A CIL Tutorial - Department of Computer Science - ETH Zürich

CHAPTER 11. PROGRAM VERIFICATION 96
Now that we can translate attribute parameters into Why3 terms, we can also interpret the syntax
for specifying loop invariants. In particular, a loop invariant gives three things. First, it species
the loop's termination condition. This could also be read out of the program, but it simplies the
code a bit to have it available here. Second, it gives the loop invariant itself. Finally, it gives a list
of variables that vary in the loop. This list could also be read out of the program, but getting the
list here from the programmer avoids us having to write a visitor. If the programmer forgets to list
a variable, the worst that could happen is that the proof will fail.
The function inv of attrs translates a loop invariant annotation into the three Why3 terms
mentioned above.
let inv of attrs (wc : wctxt) (a : attributes)
: T.term × T.term × T.vsymbol list
=
match filterAttributes invariantAttrStr a with
| [Attr( , lc :: li :: rst)] →
term of attrparam wc lc,
term of attrparam wc li,
L.map (oldvar of ap wc) rst
| → Em.s(Em.error "Malformed invariant attribute: %a" d attrlist a)
The function cond of function extracts the Why3 terms for the pre- and post-condition annotations
on C function denitionss.
let cond of function (k : string) (wc : wctxt) (fd : fundec) : T.term option =
match filterAttributes k (typeAttrs fd.svar.vtype) with
| [Attr( , [ap])] → Some(term of attrparam wc ap)
| → None
let post of function = cond of function postAttrStr
let pre of function = cond of function preAttrStr
Now that we have written functions to translate the new syntax elements into Why3 terms, we can
calculate the VC of the postcondition. We proceed by rst translating CIL expressions into Why3
terms. This is similar to our handling of attribute expressions with two exceptions. First, there are
no qualiers. Second, we treat the results of comparisons and the boolean operations (e.g. ∧, ∨) as
integer valued, using 1 for true and 0 for false. These can be converted back to boolean values for
if statements and loop conditions as necessary.
The iterm of bterm function performs the conversion from a boolean valued Why3 term to
an integer valued Why3 term. bterm of iterm performs the reverse conversion. term of exp,
assisted by term of uop and term of bop, translates a CIL expression into a Why3 term. Their
denitions are very similar to the analogous functions for attribute parameters, so they are omitted
in the text.