Proving total correctness of recursive procedures

We show that some well-known rules in a Hoare-style proof system for total correctness of recursive procedures can interact in such a way that they yield incorrect results. The problem is connected to the quantification scope of certain variables in the proof rules. By defining some restrictions on the applicability of the rules a system is obtained that is sound and complete. However, the completeness proof differs substantially from the original one. This technique is also applied to dynamic logic, where we show that the original proof rules for recursive procedures can be replaced by simpler and more natural ones, and that it is not ncessary to extend the programming language in order to arrive at a sound and complete proof system