Input:
int findMax(int arr[], int n) {
    int max = arr[0];
    for (int i = 1; i < n; i++) {
        if (arr[i] > max) {
            max = arr[i];
        }
    }
    return max;
}
int main(){
    int arr[] = {0, 1, 2, 3, 4};
    int n = sizeof(arr) / sizeof(arr[0]);
    int max = findMax(arr, n);
    //@ assert \forall integer i; 0 <= i < n ==> arr[i] <= max;
    return 0;
}

Output:
/*@ requires n > 0;
    requires \valid(arr + (0..n-1));
    assigns \nothing;
    ensures \forall integer i; 0 <= i < n ==> arr[i] <= \result;
*/
int findMax(int arr[], int n) {
    int max = arr[0];
    /*@ loop invariant 1 <= i <= n;
        loop invariant \forall integer j; 0 <= j < i ==> arr[j] <= max;
        loop assigns i,max;
        loop variant n - i;
    */
    for (int i = 1; i < n; i++) {
        if (arr[i] > max) {
            max = arr[i];
        }
    }
    return max;
}
int main(){
    int arr[] = {0, 1, 2, 3, 4};
    int n = sizeof(arr) / sizeof(arr[0]);
    int max = findMax(arr, n);
    //@ assert \forall integer i; 0 <= i < n ==> arr[i] <= max;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
  requires 0 <= x <= 2;
  requires 0 <= y <= 2;
*/
void foo(int x, int y) {
  while (unknown()) {
    x  = x + 2;
    y  = y + 2;
  }
  if (x == 4) {
    //@ assert y != 0;
  }
}

Output:
/*@
  requires 0 <= x <= 2;
  requires 0 <= y <= 2;
*/
void foo(int x, int y) {
  /*@
  loop invariant x == 4 ==> y != 0;
  loop invariant 0 <= y;
  loop invariant 0 <= x;
  loop assigns y,x;
  */
  while (unknown()) {
    x  = x + 2;
    y  = y + 2;
  }
  if (x == 4) {
    //@ assert y != 0;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void firstSubset(int s[], int n) {
 int k;
 for ( k = 0; k < n; k++) {
  s[k] = 0;
 }
}
int main(){
  int s[3];
  firstSubset(s, 3);
  //@ assert s[0] == 0 && s[1] == 0 && s[2] == 0;
}

Output:
/*@
  requires \valid(s + (0 .. n - 1)) && n >= 1;
  assigns s[0 .. n - 1];
  ensures \forall integer k; 0 <= k < n ==> s[k] == 0;
*/
void firstSubset(int s[], int n) {
  /*@
    loop invariant 0 <= k <= n;
    loop invariant \forall integer i; 0 <= i < k ==> s[i] == 0;
    loop assigns k, s[0 .. n - 1];
    loop variant n - k;
  */
 for (int k = 0; k < n; k++) {
  s[k] = 0;
 }
}
int main(){
  int s[3];
  firstSubset(s, 3);
  //@ assert s[0] == 0 && s[1] == 0 && s[2] == 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int main(){
    int i=0;
    while (i<30){
        ++i;
    }
    //@assert i==30;
}

Output:
int main(){
    int i=0;
    /*@
        loop invariant 0 <= i <= 30;
    */
    while (i<30){
        ++i;
    }
    //@assert i==30;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
  logic integer gcd(integer a, integer b) =
      (a==0)?b:
      (b==0)?a:
      (a==b)?a:
      (a>b)? gcd(a-b, b) : gcd(a, b-a);
*/
int gcd(int a, int b) {
    if (a == 0)
       return b;
    if (b == 0)
       return a;
    if (a == b)
        return a;
    if (a > b)
        return gcd(a-b, b);
    return gcd(a, b-a);
}
int main()
{
    int a = 98, b = 56;
    int c = gcd(a, b);
    //@ assert c == 14;
    return 0;
}

Output:
/*@
  logic integer gcd(integer a, integer b) =
      (a==0)?b:
      (b==0)?a:
      (a==b)?a:
      (a>b)? gcd(a-b, b) : gcd(a, b-a);
*/
/*@
  requires a>0 && b>0;
  assigns \nothing;
  behavior exit1:
    assumes a == 0;
    ensures \result == b;
  behavior exit2:
    assumes b == 0;
    ensures \result == a;
  behavior exit3:
    assumes a == b;
    ensures \result == a;
  behavior exit4:
    assumes a > b;
    ensures \result == gcd(a-b,b);
  behavior exit5:
    assumes a < b;
    ensures \result == gcd(a,b-a);
  complete behaviors;
  disjoint behaviors;
*/
int gcd(int a, int b) {
    if (a == 0)
       return b;
    if (b == 0)
       return a;
    if (a == b)
        return a;
    if (a > b)
        return gcd(a-b, b);
    return gcd(a, b-a);
}
int main()
{
    int a = 98, b = 56;
    int c = gcd(a, b);
    //@ assert c == 14;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int mod(int a, int b)
{
	return a % b;
}
int main(){
    int a = 10000;
    int b = 3;
    int c = mod(a,b);
    //@ assert c == 1;
}

Output:
/*@ requires b != 0;
    assigns \nothing;
    ensures \result == (a % b);
 */
int mod(int a, int b)
{
	return a % b;
}
int main(){
    int a = 10000;
    int b = 3;
    int c = mod(a,b);
    //@ assert c == 1;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(int y) {
  int x = 1;
  while (x < y) {
    x = x + x;
  }
  //@ assert x >= 1;
}

Output:
void foo(int y) {
  int x = 1;
  /*@
  loop invariant 1 <= x;
  loop assigns y;
  loop assigns x;
  */
  while (x < y) {
    x = x + x;
  }
  //@ assert x >= 1;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c  = 1;
      }
    }
  }
  if (c < 0) {
    if (c > n) {
      //@ assert c == n;
    }
  }
}

Output:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant c > n ==> c == n + 1;
  loop invariant c <= n;
  loop invariant c <= 1 || c > n;
  loop invariant c < 0 ==> c == n;
  loop invariant c != n;
  loop invariant c != -1;
  loop invariant 0 <= c;
  loop invariant (c > n) || (c <= n);
  loop assigns n,c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c  = 1;
      }
    }
  }
  if (c < 0) {
    if (c > n) {
      //@ assert c == n;
    }
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
void
copy(const value_type* a, size_type n, value_type* b)
{
  for (size_type i = 0u; i < n; ++i) {
    b[i] = a[i];
  }
  //@ assert Equal{Pre,Here}(a, n, b);
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  requires valid:  \valid_read(a + (0..n-1));
  requires valid:  \valid(b + (0..n-1));
  requires sep:    \separated(a + (0..n-1), b);
  assigns          b[0..n-1];
  ensures equal:   Equal{Old,Here}(a, n, b);
*/
void
copy(const value_type* a, size_type n, value_type* b)
{
  /*@
    loop invariant bound:     0 <= i <= n;
    loop invariant equal:     Equal{Pre,Here}(a, i, b);
    loop invariant unchanged: Unchanged{Pre,Here}(a, i, n);
    loop assigns   i, b[0..n-1];
    loop variant n-i;
  */
  for (size_type i = 0u; i < n; ++i) {
    b[i] = a[i];
  }
  //@ assert Equal{Pre,Here}(a, n, b);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int array_find(int* arr, int n, int x) {
    int i = 0;
    for (i = 0; i < n; i++) {
        if (arr[i] == x) {
            return i;
        }
    }
    return -1;
}
void main() {
    int arr[5] = {1, 2, 3, 4, 5};
    int index = array_find(arr, 5, 3);
    //@ assert index == 2;
}

Output:
/*@
    requires n >= 0;
    requires \valid_read(arr+(0..n-1));
    assigns \nothing;
    ensures -1 <= \result < n;
    ensures 0 <= \result < n ==> arr[\result] == x;
    ensures (\result == -1) ==> (\forall integer i; 0 <= i < n ==> arr[i] != x);
    assigns \nothing;
*/
int array_find(int* arr, int n, int x) {
    int i = 0;
    /*@
        loop invariant 0 <= i <= n;
        loop invariant \forall integer k; 0 <= k < i ==> arr[k] != x;
        loop assigns i;
        loop variant n-i;
    */
    for (i = 0; i < n; i++) {
        if (arr[i] == x) {
            return i;
        }
    }
    return -1;
}
void main() {
    int arr[5] = {1, 2, 3, 4, 5};
    int index = array_find(arr, 5, 3);
    //@ assert index == 2;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
unsigned rshift(unsigned a)
{
	return a >> 1;
}
int main(){
	unsigned a = 10;
	unsigned b = rshift(a);
	//@ assert b == 5;
}

Output:
/*@ assigns \nothing;
    ensures \result == a / 2;
 */
unsigned rshift(unsigned a)
{
	return a >> 1;
}
int main(){
	unsigned a = 10;
	unsigned b = rshift(a);
	//@ assert b == 5;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#define SPEC_INT_MIN -2147483648
#define SPEC_INT_MAX 2147483647
long spec_abs1(int a)
{
   long abs;
   abs = a;
   if (a < 0) {
      abs = -abs;
   }
   return abs;
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a = spec_abs1(SPEC_INT_MIN+1);
   //@ assert a == SPEC_INT_MAX;
}
#endif

Output:
#define SPEC_INT_MIN -2147483648
#define SPEC_INT_MAX 2147483647
/*@ assigns \nothing;
    ensures \result >= 0;
    behavior positive:
       assumes a > 0;
       ensures \result == a;
    behavior zero:
       assumes a == 0;
       ensures \result == 0;
       ensures \result == a;
    behavior negative:
       assumes a < 0;
       ensures \result == -a;
    complete behaviors;
    disjoint behaviors;
 */
long spec_abs1(int a)
{
   long abs;
   abs = a;
   if (a < 0) {
      abs = -abs;
   }
   return abs;
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a = spec_abs1(SPEC_INT_MIN+1);
   //@ assert a == SPEC_INT_MAX;
}
#endif

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(int x) {
  int lock = 0;
  int y = x + 1;
  while (x != y) {
    if (unknown()) {
      lock = 1;
      x  = y;
    } else {
      lock = 0;
      x  = y;
      y  = y + 1;
    }
  }
  //@ assert lock == 1;
}

Output:
void foo(int x) {
  int lock = 0;
  int y = x + 1;
  /*@
  loop invariant x <= y;
  loop invariant x != y ==> lock == 0;
  loop invariant lock == 0 ==> x + 1 == y;
  loop invariant x == y || x == y - 1;
  loop invariant x == y || x + 1 == y;
  loop invariant lock == 1 ==> x == y;
  loop invariant lock == 0 || lock == 1;
  loop invariant lock <= 1;
  loop invariant 0 <= lock;
  loop assigns x,y,lock;
  */
  while (x != y) {
    if (unknown()) {
      lock = 1;
      x  = y;
    } else {
      lock = 0;
      x  = y;
      y  = y + 1;
    }
  }
  //@ assert lock == 1;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Reverse
  {
    predicate
    Reverse{K,L}(value_type* a, integer n, value_type* b) =
      \forall integer i; 0 <= i < n  ==>  \at(a[i],K) == \at(b[n-1-i], L);
    predicate
    Reverse{K,L}(value_type* a, integer m, integer n,
                 value_type* b, integer p) = Reverse{K,L}(a+m, n-m, b+p);
    predicate
    Reverse{K,L}(value_type* a, integer m, integer n, value_type* b) =
      Reverse{K,L}(a, m, n, b, m);
    predicate
    Reverse{K,L}(value_type* a, integer m, integer n, integer p) =
      Reverse{K,L}(a, m, n, a, p);
    predicate
    Reverse{K,L}(value_type* a, integer m, integer n) =
      Reverse{K,L}(a, m, n, m);
    predicate
    Reverse{K,L}(value_type* a, integer n) = Reverse{K,L}(a, 0, n);
  }
*/
/*@
  requires valid:  \valid(a + (0..n-1));
  assigns          a[0..n-1];
  ensures reverse: Reverse{Old,Here}(a, n);
*/
void
reverse(value_type* a, size_type n);
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
size_type
rotate(value_type* a, size_type m, size_type n)
{
  if ((0u < m) && (m < n)) {
    reverse(a,  m);
    reverse(a + m, n - m);
    reverse(a, n);
    //@ assert left:   Equal{Pre,Here}(a, 0, m, n-m);
    //@ assert right:  Equal{Pre,Here}(a, m, n, 0);
  }
  return n - m;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Reverse
  {
    predicate
    Reverse{K,L}(value_type* a, integer n, value_type* b) =
      \forall integer i; 0 <= i < n  ==>  \at(a[i],K) == \at(b[n-1-i], L);
    predicate
    Reverse{K,L}(value_type* a, integer m, integer n,
                 value_type* b, integer p) = Reverse{K,L}(a+m, n-m, b+p);
    predicate
    Reverse{K,L}(value_type* a, integer m, integer n, value_type* b) =
      Reverse{K,L}(a, m, n, b, m);
    predicate
    Reverse{K,L}(value_type* a, integer m, integer n, integer p) =
      Reverse{K,L}(a, m, n, a, p);
    predicate
    Reverse{K,L}(value_type* a, integer m, integer n) =
      Reverse{K,L}(a, m, n, m);
    predicate
    Reverse{K,L}(value_type* a, integer n) = Reverse{K,L}(a, 0, n);
  }
*/
/*@
  requires valid:  \valid(a + (0..n-1));
  assigns          a[0..n-1];
  ensures reverse: Reverse{Old,Here}(a, n);
*/
void
reverse(value_type* a, size_type n);
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  requires valid: \valid(a + (0..n-1));
  requires bound: m <= n;
  assigns         a[0..n-1];
  ensures result: \result == n-m;
  ensures left:   Equal{Old,Here}(a, 0, m, n-m);
  ensures right:  Equal{Old,Here}(a, m, n, 0);
*/
size_type
rotate(value_type* a, size_type m, size_type n)
{
  if ((0u < m) && (m < n)) {
    reverse(a,  m);
    reverse(a + m, n - m);
    /*@
      requires left:   Reverse{Pre,Here}(a, 0, m, 0);
      requires right:  Reverse{Pre,Here}(a, m, n, m);
      assigns          a[0..n-1];
      ensures left:    Reverse{Old,Here}(a, 0, m, n-m);
      ensures right:   Reverse{Old,Here}(a, m, n, 0);
    */
    reverse(a, n);
    //@ assert left:   Equal{Pre,Here}(a, 0, m, n-m);
    //@ assert right:  Equal{Pre,Here}(a, m, n, 0);
  }
  return n - m;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


nabinkrsah_Increment function with precondition and postcondition.

Input:
#include<stdio.h>
#include<limits.h>
int inc(int n)
{
return n+1;
}
void main()
{
int a=10;
int k=inc(a);
//@ assert k==11;
}

Output:
#include<stdio.h>
#include<limits.h>
/*@ requires -100000<=n<=100000;
ensures \result==n+1;
*/
int inc(int n)
{
return n+1;
}
void main()
{
int a=10;
int k=inc(a);
//@ assert k==11;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
unsigned lower_bound(const int *a, unsigned n, int val)
{
   unsigned left = 0;
   unsigned right = n;
   unsigned middle = 0;
   while (left < right) {
      middle = left + (right - left) / 2;
      if (a[middle] < val) {
         //@ assert \forall integer i; 0 <= i < middle+1 ==> a[i] < val;
         left = middle + 1;
      } else right = middle;
   }
   return left;
}
#ifdef OUT_OF_TASK
#include <stdio.h>
#define ARRAY_SIZE(array) (sizeof(array)/sizeof((array)[0]))
int main(void)
{
   int a[] = {0};
   int b[] = {0,1};
   int c[] = {0,1,2,3,4,5};
   int res;
   res = lower_bound(a, ARRAY_SIZE(a), 0);
   printf("res: %d\n", res);
   res = lower_bound(b, ARRAY_SIZE(b), 1);
   printf("res: %d\n", res);
   res = lower_bound(c, ARRAY_SIZE(c), 10);
   printf("res: %d\n", res);
}
#endif

Output:
/*@ requires \valid(a + (0..n-1));
    requires \forall integer i, integer j; 0 <= i < j < n ==> a[i] <= a[j];
    assigns \nothing;
    ensures 0 <= \result <= n;
    ensures \forall integer k; 0 <= k < \result ==> a[k] < val;
    ensures \forall integer k; \result <= k < n ==> val <= a[k];
*/
unsigned lower_bound(const int *a, unsigned n, int val)
{
   unsigned left = 0;
   unsigned right = n;
   unsigned middle = 0;
   /*@ loop invariant 0 <= left <= right <= n;
       loop assigns middle, left, right;
       loop invariant \forall integer i; 0 <= i < left ==> a[i] < val;
       loop invariant \forall integer i; right <= i < n ==> val <= a[i];
       loop variant right - left;
   */
   while (left < right) {
      middle = left + (right - left) / 2;
      if (a[middle] < val) {
         //@ assert \forall integer i; 0 <= i < middle+1 ==> a[i] < val;
         left = middle + 1;
      } else right = middle;
   }
   return left;
}
#ifdef OUT_OF_TASK
#include <stdio.h>
#define ARRAY_SIZE(array) (sizeof(array)/sizeof((array)[0]))
int main(void)
{
   int a[] = {0};
   int b[] = {0,1};
   int c[] = {0,1,2,3,4,5};
   int res;
   res = lower_bound(a, ARRAY_SIZE(a), 0);
   printf("res: %d\n", res);
   res = lower_bound(b, ARRAY_SIZE(b), 1);
   printf("res: %d\n", res);
   res = lower_bound(c, ARRAY_SIZE(c), 10);
   printf("res: %d\n", res);
}
#endif

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n)
{
    int x = 0;
    int m = 0;
    while (x < n) {
        if (unknown()) {
            m = x;
        }
        x = x + 1;
    }
    if(n > 0) {
       //@ assert m < n;
       //@ assert m >= 0;
    }
}

Output:
/*@
requires n > 0;
*/
void foo(int n)
{
    int x = 0;
    int m = 0;
    /*@
    loop invariant x <= n;
    loop invariant n > 0 ==> m >= 0;
    loop invariant n > 0 ==> m < n;
    loop invariant m <= x;
    loop invariant 0 <= x;
    loop assigns x,m;
    */
    while (x < n) {
        if (unknown()) {
            m = x;
        }
        x = x + 1;
    }
    if(n > 0) {
       //@ assert m < n;
       //@ assert m >= 0;
    }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <stdint.h>
#include <unistd.h>
#include <string.h>
typedef uint8_t	  u8;
typedef uint16_t u16;
typedef uint32_t u32;
typedef uint64_t u64;
#define X509_FILE_NUM 0
/*@
  predicate bmatch(u8 *b1, u8 *b2, u32 n) =
    \forall integer i; 0 <= i < n ==> b1[i] == b2[i];
  predicate bdiffer(u8 *b1, u8 *b2, u32 n) =
    ! bmatch(b1, b2, n);
*/
int bufs_differ(const u8 *b1, const u8 *b2, u32 n)
{
	int ret = 0;
	u32 i = 0;
	for (i = 0; i < n; i++) {
		if(b1[i] != b2[i]) {
			ret = 1;
			break;
		}
	}
	return ret;
}
int main() {
  u8 b1[10] = {1,2,3,4,5,6,7,8,9,10};
  u8 b2[10] = {10,9,8,7,6,5,4,3,2,1};
  u8 b3[10] = {1,2,3,4,5,6,7,8,9,10};
  u32 n = 10;
  int ret1 = bufs_differ(b1, b3, n);
  //@ assert ret1 == 0;
  int ret2 = bufs_differ(b1, b2, n);
  //@ assert ret2 == 1;
  return 0;
}

Output:
#include <stdint.h>
#include <unistd.h>
#include <string.h>
typedef uint8_t	  u8;
typedef uint16_t u16;
typedef uint32_t u32;
typedef uint64_t u64;
#define X509_FILE_NUM 0
/*@
  predicate bmatch(u8 *b1, u8 *b2, u32 n) =
    \forall integer i; 0 <= i < n ==> b1[i] == b2[i];
  predicate bdiffer(u8 *b1, u8 *b2, u32 n) =
    ! bmatch(b1, b2, n);
*/
/*@
  requires \valid_read(b1 + (0 .. n-1));
  requires \valid_read(b2 + (0 .. n-1));
  requires \valid(b1 + (0 .. n-1));
  requires \valid(b2 + (0 .. n-1));
  requires n >= 0;
  ensures \result == 0 <==> bmatch(b1, b2, n);
  ensures \result == 1 <==> bdiffer(b1, b2, n);
  assigns \nothing;
*/
int bufs_differ(const u8 *b1, const u8 *b2, u32 n)
{
	int ret = 0;
	u32 i = 0;
	/*@
	  loop invariant 0 <= i <= n;
	  loop invariant bmatch(b1, b2, i);
	  loop assigns i;
	  loop variant n - i;
	*/
	for (i = 0; i < n; i++) {
		if(b1[i] != b2[i]) {
			ret = 1;
			break;
		}
	}
	return ret;
}
int main() {
  u8 b1[10] = {1,2,3,4,5,6,7,8,9,10};
  u8 b2[10] = {10,9,8,7,6,5,4,3,2,1};
  u8 b3[10] = {1,2,3,4,5,6,7,8,9,10};
  u32 n = 10;
  int ret1 = bufs_differ(b1, b3, n);
  //@ assert ret1 == 0;
  int ret2 = bufs_differ(b1, b2, n);
  //@ assert ret2 == 1;
  return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n) {
    int y = 0;
    int x = 1;
    while (x <= n) {
        y = n - x;
        x = x +1;
    }
    if (n > 0) {
        //@ assert y >= 0;
    }
}

Output:
/*@
requires n > 0;
*/
void foo(int n) {
    int y = 0;
    int x = 1;
    /*@
    loop invariant y <= n;
    loop invariant x <= n+1;
    loop invariant x <= n + 1;
    loop invariant 1 <= x;
    loop invariant 0 <= y;
    loop invariant 0 <= x;
    loop assigns y,x;
    */
    while (x <= n) {
        y = n - x;
        x = x +1;
    }
    if (n > 0) {
        //@ assert y >= 0;
    }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void reset_1st_if_2nd_is_true(int* a, int const* b){
    if(*b) *a = 0 ;
}
int main(){
    int a = 5 ;
    int x = 0 ;
    reset_1st_if_2nd_is_true(&a, &x);
    //@ assert a == 5 ;
    //@ assert x == 0 ;
    int const b = 1 ;
    reset_1st_if_2nd_is_true(&a, &b);
    //@ assert a == 0 ;
    //@ assert b == 1 ;
}

Output:
/*@
    requires \valid(a) && \valid_read(b);
    requires \separated(a, b);
    assigns *a;
    ensures \old(*b) ==> *a == 0;
    ensures ! \old(*b) ==> *a == \old(*a);
    ensures *b == \old(*b);
*/
void reset_1st_if_2nd_is_true(int* a, int const* b){
    if(*b) *a = 0 ;
}
int main(){
    int a = 5 ;
    int x = 0 ;
    reset_1st_if_2nd_is_true(&a, &x);
    //@ assert a == 5 ;
    //@ assert x == 0 ;
    int const b = 1 ;
    reset_1st_if_2nd_is_true(&a, &b);
    //@ assert a == 0 ;
    //@ assert b == 1 ;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int main() {
    int x = 1;
    int y = 0;
    while (x <= 10) {
        y = 10 - x;
        x = x +1;
    }
    //@ assert y < 10;
}

Output:
int main() {
    int x = 1;
    int y = 0;
    /*@
    loop invariant y < 10;
    loop invariant y <= 10;
    loop invariant x <= 11;
    loop invariant 1 <= x;
    loop invariant 0 <= y;
    loop invariant 0 <= x;
    loop assigns y,x;
    */
    while (x <= 10) {
        y = 10 - x;
        x = x +1;
    }
    //@ assert y < 10;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int main() {
  int sn = 0;
  int x = 0;
  while (unknown()) {
    x  = x + 1;
    sn  = sn + 1;
  }
  if (sn != -1) {
    //@ assert sn == x;
  }
}

Output:
int main() {
  int sn = 0;
  int x = 0;
  /*@
  loop invariant x == sn;
  loop invariant sn == x;
  loop invariant 0 <= x;
  loop invariant 0 <= sn;
  loop assigns x;
  loop assigns sn;
  */
  while (unknown()) {
    x  = x + 1;
    sn  = sn + 1;
  }
  if (sn != -1) {
    //@ assert sn == x;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
int function(int x, int y) {
    int res ;
    y += 10 ;
    x -= 5 ;
    res = x + y ;
    //@ assert -15 <= res <= 5;
    return res ;
}
void main() {
    int t = function(-5, 5);
    //@ assert t == 5;
}

Output:
#include <limits.h>
/*@
    requires INT_MIN <= x <= INT_MAX;
    requires INT_MIN <= y <= INT_MAX;
    requires -20 <= x + y <= 0;
    ensures \result == x + y + 5;
*/
int function(int x, int y) {
    int res ;
    y += 10 ;
    x -= 5 ;
    res = x + y ;
    //@ assert -15 <= res <= 5;
    return res ;
}
// write a test
void main() {
    int t = function(-5, 5);
    // -5 -5 + 5 + 10 = 5
    //@ assert t == 5;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <assert.h>
int unknown1();
int unknown2();
int unknown3();
int unknown4();
int main() {
  int w = 1;
  int z = 0;
  int x = 0;
  int y = 0;
  while (unknown2()) {
    if (w % 2 == 1) {
      x++;
      w++;
    }
    if (z % 2 == 0) {
      y++;
      z++;
    }
  }
  //@ assert x <= 1;
  return 0;
}

Output:
#include <assert.h>
int unknown1();
int unknown2();
int unknown3();
int unknown4();
int main() {
  int w = 1;
  int z = 0;
  int x = 0;
  int y = 0;
  /*@
  loop invariant z % 2 == 0 ==> y == z;
  loop invariant x <= 1;
  loop invariant w % 2 == 1 ==> x == w - 1;
  loop invariant z % 2 == y;
  loop invariant y == z;
  loop invariant w == z || w == z + 1;
  loop invariant w == 2 * x || w == 2 * x + 1;
  loop invariant 1 <= w;
  loop assigns x,y,w,z;
  */
  while (unknown2()) {
    if (w % 2 == 1) {
      x++;
      w++;
    }
    if (z % 2 == 0) {
      y++;
      z++;
    }
  }
  //@ assert x <= 1;
  return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
int add(int *p, int *q) {
    return *p + *q;
}
int main() {
    int a = 24;
    int b = 32;
    int x;
    x = add(&a, &b) ;
    //@ assert x == a + b ;
    //@ assert x == 56 ;
    x = add(&a, &a) ;
    //@ assert x == a + a ;
    //@ assert x == 48 ;
}

Output:
#include <limits.h>
/*@
    requires \valid_read(p) && \valid_read(q);
    requires *p + *q <= INT_MAX;
    requires *p + *q >= INT_MIN;
    assigns \nothing;
    ensures \result == *p + *q;
*/
int add(int *p, int *q) {
    return *p + *q;
}
int main() {
    int a = 24;
    int b = 32;
    int x;
    x = add(&a, &b) ;
    //@ assert x == a + b ;
    //@ assert x == 56 ;
    x = add(&a, &a) ;
    //@ assert x == a + a ;
    //@ assert x == 48 ;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int clamp(int v, int min, int max)
{
	int low = v > min ? v : min;
	return low < max ? low : max;
}
int main(){
	int a = 10;
	int b = 20;
	int c = clamp(a, b, 15);
	//@ assert c == 15;
}

Output:
/*@
	assigns \nothing;
    ensures \result == \min(\max(min, v), max);
 */
int clamp(int v, int min, int max)
{
	int low = v > min ? v : min;
	return low < max ? low : max;
}
int main(){
	int a = 10;
	int b = 20;
	int c = clamp(a, b, 15);
	//@ assert c == 15;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


nabinkrsah_Examples illustrating the usage of labels

Input:
#include<stdio.h>
#include<limits.h>
void function(int* a, int const* b)
{
*a += *b;
}
void main() {
int a = 6;
int b = 4;
L1:
function(&a, &b);
//@assert \at(a,Here)==10 &&  b==4;
//@assert \at(a,L1)==6 && \at(b,L1)==4;
}

Output:
#include<stdio.h>
#include<limits.h>
/*@
  requires INT_MIN<=*a+*b<=INT_MAX;
  requires \valid(a) && \valid_read(b);
  requires \separated(a, b);
  assigns *a;
  ensures *a==\old(*a)+*b;
  ensures *b==\old(*b);
*/
void function(int* a, int const* b)
{
*a += *b;
}
void main() {
int a = 6;
int b = 4;
L1:
function(&a, &b);
//@assert \at(a,Here)==10 &&  b==4;
//@assert \at(a,L1)==6 && \at(b,L1)==4;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<limits.h>
int check(int n){
if(n%2==0)
return 1;
else
return 0;
}
int main(){
int a=4;
int r=check(a);
//@assert a==4;
}

Output:
#include<limits.h>
/*@
requires INT_MIN<=n<INT_MAX;
ensures (n%2==0 ==> \result==1) && (n%2!=0 ==> \result==0);
*/
int check(int n){
if(n%2==0)
return 1;
else
return 0;
}
int main(){
int a=4;
int r=check(a);
//@assert a==4;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int day_of(int m){
    int days[] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
    return days[m-1];
}
int main(){
    int m2 = day_of(2);
    //@ assert m2 == 28;
    int m1 = day_of(1);
    //@ assert m1 == 31;
    int m4 = day_of(4);
    //@ assert m4 == 30;
    return 0;
}

Output:
/*@
    requires 1 <= m <= 12;
    ensures m \in {2} ==> \result == 28;
    ensures m \in {1, 3, 5, 7, 8, 10, 12} ==> \result == 31;
    ensures m \in {4, 6, 9, 11} ==> \result == 30;
*/
int day_of(int m){
    int days[] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
    return days[m-1];
}
int main(){
    int m2 = day_of(2);
    //@ assert m2 == 28;
    int m1 = day_of(1);
    //@ assert m1 == 31;
    int m4 = day_of(4);
    //@ assert m4 == 30;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
  requires 0 <= x <= 10;
  requires 0 <= y <= 10;
*/
void foo(int x, int y) {
  while (unknown()) {
    x  = x + 10;
    y  = y + 10;
  }
  if (y == 0) {
    //@ assert x != 20;
  }
}

Output:
/*@
  requires 0 <= x <= 10;
  requires 0 <= y <= 10;
*/
void foo(int x, int y) {
  /*@
  loop invariant y == 0 ==> x != 20;
  loop invariant y <= x + 10;
  loop invariant 0 <= y;
  loop invariant 0 <= x;
  loop assigns y,x;
  */
  while (unknown()) {
    x  = x + 10;
    y  = y + 10;
  }
  if (y == 0) {
    //@ assert x != 20;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(int x) {
  int i = 0;
  int j = 0;
  int y = 0;
  while (i <= x) {
    i  = i + 1;
    j  = j + y;
  }
  if (y == 1) {
    //@ assert i == j;
  }
}

Output:
void foo(int x) {
  int i = 0;
  int j = 0;
  int y = 0;
  /*@
  loop invariant y == 0 || y == 1;
  loop invariant y <= 1;
  loop invariant j == y*i;
  loop invariant j == y*(i-1);
  loop invariant j == y * i;
  loop invariant j <= y*(x+1);
  loop invariant j <= i*y;
  loop invariant 0 <= y;
  loop invariant 0 <= j;
  loop invariant 0 <= i;
  loop assigns y,i,j;
  */
  while (i <= x) {
    i  = i + 1;
    j  = j + y;
  }
  if (y == 1) {
    //@ assert i == j;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid: \valid(s) && StackInvariant(s);
  assigns         s->size;
  ensures  valid: \valid(s) && StackInvariant(s);
  behavior empty:
    assumes            StackEmpty(s);
    assigns            \nothing;
    ensures empty:     StackEmpty(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_empty:
    assumes            !StackEmpty(s);
    assigns            s->size;
    ensures size:      StackSize(s) == StackSize{Old}(s) - 1;
    ensures full:      !StackFull(s);
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_pop(Stack* s);
/*@
  requires valid:      \valid(s) && StackInvariant(s);
  assigns              s->size, s->obj[s->size];
  behavior full:
    assumes            StackFull(s);
    assigns            \nothing;
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures full:      StackFull(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_full:
    assumes            !StackFull(s);
    assigns            s->size;
    assigns            s->obj[s->size];
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures size:      StackSize(s) == StackSize{Old}(s) + 1;
    ensures top:       StackTop(s) == v;
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures not_empty: !StackEmpty(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize{Old}(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_push(Stack* s, value_type v);
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  top:   !StackEmpty(s) ==> \result == StackTop(s);
*/
value_type
stack_top(const Stack* s);
void
axiom_push_of_pop_top(Stack* s)
{
  const value_type v = stack_top(s);
  //@ assert StackTop(s) == v;
  stack_pop(s);
  stack_push(s, v);
  //@ assert StackTop(s) == v;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid: \valid(s) && StackInvariant(s);
  assigns         s->size;
  ensures  valid: \valid(s) && StackInvariant(s);
  behavior empty:
    assumes            StackEmpty(s);
    assigns            \nothing;
    ensures empty:     StackEmpty(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_empty:
    assumes            !StackEmpty(s);
    assigns            s->size;
    ensures size:      StackSize(s) == StackSize{Old}(s) - 1;
    ensures full:      !StackFull(s);
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_pop(Stack* s);
/*@
  requires valid:      \valid(s) && StackInvariant(s);
  assigns              s->size, s->obj[s->size];
  behavior full:
    assumes            StackFull(s);
    assigns            \nothing;
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures full:      StackFull(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_full:
    assumes            !StackFull(s);
    assigns            s->size;
    assigns            s->obj[s->size];
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures size:      StackSize(s) == StackSize{Old}(s) + 1;
    ensures top:       StackTop(s) == v;
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures not_empty: !StackEmpty(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize{Old}(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_push(Stack* s, value_type v);
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  top:   !StackEmpty(s) ==> \result == StackTop(s);
*/
value_type
stack_top(const Stack* s);
/*@
  requires  valid:     \valid(s) && StackInvariant(s);
  requires  not_empty: !StackEmpty(s);
  assigns              s->size, s->obj[s->size-1];
  ensures   equal:     StackEqual{Old,Here}(s, s);
*/
void
axiom_push_of_pop_top(Stack* s)
{
  const value_type v = stack_top(s);
  //@ assert StackTop(s) == v;
  stack_pop(s);
  stack_push(s, v);
  //@ assert StackTop(s) == v;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires size >= 1;
*/
void foo(int size) {
  int i = 1;
  int sn = 0;
  while (i <= size) {
    i = i + 1;
    sn = sn + 1;
  }
  if(sn != 0) {
    //@ assert sn == size;
  }
}

Output:
/*@
requires size >= 1;
*/
void foo(int size) {
  int i = 1;
  int sn = 0;
  /*@
  loop invariant sn == i-1;
  loop invariant sn == i - 1;
  loop invariant sn <= size;
  loop invariant i <= size+1;
  loop invariant i <= size + 1;
  loop invariant 1 <= i;
  loop invariant 0 <= sn;
  loop assigns sn;
  loop assigns i;
  */
  while (i <= size) {
    i = i + 1;
    sn = sn + 1;
  }
  if(sn != 0) {
    //@ assert sn == size;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 1;
*/
void foo(int n)
{
    int x = 1;
    int m = 1;
    while (x < n) {
        if (unknown()) {
            m = x;
        }
        x = x + 1;
    }
    if(n > 1) {
       //@ assert m < n;
       //@ assert m >= 1;
    }
}

Output:
/*@
requires n > 1;
*/
void foo(int n)
{
    int x = 1;
    int m = 1;
    /*@
    loop invariant 1 <= x <= n;
    loop invariant 1 <= m <= x;
    loop invariant m <= n;
    loop invariant (m == 1 || (m >= 1 && m < x));
    loop assigns x,m;
    */
    while (x < n) {
        if (unknown()) {
            m = x;
        }
        x = x + 1;
    }
    if(n > 1) {
       //@ assert m < n;
       //@ assert m >= 1;
    }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
  requires \valid(a) && \valid(b);
  assigns  *a, *b ;
  behavior reorder:
    assumes *a < *b ;
    ensures *a == \old(*b) && *b == \old(*a) ;
  behavior do_not_change:
    assumes *a >= *b ;
    ensures *a == \old(*a) && *b == \old(*b) ;
  complete behaviors ;
  disjoint behaviors ;
*/
void max_ptr(int* a, int* b){
  if(*a < *b){
    int tmp = *b ;
    *b = *a ;
    *a = tmp ;
  }
  //@ assert *a >= *b ;
}
/*@
  requires \valid(a) && \valid(b);
  assigns  *a, *b ;
  behavior reorder:
    assumes *a > *b ;
    ensures *a == \old(*b) && *b == \old(*a) ;
  behavior do_not_change:
    assumes *a <= *b ;
    ensures *a == \old(*a) && *b == \old(*b) ;
  complete behaviors ;
  disjoint behaviors ;
*/
void min_ptr(int* a, int* b){
  max_ptr(b, a);
  //@ assert *a <= *b ;
}

void order_3_inc_min(int* a, int* b, int* c) {
  min_ptr(a, b) ;
  min_ptr(a, c);
  min_ptr(b, c);
  //@ assert *a <= *b && *b <= *c ;
}

Output:
/*@
  requires \valid(a) && \valid(b);
  assigns  *a, *b ;
  behavior reorder:
    assumes *a < *b ;
    ensures *a == \old(*b) && *b == \old(*a) ;
  behavior do_not_change:
    assumes *a >= *b ;
    ensures *a == \old(*a) && *b == \old(*b) ;
  complete behaviors ;
  disjoint behaviors ;
*/
void max_ptr(int* a, int* b){
  if(*a < *b){
    int tmp = *b ;
    *b = *a ;
    *a = tmp ;
  }
  //@ assert *a >= *b ;
}
/*@
  requires \valid(a) && \valid(b);
  assigns  *a, *b ;
  behavior reorder:
    assumes *a > *b ;
    ensures *a == \old(*b) && *b == \old(*a) ;
  behavior do_not_change:
    assumes *a <= *b ;
    ensures *a == \old(*a) && *b == \old(*b) ;
  complete behaviors ;
  disjoint behaviors ;
*/
void min_ptr(int* a, int* b){
  max_ptr(b, a);
  //@ assert *a <= *b ;
}
/*@ requires \valid(a) && \valid(b) && \valid(c) ;
    requires \separated(a, b, c);
    assigns *a, *b, *c ;
    ensures { \old(*a), \old(*b), \old(*c) } == { *a, *b, *c };
    behavior all_equal:
        assumes *a == *b == *c ;
        ensures *a == *b == *c;
    behavior all_uequal:
        assumes *a != *b && *a != *c && *b != *c ;
        ensures *a != *b && *a != *c && *b != *c ;
    behavior two_eq_lt:
        assumes *a == *b < *c ||
                *a == *c < *b ||
                *b == *c < *a;
        ensures *a == *b;
    behavior two_eq_gt:
        assumes *a == *b > *c ||
                *a == *c > *b ||
                *b == *c > *a;
        ensures *b == *c;
    complete behaviors ;
    disjoint behaviors ;
*/
void order_3_inc_min(int* a, int* b, int* c) {
  min_ptr(a, b) ;
  min_ptr(a, c);
  min_ptr(b, c);
  //@ assert *a <= *b && *b <= *c ;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <stdlib.h>
int sum(char n) {
    int s = 0;
    char k = 0;
    while(k <= n) {
        s = s + (int)k;
        k = k + 1;
    }
    //@ assert s == (int)((n+1)*(n)/2);
    return (int)s;
}
int main() {
    int s = sum(5);
    //@ assert s == 15;
}

Output:
#include <stdlib.h>
/*@
    requires n >= 0 && n <= 100;
    ensures \result >= 0;
    ensures \result == (int)((n+1)*(n)/2);
    assigns \nothing;
*/
int sum(char n) {
    int s = 0;
    char k = 0;
    /*@
        loop invariant 0 <= k <= n+1;
        loop invariant s == (k-1)*(k)/2;
        loop assigns k, s;
        loop variant n - k;
    */
    while(k <= n) {
        s = s + (int)k;
        k = k + 1;
    }
    //@ assert s == (int)((n+1)*(n)/2);
    return (int)s;
}
int main() {
    int s = sum(5);
    //@ assert s == 15;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n)
{
    int x = 0;
    int m = 0;
    while (x < n) {
        if (unknown()) {
            m = x;
        }
        x = x + 1;
    }
    if(n > 0) {
       //@ assert m < n;
       //@ assert m >= 0;
    }
}

Output:
/*@
requires n > 0;
*/
void foo(int n)
{
    int x = 0;
    int m = 0;
    /*@
    loop invariant 0 <= x <= n;
    loop invariant 0 <= m <= x;
    loop invariant m < n;
    loop assigns x,m;
    */
    while (x < n) {
        if (unknown()) {
            m = x;
        }
        x = x + 1;
    }
    //post-condition
    if(n > 0) {
       //@ assert m < n;
       //@ assert m >= 0;
    }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int max(int x, int y) {
    if (x >= y) {
        return x;
    }
    return y;
}
int main() {
    int a = 5;
    int b = 10;
    int result = max(a, b);
    //@ assert result == 10;
    return 0;
}

Output:
/*@
    ensures \result == x || \result == y;
    ensures \result >= x && \result >= y;
*/
int max(int x, int y) {
    if (x >= y) {
        return x;
    }
    return y;
}
int main() {
    int a = 5;
    int b = 10;
    int result = max(a, b);
    //@ assert result == 10;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<stdio.h>
/*@predicate sorted(int* a, int length)=\forall integer i,j;0<=i<=j<length==>a[i]<=a[j];
*/
int binary_search(int* a, int n, int v) {
	int l=0,u=n-1;
	while(l<=u) {
		int m=l+(u-l)/2;
		if(a[m]==v) return m;
		else if(a[m]<v) l=m+1;
		else u=m-1;
	}
	return -1;
}
void main() {
	int a[] = {3,4,5,13,21};
	//@ assert sorted(a, 5);
	int res = binary_search(a, 5, 5);
	//@ assert res == 2;
}

Output:
#include<stdio.h>
/*@predicate sorted(int* a, int length)=\forall integer i,j;0<=i<=j<length==>a[i]<=a[j];
*/
/*@
	requires n>=0&&\valid_read(a+(0..n-1));
  	requires sorted(a,n);
	assigns \nothing;
	behavior exists:
		assumes \exists integer i;0<=i<n&&a[i]==v;
		ensures 0<=\result<n&&a[\result]==v;
	behavior not_exists:
		assumes \forall integer i;0<=i<n==>a[i]!=v;
		ensures \result==-1;
	complete behaviors;
	disjoint behaviors;
*/
int binary_search(int* a, int n, int v) {
	int l=0,u=n-1;
	/*@
		loop invariant 0<=l<=u+1;
		loop invariant u<n;
		loop assigns l,u;
		loop invariant \forall integer k;0<=k<l==>a[k]<v;
		loop invariant \forall integer k;u<k<n==>a[k]>v;
		loop variant u-l;
	*/
	while(l<=u) {
		int m=l+(u-l)/2;
		if(a[m]==v) return m;
		else if(a[m]<v) l=m+1;
		else u=m-1;
	}
	return -1;
}
void main() {
	int a[] = {3,4,5,13,21};
	int res = binary_search(a, 5, 5);
	//@ assert res == 2;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int divmult(int a, int b)
{
	return (a / b) * b + (a % b);
}
int main(){
    int a = 10;
    int b = 3;
    int c = divmult(a, b);
    //@ assert c == 10;
    return 0;
}

Output:
/*@
    requires b != 0;
    requires b != -1;
    assigns \nothing;
    ensures \result == a/b * b + a % b;
 */
int divmult(int a, int b)
{
	return (a / b) * b + (a % b);
}
int main(){
    int a = 10;
    int b = 3;
    int c = divmult(a, b);
    //@ assert c == 10;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (n <= -1) {
    //@ assert c != n;
  }
}

Output:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant n - c;
  loop invariant c != n;
  loop invariant 0 <= c <= n;
  loop invariant 0 < n;
  loop assigns n,c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (n <= -1) {
    //@ assert c != n;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires 1 <= n;
*/
void foo(int n) {
  int i = 1;
  int sn = 0;
  while (i <= n) {
    i  = i + 1;
    sn  = sn + 1;
  }
  if(sn != n) {
    //@ assert sn == 0;
  }
}

Output:
/*@
requires 1 <= n;
*/
void foo(int n) {
  int i = 1;
  int sn = 0;
  /*@
  loop invariant sn == i-1;
  loop invariant sn == i - 1;
  loop invariant i <= n+1;
  loop invariant i <= n + 1;
  loop invariant 1 <= i;
  loop assigns sn;
  loop assigns i;
  */
  while (i <= n) {
    i  = i + 1;
    sn  = sn + 1;
  }
  if(sn != n) {
    //@ assert sn == 0;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<stddef.h>
void reset(int* array,size_t length){
for(size_t i=0;i<length;i++){
array[i]=0;}
}
int main(){
int a[]={1,2,3,4,5};
reset(a,5);
//@ assert a[0] == 0;
//@ assert a[1] == 0;
//@ assert a[2] == 0;
//@ assert a[3] == 0;
//@ assert a[4] == 0;
}

Output:
#include<stddef.h>
/*@
requires \valid(array + (0..length-1));
assigns array[0..length-1];
ensures \forall size_t i; 0 <= i < length ==> array[i] == 0;
*/
void reset(int* array,size_t length){
/*@
loop invariant 0 <= i <=length;
loop invariant \forall size_t j; 0 <= j < i ==> array[j] == 0;
loop assigns i,array[0..length-1];
loop variant length-i;
*/
for(size_t i=0;i<length;i++){
array[i]=0;}
}
int main(){
int a[]={1,2,3,4,5};
reset(a,5);
//@ assert a[0] == 0;
//@ assert a[1] == 0;
//@ assert a[2] == 0;
//@ assert a[3] == 0;
//@ assert a[4] == 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int arraymax(int* a, int n) {
  int i = 1;
  int max = a[0];
  while (i < n) {
    if (max < a[i])
    max = a[i];
    i = i + 1;
  }
  return max;
}
void main() {
  int arr[5] = {1, 2, 3, 4, 5};
  int sum = arraymax(arr, 5);
  //@ assert sum == 5;
}

Output:
/*@
    requires \valid_read(a + (0..n-1));
    requires n > 0;
    ensures \forall integer k;  0 <= k < n ==> \result >=  a[k];
    ensures \exists integer k;  0 <= k < n && \result == a[k];
    assigns \nothing;
*/
int arraymax(int* a, int n) {
  int i = 1;
  int max = a[0];
  /*@
     loop invariant \forall integer k;  0 <= k < i ==> max >=  a[k];
     loop invariant \exists integer k;  0 <= k < i &&  max == a[k];
     loop invariant 0 <= i <= n;
     loop assigns i,max;
 */
  while (i < n) {
    if (max < a[i])
    max = a[i];
    i = i + 1;
  }
  return max;
}
// write a test
void main() {
  int arr[5] = {1, 2, 3, 4, 5};
  int sum = arraymax(arr, 5);
  //@ assert sum == 5;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
unsigned lower_bound_raw(const int *a, unsigned n, int val)
{
   unsigned i = 0;
   for(; i < n; ++i) {
      if (a[i] >= val) {
         break;
      }
   }
   //@ assert \forall integer k; 0 <= k < i ==> a[k] < val;
   return i;
}

Output:
/*@ requires \valid(a + (0..n-1));
    requires \forall integer i, integer j; 0 <= i < j < n ==> a[i] <= a[j];
    assigns \nothing;
    ensures 0 <= \result <= n;
    ensures \forall integer k; 0 <= k < \result ==> a[k] < val;
    ensures \forall integer k; \result <= k < n ==> val <= a[k];
*/
unsigned lower_bound_raw(const int *a, unsigned n, int val)
{
   unsigned i = 0;
    /*@ loop invariant 0 <= i <= n;
     loop assigns i;
     loop invariant \forall integer k; 0 <= k < i ==> a[k] < val;
     loop invariant \forall integer k; i <= k < n ==> a[k] >= a[i];
     loop variant n - i;
     */
   for(; i < n; ++i) {
      if (a[i] >= val) {
         break;
      }
   }
   //@ assert \forall integer k; 0 <= k < i ==> a[k] < val;
   return i;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int main() {
  int sn = 0;
  int x = 0;
  while (unknown()) {
    x = x + 1;
    sn = sn + 1;
  }
  if (sn != -1) {
    //@ assert sn == x;
  }
}

Output:
int main() {
  int sn = 0;
  int x = 0;
  /*@
  loop invariant x == sn;
  loop invariant sn == x;
  loop invariant 0 <= x;
  loop invariant 0 <= sn;
  loop assigns x;
  loop assigns sn;
  */
  while (unknown()) {
    x = x + 1;
    sn = sn + 1;
  }
  if (sn != -1) {
    //@ assert sn == x;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct size_type_pair {
  size_type first;
  size_type second;
};
typedef struct size_type_pair size_type_pair;
/*@
    assigns         \nothing;
    ensures result: \result.first  == first;
    ensures result: \result.second == second;
*/
static inline
size_type_pair
make_pair(size_type first, size_type second)
{
  size_type_pair pair;
  pair.first  = first;
  pair.second = second;
  return pair;
}
/*@
  axiomatic ArrayBounds
  {
    predicate
    LowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v <= a[i];
    predicate
    LowerBound{L}(value_type* a, integer n, value_type v) =
      LowerBound{L}(a, 0, n, v);
    predicate
    StrictLowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v < a[i];
    predicate
    StrictLowerBound{L}(value_type* a, integer n, value_type v) =
      StrictLowerBound{L}(a, 0, n, v);
    predicate
    UpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] <= v;
    predicate
    UpperBound{L}(value_type* a, integer n, value_type v) =
      UpperBound{L}(a, 0, n, v);
    predicate
    StrictUpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] < v;
    predicate
    StrictUpperBound{L}(value_type* a, integer n, value_type v) =
      StrictUpperBound{L}(a, 0, n, v);
  }
*/
/*@
  axiomatic ArrayExtrema
  {
    predicate
    MaxElement{L}(value_type* a, integer n, integer max) =
      0 <= max < n && UpperBound(a, n, a[max]);
    predicate
    MinElement{L}(value_type* a, integer n, integer min) =
      0 <= min < n && LowerBound(a, n, a[min]);
  }
*/
/*@
  requires valid:    \valid_read(a + (0..n-1));
  assigns            \nothing;
  ensures result:    0 <= \result.first  <= n;
  ensures result:    0 <= \result.second <= n;
  behavior empty:
    assumes          0 == n;
    assigns          \nothing;
    ensures result:  \result.first == 0;
    ensures result:  \result.second == 0;
  behavior not_empty:
    assumes          0 < n;
    assigns          \nothing;
    ensures result:  0 <= \result.first < n;
    ensures result:  0 <= \result.second < n;
    ensures min:     MinElement(a, n, \result.first);
    ensures first:   StrictLowerBound(a, \result.first, a[\result.first]);
    ensures max:     MaxElement(a, n, \result.second);
    ensures last:    StrictUpperBound(a, \result.second+1, n, a[\result.second]);
*/
size_type_pair
minmax_element(const value_type* a, size_type n)
{
  if (0u < n) {
    size_type min = 0u;
    size_type max = 0u;
    for (size_type i = 0u; i < n; i++) {
      if (a[i] >= a[max]) {
        max = i;
      }
      if (a[i] < a[min]) {
        min = i;
      }
    }
    //@ assert MinElement(a, n, min) && MaxElement(a, n, max);
    return make_pair(min, max);
  }
  return make_pair(n, n);
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct size_type_pair {
  size_type first;
  size_type second;
};
typedef struct size_type_pair size_type_pair;
/*@
    assigns         \nothing;
    ensures result: \result.first  == first;
    ensures result: \result.second == second;
*/
static inline
size_type_pair
make_pair(size_type first, size_type second)
{
  size_type_pair pair;
  pair.first  = first;
  pair.second = second;
  return pair;
}
/*@
  axiomatic ArrayBounds
  {
    predicate
    LowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v <= a[i];
    predicate
    LowerBound{L}(value_type* a, integer n, value_type v) =
      LowerBound{L}(a, 0, n, v);
    predicate
    StrictLowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v < a[i];
    predicate
    StrictLowerBound{L}(value_type* a, integer n, value_type v) =
      StrictLowerBound{L}(a, 0, n, v);
    predicate
    UpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] <= v;
    predicate
    UpperBound{L}(value_type* a, integer n, value_type v) =
      UpperBound{L}(a, 0, n, v);
    predicate
    StrictUpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] < v;
    predicate
    StrictUpperBound{L}(value_type* a, integer n, value_type v) =
      StrictUpperBound{L}(a, 0, n, v);
  }
*/
/*@
  axiomatic ArrayExtrema
  {
    predicate
    MaxElement{L}(value_type* a, integer n, integer max) =
      0 <= max < n && UpperBound(a, n, a[max]);
    predicate
    MinElement{L}(value_type* a, integer n, integer min) =
      0 <= min < n && LowerBound(a, n, a[min]);
  }
*/
/*@
  requires valid:    \valid_read(a + (0..n-1));
  assigns            \nothing;
  ensures result:    0 <= \result.first  <= n;
  ensures result:    0 <= \result.second <= n;
  behavior empty:
    assumes          0 == n;
    assigns          \nothing;
    ensures result:  \result.first == 0;
    ensures result:  \result.second == 0;
  behavior not_empty:
    assumes          0 < n;
    assigns          \nothing;
    ensures result:  0 <= \result.first < n;
    ensures result:  0 <= \result.second < n;
    ensures min:     MinElement(a, n, \result.first);
    ensures first:   StrictLowerBound(a, \result.first, a[\result.first]);
    ensures max:     MaxElement(a, n, \result.second);
    ensures last:    StrictUpperBound(a, \result.second+1, n, a[\result.second]);
*/
size_type_pair
minmax_element(const value_type* a, size_type n)
{
  if (0u < n) {
    size_type min = 0u;
    size_type max = 0u;
    /*@
      loop invariant bound: 0 <= i    <= n;
      loop invariant min:   0 <= min  <  n;
      loop invariant max:   0 <= max  <  n;
      loop invariant lower: LowerBound(a, i, a[min]);
      loop invariant upper: UpperBound(a, i, a[max]);
      loop invariant first: StrictLowerBound(a, min, a[min]);
      loop invariant last:  StrictUpperBound(a, max+1, i, a[max]);
      loop assigns min, max, i;
      loop variant n-i;
    */
    for (size_type i = 0u; i < n; i++) {
      if (a[i] >= a[max]) {
        max = i;
      }
      if (a[i] < a[min]) {
        min = i;
      }
    }
    //@ assert MinElement(a, n, min) && MaxElement(a, n, max);
    return make_pair(min, max);
  }
  return make_pair(n, n);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid:     \valid(s);
  requires capacity:  0 < capacity;
  requires storage:   \valid(storage + (0..capacity-1));
  requires sep:       \separated(s, storage + (0..capacity-1));
  assigns             s->obj, s->capacity, s->size;
  ensures  valid:     \valid(s);
  ensures  capacity:  StackCapacity(s) == capacity;
  ensures  storage:   StackStorage(s) == storage;
  ensures  invariant: StackInvariant(s);
  ensures  empty:     StackEmpty(s);
*/
void
stack_init(Stack* s, value_type* storage, size_type capacity);
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  size:  \result == StackSize(s);
*/
size_type
stack_size(const Stack* s);
size_type
axiom_size_of_init(Stack* s, value_type* a, size_type n)
{
  stack_init(s, a, n);
  //@ assert StackSize(s) == 0;
  return stack_size(s);
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid:     \valid(s);
  requires capacity:  0 < capacity;
  requires storage:   \valid(storage + (0..capacity-1));
  requires sep:       \separated(s, storage + (0..capacity-1));
  assigns             s->obj, s->capacity, s->size;
  ensures  valid:     \valid(s);
  ensures  capacity:  StackCapacity(s) == capacity;
  ensures  storage:   StackStorage(s) == storage;
  ensures  invariant: StackInvariant(s);
  ensures  empty:     StackEmpty(s);
*/
void
stack_init(Stack* s, value_type* storage, size_type capacity);
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  size:  \result == StackSize(s);
*/
size_type
stack_size(const Stack* s);
/*@
  requires valid:  \valid(s);
  requires valid:  \valid(a + (0..n-1));
  requires sep:    \separated(s, a + (0..n-1));
  requires pos:    0 < n;
  assigns          s->obj, s->capacity, s->size;
  ensures  size:   \result == 0;
  ensures  valid:  StackInvariant(s);
*/
size_type
axiom_size_of_init(Stack* s, value_type* a, size_type n)
{
  stack_init(s, a, n);
  //@ assert StackSize(s) == 0;
  return stack_size(s);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int max3(int a, int b, int c)
{
	return a > b ? (a > c ? a : c) : (b > c ? b : c);
}
int main(){
	int a = 1;
	int b = 2;
	int c = 3;
	int d = max3(a, b, c);
    //@ assert d == 3;
}

Output:
/*@ assigns \nothing;
    ensures \result == \max(\max(a, b), \max(b, c));
 */
int max3(int a, int b, int c)
{
	return a > b ? (a > c ? a : c) : (b > c ? b : c);
}
int main(){
	int a = 1;
	int b = 2;
	int c = 3;
	int d = max3(a, b, c);
    //@ assert d == 3;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c != n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if(c < 0) {
    if(c > n) {
      //@ assert c == n;
    }
  }
}

Output:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant c > 0 ==> c <= n;
  loop invariant c <= n;
  loop invariant 0 <= c;
  loop invariant (c == n) || (c < n);
  loop assigns c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c != n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if(c < 0) {
    if(c > n) {
      //@ assert c == n;
    }
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic WeaklyIncreasing
  {
    predicate
    WeaklyIncreasing{L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n-1  ==>  a[i] <= a[i+1];
    predicate
    WeaklyIncreasing{L}(value_type* a, integer n) = WeaklyIncreasing{L}(a, 0, n);
  }
*/
/*@
  axiomatic Increasing
  {
    predicate
    Increasing{L}(value_type* a, integer m, integer n) =
      \forall integer i, j; m <= i < j < n  ==>  a[i] <= a[j];
    predicate
    Increasing{L}(value_type* a, integer n) = Increasing{L}(a, 0, n);
  }
*/
/*@
  axiomatic ArrayBounds
  {
    predicate
    LowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v <= a[i];
    predicate
    LowerBound{L}(value_type* a, integer n, value_type v) =
      LowerBound{L}(a, 0, n, v);
    predicate
    StrictLowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v < a[i];
    predicate
    StrictLowerBound{L}(value_type* a, integer n, value_type v) =
      StrictLowerBound{L}(a, 0, n, v);
    predicate
    UpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] <= v;
    predicate
    UpperBound{L}(value_type* a, integer n, value_type v) =
      UpperBound{L}(a, 0, n, v);
    predicate
    StrictUpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] < v;
    predicate
    StrictUpperBound{L}(value_type* a, integer n, value_type v) =
      StrictUpperBound{L}(a, 0, n, v);
  }
*/
size_type
upper_bound(const value_type* a, size_type n, value_type v)
{
  size_type left  = 0u;
  size_type right = n;
  while (left < right) {
    const size_type middle = left + (right - left) / 2u;
    if (a[middle] <= v) {
      left = middle + 1u;
    }
    else {
      right = middle;
    }
  }
  //@ assert UpperBound(a, 0, right, v);
  return right;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic WeaklyIncreasing
  {
    predicate
    WeaklyIncreasing{L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n-1  ==>  a[i] <= a[i+1];
    predicate
    WeaklyIncreasing{L}(value_type* a, integer n) = WeaklyIncreasing{L}(a, 0, n);
  }
*/
/*@
  axiomatic Increasing
  {
    predicate
    Increasing{L}(value_type* a, integer m, integer n) =
      \forall integer i, j; m <= i < j < n  ==>  a[i] <= a[j];
    predicate
    Increasing{L}(value_type* a, integer n) = Increasing{L}(a, 0, n);
  }
*/
/*@
  axiomatic ArrayBounds
  {
    predicate
    LowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v <= a[i];
    predicate
    LowerBound{L}(value_type* a, integer n, value_type v) =
      LowerBound{L}(a, 0, n, v);
    predicate
    StrictLowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v < a[i];
    predicate
    StrictLowerBound{L}(value_type* a, integer n, value_type v) =
      StrictLowerBound{L}(a, 0, n, v);
    predicate
    UpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] <= v;
    predicate
    UpperBound{L}(value_type* a, integer n, value_type v) =
      UpperBound{L}(a, 0, n, v);
    predicate
    StrictUpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] < v;
    predicate
    StrictUpperBound{L}(value_type* a, integer n, value_type v) =
      StrictUpperBound{L}(a, 0, n, v);
  }
*/
/*@
  requires valid:      \valid_read(a + (0..n-1));
  requires increasing: Increasing(a, n);
  assigns              \nothing;
  ensures result:      0 <= \result <= n;
  ensures left:        UpperBound(a, 0, \result, v);
  ensures right:       StrictLowerBound(a, \result, n, v);
*/
size_type
upper_bound(const value_type* a, size_type n, value_type v)
{
  size_type left  = 0u;
  size_type right = n;
  /*@
    loop invariant bound:  0 <= left <= right <= n;
    loop invariant left:   UpperBound(a, 0, left, v);
    loop invariant right:  StrictLowerBound(a, right, n, v);
    loop assigns left, right;
    loop variant right - left;
  */
  while (left < right) {
    const size_type middle = left + (right - left) / 2u;
    if (a[middle] <= v) {
      left = middle + 1u;
    }
    else {
      right = middle;
    }
  }
  //@ assert UpperBound(a, 0, right, v);
  return right;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<stdio.h>
/*@
	requires n>=0&&\valid_read(a+(0..n-1));
	assigns \nothing;
	ensures \forall integer k;0<=k<n==>\result>=a[k];
*/
int max(int a[], int n) {
	int max = a[0];
	int i = 0;
	/*@
		loop invariant 0<=i<=n;
		loop invariant \forall integer k;0<=k<i==>max>=a[k];
		loop assigns i,max;
		loop variant n-i;
	*/
	while(i<n) {
		if(a[i]>max)
			max = a[i];
		i++;
	}
	return max;
}
int min(int a[], int n) {
	int min = a[0];
	int i = 0;
	while(i<n) {
		if(a[i]<min)
			min = a[i];
		i++;
	}
	return min;
}
void main() {
	int a[] = {11, 23, 13, 16, 54, 59};
	int max_val = max(a, 6);
	//@ assert \forall integer k; 0 <= k < 6 ==> max_val >= a[k];
	int min_val = min(a, 6);
	//@ assert \forall integer k; 0 <= k < 6 ==> min_val <= a[k];
}

Output:
#include<stdio.h>
/*@
	requires n>=0&&\valid_read(a+(0..n-1));
	assigns \nothing;
	ensures \forall integer k;0<=k<n==>\result>=a[k];
*/
int max(int a[], int n) {
	int max = a[0];
	int i = 0;
	/*@
		loop invariant 0<=i<=n;
		loop invariant \forall integer k;0<=k<i==>max>=a[k];
		loop assigns i,max;
		loop variant n-i;
	*/
	while(i<n) {
		if(a[i]>max)
			max = a[i];
		i++;
	}
	return max;
}
/*@
	requires n>=0&&\valid_read(a+(0..n-1));
	assigns \nothing;
	ensures \forall integer k;0<=k<n==>\result<=a[k];
*/
int min(int a[], int n) {
	int min = a[0];
	int i = 0;
	/*@
		loop invariant 0<=i<=n;
		loop invariant \forall integer k;0<=k<i==>min<=a[k];
		loop assigns i,min;
		loop variant n-i;
	*/
	while(i<n) {
		if(a[i]<min)
			min = a[i];
		i++;
	}
	return min;
}
void main() {
	int a[] = {11, 23, 13, 16, 54, 59};
	int max_val = max(a, 6);
	//@ assert \forall integer k; 0 <= k < 6 ==> max_val >= a[k];
	int min_val = min(a, 6);
	//@ assert \forall integer k; 0 <= k < 6 ==> min_val <= a[k];
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Replace
  {
    predicate
    Replace{K,L}(value_type* a, integer n, value_type* b,
                 value_type v, value_type w) =
      \forall integer i; 0 <= i < n  ==>
        \let ai = \at(a[i],K);
        \let bi = \at(b[i],L);
        (ai == v  ==>  bi == w) && (ai != v  ==>  bi == ai) ;
    predicate
    Replace{K,L}(value_type* a, integer n, value_type v, value_type w) =
      Replace{K,L}(a, n, a, v, w);
  }
*/
void
replace(value_type* a, size_type n, value_type v, value_type w)
{
  for (size_type i = 0u; i < n; ++i) {
    if (a[i] == v) {
      a[i] = w;
    }
  }
  //@ assert Replace{Pre,Here}(a, n, v, w);
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Replace
  {
    predicate
    Replace{K,L}(value_type* a, integer n, value_type* b,
                 value_type v, value_type w) =
      \forall integer i; 0 <= i < n  ==>
        \let ai = \at(a[i],K);
        \let bi = \at(b[i],L);
        (ai == v  ==>  bi == w) && (ai != v  ==>  bi == ai) ;
    predicate
    Replace{K,L}(value_type* a, integer n, value_type v, value_type w) =
      Replace{K,L}(a, n, a, v, w);
  }
*/
/*@
  requires valid:   \valid(a + (0..n-1));
  assigns           a[0..n-1];
  ensures replace:  Replace{Old,Here}(a, n, v, w);
*/
void
replace(value_type* a, size_type n, value_type v, value_type w)
{
  /*@
    loop invariant bounds:    0 <= i <= n;
    loop invariant replace:   Replace{Pre,Here}(a, i, v, w);
    loop invariant unchanged: Unchanged{Pre,Here}(a, i, n);
    loop assigns i, a[0..n-1];
    loop variant n-i;
  */
  for (size_type i = 0u; i < n; ++i) {
    if (a[i] == v) {
      a[i] = w;
    }
  }
  //@ assert Replace{Pre,Here}(a, n, v, w);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  top:   !StackEmpty(s) ==> \result == StackTop(s);
*/
value_type
stack_top(const Stack* s);
bool
stack_top_wd(const Stack* s, const Stack* t)
{
  return stack_top(s) == stack_top(t);
}
int main(){
  Stack s1, s2;
  value_type arr1[3] = {1, 2, 3};
  value_type arr2[3] = {1, 2, 3};
  s1.obj = arr1;
  s1.capacity = 3;
  s1.size = 3;
  s2.obj = arr2;
  s2.capacity = 3;
  s2.size = 3;
  bool result = stack_top_wd(&s1, &s2);
  //@ assert result == true;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  top:   !StackEmpty(s) ==> \result == StackTop(s);
*/
value_type
stack_top(const Stack* s);
/*@
  requires valid:  \valid(s) && StackInvariant(s) && !StackEmpty(s);
  requires valid:  \valid(t) && StackInvariant(t) && !StackEmpty(t);
  requires equal:  StackEqual{Here,Here}(s, t);
  assigns          \nothing;
  ensures  equal:  \result == true <==> StackTop(s) == StackTop(t);
  ensures  not_equal: \result == false <==> StackTop(s) != StackTop(t);
*/
bool
stack_top_wd(const Stack* s, const Stack* t)
{
  return stack_top(s) == stack_top(t);
}
int main(){
  Stack s1, s2;
  value_type arr1[3] = {1, 2, 3};
  value_type arr2[3] = {1, 2, 3};
  s1.obj = arr1;
  s1.capacity = 3;
  s1.size = 3;
  s2.obj = arr2;
  s2.capacity = 3;
  s2.size = 3;
  bool result = stack_top_wd(&s1, &s2);
  //@ assert result == true;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.