--- layout: fc_discuss_archives title: Message 18 from Frama-C-discuss on October 2014 ---
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Frama-c-discuss] Unable to prove the example code in ACSL documentation



On Thu, Oct 23, 2014 at 4:49 PM, Lo?c Correnson <loic.correnson at cea.fr>
wrote:

>
> The more general solution is based on refinement:
> one specification for B is concrete and is used for proving properties
> inside B : functions assigns the (private) static variables in B.
> The second specification for B is abstract, and is used for asserting
> Pre-Post for other modules to call functions in B.
> In this second spec, functions in B assign dummy (ghost) public variables
> that model the internal state of all variables in B.
> What is missing in this methodology is a way to make both specifications
> consistent with each other.
>
>

Thank you for the explanation. However, I am still a bit lost here. Could
you give me a small example of this more general solution using ghost
variables? Is it similar to the concrete example (from the documentation) I
have shown?

George
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.gforge.inria.fr/pipermail/frama-c-discuss/attachments/20141023/d0da036c/attachment.html>