--- layout: fc_discuss_archives title: Message 2 from Frama-C-discuss on November 2013 ---
Excuse me, but I'm not sure I understand. When you say: > I suspect that you wanted to write > IsGCD(a,b,z) ==> IsGCD(\at(a,Pre),\at(b,Pre),z). > However, I'm not completely sure that existing ATP will have much luck > in proving IsGCD(a-b,b,z) ==> IsGCD(a,b,z). > What you means is that, even if the correct loop invariant is: IsGCD(a,b,z) ==> IsGCD(\at(a,Pre),\at(b,Pre),z) the theorem prover is not able to prove it? If this is the case, there is something I can change in the IsGCD predicate, apart from the positivity conditions, to help the ATP in his proof or is it better to change the invariant? Thank you in advance for your reply. I have attached the modified file. Kind regards, Alessio Iotti -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.gforge.inria.fr/pipermail/frama-c-discuss/attachments/20131101/d4f2b328/attachment.html> -------------- next part -------------- A non-text attachment was scrubbed... Name: gcd.c Type: text/x-csrc Size: 650 bytes Desc: not available URL: <http://lists.gforge.inria.fr/pipermail/frama-c-discuss/attachments/20131101/d4f2b328/attachment.c>