Research on deductive verification of probabilistic programs has considered expectation-based logics, where pre-and post-conditions are real-valued functions on states, and assertion-based logics, where pre-and post-conditions are boolean predicates on state distributions. Both approaches have developed over nearly four decades, but they have different standings today. Expectation-based systems have managed to formalize many sophisticated case studies, while assertion-based systems today have more limited expressivity and have targeted simpler examples. We present Ellora, a sound and relatively complete assertion-based program logic, and demonstrate its expressivity by verifying several classical examples of randomized algorithms using an implementation in the EasyCrypt proof assistant. Ellora features new proof rules for loops and adversarial code, and supports richer assertions than existing program logics. We also show that Ellora allows convenient reasoning about complex probabilistic concepts by developing a new program logic for probabilistic independence and distribution law, and then smoothly embedding it into Ellora. Our work demonstrates that the assertionbased approach is not fundamentally limited and suggests that some notions are potentially easier to reason about in assertion-based systems.The most mature systems for deductive verification of randomized algorithms are expectation-based techniques; seminal examples include PPDL [25] and pGCL [31]. These approaches reason about expectations, functions E from states to real numbers, 7 propagating them backwards through a program until they are transformed into a mathematical function of the input. Expectationbased systems are both theoretically elegant [21,13,32,20]
and practically useful;This is the full version of the paper. 7 Treating a program as a function from input states s to output distributions µ(s), the expected value of E on µ(s) is an expectation.Implementation and case studies. We implement Ellora on top of Easy-Crypt, a general-purpose proof assistant for reasoning about probabilistic programs, and we mechanically verify a diverse collection of examples including textbook algorithms and a randomized routing procedure. We develop an Easy-Crypt formalization of probability theory from the ground up, including tools like concentration bounds (e.g., the Chernoff bound), Markov's inequality, and theorems about probabilistic independence.Embeddings. We propose a simple program logic for proving probabilistic independence. This logic is designed to reason about independence in a lightweight way, as is common in paper proofs. We prove that the logic can be embedded into Ellora, and is therefore sound. Furthermore, we prove an embedding of the Union Bound logic [4]. 9 The formalization is available at https://github.com/strub/xhl.