--- layout: fc_discuss_archives title: Message 22 from Frama-C-discuss on December 2012 ---
Hello Initisar, Yes, It is a good idea to look at ACSL tutorial recommended by Jens. But, just looking at these two lines of your previous mail : > This new version is verifiable: > ensures \exists int e; 0<=e && (\forall int i; 0<=i<15 && e > queue[i]) && ( (e >= 5) || (e >= 10) ) ==> \result == 0; I can see that you didn't fully understand the answer of Virgile. That ensures is almost equivalent to: ensures false ==> what_ever; This is always true what ever does your code! The ensures of your first mail is almost equivalent to ensures what_ever ==> false; A function doing the impossible can be compliant with this specification. That is difficult to implement! An alternative is to implement a function which doesn't terminate (while(true);). I guess your code is not like that. So, in addition to the tutorial, look again more carefully at the answer of Virgile. That should help you in understanding why your specification is equivalent to what I say. Patrick. -- Patrick Baudin, DILS/LSL, B?t. 862, Point Courrier n? 174 Institut CARNOT CEA LIST, CEA Saclay Nano-INNOV, 91191 Gif-sur-Yvette cedex, France. tel: +33 (0)1 6908 2072