--- layout: fc_discuss_archives title: Message 87 from Frama-C-discuss on October 2013 ---
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Frama-c-discuss] how does Frama-C infer missing invariants?



The simple program below is verified by Frama-C+Jessie+AltErgo.   What is a little surprising is that it still verifies if you leave out the "loop invariant i<=n;" for the inner loop.  I think I remember reading somewhere that Frama-C can infer some invariants and frame conditions automatically.  I assume something like that is going on here, but I don't remember where I read about it and would like to understand how it works.  I spend a bit of time making my students do Hoare logic proofs like this by hand, and drill into them that anything you want to "know" after the loop terminates had better be in the loop invariant, but then they use Frama-C and see that isn't true!

-Steve


/*@ requires n>=0 && m>=0; */
void f(int n, int m) {
  int i=0;

  /*@ loop invariant i<=n;
    @ loop variant n-i;
    @*/
  while (i<n) {
    int j=0;

    /*@ loop invariant j<=m;
      @ loop invariant i<=n;
      @ loop variant m-j;
      @*/
    while (j<m) { j++; }
    //@ assert j==m;
    i++;
  }
  //@ assert i==n;
}