Frama-C-discuss mailing list archives

Patrick.Baudin at cea.fr (BAUDIN Patrick) · Wed, 02 Jan 2013 09:03:37 +0100

Hello,
The properties (ensures and loop invariant) should refer to the number 
of iterations ALREADY DONE.
In your example, these numbers are almost "n" for clauses "ensures" and 
"i" for clauses "loop invariant".
That should be the source of your problem in the property you identified.
Kind regards,
Patrick.

Le 21/12/2012 09:32, intissar mzalouat a ?crit :
> Hello Patrick,
>
> Thank you for your answer.
> Bur my problem is not solved.
> I tried to follow the max_element in the ACSL_By_example.
> This is my new program annotated:
>
> /*@ requires \valid_range(queue,0,n-1) && n>0;
>     assigns \nothing;
>
>     ensures \forall integer i; 0 <= i <= n-1 ==> \result >= queue[i];
>     ensures \exists integer e; 0 <= e <= n-1 && \result == queue[e];
>
> */
> int find_array_max(int* queue, int n){
>
>   int i, largest;
>
>   largest = 0;
> /*@ loop variant n - i;
>     loop invariant 0 <= i <= n;
>    loop invariant \forall integer k; 0 <= k < i ==> queue[k] <= largest ;
>    loop invariant \exists integer e; 0 <= e <= n-1 && largest == queue[e];
>
> */
>   for (i = 0; i < n; i++) {
>     if (queue[i] > largest)
>       largest = queue[i];
>   }
>
>
>   return largest;
>
> }
>
> Could you, please, tell me why I am still not able to verify all the 
> VC? The problem still in the " loop invariant \exists integer e; 0 <= 
> e <= n-1 && largest == queue[e];".
>
> Thanks in advance.
>
> Best regards,
> Intissar
>
>
>
>
> ------------------------------------------------------------------------
> *De :* BAUDIN Patrick <Patrick.Baudin at cea.fr>
> *? :* frama-c-discuss at lists.gforge.inria.fr
> *Envoy? le :* Mercredi 19 d?cembre 2012 15h21
> *Objet :* Re: [Frama-c-discuss] Problem with ACSL annotations
>
> Hello Initisar,
>
> Yes, It is a good idea to look at ACSL tutorial recommended by Jens.
>
> But, just looking at these two lines of your previous mail :
> > This new version is verifiable:
> > ensures \exists int e; 0<=e && (\forall int i; 0<=i<15 && e > 
> queue[i]) && ( (e >= 5) || (e >= 10) ) ==> \result == 0;
> I can see that you didn't fully understand the answer of Virgile.
>
> That ensures is almost equivalent to:
> ensures false ==> what_ever;
> This is always true what ever does your code!
>
> The ensures of your first mail is almost equivalent to
>   ensures what_ever ==> false;
> A function doing the impossible can be compliant with this specification.
> That is difficult to implement!
> An alternative is to implement a function which doesn't terminate 
> (while(true);).
> I guess your code is not like that.
>
> So, in addition to the tutorial, look again more carefully at the 
> answer of Virgile.
> That should help you in understanding why your specification is 
> equivalent to what I say.
>
> Patrick.
>
> -- Patrick Baudin, DILS/LSL, B?t. 862,
> Point Courrier n? 174
> Institut CARNOT CEA LIST,
> CEA Saclay Nano-INNOV,
> 91191 Gif-sur-Yvette cedex, France.
> tel: +33 (0)1 6908 2072
>
>
> _______________________________________________
> Frama-c-discuss mailing list
> Frama-c-discuss at lists.gforge.inria.fr 
> <mailto:Frama-c-discuss at lists.gforge.inria.fr>
> http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/frama-c-discuss
>
>
>
>
> _______________________________________________
> Frama-c-discuss mailing list
> Frama-c-discuss at lists.gforge.inria.fr
> http://lists.gforge.inria.fr/cgi-bin/mailman/listinfo/frama-c-discuss

-------------- section suivante --------------
Une pi?ce jointe HTML a ?t? nettoy?e...
URL: <http://lists.gforge.inria.fr/pipermail/frama-c-discuss/attachments/20130102/08d2e6de/attachment.html>