A CIL Tutorial - Department of Computer Science - ETH Zürich

CHAPTER 11. PROGRAM VERIFICATION 92
11.1 tut11.ml
This module is organized as follows. First, we dene types and functions for initializing and maintaining
the state needed for translation of the VC into the Term language of Why3. Then, we dene
functions for calculating the VC for the elements of the CIL AST and translating them into the
Why3 Term language. We begin with attribute parameters, needed for the precondition, postcondition,
and loop invariant syntax that we add to C. This is followed by the translation of expressions
into Why Terms, which is similar. Next, using the Why3 Terms, we dene functions to generate the
VC for instructions, statements, blocks, and functions. Finally, we dene a function that wraps up
the generated VC into a proof goal that we pass on to one of Why3's provers.
module W = Why3 (∗ We introduce aliases for the Why3 module and some of its sub-modules. ∗)
module T = W.Term (∗ The Why3 library for constructing terms. ∗)
module Th = W.Theory (∗ The Why3 library of theories. ∗)
We use the ops record type to store function symbols of the Why3 theories that we'll employ. In
particular we'll use its theories of integer arithmetic, computer division, and maps.
type ops = {
iplus op : T.lsymbol; (∗ Integer addition ∗)
iminus op : T.lsymbol; (∗ Integer subtraction ∗)
itimes op : T.lsymbol; (∗ Integer multiplication ∗)
idiv op : T.lsymbol; (∗ Computer integer division ∗)
imod op : T.lsymbol; (∗ Computer integer modulus ∗)
lt op : T.lsymbol; (∗ Integer comparisons ∗)
(∗ ... ∗)
get op : T.lsymbol; (∗ get and set for maps ∗)
set op : T.lsymbol;
}
We use the type wctxt to store context for Why3. The rst four elds, which we omit here, store the
internal conguration of Why3, the theories it will use, and information about the back-end prover
it will use. The ops eld stores the symbols described above. The memory eld stores a variable of
Why3 type (map int int) that we'll use to model memory accesses. The vars eld is a map from
strings to Why3 symbols for the variables that are mentioned in the Why3 Term being constructed.
type wctxt = {
(∗...∗)
mutable ops : ops;
mutable memory : T.vsymbol;
mutable vars : T.vsymbol SM.t;
}
The initOps function extracts the Why3 symbols for the operations from the Why3 theories that
we are using.