{ A } P { B }
P ...program A ...precondition B ...postcondition
Provable properties need not characterize program uniquely.