was the
knowledge that she had lost her looks which killed her. Depend upon
it, she took the poison so as to avoid dragging out her days a
scarred and miserable object."

"How do you know that, Claude?" asked his father, with a curious
look on his face.

"Because not once, but twice, or thrice, Mrs. Hilliston told me she
would kill herself rather than grow old and ugly. The loss of beauty
came with the smallpox; and so she has carried out her resolve."

"It will be a blow to Hilliston."

"I don't think so," said Captain Larcher rather cynically. "From
what I remember of Louisa Sinclair, the love was all on her side. No
doubt he married her when she was Mrs. Derrick purely for her
money. No! No! I quite believe the story of Mona Bantry. She was
and is the woman of his love. Now the wife is dead he can console
himself with the mistress."

"That reminds me," observed Claude suddenly. "What are we to

do about Jenny? Is she to be informed that her mother is yet alive?"

Captain Larcher shook his head. "Set your mind at rest on that
point," he said with a nod. "I told Mrs. Bezel that Jenny was about to
become your wife; that she thinks her parents are dead; and I
pointed out that it would be unwise to mar the happiness of the girl
by letting her know the truth. Mrs. Bezel agrees with me, and she
has consented that things shall remain as they are."

"Does she not want to see Jenny, father?"

"Of course she does. It is only natural, poor soul, but she loves
her child sufficiently to avoid casting a shadow on her life. Jenny will
never know that Jeringham was her father or that her mother is still
alive. She will marry you, Claude, as Miss Kennedy, and know no
more of her connection with the matter than she does at present."

"And Denis?"

"Denis has been told. I wrote him two days ago, and I have no
doubt he will come up to town to see the last of his wretched sister."

"The last of her?"

"Can you doubt it? Mrs. Bezel has death written on her face."

"Another blow for Hilliston," said Tait, in a rather regretful tone.

Villain as he knew the lawyer to be, he could not help feeling sorry
for his troubles. Fate had held her hand a long time, but now she
was dealing a full measure, and pouring the vials of her wrath on the
head of the sinner.

"It will be a heavier blow than the last," said Larcher, in a severe
tone, "for there is no doubt Hilliston truly loves Mona."

"I suppose Denis will object to his going near her again."

"It is impossible to say. We must leave that to the man himself."

This conversation took place in Tait's rooms one morning some

three weeks after the momentous interview with Mrs. Bezel. It had
been Captain Larcher's intention to return at once to Thorston, but
he had been dissuaded from this by his son, who thought a few
weeks in town would do his father good. There was no doubt on this
point, for Captain Larcher brisked up wonderfully in the exhilarating
atmosphere of the West End. But for the unexplained mystery of
Jeringham's death, he would have been quite happy in the recovered
society of his son, and even while the future was still black enjoyed
himself in no small degree. It did Claude good to see that his father
was at length getting some pleasure out of life, after his years of
incessant trouble and wearing anxiety.
 The next day Denis, looking older and grayer than ever, came up
to see his sister. He saw his master for a few minutes, and then
went on to Hampstead.

"I have told Denis how ill she is," explained Captain Larcher, as
the man took his departure, "and he has promised to be as lenient
as possible toward her wrong-doing. By the way, Hilliston is in
town."

"Hilliston!"

"Yes. He came up in the same train as Denis, and had the

impudence to speak to him. Asked him where I was, as he wanted
to see me."

"To see you, father?" cried Claude, in astonishment. "What for?"

"I think I can guess," interposed Tait quietly, "Hilliston has been
stricken by his wife's death, and wants to atone for his sins by
confessing the truth. I would not be surprised if he called here this
afternoon."

Captain Larcher looked skeptical, but said nothing, and the matter
dropped for the time being. As it happened Denis was still ignorant
that his sister had been the mistress of the lawyer, else there might
have been trouble. He had but a confused idea of Hilliston's
connection with the case, and, beyond knowing that he was the
owner of the garnet scarfpin, could not conceive that he had been
actually present in the garden when the murder was committed.
True it was that the scarfpin had been found on the spot where the
corpse of Jeringham had lain, but assured by his master that
Hilliston was innocent, as Captain Larcher had truly believed these
many years, Denis never gave the matter a second thought. Now he
would learn the truth from Mrs. Bezel.

Denis only came back in the afternoon, looking much put out. The
ruin of his much loved sister by Jeringham had been a great blow to
him, but the discovery that she was alive and had been living in sin
with Hilliston startled him considerably. He could hardly reply to the
questions of his master, but ultimately related that they had parted
friends. Mrs. Bezel had told him that the doctor assured her she
could not live much longer; and in the shadow of death Denis had
freely forgiven her all her sins and follies.

"And, indeed, sir, what else could I do," said Denis, wiping the
tears from his eyes, "when I saw the poor thing lying there like a
corpse? It's a bitter time she's had of it, these last ten years, in that
death-in-life state. Oh yes, captain, I forgave her freely, poor soul!"

"And Hilliston?" asked Larcher inquiringly.

"May his black soul burn," cried Denis, with a scowl. "Were I or he
younger I'd leave my mark on him. Mona had a letter from him
saying he was calling to see her this evening, but that he had an
appointment with you, sir."

"With me, Denis! It is the first I have heard of it. Where is he?"

At this moment, as if in response to his question, the door opened

and Tait appeared, looking very disturbed.

"Mr. Hilliston is here, Captain Larcher, and wishes to speak with

you."

Claude had entered the room by another door, and, on hearing

this, stepped forward looking slightly pale. He slipped his arm within
that of his father, as though to protect the elder man. Then they all
waited to hear what Captain Larcher had to say. The permission for
the interview must come from the man who had been most deeply
wronged. He thought for a moment or so with a frown on his face,
then sank into a chair with a deep sigh.

"Denis, stand behind me," he said, in a peremptory tone. "Claude,

sit down yonder. Now, Mr. Tait, we are ready to see our friend."
 Tait anticipated this permission, and was already prepared for it.
Without a word he threw open the door, and Hilliston, dressed in
deep mourning, entered the room with a paper in his hand. He
looked pale and worn, his fresh color was gone, and as he spoke he
kept his eyes persistently on the ground. It could be easily seen that
the man had received a shock from which he would not easily
recover.

"I have called to see you and deliver this," he said, in a low tone,
placing the paper he carried on the table. "I do not ask your
forgiveness, Larcher, for I do not consider I have done anything to
justify your anger against me."

"You could have saved me all these years of anguish by telling me

the truth," said Larcher indignantly.

"Perhaps! But it was not to my interest to tell you the truth."

"I don't wonder at that," said Claude bitterly. "You were afraid of
the law."

"Perhaps," said Hilliston again. "On the other hand I may not be
so guilty as you think me. You will find the truth in that paper."

He pointed toward the table, and the eyes of all immediately

turned in that direction, while Hilliston moved toward the door.

"Having fulfilled the promise I made to my dead wife, I now take

my leave," he said quietly. "I will never see any of you again, and
some day you may learn that you have misjudged me. Good-by."

He opened the door, but before he could pass through Denis

sprang forward.

"My sister?" he said, with an indignant look in his eyes.

"I am about to repair the wrong I did her," replied the lawyer
gravely. "By to-morrow she will be my wife."
 CHAPTER XLIV.
THE TRUTH.

Hilliston came and went in the space of a few minutes. None of

those present made any attempt to stay his exit, but as the door
closed after him they looked at one another in silence. Thinking of
Hilliston's last speech, Denis was the first to speak.

"What does that mean, sir?" he asked his master, with an air of
helpless bewilderment.

"I think it can only mean one thing, Denis," replied Larcher,
rousing himself. "Mr. Hilliston has at length awakened to the fact of
his dastardly treatment of your sister, and is about to make
reparation for the past. He intends to marry her."

"But his wife only died a few days ago, master."

"I know that. But Mrs. Bezel will also die shortly, and if Hilliston
desires to atone for the past he has no time to lose. He can marry
her at once, but he will again be a widower within the month."

Denis lifted a pair of shaking hands, and slowly left the room,
followed by the sympathetic looks of the others. He did not even
pause to learn the contents of the sealed envelope left by Mr.
Hilliston. Great as was his curiosity to learn all that had taken place
on that fatal night, his love and grief for his sister were greater still.
Bowed and gray and older-looking than ever, he departed; but in his
heart there was one comfortable thought—Mona would die an
honest woman, if Mr. Hilliston was to be believed.

When the three found themselves alone, Captain Larcher picked

up the sealed letter with some reluctance.
 "Strange," he said, balancing it in his hand. "For years I have
been eager to know the truth. Now that I have only to open this
envelope to learn it, I feel half afraid."

"Nevertheless, it will be as well to lose no time in making

ourselves acquainted with the contents," said Tait eagerly, for he
was in a fever of impatience to know all. "It may be a confession by
Hilliston."

"I think not. It is directed to me in the handwriting of Mrs.

Hilliston."

"To Ferdinand Paynton?"

"No. To Captain Larcher."

"H'm!" said Tait, with a start. "How did Mrs. Hilliston know you
were Captain Larcher? Did she see you at Thorston?"

"No. But her husband doubtless informed her of my real name.

However, we will learn all from this," said Larcher, breaking the seal.
"I believe this is a confession by Mrs. Hilliston."

"But what can she have to confess?" cried Claude, as his father
smoothed out a closely written letter. "She can know nothing of the
tragedy."

"You forget," said Tait, with a sudden recollection, "Louisa

Sinclair; she was at Horriston, and, according to Mona Bantry, was in
the garden of The Laurels on that night. I would not be surprised if
she saw the committal of the crime."

"What! Do you think she is about to betray her husband?"

"Oh," said Tait significantly, "we are by no means sure of

Hilliston's guilt!"
 Larcher found that the writing was too small for him to read
comfortably, so handed the letter to Claude, with a request that he
should read it out aloud. Excusing himself on the plea of the
illegibility of the writing, Claude passed it to Tait, who accepted the
office with avidity. The letter was without date or direction, and
began in an abrupt manner, highly suggestive of the agitation under
which it had been written. Tait mentally noted these points, and
began.

"This confession is to be read after my death by Captain George

Larcher, and, if he sees fit, he has my free permission to make it
public. Still I trust out of regret for the memory of an unhappy
woman that he will not do so save in the arising of two
contingencies. First, should he be still alive, and accused of
murdering Mr. Jeringham. Second, should my dear husband be
accused of the crime. In the event of the occurrence of either of
these contingencies, I authorize him to make these pages public.

"To explain myself I must go back twenty-six years, when I was

residing at Horriston. You, Captain Larcher, will remember me well as
Louisa Sinclair, for at that time I saw a great deal of yourself and
your wife. I saw too much of her, for my eyes were sharp, and, but
for a natural reluctance to disturb your domestic peace, I could have
enlightened you as to her conduct. She was never worthy of a good
man like you. She was as bad as I afterward became, and that is
saying a great deal, as you will see by reading on.

"I loved Francis Hilliston, your intimate friend. Belinda Pike loved
him also, but there was no need for either of us to be jealous of the
other, for Mr. Hilliston loved a third person; none other than your
wife. No doubt you will be angry when you read this, but your anger
cannot alter facts. Yes, your dearest friend loved your wife. Let him
deny that if he can."
 At this point there was a marginal note by Hilliston: "I do deny it,
and but that I am not in a position to do so I would not let George
Larcher's eyes rest on this confession. My poor wife was insanely
jealous of Mrs. Larcher, but I swear that she had no grounds to be
so. I admired Mrs. Larcher as a friend, nothing more, and I loved
Mona Bantry. She is the only woman who has ever attracted me,
and, notwithstanding my marriage, now dissolved by death, she
attracts me still."

This note was hastily scribbled in pencil, and after Tait had read
it, without interruption from Captain Larcher, he continued the
confession:

"I admit that I was jealous of his attentions to your wife,"

continued Mrs. Hilliston, "for though I did all in my power I could not
win him to my side. Regarding the efforts of Belinda Pike, I say
nothing. She tried to gain his love, and she failed. I was more
successful in the end, but not till the lapse of many years. Here I
may say that I have gypsy blood in my veins, which at times renders
me insanely jealous, and in such a state I am capable of all things. A
recollection of this may enlighten you as to my acting as I did in the
garden of The Laurels.

"I knew that your wife loved Jeringham, and could have told you
of it. I am sorry I did not now, as she would have been disgraced,
and then Francis might have turned to me for consolation. But I held
my peace, and paid the cost of doing so. I am doing so now; you
also; for if you had been forewarned you would never have had to
conceal yourself under a feigned name on account of Jeringham's
death.

"At the fancy dress ball held at the Town Hall, matters came to a
climax. My gypsy blood made me mad on that night, owing to the
way in which I was neglected by Francis Hilliston. With some
difficulty I learned that your wife was to be dressed as Mary, Queen
of Scots, and, with a view to making myself attractive in Hilliston's
eyes, I chose the same dress. With the assistance of the dressmaker
who worked for us both, I obtained a dress similar in all respects to
that of Mrs. Larcher, hoping that by doing so he would speak to me
under the impression that I was your wife. My stratagem was
successful. I was masked and dressed as she was; he spoke to me,
thinking I was she, and I learned then how he loved her. At that
moment I could have killed her. I could have killed him."

Here there was another note in Hilliston's handwriting: "Again I

say that the poor creature was mistaken. I did speak to her under
the impression that she was Mrs. Larcher, but I said nothing that she
could construe into a declaration of love. Her jealousy rendered her
mad, and she distorted the idle words I spoke. She took them up in
the wrong sense."

"My suspicions were confirmed later on," continued the

confession, "for I overheard them talking together; yes, Francis
Hilliston and your wife were in a corner together, talking of love. I
listened. It was mean to do so; but then, I was in love and would
have stooped to any degradation to have rescued him from her
clutches. They talked about a dagger which he had given her to
complete her dress. Aha! he did not think to complete my costume
with such a gift. Mrs. Larcher took the dagger out of its sheath and
together they examined it. She blamed him for putting an inscription
on it, saying it would make her husband jealous. Francis laughed,
and said that you would never suspect him. Then Mrs. Larcher
slipped the dagger back in the sheath, as she thought; but in reality
it slipped down among the folds of her dress, and when she arose to
go it fell on the ground. They departed, and I picked up the dagger.

"At once I looked at the inscription, and there it was on the gold
handle—'To J. L., from F. H.' I was so enraged that I could have
broken the dagger. I tried to, but it was too strong for me. Therefore
I thrust it into my waistband and went in search of Hilliston to return
it to him, and reproach him for giving it to Mrs. Larcher. I saw him,
Welcome to our website – the ideal destination for book lovers and
knowledge seekers. With a mission to inspire endlessly, we offer a
vast collection of books, ranging from classic literary works to
specialized publications, self-development books, and children's
literature. Each book is a new journey of discovery, expanding
knowledge and enriching the soul of the reade

Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.

Let us accompany you on the journey of exploring knowledge and

personal growth!

ebookname.com