A CIL Tutorial - Department of Computer Science - ETH Zürich

CHAPTER 11. PROGRAM VERIFICATION 97
let iterm of bterm (t : T.term) : T.term = T.t if t (term of int 1) (term of int 0)
let bterm of iterm (t : T.term) : T.term = T.t neq t (term of int 0)
let rec term of exp (wc : wctxt) (e : exp) : T.term = (∗ ... ∗)
and term of uop (wc : wctxt) (u : unop) (e : exp) : T.term = (∗ ... ∗)
and term of bop (wc : wctxt) (b : binop) (e1 : exp) (e2 : exp) : T.term = (∗ ... ∗)
With expressions translated to terms, we can now begin calculating the VC. We are using the
backwards method of VC construction, but we accomplish this by traversing the program in the
forwards direction, building up a continuation that will then be applied to the function's postcondition.
Therefore, both term of inst and term of stmt return functions that take as an argument
the term generated by the next instruction or statement, and yield the term modied according to
the current instruction or statement.
This method of VC generation is not very ecient. In particular it prevents the hashcons
optimizations inside of the Why3 library from being applied until the continuation we build up
is nally applied. It would be more sensible, especially for dealing with large programs, to use a
forwards method of VC construction.
The function term of inst generates Why3 let bindings for assignments. These let bindings
automatically take care of any necessary variable renaming. Currently, the translation does not
handle writes to struct elds. Accomplishing this will be discussed in one of the exercises.
let term of inst (wc : wctxt) (i : instr) : T.term → T.term =
match i with
| Set((Var vi, NoOffset), e, loc) →
let te = term of exp wc e in
let vs = SM.find vi.vname wc.vars in
T.t let close vs te
(∗ Also the case for a memory write ∗)
| → Em.s (Em.error "term of inst: We can only handle assignment")
The function term of stmt generates the continuation for calculating the VC for a statement. For
instruction statements, it folds over the list of instructions. For if statements it generates a Why3
if-then-else term. It recursively descends into block statements, and treats return statements as
no-ops. Loop statements are more complex. Handling loops is described in detail below.
let rec term of stmt (wc : wctxt) (s : stmt) : T.term → T.term =
match s.skind with
| Instr il → L.fold right (fun i t → (term of inst wc i) t) il
| If(e, tb, fb, loc) → term of if wc e tb fb
| Loop(b, loc, bo, co) → term of loop wc b
| Block b → term of block wc b
| Return(eo, loc) → (fun t → t)