--- layout: fc_discuss_archives title: Message 13 from Frama-C-discuss on October 2013 ---
On 04/10/2013 15:50, Rovedy Aparecida Busquim e Silva wrote: > The attached source code is a simplified version of the program we are > trying to prove. > Basically, M and L are struct type variables. > > L.M1 is equal to 0.0 and we tried to state this in the requires clause > with the BOUND define. Is it correct? I don't see anything wrong with the specification. In fact, if you replace field M.x1 by some float variable Mx1, it will go through. > We want to prove that M.x1 and result variable are equal to 0.0 too, > but the assert clauses are not proved. What is wrong? Gappa can prove the arithmetic properties, but it does not support field accesses. SMT solvers support them, but they cannot cope with the arithmetic. Thus you are stuck, since none of the tools is powerful enough. Best regards, Guillaume