Frama-C-discuss mailing list archives

This page gathers the archives of the old Frama-C-discuss archives, that was hosted by Inria's gforge before its demise at the end of 2020. To search for mails newer than September 2020, please visit the page of the new mailing list on Renater.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Frama-c-discuss] Problem with loop invariant

  • Subject: [Frama-c-discuss] Problem with loop invariant
  • From: hollas at informatik.htw-dresden.de (Boris Hollas)
  • Date: Wed, 23 Jun 2010 15:00:42 +0200
  • In-reply-to: <4C1F2AF5.3000604@inria.fr>
  • References: <1276795121.1681.16.camel@iti27> <4C1F2AF5.3000604@inria.fr>
Now, the code verifies. However, there are two points that I can't
explain:

- The loop invariant can be proved, but not the assertion at the end of
the loop body. But the latter should follow from the loop invariant
because

  wp(internal.msgnum++,
     \forall integer x;  0 <= x < internal.msgnum * BUFFSIZE 
                   ==>  tosend->data[x] == received->data[x];)  =

     \forall integer x;  0 <= x < (internal.msgnum+1) * BUFFSIZE
                   ==>  tosend->data[x] == received->data[x];

where wp(S,P) is the weakest precondition of S wrt P.

- If the assertion is omitted, the loop invariant can't be proved. Does
it nonetheless cause the prover to find the right goals?



/*@
loop variant MSGCOUNT - internal.msgnum;
loop invariant 0 <= internal.msgnum &&
  \forall integer x;  0 <= x < internal.msgnum * BUFFSIZE 
                   ==>  tosend->data[x] == received->data[x];
*/
for (internal.msgnum = 0;internal.msgnum < MSGCOUNT; internal.msgnum++)
{
  sreadi(msg_send,tosend,internal.msgnum);
  abpRound(msg_send,msg_receive,&channel,&internal);
  swritei(received,msg_receive,internal.msgnum);
  //@ assert \forall integer x;  0 <= x < (internal.msgnum+1) * BUFFSIZE
                   ==>  tosend->data[x] == received->data[x];
}

-- 
Regards,
Boris