Frama-C-discuss mailing list archives

This page gathers the archives of the old Frama-C-discuss archives, that was hosted by Inria's gforge before its demise at the end of 2020. To search for mails newer than September 2020, please visit the page of the new mailing list on Renater.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Frama-c-discuss] Problem with loop invariant

  • Subject: [Frama-c-discuss] Problem with loop invariant
  • From: n.rousset at laposte.net (n.rousset at laposte.net)
  • Date: Mon, 28 Jun 2010 14:04:21 +0200 (CEST)
  • In-reply-to: <1277298042.2073.36.camel@iti27>
  • References: <1276795121.1681.16.camel@iti27> <4C1F2AF5.3000604@inria.fr> <1277298042.2073.36.camel@iti27>
The loop invariant after the loop body is indeed equivalent to the assertion,
but the invariant is checked AFTER the assertion...

To find out why the assertion is not proved,
we need to see the postconditions of sreadi(), abpRound(), and swritei().

- Nicolas
> Message du 23/06/10 15:00
> De : "Boris Hollas"
> A : "Frama-C public discussion"
> Copie ? :
> Objet : Re: [Frama-c-discuss] Problem with loop invariant
>
>
> Now, the code verifies. However, there are two points that I can't
> explain:
>
> - The loop invariant can be proved, but not the assertion at the end of
> the loop body. But the latter should follow from the loop invariant
> because
>
> wp(internal.msgnum++,
> \forall integer x; 0 <= x < internal.msgnum * BUFFSIZE
> ==> tosend->data[x] == received->data[x];) =
>
> \forall integer x; 0 <= x < (internal.msgnum+1) * BUFFSIZE
> ==> tosend->data[x] == received->data[x];
>
> where wp(S,P) is the weakest precondition of S wrt P.
>
> - If the assertion is omitted, the loop invariant can't be proved. Does
> it nonetheless cause the prover to find the right goals?
>
>
>
> /*@
> loop variant MSGCOUNT - internal.msgnum;
> loop invariant 0 <= internal.msgnum &&
> \forall integer x; 0 <= x < internal.msgnum * BUFFSIZE
> ==> tosend->data[x] == received->data[x];
> */
> for (internal.msgnum = 0;internal.msgnum < MSGCOUNT; internal.msgnum++)
> {
> sreadi(msg_send,tosend,internal.msgnum);
> abpRound(msg_send,msg_receive,&channel,&internal);
> swritei(received,msg_receive,internal.msgnum);
> //@ assert \forall integer x; 0 <= x < (internal.msgnum+1) * BUFFSIZE
> ==> tosend->data[x] == received->data[x];
> }
>
> --
> Regards,
> Boris
>
>
> _______________________________________________
> Frama-c-discuss mailing list
> Frama-c-discuss at lists.gforge.inria.fr
> http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/frama-c-discuss
>
> 

Une messagerie gratuite, garantie ? vie et des services en plus, ?a vous tente ?
Je cr?e ma bo?te mail www.laposte.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.gforge.inria.fr/pipermail/frama-c-discuss/attachments/20100628/e3fe161e/attachment.htm>