A CIL Tutorial - Department of Computer Science - ETH Zürich

CHAPTER 11. PROGRAM VERIFICATION 98
(∗ The other cases are unimplemented ∗)
| → Em.s(Em.error "No support for try-finally, or try-except")
For the C if statement, the function term of if we creates a Why3 if-then-else term. We
convert the condition of the if statement (e) to a term. The expression translation code gives an
integer term, which we convert to a boolean term using bterm of iterm. Next, we obtain the VC
continuations for the true and false blocks, and nally construct the VC continuation for the if
term.
and term of if (wc : wctxt) (e : exp) (tb : block) (fb : block) : T.term → T.term =
let te = e | > term of exp wc | > bterm of iterm in
let tbf = term of block wc tb in
let fbf = term of block wc fb in
(fun t → T.t if te (tbf t) (fbf t))
For a loop statement, we use the following translation:
V C(loop(inv, c, b), t) = inv ∧ ∀ x1 ,...,x n
(inv ⇒ (c ⇒ V C(b, inv)) ∧ (¬c ⇒ t))
Where inv is the loop invariant, c is the termination condition, b is the body of the loop, t is
the postcondition for the loop, and x 1 , . . . , x n are the loop variants. Furthermore, V C(b, inv) is the
verication condition of the loop invariant with respect to the body.
This asserts, essentially, that the invariant is true before the rst iteration, that each nonterminal
iteration maintains the invariant, and that when the loop exits, the postcondition is true.
CIL transforms all loops into the form:
while(1) {
if(!cond) break;
{
...
}
}
where the innermost block statement is the original loop body. In the syntax extensions to C used
for this tutorial, the loop invariant goes on this loop body block. Therefore, we must take apart
the loop a bit to reach the invariant. Then, we must generate the continuation calculating the VC
for the loop body, excluding the break statement (since we can't handle it correctly). Finally, we
generate the continuation for the VC for the loop statement, which employs the loop invariant, and
quanties over the loop variant variables, including the memory.
The function term of loop performs the above translation.