A CIL Tutorial - Department of Computer Science - ETH Zürich
A CIL Tutorial - Department of Computer Science - ETH Zürich A CIL Tutorial - Department of Computer Science - ETH Zürich
CHAPTER 11. PROGRAM VERIFICATION 100 let vcgen (wc : wctxt) (fd : fundec) (pre : T.term option) : T.term → T.term = (fun t → T.t forall close (vsymbols of function wc fd) [ ] (pre impl t wc fd pre t)) The function validateWhyCtxt Adds the term p to the Why3 context as a proof goal, and invokes the external prover. In this example the prover is given a timeout of two minutes, and the result is echoed to the terminal. One might also choose to use a proof assistant such as Coq [2] as the back-end to Why3, in which case, we could enter into an interactive proof session. Alternately, there are a range of options for what could be done here. We could do anything from simply directing Why3 to emit all of the proof obligations for a program for examination o-line, to halting compilation and emitting an error if a proof obligation is not discharged during compilation. The right choice likely depends on the stage of development the code is in, not to mention the goals of the t let validateWhyCtxt (w : wctxt) (p : T.term) : unit = (∗...∗) The function processFunction initializes the Why3 context with fresh variables for the local variables and formal parameters of the function before checking to see if it has any postconditions. If so, it tries to nd a precondition, generates the verication condition for the postcondition, and nally invokes validateWhyCtxt on the resulting term. let processFunction (wc : wctxt) (fd : fundec) (loc : location) : unit = wc.vars ← L.fold left (fun m vi → SM.add vi.vname (make symbol vi.vname) m) SM.empty (fd.slocals @ fd.sformals); match post of function wc fd with | None → () | Some g → let pre = pre of function wc fd in let vc = vcgen wc fd pre g in validateWhyCtxt wc vc The function tut11 is the entry point for this module. It initializes the Why3 context and then iterates over all functions in the le. let tut11 (f : file) : unit = let wc = initWhyCtxt (!Ciltutoptions.prover) (!Ciltutoptions.prover version) in iterGlobals f (onlyFunctions (processFunction wc)); eraseAttrs f
CHAPTER 11. PROGRAM VERIFICATION 101 11.2 test/tut11.c This C source le contains an example function that we will use to demonstrate the features developed in tut11.ml. In particular we will verify that a function will successfully initialize an integer array to contain the number 4 at each entry. ../test/tut11.c # include // For the pre, post and invariant annotations. The function arr init loops over the given array setting each element to 4. The precondition to the function states that the parameter n must be positive. The postcondition states that each element of the array is 4. The loop invariant states that the loop index stays in bounds, and that the array up to the value of the loop index is initialized to be 4. ../test/tut11.c void (pre(n > 0) post(forall(j,implies(j>=0 && j < n,*(a+j)==4))) arr_init)(int *a, int n) { int i; for (i = 0; i < n; i++) { invariant(i != n, i >= 0 && i =0 && j
- Page 51 and 52: CHAPTER 6. OVERRIDING FUNCTIONS 49
- Page 53 and 54: References [1] Kumar Avijit, Pratee
- Page 55 and 56: CHAPTER 7. TYPE QUALIFIERS 53 let c
- Page 57 and 58: CHAPTER 7. TYPE QUALIFIERS 55 let w
- Page 59 and 60: CHAPTER 7. TYPE QUALIFIERS 57 $ cil
- Page 61 and 62: Chapter 8 Dependant Type Qualiers O
- Page 63 and 64: CHAPTER 8. DEPENDANT TYPE QUALIFIER
- Page 65 and 66: CHAPTER 8. DEPENDANT TYPE QUALIFIER
- Page 67 and 68: CHAPTER 8. DEPENDANT TYPE QUALIFIER
- Page 69 and 70: CHAPTER 8. DEPENDANT TYPE QUALIFIER
- Page 71 and 72: CHAPTER 8. DEPENDANT TYPE QUALIFIER
- Page 73 and 74: Chapter 9 Type Qualier Inference In
- Page 75 and 76: CHAPTER 9. TYPE QUALIFIER INFERENCE
- Page 77 and 78: CHAPTER 9. TYPE QUALIFIER INFERENCE
- Page 79 and 80: CHAPTER 9. TYPE QUALIFIER INFERENCE
- Page 81 and 82: CHAPTER 9. TYPE QUALIFIER INFERENCE
- Page 83 and 84: Chapter 10 Adding a New Kind of Sta
- Page 85 and 86: CHAPTER 10. ADDING A NEW KIND OF ST
- Page 87 and 88: CHAPTER 10. ADDING A NEW KIND OF ST
- Page 89 and 90: CHAPTER 10. ADDING A NEW KIND OF ST
- Page 91 and 92: CHAPTER 10. ADDING A NEW KIND OF ST
- Page 93 and 94: Chapter 11 Program Verication In th
- Page 95 and 96: CHAPTER 11. PROGRAM VERIFICATION 93
- Page 97 and 98: CHAPTER 11. PROGRAM VERIFICATION 95
- Page 99 and 100: CHAPTER 11. PROGRAM VERIFICATION 97
- Page 101: CHAPTER 11. PROGRAM VERIFICATION 99
- Page 105 and 106: CHAPTER 11. PROGRAM VERIFICATION 10
- Page 107 and 108: Chapter 12 Comments CIL has a very
- Page 109 and 110: CHAPTER 12. COMMENTS 107 let printC
- Page 111 and 112: References [1] Lin Tan, Ding Yuan,
- Page 113 and 114: CHAPTER 13. WHOLE-PROGRAM ANALYSIS
- Page 115 and 116: CHAPTER 13. WHOLE-PROGRAM ANALYSIS
- Page 117 and 118: CHAPTER 14. IMPLEMENTING A SIMPLE D
- Page 119 and 120: CHAPTER 14. IMPLEMENTING A SIMPLE D
- Page 121 and 122: CHAPTER 14. IMPLEMENTING A SIMPLE D
- Page 123 and 124: CHAPTER 14. IMPLEMENTING A SIMPLE D
- Page 125 and 126: CHAPTER 14. IMPLEMENTING A SIMPLE D
- Page 127 and 128: Chapter 15 Automated Test Generatio
- Page 129 and 130: CHAPTER 15. AUTOMATED TEST GENERATI
- Page 131 and 132: CHAPTER 15. AUTOMATED TEST GENERATI
- Page 133 and 134: CHAPTER 15. AUTOMATED TEST GENERATI
- Page 135 and 136: Index A (module), 10, 13, 15, 10, 1
- Page 137 and 138: INDEX 135 isCacheReportType, 11, 11
CHAPTER 11. PROGRAM VERIFICATION 101<br />
11.2 test/tut11.c<br />
This C source le contains an example function that we will use to demonstrate the features developed<br />
in tut11.ml. In particular we will verify that a function will successfully initialize an integer<br />
array to contain the number 4 at each entry.<br />
../test/tut11.c<br />
# include // For the pre, post and invariant annotations.<br />
The function arr init loops over the given array setting each element to 4. The precondition to the<br />
function states that the parameter n must be positive. The postcondition states that each element<br />
<strong>of</strong> the array is 4. The loop invariant states that the loop index stays in bounds, and that the array<br />
up to the value <strong>of</strong> the loop index is initialized to be 4.<br />
../test/tut11.c<br />
void (pre(n > 0)<br />
post(forall(j,implies(j>=0 && j < n,*(a+j)==4)))<br />
arr_init)(int *a, int n)<br />
{<br />
int i;<br />
for (i = 0; i < n; i++)<br />
{ invariant(i != n,<br />
i >= 0 && i =0 && j
Change language