Understanding Frama-C logic labels -

i have troubles when try use default logic labels loopentry , loopcurrent. here simple example different provers (alt-ergo, coq, cvc3, z3) use not able prove :

/*@ requires n > 0;*/ void f(int n){     int = 0;     /*@ loop invariant \at(i,loopentry) == 0;       @ loop invariant \at(i,loopcurrent) >= \at(i,loopentry);       @ loop invariant 0 <= <= n;       @ loop assigns i;       @ loop variant n-i;     */     while(i < n){         i++;     } } 

in particular, first , second invariants not proved (no problem others). if modify simple example adding label "label" after declaration/definition of , if refer label, , change loopcurrent here (which gives snippet :

/*@ requires n > 0;*/ void f(int n){     int = 0;     label : ;     /*@ loop assigns i;       @ loop invariant \at(i,label) == 0;       @ loop invariant \at(i,here) >= \at(i,label);       @ loop invariant 0 <= <= n;       @ loop variant n-i;     */     while(i < n){         i++;     } } 

)

now proved.

i found documentation acsl default logic labels quite easy understand , expected first example proved second. explain problem come from?

roo

ps1 : pre refer when used in loop clause? state before first loop iteration or previous iteration??

ps2 : i'm using frama-c fluorine, maybe didn't upgrade every minor updates

loopcurrent , loopentry indeed not supported wp in fluorine. fixed in development version (see http://bts.frama-c.com/view.php?id=1353), , should appear in next release.

regarding other pre-defined labels,

• pre refers state @ beginning of function.
• old can used in contract, , refers pre-state of contract (i.e. state in requires , assumes clauses evaluated). equivalent pre function contract, not statement contract (unless make contract enclosing main block of function).
• here means program point corresponding annotation evaluated. in contract, meaning depends on clause in appears.
• post can used in ensures, assigns, allocates or frees clauses, , refer state @ end of contract.