A CIL Tutorial - Department of Computer Science - ETH Zürich

CHAPTER 11. PROGRAM VERIFICATION 100
let vcgen (wc : wctxt) (fd : fundec) (pre : T.term option) : T.term → T.term =
(fun t → T.t forall close (vsymbols of function wc fd) [ ] (pre impl t wc fd pre t))
The function validateWhyCtxt Adds the term p to the Why3 context as a proof goal, and invokes
the external prover. In this example the prover is given a timeout of two minutes, and the result
is echoed to the terminal. One might also choose to use a proof assistant such as Coq [2] as the
back-end to Why3, in which case, we could enter into an interactive proof session.
Alternately, there are a range of options for what could be done here. We could do anything from
simply directing Why3 to emit all of the proof obligations for a program for examination o-line, to
halting compilation and emitting an error if a proof obligation is not discharged during compilation.
The right choice likely depends on the stage of development the code is in, not to mention the goals
of the t
let validateWhyCtxt (w : wctxt) (p : T.term) : unit = (∗...∗)
The function processFunction initializes the Why3 context with fresh variables for the local variables
and formal parameters of the function before checking to see if it has any postconditions. If
so, it tries to nd a precondition, generates the verication condition for the postcondition, and
nally invokes validateWhyCtxt on the resulting term.
let processFunction (wc : wctxt) (fd : fundec) (loc : location) : unit =
wc.vars ←
L.fold left (fun m vi → SM.add vi.vname (make symbol vi.vname) m)
SM.empty (fd.slocals @ fd.sformals);
match post of function wc fd with
| None → ()
| Some g →
let pre = pre of function wc fd in
let vc = vcgen wc fd pre g in
validateWhyCtxt wc vc
The function tut11 is the entry point for this module. It initializes the Why3 context and then
iterates over all functions in the le.
let tut11 (f : file) : unit =
let wc = initWhyCtxt (!Ciltutoptions.prover) (!Ciltutoptions.prover version) in
iterGlobals f (onlyFunctions (processFunction wc));
eraseAttrs f