Frama-C-discuss mailing list archives

This page gathers the archives of the old Frama-C-discuss archives, that was hosted by Inria's gforge before its demise at the end of 2020. To search for mails newer than September 2020, please visit the page of the new mailing list on Renater.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Frama-c-discuss] Verification of integer and pointer programs


Hollas Boris (CR/AEY1) wrote:
> Hello and happy new year everyone!
>  
> I had a look at Yannik Moy's thesis to find out how integer and pointer 
> programs are verified. However, some things are not yet clear to me.
>  
> - Suppose there's a pointer expression *(expr) in a statement, where 
> expr evaluates to a memory location. Is then an implicit precondition 
> \valid(expr) generated?

Yes

> - For an assignment x=e to an int x, is an implicit precondition min_int 
> <= e <= max_int generated?

Yes, unless pragma JessiIntegerModel(exact) is set

> - In this case, are the rules for the wp-calculus changed accordingly? 
> Eg, for a variable x and an expression e containing pointer expressions, is
>  
>   wp(x=e, Q) = Q[ x -> e] \cup \bigcup_p {\valid(p)} \cup {min_int <= e 
> <= max_int}
>  
>   the rule for assignment, where p ranges over all pointer expressions 
> *(expr) in e?

No, rules for wp-calculus are not made specific for that kind of 
expressions. Instead, "assert" are automatic generated, and handled by 
the general rule for assert :

wp(assert p; e,q) = p /\ wp(e,Q)

At least this is how it is seen in Moy's thesis.

In the implementation of Jessie/Why, it is slighty different. But the 
same answer is true: WP calculus is not made specific for those case.
The difference is that Jessie produces Why statements that are not 
asserts but the so-called black boxes :

*e in C, where e as type t*,  becomes  in Why

let tmp = e in [ { \valid(tmp) } t { result = select(intM,tmp) } ]

where what is inside [ ] reads as "precondition \valid(p), returns any 
result of type p such post-condition  result = select(intM,tmp).

General idea: WP-calculus deals with control flow, and is generic with 
respect to data. Why handles the control flow by is VCGen, whereas 
Jessie encodes data into Why abstract types.

You find rules closer to the Jessie/Why implementation on the lectures 
notes on pages 
http://www.lri.fr/~filliatr/types-summer-school-2007/notes.pdf and 
http://krakatoa.lri.fr/ws/ and

Hope this helps,

-Claude