Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid: \valid(s) && StackInvariant(s);
  assigns         s->size;
  ensures  valid: \valid(s) && StackInvariant(s);
  behavior empty:
    assumes            StackEmpty(s);
    assigns            \nothing;
    ensures empty:     StackEmpty(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_empty:
    assumes            !StackEmpty(s);
    assigns            s->size;
    ensures size:      StackSize(s) == StackSize{Old}(s) - 1;
    ensures full:      !StackFull(s);
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_pop(Stack* s);
/*@
  requires valid:      \valid(s) && StackInvariant(s);
  assigns              s->size, s->obj[s->size];
  behavior full:
    assumes            StackFull(s);
    assigns            \nothing;
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures full:      StackFull(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_full:
    assumes            !StackFull(s);
    assigns            s->size;
    assigns            s->obj[s->size];
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures size:      StackSize(s) == StackSize{Old}(s) + 1;
    ensures top:       StackTop(s) == v;
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures not_empty: !StackEmpty(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize{Old}(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_push(Stack* s, value_type v);
void
axiom_pop_of_push(Stack* s, value_type v)
{
  stack_push(s, v);
  stack_pop(s);
  //@ assert StackEqual{Pre,Here}(s, s);
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid: \valid(s) && StackInvariant(s);
  assigns         s->size;
  ensures  valid: \valid(s) && StackInvariant(s);
  behavior empty:
    assumes            StackEmpty(s);
    assigns            \nothing;
    ensures empty:     StackEmpty(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_empty:
    assumes            !StackEmpty(s);
    assigns            s->size;
    ensures size:      StackSize(s) == StackSize{Old}(s) - 1;
    ensures full:      !StackFull(s);
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_pop(Stack* s);
/*@
  requires valid:      \valid(s) && StackInvariant(s);
  assigns              s->size, s->obj[s->size];
  behavior full:
    assumes            StackFull(s);
    assigns            \nothing;
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures full:      StackFull(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_full:
    assumes            !StackFull(s);
    assigns            s->size;
    assigns            s->obj[s->size];
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures size:      StackSize(s) == StackSize{Old}(s) + 1;
    ensures top:       StackTop(s) == v;
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures not_empty: !StackEmpty(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize{Old}(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_push(Stack* s, value_type v);
/*@
  requires  valid:    \valid(s) && StackInvariant(s);
  requires  not_full: !StackFull(s);
  assigns             s->size, s->obj[s->size];
  ensures   equal:    StackEqual{Old,Here}(s, s);
*/
void
axiom_pop_of_push(Stack* s, value_type v)
{
  stack_push(s, v);
  stack_pop(s);
  //@ assert StackEqual{Pre,Here}(s, s);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<stddef.h>
void reset(int* array,size_t length)
{
    for(size_t i =0;i<length;i++)
  {
    array[i] = 0;
  }
}
void main()
{
  int a[6] = {4,6,3,6,7,89};
  reset(a,6);
  //@ assert \forall integer i; 0<= i < 6 ==> a[i] == 0;
}

Output:
#include<stddef.h>
/*@
  requires \valid(array +(0 .. length-1));
  assigns array[0..length-1];
  ensures \forall size_t i; 0<= i<length ==>array[i] ==0;
*/
void reset(int* array,size_t length)
{
  /*@
    loop invariant 0<= i<=length;
    loop invariant \forall size_t j; 0<= j<i ==> array[j] ==0;
    loop assigns i,array[0..length-1];
    loop variant length-i;
  */
    for(size_t i =0;i<length;i++)
  {
    array[i] = 0;
  }
}
void main()
{
  int a[6] = {4,6,3,6,7,89};
  reset(a,6);
  //@ assert \forall integer i; 0<= i < 6 ==> a[i] == 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int arraymax(int* a, int n) {
  int i = 1;
  int max = a[0];
  while (i < n) {
    if (max < a[i])
    max = a[i];
    i = i + 1;
  }
  //@ assert \forall integer k;  0 <= k < n ==> max >=  a[k];
  return max;
}

Output:
/*@
    requires \valid_read(a + (0..n-1));
    requires n > 0;
    ensures \forall integer k;  0 <= k < n ==> \result >=  a[k];
    ensures \exists integer k;  0 <= k < n && \result == a[k];
    assigns \nothing;
*/
int arraymax(int* a, int n) {
  int i = 1;
  int max = a[0];
  /*@
     loop invariant \forall integer k;  0 <= k < i ==> max >=  a[k];
     loop invariant \exists integer k;  0 <= k < i &&  max == a[k];
     loop invariant 0 <= i <= n;
     loop assigns i,max;
 */
  while (i < n) {
    if (max < a[i])
    max = a[i];
    i = i + 1;
  }
  //@ assert \forall integer k;  0 <= k < n ==> max >=  a[k];
  return max;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void f(int n, int *p, int *q) {
    if (n > 0) *p = n;
    else *q = n;
}
int main(){
    int n = 10;
    int p = 1,q = 2;
    f(n, &p, &q);
    //@ assert p == 10;
    n = -10;
    f(n, &p, &q);
    //@ assert q == -10;
}

Output:
/*@ behavior p_changed:
    assumes n > 0;
    requires \valid(p);
    assigns *p;
    ensures *p == n;
    behavior q_changed:
    assumes n <= 0;
    requires \valid(q);
    assigns *q;
    ensures *q == n;
*/
void f(int n, int *p, int *q) {
    if (n > 0) *p = n;
    else *q = n;
}
int main(){
    int n = 10;
    int p = 1,q = 2;
    f(n, &p, &q);
    //@ assert p == 10;
    n = -10;
    f(n, &p, &q);
    //@ assert q == -10;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
  requires 0 <= x <= 2;
  requires 0 <= y <= 2;
*/
void foo(int x, int y) {
  int z1;
  int z2;
  int z3;
  while (unknown()) {
    x  = x + 2;
    y  = y + 2;
  }
  if (y == 0) {
    //@ assert x != 4;
  }
}

Output:
/*@
  requires 0 <= x <= 2;
  requires 0 <= y <= 2;
*/
void foo(int x, int y) {
  int z1;
  int z2;
  int z3;
  /*@
  loop invariant y == 0 ==> x != 4;
  loop invariant 0 <= y;
  loop invariant 0 <= x;
  loop assigns x,y;
  */
  while (unknown()) {
    x  = x + 2;
    y  = y + 2;
  }
  if (y == 0) {
    //@ assert x != 4;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(int x, int y) {
  int i = x;
  int j = y;
  while (x != 0) {
    x  = x - 1;
    y  = y - 1;
  }
  if (i == j) {
    //@ assert y == 0;
  }
}

Output:
void foo(int x, int y) {
  int i = x;
  int j = y;
  /*@
  loop invariant y <= j;
  loop invariant x <= i;
  loop invariant j == y + i - x;
  loop invariant j - i == y - x;
  loop invariant i == x + j - y;
  loop invariant i - x == j - y;
  loop invariant \forall integer k; 0 <= k < x ==> j - i - k == (j - i) - k;
  loop assigns x,y,i,j;
  */
  while (x != 0) {
    x  = x - 1;
    y  = y - 1;
  }
  if (i == j) {
    //@ assert y == 0;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int avr(int a, int b)
{
	int avr;
	if (a >= 0 && b >= 0) {
		if (b > a) {
			avr = a + (b - a) / 2;
		} else {
			avr = b + (a - b) / 2;
		}
	} else if (a < 0 && b < 0) {
		if (b > a) {
			avr = b + (a - b) / 2;
		} else {
			avr = a + (b - a) / 2;
		}
	} else {
		avr = (a + b) / 2;
	}
	return avr;
}
int main(){
	int a = 10;
	int b = 20;
	int c = avr(a,b);
	//@ assert c == 15;
}

Output:
/*@ assigns \nothing;
    ensures \result == (a + b) / 2;
 */
int avr(int a, int b)
{
	int avr;
	if (a >= 0 && b >= 0) {
		if (b > a) {
			avr = a + (b - a) / 2;
		} else {
			avr = b + (a - b) / 2;
		}
	} else if (a < 0 && b < 0) {
		if (b > a) {
			avr = b + (a - b) / 2;
		} else {
			avr = a + (b - a) / 2;
		}
	} else {
		avr = (a + b) / 2;
	}
	return avr;
}
int main(){
	int a = 10;
	int b = 20;
	int c = avr(a,b);
	//@ assert c == 15;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
int add(int *a, int *b, int *r) {
    return *a + *b + *r;
}
int main() {
    int a = 24;
    int b = 32;
    int r = 12;
    int x;
    x = add(&a, &b, &r) ;
    //@ assert x == a + b + r;
    //@ assert x == 68 ;
    x = add(&a, &a, &a) ;
    //@ assert x == a + a + a;
    //@ assert x == 72 ;
}

Output:
#include <limits.h>
/*@
    requires \valid_read(a) && \valid_read(b) && \valid_read(r);
    requires *a + *b + *r <= INT_MAX;
    requires *a + *b + *r >= INT_MIN;
    assigns \nothing;
    ensures \result == *a + *b + *r;
*/
int add(int *a, int *b, int *r) {
    return *a + *b + *r;
}
int main() {
    int a = 24;
    int b = 32;
    int r = 12;
    int x;
    x = add(&a, &b, &r) ;
    //@ assert x == a + b + r;
    //@ assert x == 68 ;
    x = add(&a, &a, &a) ;
    //@ assert x == a + a + a;
    //@ assert x == 72 ;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic AllSomeNot
  {
    predicate
    AllEqual(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] == v;
    predicate
    AllEqual(value_type* a, integer m, integer n) =
      AllEqual(a, m, n, a[m]);
    predicate
    AllEqual(value_type* a, integer n, value_type v) =
      AllEqual(a, 0, n, v);
    predicate
    SomeNotEqual{A}(value_type* a, integer m, integer n, value_type v) =
      \exists integer i; m <= i < n && a[i] != v;
    predicate
    SomeNotEqual{A}(value_type* a, integer n, value_type v) =
      SomeNotEqual(a, 0, n, v);
    lemma NotAllEqual_SomeNotEqual:
      \forall value_type *a, v, integer m, n;
        !AllEqual(a, m, n, v)  ==>  SomeNotEqual(a, m, n, v);
    lemma SomeNotEqual_NotAllEqual:
      \forall value_type *a, v, integer m, n;
       SomeNotEqual(a, m, n, v)   ==>  !AllEqual(a, m, n, v);
  }
*/
/*@
  axiomatic HasConstantSubRange
  {
    predicate
    HasConstantSubRange{L}(value_type* a, integer m, integer n, value_type v, integer p) =
      \exists integer k; m <= k <= n-p && AllEqual(a, k, k+p, v);
    predicate
    HasConstantSubRange{L}(value_type* a, integer n, value_type v, integer p) =
      HasConstantSubRange(a, 0, n, v, p);
    lemma HasConstantSubRange_Sizes:
      \forall value_type *a, v, integer n, p;
        HasConstantSubRange(a, n, v, p)  ==>  p <= n;
  }
*/
size_type
search_n(const value_type* a, size_type n, value_type v, size_type p)
{
  if (0u < p) {
    if (p <= n) {
      size_type start = 0u;
      for (size_type i = 0u; i < n; ++i) {
        if (a[i] != v) {
          start = i + 1u;
          //@ assert not_found: !HasConstantSubRange(a, i+1, v, p);
        }
        else {
          //@ assert match: a[i] == v;
          //@ assert match: AllEqual(a, start, i+1, v);
          if (p == i + 1u - start) {
            //@ assert bound: start + p == i + 1;
            //@ assert match: AllEqual(a, start, start+p, v);
            //@ assert match: \exists integer k; 0 <= k <= n-p && AllEqual(a, k, k+p, v);
            //@ assert match: HasConstantSubRange(a, n, v, p);
            return start;
          }
          else {
            //@ assert bound: i + 1 < start + p;
            continue;
          }
        }
        //@ assert not_found: !HasConstantSubRange(a, i+1, v, p);
      }
      //@ assert not_found: !HasConstantSubRange(a, n, v, p);
      return n;
    }
    else {
      //@ assert not_found: n < p;
      //@ assert not_found: !HasConstantSubRange(a, n, v, p);
      return n;
    }
  }
  else {
    //@ assert bound: p == 0;
    //@ assert match: AllEqual(a, 0, 0, v);
    //@ assert match: HasConstantSubRange(a, n, v, 0);
    return 0u;
  }
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic AllSomeNot
  {
    predicate
    AllEqual(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] == v;
    predicate
    AllEqual(value_type* a, integer m, integer n) =
      AllEqual(a, m, n, a[m]);
    predicate
    AllEqual(value_type* a, integer n, value_type v) =
      AllEqual(a, 0, n, v);
    predicate
    SomeNotEqual{A}(value_type* a, integer m, integer n, value_type v) =
      \exists integer i; m <= i < n && a[i] != v;
    predicate
    SomeNotEqual{A}(value_type* a, integer n, value_type v) =
      SomeNotEqual(a, 0, n, v);
    lemma NotAllEqual_SomeNotEqual:
      \forall value_type *a, v, integer m, n;
        !AllEqual(a, m, n, v)  ==>  SomeNotEqual(a, m, n, v);
    lemma SomeNotEqual_NotAllEqual:
      \forall value_type *a, v, integer m, n;
       SomeNotEqual(a, m, n, v)   ==>  !AllEqual(a, m, n, v);
  }
*/
/*@
  axiomatic HasConstantSubRange
  {
    predicate
    HasConstantSubRange{L}(value_type* a, integer m, integer n, value_type v, integer p) =
      \exists integer k; m <= k <= n-p && AllEqual(a, k, k+p, v);
    predicate
    HasConstantSubRange{L}(value_type* a, integer n, value_type v, integer p) =
      HasConstantSubRange(a, 0, n, v, p);
    lemma HasConstantSubRange_Sizes:
      \forall value_type *a, v, integer n, p;
        HasConstantSubRange(a, n, v, p)  ==>  p <= n;
  }
*/
/*@
  requires valid:     \valid_read(a + (0..n-1));
  assigns             \nothing;
  ensures  result:    0 <= \result <= n;
  behavior has_match:
    assumes           HasConstantSubRange(a, n, v, p);
    assigns           \nothing;
    ensures result:   0 <= \result <= n-p;
    ensures match:    AllEqual(a, \result, \result+p, v);
    ensures first:    !HasConstantSubRange(a, \result+p-1, v, p);
  behavior no_match:
    assumes           !HasConstantSubRange(a, n, v, p);
    assigns           \nothing;
    ensures result:   \result == n;
  complete behaviors;
  disjoint behaviors;
*/
size_type
search_n(const value_type* a, size_type n, value_type v, size_type p)
{
  if (0u < p) {
    if (p <= n) {
      size_type start = 0u;
      /*@
        loop invariant match:     AllEqual(a, start, i, v);
        loop invariant start:     0 < start ==> a[start-1] != v;
        loop invariant bound:     start <= i + 1 <= start + p;
        loop invariant not_found: !HasConstantSubRange(a, i, v, p);
        loop assigns i, start;
        loop variant n - i;
      */
      for (size_type i = 0u; i < n; ++i) {
        if (a[i] != v) {
          start = i + 1u;
          //@ assert not_found: !HasConstantSubRange(a, i+1, v, p);
        }
        else {
          //@ assert match: a[i] == v;
          //@ assert match: AllEqual(a, start, i+1, v);
          if (p == i + 1u - start) {
            //@ assert bound: start + p == i + 1;
            //@ assert match: AllEqual(a, start, start+p, v);
            //@ assert match: \exists integer k; 0 <= k <= n-p && AllEqual(a, k, k+p, v);
            //@ assert match: HasConstantSubRange(a, n, v, p);
            return start;
          }
          else {
            //@ assert bound: i + 1 < start + p;
            continue;
          }
        }
        //@ assert not_found: !HasConstantSubRange(a, i+1, v, p);
      }
      //@ assert not_found: !HasConstantSubRange(a, n, v, p);
      return n;
    }
    else {
      //@ assert not_found: n < p;
      //@ assert not_found: !HasConstantSubRange(a, n, v, p);
      return n;
    }
  }
  else {
    //@ assert bound: p == 0;
    //@ assert match: AllEqual(a, 0, 0, v);
    //@ assert match: HasConstantSubRange(a, n, v, 0);
    return 0u;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
int abs(int val) {
    if(val < 0) return -val;
    return val;
}
void foo(int a) {
    int b = abs(-42);
    //@ assert b == 42;
    int c = abs(42);
    //@ assert c == 42;
    int e = abs(INT_MIN);
}

Output:
#include <limits.h>
/*@
    requires INT_MIN <= val < INT_MAX;
    ensures \result >= 0;
    behavior positive:
        assumes val >= 0;
        ensures \result == val;
    behavior negative:
        assumes val < 0;
        ensures \result == -val;
    assigns \nothing;
*/
int abs(int val) {
    if(val < 0) return -val;
    return val;
}
void foo(int a) {
    int b = abs(-42);
    //@ assert b == 42;
    int c = abs(42);
    //@ assert c == 42;
    int e = abs(INT_MIN);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
    int c = 0;
    while (unknown()) {
        if(c == n) {
            c = 1;
        }
        else {
            c = c + 1;
        }
    }
    if(c == n) {
        //@ assert  c >= 0;
        //@ assert  c <= n;
    }
}

Output:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
    int c = 0;
    /*@
    loop invariant c <= n;
    loop invariant 0 <= c;
    loop assigns c;
    */
    while (unknown()) {
        if(c == n) {
            c = 1;
        }
        else {
            c = c + 1;
        }
    }
    if(c == n) {
        //@ assert  c >= 0;
        //@ assert  c <= n;
    }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (n > -1) {
    //@ assert c != n;
  }
}

Output:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant n-c;
  loop invariant n > -1 ==> c != n;
  loop invariant c >= 0 && c <= n+1;
  loop invariant 0 <= c <= n;
  loop invariant c != n;
  loop assigns n,c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (n > -1) {
    //@ assert c != n;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  size:  \result == StackSize(s);
*/
size_type
stack_size(const Stack* s);
bool
stack_size_wd(const Stack* s, const Stack* t)
{
  return stack_size(s) == stack_size(t);
}
int main(){
  value_type a[5] = {1, 2, 3, 4, 5};
  value_type b[5] = {1, 2, 3, 4, 5};
  Stack s1, s2;
  s1.capacity = 5;
  s1.size = 5;
  s1.obj = a;
  s2.capacity = 5;
  s2.size = 5;
  s2.obj = b;
  bool result = stack_size_wd(&s1, &s2);
  //@ assert result == true;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  size:  \result == StackSize(s);
*/
size_type
stack_size(const Stack* s);
/*@
  requires valid:  \valid(s) && StackInvariant(s);
  requires valid:  \valid(t) && StackInvariant(t);
  requires equal:  StackEqual{Here,Here}(s, t);
  assigns          \nothing;
  ensures  equal:  \result == true <==> StackSize(s) == StackSize(t);
  ensures  not_equal: \result == false <==> StackSize(s) != StackSize(t);
*/
bool
stack_size_wd(const Stack* s, const Stack* t)
{
  return stack_size(s) == stack_size(t);
}
int main(){
  value_type a[5] = {1, 2, 3, 4, 5};
  value_type b[5] = {1, 2, 3, 4, 5};
  Stack s1, s2;
  s1.capacity = 5;
  s1.size = 5;
  s1.obj = a;
  s2.capacity = 5;
  s2.size = 5;
  s2.obj = b;
  bool result = stack_size_wd(&s1, &s2);
  //@ assert result == true;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int check(int *a, int *b, int n) {
    for (int i = 0; i < n; i++) {
        if (a[i] != b[i]) {
            return 0;
        }
    }
    return 1;
}
int main() {
    int a[] = {1,2,3,4,5};
    int b[] = {1,2,3,4,5};
    int ans = check(a, b, 5);
    //@ assert ans == 1;
}

Output:
/*@
    requires n > 0;
    requires \valid_read (a + (0..n-1));
    requires \valid_read (b + (0..n-1));
    assigns \nothing;
    behavior equal:
        assumes \forall integer k;  0 <= k < n ==> b[k] == a[k];
        ensures \result == 1;
    behavior not_equal:
        assumes \exists integer k;  0 <= k < n && b[k] != a[k];
        ensures \result == 0;
*/
int check(int *a, int *b, int n) {
    /*@
        loop invariant 0 <= i <= n;
        loop invariant \forall integer k; 0 <= k < i ==> a[k] == b[k];
        loop assigns i;
    */
    for (int i = 0; i < n; i++) {
        if (a[i] != b[i]) {
            return 0;
        }
    }
    return 1;
}
int main() {
    int a[] = {1,2,3,4,5};
    int b[] = {1,2,3,4,5};
    int ans = check(a, b, 5);
    //@ assert ans == 1;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int main() {
  int x = -15000;
  int y = 0;
  while (x < 0) {
    x  = x + y;
    y  = y + 1;
  }
  //@ assert y > 0;
}

Output:
int main() {
  int x = -15000;
  int y = 0;
  /*@
  loop invariant x <= -15000 || 1 <= y;
  loop invariant x <= -15000 || 0 <= y;
  loop invariant x < 0 || 1 <= y;
  loop invariant x < 0 || 0 <= y;
  loop invariant x < 0 || -15000 <= x;
  loop invariant 1 <= y || x <= 0;
  loop invariant 1 <= y || 0 <= y;
  loop invariant 1 <= y || -15000 <= x;
  loop invariant 0 <= y || x <= 0;
  loop invariant 0 <= y || -15000 <= x;
  loop invariant -15000 <= x || x <= 0;
  loop assigns x,y;
  loop invariant 0 <= y;
  loop invariant -15000 <= x;
  */
  while (x < 0) {
    x  = x + y;
    y  = y + 1;
  }
  //@ assert y > 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int unknown();
int main() {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c != 40) {
        c  = c + 1;
      }
    } else {
      if (c == 40) {
        c  = 1;
      }
    }
  }
  if (c != 40) {
    //@ assert c >= 0;
  }
}

Output:
int unknown();
int main() {
  int c = 0;
  /*@
  loop invariant c <= 40;
  loop invariant c != 40 ==> c >= 0;
  loop invariant 0 <= c;
  loop assigns c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c != 40) {
        c  = c + 1;
      }
    } else {
      if (c == 40) {
        c  = 1;
      }
    }
  }
  // post-condition
  if (c != 40) {
    //@ assert c >= 0;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


nabinkrsah_Compute the GCD of two numbers with precondition and postcondition

Input:
#include <stdio.h>
/*@
 axiomatic GCD {
 logic integer Gcd(integer p, integer q);
 axiom Gcd1:
 \forall integer m, n;
 m > n ==> Gcd(m,n) == Gcd(m-n, n);
 axiom Gcd2:
 \forall integer m, n;
 n > m ==> Gcd(m,n) == Gcd(m, n-m);
 axiom Gcd3:
 \forall integer m, n;
 m == n ==> Gcd(m,n) == m;
 }
*/
int gcd(int p, int q) {
while (p != q) {
 if (p > q)
p = p - q;
 if (q > p)
q = q - p;
}
return p;
}
int main() {
 int p = 48;
 int q = 18;
 int result = gcd(p, q);
 //@ assert result == 6;
 return 0;
}

Output:
#include <stdio.h>
/*@
 axiomatic GCD {
 logic integer Gcd(integer p, integer q);
 axiom Gcd1:
 \forall integer m, n;
 m > n ==> Gcd(m,n) == Gcd(m-n, n);
 axiom Gcd2:
 \forall integer m, n;
 n > m ==> Gcd(m,n) == Gcd(m, n-m);
 axiom Gcd3:
 \forall integer m, n;
 m == n ==> Gcd(m,n) == m;
 }
*/
/*@
 requires p >= 1;
 requires p >= 1;
 ensures \result == Gcd(\old(p), \old(q));
 assigns \nothing;
*/
int gcd(int p, int q) {
/*@ loop invariant Gcd(p,q) ==
 Gcd(\at(p,Pre), \at(q,Pre));
 loop assigns p, q;
*/
while (p != q) {
 if (p > q)
p = p - q;
 if (q > p)
q = q - p;
}
return p;
}
int main() {
 int p = 48;
 int q = 18;
 int result = gcd(p, q);
 //@ assert result == 6;
 return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int grade;
int calculateGrade(int mark) {
    if (mark >= 1 && mark <= 100) {
        grade = 1;
        return grade;
    } else if (mark >= 101 && mark <= 200) {
        grade = 2;
        return grade;
    } else if (mark >= 201 && mark <= 300) {
        grade = 3;
        return grade;
    } else if (mark >= 301 && mark <= 400) {
        grade = 4;
        return grade;
    }
    return 0;
}

Output:
int grade;
/*@ requires mark >= 0;
    ensures \result == 0 || \result == 1 || \result == 2 || \result == 3 || \result == 4;
    behavior one:
        assumes mark >= 1 && mark <= 100;
        ensures \result == 1;
        assigns grade;
    behavior two:
        assumes mark >= 101 && mark <= 200;
        ensures \result == 2;
        assigns grade;
    behavior three:
        assumes mark >= 201 && mark <= 300;
        ensures \result == 3;
        assigns grade;
    behavior four:
        assumes mark >= 301 && mark <= 400;
        ensures \result == 4;
        assigns grade;
    behavior else:
        assumes mark <= 0 || mark > 400;
        ensures \result == 0;
        assigns grade;
    complete behaviors;
    disjoint behaviors;
*/
int calculateGrade(int mark) {
    if (mark >= 1 && mark <= 100) {
        grade = 1;
        return grade;
    } else if (mark >= 101 && mark <= 200) {
        grade = 2;
        return grade;
    } else if (mark >= 201 && mark <= 300) {
        grade = 3;
        return grade;
    } else if (mark >= 301 && mark <= 400) {
        grade = 4;
        return grade;
    }
    return 0;
}
int main(){
    int mark = 150;
    int result = calculateGrade(mark);
    //@ assert result == 2;
    return 0;

}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if ( unknown() ) {
      if (c > n) {
        c  = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (c != n) {
    //@ assert c <= n;
  }
}

Output:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant n - c;
  loop invariant c <= n;
  loop invariant c <= n + 1;
  loop invariant 0 <= c;
  loop assigns c;
  */
  while (unknown()) {
    if ( unknown() ) {
      if (c > n) {
        c  = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (c != n) {
    //@ assert c <= n;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int spec_sign(int x)
{
   return (x > 0) - (x < 0);
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int res = spec_sign(-10);
   //@ assert res == -1;
   return 0;
}
#endif

Output:
/*@
   assigns \nothing;
    ensures \result == 0 || \result == 1 || \result == -1;
    behavior positive:
       assumes x > 0;
       ensures \result == 1;
    behavior zero:
       assumes x == 0;
       ensures \result == 0;
    behavior negative:
       assumes x < 0;
       ensures \result == -1;
    complete behaviors;
    disjoint behaviors;
 */
int spec_sign(int x)
{
   return (x > 0) - (x < 0);
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int res = spec_sign(-10);
   //@ assert res == -1;
   return 0;
}
#endif

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <stdint.h>
#include <unistd.h>
#include <string.h>
typedef uint8_t	  u8;
typedef uint16_t u16;
typedef uint32_t u32;
typedef uint64_t u64;
#define X509_FILE_NUM 1
#define X509_FILE_LINE_NUM_ERR ((X509_FILE_NUM * 100000))
static int check_ia5_string(const u8 *buf, u32 len)
{
	int ret;
	u32 i;
	if ((buf == NULL) || (len == 0)) {
		ret = -X509_FILE_LINE_NUM_ERR;
		goto out;
	}
	for (i = 0; i < len; i++) {
		if (buf[i] > 0x7f) {
			ret = -X509_FILE_LINE_NUM_ERR;
			goto out;
		}
	}
	ret = 0;
out:
	return ret;
}
int main() {
	u8 buf[5];
	u32 len = 5;
	int ret = check_ia5_string(&buf[0], len);
	//@ assert ret == -X509_FILE_LINE_NUM_ERR ==> \exists integer i; 0 <= i < len && buf[i] > 0x7f;
	//@ assert ret == 0 ==> \forall integer i; 0 <= i < len ==> (buf[i] <= 0x7f);
	return ret;
}

Output:
#include <stdint.h>
#include <unistd.h>
#include <string.h>
typedef uint8_t	  u8;
typedef uint16_t u16;
typedef uint32_t u32;
typedef uint64_t u64;
#define X509_FILE_NUM 1
#define X509_FILE_LINE_NUM_ERR ((X509_FILE_NUM * 100000))
/*@
  requires buf != NULL && len > 0;
  requires ((len > 0) && (buf != \null)) ==> \valid_read(buf + (0 .. (len - 1)));
  ensures \result < 0 || \result == 0;
  ensures (len == 0) ==> \result < 0;
  ensures (buf == \null) ==> \result < 0;
  ensures \result == 0 ==> \forall integer i; 0 <= i < len ==> (buf[i] <= 0x7f);
  ensures \result == -X509_FILE_LINE_NUM_ERR ==> \exists integer i; 0 <= i < len && buf[i] > 0x7f;
  ensures \exists integer i; 0 <= i < len && buf[i] > 0x7f ==> \result == -X509_FILE_LINE_NUM_ERR;
  assigns \nothing;
*/
static int check_ia5_string(const u8 *buf, u32 len)
{
	int ret;
	u32 i;
	if ((buf == NULL) || (len == 0)) {
		ret = -X509_FILE_LINE_NUM_ERR;
		goto out;
	}
	/*@
	  loop invariant \forall integer x ; 0 <= x < i ==> (buf[x] <= 0x7f);
	  loop invariant ret ==0 ==> \forall integer x ; 0 <= x < i ==> (buf[x] <= 0x7f);
	  loop assigns i;
	  loop variant (len - i);
	*/
	for (i = 0; i < len; i++) {
		if (buf[i] > 0x7f) {
			ret = -X509_FILE_LINE_NUM_ERR;
			goto out;
		}
	}
	ret = 0;
out:
	return ret;
}
int main() {
	u8 buf[5];
	u32 len = 5;
	int ret = check_ia5_string(&buf[0], len);
	//@ assert ret == -X509_FILE_LINE_NUM_ERR ==> \exists integer i; 0 <= i < len && buf[i] > 0x7f;
	//@ assert ret == 0 ==> \forall integer i; 0 <= i < len ==> (buf[i] <= 0x7f);
	return ret;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires size >= 1;
*/
void foo(int size) {
  int i = 1;
  int sn = 0;
  while (i <= size) {
    i = i + 1;
    sn = sn + 1;
  }
  if(sn != size) {
    //@ assert sn == 0;
  }
}

Output:
/*@
requires size >= 1;
*/
void foo(int size) {
  int i = 1;
  int sn = 0;
  /*@
  loop invariant sn == i-1;
  loop invariant sn == i - 1;
  loop invariant i <= size+1;
  loop invariant i <= size + 1;
  loop invariant 1 <= i;
  loop assigns sn;
  loop assigns i;
  */
  while (i <= size) {
    i = i + 1;
    sn = sn + 1;
  }
  if(sn != size) {
    //@ assert sn == 0;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
int max ( int x, int y ) {
    if ( x >=y )
        return x ;
    return y ;
}
void foo()
{
    int s = max(34,45);
    //@ assert s==45;
    int t = max(-43,34);
    //@ assert t==34;
}

Output:
#include <limits.h>
/*@
requires INT_MIN<x && INT_MIN<y;
ensures \result>=x && \result>=y;
ensures \result==x || \result==y;
*/
int max ( int x, int y ) {
    if ( x >=y )
        return x ;
    return y ;
}
void foo()
{
    int s = max(34,45);
    //@ assert s==45;
    int t = max(-43,34);
    //@ assert t==34;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <stdint.h>
#include <unistd.h>
#include <string.h>
typedef uint8_t	  u8;
typedef uint16_t u16;
typedef uint32_t u32;
typedef uint64_t u64;
#define X509_FILE_NUM 0
#define X509_FILE_LINE_NUM_ERR ((X509_FILE_NUM * 100000) + __LINE__)
/*@
  predicate bmatch(u8 *b1, u8 *b2, u32 n) =
    \forall integer i; 0 <= i < n ==> b1[i] == b2[i];

  predicate bdiffer(u8 *b1, u8 *b2, u32 n) =
    ! bmatch(b1, b2, n);
*/
/*@
  requires \valid_read(b1 + (0 .. n-1));
  requires \valid_read(b2 + (0 .. n-1));
  requires n >= 0;
  ensures \result == 0 <==> bmatch(b1, b2, n);
  ensures \result == 1 <==> bdiffer(b1, b2, n);
  assigns \nothing;
*/
int bufs_differ(const u8 *b1, const u8 *b2, u32 n)
{
	int ret = 0;
	u32 i = 0;
	/*@
	  loop invariant 0 <= i <= n;
	  loop invariant bmatch(b1, b2, i);
	  loop assigns i;
	  loop variant n - i;
	*/
	for (i = 0; i < n; i++) {
		if(b1[i] != b2[i]) {
			ret = 1;
			break;
		}
	}
	return ret;
}
static const u8 null_encoded_val[] = { 0x05, 0x00 };
int parse_null(const u8 *buf, u32 len, u32 *parsed)
{
	int ret;
	if ((len == 0) || (buf == NULL) || (parsed == NULL)) {
		ret = -X509_FILE_LINE_NUM_ERR;
		goto out;
	}
	if (len != sizeof(null_encoded_val)) {
		ret = -X509_FILE_LINE_NUM_ERR;
		goto out;
	}
	ret = bufs_differ(buf, null_encoded_val, sizeof(null_encoded_val));
	if (ret) {
		ret = -X509_FILE_LINE_NUM_ERR;
		goto out;
	}
	ret = 0;
	*parsed = sizeof(null_encoded_val);
out:
	return ret;
}
int main() {
  const u8 b[] = { 0x05, 0x00 };
  u32 parsed;
  int ret = parse_null(b, sizeof(null_encoded_val), &parsed);
  //@ assert parsed == sizeof(null_encoded_val);
  //@ assert ret == 0;
  return 0;
}

Output:
#include <stdint.h>
#include <unistd.h>
#include <string.h>
typedef uint8_t	  u8;
typedef uint16_t u16;
typedef uint32_t u32;
typedef uint64_t u64;
#define X509_FILE_NUM 0
#define X509_FILE_LINE_NUM_ERR ((X509_FILE_NUM * 100000) + __LINE__)
/*@
  predicate bmatch(u8 *b1, u8 *b2, u32 n) =
    \forall integer i; 0 <= i < n ==> b1[i] == b2[i];

  predicate bdiffer(u8 *b1, u8 *b2, u32 n) =
    ! bmatch(b1, b2, n);
*/
/*@
  requires \valid_read(b1 + (0 .. n-1));
  requires \valid_read(b2 + (0 .. n-1));
  requires n >= 0;
  ensures \result == 0 <==> bmatch(b1, b2, n);
  ensures \result == 1 <==> bdiffer(b1, b2, n);
  assigns \nothing;
*/
int bufs_differ(const u8 *b1, const u8 *b2, u32 n)
{
	int ret = 0;
	u32 i = 0;
	/*@
	  loop invariant 0 <= i <= n;
	  loop invariant bmatch(b1, b2, i);
	  loop assigns i;
	  loop variant n - i;
	*/
	for (i = 0; i < n; i++) {
		if(b1[i] != b2[i]) {
			ret = 1;
			break;
		}
	}
	return ret;
}
static const u8 null_encoded_val[] = { 0x05, 0x00 };
/*@
  requires ((len > 0) && (buf != \null)) ==> \valid_read(buf + (0 .. (len - 1)));
  requires (parsed != NULL) ==> \valid(parsed);
  requires \separated(parsed, buf+(..));
  ensures \result < 0 || \result == 0;
  ensures (len == sizeof(null_encoded_val) && len != 0 && buf != NULL && parsed != NULL) ==> (\result == 0 <==> bmatch(buf, &null_encoded_val[0], len));
  ensures (\result == 0) ==> *parsed == 2;
  ensures (buf == \null) ==> \result < 0;
  assigns *parsed;
*/
int parse_null(const u8 *buf, u32 len, u32 *parsed)
{
	int ret;
	if ((len == 0) || (buf == NULL) || (parsed == NULL)) {
		ret = -X509_FILE_LINE_NUM_ERR;
		goto out;
	}
	if (len != sizeof(null_encoded_val)) {
		ret = -X509_FILE_LINE_NUM_ERR;
		goto out;
	}
	ret = bufs_differ(buf, null_encoded_val, sizeof(null_encoded_val));
	if (ret) {
		ret = -X509_FILE_LINE_NUM_ERR;
		goto out;
	}
	ret = 0;
	*parsed = sizeof(null_encoded_val);
out:
	return ret;
}
int main() {
  const u8 b[] = { 0x05, 0x00 };
  u32 parsed;
  int ret = parse_null(b, sizeof(null_encoded_val), &parsed);
  //@ assert parsed == sizeof(null_encoded_val);
  //@ assert ret == 0;
  return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires x >= 0;
requires y >= 0;
requires x >= y;
*/
void foo(int x, int y) {
  int i = 0;
  while (unknown()) {
    if ( (i < y) )
    {
    (i  = (i + 1));
    }
  }
  if (i < y) {
    //@ assert 0 <= i;
  }
}

Output:
/*@
requires x >= 0;
requires y >= 0;
requires x >= y;
*/
void foo(int x, int y) {
  int i = 0;
  /*@
  loop invariant i <= y;
  loop invariant 0 <= i;
  loop assigns y,i;
  */
  while (unknown()) {
    if ( (i < y) )
    {
    (i  = (i + 1));
    }
  }
  if (i < y) {
    //@ assert 0 <= i;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void order_3(int* a, int* b, int* c){
    if(*a > *b){
        int tmp = *b ; *b = *a ; *a = tmp ;
    }
    if(*a > *c){
        int tmp = *c ; *c = *a ; *a = tmp ;
    }
    if(*b > *c){
        int tmp = *b ; *b = *c ; *c = tmp ;
  }
}
void test(){
    int a1 = 5, b1 = 3, c1 = 4 ;
    order_3(&a1, &b1, &c1);
    //@ assert a1 == 3 && b1 == 4 && c1 == 5 ;
    int a2 = 2, b2 = 2, c2 = 2 ;
    order_3(&a2, &b2, &c2) ;
    //@ assert a2 == 2 && b2 == 2 && c2 == 2 ;
    int a3 = 4, b3 = 3, c3 = 4 ;
    order_3(&a3, &b3, &c3) ;
    //@ assert a3 == 3 && b3 == 4 && c3 == 4 ;
    int a4 = 4, b4 = 5, c4 = 4 ;
    order_3(&a4, &b4, &c4) ;
    //@ assert a4 == 4 && b4 == 4 && c4 == 5 ;
}

Output:
/*@
    requires \valid(a) && \valid(b) && \valid(c);
    requires \separated(a, b, c);
    assigns *a, *b, *c;
    ensures sorted: *a <= *b <= *c ;
    ensures has_all_values: { *a, *b, *c } == \old({ *a, *b, *c }) ;
    ensures \old(*a == *b == *c) ==> *a == *b == *c ;
    ensures \old(*a == *b < *c || *a == *c < *b || *b == *c < *a) ==> *a == *b ;
    ensures \old(*a == *b > *c || *a == *c > *b || *b == *c > *a) ==> *b == *c ;
*/
void order_3(int* a, int* b, int* c){
    if(*a > *b){
        int tmp = *b ; *b = *a ; *a = tmp ;
    }
    if(*a > *c){
        int tmp = *c ; *c = *a ; *a = tmp ;
    }
    if(*b > *c){
        int tmp = *b ; *b = *c ; *c = tmp ;
  }
}
void test(){
    int a1 = 5, b1 = 3, c1 = 4 ;
    order_3(&a1, &b1, &c1);
    //@ assert a1 == 3 && b1 == 4 && c1 == 5 ;
    int a2 = 2, b2 = 2, c2 = 2 ;
    order_3(&a2, &b2, &c2) ;
    //@ assert a2 == 2 && b2 == 2 && c2 == 2 ;
    int a3 = 4, b3 = 3, c3 = 4 ;
    order_3(&a3, &b3, &c3) ;
    //@ assert a3 == 3 && b3 == 4 && c3 == 4 ;
    int a4 = 4, b4 = 5, c4 = 4 ;
    order_3(&a4, &b4, &c4) ;
    //@ assert a4 == 4 && b4 == 4 && c4 == 5 ;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
 void swap(int* a, int* b){
 int tmp = *a;
 *a = *b;
 *b = tmp;
 }
 int main(){
 int a = 42;
 int b = 37;
 swap(&a, &b);
 //@ assert a == 37 && b == 42;
 return 0;
 }

Output:
 /*@
 requires \valid(a) && \valid(b);
 assigns *a, *b;
 ensures *a == \old(*b);
 ensures *b == \old(*a);
 */
 void swap(int* a, int* b){
 int tmp = *a;
 *a = *b;
 *b = tmp;
 }
 int main(){
 int a = 42;
 int b = 37;
 swap(&a, &b);
 //@ assert a == 37 && b == 42;
 return 0;
 }

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic UnchangedLemmas
  {
    lemma Unchanged_Shrink{K,L}:
      \forall value_type *a, integer m, n, p, q;
         m <= p <= q <= n         ==>
         Unchanged{K,L}(a, m, n)  ==>
         Unchanged{K,L}(a, p, q);
    lemma Unchanged_Extend{K,L}:
      \forall value_type *a, integer n;
        Unchanged{K,L}(a, n)        ==>
        \at(a[n],K) == \at(a[n],L)  ==>
        Unchanged{K,L}(a, n+1);
    lemma Unchanged_Symmetric{K,L}:
      \forall value_type *a, integer m, n;
        Unchanged{K,L}(a, m, n)  ==>
        Unchanged{L,K}(a, m, n);
    lemma Unchanged_Transitive{K,L,M}:
      \forall value_type *a, integer m, n;
        Unchanged{K,L}(a, m, n)  ==>
        Unchanged{L,M}(a, m, n)  ==>
        Unchanged{K,M}(a, m, n);
  }
*/
/*@
  axiomatic Count
  {
    logic integer
    Count(value_type* a, integer m, integer n, value_type v) =
      n <= m ? 0 : Count(a, m, n-1, v) + (a[n-1] == v ? 1 : 0);
    logic integer
    Count(value_type* a, integer n, value_type v) = Count(a, 0, n, v);
    lemma Count_Empty:
      \forall value_type *a, v, integer m, n;
        n <= m  ==>  Count(a, m, n, v) == 0;
    lemma Count_Hit:
      \forall value_type *a, v, integer n, m;
        m < n        ==>
        a[n-1] == v  ==>
        Count(a, m, n, v) == Count(a, m, n-1, v) + 1;
    lemma Count_Miss:
      \forall value_type *a, v, integer n, m;
        m < n        ==>
        a[n-1] != v  ==>
        Count(a, m, n, v) == Count(a, m, n-1, v);
    lemma Count_One:
      \forall value_type *a, v, integer m, n;
        m <= n  ==>  Count(a, m, n+1, v) == Count(a, m, n, v) + Count(a, n, n+1, v);
    lemma Count_Single{K,L}:
      \forall value_type *a, *b, v, integer m, n;
        \at(a[m],K) == \at(b[n],L)  ==>
        Count{K}(a, m, m+1, v) == Count{L}(b, n, n+1, v);
    lemma Count_Single_Bounds:
      \forall value_type *a, v, integer n;
        0 <= Count(a, n, n+1, v) <= 1;
    lemma Count_Single_Shift:
      \forall value_type *a, v, integer n;
        0 <= n  ==>  Count(a+n, 0, 1, v) == Count(a, n, n+1, v);
  }
*/
size_type
count(const value_type* a, size_type n, value_type v)
{
  size_type counted = 0u;
  for (size_type i = 0u; i < n; ++i) {
    if (a[i] == v) {
      counted++;
    }
  }
  //@ assert Count(a, n, v) == counted;
  return counted;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic UnchangedLemmas
  {
    lemma Unchanged_Shrink{K,L}:
      \forall value_type *a, integer m, n, p, q;
         m <= p <= q <= n         ==>
         Unchanged{K,L}(a, m, n)  ==>
         Unchanged{K,L}(a, p, q);
    lemma Unchanged_Extend{K,L}:
      \forall value_type *a, integer n;
        Unchanged{K,L}(a, n)        ==>
        \at(a[n],K) == \at(a[n],L)  ==>
        Unchanged{K,L}(a, n+1);
    lemma Unchanged_Symmetric{K,L}:
      \forall value_type *a, integer m, n;
        Unchanged{K,L}(a, m, n)  ==>
        Unchanged{L,K}(a, m, n);
    lemma Unchanged_Transitive{K,L,M}:
      \forall value_type *a, integer m, n;
        Unchanged{K,L}(a, m, n)  ==>
        Unchanged{L,M}(a, m, n)  ==>
        Unchanged{K,M}(a, m, n);
  }
*/
/*@
  axiomatic Count
  {
    logic integer
    Count(value_type* a, integer m, integer n, value_type v) =
      n <= m ? 0 : Count(a, m, n-1, v) + (a[n-1] == v ? 1 : 0);
    logic integer
    Count(value_type* a, integer n, value_type v) = Count(a, 0, n, v);
    lemma Count_Empty:
      \forall value_type *a, v, integer m, n;
        n <= m  ==>  Count(a, m, n, v) == 0;
    lemma Count_Hit:
      \forall value_type *a, v, integer n, m;
        m < n        ==>
        a[n-1] == v  ==>
        Count(a, m, n, v) == Count(a, m, n-1, v) + 1;
    lemma Count_Miss:
      \forall value_type *a, v, integer n, m;
        m < n        ==>
        a[n-1] != v  ==>
        Count(a, m, n, v) == Count(a, m, n-1, v);
    lemma Count_One:
      \forall value_type *a, v, integer m, n;
        m <= n  ==>  Count(a, m, n+1, v) == Count(a, m, n, v) + Count(a, n, n+1, v);
    lemma Count_Single{K,L}:
      \forall value_type *a, *b, v, integer m, n;
        \at(a[m],K) == \at(b[n],L)  ==>
        Count{K}(a, m, m+1, v) == Count{L}(b, n, n+1, v);
    lemma Count_Single_Bounds:
      \forall value_type *a, v, integer n;
        0 <= Count(a, n, n+1, v) <= 1;
    lemma Count_Single_Shift:
      \forall value_type *a, v, integer n;
        0 <= n  ==>  Count(a+n, 0, 1, v) == Count(a, n, n+1, v);
  }
*/
/*@
  requires valid: \valid_read(a + (0..n-1));
  assigns         \nothing;
  ensures bound:  0 <= \result <= n;
  ensures count:  \result == Count(a, n, v);
*/
size_type
count(const value_type* a, size_type n, value_type v)
{
  size_type counted = 0u;
  /*@
    loop invariant bound: 0 <= i <= n;
    loop invariant bound: 0 <= counted <= i;
    loop invariant count: counted == Count(a, i, v);
    loop assigns i, counted;
    loop variant n-i;
  */
  for (size_type i = 0u; i < n; ++i) {
    if (a[i] == v) {
      counted++;
    }
  }
  //@ assert Count(a, n, v) == counted;
  return counted;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(int x, int y) {
  int lock = 1;
  while ((x != y)) {
      if (unknown()) {
        lock  = 1;
        x = y;
      } else {
        lock = 0;
        x = y;
        y = y + 1;
      }
  }
  //@ assert lock == 1;
}

Output:
/*@
requires x == y;
*/
void foo(int x, int y) {
  int lock = 1;
  /*@
  loop invariant x == y;
  loop invariant lock == 1;
  loop invariant lock == 1 || lock == 0;
  loop invariant lock == 0 || lock == 1;
  loop assigns y;
  loop assigns x;
  loop assigns lock;
  */
  while ((x != y)) {
      if (unknown()) {
        lock  = 1;
        x = y;
      } else {
        lock = 0;
        x = y;
        y = y + 1;
      }
  }
  //@ assert lock == 1;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (c < 0) {
    if (c > n) {
      //@ assert c == n;
    }
  }
}

Output:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant n - c;
  loop invariant c >= 0 && c <= n;
  loop invariant c > n ==> c == n;
  loop invariant c > n ==> c == n + 1;
  loop invariant c <= n;
  loop invariant \forall integer k; 1 <= k <= c ==> (\exists integer i; 1 <= i <= n && i == c);
  loop invariant 0 <= c;
  loop assigns n,c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (c < 0) {
    if (c > n) {
      //@ assert c == n;
    }
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int fun(int x, int y , int *r) {
    *r = x;
    int d = 0;
    while (*r >= y) {
        *r = *r - y;
        d = d + 1;
    }
    return d;
}
int main() {
    int a = 3;
    int num = fun(1, 2, &a);
    //@ assert a == 1;
    //@ assert num == 0;
    return 0;
}

Output:
/*@
    requires x ==1 && y==2;
    ensures *r < y;
    ensures \result == 0 <==> x < y;
    ensures x == \result*y + *r;
    ensures \result ==0 ==> x == *r;
*/
int fun(int x, int y , int *r) {
    *r = x;
    int d = 0;
    /*@
        loop invariant d >= 0;
        loop invariant *r <= x;
        loop invariant *r < y ==> d == 0;
        loop invariant *r == x - y*d;
        loop assigns *r, d;
    */
    while (*r >= y) {
        *r = *r - y;
        d = d + 1;
    }
    return d;
}
int main() {
    int a = 3;
    int num = fun(1, 2, &a);
    //@ assert a == 1;
    //@ assert num == 0;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<limits.h>
int check(int n){
if(n%3==0)
return 1;
else
return 0;
}
int main(){
int a=9;
int r=check(a);
//@assert a==9;
}

Output:
#include<limits.h>
/*@
requires INT_MIN<=n;
requires INT_MAX>n;
ensures (n%3==0 ==> \result==1) && (n%3!=0 ==> \result==0);
*/
int check(int n){
if(n%3==0)
return 1;
else
return 0;
}
int main(){
int a=9;
int r=check(a);
//@assert a==9;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(int x2, int x3) {
    int d1 = 1;
    int d2 = 1;
    int d3 = 1;
    int x1 = 1;
    while(x1 > 0) {
        if(x2 > 0) {
            if(x3 > 0) {
                x1 = x1 - d1;
                x2 = x2 - d2;
                x3 = x3 - d3;
            }
        }
    }
    //@ assert x2 >= 0;
}

Output:
void foo(int x2, int x3) {
    int d1 = 1;
    int d2 = 1;
    int d3 = 1;
    int x1 = 1;
    /*@
    loop invariant x1 > 0 || (x2 >= 0 && x3 >= 0);
    loop invariant x1 > 0 ==> (x2 > 0 ==> x3 > 0 ==> x1 - d1 >= 0 && x2 - d2 >= 0 && x3 - d3 >= 0);
    loop invariant x1 > 0 ==> (x2 > 0 ==> x3 > 0 ==> x1 - d1 < x1 && x2 - d2 < x2 && x3 - d3 < x3);
    loop invariant d3 == 1;
    loop invariant d2 == 1;
    loop invariant d1 == 1;
    loop invariant 0 <= x1;
    loop invariant (x2 > 0 && x3 > 0) || (x2 <= 0 || x3 <= 0);
    loop assigns x1,x2,x3,d1,d2,d3;
    */
    while(x1 > 0) {
        if(x2 > 0) {
            if(x3 > 0) {
                x1 = x1 - d1;
                x2 = x2 - d2;
                x3 = x3 - d3;
            }
        }
    }
    //@ assert x2 >= 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic SomeNone
  {
    predicate
    SomeEqual{A}(value_type* a, integer m, integer n, value_type v) =
      \exists integer i; m <= i < n && a[i] == v;
    predicate
    SomeEqual{A}(value_type* a, integer n, value_type v) =
      SomeEqual(a, 0, n, v);
    predicate
    NoneEqual(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] != v;
    predicate
    NoneEqual(value_type* a, integer n, value_type v) =
      NoneEqual(a, 0, n, v);
    lemma NotSomeEqual_NoneEqual:
      \forall value_type *a, v, integer m, n;
        !SomeEqual(a, m, n, v)  ==>  NoneEqual(a, m, n, v);
    lemma NoneEqual_NotSomeEqual:
      \forall value_type *a, v, integer m, n;
       NoneEqual(a, m, n, v)   ==>  !SomeEqual(a, m, n, v);
  }
*/
size_type
remove_copy(const value_type *a, size_type n, value_type *b, value_type v)
{
  size_type k = 0u;
  for (size_type i = 0u; i < n; ++i) {
    if (a[i] != v) {
      b[k++] = a[i];
    }
  }
  //@ assert NoneEqual(b, k, v);
  return k;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic SomeNone
  {
    predicate
    SomeEqual{A}(value_type* a, integer m, integer n, value_type v) =
      \exists integer i; m <= i < n && a[i] == v;
    predicate
    SomeEqual{A}(value_type* a, integer n, value_type v) =
      SomeEqual(a, 0, n, v);
    predicate
    NoneEqual(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] != v;
    predicate
    NoneEqual(value_type* a, integer n, value_type v) =
      NoneEqual(a, 0, n, v);
    lemma NotSomeEqual_NoneEqual:
      \forall value_type *a, v, integer m, n;
        !SomeEqual(a, m, n, v)  ==>  NoneEqual(a, m, n, v);
    lemma NoneEqual_NotSomeEqual:
      \forall value_type *a, v, integer m, n;
       NoneEqual(a, m, n, v)   ==>  !SomeEqual(a, m, n, v);
  }
*/
/*@
  requires valid:    \valid_read(a + (0..n-1));
  requires valid:    \valid(b + (0..n-1));
  requires sep:      \separated(a + (0..n-1), b + (0..n-1));
  assigns            b[0..n-1];
  ensures bound:     0 <= \result <= n;
  ensures discard:   NoneEqual(b, \result, v);
  ensures unchanged: Unchanged{Old,Here}(a, n);
  ensures unchanged: Unchanged{Old,Here}(b, \result, n);
*/
size_type
remove_copy(const value_type *a, size_type n, value_type *b, value_type v)
{
  size_type k = 0u;
  /*@
    loop invariant bound:     0 <= k <= i <= n;
    loop invariant discard:   NoneEqual(b, k, v);
    loop invariant unchanged: Unchanged{Pre,Here}(b, k, n);
    loop assigns   k, i, b[0..n-1];
    loop variant   n-i;
  */
  for (size_type i = 0u; i < n; ++i) {
    if (a[i] != v) {
      b[k++] = a[i];
    }
  }
  //@ assert NoneEqual(b, k, v);
  return k;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires 1 <= n;
*/
void foo(int n) {
  int i = 1;
  int sn = 0;
  while (i <= n) {
    i = i + 1;
    sn = sn + 1;
  }
  if (sn != 0) {
    //@ assert sn == n;
  }
}

Output:
/*@
requires 1 <= n;
*/
void foo(int n) {
  int i = 1;
  int sn = 0;
  /*@
  loop invariant sn == i-1;
  loop invariant sn == i - 1;
  loop invariant i <= n+1;
  loop invariant i <= n + 1;
  loop invariant 1 <= i;
  loop assigns sn;
  loop assigns i;
  */
  while (i <= n) {
    i = i + 1;
    sn = sn + 1;
  }
  if (sn != 0) {
    //@ assert sn == n;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n) {
    int c = 0;
    while (unknown()) {
        if(c == n) {
            c = 1;
        }
        else {
            c = c + 1;
        }
    }
    if(c == n) {
        //@ assert  c >= 0;
        //@ assert  c <= n;
    }
}

Output:
/*@
requires n > 0;
*/
void foo(int n) {
    int c = 0;
    /*@
    loop invariant c <= n;
    loop invariant 0 <= c;
    loop invariant (c == n) ==> (c >= 0 && c <= n);
    loop assigns c;
    */
    while (unknown()) {
        if(c == n) {
            c = 1;
        }
        else {
            c = c + 1;
        }
    }
    if(c == n) {
        //@ assert  c >= 0;
        //@ assert  c <= n;
    }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#define SPEC_INT_MIN -2147483648
#define SPEC_INT_MAX 2147483647
unsigned distance_abs(int a, int b)
{
   unsigned ua = a < 0 ? -a : a;
   unsigned ub = b < 0 ? -b : b;
   return ua > ub ? ua - ub : ub - ua;
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a = distance_abs(3, 30);
   int b = distance_abs(-5, -20);
   int c = distance_abs(7, -10);
   int d = distance_abs(-2, 15);
   //@ assert a == 27;
   //@ assert b == 15;
   //@ assert c == 17;
   //@ assert d == 17;
   return 0;
}
#endif

Output:
#define SPEC_INT_MIN -2147483648
#define SPEC_INT_MAX 2147483647
/*@ requires \true;
    requires a > SPEC_INT_MIN;
    requires b > SPEC_INT_MIN;
    assigns \nothing;
    ensures \result == \abs(\abs(a) - \abs(b));
 */
unsigned distance_abs(int a, int b)
{
   unsigned ua = a < 0 ? -a : a;
   unsigned ub = b < 0 ? -b : b;
   return ua > ub ? ua - ub : ub - ua;
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a = distance_abs(3, 30);
   int b = distance_abs(-5, -20);
   int c = distance_abs(7, -10);
   int d = distance_abs(-2, 15);
   //@ assert a == 27;
   //@ assert b == 15;
   //@ assert c == 17;
   //@ assert d == 17;
   return 0;
}
#endif

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
int equ(int a[], int b[], int n)
{
    for (int i = 0; i < n; i++)
    {
        if (a[i] != b[i])
        {
            return 0;
        }
    }
    return 1;
}
int main(){
    int a[10]={1,2,3,4,5,6,7,8,9,10};
    int b[10]={1,2,3,4,5,6,7,8,9,10};
    int c[10]={1,2,3,4,5,6,7,8,9,11};

    int res=equ(a,b,10);
    int res1=equ(a,c,10);
    //@ assert res==1;
    //@ assert res1==0;
}

Output:
#include <limits.h>
/*@
requires n>0 && n<INT_MAX;
requires \valid_read(a+(0..n-1));
requires \valid_read(b+(0..n-1));
assigns \nothing;
behavior same:
    assumes \forall integer j;0<=j<n ==> a[j]==b[j];
    ensures \result==1;
behavior notones:
    assumes \exists integer j;0<=j<n && a[j]!=b[j];
    ensures \result==0;
complete behaviors;
disjoint behaviors;
*/
int equ(int a[], int b[], int n)
{
    /*@
    loop invariant 0<=i<=n;
    loop invariant \forall integer j;0<=j<i ==> a[j]==b[j];
    loop assigns i;
    loop variant n-i;
    */
    for (int i = 0; i < n; i++)
    {
        if (a[i] != b[i])
        {
            return 0;
        }
    }
    return 1;
}
int main(){
    int a[10]={1,2,3,4,5,6,7,8,9,10};
    int b[10]={1,2,3,4,5,6,7,8,9,10};
    int c[10]={1,2,3,4,5,6,7,8,9,11};

    int res=equ(a,b,10);
    int res1=equ(a,c,10);
    //@ assert res==1;
    //@ assert res1==0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int main(){
    int x = 0;
    int y = 0;
    while(y >= 0){
        y = y + x;
    }
    //@ assert  y >= 0;
}

Output:
int main(){
    int x = 0;
    int y = 0;
    /*@
    loop invariant 0 <= y;
    loop invariant 0 <= x;
    loop assigns y;
    loop assigns x;
    */
    while(y >= 0){
        y = y + x;
    }
    //@ assert  y >= 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <stdint.h>
#include <unistd.h>
#include <string.h>
typedef uint8_t	  u8;
typedef uint16_t u16;
typedef uint32_t u32;
typedef uint64_t u64;
u64 time_components_to_comparable_u64(u16 na_year, u8 na_month, u8 na_day,
				      u8 na_hour, u8 na_min, u8 na_sec)
{
	u64 res, tmp;
	res = ((u64)na_sec);
	/*@ assert res < (1ULL << 6); */
	tmp = ((u64)na_min) * (1ULL << 8);
	/*@ assert tmp < (1ULL << 14); */
	res += tmp;
	/*@ assert res < (1ULL << 15); */
	tmp = (((u64)na_hour) * (1ULL << 16));
	/*@ assert tmp < (1ULL << 21); */
	res += tmp;
	/*@ assert res < (1ULL << 22); */
	tmp = ((u64)na_day) * (1ULL << 24);
	/*@ assert tmp < (1ULL << 29); */
	res += tmp;
	/*@ assert res < (1ULL << 30); */
	tmp = ((u64)na_month) * (1ULL << 32);
	/*@ assert tmp < (1ULL << 36); */
	res += tmp;
	/*@ assert res < (1ULL << 37); */
	tmp = ((u64)na_year) * (1ULL << 40);
	/*@ assert tmp < (1ULL << 54); */
	res += tmp;
	/*@ assert res < (1ULL << 55); */
	return res;
}
int main(void)
{
	u16 na_year = 2023;
	u8 na_month = 12;
	u8 na_day = 20;
	u8 na_hour = 12;
	u8 na_min = 00;
	u8 na_sec = 00;
	u64 res;
	res = time_components_to_comparable_u64(na_year, na_month, na_day, na_hour, na_min, na_sec);
	//@ assert res < (1ULL << 55);
	return 0;
}

Output:
#include <stdint.h>
#include <unistd.h>
#include <string.h>
typedef uint8_t	  u8;
typedef uint16_t u16;
typedef uint32_t u32;
typedef uint64_t u64;
/*@
  requires na_year <= 9999;
  requires na_month <= 12;
  requires na_day <= 31;
  requires na_hour <= 23;
  requires na_min <= 59;
  requires na_sec <= 59;
  ensures \result < (1ULL << 55);
  assigns \nothing;
*/
u64 time_components_to_comparable_u64(u16 na_year, u8 na_month, u8 na_day,
				      u8 na_hour, u8 na_min, u8 na_sec)
{
	u64 res, tmp;
	res = ((u64)na_sec);
	/*@ assert res < (1ULL << 6); */
	tmp = ((u64)na_min) * (1ULL << 8);
	/*@ assert tmp < (1ULL << 14); */
	res += tmp;
	/*@ assert res < (1ULL << 15); */
	tmp = (((u64)na_hour) * (1ULL << 16));
	/*@ assert tmp < (1ULL << 21); */
	res += tmp;
	/*@ assert res < (1ULL << 22); */
	tmp = ((u64)na_day) * (1ULL << 24);
	/*@ assert tmp < (1ULL << 29); */
	res += tmp;
	/*@ assert res < (1ULL << 30); */
	tmp = ((u64)na_month) * (1ULL << 32);
	/*@ assert tmp < (1ULL << 36); */
	res += tmp;
	/*@ assert res < (1ULL << 37); */
	tmp = ((u64)na_year) * (1ULL << 40);
	/*@ assert tmp < (1ULL << 54); */
	res += tmp;
	/*@ assert res < (1ULL << 55); */
	return res;
}
int main(void)
{
	u16 na_year = 2023;
	u8 na_month = 12;
	u8 na_day = 20;
	u8 na_hour = 12;
	u8 na_min = 00;
	u8 na_sec = 00;
	u64 res;
	res = time_components_to_comparable_u64(na_year, na_month, na_day, na_hour, na_min, na_sec);
	//@ assert res < (1ULL << 55);
	return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires 1 <= n;
*/
void foo(int n) {
  int i = 1;
  int sn = 0;
  while (i <= n) {
    i  = i + 1;
    sn  = sn + 1;
  }
  if (sn != n) {
    //@ assert sn == 0;
  }
}

Output:
/*@
requires 1 <= n;
*/
void foo(int n) {
  int i = 1;
  int sn = 0;
  /*@
  loop invariant sn == i-1;
  loop invariant sn == i - 1;
  loop invariant sn <= n;
  loop invariant sn <= i-1;
  loop invariant i <= n+1;
  loop invariant i <= n + 1;
  loop invariant 1 <= i;
  loop invariant 0 <= sn;
  loop assigns sn;
  loop assigns i;
  */
  while (i <= n) {
    i  = i + 1;
    sn  = sn + 1;
  }
  if (sn != n) {
    //@ assert sn == 0;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
size_type
find(const value_type* a, size_type n, value_type v)
{
  for (size_type i = 0u; i < n; i++) {
    if (a[i] == v) {
      //@ assert \exists integer k; 0 <= k < n && a[k] == v;
      return i;
    }
  }
  //@ assert \forall integer k; 0 <= k < n ==> a[k] != v;
  return n;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  requires   \valid_read(a + (0..n-1));
  assigns    \nothing;
  ensures    0 <= \result <= n;
  behavior some:
    assumes  \exists integer i; 0 <= i < n && a[i] == v;
    assigns  \nothing;
    ensures  0 <= \result < n;
    ensures  a[\result] == v;
    ensures  \forall integer i; 0 <= i < \result ==> a[i] != v;
  behavior none:
    assumes  \forall integer i; 0 <= i < n ==> a[i] != v;
    assigns  \nothing;
    ensures  \result == n;
  complete behaviors;
  disjoint behaviors;
*/
size_type
find(const value_type* a, size_type n, value_type v)
{
  /*@
    loop invariant 0 <= i <= n;
    loop invariant \forall integer k; 0 <= k < i ==> a[k] != v;
    loop assigns i;
    loop variant n-i;
   */
  for (size_type i = 0u; i < n; i++) {
    if (a[i] == v) {
      //@ assert \exists integer k; 0 <= k < n && a[k] == v;
      return i;
    }
  }
  //@ assert \forall integer k; 0 <= k < n ==> a[k] != v;
  return n;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires x == y;
*/
void foo(int x, int y) {
  int lock = 1;
  while (x != y) {
    if (unknown()) {
      lock = 1;
      x = y;
    } else {
      lock  = 0;
      x  = y;
      y  = y + 1;
    }
  }
  //@ assert lock == 1;
}

Output:
/*@
requires x == y;
*/
void foo(int x, int y) {
  int lock = 1;
  /*@
  loop invariant x == y;
  loop invariant lock == 1;
  loop invariant lock == 1 || lock == 0;
  loop invariant lock == 0 || lock == 1;
  loop invariant lock != 1 ==> x == y;
  loop invariant (lock == 1) || (lock == 0);
  loop assigns x,y,lock;
  */
  while (x != y) {
    if (unknown()) {
      lock = 1;
      x = y;
    } else {
      lock  = 0;
      x  = y;
      y  = y + 1;
    }
  }
  //@ assert lock == 1;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int main() {
    int x = 1;
    int y = 0;
    while (x <= 100) {
        y = 100 - x;
        x = x +1;
    }
    //@ assert y >= 0;
}

Output:
int main() {
    int x = 1;
    int y = 0;
    /*@
    loop invariant y <= 100;
    loop invariant 0 <= y;
    loop invariant -99 <= y;
    loop invariant x <= 101;
    loop invariant 1 <= x;
    loop invariant 0 <= x;
    loop assigns y,x;
    */
    while (x <= 100) {
        y = 100 - x;
        x = x +1;
    }
    //@ assert y >= 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int day_of(int month){
    int days[] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 } ;
    return days[month-1] ;
}
int main(){
    int days2 = day_of(2);
    //@ assert days2 == 28;
    int days7 = day_of(7);
    //@ assert days7 == 31;
}

Output:
/*@
    requires input_range: 1 <= month <= 12;
    assigns \nothing;
    ensures result_options: \result \in {28, 30, 31};
    behavior day_28:
        assumes month == 2;
        ensures \result == 28;
    behavior day_30:
        assumes month \in { 4, 6, 9, 11 } ;
        ensures \result == 30;
     behavior days_31:
        assumes month \in {1, 3, 5, 7, 8, 10, 12};
        ensures \result == 31;
    complete behaviors;
    disjoint behaviors;
*/
int day_of(int month){
    int days[] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 } ;
    return days[month-1] ;
}
int main(){
    int days2 = day_of(2);
    //@ assert days2 == 28;
    int days7 = day_of(7);
    //@ assert days7 == 31;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
size_type
mismatch(const value_type* a, size_type n, const value_type* b)
{
  for (size_type i = 0u; i < n; i++) {
    if (a[i] != b[i]) {
      //@ assert !Equal{Here,Here}(a, n, b);
      return i;
    }
  }
  //@ assert Equal{Here,Here}(a, n, b);
  return n;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  requires valid:   \valid_read(a + (0..n-1));
  requires valid:   \valid_read(b + (0..n-1));
  assigns           \nothing;
  ensures  result:  0 <= \result <= n;
  behavior all_equal:
    assumes         Equal{Here,Here}(a, n, b);
    assigns         \nothing;
    ensures result: \result == n;
  behavior some_not_equal:
    assumes         !Equal{Here,Here}(a, n, b);
    assigns         \nothing;
    ensures bound:  0 <= \result < n;
    ensures result: a[\result] != b[\result];
    ensures first:  Equal{Here,Here}(a, \result, b);
  complete behaviors;
  disjoint behaviors;
*/
size_type
mismatch(const value_type* a, size_type n, const value_type* b)
{
  /*@
    loop invariant bound:  0 <= i <= n;
    loop invariant equal:  Equal{Here,Here}(a, i, b);
    loop assigns i;
    loop variant n-i;
  */
  for (size_type i = 0u; i < n; i++) {
    if (a[i] != b[i]) {
      //@ assert !Equal{Here,Here}(a, n, b);
      return i;
    }
  }
  //@ assert Equal{Here,Here}(a, n, b);
  return n;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#define INT_MAX 2147483647
unsigned lshift(unsigned a)
{
	return a << 1;
}
int main() {
    unsigned a = 5;
    unsigned result = lshift(a);
    //@ assert result == 10;
    return 0;
}

Output:
#define INT_MAX 2147483647
/*@ requires (a * 2) <= INT_MAX;
    assigns \nothing;
    ensures \result == a * 2;
 */
unsigned lshift(unsigned a)
{
	return a << 1;
}
int main() {
    unsigned a = 5;
    unsigned result = lshift(a);
    //@ assert result == 10;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<limits.h>
int test(int x) {
    int a = x;
    int y = 0;
    while(a != 0) {
        y = y + 1;
        a = a - 1;
    }
    return y;
}
int main() {
    int num = test(3);
    //@ assert num == 3;
    return 0;
}

Output:
#include<limits.h>
/*@
    requires x > 0 && x < INT_MAX;
    ensures \result == x;
    assigns \nothing;
*/
int test(int x) {
    int a = x;
    int y = 0;
    /*@
        loop invariant y + a == x;
        loop invariant a > -1 && a <= x;
        loop assigns a, y;
    */
    while(a != 0) {
        y = y + 1;
        a = a - 1;
    }
    return y;
}
int main() {
    int num = test(3);
    //@ assert num == 3;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n >= 0;
*/
void foo(int n) {
  int x = 0;
  while (x < n) {
    x  = x + 1;
  }
  if(n >= 0) {
    //@ assert x == n;
  }
}

Output:
/*@
requires n >= 0;
*/
void foo(int n) {
  int x = 0;
  /*@
  loop invariant x <= n;
  loop invariant 0 <= x;
  loop assigns x;
  loop assigns n;
  */
  while (x < n) {
    x  = x + 1;
  }
  if(n >= 0) {
    //@ assert x == n;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
  requires \valid(a) && \valid(b);
  assigns  *a, *b ;
  behavior reorder:
    assumes *a < *b ;
    ensures *a == \old(*b) && *b == \old(*a) ;
  behavior do_not_change:
    assumes *a >= *b ;
    ensures *a == \old(*a) && *b == \old(*b) ;
  complete behaviors ;
  disjoint behaviors ;
*/
void max_ptr(int* a, int* b){
  if(*a < *b){
    int tmp = *b ;
    *b = *a ;
    *a = tmp ;
  }
  //@ assert *a >= *b ;
}
/*@
  requires \valid(a) && \valid(b);
  assigns  *a, *b ;
  behavior reorder:
    assumes *a > *b ;
    ensures *a == \old(*b) && *b == \old(*a) ;
  behavior do_not_change:
    assumes *a <= *b ;
    ensures *a == \old(*a) && *b == \old(*b) ;
  complete behaviors ;
  disjoint behaviors ;
*/
void min_ptr(int* a, int* b){
  max_ptr(b, a);
  //@ assert *a <= *b ;
}

void order_3_inc_max_min(int* a, int* b, int* c) {
  max_ptr(c, b) ;
  max_ptr(c, a) ;
  max_ptr(b, a) ;
  //@ assert *a <= *b && *b <= *c ;
}

Output:
/*@
  requires \valid(a) && \valid(b);
  assigns  *a, *b ;
  behavior reorder:
    assumes *a < *b ;
    ensures *a == \old(*b) && *b == \old(*a) ;
  behavior do_not_change:
    assumes *a >= *b ;
    ensures *a == \old(*a) && *b == \old(*b) ;
  complete behaviors ;
  disjoint behaviors ;
*/
void max_ptr(int* a, int* b){
  if(*a < *b){
    int tmp = *b ;
    *b = *a ;
    *a = tmp ;
  }
  //@ assert *a >= *b ;
}
/*@
  requires \valid(a) && \valid(b);
  assigns  *a, *b ;
  behavior reorder:
    assumes *a > *b ;
    ensures *a == \old(*b) && *b == \old(*a) ;
  behavior do_not_change:
    assumes *a <= *b ;
    ensures *a == \old(*a) && *b == \old(*b) ;
  complete behaviors ;
  disjoint behaviors ;
*/
void min_ptr(int* a, int* b){
  max_ptr(b, a);
  //@ assert *a <= *b ;
}
/*@ requires \valid(a) && \valid(b) && \valid(c) ;
    requires \separated(a, b, c);
    assigns *a, *b, *c ;
    ensures { \old(*a), \old(*b), \old(*c) } == { *a, *b, *c };
    behavior all_equal:
        assumes *a == *b == *c ;
        ensures *a == *b == *c;
    behavior all_uequal:
        assumes *a != *b && *a != *c && *b != *c ;
        ensures *a != *b && *a != *c && *b != *c ;
    behavior two_eq_lt:
        assumes *a == *b < *c ||
                *a == *c < *b ||
                *b == *c < *a;
        ensures *a == *b;
    behavior two_eq_gt:
        assumes *a == *b > *c ||
                *a == *c > *b ||
                *b == *c > *a;
        ensures *b == *c;
    complete behaviors ;
    disjoint behaviors ;
*/
void order_3_inc_max(int* a, int* b, int* c) {
  max_ptr(c, b) ;
  max_ptr(c, a) ;
  max_ptr(b, a) ;
  //@ assert *a <= *b && *b <= *c ;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c  = 1;
      }
    }
  }
  if (c == n) {
    //@ assert n <= -1;
  }
}

Output:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant n - c;
  loop invariant c <= n;
  loop invariant c <= n+1;
  loop invariant 0 <= c;
  loop assigns n,c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c  = 1;
      }
    }
  }
  if (c == n) {
    //@ assert n <= -1;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n >= 0;
*/
void foo(int n) {
  int x = n;
  int y = 0;
  while (x > 0) {
    y  = y + 1;
    x  = x - 1;
  }
  //@ assert n == x + y;
}

Output:
/*@
requires n >= 0;
*/
void foo(int n) {
  int x = n;
  int y = 0;
  /*@
  loop invariant y == n - x;
  loop invariant y <= n;
  loop invariant x <= n;
  loop invariant x + y == n;
  loop invariant n == x + y;
  loop invariant 0 <= y;
  loop invariant 0 <= x;
  loop assigns y;
  loop assigns x;
  */
  while (x > 0) {
    y  = y + 1;
    x  = x - 1;
  }
  //@ assert n == x + y;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Difference
  {
    logic integer
    Difference{L}(value_type* a, integer n) =
      n <= 0 ? a[0] : a[n] - a[n-1];
    lemma Difference_Zero{L}:
      \forall value_type *a; Difference(a, 0) == a[0];
    lemma Difference_Next{L}:
      \forall value_type *a, integer n;
        0 < n  ==>  Difference(a, n) == a[n] - a[n-1];
    lemma Difference_Unchanged{K,L}:
      \forall value_type *a, integer n;
        0 <= n  ==>  Unchanged{K,L}(a, n+1)  ==>
        Difference{K}(a, n) == Difference{L}(a, n);
  }
*/
/*@
  axiomatic AdjacentDifference
  {
    predicate
    AdjacentDifference{L}(value_type* a, integer n, value_type* b) =
      \forall integer i; 0 <= i < n  ==>  b[i] == Difference(a, i);
    predicate
    AdjacentDifferenceBounds(value_type* a, integer n) =
      \forall integer i; 1 <= i < n  ==>
        VALUE_TYPE_MIN <= Difference(a, i) <= VALUE_TYPE_MAX;
    lemma AdjacentDifference_Step{K,L}:
      \forall value_type *a, *b, integer n;
        AdjacentDifference{K}(a, n, b)      ==>
        Unchanged{K,L}(b, n)                ==>
        Unchanged{K,L}(a, n+1)              ==>
        \at(b[n],L) == Difference{L}(a, n)  ==>
        AdjacentDifference{L}(a, n+1, b);
    lemma AdjacentDifference_Section{K}:
      \forall value_type *a, *b, integer m, n;
        0 <= m <= n                     ==>
        AdjacentDifference{K}(a, n, b)  ==>
        AdjacentDifference{K}(a, m, b);
  }
*/
size_type
adjacent_difference(const value_type* a, size_type n, value_type* b)
{
  if (0u < n) {
    b[0u] = a[0u];
    for (size_type i = 1u; i < n; ++i) {
      //@ assert bound: VALUE_TYPE_MIN <= Difference(a, i) <= VALUE_TYPE_MAX;
      b[i] = a[i] - a[i - 1u];
      //@ assert difference: AdjacentDifference(a, i+1, b);
    }
  }
  return n;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Difference
  {
    logic integer
    Difference{L}(value_type* a, integer n) =
      n <= 0 ? a[0] : a[n] - a[n-1];
    lemma Difference_Zero{L}:
      \forall value_type *a; Difference(a, 0) == a[0];
    lemma Difference_Next{L}:
      \forall value_type *a, integer n;
        0 < n  ==>  Difference(a, n) == a[n] - a[n-1];
    lemma Difference_Unchanged{K,L}:
      \forall value_type *a, integer n;
        0 <= n  ==>  Unchanged{K,L}(a, n+1)  ==>
        Difference{K}(a, n) == Difference{L}(a, n);
  }
*/
/*@
  axiomatic AdjacentDifference
  {
    predicate
    AdjacentDifference{L}(value_type* a, integer n, value_type* b) =
      \forall integer i; 0 <= i < n  ==>  b[i] == Difference(a, i);
    predicate
    AdjacentDifferenceBounds(value_type* a, integer n) =
      \forall integer i; 1 <= i < n  ==>
        VALUE_TYPE_MIN <= Difference(a, i) <= VALUE_TYPE_MAX;
    lemma AdjacentDifference_Step{K,L}:
      \forall value_type *a, *b, integer n;
        AdjacentDifference{K}(a, n, b)      ==>
        Unchanged{K,L}(b, n)                ==>
        Unchanged{K,L}(a, n+1)              ==>
        \at(b[n],L) == Difference{L}(a, n)  ==>
        AdjacentDifference{L}(a, n+1, b);
    lemma AdjacentDifference_Section{K}:
      \forall value_type *a, *b, integer m, n;
        0 <= m <= n                     ==>
        AdjacentDifference{K}(a, n, b)  ==>
        AdjacentDifference{K}(a, m, b);
  }
*/
/*@
   requires valid:      \valid_read(a + (0..n-1));
   requires valid:      \valid(b + (0..n-1));
   requires sep:        \separated(a + (0..n-1), b + (0..n-1));
   requires bounds:     AdjacentDifferenceBounds(a, n);
   assigns              b[0..n-1];
   ensures result:      \result == n;
   ensures difference:  AdjacentDifference(a, n, b);
   ensures unchanged:   Unchanged{Old,Here}(a, n);
*/
size_type
adjacent_difference(const value_type* a, size_type n, value_type* b)
{
  if (0u < n) {
    b[0u] = a[0u];
    /*@
       loop invariant index:      1 <= i <= n;
       loop invariant unchanged:  Unchanged{Pre,Here}(a, n);
       loop invariant difference: AdjacentDifference(a, i, b);
       loop assigns i, b[1..n-1];
       loop variant n - i;
    */
    for (size_type i = 1u; i < n; ++i) {
      //@ assert bound: VALUE_TYPE_MIN <= Difference(a, i) <= VALUE_TYPE_MAX;
      b[i] = a[i] - a[i - 1u];
      //@ assert difference: AdjacentDifference(a, i+1, b);
    }
  }
  return n;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c != n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if(c != n) {
    //@ assert c >= 0;
  }
}

Output:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant c == n ==> c == n;
  loop invariant 0 <= c;
  loop assigns n,c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c != n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if(c != n) {
    //@ assert c >= 0;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.