A CIL Tutorial - Department of Computer Science - ETH Zürich

CHAPTER 11. PROGRAM VERIFICATION 93
let initOps (it : Th.theory) (dt : Th.theory) (mt : Th.theory) : ops =
{iplus op = Th.ns find ls it.Th.th export ["infix +"];
iminus op = Th.ns find ls it.Th.th export ["infix -"];
(∗...∗)
}
The function initWhyCtxt initializes the Why3 context and directs it to use the prover specied
by the string p. It uses the Why3 API to read its conguration, load its plug-ins, nd the specied
prover, and load the theories we'll need into the wctxt.
let initWhyCtxt (p : string) (pv : string) : wctxt =
(∗ ... ∗)
As with the other attributes in previous chapters, we introduce global variables for string constants
for the attribute syntax.
let invariantAttrStr = "invariant"
let postAttrStr = "post"
let preAttrStr = "pre"
let tut11 attrs = [invariantAttrStr; postAttrStr; preAttrStr; ]
The functions term of int and term of int64 convert OCaml integers (which we'll extract from
the CIL AST) into Why3 terms.
let term of int (i : int) : T.term = i | > string of int | > T.t int const
let term of i64 (i : int64) : T.term = i | > Int64.to string | > T.t int const
We'll use the functions make symbol and freshvar of ap to make fresh symbols for the variables
bound by quantiers that appear in attribute parameters.
let make symbol (s : string) : T.vsymbol =
T.create vsymbol (W.Ident.id fresh s) W.Ty.ty int
let freshvar of ap (ap : attrparam) : string × T.vsymbol =
match ap with
| ACons(n, [ ]) → n, make symbol n
| → Em.s(Em.error "Names only")
The function term of attrparam converts an attribute parameter into a Why3 term. For variable
references, it looks up symbols in the vars eld of the context. For binary and unary operations, it
uses the operations dened in the ops eld.
For memory references it uses the get and set operations and the memory eld of the context to
generate the appropriate Why3 terms. In particular, memory is modeled as one large array indexed