A CIL Tutorial - Department of Computer Science - ETH Zürich

CHAPTER 11. PROGRAM VERIFICATION 99
and term of loop (wc : wctxt) (b : block) : T.term → T.term =
let test, body = L.hd b.bstmts, L.tl b.bstmts in
let body block = body | > L.hd | > force block in
let bf = term of block wc (mkBlock (body block.bstmts @ (L.tl body))) in
let ct, li, lvl = inv of attrs wc body block.battrs in
let lvl' = wc.memory :: lvl in
(fun t → t
|> T.t if ct (bf li) (∗ if c then V C(b, inv) else t ∗)
|> T.t implies li (∗ inv => previous line ∗)
|> T.t forall close lvl' [ ] (∗ ∀ x1,...,x n
(previous line) ∗)
|> T.t and li) (∗ inv ∧ previous line ∗)
The function term of block folds over the statements of a block, processing the last statement
rst, to generate a continuation for the VC.
and term of block (wc : wctxt) (b : block) : T.term → T.term =
L.fold right (term of stmt wc) b.bstmts
The function vsymbols of function collects the Why3 symbols for the formal parameters to a
function in addition to the symbol for the memory.
let vsymbols of function (wc : wctxt) (fd : fundec) : T.vsymbol list =
fd.sformals
|> L.map (fun vi → vi.vname)
|> sm find all wc.vars
|> L.append [wc.memory]
If there is a precondition, the function pre impl t returns a continuation that generates a term in
which the precondition implies the VC generated for the function body and the term. Otherwise,
it simply gives the continuation that generates the VC for the function body and the term.
let pre impl t (wc : wctxt) (fd : fundec) (pre : T.term option) : T.term → T.term =
match pre with
| None → term of block wc fd.sbody
| Some pre → (fun t → T.t implies pre (term of block wc fd.sbody t))
Finally the function vcgen generates a function that will take the function postcondition as the
argument and produce the verication condition for the function. It does this by quantifying over
the memory and formal parameters as given by vsymbols of function, with the VC continuation
for the function body given by pre impl t.