Input:
#include <stddef.h>
#include <limits.h>
int* search(int* array, size_t length, int element){
    for(size_t i = 0; i < length; i++){
        if(array[i] == element) return &array[i];
    }
    return NULL;
}
int main(){
    int array[] = {1,2,3,4,5};
    int *p = search(array,5,6);
    //@ assert p == NULL;
}

Output:
#include <stddef.h>
#include <limits.h>
/*@
	requires \valid_read(array+(0..length-1));
	assigns \nothing;
	behavior in:
		assumes \exists size_t off;0<=off<length&&array[off]==element;
		ensures array<=\result<array+length&&*\result==element;
	behavior notin:
		assumes \forall size_t off;0<=off<length==>array[off]!=element;
		ensures \result==NULL;
	disjoint behaviors;
	complete behaviors;
*/
int* search(int* array, size_t length, int element) {
	/*@
		loop invariant 0<=i<=length;
		loop invariant \forall size_t j;0<=j<i==>array[j]!=element;
		loop assigns i;
		loop variant length-i;
	*/
	for(size_t i = 0; i < length; i++)
		if(array[i]==element) return &array[i];
	return NULL;
}
int main(){
    int array[] = {1,2,3,4,5};
    int *p = search(array,5,6);
    //@ assert p == NULL;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<limits.h>
int max(int a,int b){
return a>b?a:b;
}
int main(){
int x=4;
int y=5;
int r=max(x,y);
//@assert x==4 && y==5;
}

Output:
#include<limits.h>
/*@
requires INT_MIN<=a<INT_MAX;
requires INT_MIN<=b<INT_MAX;
ensures \result==a && \result>b || \result==b && \result>a || \result==a && \result==b;
*/
int max(int a,int b){
return a>b?a:b;
}
int main(){
int x=4;
int y=5;
int r=max(x,y);
//@assert x==4 && y==5;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <stdio.h>
int validts(int a, int b, int c) {
    int valid = 0;
    if ((a+b>c) && (a+c>b) && (b+c>a) && 1) {
        valid = 1;
    } else {
        valid = 0;
    }
    return valid;
}
void test() {
    int valid = validts(2,3,4);
    //@ assert valid == 1;
}

Output:
#include <stdio.h>
/*@
    requires a>0 && b>0 && c>0;
    ensures \result == 1 <==> (a+b>c) && (a+c>b) && (b+c>a);
    ensures \result == 0 <==> !(a+b>c) || !(a+c>b) || !(b+c>a);
*/
int validts(int a, int b, int c) {
    int valid = 0;
    if ((a+b>c) && (a+c>b) && (b+c>a) && 1) {
        valid = 1;
    } else {
        valid = 0;
    }
    return valid;
}
void test() {
    int valid = validts(2,3,4);
    //@ assert valid == 1;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void max_ptr(int* a, int* b){
    if(*a < *b){
        int tmp = *b;
        *b = *a;
        *a = tmp;
    }
}
int main(){
    int x = 10, y = 20;
    max_ptr(&x, &y);
    //@ assert x == 20 && y == 10;
    return 0;
}

Output:
/*@ requires \valid(a) && \valid(b);
    assigns *a, *b;
    ensures \old(*a) < \old(*b) ==> *a == \old(*b) && *b == \old(*a);
    ensures \old(*a) >= \old(*b) ==> *a == \old(*a) && *b == \old(*b);
*/
void max_ptr(int* a, int* b){
    if(*a < *b){
        int tmp = *b;
        *b = *a;
        *a = tmp;
    }
}
int main(){
    int x = 10, y = 20;
    max_ptr(&x, &y);
    //@ assert x == 20 && y == 10;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires y >= 127;
*/
void foo(int y) {
  int c = 0;
  int z = 36 * y;
  while (unknown()) {
    if (c < 36)
    {
      z = z + 1;
      c = c + 1;
    }
  }
  if (c < 36) {
    //@ assert z >= 0;
  }
}

Output:
/*@
requires y >= 127;
*/
void foo(int y) {
  int c = 0;
  int z = 36 * y;
  /*@
  loop invariant z == 36*y + c;
  loop invariant z == 36 * y + c;
  loop invariant c <= 36;
  loop invariant 36 * y <= z;
  loop invariant 0 <= c;
  loop assigns z;
  loop assigns c;
  */
  while (unknown()) {
    if (c < 36)
    {
      z = z + 1;
      c = c + 1;
    }
  }
  if (c < 36) {
    //@ assert z >= 0;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires a <= m;
*/
void foo(int a, int m) {
    int j = 0;
    int k = 0;
    while ( k < 1) {
        if(m < a) {
            m = a;
        }
        k = k + 1;
    }
    //@ assert a <= m;
}

Output:
/*@
requires a <= m;
*/
void foo(int a, int m) {
    int j = 0;
    int k = 0;
    /*@
    loop invariant k <= 1;
    loop invariant a <= m;
    loop invariant 0 <= k;
    loop assigns m;
    loop assigns k;
    */
    while ( k < 1) {
        if(m < a) {
            m = a;
        }
        k = k + 1;
    }
    //@ assert a <= m;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid: \valid(s) && StackInvariant(s);
  assigns         s->size;
  ensures  valid: \valid(s) && StackInvariant(s);
  behavior empty:
    assumes            StackEmpty(s);
    assigns            \nothing;
    ensures empty:     StackEmpty(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_empty:
    assumes            !StackEmpty(s);
    assigns            s->size;
    ensures size:      StackSize(s) == StackSize{Old}(s) - 1;
    ensures full:      !StackFull(s);
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_pop(Stack* s);
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  size:  \result == StackSize(s);
*/
size_type
stack_size(const Stack* s);
size_type
axiom_size_of_pop(Stack* s)
{
  stack_pop(s);
  //@ assert StackSize(s) == StackSize{Pre}(s) - 1;
  return stack_size(s);
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  requires valid: \valid(s) && StackInvariant(s);
  assigns         s->size;
  ensures  valid: \valid(s) && StackInvariant(s);
  behavior empty:
    assumes            StackEmpty(s);
    assigns            \nothing;
    ensures empty:     StackEmpty(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_empty:
    assumes            !StackEmpty(s);
    assigns            s->size;
    ensures size:      StackSize(s) == StackSize{Old}(s) - 1;
    ensures full:      !StackFull(s);
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_pop(Stack* s);
/*@
    requires valid: \valid(s) && StackInvariant(s);
    assigns         \nothing;
    ensures  size:  \result == StackSize(s);
*/
size_type
stack_size(const Stack* s);
/*@
  requires valid:  \valid(s) && StackInvariant(s);
  requires empty:  !StackEmpty(s);
  assigns          s->size;
  ensures   size:  \result == StackSize{Old}(s) - 1;
*/
size_type
axiom_size_of_pop(Stack* s)
{
  stack_pop(s);
  //@ assert StackSize(s) == StackSize{Pre}(s) - 1;
  return stack_size(s);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires (x == 100);
*/
void foo(int x) {
  while (x > 0) {
    x  = x - 1;
  }
  //@ assert x == 0;
}

Output:
/*@
requires (x == 100);
*/
void foo(int x) {
  // loop body
  /*@
  loop invariant x <= 100;
  loop invariant 0 <= x;
  loop assigns x;
  */
  while (x > 0) {
    x  = x - 1;
  }
  // post-condition
  //@ assert x == 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(int x, int y) {
  int i = x;
  int j = y;
  while (x != 0) {
    x  = x - 1;
    y  = y - 1;
  }
  if (y != 0) {
    //@ assert i != j;
  }
}

Output:
void foo(int x, int y) {
  int i = x;
  int j = y;
  /*@
  loop invariant y <= j;
  loop invariant x <= i;
  loop invariant j - y == i - x;
  loop invariant i - x == j - y;
  loop assigns x,y,i,j;
  */
  while (x != 0) {
    x  = x - 1;
    y  = y - 1;
  }
  if (y != 0) {
    //@ assert i != j;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
   requires \valid(&a[i]);
    requires \valid(&a[j]);
    assigns a[i], a[j];
    ensures a[i] == \old(a[j]);
    ensures a[j] == \old(a[i]);
 */
void swap(int a[], int i, int j);
void reverse_in_place(int a[], int size)
{
   int i;
   for(i = 0; i < (size / 2); ++i) {
      swap(a, i, size - i - 1);
   }
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a[] = {1,2,3,4,5,6,7,8,9,10};
   int size = sizeof(a) / sizeof(a[0]);
   //@ assert a[0] == 1;
   reverse_in_place(a, size);
   //@ assert a[0] == 10;
}
#endif

Output:
/*@
   requires \valid(&a[i]);
    requires \valid(&a[j]);
    assigns a[i], a[j];
    ensures a[i] == \old(a[j]);
    ensures a[j] == \old(a[i]);
 */
void swap(int a[], int i, int j);
/*@
   predicate reverse{L1,L2}(int* a, integer size, integer i, integer j) =
       \forall integer k; i <= k < j ==>
          \at(a[k], L1) == \at(a[size - k - 1], L2);
    predicate reverse{L1,L2}(int* a, integer size) = reverse{L1,L2}(a, size, 0, size);
*/
/*@
    requires size >= 0;
    requires \valid(a+(0..size-1));
    assigns a[0..size-1];
    ensures reverse{Pre,Here}(a, size);
    ensures \forall integer i; 0 <= i < size ==>
            \exists integer j; 0 <= j < size &&
            \old(a[\at(i,Here)]) == a[j];
 */
void reverse_in_place(int a[], int size)
{
   int i;
   /*@ loop invariant 0 <= i <= size / 2;
       loop invariant reverse{Pre,Here}(a, size, 0, i);
       loop invariant \forall integer j; i <= j < size - i ==> a[j] == \at(a[\at(j,Here)],Pre);
       loop invariant reverse{Pre,Here}(a, size, size - i, size);
       loop assigns i, a[0..size-1];
       loop variant size / 2 - i;
    */
   for(i = 0; i < (size / 2); ++i) {
      swap(a, i, size - i - 1);
   }
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a[] = {1,2,3,4,5,6,7,8,9,10};
   int size = sizeof(a) / sizeof(a[0]);
   //@ assert a[0] == 1;
   reverse_in_place(a, size);
   //@ assert a[0] == 10;
}
#endif

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  axiomatic StackLemmas
  {
    lemma StackPush_Equal{K,L}:
      \forall Stack *s, *t;
        StackEqual{K,K}(s,t)                     ==>
        StackSize{L}(s) == StackSize{K}(s) + 1   ==>
        StackSize{L}(s) == StackSize{L}(t)       ==>
        StackTop{L}(s)  == StackTop{L}(t)        ==>
        Equal{L,L}(StackStorage{L}(s),
                   StackSize{K}(s),
                   StackStorage{L}(t))           ==>
        StackEqual{L,L}(s,t);
  }
*/
/*@
  requires valid:      \valid(s) && StackInvariant(s);
  assigns              s->size, s->obj[s->size];
  behavior full:
    assumes            StackFull(s);
    assigns            \nothing;
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures full:      StackFull(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_full:
    assumes            !StackFull(s);
    assigns            s->size;
    assigns            s->obj[s->size];
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures size:      StackSize(s) == StackSize{Old}(s) + 1;
    ensures top:       StackTop(s) == v;
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures not_empty: !StackEmpty(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize{Old}(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_push(Stack* s, value_type v);
void
stack_push_wd(Stack* s, Stack* t, value_type v)
{
  stack_push(s, v);
  stack_push(t, v);
  //@ assert top:   StackTop(s) == v;
  //@ assert top:   StackTop(t) == v;
  //@ assert equal: Equal{Here,Here}(StackStorage(s), StackSize{Pre}(s), StackStorage(t));
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
  axiomatic StackLemmas
  {
    lemma StackPush_Equal{K,L}:
      \forall Stack *s, *t;
        StackEqual{K,K}(s,t)                     ==>
        StackSize{L}(s) == StackSize{K}(s) + 1   ==>
        StackSize{L}(s) == StackSize{L}(t)       ==>
        StackTop{L}(s)  == StackTop{L}(t)        ==>
        Equal{L,L}(StackStorage{L}(s),
                   StackSize{K}(s),
                   StackStorage{L}(t))           ==>
        StackEqual{L,L}(s,t);
  }
*/
/*@
  requires valid:      \valid(s) && StackInvariant(s);
  assigns              s->size, s->obj[s->size];
  behavior full:
    assumes            StackFull(s);
    assigns            \nothing;
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures full:      StackFull(s);
    ensures unchanged: StackUnchanged{Old,Here}(s);
  behavior not_full:
    assumes            !StackFull(s);
    assigns            s->size;
    assigns            s->obj[s->size];
    ensures valid:     \valid(s) && StackInvariant(s);
    ensures size:      StackSize(s) == StackSize{Old}(s) + 1;
    ensures top:       StackTop(s) == v;
    ensures storage:   StackStorage(s) == StackStorage{Old}(s);
    ensures capacity:  StackCapacity(s) == StackCapacity{Old}(s);
    ensures not_empty: !StackEmpty(s);
    ensures unchanged: Unchanged{Old,Here}(StackStorage(s), StackSize{Old}(s));
  complete behaviors;
  disjoint behaviors;
*/
void
stack_push(Stack* s, value_type v);
/*@
  requires valid:     \valid(s) && StackInvariant(s);
  requires valid:     \valid(t) && StackInvariant(t);
  requires equal:     StackEqual{Here,Here}(s, t);
  requires not_full:  !StackFull(s) && !StackFull(t);
  requires sep:       StackSeparated(s, t);
  assigns             s->size, s->obj[s->size];
  assigns             t->size, t->obj[t->size];
  ensures  valid:     StackInvariant(s) && StackInvariant(t);
  ensures  equal:     StackEqual{Here,Here}(s, t);
*/
void
stack_push_wd(Stack* s, Stack* t, value_type v)
{
  stack_push(s, v);
  stack_push(t, v);
  //@ assert top:   StackTop(s) == v;
  //@ assert top:   StackTop(t) == v;
  //@ assert equal: Equal{Here,Here}(StackStorage(s), StackSize{Pre}(s), StackStorage(t));
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int average(int a, int b)
{
   int average = 0;
	int greater;
	int smaller;
	if (a > b) {
	   greater = a;
	   smaller = b;
	} else {
	   greater = b;
	   smaller = a;
	}
	if (a >= 0 && b >= 0) {
	   average = smaller + (greater - smaller) / 2;
	} else if (a < 0 && b < 0) {
	   average = greater + (smaller - greater) / 2;
	} else if ((a >= 0 && b <= 0) || (a <= 0 && b >= 0)) {
	   average = (a + b) / 2;
	}
   return average;
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a = average(3,30);
   int b = average(-5,-20);
   int c = average(7,-10);
   int d = average(-2,15);
   //@ assert a == 16;
   //@ assert b == -13;
   //@ assert c == -3;
   //@ assert d == 8;
   return 0;
}
#endif

Output:
/*@ assigns \nothing;
    ensures \result == (a+b)/2;
*/
int average(int a, int b)
{
   int average = 0;
	int greater;
	int smaller;
	if (a > b) {
	   greater = a;
	   smaller = b;
	} else {
	   greater = b;
	   smaller = a;
	}
	if (a >= 0 && b >= 0) {
	   average = smaller + (greater - smaller) / 2;
	} else if (a < 0 && b < 0) {
	   average = greater + (smaller - greater) / 2;
	} else if ((a >= 0 && b <= 0) || (a <= 0 && b >= 0)) {
	   average = (a + b) / 2;
	}
   return average;
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a = average(3,30);
   int b = average(-5,-20);
   int c = average(7,-10);
   int d = average(-2,15);
   //@ assert a == 16;
   //@ assert b == -13;
   //@ assert c == -3;
   //@ assert d == 8;
   return 0;
}
#endif

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<limits.h>
/*@
logic integer ax_b(integer a,integer x,integer b) = a*x+b;
*/
/*@
assigns \nothing;
ensures \result==ax_b(a,x,4);
*/
int func(int a,int x){
return a*x+4;
}
void check(int a,int x,int y){
int fmin,fmax;
if(x>y){
fmin=func(a,x);
fmax=func(a,y);
}
else{
fmin=func(a,y);
fmax=func(a,x);
}
//@assert fmin<=fmax;
}
int main(){
int w=3;
int r=4;
int s=7;
int t=func(w,r);
check(w,r,s);
}

Output:
#include<limits.h>
/*@
logic integer ax_b(integer a,integer x,integer b) = a*x+b;
*/
/*@
assigns \nothing;
ensures \result==ax_b(a,x,4);
*/
int func(int a,int x){
return a*x+4;
}
/*@
requires INT_MIN<=a*x<INT_MAX;
requires INT_MIN<=a*y<INT_MAX;
requires a>0;
requires INT_MIN<=ax_b(a,x,4)<=INT_MAX;
requires INT_MIN<=ax_b(a,y,4)<=INT_MAX;
assigns \nothing;
*/
void check(int a,int x,int y){
int fmin,fmax;
if(x < y){}
else{
    int temp = x;
    x = y;
    y = temp;
}
fmin=func(a,x);
fmax=func(a,y);
//@assert fmin== ax_b(a, (x < y ? x : y), 4);
}
int main(){
int w=3;
int r=4;
int s=7;
int t=func(w,r);
check(w,r,s);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<limits.h>
int plus_5(int* a) {
    return *a + 5;
}
int main(){
    int a = 10;
    int b = plus_5(&a);
    //@ assert b == 15;
}

Output:
#include<limits.h>
/*@
  requires \valid_read(a);
  requires *a <= INT_MAX - 5;
  assigns \nothing;
  ensures \result == *a + 5;
*/
int plus_5(int* a) {
    return *a + 5;
}
int main(){
    int a = 10;
    int b = plus_5(&a);
    //@ assert b == 15;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(){
  int h = 42 ;
  int x = 0 ;
  int e = 0 ;
  PreLoop:
  while(e < 10){
    ++ e ;
    x += e * 2 ;
  }
  //@ assert h == 42 ;
}

Output:
void foo(){
  int h = 42 ;
  int x = 0 ;
  int e = 0 ;
  PreLoop:
  /*@
    loop invariant h == \at(h, PreLoop) ;
    loop assigns e, x ;
    loop variant 10 - e;
  */
  while(e < 10){
    ++ e ;
    x += e * 2 ;
  }
  //@ assert h == 42 ;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void foo(int x) {
  int i = 0;
  int j = 0;
  int y = 0;
  while (i <= x) {
    i  = i + 1;
    j  = j + y;
  }
  if (i != j) {
    //@ assert y != 1;
  }
}

Output:
void foo(int x) {
  int i = 0;
  int j = 0;
  int y = 0;
  /*@
  loop invariant y == 0;
  loop invariant j == y*i;
  loop invariant j == y*(i-1);
  loop invariant j == i*y;
  loop invariant j == (i-1)*y;
  loop invariant j <= y*(i-1);
  loop invariant 0 <= j;
  loop invariant 0 <= i;
  loop assigns y,i,j;
  */
  while (i <= x) {
    i  = i + 1;
    j  = j + y;
  }
  if (i != j) {
    //@ assert y != 1;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c  = c + 1;
      }
    } else {
      if (c == n) {
        c  = 1;
      }
    }
  }
  if ( (c != n) ) {
    //@ assert  (c >= 0) ;
  }
}

Output:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant n-c;
  loop invariant n - c;
  loop invariant c <= n;
  loop invariant c <= n || c == 1;
  loop invariant 0 <= c;
  loop invariant (c <= n && c >= 0) || (c == n+1);
  loop assigns c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c  = c + 1;
      }
    } else {
      if (c == n) {
        c  = 1;
      }
    }
  }
  if ( (c != n) ) {
    //@ assert  (c >= 0) ;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
    requires valid:    \valid(s) && StackInvariant(s);
    assigns            \nothing;
    ensures empty:     \result == 1  <==>  StackEmpty(s);
    ensures not_empty: \result == 0  <==> !StackEmpty(s);
*/
bool
stack_empty(const Stack* s);
bool
stack_empty_wd(const Stack* s, const Stack* t)
{
  return stack_empty(s) == stack_empty(t);
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
struct Stack
{
  value_type* obj;
  size_type   capacity;
  size_type   size;
};
typedef struct Stack Stack;
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic StackInvariant
  {
    logic integer
    StackCapacity{L}(Stack* s) = s->capacity;
    logic integer
    StackSize{L}(Stack* s) = s->size;
    logic value_type*
    StackStorage{L}(Stack* s) = s->obj;
    logic integer
    StackTop{L}(Stack* s) = s->obj[s->size-1];
    predicate
    StackEmpty{L}(Stack* s) =  StackSize(s) == 0;
    predicate
    StackFull{L}(Stack* s)  =  StackSize(s) == StackCapacity(s);
    predicate
    StackInvariant{L}(Stack* s) =
      0 < StackCapacity(s) &&
      0 <= StackSize(s) <= StackCapacity(s) &&
      \valid(StackStorage(s) + (0..StackCapacity(s)-1)) &&
      \separated(s, StackStorage(s) + (0..StackCapacity(s)-1));
  }
*/
/*@
  axiomatic StackUtility
  {
    predicate
    StackSeparated(Stack* s, Stack* t) =
      \separated(s, s->obj + (0..s->capacity-1),
                 t, t->obj + (0..t->capacity-1));
    predicate
    StackUnchanged{K,L}(Stack* s) =
      StackSize{K}(s)     == StackSize{L}(s)      &&
      StackStorage{K}(s)  == StackStorage{L}(s)   &&
      StackCapacity{K}(s) == StackCapacity{L}(s)  &&
      Unchanged{K,L}(StackStorage{K}(s), StackSize{K}(s));
  }
*/
/*@
  axiomatic StackEquality
  {
    predicate
    StackEqual{S,T}(Stack* s, Stack* t) =
      StackSize{S}(s) == StackSize{T}(t) &&
      Equal{S,T}(StackStorage{S}(s), StackSize{S}(s), StackStorage{T}(t));
    lemma StackEqual_Reflexive{S} :
      \forall Stack* s; StackEqual{S,S}(s, s);
    lemma StackEqual_Symmetric{S,T} :
      \forall Stack *s, *t;
        StackEqual{S,T}(s, t)  ==>  StackEqual{T,S}(t, s);
    lemma StackEqual_Transitive{S,T,U}:
      \forall Stack *s, *t, *u;
        StackEqual{S,T}(s, t)  ==>
        StackEqual{T,U}(t, u)  ==>
        StackEqual{S,U}(s, u);
  }
*/
/*@
    requires valid:    \valid(s) && StackInvariant(s);
    assigns            \nothing;
    ensures empty:     \result == 1  <==>  StackEmpty(s);
    ensures not_empty: \result == 0  <==> !StackEmpty(s);
*/
bool
stack_empty(const Stack* s);
/*@
  requires valid:  \valid(s) && StackInvariant(s);
  requires valid:  \valid(t) && StackInvariant(t);
  requires equal:  StackEqual{Here,Here}(s, t);
  assigns          \nothing;
  ensures  StackEmpty(s) && StackEmpty(t) ==> \result == true;
  ensures  (!StackEmpty(s) && StackEmpty(t)) || (StackEmpty(s) && !StackEmpty(t)) || (!StackEmpty(s) && !StackEmpty(t)) ==> \result == false;
*/
bool
stack_empty_wd(const Stack* s, const Stack* t)
{
  return stack_empty(s) && stack_empty(t);
}
int main(){
  value_type a[5] = {1, 2, 3, 4, 5};
  value_type b[5] = {1, 2, 3, 4, 5};
  Stack s1, s2;
  s1.capacity = 5;
  s1.size = 5;
  s1.obj = a;
  s2.capacity = 5;
  s2.size = 5;
  s2.obj = b;
  bool result = stack_empty_wd(&s1, &s2);
  //@ assert result == false;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (c != n) {
    //@ assert c <= n;
  }
}

Output:
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  /*@
  loop invariant n-c;
  loop invariant n - c;
  loop invariant c <= n;
  loop invariant 0 <= c;
  loop assigns c;
  */
  while (unknown()) {
    if (unknown()) {
      if (c > n) {
        c = c + 1;
      }
    } else {
      if (c == n) {
        c = 1;
      }
    }
  }
  if (c != n) {
    //@ assert c <= n;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int divide(int a, int b)
{
	return a / b;
}
int main(){
	int a = 10;
    int b = 2;
    int c = divide(a, b);
    //@ assert c == 5;
}

Output:
/*@
    requires b != 0;
    requires b != -1;
    assigns \nothing;
    ensures \result == a / b;
 */
int divide(int a, int b)
{
	return a / b;
}
int main(){
	int a = 10;
    int b = 2;
    int c = divide(a, b);
    //@ assert c == 5;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
requires \valid(a) && \valid(b);
assigns *a, *b;
ensures *a == \old(*b) && *b == \old(*a);
*/
void swap(int* a, int* b);
void
swap_ranges(value_type* a, size_type n, value_type* b)
{
  for (size_type i = 0u; i < n; ++i) {
    swap(a + i, b + i);
  }
}
int main(){
  value_type a[] = {1, 2, 3, 4, 5};
  value_type b[] = {6, 7, 8, 9, 10};
  int n = 5;
  swap_ranges(a, n, b);
  //@ assert a[0] == 6 && b[0] == 1;
  //@ assert a[1] == 7 && b[1] == 2;
  //@ assert a[2] == 8 && b[2] == 3;
  //@ assert a[3] == 9 && b[3] == 4;
  //@ assert a[4] == 10 && b[4] == 5;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
*/
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
requires \valid(a) && \valid(b);
assigns *a, *b;
ensures *a == \old(*b) && *b == \old(*a);
*/
void swap(int* a, int* b);
/*@
  requires valid:  \valid(a + (0..n-1));
  requires valid:  \valid(b + (0..n-1));
  requires sep:    \separated(a+(0..n-1), b+(0..n-1));
  assigns          a[0..n-1];
  assigns          b[0..n-1];
  ensures equal:   Equal{Old,Here}(a, n, b);
  ensures equal:   Equal{Old,Here}(b, n, a);
*/
void
swap_ranges(value_type* a, size_type n, value_type* b)
{
  /*@
    loop invariant bound:  0 <= i <= n;
    loop invariant equal:  Equal{Pre,Here}(a, i, b);
    loop invariant equal:  Equal{Pre,Here}(b, i, a);
    loop invariant unchanged:  Unchanged{Pre,Here}(a, i, n);
    loop invariant unchanged:  Unchanged{Pre,Here}(b, i, n);
    loop assigns i, a[0..n-1], b[0..n-1];
    loop variant n-i;
  */
  for (size_type i = 0u; i < n; ++i) {
    swap(a + i, b + i);
  }
}
int main(){
  value_type a[] = {1, 2, 3, 4, 5};
  value_type b[] = {6, 7, 8, 9, 10};
  int n = 5;
  swap_ranges(a, n, b);
  //@ assert a[0] == 6 && b[0] == 1;
  //@ assert a[1] == 7 && b[1] == 2;
  //@ assert a[2] == 8 && b[2] == 3;
  //@ assert a[3] == 9 && b[3] == 4;
  //@ assert a[4] == 10 && b[4] == 5;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void reverse(int a[], int res[], int size)
{
   int i;
   for(i = size - 1; i >= 0; --i) {
      res[i] = a[size - i - 1];
   }
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a[] = {1,2,3,4,5,6,7,8,9,10};
   int size = sizeof(a) / sizeof(a[0]);
   reverse(a, b, size);
   //@ assert \forall integer i; 0 <= i < size ==> b[i] == a[size - i - 1];
}
#endif

Output:
/*@ requires size >= 0;
    requires \valid(a+(0..size-1));
    requires \valid(res+(0..size-1));
    assigns res[0..size-1];
    ensures \forall integer i; 0 <= i < size ==> res[i] == a[size - i - 1];
 */
void reverse(int a[], int res[], int size)
{
   int i;
   /*@ loop invariant -1 <= i < size;
       loop invariant \forall integer j; i < j < size ==> res[j] == a[size - j - 1];
       loop assigns i, res[0..size-1];
       loop variant i;
    */
   for(i = size - 1; i >= 0; --i) {
      res[i] = a[size - i - 1];
   }
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a[] = {1,2,3,4,5,6,7,8,9,10};
   int size = sizeof(a) / sizeof(a[0]);
   reverse(a, b, size);
   //@ assert \forall integer i; 0 <= i < size ==> b[i] == a[size - i - 1];
}
#endif

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int array_max_advanced(int* arr, int n) {
    int max = arr[0];
    for (int i = 0; i < n; i++) {
        if (arr[i] > max) {
            max = arr[i];
        }
    }
    //@ assert \forall integer j; 0 <= j < n ==> arr[j] <= max;
    return max;
}

Output:
/*@
    requires n > 0;
    requires \valid(arr+(0..n-1));
    ensures \forall integer i; 0 <= i < n ==> arr[i] <= \result;
    assigns \nothing;
*/
int array_max_advanced(int* arr, int n) {
    int max = arr[0];
    /*@
        loop invariant 0 <= i <= n;
        loop invariant \forall integer j; 0 <= j < i ==> arr[j] <= max;
        loop assigns i, max;
        loop variant n - i;
    */
    for (int i = 0; i < n; i++) {
        if (arr[i] > max) {
            max = arr[i];
        }
    }
    //@ assert \forall integer j; 0 <= j < n ==> arr[j] <= max;
    return max;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires x >= 0;
requires y >= 0;
requires x >= y;
*/
void foo(int x, int y) {
  int i = 0;
  while (unknown()) {
    if (i < y)
    {
      i = i + 1;
    }
  }
  if (i <= y) {
    //@ assert i <= x;
  }
}

Output:
/*@
requires x >= 0;
requires y >= 0;
requires x >= y;
*/
void foo(int x, int y) {
  int i = 0;
  /*@
  loop invariant y <= x;
  loop invariant i <= x;
  loop invariant 0 <= y;
  loop invariant 0 <= x;
  loop invariant i <= y;
  loop invariant i <= y + 1;
  loop invariant 0 <= i;
  loop assigns x,y,i;
  */
  while (unknown()) {
    if (i < y)
    {
      i = i + 1;
    }
  }
  if (i <= y) {
    //@ assert i <= x;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int main() {
  int x = -5000;
  int y = 0;
  while ((x < 0)) {
    x  = x + y;
    y  = y + 1;
  }
  //@ assert y > 0;
}

Output:
int main() {
  int x = -5000;
  int y = 0;
  /*@
  loop invariant x >= 0 ==> y > 0;
  loop invariant -5000 <= x;
  loop invariant -5000 <= x + y;
  loop invariant 0 <= y;
  loop assigns y,x;
  */
  while ((x < 0)) {
    x  = x + y;
    y  = y + 1;
  }
  //@ assert y > 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires n >= 0;
*/
void foo(int n) {
  int x = n;
  int y = 0;
  while (x > 0) {
    y  = y + 1;
    x  = x - 1;
  }
  //@ assert y == n;
}

Output:
/*@
requires n >= 0;
*/
void foo(int n) {
  int x = n;
  int y = 0;
  /*@
  loop invariant y == n - x;
  loop invariant y <= n;
  loop invariant y + x == n;
  loop invariant x <= n;
  loop invariant 0 <= y;
  loop invariant 0 <= x;
  loop assigns y;
  loop assigns x;
  */
  while (x > 0) {
    y  = y + 1;
    x  = x - 1;
  }
  //@ assert y == n;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic WeaklyIncreasing
  {
    predicate
    WeaklyIncreasing{L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n-1  ==>  a[i] <= a[i+1];
    predicate
    WeaklyIncreasing{L}(value_type* a, integer n) = WeaklyIncreasing{L}(a, 0, n);
  }
*/
/*@
  axiomatic Increasing
  {
    predicate
    Increasing{L}(value_type* a, integer m, integer n) =
      \forall integer i, j; m <= i < j < n  ==>  a[i] <= a[j];
    predicate
    Increasing{L}(value_type* a, integer n) = Increasing{L}(a, 0, n);
  }
*/
/*@
  axiomatic ArrayBounds
  {
    predicate
    LowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v <= a[i];
    predicate
    LowerBound{L}(value_type* a, integer n, value_type v) =
      LowerBound{L}(a, 0, n, v);
    predicate
    StrictLowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v < a[i];
    predicate
    StrictLowerBound{L}(value_type* a, integer n, value_type v) =
      StrictLowerBound{L}(a, 0, n, v);
    predicate
    UpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] <= v;
    predicate
    UpperBound{L}(value_type* a, integer n, value_type v) =
      UpperBound{L}(a, 0, n, v);
    predicate
    StrictUpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] < v;
    predicate
    StrictUpperBound{L}(value_type* a, integer n, value_type v) =
      StrictUpperBound{L}(a, 0, n, v);
  }
*/
size_type
lower_bound(const value_type* a, size_type n, value_type v)
{
  size_type left  = 0u;
  size_type right = n;
  while (left < right) {
    const size_type middle = left + (right - left) / 2u;
    if (a[middle] < v) {
      left = middle + 1u;
    }
    else {
      right = middle;
    }
  }
  //@ assert LowerBound(a, left, n, v);
  return left;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic WeaklyIncreasing
  {
    predicate
    WeaklyIncreasing{L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n-1  ==>  a[i] <= a[i+1];
    predicate
    WeaklyIncreasing{L}(value_type* a, integer n) = WeaklyIncreasing{L}(a, 0, n);
  }
*/
/*@
  axiomatic Increasing
  {
    predicate
    Increasing{L}(value_type* a, integer m, integer n) =
      \forall integer i, j; m <= i < j < n  ==>  a[i] <= a[j];
    predicate
    Increasing{L}(value_type* a, integer n) = Increasing{L}(a, 0, n);
  }
*/
/*@
  axiomatic ArrayBounds
  {
    predicate
    LowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v <= a[i];
    predicate
    LowerBound{L}(value_type* a, integer n, value_type v) =
      LowerBound{L}(a, 0, n, v);
    predicate
    StrictLowerBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  v < a[i];
    predicate
    StrictLowerBound{L}(value_type* a, integer n, value_type v) =
      StrictLowerBound{L}(a, 0, n, v);
    predicate
    UpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] <= v;
    predicate
    UpperBound{L}(value_type* a, integer n, value_type v) =
      UpperBound{L}(a, 0, n, v);
    predicate
    StrictUpperBound{L}(value_type* a, integer m, integer n, value_type v) =
      \forall integer i; m <= i < n  ==>  a[i] < v;
    predicate
    StrictUpperBound{L}(value_type* a, integer n, value_type v) =
      StrictUpperBound{L}(a, 0, n, v);
  }
*/
/*@
  requires valid:      \valid_read(a + (0..n-1));
  requires increasing: Increasing(a, n);
  assigns              \nothing;
  ensures result:      0 <= \result <= n;
  ensures left:        StrictUpperBound(a, 0, \result, v);
  ensures right:       LowerBound(a, \result, n, v);
*/
size_type
lower_bound(const value_type* a, size_type n, value_type v)
{
  size_type left  = 0u;
  size_type right = n;
  /*@
    loop invariant bound:  0 <= left <= right <= n;
    loop invariant left:   StrictUpperBound(a, 0,  left, v);
    loop invariant right:  LowerBound(a, right, n, v);
    loop assigns left, right;
    loop variant right - left;
  */
  while (left < right) {
    const size_type middle = left + (right - left) / 2u;
    if (a[middle] < v) {
      left = middle + 1u;
    }
    else {
      right = middle;
    }
  }
  //@ assert LowerBound(a, left, n, v);
  return left;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires y >= 127;
*/
void foo(int y) {
  int c = 0;
  int z = 36 * y;
  while (unknown()) {
    if (c < 36)
    {
      z = z + 1;
      c = c + 1;
    }
  }
  if (z < 0) {
    if (z >= 4608)  {
      //@ assert c >= 36;
    }
  }
}

Output:
/*@
requires y >= 127;
*/
void foo(int y) {
  int c = 0;
  int z = 36 * y;
  /*@
  loop invariant z == 36*y + c;
  loop invariant z == 36 * y + c;
  loop invariant z == (36 * y) + c;
  loop invariant z <= 36 * y + 36;
  loop invariant z < 0 ==> z >= 4608 ==> c >= 36;
  loop invariant c <= 36;
  loop invariant 36*y <= z;
  loop invariant 36 * y <= z;
  loop invariant 0 <= c;
  loop assigns z;
  loop assigns c;
  */
  while (unknown()) {
    if (c < 36)
    {
      z = z + 1;
      c = c + 1;
    }
  }
  if (z < 0) {
    if (z >= 4608)  {
      //@ assert c >= 36;
    }
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include<stdio.h>
int* reverse(int a[], int n, int b[]) {
	int i = 0;
	while(i<n) {
		b[i]=a[n-i-1];
		i++;
	}
	return b;
}
void main() {
	int a[] = {21, 24, 23, 24, 25};
	int b[10];
	int* c = reverse(a, 5, b);
	//@ assert \forall integer k; 0 <= k < 5 ==> c[k] == a[5-k-1];
}

Output:
#include<stdio.h>
/*@
	requires n>=0&&\valid_read(a+(0..n-1));
	assigns b[0..n-1];
	ensures \forall integer k;0<=k<n==>a[n-k-1]==\result[k];
*/
int* reverse(int a[], int n, int b[]) {
	int i = 0;
	/*@
		loop invariant 0<=i<=n;
		loop invariant \forall integer k;0<=k<i==>a[n-k-1]==b[k];
		loop assigns b[0..n-1],i;
		loop variant n-i;
	*/
	while(i<n) {
		b[i]=a[n-i-1];
		i++;
	}
	return b;
}
void main() {
	int a[] = {21, 24, 23, 24, 25};
	int b[10];
	int* c = reverse(a, 5, b);
	//@ assert \forall integer k; 0 <= k < 5 ==> c[k] == a[5-k-1];
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void main() {
  int c = 0;
  while (unknown()) {
      if (unknown()) {
        if (c != 4) {
          c = c + 1;
        }
      } else {
        if (c == 4) {
          c = 1;
        }
      }
  }
  if (c != 4){
    //@ assert c <= 4;
  }
}

Output:
void main() {
  int c = 0;
  /*@
  loop invariant c <= 4;
  loop invariant c != 4 ==> c < 4;
  loop invariant \exists integer k; 0 <= k <= 4 && c == k;
  loop invariant 0 <= c;
  loop assigns c;
  */
  while (unknown()) {
      if (unknown()) {
        if (c != 4) {
          c = c + 1;
        }
      } else {
        if (c == 4) {
          c = 1;
        }
      }
  }
  if (c != 4){
    //@ assert c <= 4;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#ifndef TYPEDEFS_H_INCLUDED
#define TYPEDEFS_H_INCLUDED
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
#endif
#include<limits.h>
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
  axiomatic UnchangedLemmas
  {
    lemma Unchanged_Shrink{K,L}:
      \forall value_type *a, integer m, n, p, q;
         m <= p <= q <= n         ==>
         Unchanged{K,L}(a, m, n)  ==>
         Unchanged{K,L}(a, p, q);
    lemma Unchanged_Extend{K,L}:
      \forall value_type *a, integer n;
        Unchanged{K,L}(a, n)        ==>
        \at(a[n],K) == \at(a[n],L)  ==>
        Unchanged{K,L}(a, n+1);
    lemma Unchanged_Symmetric{K,L}:
      \forall value_type *a, integer m, n;
        Unchanged{K,L}(a, m, n)  ==>
        Unchanged{L,K}(a, m, n);
    lemma Unchanged_Transitive{K,L,M}:
      \forall value_type *a, integer m, n;
        Unchanged{K,L}(a, m, n)  ==>
        Unchanged{L,M}(a, m, n)  ==>
        Unchanged{K,M}(a, m, n);
  }
  axiomatic Accumulate
  {
    logic integer
    Accumulate{L}(value_type* a, integer n, integer init) =
      n <= 0 ? init : Accumulate(a, n-1, init) + a[n-1];
    predicate
    AccumulateBounds{L}(value_type* a, integer n, value_type init) =
      \forall integer i; 0 <= i <= n  ==>
        VALUE_TYPE_MIN <= Accumulate(a, i, init) <= VALUE_TYPE_MAX;
    lemma Accumulate_Init:
      \forall value_type *a, init, integer n;
         n <= 0  ==>  Accumulate(a, n, init) == init;
  }
*/
value_type
accumulate(const value_type* a, size_type n, value_type init)
{
  for (size_type i = 0u; i < n; ++i) {
    //@ assert rte_help: init + a[i] == Accumulate(a, i+1, \at(init,Pre));
    init = init + a[i];
  }
  return init;
}

Output:
#ifndef TYPEDEFS_H_INCLUDED
#define TYPEDEFS_H_INCLUDED
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
#endif
#include<limits.h>
/*@
  axiomatic Unchanged
  {
    predicate
    Unchanged{K,L}(value_type* a, integer m, integer n) =
      \forall integer i; m <= i < n ==>  \at(a[i],K) == \at(a[i],L);
    predicate
    Unchanged{K,L}(value_type* a, integer n) = Unchanged{K,L}(a, 0, n);
  }
  axiomatic UnchangedLemmas
  {
    lemma Unchanged_Shrink{K,L}:
      \forall value_type *a, integer m, n, p, q;
         m <= p <= q <= n         ==>
         Unchanged{K,L}(a, m, n)  ==>
         Unchanged{K,L}(a, p, q);
    lemma Unchanged_Extend{K,L}:
      \forall value_type *a, integer n;
        Unchanged{K,L}(a, n)        ==>
        \at(a[n],K) == \at(a[n],L)  ==>
        Unchanged{K,L}(a, n+1);
    lemma Unchanged_Symmetric{K,L}:
      \forall value_type *a, integer m, n;
        Unchanged{K,L}(a, m, n)  ==>
        Unchanged{L,K}(a, m, n);
    lemma Unchanged_Transitive{K,L,M}:
      \forall value_type *a, integer m, n;
        Unchanged{K,L}(a, m, n)  ==>
        Unchanged{L,M}(a, m, n)  ==>
        Unchanged{K,M}(a, m, n);
  }
  axiomatic Accumulate
  {
    logic integer
    Accumulate{L}(value_type* a, integer n, integer init) =
      n <= 0 ? init : Accumulate(a, n-1, init) + a[n-1];
    predicate
    AccumulateBounds{L}(value_type* a, integer n, value_type init) =
      \forall integer i; 0 <= i <= n  ==>
        VALUE_TYPE_MIN <= Accumulate(a, i, init) <= VALUE_TYPE_MAX;
    lemma Accumulate_Init:
      \forall value_type *a, init, integer n;
         n <= 0  ==>  Accumulate(a, n, init) == init;
  }
*/
/*@
  requires valid:  \valid_read(a + (0..n-1));
  requires bounds: AccumulateBounds(a, n, init);
  assigns          \nothing;
  ensures  result: \result == Accumulate(a, n, init);
*/
value_type
accumulate(const value_type* a, size_type n, value_type init)
{
  /*@
    loop invariant index:    0 <= i <= n;
    loop invariant partial:  init == Accumulate(a, i, \at(init,Pre));
    loop assigns i, init;
    loop variant n-i;
  */
  for (size_type i = 0u; i < n; ++i) {
    //@ assert rte_help: init + a[i] == Accumulate(a, i+1, \at(init,Pre));
    init = init + a[i];
  }
  return init;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic HasSubRange
  {
    predicate
    HasSubRange{L}(value_type* a, integer m, integer n, value_type* b, integer p) =
      \exists integer k; (m <= k <= n-p) && Equal{L,L}(a+k, p, b);
    predicate
    HasSubRange{L}(value_type* a, integer n, value_type* b, integer p) =
      HasSubRange{L}(a, 0, n, b, p);
    lemma HasSubRange_Sizes:
      \forall value_type *a, *b, integer m, n, p;
        HasSubRange(a, m, n, b, p)  ==>  p <= n-m;
  }
*/
/*@
  requires valid:  \valid_read(a + (0..n-1));
  requires valid:  \valid_read(b + (0..n-1));
  assigns          \nothing;
  ensures result:  \result <==> Equal{Here,Here}(a, n, b);
*/
bool
equal(const value_type* a, size_type n, const value_type* b);
size_type
find_end(const value_type* a, size_type n,
         const value_type* b, size_type p)
{
  size_type r = n;
  if ((0u < p) && (p <= n)) {
    for (size_type i = 0u; i <= n - p; ++i) {
      if (equal(a + i, p, b)) {
        r = i;
      }
    }
  }
  //@ assert !HasSubRange(a, r + 1, n, b, p);
  return r;
}

Output:
#include <limits.h>
#ifndef __cplusplus
typedef int bool;
#define false		((bool)0)
#define true		((bool)1)
#endif
typedef int value_type;
#define VALUE_TYPE_MAX  INT_MAX
#define VALUE_TYPE_MIN  INT_MIN
typedef unsigned int size_type;
#define SIZE_TYPE_MAX  UINT_MAX
/*@
  axiomatic Equal
  {
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, value_type* b) =
      \forall integer i; m <= i < n  ==>  \at(a[i],K) == \at(b[i],L);
    predicate
    Equal{K,L}(value_type* a, integer n, value_type* b) =
      Equal{K,L}(a, 0, n, b);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n,
               value_type* b, integer p) = Equal{K,L}(a+m, n-m, b+p);
    predicate
    Equal{K,L}(value_type* a, integer m, integer n, integer p) =
      Equal{K,L}(a, m, n, a, p);
  }
*/
/*@
  axiomatic HasSubRange
  {
    predicate
    HasSubRange{L}(value_type* a, integer m, integer n, value_type* b, integer p) =
      \exists integer k; (m <= k <= n-p) && Equal{L,L}(a+k, p, b);
    predicate
    HasSubRange{L}(value_type* a, integer n, value_type* b, integer p) =
      HasSubRange{L}(a, 0, n, b, p);
    lemma HasSubRange_Sizes:
      \forall value_type *a, *b, integer m, n, p;
        HasSubRange(a, m, n, b, p)  ==>  p <= n-m;
  }
*/
/*@
  requires valid:  \valid_read(a + (0..n-1));
  requires valid:  \valid_read(b + (0..n-1));
  assigns          \nothing;
  ensures result:  \result <==> Equal{Here,Here}(a, n, b);
*/
bool
equal(const value_type* a, size_type n, const value_type* b);
/*@
  requires valid:   \valid_read(a + (0..n-1));
  requires valid:   \valid_read(b + (0..p-1));
  assigns           \nothing;
  ensures result:   0 <= \result <= n;
  behavior has_match:
    assumes         HasSubRange(a, n, b, p);
    assigns         \nothing;
    ensures bound:  0 <= \result <= n-p;
    ensures result: Equal{Here,Here}(a + \result, p, b);
    ensures last:   !HasSubRange(a, \result + 1, n, b, p);
  behavior no_match:
    assumes         !HasSubRange(a, n, b, p);
    assigns         \nothing;
    ensures result: \result == n;
  complete behaviors;
  disjoint behaviors;
*/
size_type
find_end(const value_type* a, size_type n,
         const value_type* b, size_type p)
{
  size_type r = n;
  if ((0u < p) && (p <= n)) {
    /*@
      loop invariant bound   :  r <= n - p || r == n;
      loop invariant not_found: r == n ==> !HasSubRange(a, p+i-1, b, p);
      loop invariant found:     r < n  ==> Equal{Here,Here}(a+r, p, b);
      loop invariant last:      r < n  ==> !HasSubRange(a, r+1, i+p-1, b, p);
      loop assigns i, r;
      loop variant n - i;
    */
    for (size_type i = 0u; i <= n - p; ++i) {
      if (equal(a + i, p, b)) {
        r = i;
      }
    }
  }
  //@ assert !HasSubRange(a, r + 1, n, b, p);
  return r;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void div_rem(unsigned x, unsigned y, unsigned* q, unsigned* r) {
    *q = x / y;
    *r = x % y;
}
void main() {
    unsigned q, r;
    div_rem(10, 3, &q, &r);
    //@ assert q == 3;
    //@ assert r == 1;
}

Output:
/*@
    requires \valid(q) && \valid(r);
    requires \separated(q, r);
    requires y != 0;
    assigns *q, *r;
    ensures x == *q * y + *r;
    ensures *r < y;
*/
void div_rem(unsigned x, unsigned y, unsigned* q, unsigned* r) {
    *q = x / y;
    *r = x % y;
}
void main() {
    unsigned q, r;
    div_rem(10, 3, &q, &r);
    //@ assert q == 3;
    //@ assert r == 1;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@ axiomatic Factorial {
    logic integer factorial(integer i);
    axiom nil:
       factorial(0) == 1;
    axiom step:
       \forall integer i; i >= 0 ==>
          factorial(i) == factorial(i - 1) * i;
    lemma non_negative:
       \forall integer i; i >= 0 ==>
          factorial(i) > 0;
    }
 */
#define SPEC_ULONG_MAX 18446744073709551615UL
unsigned long factorial(unsigned i)
{
	unsigned long f = 1;
	while (i) {
		f *= i--;
	}
	return f;
}
int main(){
    unsigned long f = factorial(5);
    //@ assert f == 120;
}

Output:
/*@ axiomatic Factorial {
    logic integer factorial(integer i);
    axiom nil:
       factorial(0) == 1;
    axiom step:
       \forall integer i; i >= 0 ==>
          factorial(i) == factorial(i - 1) * i;
    lemma non_negative:
       \forall integer i; i >= 0 ==>
          factorial(i) > 0;
    }
 */
#define SPEC_ULONG_MAX 18446744073709551615UL
/*@ requires factorial(i) <= SPEC_ULONG_MAX;
    assigns \nothing;
    ensures \result == factorial(i);
 */
unsigned long factorial(unsigned i)
{
	unsigned long f = 1;
	/*@ loop invariant 0 <= i;
	    loop assigns f, i;
	    loop variant i;
	  */
	while (i) {
		f *= i--;
	}
	return f;
}
int main(){
    unsigned long f = factorial(5);
    //@ assert f == 120;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
requires 1 <= n;
*/
void foo(int n) {
  int i = 1;
  int sn = 0;
  while (i <= n) {
    i = i + 1;
    sn = sn + 1;
  }
  if (sn != 0) {
    //@ assert sn == n;
  }
}

Output:
/*@
requires 1 <= n;
*/
void foo(int n) {
  int i = 1;
  int sn = 0;
  /*@
  loop invariant sn == i-1;
  loop invariant sn == i - 1;
  loop invariant i <= n+1;
  loop invariant 1 <= i;
  loop assigns sn;
  loop assigns i;
  */
  while (i <= n) {
    i = i + 1;
    sn = sn + 1;
  }
  if (sn != 0) {
    //@ assert sn == n;
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void increment_array_by(int* arr, int n, int c) {
    for (int  i = 0; i < n; i++) {
        arr[i] = arr[i] + c;
    }
     //@ assert \forall integer k; 0 <= k < n ==> arr[k] == (\at(arr[k], Pre) + c);
}
int main(){
    int arr[10] = {1,2,3,4,5,6,7,8,9,10};
    Label_a:
    increment_array_by(arr, 10, 1);
    //@ assert \forall integer k; 0 <= k < 10 ==> arr[k] == (\at(arr[k], Label_a) + 1);
}

Output:
/*@
    requires n > 0;
    requires \valid_read(arr+(0..n-1));
    ensures \forall integer k; 0 <= k < n ==> arr[k] == (\at(arr[k], Pre) + c);
*/
void increment_array_by(int* arr, int n, int c) {
    /*@
        loop invariant 0 <= i <= n;
        loop invariant \forall integer k; 0 <= k < i ==> arr[k] == \at(arr[k], Pre) + c;
        loop invariant \forall integer k; i <= k < n ==> arr[k] == \at(arr[k], Pre);
        loop assigns i, arr[0..n-1];
    */
    for (int  i = 0; i < n; i++) {
        arr[i] = arr[i] + c;
    }
}
int main(){
    int arr[10] = {1,2,3,4,5,6,7,8,9,10};
    Label_a:
    increment_array_by(arr, 10, 1);
    //@ assert \forall integer k; 0 <= k < 10 ==> arr[k] == (\at(arr[k], Label_a) + 1);
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
void div_rem(unsigned x, unsigned y, unsigned* q, unsigned* r){
     *q = x / y ;
     *r = x % y ;
}
int main() {
    unsigned x = 10, y = 3;
    unsigned q, r;
    div_rem(x, y, &q, &r);
    //@ assert q == 3 && r == 1;
    return 0;
}

Output:
/*@
    requires valid_pointers: \valid(q) && \valid(r);
    requires \separated(q, r);
    requires no_divide_by_zero: y != 0;
    assigns *q, *r;
    ensures *q == x / y;
    ensures *r == x % y;
*/
void div_rem(unsigned x, unsigned y, unsigned* q, unsigned* r){
     *q = x / y ;
     *r = x % y ;
}
int main() {
    unsigned x = 10, y = 3;
    unsigned q, r;
    div_rem(x, y, &q, &r);
    //@ assert q == 3 && r == 1;
    return 0;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


nabinkrsah_Computing the mod with precondition and postcondition

Computing the integer square root with precondition and postcondition

Input:
int my_mod(int a, int b){
	int c = a * a;
	int d = c * 3;
	return d % b;
}

void main(){
	int x1 = 5;
	int x2 = 10;
	int y1 = my_mod(x1, 2);
	int y2 = my_mod(x2, 2);
	//@ assert y1 != y2;
}

Output:
/*@
	requires b >= 0;
	ensures \result == (a * a * 3) % b;
*/
int my_mod(int a, int b){
	int c = a * a;
	int d = c * 3;
	return d % b;
}

void main(){
	int x1 = 5;
	int x2 = 10;
	int y1 = my_mod(x1, 2);
	int y2 = my_mod(x2, 2);
	//@ assert y1 != y2;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int max3(int a,int b,int c) {
      int max;
      if((a >= b) && (a >= c)) {
        max = a;
      }
      else if((b >= a) && (b >= c)) {
        max = b;
      }
      else if((c >= a) && (c >= b)) {
        max = c;
      }
    return max;
}
int main(){
    int a = 10;
    int b = 20;
    int c = 30;
    int max = max3(a,b,c);
    //@ assert max == 30;
}

Output:
/*@
    ensures \result>=a && \result>=b && \result>=c;
    ensures \result==a || \result==b || \result==c;
    ensures a>=b && a>=c ==> \result==a;
    ensures b>=a && b>=c ==> \result==b;
    ensures c>=a && c>=b ==> \result==c;
*/
int max3(int a,int b,int c) {
      int max;
      if((a >= b) && (a >= c)) {
        max = a;
      }
      else if((b >= a) && (b >= c)) {
        max = b;
      }
      else if((c >= a) && (c >= b)) {
        max = c;
      }
    return max;
}
int main(){
    int a = 10;
    int b = 20;
    int c = 30;
    int max = max3(a,b,c);
    //@ assert max == 30;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@
predicate is_dset{L}(int *a, integer n) =
  \forall integer i; 0 <= i < n ==> (a[i] == 0 || a[i] == 1);
predicate is_eq{L1,L2}(int *a, integer n) =
  \forall integer i; 0 <= i < n ==> \at(a[i],L1) == \at(a[i],L2);
predicate lt{L1,L2}(int* a, integer i) =
  \at(a[i],L1) < \at(a[i],L2);
*/
int nextSubset(int s[], int n) {
  int i,k;
  for (k = n-1; k >= 0; k--) { if (s[k] == 0) { break; } }
  if (k == -1) { return -1; }
  s[k] = 1;
  for (i = k+1; i < n; i++) { s[i] = 0; }
  //@ assert is_dset(s,n);
  return k;
}

Output:
/*@
predicate is_dset{L}(int *a, integer n) =
  \forall integer i; 0 <= i < n ==> (a[i] == 0 || a[i] == 1);
predicate is_eq{L1,L2}(int *a, integer n) =
  \forall integer i; 0 <= i < n ==> \at(a[i],L1) == \at(a[i],L2);
predicate lt{L1,L2}(int* a, integer i) =
  \at(a[i],L1) < \at(a[i],L2);
*/
/*@
requires n >= 0 && n <= 3 && \valid(s+(0..n-1));
requires is_dset(s,n);
assigns s[0..n-1];
 ensures is_dset(s,n);
 ensures -1 <= \result < n;
ensures \result == -1 ==> is_eq{Pre,Post}(s,n);
ensures \result != -1 ==> is_eq{Pre,Post}(s,\result);
ensures \result != -1 ==> lt{Pre,Post}(s,\result);
*/
int nextSubset(int s[], int n) {
  int i,k;
  /*@ loop invariant -1 <= k <= n-1;
     loop assigns k;
     loop variant k; */
  for (k = n-1; k >= 0; k--) { if (s[k] == 0) { break; } }
  if (k == -1) { return -1; }
  s[k] = 1;
  /*@ loop invariant k+1 <= i <= n;
     loop invariant is_dset(s,i);
     loop assigns i,s[k+1..n-1];
     loop variant n-i; */
  for (i = k+1; i < n; i++) { s[i] = 0; }
  //@ assert is_dset(s,n);
  return k;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
/*@ axiomatic Factorial {
    logic integer factorial(integer i);
    axiom nil:
       factorial(0) == 1;
    axiom step:
       \forall integer i; i >= 0 ==>
          factorial(i) == factorial(i - 1) * i;
    lemma non_negative:
       \forall integer i; i >= 0 ==>
          factorial(i) > 0;
    }
 */
#define SPEC_ULONG_MAX 18446744073709551615UL
unsigned long factorial(unsigned i)
{
   unsigned long f = 1;
   while (i) {
      f *= i--;
   }
   return f;
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a = factorial(5);
   int b = factorial(0);
   //@ assert a == 120;
   //@ assert b == 1;
}
#endif

Output:
/*@ axiomatic Factorial {
    logic integer factorial(integer i);
    axiom nil:
       factorial(0) == 1;
    axiom step:
       \forall integer i; i >= 0 ==>
          factorial(i) == factorial(i - 1) * i;
    lemma non_negative:
       \forall integer i; i >= 0 ==>
          factorial(i) > 0;
    }
 */
#define SPEC_ULONG_MAX 18446744073709551615UL
/*@ requires factorial(i) <= SPEC_ULONG_MAX;
    assigns \nothing;
    ensures \result == factorial(i);
 */
unsigned long factorial(unsigned i)
{
   unsigned long f = 1;
   /*@ loop invariant 0 <= i;
       loop assigns f, i;
       loop variant i;
    */
   while (i) {
      f *= i--;
   }
   return f;
}
#ifdef OUT_OF_TASK
#include <stdio.h>
int main(void)
{
   int a = factorial(5);
   int b = factorial(0);
   //@ assert a == 120;
   //@ assert b == 1;
}
#endif

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int found;
/*@
requires \valid(t+(0..4));
*/
void f(int*t, int x) {
  int i = 0;
  found = 0;
 first_loop:
  for(; i <= 4; i++) {
    if(t[i] == x)
      found = 1;
  }
  //@ assert found <==> \exists integer i; 0 <= i <= 4 && t[i] == x;
}

Output:
int found;
/*@
requires \valid(t+(0..4));
*/
void f(int*t, int x) {
  int i = 0;
  found = 0;
 first_loop:
  /*@
  loop invariant 0 <= i <= 5;
  loop invariant found <==> (\exists integer k; 0 <= k < i && t[k] == x);
  loop assigns found, i;
  */
  for(; i <= 4; i++) {
    if(t[i] == x)
      found = 1;
  }
  //@ assert found <==> \exists integer i; 0 <= i <= 4 && t[i] == x;
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.


Input:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  while (unknown()) {
      if (unknown()) {
        if (c != n) {
          c  = c + 1;
        }
      } else {
        if (c == n) {
          c = 1;
        }
      }
  }
  if (c < 0) {
    if (c > n) {
      //@ assert c == n;
    }
  }
}

Output:
int unknown();
/*@
requires n > 0;
*/
void foo(int n) {
  int c = 0;
  // loop body
  /*@
  loop invariant 0 <= c;
  loop assigns n,c;
  */
  while (unknown()) {
      if (unknown()) {
        if (c != n) {
          c  = c + 1;
        }
      } else {
        if (c == n) {
          c = 1;
        }
      }
  }
  if (c < 0) {
    if (c > n) {
      //@ assert c == n;
    }
  }
}

Please write ACSL specification for the given C code ensuring its correctness.
You only need to return the completed ACSL formal specification together with C program without explanation.