A CIL Tutorial - Department of Computer Science - ETH Zürich

CHAPTER 11. PROGRAM VERIFICATION 94
by integers and storing integers. Thus, the C expression *a is translated to M(a), and the i'th eld
of array a is translated to M(a + i).
Since attribute parameters will be used to express function pre- and post-conditions, and loop
invariants, we also interpret syntax for universal quantication. The forall attribute parameter is
parameterized by the quantied formula and the free variables of this formula. The free variables
are added to the context, the attribute parameter for the quantied formula is translated to a Why3
term, and then we construct a Why3 term for the qualier.
let rec term of attrparam (wc : wctxt) (ap : attrparam) : T.term =
match ap with
| AInt i → term of int i
| ACons(n, [ ]) → T.t var (SM.find n wc.vars)
| ACons("forall",apl) → term of forall wc apl
| ACons("implies",[a; c]) → term of implies wc a c
| AUnOp(uo, ap) → term of apuop wc uo ap
| ABinOp(bo, ap1, ap2) → term of apbop wc bo ap1 ap2
| AStar ap → term of star wc ap
| AIndex(base, index) → term of index wc base index
(∗ The rest are unimplemented. See the exercises at the end of the section. ∗)
| → Em.s(Em.error "Attrparam is not a term: %a" d attrparam ap)
The function term of forall builds a Why3 term for our universal quantier annotation. The
list of parameters to a forall ends with the formula we are quantifying over. We copy this last
element of apl into fat. The rest of the elements of apl are the variables that we are quantifying
over. We translate those strings into fresh Why3 symbols and store the list in vl. Next, we add the
new symbols to the Why3 context after keeping a copy of the old map. Then, we translate fat in
the new context, restore the old context, and then nally build the Why3 term for the quantier.
and term of forall (wc : wctxt) (apl : attrparam list) : T.term =
let fat = apl | > L.rev | > L.hd in
let vl = apl | > L.rev | > L.tl | > L.map freshvar of ap in
let oldm = wc.vars in
wc.vars ← L.fold left (fun m (n, v) → SM.add n v m) oldm vl;
let t = term of attrparam wc fat in
wc.vars ← oldm;
T.t forall close (L.map snd vl) [ ] t
The function term of implies translates the antecedent and consequence, then constructs and
returns the Why3 implication term.
and term of implies (wc : wctxt) (a : attrparam) (c : attrparam) : T.term =
let at = term of attrparam wc a in
let ct = term of attrparam wc c in
T.t implies at ct